PAGES
← all tools
◆ Secure Access (VPN / SASE / ZTNA)

Zscaler

Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-10-05 commercial

Zscaler is a cloud-native security platform that provides secure internet access, zero trust networking, and threat protection for users, devices, and applications.

Summary

Zscaler is a commercial secure-access platform, delivered as a cloud service, that routes and inspects traffic for private applications, branch sites, and cloud workloads through what it calls its Zero Trust Exchange. It is built for network and security teams — NetOps, SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared., and platform engineers — who need to protect users, branches, and OT/IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. devices without deploying and patching individual appliances. Its scope spans application-layer protection that adapts automatically as software changes, a managed Zero Trust browser, branch connectivity with zero-touch provisioning, and integrations into Google Cloud and AI tools like Claude, positioning it against the traditional mix of VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., proxies, and point security products rather than any single named competitor. Launched in 2008 and still active, with 53 tracked releases and its latest just 15 days ago.

Zscaler is a cloud-native security platform that provides secure internet access, zero trust networking, and threat protection for users, devices, and applications.

How Zscaler helps

Which private applications are exposed to risk that nobody has patched yet?

continuously assesses exposure via App Connectors and applies per-app protections in the cloud automatically, so a stale application still gets current controls without waiting on a maintenance window | which is only as current as the telemetry Zscaler's global customer base feeds into the model

Which AI agents on this machine are calling tools I never approved?

the browser extension enumerates every tool a site registers before it runs and logs each invocation with the tool name, arguments, provider origin, and the user and device behind it, searchable in the admin console

Is a branch user's slow connection my network's fault or the ISP's?

the route visualization and per-carrier telemetry break latency and packet loss down by ASN and by hop, and peer impact analysis shows whether other customers on the same path see the same problem

Which devices at a branch site can talk to each other when they shouldn't?

assigns each device its own isolated network segment as it's discovered, so cameras, badge readers, and building systems stay separated from user traffic without manual VLAN work

Who has access they shouldn't across my cloud accounts and identities?

maps human, service-account, and AI-agent identities to the data and endpoints they can reach, tracing paths that reveal overprivileged or toxic combinations and ranking them by blast radius

all 117 features, with the evidence for each →

Languages

English, Chinese (Simplified), Chinese (Traditional), French, German, Japanese, Spanish Release notes: English, Chinese (Simplified), Chinese (Traditional), French, German, Japanese, Spanish Chinese (Simplified), French, German, Japanese, Spanish added in Client Connector — Release Upgrade Summary (2025) — 2025-02-14 (Feb 14, 2025) · Chinese (Simplified), French, German, Japanese, Spanish added in Client Connector — Release Upgrade Summary (2025) — 2025-02-07 (Feb 7, 2025) · Chinese (Traditional), French, German, Japanese, Spanish added in Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-10-16 (Oct 16, 2024) · Chinese (Traditional), French, German, Japanese, Spanish added in Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-10-07 (Oct 7, 2024) · English, French added in Client Connector — Client Connector App Release Summary (2024) — 2024-07-05 (Jul 5, 2024)

Features

117 capabilities

Built from Zscaler's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What Zscaler offers you

  • REST API19
  • Web management console10
  • Administrative audit log3
  • User-defined detection rules3
  • Agent-based deployment2
  • ML-based detection2
  • SAML SSO2
  • Scheduled jobs2
  • SIEM forwarding2
  • Single sign-on2
  • CI/CD pipeline integration1
  • Multi-tenant management1
  • OIDC SSO1
  • On-premises appliance1
  • Outbound webhooks (the product notifies you)1
  • Python scripting support1
  • Role-based access control1
  • Scripting language support1
  • Ticketing integration1
All capabilities 117 capabilities
Autonomous Application Shield shipped Continuously assesses private application exposure via App Connectors and automatically applies per-app, ML-tuned protections in the Zscaler cloud — adapting when new releases ship and integrating global threat intelligence — without requiring patches, manual re-tuning, or security team intervention. 75 releases · 1 other source · first seen May 2019

