Austin, TX – June 2, 2025 – CyberRatings.org (CyberRatings), the non-profit organization dedicated to providing insight into the capabilities of cybersecurity products and services through independent testing, has released additional results from its Security Service Edge (SSE) and Zero Trust Network Access (ZTNA) testing. This latest test focused on another leading product: Zscaler Zero Trust Exchange (ZTE).
Zscaler achieved a Security Effectiveness score of 100%, successfully blocking 100% of exploits, malware and evasions in the SSE test. The test report provides details on product performance across multiple threat categories, with scoring weighted by attack severity. The SSE evaluation covered:
- TLS/SSL: Top 5 Ciphers used (accounts for ~97% of HTTPS traffic).
- Malware: 6,184 attack samples sourced from current malware campaigns.
- Exploits: 205 attack samples from widely exploited vulnerabilities in enterprise environments.
- Evasions: 1,154 attacks spanning 37 evasion techniques.
- False Positives: 1,514 samples from various business-critical files and applications, ensuring security measures did not disrupt legitimate traffic.
The ZTNA results confirmed that Zscaler demonstrated strong capabilities by effectively enforcing policies and managing access according to predefined rules, policies, and user roles, achieving 100% in all categories tested. The ZTNA test covered:
- Authentication & Identity
- Routing & Access Control
- Resource Access (Zero Trust Network Access capabilities)
- TLS/SSL Support
Of the SSE test criteria, meeting the threshold of blocking evasions had the most impact on scores. Evasion techniques are used by attackers to disguise or obfuscate attacks so that they bypass detection. SSE products must not be tricked by evasions—failure exposes organizations to entire classes of undetected threats. Zscaler scored 100% in blocking all 1,154 evasion attempts.
Security Service Edge is a complex multi-layered security technology built on top of complex, ever-changing cloud technologies. Customers have minimal visibility into their operation and architecture, and testing is challenging. This double-layered opacity limits an organization’s ability to diagnose performance issues, fine-tune policy enforcement, or validate security outcomes.
“The only way to know if an SSE offering works properly is to test it,” said Vikram Phatak, CEO of CyberRatings.org. “Our test determined that Zscaler provides exceptional security effectiveness and strong coverage across a wide variety of threat categories.”
CyberRatings is on track to test several other SSE vendors for Threat Protection along with a Comparative Report to be published this summer.
In addition to in-house testing technologies, CyberRatings used Keysight’s CyPerf tool to test performance and TLS/SSL functionality as well as TeraPackets Threat Replayer tool for exploit packet capture replay.