Zscaler Zero Trust Exchange review

Zscaler Zero Trust Exchange is the foundation of Zscaler’s cybersecurity platform. The company describes it as an inline layer for connections: instead of giving an entity broad network access, it connects that entity only to resources it is authorized to reach. The stated aim is to secure users, data, deployed AI agents and models, and help security operations teams stop threats.

That makes the Exchange a platform concept, not a single feature with one clear job. Its scope includes access controls, user and data protection, AI security, and threat response. Zscaler’s homepage says this approach makes the attack surface “disappear.” That is a vendor claim, not a measurable guarantee in the information available to us. The practical question for buyers is whether the access controls and included capacity match their users, applications, workloads, and security needs.

The clearest strength is the platform’s access model: Zscaler says it sits inline on connections and grants each entity access only to what it is authorized to reach. That is a concrete operating principle, even if the published material does not spell out deployment requirements or performance figures. The product scope also reaches beyond user access to data, AI agents and models, and SOC threat response.

The listed plans provide some useful capacity distinctions:

• Essentials Platform includes ZPA Standard at one user per 20 subscribed, with a 500-user minimum; up to 20 App Connectors and 10 App Segments; 1 GB of workloads traffic per user per month; one pair of dedicated IPs; and Cyber Isolation Standard at 100 MB per user.
• Zscaler Platform includes ZPA Platform for all subscribed users, unlimited App Connectors, 20 App Segments, 2 GB of workloads traffic per user per month, and six pairs of dedicated IPs. For organizations over 500 users, it also lists PRA Standard for 10 systems.

Those inclusions give buyers a starting point for comparing scope. They do not establish that either tier will cover a particular environment without add-ons.

The biggest buying problem is price opacity. The available plan information lists no monthly or annual prices, does not specify billing terms, and gives no overage costs. It also lists no free plan; trial availability is not published. That makes it hard to compare the total cost with a current security stack before speaking to sales.

The capacity limits also matter. Essentials has a 500-user minimum, limits App Connectors to 20 and App Segments to 10, and includes 1 GB of workloads traffic per user per month. Zscaler Platform raises workloads traffic to 2 GB and App Segments to 20, while making App Connectors unlimited, but the listed PRA Standard allowance is 10 systems only for organizations over 500 users. These are plan inclusions, not proof that all requirements are covered.

Several capabilities—including Sandbox Advanced, Firewall Advanced, and Advanced Data Security modules—are listed as add-ons with prices not published. The pricing information is marked low confidence, so buyers should verify plan limits, add-on costs, and overages directly before budgeting.

Zscaler does not publish prices for either tier, so there’s no reliable dollar figure or price jump to compare. The pricing page lists Essentials Platform for organizations starting with core access and Zscaler Platform for broader access; monthly and annual rates, billing terms, and overage costs are not published.

The limits do change. Essentials includes ZPA Standard at 1 user per 20 subscribed, with a 500-user minimum; up to 20 App Connectors and 10 App Segments; 1 GB of workloads traffic per user per month; and one pair of dedicated IPs. Zscaler Platform includes ZPA for all subscribed users, unlimited App Connectors, 20 App Segments, 2 GB of workloads traffic per user per month, and six pairs of dedicated IPs. PRA Standard for 10 systems is listed for accounts over 500 users.

Budget separately for add-ons: Sandbox Advanced, Firewall Advanced, and AppProtection are among the options, but their prices are not published. Ask for a written quote covering add-ons and overages before comparing tiers.

Treat migration as an access-policy and dependency-mapping project, not just a license swap. Zscaler says the Exchange sits inline and connects each entity only to authorized resources. Before switching, inventory users, private apps, App Connectors, App Segments, workloads traffic, dedicated IPs, and any privileged remote access. The listed allowances differ by tier, so check that your current setup fits the destination plan before scheduling a cutover.

The published material does not describe migration tooling, data export, retention, or a step-by-step offboarding process. Get those terms in writing, including what configuration and logs you can export, in what format, and for how long after cancellation. Also confirm how existing app connections behave during a transition and whether add-ons have separate terms.

We can’t substantiate reasons customers leave from Reddit here: no Reddit posts or comments were supplied. Ask references about implementation effort, support, and exit handling rather than treating unverified complaints as a pattern.