release 75 total

  • Automatic protection adaptation when developers ship new releases — security policy updates without manual re-tuning, policy review meetings, or security team intervention. changelog · Jul 2026 · source · release history
  • Per-application protection reasoning: the Zscaler cloud evaluates each private application individually and applies only the controls that specific application needs, reducing false positives and performance impact. changelog · Jul 2026 · source · release history
  • Global threat intelligence integration feeds zero-day and emerging attack technique data from Zscaler's worldwide customer base into the protection engine, with ML continuously tuning policies per application. changelog · Jul 2026 · source · release history
  • New Autonomous Application Shield capability continuously assesses private application exposure via App Connectors and automatically applies per-app protections in the Zscaler cloud without requiring a patch. changelog · Jul 2026 · source · release history
  • Adds standalone App Hardening enabling manual application registration via AI Infrastructure > Remediation page for unmanaged applications without standard onboarding. Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-06-08 · Jun 2026 · source · release history
  • Adds new model attributes endPointApplications, endPointApplicationGroups, endPointApplicationThreatLevels, and excludeContextShieldEndPoint to SSLInspectionRule, FirewallFilteringRule, and FirewallDnsRule policy models to enable endpoint-based conditions. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-04 · Jun 2026 · source · release history

example

  • Request early access to Autonomous Application Shield to get hands-on experience and direct roadmap input before general availability. In the Zscaler console, contact your Zscaler representative or register via the Early Access Program webinar link to enable Autonomous Application Shield for your private applications. changelog · Jul 2026 · source
Zero Trust Browser shipped Delivers browser-native zero trust security across three deployment form factors — Cloud Browser Isolation, a browser extension with detection and response, and a purpose-built managed Chromium Enterprise Browser — so organizations can mix and match coverage based on user, device, and workflow requirements. 61 releases · first seen May 2019

release 61 total

  • Extends Browser Control Policy to create policies, configure browser control, and HTTP header control for the Brave browser (User Agent criterion in Cloud App, SSL/TLS Inspection, URL Filtering, Browser Blocking) Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-09-25 · Sep 2026 · source · release history
  • Adds Browser Detection and Response (BDR) via the Zero Trust Browser Extension, delivering browser-native threat detection and response inside existing browsers for threats that evade upstream network and endpoint controls. changelog · Jul 2026 · source · release history
  • Introduces Zero Trust Enterprise Browser: a purpose-built, fully managed Chromium browser with Zero Trust security integrated directly into the browsing experience. changelog · Jul 2026 · source · release history
  • Delivers three Zero Trust Browser deployment form factors — Cloud Browser Isolation, Browser Extension, and Enterprise Browser — allowing organizations to mix and match based on user, device, and workflow requirements. changelog · Jul 2026 · source · release history
  • Adds remote_address, transfer_size, and request_header_content_length to the Real User Monitoring (RUM) Browser Extension for new visibility into network context. Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2026) — 2026-07-16 · Jul 2026 · source · release history
  • First release of Enterprise Browser for Zero Trust Browser (dedicated hardened Chromium) across zia, zscalerone, zscalertwo, zscalerthree, zscloud, and zscalerbeta clouds Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-07-01 · Jul 2026 · source · release history
Zero Trust Branch shipped Provides zero-touch branch connectivity with integrated appliances supporting one-arm or gateway mode, per-device /32 segmentation, OT/IoT discovery and isolation, a Ransomware Killswitch, local internet breakout for CISA TIC 3.0 compliance, and FedRAMP Moderate/High support for federal environments. 57 releases · first seen May 2019

