We completed a full migration from Zscaler Internet Access (ZIA) to Cloudflare One six months ago. The primary driver was cost, but we also needed to modernize our stack away from the legacy proxy model. The marketing promises of "Zero Trust" and "the network of the future" are one thing; the operational reality is another. Here is a blunt, data-driven report on what worked, what didn't, and where we've landed on total cost of ownership.
**The Good: Performance and Developer Experience**
* **Latency:** This is Cloudflare's undeniable win. Average egress latency dropped by 62% compared to ZIA's closest PAC-determined DC. This is simply due to their network size. `curl` times for external API dependencies are noticeably faster.
* **Tunnel Simplicity:** `cloudflared` tunnels are superior to Zscaler's App Connectors in reliability and configuration clarity. Our Terraform for a tunnel is straightforward:
```hcl
resource "cloudflare_tunnel" "primary_tunnel" {
account_id = var.account_id
name = "prod-egress-tunnel"
secret = var.tunnel_secret
}
```
It just works. Zscaler's equivalent was a constant source of connection state alarms.
* **DNS and Gateway Integration:** Having DNS filtering (`1.1.1.3`) integrated directly into the Gateway SWG policy is seamless. Policy enforcement at the DNS layer for certain threat categories is efficient and low-overhead.
**The Bad and the Ugly: Policy Granularity and Logging**
* **Policy Engine Limitations:** This is the biggest regression from ZIA. Cloudflare's `http.request` and `dns.request` policies lack the deep, granular inspection of ZIA's Advanced Cloud Firewall. You cannot write a policy based on, for example, specific HTTP headers or URI path regex with the same control. Their WAF is separate, creating a split brain for inspection.
* **Logging is Aggressively Aggregated:** For a data-centric team, this is painful. Cloudflare One logs are sampled and aggregated for "high-volume" tenants. You lose the ability to perform detailed forensic analysis on every single request. ZIA's full log forwarding, while expensive, gave us complete visibility. We've had to rebuild certain security audits using statistical sampling, which introduces uncertainty.
* **Cost Model Shift:** While our upfront bill is lower, the cost model is opaque. You pay per "seat" (user) and for egress bandwidth after a generous allowance. High-volume data egress (like from our data warehouses) now directly impacts the security budget, which creates internal friction. With ZIA, it was a capped, predictable cost, albeit higher.
**The Verdict: Trade-offs Made Concrete**
We saved 34% in direct costs year-over-year. However, we incurred new, hidden costs:
1. Engineering time to work around policy limitations (approx. 3 person-weeks).
2. Increased spending on our SIEM to try to reconstruct visibility from sampled logs.
3. The operational risk of not having full-fidelity logs for critical incidents.
**Recommendation:** If your primary needs are performance, user experience, and basic URL/DNS filtering, Cloudflare One is a compelling, modern choice. If your compliance or security model requires deterministic, granular policies and 100% immutable log fidelity for all traffic, Zscaler still holds an edge, albeit at a premium price and with more operational complexity.
For us, the performance win was critical enough to accept the logging trade-off. We are mitigating the policy gaps by running a parallel, explicit forward proxy for a subset of sensitive services, which negates some of the simplicity we sought.
—davidr
—davidr