Independent Research · Unvarnished Reviews
Unvarnished Reviews Research
Palo Alto Networks Prisma SASE is the right platform for organizations already deeply invested in the Palo Alto ecosystem, and the only vendor named a Leader in all three relevant Gartner Magic Quadrants simultaneously: SASE Platforms, SSE, and SD-WAN. Its Strata Cloud Manager is both its greatest strength (unified management across the full Palo Alto stack) and its most consistent complaint (complex, cumbersome, and designed for too many products at once). Licensing changes in 2025, including end-of-sale announcements that forced customer migrations, have added to the complexity burden.
Zscaler is the right platform for cloud-first organizations pursuing pure SSE without legacy on-premises infrastructure. It holds the highest user and Gartner SSE ratings and the largest independent review base in its category. Its latency and performance issues are real, geographically variable, and well-documented across Spiceworks, Reddit, and other practitioner communities, and are most severe for users in Asia, the Middle East, and restricted geographies where ZEN nodes are distant.
A notable market signal: both platforms are losing mindshare in the SASE category as of May 2026, Prisma Access from 16.8% to 10.4% and Zscaler from 11.3% to 8.9% year-over-year in user ratings. Cato Networks and other challengers are gaining ground. Neither incumbent should be evaluated without also assessing the emerging alternatives.
Both vendors prominently cite Gartner recognition in their marketing. The nuance buyers miss:
2025 Gartner Magic Quadrant for SASE Platforms:
2025 Gartner Magic Quadrant for Security Service Edge (SSE):
SASE Platforms covers integrated networking and security convergence, where Palo Alto's native SD-WAN integration gives it an architectural advantage. SSE covers security-only cloud delivery, where Zscaler's pure-cloud heritage gives it the edge. The right quadrant to weight depends on whether your requirement is integrated networking plus security (Palo Alto wins) or pure security service edge (Zscaler leads).
User ratings further clarify the competitive picture: In the Web Secure Gateway category, Zscaler holds 8.5/10 vs. Palo Alto's 8.2/10. In SASE, Zscaler is ranked #2 in SSE solutions while Prisma Access holds #1 in CASB solutions. Both platforms are credible, in different use cases.
| Platform | PeerSpot | G2 | Trustpilot | TrustRadius Reviews |
|---|---|---|---|---|
| Zscaler Internet Access | 8.5 / 10 | 4.4 / 5 | No Trustpilot listing located | 115+ |
| Prisma Access (Palo Alto) | 8.2 / 10 | 4.3 / 5 | 2.4 / 5 (7 reviews, too small to weight) | 93+ |
Zscaler leads on independent practitioner review ratings across platforms. The gap is consistent and reflects differences in user experience, particularly around deployment simplicity and day-to-day management, rather than security effectiveness.
All user traffic, internet-bound, SaaS, and private application, routes through Zscaler's global network of Zscaler Enforcement Nodes (ZENs). Inspection, policy enforcement, and threat detection happen in the cloud at the point of access without traffic touching a hardware appliance. The model eliminates VPN backhauling for users near a ZEN, a performance advantage over legacy architectures.
The geographic dependency problem: Zscaler's backhauling architecture sends all traffic through ZEN nodes for inspection. For users near a ZEN, performance is good. For users in Asia, the Middle East, Africa, or anywhere distant from ZEN infrastructure, the backhauling adds round trips that are documented across Spiceworks, Reddit, and other practitioner reviews as 10%-30% speed drops and significant latency during peak hours. Practitioners call out China and restricted geographies as particularly problematic, where local network fragility compounds the backhauling penalty. This is not a fringe complaint: It is consistently the most cited operational issue in Zscaler communities.
Console sprawl from acquisition. Zscaler's product suite, ZIA, ZPA, ZDX, and multiple admin surfaces, was built through years of expansion rather than designed as a unified interface. Practitioners on Spiceworks and Reddit describe "console sprawl" as a consistent management friction point, requiring administrators to navigate multiple interfaces for comprehensive visibility.
Prisma SASE converges Prisma Access, Prisma SD-WAN, and Strata Cloud Manager into a unified platform, securing both user-to-application connections and network traffic flow. The model enables deep integration between firewall policy, network routing, and cloud-delivered security under single management.
