SECURITY ATLAS / EVALUATION BRIEF Zscaler Internet & SaaS and Private Access Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/zscaler-secure-access/ THE ATLAS TAKE Zscaler is a serious evaluation candidate for organizations replacing network-centric remote access and central internet inspection. The combined profile should still be understood as ZIA for internet/SaaS traffic and ZPA for private applications, with Client Connector and application-side connectivity designed explicitly. Atlas sees the application boundary as the decisive benefit to test: a user should reach the approved service without gaining unnecessary adjacent reachability. The project succeeds through application inventory, identity and forwarding accuracy. A broad platform purchase cannot compensate for incomplete routing or an overly permissive application definition. SCOPE The scored configuration selects ZIA web policy plus ZPA private application access and Client Connector. ZDX, advanced data protection, browser isolation and privileged access add-ons are excluded unless specifically purchased and assessed. WORTH A LOOK WHEN Enterprises prepared to map applications, user groups and traffic forwarding across a distributed workforce. THINK TWICE WHEN The team expects a license change alone to replace every legacy VPN dependency. IMPLEMENTATION 1. Inventory a representative application Map DNS, ports, helper services and user groups before migrating a complex business workflow. 2. Pilot forwarding and certificates Check endpoint traffic paths, trust configuration and exceptions on representative operating systems and networks. 3. Rehearse connector failure Demonstrate redundancy, useful diagnostics and an owned recovery process without opening broad fallback access. OPERATING REALITY Network, endpoint and identity teams share responsibility for forwarding, client updates, application definitions and connector availability. Troubleshooting must distinguish authentication, policy and application reachability. When a new application arrives, its DNS, dependencies and access owner need to enter the same operating process rather than an expanding catch-all exception. COMMERCIAL CONSIDERATIONS Compare a written ZIA, ZPA and Client Connector configuration with any optional services. Include application discovery, connector infrastructure and migration operations in the commercial model. - User populations and selected ZIA/ZPA editions - Connector infrastructure and regional architecture - Application migration, endpoint rollout and diagnostics EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Allow one private application and deny an adjacent service Acceptance evidence: Keep identity, policy and destination-side evidence. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Fail a test App Connector Acceptance evidence: Record remaining reachability and diagnostic ownership. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Trace an internet policy decision Acceptance evidence: Correlate client route, inspection outcome and the user-visible result. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Which ZIA and ZPA subscriptions are actually selected? - Which session controls require client or application changes? - How are connector health, inspection exceptions and exported logs operated? EVIDENCE GAPS - Atlas has not independently measured latency, resilience or prevention efficacy. - Some help pages require JavaScript; confirm full release-specific prerequisites in the deployment review. SOURCES Zscaler Internet and SaaS Access (Product information) https://www.zscaler.com/products-and-solutions/zscaler-internet-access Zscaler Private Access (Product information) https://www.zscaler.com/products-and-solutions/zscaler-private-access ZPA App Connectors (Documentation) https://help.zscaler.com/zpa/about-connectors ZPA private-access architecture (Documentation) https://help.zscaler.com/zpa/understanding-private-access-architecture Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.