SECURITY ATLAS / EVALUATION BRIEF Zscaler MDR Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/zscaler-mdr/ THE ATLAS TAKE Zscaler MDR builds on Red Canary's managed detection and response following the completed acquisition. The current product and release documentation should govern an evaluation, rather than assuming that every Zero Trust Exchange capability is automatically a managed response source. Atlas analysis: it is interesting for teams connecting endpoint, identity, and cloud detection with a wider Zscaler architecture. Preserve an explicit inventory of supported telemetry and actions. Corporate ownership explains the portfolio, but only current integration behavior and the service agreement establish who monitors, who can respond, and what remains with the customer. SCOPE The service investigates integrated EDR, cloud, and identity threats. Do not assume Zero Trust Exchange coverage without the order form. Ask which EDR classes are supported in the purchased SKU. WORTH A LOOK WHEN Teams evaluating current Red Canary-derived MDR alongside existing endpoint, identity, cloud, or Zscaler services. THINK TWICE WHEN The buying case depends on assuming the acquisition makes every Zscaler signal and response action automatically in scope. IMPLEMENTATION 1. Reconcile product identity Record the current service name, contract entity, documentation path, and support contacts. 2. Map each integration Separate collected events, managed detections, investigation access, and response actions. 3. Test a current workflow Use an approved lab case and retain the service handoff and target-side action evidence. OPERATING REALITY Supported integrations, collection health, response configuration, release changes, and emergency contacts need maintenance. Atlas analysis: reconcile inherited Red Canary names and documentation with the quoted Zscaler service. Keep a dated record of the actual covered sources and actions so a portfolio transition does not create ambiguous incident ownership. COMMERCIAL CONSIDERATIONS Quote MDR independently from underlying security tools and any adjacent Zscaler products or integration services. - Covered source products and protected population - MDR service and response configuration - Underlying platform and integration costs EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Verify a claimed integration Acceptance evidence: Show a current source event becomes an in-scope managed investigation. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Rehearse response authority Acceptance evidence: Retain direct action, customer approval, and pending tasks for a synthetic incident. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Check release-sensitive behavior Acceptance evidence: Repeat one integration test after an agreed update and document changed scope or prerequisites. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Which EDR classes are supported, and is Zero Trust Exchange telemetry on the order form? - Who owns the former Red Canary portal access and automations after the brand change? - How are investigation records exported if the service later ends? EVIDENCE GAPS - No independent service-performance or cross-product integration test was performed. - Public portfolio statements do not establish every current source or response entitlement. SOURCES Zscaler MDR release notes (Documentation) https://docs.redcanary.com/docs/red-canary-release-notes Completed Red Canary acquisition (Lifecycle) https://www.zscaler.com/press/zscaler-completes-acquisition-red-canary-accelerate-innovations-agentic-ai-driven-security Zscaler MDR scope (Product information) https://www.zscaler.com/products-and-solutions/managed-detection-and-response Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.