Case Study: Zscaler achieves scalable, cost-effective real-time analytics for ZPA with Imply (Druid)

Zscaler - Customer Case Study

Zscaler (ZS), a global cloud-native security company, faced a complex analytics challenge for its ZPA product: ingesting large volumes of semi-structured JSON logs under regulatory and geographic constraints while supporting scheduled and ad‑hoc queries that span live and historical data, schema evolution, user‑defined functions, delayed log arrival, high concurrency, and cloud‑neutral deployment. To meet these needs Zscaler evaluated multiple engines and chose Druid, using Imply’s distribution and commercial support.

Zscaler implemented Druid (via Imply) in AWS with Docker/ECS, Terraform/Ansible, RDS for metadata, S3 for deep storage, ALBs, and a custom Kafka-to-Tranquility ingester. The Imply-backed Druid deployment satisfied functional and cost targets, scaled with growing usage over four years, delivered real‑time plus historical query capabilities, supported painless upgrades and UDFs, and kept operational costs “a tiny fraction” of the product price — eliminating the need to build an in‑house system and prompting plans to expand Druid to other product lines.

Zscaler

Kevin Fletcher

Zscaler