Zscaler vs Cloudflare Gateway: Two Cloud Proxies, One Better Path

Zscaler and Cloudflare are both cloud proxies, which means the real question is not which one to pick, but whether you should be routing your traffic through anyone's data center at all. Both forward your users' traffic to their cloud, inspect it there, and send it on. That detour is the source of the latency and outage problems each has documented. dope.security takes the other path: it inspects traffic on the device and flies direct to the destination, with no backhaul. If you are weighing Zscaler against Cloudflare Gateway in 2026, weigh the architecture first, and if Zscaler is your incumbent, our complete guide to replacing Zscaler covers the full migration.

Zscaler vs Cloudflare: how they actually differ

Both are credible platforms, and they differ in maturity more than in model. Zscaler is the category incumbent, with the deepest SSE feature set and a proxy-in-the-cloud design where all traffic forwards to a ZEN or Service Edge node in the data path. Cloudflare is the newer entrant, fast at the edge, but Gartner has placed it as a Niche Player in the SSE Magic Quadrant from 2023 through 2025 rather than a Leader, and its enterprise SWG depth is gated behind its top contract plan.

The shared trait is the one that matters most. Both inspect in the cloud, so both add a network hop between your user and the destination, and both put a control plane in the path that becomes a single point of failure. The differences below are real, but they are differences between two versions of the same architecture. For the full displacement playbook, see our complete guide to replacing Zscaler.

The reliability record both vendors documented

Lead with the public record, because it is not in dispute. Zscaler took a multi-service outage on January 19, 2025 during scheduled maintenance, and back on October 25, 2022 a subset of ZIA proxies saw total packet loss after internal maintenance hit its own node addresses. The pattern is documented: the control plane is the weak spot, and several incidents were self-inflicted through maintenance. We track it in Zscaler outage history and the control plane.

Cloudflare's record is shorter but sharper. On November 18, 2025 it suffered its worst outage since 2019, when a single oversized configuration file panicked its core proxy and produced global 5xx errors for around five hours, taking down major sites along with it. During an earlier November 2, 2023 outage, most customers could not even access their raw logs. Because Cloudflare uses uniform anycast, there is no regional blast-radius isolation, so a global config problem is exactly that, global. Both records point to the same lesson: when inspection lives in one cloud, your security availability is tied to that cloud's worst day.

SSL inspection and the apps that break

Both platforms decrypt TLS in the cloud, and both run into the same wall: applications that pin their certificates. Zscaler documents that it cannot inspect cert-pinned apps like Microsoft 365, WebEx, and Dropbox without bypasses, and developer tools such as Docker, Python, and Git break under its inspection. Cloudflare's TLS decryption similarly breaks git, aws, kubectl, terraform, and Docker, and it has been documented to break the ChatGPT desktop app. The usual fix on both is a bypass list, and every bypass is a blind spot.

This is where the on-device model separates itself. Because dope.security performs SSL inspection on the device rather than in a cloud proxy, and surfaces SSL error notifications so admins can create the handful of needed bypasses in a few clicks, it handles cert-pinned traffic without routing everything through a remote node. Same inspection job, no detour, and a clear view of what is being bypassed and why.

Capability comparison

Factor	Zscaler	Cloudflare Gateway	dope.security
Architecture	Cloud proxy in data path	Cloud proxy, uniform anycast	On-device, fly direct
Documented outages	Jan 2025, Oct 2022	Nov 2025 (worst since 2019)	No central control plane in the path
Cert-pinned and dev tools	Bypass lists (M365, Docker, Git)	Breaks git, kubectl, Docker	On-device inspection, guided bypass
AI prompt DLP	Data Protection add-on	Beta, ~4 named apps	Native Dopamine DLP
Enterprise SWG depth	Stacked editions	Gated to Contract plan	Single platform, one console
China	China Premium / Plus uplift	Depends on JD Cloud, ICP filing	Works without a paid uplift

Competitor cells reflect documented vendor materials and dated post-mortems. dope.security inspects on the device, which removes the backhaul that drives the rest of the row.

Which is better for AI governance?

Neither cloud proxy makes AI governance simple. Zscaler's prompt-level DLP requires its Data Protection add-on, with AI scanning and coaching spread across separately licensed pieces on top of the base proxy, a stack we price out in the Zscaler AI governance add-on cost breakdown. Cloudflare's AI Prompt Protection shipped in beta in August 2025, covers only a handful of named apps, and its tenant control is header-based for Google and Microsoft only, far narrower than what real instance awareness requires. Worth noting, Cloudflare's own TLS inspection has been documented to break the ChatGPT desktop app, which is awkward for a tool meant to govern ChatGPT.

dope.security treats AI governance as part of the base product, not an add-on. Three layers cover discovery, web policy, and tenant control, so you can allow your corporate ChatGPT and block personal ChatGPT on the same domain, with Dopamine DLP inspecting the prompt itself. That is the test most cloud proxies need extra SKUs to attempt.

