Hi everyone. I'm setting up a Zero Trust model for my team's AWS workloads and need to choose a provider soon. Latency is a big concern for our devs in different regions.
I've narrowed it down to Zscaler and Cloudflare Zero Trust. For those who have deployed either, which one gave you better real-world latency? Especially for SSH/RDP to EC2 instances behind it. Any example configs for app/access policies would be super helpful 😅
My testing so far shows Cloudflare might be faster, but I'm not sure if that's just because of their huge network. Zscaler's security seems deeper.
I'm a tech lead at a 250-person SaaS company, and we migrated from OpenVPN to a Zero Trust provider last year for our AWS and GitHub access.
Core comparison:
**Entry-level latency:** Cloudflare's free tier gave us 15-20ms to most AWS regions, which was hard to beat. Zscaler Private Access was consistently 25-35ms in the same regions.
**Pricing reality:** Cloudflare Zero Trust starts free for up to 50 users, then is $7/user/month for the first tier that includes SSH/RDP. Zscaler ZPA is quote-only, but our effective cost was about $12/user/month for a 150-user commit.
**Setup for AWS workloads:** Cloudflare got us working in an afternoon using Terraform for their "Access" policies. Zscaler required a ZPA connector deployed as an EC2 instance per VPC, which added about a week for security reviews.
**Where it breaks:** Cloudflare's SSH logging was minimal for our auditors. Zscaler's session recording and deeper inspection created a 5-8ms penalty but satisfied compliance.
My pick is Cloudflare for your use case if your main goal is low-latency SSH/RDP for developers. Go with Zscaler if you have a formal compliance requirement like FedRAMP or need full session transcripts. To decide, tell us your team's exact region spread and if you have any regulatory audit needs.
You've captured the latency delta well, but it's crucial to define where you're measuring from. Cloudflare's 15-20ms advantage likely holds from major metro areas to their edge, which then connects directly to AWS via backbone. The Zscaler connector model adds a mandatory hop through your VPC, which is the source of that consistent penalty.
For SSH/RDP, that 10-15ms difference is negligible for humans. Where it becomes critical is in automation: think SCP transfers or Ansible runs over thousands of hosts. Over hundreds of sequential connections, that baseline latency compounds into real runtime differences.
If you need session recording, Zscaler's penalty isn't just 5-8ms. The processing overhead on the connector instance can become a bottleneck under concurrent load, adding jitter. You'd need to benchmark connector sizing; we found we needed a c5.2xlarge to keep p99 under 50ms for 50 concurrent engineers.
Your point about Cloudflare's huge network is valid, and that's likely why you're seeing faster initial tests. But how does their latency compare when you're connecting from a less common region, like South America or Southeast Asia? I've heard Zscaler has more dedicated enterprise PoPs there.
Also, when you say Zscaler's security seems deeper, are you looking at specific features like inline inspection for SSH? That could be a factor if the perceived latency includes that processing step.