Zscaler Internet Access

No entries match these filters. Clear filters

1. changelog Oct 30, 2026 · issue 127

   Zscaler Internet Access adds portable-device and optical-media controls, DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Intent visibility, and Zoom AI transcript scanning for FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. environments⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Endpoint DLP 26.08 now extends Device Control to portable devices (smartphones and cameras), CD/DVD, and floppy disk channels (floppy disk is Windows only).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Endpoint DLP 26.08 adds DLP Intent visibility into suspicious user behavior and into sensitive files entering endpoints.
   • Endpoint DLP 26.08 adds a CSV export for Application Inventory.
   • Endpoint DLP 26.08 now lets IDM index all files in a folder, removing the previous 20-file limit.
   • Endpoint DLP 26.08 adds real-time OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. support for PDFs across all channels except Application File Access.

   +2 more show less

   • Endpoint DLP 26.08 adds a refreshed User Investigation experience.
   • Zoom tenants using Data at Rest Scanning DLP and Malware can now scan AI transcripts and AI meeting summaries generated by Zoom AI Companion.
   • Endpoint DLP 26.08 now extends Device Control to portable devices (smartphones and cameras), CD/DVD, and floppy disk channels (floppy disk is Windows only).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Endpoint DLP 26.08 adds DLP Intent visibility into suspicious user behavior and into sensitive files entering endpoints.
   • Endpoint DLP 26.08 adds a CSV export for Application Inventory.
   • Zoom tenants using Data at Rest Scanning DLP and Malware can now scan AI transcripts and AI meeting summaries generated by Zoom AI Companion.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Existing Zoom tenants onboarding AI transcript and AI meeting summary scanning must add additional scopes, webhook subscriptions, and reauthorize their Zoom integration.
2. changelog Oct 27, 2026 · issue 123

   Zscaler Cloud Sandbox adds AI Instant Verdict inline blocking, macOS detonation, 200 MB large file support, and API-driven file analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds AI/ML Detection Source column to Insights Logs for reviewing AI/ML-driven detections and actions inline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds AI Instant Verdict: files scoring 91–100 on the AI/ML threat confidence scale are blocked inline before reaching an endpoint, with ~91% receiving instant benign verdicts and ~9% escalated to full dynamic detonation.
   • Adds macOS detonation support for .dmg and .pkg files across both inline and API channels, extending behavioral analysis to Mac fleets.
   • Raises file size support for EXE and DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. inspection to 200 MB with 10-layer archive inspection for nested and compressed packages.
   • Adds API-Driven File Analysis for on-demand file submission, producing MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior.-mapped reports with TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., and PCAPsPCAPsA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic., feeding into SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents./SOAR workflows.

   +2 more show less

   • Adds Endpoint Sandbox (coming early 2027) via Zscaler Client Connector to intercept and inspect files arriving via offline paths such as USB, Bluetooth, and AirDrop before execution.
   • Adds Content Disarm & Reconstruction (coming early 2027) to strip malicious content, reconstruct files in their original native format, and deliver sanitized versions.
   • Adds AI/ML Detection Source column to Insights Logs for reviewing AI/ML-driven detections and actions inline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds AI Instant Verdict: files scoring 91–100 on the AI/ML threat confidence scale are blocked inline before reaching an endpoint, with ~91% receiving instant benign verdicts and ~9% escalated to full dynamic detonation.
   • Adds macOS detonation support for .dmg and .pkg files across both inline and API channels, extending behavioral analysis to Mac fleets.
   • Adds API-Driven File Analysis for on-demand file submission, producing MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior.-mapped reports with TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind., IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., and PCAPsPCAPsA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic., feeding into SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents./SOAR workflows.
   • Adds Endpoint Sandbox (coming early 2027) via Zscaler Client Connector to intercept and inspect files arriving via offline paths such as USB, Bluetooth, and AirDrop before execution.

   +1 more show less

   • Adds Content Disarm & Reconstruction (coming early 2027) to strip malicious content, reconstruct files in their original native format, and deliver sanitized versions.

   1 more in Everything

3. changelog Aug 13, 2026 · issue 044

   Zscaler Zero Trust Gateway for Google Cloud adds multi-cloud policy, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS inspection, sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls., and AI dev tool protection.

   • Adds Advanced Threat Protection with inline SSL inspection targeting malware and ransomware in cloud traffic.
   • Enables secure access controls for AI development tools such as Devin and Cursor without blocking developer workflows.
   • Consolidates virtual firewall infrastructure across multi-cloud environments under a single policy framework to reduce sprawl.

   3 details in Everything

4. changelog Jul 30, 2026 · issue 031

   ZIA adds DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. log filters, time-bound file type rules, and per-channel DLP engine scoping in the July 2026 GovCloud release.

   └──▷ HOW TO FIND IT
   Scope a DLP engine to only the Endpoint DLP channel to reduce noise from irrelevant matches in other channels.
   📍In the ZIA console, go to Policies › Data Protection › Common Resources › DLP Dictionaries & Engines › DLP Engines, then create, edit, or clone a DLP engine and select the specific channels (e.g., Endpoint DLP, DSPM) under the channel selection option.
   Set a temporary exception for a file type control rule that automatically expires after an operational window.
   📍In the ZIA console, navigate to your File Type Control policy rule, open the rule settings, and set an expiration date under the rule configuration to auto-expire the exception at the end of the allowed window.
   • Adds DLP Policy Action and DLP Confirmation Message filter columns to Web Insights Logs and Endpoint DLP Insights Logs for improved audit and incident investigation.
   • Enables expiration dates on File Type Control policy rules for time-limited enforcement windows and temporary exceptions.
   • Allows custom and predefined DLP engines to be scoped to specific channels (e.g., Endpoint DLP, DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores.), reducing false-positive noise from broad engine application.
   • Risk360 is now included in most ZIA and platform SKUs for organizations with more than 500 users.

   4 details in Everything

5. changelog Jul 15, 2026 · issue 017

   Zscaler Endpoint Context enriches security logs with endpoint data for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. and SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. automation workflows.