Cloudflare vs Zscaler
A one-point pairing. Cloudflare and Zscaler post identical speed (18), identical creative destruction (11) and identical demerits (−5) — the entire difference between them is one distribution point inside the moat section.
Cloudflare by 1
| Item | Max | Cloudflare | Zscaler |
|---|---|---|---|
| A · Speed | 18 | 18 | |
| A1 · Growth | / 10 | 8 | 8 |
| A2 · Capital velocity | / 5 | 4 | 3 |
| A3 · Hiring & productivity | / 5 | 3 | 3 |
| A4 · Share velocity | / 5 | 3 | 4 |
| B · Moat | 38 | 37 | |
| B1 · Network effects | / 18 | 8 | 8 |
| B2 · Distribution scalability | / 18 | 12 | 10 |
| B3 · Market size | / 12 | 10 | 9 |
| B4 · Gross margin | / 12 | 8 | 10 |
| C · Creative destruction | 11 | 11 | |
| C1 · Order being replaced | / 5 | 4 | 4 |
| C2 · Irreversible behavior change | / 5 | 4 | 4 |
| C3 · Cost-structure change | / 5 | 3 | 3 |
| D · BlitzFailing demerits | −5 | −5 | |
| D1 · Debt | / 10 | −2 | −3 |
| D2 · Revenue quality | / 10 | 0 | 0 |
| D3 · Governance | / 5 | −3 | −1 |
| D4 · Regulatory & social cost | / 5 | 0 | −1 |
| Blitz Index total | 62 | 61 | |
The success line is 65. Demerits (section D) are subtracted; a demerit total of 15 or more flags a company for BlitzFailing watch. Scores as of the 2026 Q4 review (October 21, 2026).
Speed and destruction — mirror images
Both companies are compounding at almost the same rate from similar bases: Cloudflare has grown for 22 straight quarters, with trailing revenue of $2.51B re-accelerating to about +34–36% in the first half of 2026; Zscaler’s FY2026 revenue of $3.35B grew +25.4%, with ARR of $3.77B also at +25%. Both are replacing the same old order — the on-premise hardware box. Cloudflare is consolidating enterprises behind one connectivity cloud; Zscaler is retiring firewalls and VPNs for a cloud-native zero-trust exchange, with its Zero Trust Everywhere footprint jumping from 350 to more than 950 deployments in a year (C1 and C2: 4 each, both companies). On the evidence in the scorecards, there is nothing between them here.
Moat — the one point, and the counterweights
The deciding item is distribution scalability: 12 vs 10. Cloudflare runs a land-and-expand motion with a 120% dollar-based net retention rate, four straight quarters at 118% or better, and $2.73B of remaining performance obligations — a self-serve and developer-led engine that keeps expanding inside accounts. Zscaler’s expansion is real (785 customers above $1M of ARR, up 18%; Z-Flex consumption licensing lifting customer ARR by roughly 30%) but it is channel-partner led, and the scorecard prices that dependence a step lower. Zscaler answers with the better financial moat items: gross margin of 76.8% held in a 77–78% band for five years, free-cash-flow margin of 23.2% and a Rule-of-40 reading of 48 (B4: 10), against Cloudflare’s gross margin sliding from about 78% in 2021 to 71.8% and continuing GAAP losses (B4: 8). Cloudflare’s larger claimed market ($196B company TAM, B3: 10 vs 9) also matters — Zscaler’s bar already consumes most of its SASE market, leaving less headroom.
Demerits — same total, different composition
Both pay exactly −5, assembled from opposite risks. Cloudflare’s bill is governance and leverage: −3 because its two founders hold 52.4% of the vote through 10-vote Class B shares, and −2 because $4.85B of debt (about 1.9× trailing revenue, rising toward ~2.3× pro forma after the August 2026 notes) is unusual for a company still reporting GAAP losses. Zscaler’s bill is financial and key-person: −3 concentrated on its $1.725B of 0% notes maturing in July 2028 (covered by $3.47B of liquidity, but a single maturity wall), plus −1 each for dependence on founder Jay Chaudhry and for the certification-maintenance risks that come with its government business. One point, two completely different risk profiles — which is precisely what a frozen rubric is for.
Full scorecards: Cloudflare — Blitz Index 62 · Zscaler — Blitz Index 61
Run your own pairing: open this pair in the interactive compare tool, or pick any two of the 96 scored companies.
How to read this
Both companies passed the same two gates before scoring: real product-market traction (G1), and a ten-year market ceiling of at least ten times current revenue (G2). The Blitz Index then grades speed (25), moat (60) and creative destruction (15), and subtracts BlitzFailing demerits (up to −30) for debt, revenue quality, governance and regulatory cost. The model is frozen at v1.0; past scores are never silently rewritten. Our own pre-registered tests found the score measures business quality — it does not predict stock returns.