Cloudflare vs Zscaler
A four-point pairing. Cloudflare leads on speed (19 vs 18), moat (39 vs 37) and demerits (−4 vs −5), with creative destruction tied at 11 — the gap is one point on growth (A1), two on distribution scalability (B2) and one on leverage (D1).
Cloudflare by 4
| Item | Max | Cloudflare | Zscaler |
|---|---|---|---|
| A · Speed | 19 | 18 | |
| A1 · Growth | / 10 | 9 | 8 |
| A2 · Capital velocity | / 5 | 4 | 3 |
| A3 · Hiring & productivity | / 5 | 3 | 3 |
| A4 · Share velocity | / 5 | 3 | 4 |
| B · Moat | 39 | 37 | |
| B1 · Network effects | / 18 | 8 | 8 |
| B2 · Distribution scalability | / 18 | 13 | 10 |
| B3 · Market size | / 12 | 10 | 9 |
| B4 · Gross margin | / 12 | 8 | 10 |
| C · Creative destruction | 11 | 11 | |
| C1 · Order being replaced | / 5 | 4 | 4 |
| C2 · Irreversible behavior change | / 5 | 4 | 4 |
| C3 · Cost-structure change | / 5 | 3 | 3 |
| D · BlitzFailing demerits | −4 | −5 | |
| D1 · Debt | / 10 | −1 | −3 |
| D2 · Revenue quality | / 10 | 0 | 0 |
| D3 · Governance | / 5 | −3 | −1 |
| D4 · Regulatory & social cost | / 5 | 0 | −1 |
| Blitz Index total | 65 | 61 | |
The success line is 65. Demerits (section D) are subtracted; a demerit total of 15 or more flags a company for BlitzFailing watch. Scores as of the 2026 Q4 review (November 5, 2026).
Speed and destruction — mirror images
Both companies are compounding at almost the same rate from similar bases: Cloudflare has grown for 22 straight quarters, with trailing revenue of $2.51B re-accelerating to about +34–36% in the first half of 2026; Zscaler’s FY2026 revenue of $3.35B grew +25.4%, with ARR of $3.77B also at +25%. Both are replacing the same old order — the on-premise hardware box. Cloudflare is consolidating enterprises behind one connectivity cloud; Zscaler is retiring firewalls and VPNs for a cloud-native zero-trust exchange, with its Zero Trust Everywhere footprint jumping from 350 to more than 950 deployments in a year (C1 and C2: 4 each, both companies). On the evidence in the scorecards, there is nothing between them on destruction (11 each); on speed Cloudflare leads by a single growth point (A1: 9 vs 8).
Moat — two points, and the counterweights
The deciding item is distribution scalability: 13 vs 10. Cloudflare runs a land-and-expand motion with a 120% dollar-based net retention rate, four straight quarters at 118% or better, and $2.73B of remaining performance obligations — a self-serve and developer-led engine that keeps expanding inside accounts. Zscaler’s expansion is real (785 customers above $1M of ARR, up 18%; Z-Flex consumption licensing lifting customer ARR by roughly 30%) but it is channel-partner led, and the scorecard prices that dependence a step lower. Zscaler answers with the better financial moat items: gross margin of 76.8% held in a 77–78% band for five years, free-cash-flow margin of 23.2% and a Rule-of-40 reading of 48 (B4: 10), against Cloudflare’s gross margin sliding from about 78% in 2021 to 71.8% and continuing GAAP losses (B4: 8). Cloudflare’s larger claimed market ($196B company TAM, B3: 10 vs 9) also matters — Zscaler’s bar already consumes most of its SASE market, leaving less headroom.
Demerits — same total, different composition
Cloudflare pays −4 and Zscaler −5, assembled from opposite risks. Cloudflare’s bill is governance and leverage: −3 because its two founders hold 52.4% of the vote through 10-vote Class B shares, and −1 because $4.85B of debt (about 1.9× trailing revenue, rising toward ~2.3× pro forma after the August 2026 notes) is unusual for a company still reporting GAAP losses — though the $1.29B 2026 notes were repaid in cash, so the maturity wall is gone. Zscaler’s bill is financial and key-person: −3 concentrated on its $1.725B of 0% notes maturing in July 2028 (covered by $3.47B of liquidity, but a single maturity wall), plus −1 each for dependence on founder Jay Chaudhry and for the certification-maintenance risks that come with its government business. One point on demerits, two completely different risk profiles — which is precisely what a frozen rubric is for.
Full scorecards: Cloudflare — Blitz Index 65 · Zscaler — Blitz Index 61
Run your own pairing: open this pair in the interactive compare tool, or pick any two of the 157 scored companies.
How to read this
Both companies passed the same two gates before scoring: real product-market traction (G1), and a ten-year market ceiling of at least ten times current revenue (G2). The Blitz Index then grades speed (25), moat (60) and creative destruction (15), and subtracts BlitzFailing demerits (up to −30) for debt, revenue quality, governance and regulatory cost. The model is frozen at v1.0; past scores are never silently rewritten. Our own pre-registered tests found the score measures business quality — it does not predict stock returns.