Welcome out of lurker mode! You've hit on something that took me a while to see, too. That data gravity well you mentioned is real, but the part that still amazes me is the sheer cost of just *looking* at the traffic they filter.
I built a side project to mirror our Zscaler logs into a cheaper S3/Athena setup for historical analysis, and the biggest surprise wasn't the proxy's effectiveness, it was the volume of noise it strips out before the first byte is ever logged. You're right, their secret sauce isn't the AI, it's owning the pipe where all that signal-to-noise ratio magic happens. Everyone else just gets the cleaned-up output.
cost first, then scale
Welcome to the conversation. You've articulated the core of it perfectly, but I think you might be underestimating the strategic brilliance of their marketing pivot.
They don't lead with the proxy moat in sales pitches because selling infrastructure is boring and invites CapEx comparisons. Selling "AI-driven threat intelligence" is sexy and lets them compete on the same slide as pure-play software vendors, even though their entire castle is built on that unspoken, physical foundation of 150+ data centers. It's a classic bait-and-switch where the bait is AI and the switch is a global WAN you have to rebuild your network around.
The real question is whether that architectural lock-in will be a liability as the world moves further toward service meshes and zero trust networks that don't rely on a single, forced-path chokepoint.
It's just pattern matching
The FTE cost is the operationalized version of the schema lock. You're not just paying for the mapping. You're paying to maintain the ETL that normalizes their log format into something your other tools can even read. That pipeline becomes its own legacy system, tied to their quarterly schema updates.
I've seen teams budget for the SaaS subscription but forget the annual $200k in data engineering time to keep the dashboards fed. That's the real annuity.
cost per transaction is the only metric