The Atlas take.
Zscaler MDR builds on Red Canary's managed detection and response following the completed acquisition. The current product and release documentation should govern an evaluation, rather than assuming that every Zero Trust Exchange capability is automatically a managed response source. Atlas analysis: it is interesting for teams connecting endpoint, identity, and cloud detection with a wider Zscaler architecture. Preserve an explicit inventory of supported telemetry and actions. Corporate ownership explains the portfolio, but only current integration behavior and the service agreement establish who monitors, who can respond, and what remains with the customer.
02 / DEFINE THE BOUNDARY
What you are actually evaluating.
The service investigates integrated EDR, cloud, and identity threats. Do not assume Zero Trust Exchange coverage without the order form. Ask which EDR classes are supported in the purchased SKU.
Names you may encounter Red Canary. Historical names do not establish current feature equivalence.
03 / THE CONTROL PATH
Where it sits. How it works.
Atlas architecture interpretation: trace the trigger, the identity allowed to act, and the evidence left by the outcome.
- 01
Supported source telemetry
Configured endpoint, identity, cloud, and other supported sources supply evidence.
- 02
Managed detection and investigation
The current MDR operation analyzes covered signals and produces response guidance or authorized action.
- 03
Customer incident workflow
The service agreement and configuration assign containment, remediation, and recovery responsibilities.
04 / WHAT EARNS ITS PLACE
Strengths, with the evidence attached.
Atlas analysis of documented capabilities; availability and behavior depend on the edition and environment.
Current operational documentation remains visible
The Red Canary documentation now publishes Zscaler MDR release notes, supporting release-specific capability checks.
Ownership is officially established
Zscaler confirms the acquisition completion rather than merely an announced intention.
Inspect the documented capability notes
- Around-the-clock investigation of integrated EDR, cloud, and identity threats.
- Customer portal and automations for cases the service raises.
- Test-threat validation (RCCAR) so buyers can rehearse detection without attacking production.
05 / KNOW THE COMPROMISES
The tradeoffs to take seriously.
Architectural implications and procurement questions from Atlas; these are not independently measured product failures.
Service and product boundaries persist
A managed detection result does not establish recovery or every possible control action; verify the purchased response scope.
06 / FROM PURCHASE TO PRACTICE
Make it work in your environment.
A proposed implementation sequence. Confirm supported versions, permissions, and rollback with the current documentation.
- 01
Reconcile product identity
Record the current service name, contract entity, documentation path, and support contacts.
- 02
Map each integration
Separate collected events, managed detections, investigation access, and response actions.
- 03
Test a current workflow
Use an approved lab case and retain the service handoff and target-side action evidence.
07 / THE OPERATING COMMITMENT
The bill is only part of the cost.
Commercial shape
Quote MDR independently from underlying security tools and any adjacent Zscaler products or integration services.
- Covered source products and protected population
- MDR service and response configuration
- Underlying platform and integration costs
08 / COMPARE THE JOB
Put these beside it.
Alternatives worth examining for the same problem. Check each offering’s scope before treating it as a substitute.
Expel MDR
Compare managed operations across a mixed stack with explicit investigation transparency.
SophosSophos MDR
Compare integration and response-tier arrangements when preserving existing security technology.
09 / MAKE THE DECISION OBSERVABLE
Earn confidence through a real evaluation.
Suggested by Atlas. Agree acceptance criteria, use synthetic fixtures in an authorized environment, and capture both useful work and failed controls.
- TEST 01
Verify a claimed integration
Acceptance evidence: Show a current source event becomes an in-scope managed investigation.
- TEST 02
Rehearse response authority
Acceptance evidence: Retain direct action, customer approval, and pending tasks for a synthetic incident.
- TEST 03
Check release-sensitive behavior
Acceptance evidence: Repeat one integration test after an agreed update and document changed scope or prerequisites.
START WITH ONE EXERCISE
In an authorized test environment, use the provider's supported test-threat validation method against a disposable host, then record acknowledge, investigation notes, and whether Zero Trust telemetry was actually in scope.
Evidence to look for: The investigation record names the EDR class used, the validation method, and that production hosts outside the test were not changed.
Questions to bring to the vendor
- Which EDR classes are supported, and is Zero Trust Exchange telemetry on the order form?
- Who owns the former Red Canary portal access and automations after the brand change?
- How are investigation records exported if the service later ends?
10 / SHOW THE WORK
Evidence, and what is still unknown.
What this research cannot establish
- No independent service-performance or cross-product integration test was performed.
- Public portfolio statements do not establish every current source or response entitlement.
Dossier research reviewed October 18, 2026. Earlier profile references are retained for traceability; products and commercial terms change.
- Zscaler MDR scope ↗Product information
- Completed Red Canary acquisition ↗Lifecycle
- Zscaler MDR release notes ↗Documentation
KEEP BUILDING YOUR JUDGMENT