Rodgers Builders Shifts 100% of Its Sites from SD-WAN to Zero Trust, Slashing Costs by 80%

In business for more than 60 years, Rodgers Builders is a mid-size general contractor that sets itself to a high standard, successfully competing against much larger firms. With a laser-focus on excellence, client care, and its “building with purpose” philosophy, Rodgers creates complex campus-style developments, typically in mission-critical healthcare environments. The organization has been named among the top 10 healthcare construction firms in the U.S. In 2024, it was acquired by Kajima Corporation, a Japanese construction conglomerate. 

To help employees, sub-contractors, and clients clearly grasp what goes into a construction project, Rodgers provides access to 3-D visualization tools and other resources. But sharing apps and files introduces risk. Additionally, because construction firms handle massive capital outlays and are perceived as slow to adopt the latest security controls, they are a lucrative target for bad actors. 

As such, CIO Markus Hill is committed to following security best practices and to building a solid infrastructure to support the business in every way possible: “We really strive to use the most advanced technologies available to secure our projects, information, our teams, and our clients.”

To fortify the company’s cyber resilience, Hill replaced much of the company’s legacy castle-and-moat security with the Zscaler Zero Trust Exchange platform to secure user access to the internet and corporate resources without the complexity of a traditional network infrastructure. Since then, the company has been on a journey of discovery that has led to greater utilization and expansion of its zero trust architecture. 

“Adopting technology in the construction industry isn’t always easy. Our users and contractors are frequently on sites in the middle of nowhere, and they need to have the ability to work wherever and whenever. What I learned with Zscaler over the years is that it’s not the location that matters, but rather the who and the what. Zscaler has given us a way to build a system that allows us to protect people and their devices wherever they are, regardless of the network,” said Hill. “Zscaler is foundational to our ongoing mission to improve our cyber resilience.”

At Rodgers, most of its 300-plus employees work remotely across 30 job sites and five regional offices. Typically, there is anywhere from a handful to 50 people at these locations at any given time. Before Zscaler, each location had an SD-WAN setup with appliances, firewalls, switches, and routers to connect to the corporate network. Rodgers was “drowning in complexity,” in Hill’s words. With a small team of five under his supervision, Hill often had to hire consultants to assist with configurations and other tasks every time a new location was added. 

“It’s a false premise to say that a traditional security stack can adequately protect remote employees who are using their own laptops—you simply don’t have the control over or visibility into the endpoints. With Zscaler, we can run our operation without the infrastructure we used to have—and now we have significantly minimized our attack surface and are more secure than ever,” said Hill.

To enable secure work-from-anywhere, he deployed cloud-native Zscaler Internet Access (ZIA), which provides:

• Seamless, secure access to the internet and SaaS apps at job sites, hotels, and on the road
• Consistent policy enforcement based on context and user identity 
• 100% SSL/TLS inspection to block malware hidden in encrypted traffic and curb data exfiltration 
• Advanced protections, such as URL filtering to keep users from visiting malicious websites and AI-powered phishing and zero-day threat detection
• Zscaler Sandbox to block and quarantine unknown malware hidden in CAD, PDF, and Microsoft documents shared by third parties 

Zscaler Private Access (ZPA) was implemented soon after ZIA to deliver:

• Zero trust access to 60-plus private apps hosted in the data center and the cloud (Azure and AWS) 
• Frictionless connectivity to apps, with no need to log into VPN every time
• A secure, low-latency experience that boosts user productivity 

“Zscaler took a tremendous amount of risk, cost, and complexity out of the equation. In a few short months, we eliminated VPNs and other costly, high-maintenance hardware while providing a more secure solution and a great user experience,” said Hill. “Before it used to take weeks to set up a job site. Now, with Zscaler, we can connect to broadband in minutes.” 

As part of the company’s defense-in-depth program, Hill added Zscaler Identity Threat Detection and Response (ITDR) to detect identity-based attacks like credential theft targeting identity access and management solutions that exploit risky configurations and permissive privileges. Integrated with identity solutions, ITDR provides greater visibility into the identity attack surface and accelerates investigation and response. 

Hill then implemented Zscaler Digital Experience (ZDX) to address common video conferencing challenges in Microsoft Teams and Zoom, such as latency, disconnections, and degraded audio and video quality. ZDX offers comprehensive end-to-end visibility, correlating issues across networks, devices, and apps. This empowers the help-desk team to swiftly and accurately pinpoint the root cause of performance problems, whether stemming from network bottlenecks, device health, or app performance and availability.

