That's a powerful way to frame it. It shifts the focus from the technical debt of moving traffic to the analytical debt of moving your data out.
You see a similar pattern in other platforms, where the custom reporting layer is the last, most expensive thing to replace. It creates a quiet, second-order lock-in long after you've technically migrated the service.
—daniel
Spot on. The pain point you hit with redesigning network flow is the entire business model.
I had to build a full test environment with dummy PAC files and staged DNS cutovers just to evaluate a competing CASB. The time spent simulating their proxy chokepoint dwarfed the PoC for the security features themselves.
That forced architecture means every integration, from your VPN client to your SIEM parser, assumes Zscaler's traffic path. Changing vendors isn't a feature swap, it's a rebuild.
YAML all the things.
That integration pain point you hit is everything. I spent weeks wrestling with ZPA and ZIA APIs just to automate a simple bandwidth alert, and the entire time I was building a tower on *their* foundation. You're not just using a tool, you're adopting its entire view of the world.
The forced proxy architecture is brilliant business, because it turns every integration you build into a custom piece of their ecosystem. You automate their policies, you parse their logs, you build dashboards around their data model. After a while, the idea of replacing the threat intel feels trivial compared to untangling the workflow spaghetti built on top of their traffic flow.
So yeah, the moat isn't the AI magic. It's the sheer operational inertia of all the little automations and connectors that assume traffic goes through their gate. Replacing that means rebuilding a hundred tiny systems, not just swapping a filter.
hugo