The mechanism. In January 2022, OMB Memorandum M-22-09 ordered every federal civilian agency to move to a zero-trust architecture — the assumption that no user, device, or network segment is trusted by default, everything is verified continuously. That's not a slogan; it's a procurement filter. Zero-trust tools bought with federal dollars must run through FedRAMP, the government's cloud-security authorization regime, and the version that matters for agency-wide, cross-cabinet deployment is FedRAMP High — the tier built for the most sensitive unclassified government data. Getting FedRAMP High authorized routinely takes vendors 18-24 months and seven-figure compliance spend before a single GSA schedule dollar shows up. Once a vendor clears that bar, agencies default to it — re-authorizing a second vendor for the same function is friction nobody in a CIO's office wants. That makes FedRAMP High a moat: expensive to build, and self-reinforcing once built.
FedRAMP High Is the Moat Nobody Prices In
OMB's zero-trust mandate hands agency-wide deployment to whoever clears the government's hardest security bar first — and Zscaler and Okta are about to fight over the same identity budget line.
FedRAMP High takes 18-24 months and seven figures to clear — and once an agency has a vendor authorized, re-authorizing a rival for the same job is friction nobody wants.
Who cashes in.
Zscaler ZS holds FedRAMP High JAB authorization for its Zero Trust Exchange, positioning it as network-layer zero trust — replacing VPNs and perimeter firewalls with cloud-brokered access. It's the incumbent on the "network and applications" pillars of M-22-09, serving the bulk of cabinet-level agencies already.
Okta OKTA holds FedRAMP High for Okta for Government High, covering core identity, Identity Governance, and Workflows — the "identity" pillar, which OMB and CISA have flagged as the pillar agencies are furthest along on. Identity is the entry point of zero trust architecture; whoever owns the login owns the renewal conversation for everything downstream.
Palo Alto Networks PANW rounds out the field with FedRAMP-authorized Prisma Access and next-gen firewall lines, competing for the same network-pillar dollars as Zscaler with a broader existing DoD footprint to cross-sell into.
Who is exposed. The collision isn't cross-sector, it's internal: ZS and OKTA both increasingly market "zero trust platform" positioning that overlaps at the access-control layer — Zscaler pushing identity-aware network access, Okta pushing device-and-network-aware identity. GSA schedule budgets for zero trust are not growing fast enough to fund duplicate full-stack builds at every agency; one vendor consolidating a pillar tends to squeeze the other's expansion revenue within the same account, even as both post authorization headlines. Fortinet FTNT, still building out its FedRAMP High footprint relative to ZS and PANW, risks getting boxed out of agency-wide network-pillar awards it can't yet bid on at the same authorization tier.
The play. Watch GSA schedule contract vehicle awards and agency zero-trust implementation plans (posted via CISA and OMB) for language specifying "identity-centric" versus "network-centric" zero trust architecture — that word choice picks the incumbent. Track FedRAMP Marketplace status changes for FTNT and S as the tell on whether the field widens or stays a two-horse identity/network race.
Source: original report ↗
Free: catalyst alerts, straight to your inbox.
Get the White House orders, federal contracts, and FDA decisions that move money — with who cashes in — free. Unsubscribe in one click.
Free · weekly · unsubscribe anytime. Privacy.
Stay three moves ahead of every practice in your market.
Knowing it happened is table stakes. Money Racket Pro hands you the play — what each move means for your margins, your license, and your patients, and exactly what to do about it — in a two-minute brief, twice a week. The owners who read it never get blindsided.
Get the edge · $40/moJoin the owners who run ahead of the industry. Cancel anytime, one click.