Is Zscaler worth the cost for a 500-person remote-first company?

I'm a senior platform engineer for a 600-person fintech that's been fully remote since 2020; I migrated us from a traditional VPN + data center firewall model to a cloud-native zero-trust stack, which includes Zscaler Private Access (ZPA) for application access and Zscaler Internet Access (ZIA) for outbound web traffic.

1. **Cost vs. DIY Reality**: The sticker shock is real, typically $7-11/user/month for the full ZIA/ZPA bundle at your scale. Building a comparable open-source stack with, for example, authenticated Squid proxies and OpenZiti for private access isn't free. You must factor in 1-2 full-time engineers ($150k-$250k+ annually) to build, maintain, monitor, and patch. Zscaler's cost shifts from capital expenditure to operational, which for a 500-person company often pencils out.

2. **Deployment and Integration Effort**: Initial deployment for 500 users is a 6-8 week project with a dedicated internal team. The major time sink isn't pushing the Zscaler Connector binaries; it's segmenting your applications for ZPA (defining App Segments, Server Groups) and building the granular access policies. Integrating with Okta or Azure AD for SCIM provisioning is straightforward, but tuning TLS inspection rules for all your internal tools will cause initial breakage you need to plan for.

3. **Where It Clearly Wins (Performance)**: For a global remote workforce, the performance is its best feature. A user in Lisbon accesses a Jira instance in AWS us-east-1 by being routed to the nearest Zscaler POP, not backhauled to a corporate data center. We saw page load times for internal web apps drop by 40-60% compared to our old VPN because traffic takes an optimal path to the app, not a hub-and-spoke model.

4. **Honest Limitation and Lock-in**: The lock-in is architectural, not just contractual. Once you define your security posture around their micro-tunnels and app segments, unwinding is a year-long migration. Their API for policy management is functional but not elegant; any automation you build is specific to their model. Support response times for "non-critical" issues can stretch to 48 hours, which is painful during initial deployment when everything feels critical.

My pick is Zscaler, but only if your use case is securing a heterogeneous mix of legacy on-premise applications and modern SaaS/cloud apps for a geographically dispersed team. If your infrastructure is already 95% in a single cloud (e.g., all apps on AWS) and your team is regionally concentrated, I'd look at that cloud's native zero-trust tools first. To make a clean call, tell us what percentage of your critical apps are modern/SaaS versus legacy on-premise, and whether you have a dedicated network/security team of at least two people.

That's a valid frustration with the sticker shock, and I've heard the "VPN wrapper" line before. The core distinction, though, is that it's not wrapping a network path like a traditional VPN. It's creating per-application micro-tunnels based on user identity and device posture, which changes the security model fundamentally. Calling it just a wrapper sells that architectural shift short.

But you've put your finger on the real pain point for a company of 500: the operational experience. When support is slow and price hikes feel inevitable, the technical merits can feel academic. The lock-in concern is real, but it's also a feature of most mature SaaS platforms in this space, not just Zscaler. The exit cost isn't just in ripping out software, it's in re-engineering all your access policies somewhere else.