Question 1

What is Zero Trust?

Accepted Answer

Zero Trust is a security model that assumes no user or connection is trustworthy by default. Instead of granting broad network access, it verifies every request and connects users only to the specific applications they need. Zscaler pioneered this approach on its global cloud—your apps stay invisible to the internet, threats are stopped at the edge, and there's no network to breach.

Question 2

Are there really no term contracts?

Accepted Answer

Correct. Our partnership operates on a month-to-month basis. You can add or remove users at any time without penalties or early termination fees.

Question 3

What are the user minimums?

Accepted Answer

Very low. The minimum is 10 seats — start there and scale up as your client base grows, with no long-term spending commitments.

Question 4

How does monthly invoicing work?

Accepted Answer

You'll receive a single consolidated invoice at the end of each month based on your actual usage across all clients. Pay only for what you consumed.

Question 5

Can I mix and match SKUs for different clients?

Accepted Answer

Absolutely. Each client can have a different combination of ZIA, ZPA, PRA, ZDX, and add-on SKUs based on their specific security requirements.

Question 6

What kind of support do you provide?

Accepted Answer

We provide dedicated partner enablement, technical onboarding assistance, sales engineering support, and ongoing account management to help you grow your Zscaler practice.

Question 7

How quickly can I get started?

Accepted Answer

Most partners are onboarded and deploying Zscaler to their first client within days. Our streamlined process eliminates the typical enterprise procurement delays.

Question 8

How does billing work?

Accepted Answer

You enter an order and in the following month you get billed in arrear for the amount of licenses you ordered or used (whichever is higher). Payments are automatically drafted from the account you have on file.

Question 9

What types of payments do you accept?

Accepted Answer

We accept ACH, Debit Card, or Credit Card on file. All processed by a secure third-party payments processor.

Question 10

How does Zscaler's infrastructure work?

Accepted Answer

Zscaler operates the world's largest security cloud, built on a distributed architecture with over 150 data centers globally. This infrastructure is designed to process traffic at the edge, closer to your users, which ensures fast and secure connectivity without the need for backhauling traffic to a traditional data center. Key aspects of our infrastructure include: Zero Trust Architecture: Instead of connecting users to a network, Zscaler connects users directly to the applications they need. This eliminates the attack surface by making your applications invisible to the internet. Scale and Intelligence: Our cloud handles over 500 trillion daily signals, using this massive dataset to provide real-time, AI-powered threat protection. Performance: By processing security at the edge, we eliminate the latency and bottlenecks often associated with hardware-based appliances or VPNs. For MSPs, this means you can offer your customers enterprise-grade security that scales instantly, regardless of where their users are located. If you are interested in how you can leverage this infrastructure to build or enhance your security practice, I recommend clicking "Become a Partner" on our site to speak with our team.

Question 11

Why is Zscaler the best zero trust platform for my business?

Accepted Answer

Zscaler stands out as the premier choice for MSPs looking to build a high-margin security practice because our platform was purpose-built for the cloud, rather than being retrofitted from legacy hardware. Purpose-Built for MSPs: We aren't just a product vendor; we are a partner. Our program is designed for your business model with zero term commitments (month-to-month flexibility), very low user minimums (a 10-seat minimum), and simple monthly invoicing in arrears. You only pay for what you use. The World's Largest Security Cloud: Your customers get the benefit of our massive, globally distributed infrastructure (150+ data centers and 500 trillion daily signals). This ensures enterprise-grade security and superior performance for your end-users, regardless of their location. Comprehensive Velocity Portfolio: You gain access to our full suite of solutions—including ZIA (internet/SaaS security), ZPA (private app access that replaces insecure VPNs), PRA (privileged access), and ZDX (digital experience monitoring). This allows you to differentiate your offering and provide a complete Zero Trust roadmap for your clients. Operational Simplicity: Because we are cloud-native, you eliminate the need to manage, patch, or upgrade physical security appliances at customer sites. This significantly reduces your operational overhead and allows your team to focus on proactive management rather than break-fix cycles. By partnering with Zscaler, you move away from traditional, appliance-based security and offer a scalable, modern, and highly effective Zero Trust solution that grows with your clients. If you are ready to see how this can transform your security offering, I recommend clicking "Become a Partner" to start the conversation with our team.

Question 12

How could I use Zscaler to get rid of my hardware based firewalls?

Accepted Answer

Moving away from hardware-based firewalls is a primary benefit of adopting the Zscaler Zero Trust platform. Instead of relying on a physical "perimeter" at each customer location, you transition that security function to our global cloud. ZIA (Zscaler Internet Access): This replaces the traditional "stack" of security appliances (web filtering, firewalls, DLP, sandboxing, etc.) at the branch or office. By routing internet-bound traffic through the Zscaler cloud, you ensure that every user—whether in the office, at home, or on the road—receives consistent, enterprise-grade protection without a single piece of hardware on-site. ZPA (Zscaler Private Access): This allows you to retire your legacy VPN appliances. Instead of providing access to the "network" (which is what traditional firewalls/VPNs do), ZPA creates secure, one-to-one connections between the user and the specific private application they need. The application is never exposed to the internet, effectively rendering the traditional firewall's port-forwarding and inbound access rules obsolete. PRA (Privileged Remote Access): For internal administrative access, you can replace insecure jump-boxes and VPNs with Zscaler's browser-based access for RDP, SSH, and VNC. This provides a secure, audited connection without needing to open firewall ports or expose infrastructure to the internet. The MSP Advantage: By removing hardware-based firewalls, you eliminate the need to ship, rack, stack, patch, and replace physical boxes at every client site. This significantly reduces your operational costs and time-to-market. You manage security centrally through the cloud, which increases your agility and allows you to standardize your security offering across your entire customer base. If you would like to discuss how to structure this migration for your customers, please click "Become a Partner" on our site to connect with our team.