“ZDX enables us to quickly identify and address issues so we can provide users with clear explanations and actionable solutions. By doing so, we not only enhance their trust in our ability to resolve problems but also deliver a significantly improved user experience. ZDX operates seamlessly in the background, with no disruption to our users, while driving faster resolutions and greater productivity,” remarked Hill. 

Once the zero trust fundamentals were in place, Hill focused on transitioning distributed locations from a legacy network framework to a modern café-like zero trust model. By rolling out Zscaler Client Connector and Zscaler Zero Trust Branch, he continued to reduce complexity to make the lives of IT and users that much better.

“This was another important step in providing our mobile workforce with high-performance, zero trust access to apps from anywhere,” he remarked.

In the first three to four months, Hill and his team replaced physical firewalls and switches from project sites by installing the lightweight Client Connector agent to endpoints used out in the field to make it faster, easier, and less costly to set up a new site.

“Because we have eliminated backhauling and multiple points of failure, our users are happier and noticeably more productive,” said Hill.

By deploying Zscaler Zero Trust Branch at all five regional offices, Hill completely phased out legacy hardware. It’s a simpler, more secure solution for connecting branch offices to apps in data centers. Replacing the cumbersome and costly SD-WAN eliminates backhauling, shrinks the attack surface, and prevents lateral threat movement.

“Zero Trust Branch has been a real win for our entire organization: it reduces management complexity, results in significant savings, and creates a better user experience,” said Hill.

When SD-WAN failed two weeks before launching a high-priority ERP upgrade, Hill pulled the trigger on deploying Zero Trust Branch for 40+ users at headquarters, completing the company-wide rollout.

“To our amazement, we plugged in Zero Trust Branch, and it just worked. All of our VLANs and devices came up. The implementation was agentless, simple, and extremely fast, and we never went back to SD-WAN, which was overly complex and had more settings than we needed,” observed Hill. “What I like best about Zero Trust Branch is its asset discovery capability. After one week, it found and categorized 640 devices we never knew we had: printers, computers, TVs and more.”

Hill also values the device segmentation built into Zero Trust Branch. Like other construction companies, Rodgers faces significant risks when guests connect to the local network to access project resources. Zero Trust Branch solves this problem by automatically isolating connected endpoints into a network of one. 

“Zero Trust Branch gives us the ability to unify the Zscaler tools we already have—ZIA, ZPA, and ZDX-- expanding visibility so we can clearly see what's on the network. It also shrinks the attack surface by connecting users only to the apps they need and prevents lateral threat movement by isolating each device.”

During zero trust deployment, Hill found Zscaler Risk360 to be an invaluable tool for enabling proper configuration and greater platform utilization. The risk quantification and visualization framework ingests data from the Rodgers environment, external sources, and Zscaler ThreatLabz to provide detailed insights into risk associated with the external attack surface, potential compromise, lateral threat movement, and data loss. Hill and his team use Risk360 to identify areas that need improvement. By following the tool’s recommended actions, which are presented in an interactive dashboard, Hill and his team were able to fine-tune Zscaler configurations on their own, without relying on expensive consultants. 

He also regularly tracks the company’s risk scores. Making adjustments and expanding utilization of Zscaler led to a 72% improvement in the risk score in just four months. Hill is also using Risk360 for reporting to the executive staff and hopes to expand this use case to bring greater visibility into the business and operational benefits of zero trust.

“Risk360 has enabled us to close some loopholes. At Rodgers, our charter is to make the most of our technology investments. Risk360 has helped us by showing us how to leverage advanced features to proactively improve security. 

Over the course of the deployment, Zscaler prevented 4.7 million policy violations and blocked 44,909 threats (6,590 hidden in encrypted traffic) over a 90-day span—key metrics that contributed to a vastly improved risk score.

Zscaler has also enabled Hill to significantly reduce infrastructure complexity and costs. Retiring firewalls, switches, and routers at project sites saves the company hundreds of thousands of dollars in hardware, support, maintenance, and consulting costs. Replacing SD-WAN with Zero Trust Branch company-wide has further boosted the cost savings. Switching to Zero Trust Branch cut connectivity cost by 80% and bandwidth cost by 75%.

“I love how Zscaler gives me the flexibility to meet my company’s unique requirements. One of the biggest benefits is the ability to simplify and strengthen our security. Now we can focus on what matters most: providing users with a consistent and secure access experience based on identity and device instead of location,” noted Hill. “The case for deploying Zscaler at a medium-size business is huge: it’s flexible, adaptable, and provides enterprise-grade protection at a significant cost savings over traditional perimeter-based security.”