Also counts toward: On-premises appliance

release 57 total

  • Zero Trust Branch 8.2.1-P1 adds an Appliance Admin Console page giving administrators terminal access to appliances for troubleshooting (FedRAMP Moderate and High; Limited Availability). changelog · Oct 2026 · source · release history
  • Offers zero-touch provisioning via the integrated Branch Appliance — define a site, activate the appliance, and it establishes secure outbound connectivity automatically. changelog · Aug 2026 · source · release history
  • Supports one-arm mode alongside existing SD-WAN or gateway mode to terminate multiple internet links and load balance traffic, with outbound-only tunnels to the Zero Trust Exchange eliminating publicly exposed routes. changelog · Aug 2026 · source · release history
  • Enables OT and IoT device discovery, tagging, and least-privilege policy enforcement to isolate cameras, badge systems, building management, and other hard-to-patch devices from user networks. changelog · Aug 2026 · source · release history
  • Extends Zscaler Zero Trust Branch to FedRAMP Moderate and High environments, giving civilian federal agencies and public sector organizations a compliant path to zero trust branch security. changelog · Aug 2026 · source · release history
  • Introduces a Ransomware Killswitch concept with color-coded policies, enabling teams to rapidly tighten enforcement during suspicious activity to limit lateral spread. changelog · Aug 2026 · source · release history
Zero Trust Gateway for Google Cloud shipped Transparently steers GCP workload traffic to Zscaler for deep inspection using Google Cloud's Network Security Integration, supporting Single, Multiple, and Shared VPC topologies with policy-driven steering via Security Profiles — no application changes, manual tunnels, or route table modifications needed. 55 releases · first seen Jun 2019

release 55 total

  • Introduces Zscaler Zero Trust Gateway (ZTGW) for Google Cloud, integrating with Google Cloud's Network Security Integration (NSI) to transparently steer workload traffic to Zscaler for deep inspection without application changes, manual tunnels, or route table modifications. changelog · Aug 2026 · source · release history
  • Provides unified visibility across GCP, other clouds, and on-premises environments through the Zscaler Admin Portal. changelog · Aug 2026 · source · release history
  • Uses Google Cloud Security Profiles and Profile Groups to control traffic steering to Zscaler, enabling policy-driven enforcement within GCP traffic flows. changelog · Aug 2026 · source · release history
  • Supports Single VPC, Multiple VPC, and Shared VPC Google Cloud topologies, fitting into existing GCP network architectures. changelog · Aug 2026 · source · release history
  • Adds GET /ztGateway, POST /ztGateway, PUT /ztGateway/{id}, and other Zero Trust Gateway API endpoints for programmatic management of gateways, configuration, and traffic tests. Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-07-13 · Jul 2026 · source · release history
  • Adds GET /domainProfiles, POST /domainProfiles, GET /domainProfiles/{id}, PUT /domainProfiles/{id}, and DELETE /domainProfiles/{id} to the Cloud Service API for domain profile management Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-19 · Jun 2026 · source · release history
ZDX Network Intelligence shipped Surfaces ISP and carrier-level network degradation for hybrid workforces through a global route visualization dashboard, BGP ASN-level probe aggregation, hop-level drill-down, and cross-customer peer impact analysis to distinguish carrier-wide outages from organization-specific issues. 43 releases · first seen Sep 2019

release 43 total

  • Introduces ZDX Peer Impact Analysis, providing cross-customer visibility into whether other Zscaler customers traversing the same ISP path are experiencing the same anomaly — confirming whether an issue is carrier-wide or organization-specific. changelog · Jul 2026 · source · release history
  • Enables BGP Autonomous System Number (ASN)-level aggregation of probe telemetry within ZDX, surfacing per-ASN latency and packet loss to identify which carrier is responsible for user experience degradation. changelog · Jul 2026 · source · release history
  • Adds ZDX Network Intelligence dashboard with global route visualization color-coded by severity, enabling NetOps teams to pinpoint last-mile and transit ISP degradation across hybrid workforces. changelog · Jul 2026 · source · release history
  • Adds hop-level drill-down within BGP ASNs in ZDX, showing per-hop latency and packet loss to identify specific routers or peering points causing problems. changelog · Jul 2026 · source · release history
  • Adds an Apply for locally generated traffic option in the PBR rule configuration to route appliance-originated system traffic (e.g., DHCP relay packets) to a specified nexthop interface. Zero Trust Branch — Release Upgrade Summary (2026) — 2026-03-17 · Mar 2026 · source · release history
  • ZDX Snapshot feature provides a URL that you can share with ZDX users for view-only access to an Incidents dashboard or specific Incident details page. Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-09-13 · Sep 2024 · source · release history
Agentic SecOps shipped An AI-driven security operations layer that correlates telemetry across the Zscaler platform, endpoints, identity, and cloud to detect threats and orchestrate automated closed-loop remediation. 38 releases · first seen May 2019