Question 13

Can I get rid of the firewalls? If so, how would data flow securely?

Accepted Answer

Yes, Zscaler is designed to handle both your office-based users and your remote workforce, effectively replacing the need for on-premises firewalls. Here is how the connectivity and routing work in a Zero Trust model: Outbound Routing (Internet & SaaS Access): Traditionally, you route all office traffic through a physical firewall to inspect it before it hits the internet. The Zscaler Way: You replace that firewall "stack" with a simple, secure tunnel (using GRE or IPSec) from your office edge router directly to the nearest Zscaler data center. All internet-bound traffic from your office is forwarded to the Zscaler cloud, which inspects the traffic for threats, applies DLP (Data Loss Prevention) policies, and enforces web security in the cloud. Only safe traffic is allowed to continue to the internet. Result: You get enterprise-grade security at the cloud edge, and you no longer need to manage, patch, or upgrade physical firewalls at the office site. Inbound Routing (Access to Private Apps): Traditionally, firewalls use "inbound rules" (opening ports) to let users or partners reach internal applications, which is a major security risk. The Zscaler Way (ZPA): You eliminate inbound firewall rules entirely. In fact, you can (and should) disable inbound access to your internal network. You install a lightweight "App Connector" inside your office network (near your applications). This connector initiates an outbound-only connection to the Zscaler cloud. When an authorized user tries to reach an app, Zscaler creates a secure, temporary, one-to-one tunnel between that user and the application via the App Connector. Result: The application remains invisible to the internet. Since the App Connector only needs to make outbound calls to the Zscaler cloud, you do not need to open any inbound ports on your firewall. Summary for your office: By leveraging ZIA for your internet traffic and ZPA for your private application traffic, your office network essentially becomes a "dumb" pipe that simply forwards traffic to our security cloud. This allows you to remove inbound port forwarding (drastically reducing your attack surface), offload inspection (removing the need for hardware-based security appliances that require physical management), and maintain consistency—your security policy follows the user, regardless of whether they are sitting in the office or working from a coffee shop. If you're ready to plan how to transition your office infrastructure to this model, please click "Become a Partner" to start the conversation with our team.

Question 14

Won't GRE tunnels just slow down the connection?

Accepted Answer

It is a common misconception that GRE (Generic Routing Encapsulation) tunnels necessarily introduce latency. In reality, Zscaler's infrastructure is engineered to ensure high performance and low latency. Here is why your concerns about speed are addressed by our cloud-native architecture: Proximity to the Edge: Zscaler operates over 150 globally distributed data centers. Because our security cloud is positioned at the internet exchange points and peering locations where your traffic is already heading, you are likely reducing, not increasing, the path traffic takes compared to backhauling it to a corporate data center or a high-traffic security appliance. Performance vs. Inspection: Traditional on-premises appliances often become bottlenecks because their compute power is finite; as you turn on more security features (SSL inspection, DLP, etc.), the hardware slows down. Zscaler's cloud is built for massive scale, meaning we perform deep inspection in parallel without the latency overhead of physical security stacks. Optimized Routing: When you use a tunnel, you are essentially creating a direct "fast lane" to the nearest Zscaler node. Because we have extensive peering relationships with major ISPs and SaaS providers, traffic leaving the Zscaler cloud is often delivered to its destination faster than it would be via standard internet routing. No "Hairpinning": Many traditional configurations force remote users to VPN back to an office and then out to the internet. By using Zscaler, you eliminate this "hairpinning," allowing users to connect directly to the nearest Zscaler data center for both security and access, which significantly improves user experience. In short, by moving from hardware-based inspection at the office to cloud-based inspection, you are replacing limited physical compute with a globally distributed, elastic security architecture. If you'd like to dive deeper into the technical performance specs or discuss how we optimize traffic for your specific client needs, I encourage you to click "Become a Partner" on our site to speak with our technical team.

Zscaler for MSPsZero Trust, SASE & Cloud Security for Managed Service Providers

Top MSPs access the Zscaler portfolio through Velocity Cyber

Purpose Built for MSPs

No Term Contracts

Very Low User Minimums

Monthly Invoicing

Grow Your Margins

Partner Support

Multi-Tenant Portal

Get Started in 3 Steps

Become a Partner

Configure & Deploy

Scale & Profit

Why Zscaler for Zero Trust

Trusted where security is mission-critical

Fortune 100 companies

Banks & credit unions

Department of Defense

Federal & public sector

Award-winning, analyst-recognized

Zero Trust, SASE & cloud security for managed service providers

Ready to offer world-classzero trust security?

Frequently Asked Questions