Pricing and packaging: what you actually pay for

The two vendors hide cost in opposite ways. Zscaler packages its capabilities into stacked editions, Business, Transformation, and Unlimited, so the feature you need often sits one edition up, and independent advisory has reported some Zscaler SKUs priced materially higher without a public announcement. The practical effect is that the quote you compare in year one is rarely the capability set you end up needing.

Cloudflare flips the model. Its free and entry tiers are generous, which is great for a small deployment, but the enterprise pieces that a security team actually wants, full DLP, remote browser isolation, unlimited CASB, and long log retention, are gated to the Contract plan. Its inline CASB also covers a much narrower set of application categories than a mature CASB, so the breadth you assume from the brand may not be there at the tier you can afford. With both vendors, the lesson is the same: map every module you need to a plan before you compare numbers, because the headline price and the working price are different.

dope.security keeps the SWG, CASB Neural, and Dopamine DLP under one platform and one console, so the AI governance and data protection are not separate towers to license. For a lean team, that single-console model is also where the operational savings come from, the same advantage we lay out in Zscaler Client Connector vs a lightweight agent.

Deployment and day-two operations

A platform is only as good as the rollout, and a cloud proxy adds steps an on-device agent does not. With either Zscaler or Cloudflare you are steering traffic to points of presence, managing forwarding, and building the bypass lists that cert-pinned and developer tools force. Those bypass lists then need ongoing care, because every one is a gap someone has to remember.

The on-device model collapses that work. dope.security deploys silently through Intune or Jamf, pushes policy in real time at the individual and group level, and uses SSL error notifications to make bypass creation a few clicks rather than a research project. The scale evidence is concrete: a Fortune 100 company moved from 900 to over 18,000 devices in a matter of weeks, around 3,000 per week, with the free production trial converting straight to a paid account and no throwaway proof-of-concept tenant, told in the Fortune 100 deployment story. When you are comparing two cloud proxies on features, it is easy to forget that the architecture also decides how hard the thing is to run once it is live.

The architecture question that settles it

Strip away the feature-by-feature scoring and one question decides the purchase: should your security live in someone else's data center, or on the device? Routing traffic to a cloud proxy is what creates the latency, the outage exposure, and the China uplift in the first place. Cloudflare versus Zscaler is a choice between two answers to a question dope.security does not ask, because the Fly Direct secure web gateway inspects on the endpoint with an agent under 100 MB of RAM and up to 4x the performance of legacy proxy SWGs. Greylock Partners made exactly this call, leaving a backhauled setup for dope.security and going from first proposal to signed contract in 27 days, told in the Greylock customer story. If China is in scope, our breakdown of whether Zscaler works in China shows why the uplift exists.

When Zscaler or Cloudflare is the right call

To be fair to both, there are situations where a cloud proxy fits. If you are a very large enterprise already standardized on Zscaler with a team that knows its console deeply, the switching cost can outweigh the architectural upside in the short term. If you are a developer-heavy shop that mainly wants Cloudflare's edge network and is comfortable living within its tiering, Gateway can be a reasonable entry point. Both vendors score well on independent reviews, and neither is a bad product in absolute terms.

The case for changing the model is strongest when your workforce is distributed, when latency and reliability are felt by users rather than just measured in a dashboard, when you have Mac fleets or people who travel to restricted geographies, and when AI governance needs to work without buying another tower of SKUs. That profile describes most mid-market and remote-first companies in 2026, and it is precisely where the backhaul tax stops being theoretical. The honest framing is not that the incumbents fail, it is that their architecture asks you to accept a detour their own outage post-mortems keep explaining. Our Netskope vs Zscaler comparison applies the same lens to the other leading proxy.

The bottom line

Comparing Zscaler and Cloudflare Gateway is comparing two cloud proxies that ask you to send your traffic away to be inspected. They differ on maturity, pricing structure, and feature depth, and both have documented outages and bypass lists that prove the cost of putting a control plane in the path. The better question is whether the detour needs to exist at all. dope.security inspects on the device and flies direct, which is why it sidesteps the reliability, latency, and geography problems both proxies carry. Compare the Cloudflare Gateway alternative and the Zscaler vs dope.security breakdowns, walk the full switch with our guide to replacing Zscaler, then start a free trial or book a 20-minute demo to see fly-direct inspection in action. The proxy you compare matters far less than the detour you can stop paying for.