SECURITY ATLAS / EVALUATION BRIEF
Zscaler Data Loss Prevention
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/zscaler-dlp/

THE ATLAS TAKE
Zscaler DLP applies content policy through its cloud security architecture and separately scoped endpoint and cloud-data capabilities. The central architectural question is whether the intended data movement actually crosses the inspection point. Atlas analysis: it fits a cloud-access program prepared to manage routing, encrypted traffic, and policy exceptions. Keep inline prevention separate from out-of-band discovery or remediation. Also verify the integration semantics: the documented third-party ICAP forwarding path sends transaction information after Zscaler's own policy decision and does not accept an external DLP response as its enforcement instruction.

SCOPE
This profile covers the documented DLP channels, including Zscaler Internet Access, endpoint and SaaS data at rest. Endpoint functions require the applicable Client Connector configuration; broad database or data-lake inventory is a separate evaluation question.

WORTH A LOOK WHEN
Teams building data controls around a Zscaler internet and SaaS access architecture with explicit channel coverage.

THINK TWICE WHEN
The design relies on a third-party ICAP verdict controlling Zscaler enforcement or assumes unsteered traffic is inspected.

IMPLEMENTATION
1. Document the transfer routes
Include remote users, branches, application exceptions, and direct-access paths.

2. Validate policy and inspection
Use synthetic data and record steering, TLS handling, rule order, and matched conditions.

3. Integrate incident handling
Agree analyst access, user coaching, third-party forwarding, and exception expiry.

OPERATING REALITY
Traffic forwarding, TLS exceptions, rule ordering, endpoint resources, and incident operations need ongoing review. Atlas analysis: route and content coverage should be tested together. A classifier can work correctly while a policy misses the transfer because a user, application, or network path never encounters the expected inspection.

COMMERCIAL CONSIDERATIONS
Quote web, endpoint, email, cloud, and context functions separately where needed, using the expected user and channel scope.
- Protected users and DLP channels
- Endpoint DLP and context entitlements
- Routing, TLS inspection, and incident operations

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Test an encrypted upload
Acceptance evidence: Retain traffic route, inspection eligibility, matched rule, and user-visible outcome.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Validate ICAP semantics
Acceptance evidence: Confirm Zscaler's own action and the separate forwarded incident received by the downstream system.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Exercise endpoint resources
Acceptance evidence: Use a lab printer or removable device and prove the licensed policy targets the intended resource.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Which encrypted flows are actually inspected and which are excluded or technically unsupported?
- Which endpoint operations are covered by the chosen Client Connector version and policy?
- For each SaaS repository, can the integration quarantine, label or restrict collaboration, and what permissions does that action require?

EVIDENCE GAPS
- No independent classification, network-latency, or endpoint-impact measurement was performed.
- Current UI, product packaging, and channel-specific support need confirmation.

SOURCES
Zscaler DLP product scope (Product information)
https://www.zscaler.com/products-and-solutions/data-loss-prevention
DLP and endpoint resource licensing (Documentation)
https://help.zscaler.com/zia/about-dlp-resources
DLP policy and ICAP behavior (Documentation)
https://help.zscaler.com/legacy-zia/about-data-loss-prevention

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.