The Strata Cloud Manager complexity problem. This is Palo Alto's defining operational liability in practitioner communities. Users and Gartner reviewers describe Strata Cloud Manager as "highly complex, cumbersome, and confusing because it attempts to present an interface for too many Palo Alto products in one place." The configuration push requirement, which takes a minimum of 2-5 minutes for every change, is a documented friction point. Global Protect connectivity issues, requiring users to click multiple times to launch the client, generate consistent end-user complaints.
2025 licensing changes added complexity. Palo Alto announced May 8, 2025 as the end-of-sale date for AIOps for NGFW Premium, AI-Powered ADEM, and Strata Logging Service with sized storage. Existing customers were migrated automatically, but the disruption added to the licensing complexity narrative that practitioners and Gartner both consistently flag.
practitioners consistently praise Zscaler's core security effectiveness, threat detection, URL filtering, SSL inspection, and policy enforcement, as strong. Enterprise users at large organizations (Marathon Petroleum, among others) describe improved latency over legacy VPN for users near ZEN nodes, and reduced internal infrastructure burden.
Centralized policy enforcement across all users regardless of location is praised as an operational advantage for distributed workforces. The elimination of VPN backhauling, for users in supported geographies, delivers measurable performance improvement over legacy architectures.
Latency is the defining complaint and it is geography-dependent. The negative tag summary for Zscaler Internet Access: Slow Performance (27 mentions), Complex Implementation (24), Connection Issues (22), Complex Configuration (22). Reddit practitioners document 10%-30% speed drops for corporate network traffic. Spiceworks community threads identify renewal pricing surprise and performance in restricted geographies as the two most common reasons organizations evaluate Zscaler alternatives.
False positive blocking at initial deployment is documented in practitioner reviews, with one reviewer noting that "many false positives and access blocked when Zscaler was first introduced" required approximately 9 months of tuning before most issues resolved. For organizations with complex SaaS environments, the tuning burden at deployment is significant.
Renewal pricing surprise. Zscaler's per-user pricing combined with add-on modules creates renewal sticker shock that is a consistent theme across Reddit and Spiceworks threads. The gap between year-one pricing and year-three costs after module additions is documented as a frequent procurement surprise.
Organizations already running Palo Alto NGFWs consistently report value in policy consistency between on-premises and cloud-delivered security. Users in financial services, the largest segment researching Prisma Access at 12% of views, describe the platform's ZTNA implementation as strong for granular application-level access control.
The integration value for existing Palo Alto customers is real and documented. Cortex XDR, NGFW, and Prisma Access sharing policy and telemetry under Strata Cloud Manager, when the organization has invested in the full platform, delivers a depth of security convergence that Zscaler's point-product architecture does not match.
Strata Cloud Manager is the most documented complaint across all independent review platforms. The pattern is consistent across user ratings and Gartner: The interface attempts to serve too many products at once, configuration pushes are slow, and end-user client connectivity generates complaints that create IT help desk burden.
Licensing complexity and changes. Users note that Prisma Cloud, the broader platform, carries "high costs and complex licensing" with "hidden and variable costs challenging" for procurement teams. The 2025 end-of-sale announcements for multiple license types, while handled at no additional cost via automatic migration, added administrative burden and reinforced the complexity narrative.
Mindshare declining. Prisma Access fell from 16.8% to 10.4% SASE mindshare in peer-review rankings year-over-year as of May 2026. In a growing market, declining mindshare indicates competitive displacement, organizations researching SASE solutions are increasingly considering alternatives including Cato Networks and Netskope.
Pricing re-checked October 2026. These vendors sell by quote only, so the ranges below are third-party and practitioner estimates, not published list prices.
Both platforms use quote-based enterprise pricing with no published rates.
The real-world cost: One documented 6,550-user enterprise deployment came in at $1,404,049 in Year 1 across 12 line items, an effective $214/user/year, well above headline per-user rates. Spiceworks and Reddit threads consistently document renewal sticker shock as add-on modules accumulate. Multi-year commitments achieve 15%-30% lower per-user pricing. Running a competitive evaluation against Palo Alto, Netskope, or Cato Networks drives better pricing from Zscaler.
Correction: An earlier version of this report modeled a 100-user scenario using a single documented large-enterprise deployment's effective per-user rate, which overstated the true small-deployment cost. The TCO Comparison below has been rebuilt using Vendr's reported per-user ranges and 1,000-user benchmark, a more representative, transaction-verified data source.
The principle for both: The three-year TCO, not the year-one quote, is the number that matters. Get it in writing before signing either contract.
Both Prisma Access and Zscaler are losing market mindshare to alternatives, and Cato Networks is the most commonly cited emerging alternative in practitioner communities. Cato's single-vendor SASE platform, which converges SD-WAN, SSE, and management into a truly unified architecture rather than a consolidated bundle of acquired products, is drawing evaluation activity from organizations frustrated with both Zscaler's console sprawl and Palo Alto's Strata Cloud Manager complexity. This report covers the two market leaders, but any serious 2026 SASE evaluation should include Cato Networks in the shortlist.
Modeled using Vendr's reported transaction benchmarks for this exact comparison, the most authoritative single source available for this scenario.
| Platform | Per-User Annual Range | 3-Year Total (1,000 Users) |
|---|---|---|
| Zscaler (ZIA + ZPA) | $50-$130/user | $220,000-$450,000 |
| Palo Alto Prisma Access | $60-$150/user | $250,000-$500,000 |
At this scale, the two platforms sit within roughly 10%-20% of each other, consistent with practitioner reports that marketing positioning overstates the real cost gap. The gap widens dramatically at large enterprise scale: Palo Alto's documented range for a full-platform large-enterprise deployment runs $11 million-$18 million over three years at list, with 35%-50% negotiable. A documented 6,550-user Zscaler deployment came in at $1,404,049 in Year 1 alone, an effective $214/user/year, near the top of Zscaler's $50-$130/user range once all 12 line items were counted, a useful confirmation that the top of the published range, not the midpoint, is the more realistic planning assumption for complex deployments.
The two platforms put complexity in different places: Zscaler in performance tuning and console sprawl, Palo Alto in a management console and licensing churn.
| Dimension | Zscaler | Palo Alto Prisma Access |
|---|---|---|
| Implementation | False positives and blocked access at initial deployment took about 9 months of tuning to resolve in one review. | Strata Cloud Manager pushes take a minimum of 2-5 minutes for every configuration change. |
| Admin and staffing dependency | Console sprawl across ZIA, ZPA, ZDX, and multiple admin surfaces from years of acquisition and expansion, requiring administrators to navigate several interfaces. | Strata Cloud Manager is described by reviewers, including Gartner Peer Insights reviewers, as highly complex, cumbersome, and confusing because it attempts to serve too many products at once. |
| Learning curve and configuration | Negative reviewer tags include Complex Implementation (24) and Complex Configuration (22). | The 2025 end-of-sale of several license types was handled by automatic migration, but added administrative burden. |
| Performance and reliability | Slow Performance (27 mentions) and Connection Issues (22), with 10%-30% speed drops in Asia, the Middle East, and restricted geographies where ZEN nodes are distant. | GlobalProtect client connectivity issues, with users clicking multiple times to launch the client, create help desk burden. |
Zscaler's complexity depends on geography and tuning, and Palo Alto's on the management console. Both cost administrator time that does not appear in the per-user price.
Every finding below is independently documented and material enough to influence a purchasing decision.
Zscaler
|
Palo Alto Prisma Access
|
Zscaler is designed for cloud-native simplicity, with strong core security, and its trade is geography-dependent latency (10%-30% speed drops in Asia, the Middle East, and restricted geographies), about 9 months of tuning for false positives in one deployment, and console sprawl across ZIA, ZPA, and ZDX. Palo Alto is designed for convergence, with consistent policy between on-premises and cloud, and its trade is Strata Cloud Manager complexity, slow configuration pushes, and 2025 license-type changes.
Choose by infrastructure and geography. Zscaler fits cloud-first estates with users near ZEN infrastructure replacing legacy VPN. Palo Alto fits organizations running Palo Alto firewalls that want one policy across on-premises and cloud. Neither incumbent should be evaluated without assessing Cato Networks, which converges SD-WAN and SSE in a single-vendor platform.
Both are quote-based, so the real price is in the itemized quote. Zscaler's published range is $50-$130 per user, with renewal sticker shock as add-on modules like ZDX accumulate, and multi-year commitments earn 15%-30% lower per-user pricing. Palo Alto's range is $60-$150 per user, with 25%-40% off list negotiable above $1M. A competitive evaluation against the other platform, or Cato, improves pricing at both.
Free trials and test-drives. Palo Alto Networks offers demos for Prisma Access and lists a Test Drive on its demo center. Zscaler offers a custom product demo and lists no free trial. Both are largely evaluated through a demo and a negotiated pilot, so ask for a paid pilot on a representative set of users and sites, a written success test for latency and policy coverage, and exit terms if the pilot fails.