release 38 total

  • Introduces Agentic SecOps solution (limited availability) — an AI-driven security operations layer that connects telemetry across the Zscaler platform, endpoints/EDR, identity, and cloud to detect threats and orchestrate automated closed-loop remediation. changelog · Jul 2026 · source · release history
  • Introduces Mapping Copilot, an AI-powered mapping assistant available via chat interface on data source mapping pages to provide context-aware recommendations, target entity identification, key field mapping, and complex transformation scripts. Asset Exposure Management — Release Upgrade Summary (2026) — 2026-06-29 · Jun 2026 · source · release history
  • Introduces Mapping Copilot, an AI-guided chat interface on the data source mapping page that provides context-aware recommendations to align third-party source data to the SecOps data model. Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-04-20 · Apr 2026 · source · release history
  • Adds Authentication Service Authentication and Authentication Service SCIM as new log types for NSS for Web, and Authentication Service Admin Audit Log as a new application filter for Admin Audit Logs. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-17 · Apr 2026 · source · release history
  • Adds integrated External Attack Surface Management (EASM) capabilities to the Zscaler SecOps platform, enabling automated discovery and scanning of internet-exposed assets starting from admin-configured seeds. Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-03-30 · Mar 2026 · source · release history
  • Adds Remediation Copilot, an AI-guided remediation assistant available directly in UVM tickets, providing context-aware fix paths based on findings, affected assets, and environment. Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-02-26 · Feb 2026 · source · release history
IPS Control shipped Enables signature-based detection and inline traffic protection at the location or sub-location level. 37 releases · first seen Aug 2019

release 37 total

  • Adds a new Perimeter Policies page and support for creating perimeter policies (Block, Sim Block, Allow) for managed resource groups directly from the Resource Groups page or the new Perimeter Policies page. Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-09-18 · Sep 2026 · source · release history
  • Adds new search filters for Firewall Filtering Policy Rules: Rule Status, Network Application Groups, Application Service Groups, Source Country, Destination Country, Source IPv6 Groups, and Destination IPv6 Groups. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-14 · Aug 2026 · source · release history
  • Adds new search filters (Rule Status, Network Application Groups, Application Service Groups, Source Country, Destination Country, Source IPv6 Groups, Destination IPv6 Groups) to the Firewall Filtering Policy page. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-07 · Aug 2026 · source · release history
  • Adds new ThreatParse rules for DNS reconnaissance, including DNS Active Directory SRV Record Reconnaissance, DNS ANY Record Enumeration, DNSSEC Probe and NSEC Zone Walk Attempt, DNS NS Record Enumeration, DNS NULL Record Query, DNS PTR Reverse Lookup, DNS SOA Record Enumeration, DNS Standard Record… Deception — Release Upgrade Summary (2026) — 2026-05-13 · May 2026 · source · release history
  • Adds GET /ipsSignatureRules/export, GET /ipsSignatureRules/import, POST /ipsSignatureRules/import, and POST /ipsSignatureRules/validateRuleText endpoints for IPS rule export, import, and validation Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-08 · May 2026 · source · release history
  • Adds GET /ipsSignatureRules, POST /ipsSignatureRules, PUT /ipsSignatureRules/{id}, DELETE /ipsSignatureRules/{id} endpoints for managing custom IPS signature rules Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-08 · May 2026 · source · release history
Client Forwarding Policy shipped Defines when application requests are forwarded to ZPA from the Zscaler Client Connector, with bypass or forward actions. 36 releases · first seen Jun 2019

release 36 total

  • Updates Zscaler Client Connector to always use the packet-based filter driver when in Tunnel mode regardless of the Tunnel Driver Type setting in a user’s forwarding profile Client Connector — Client Connector App Release Summary (2025) — 2025-10-30 · Oct 2025 · source · release history
  • Updates a previous change to keep a Zscaler Client Connector firewall rule active from starting to stopping the app to also delete the rule when exiting the app and add the rule when restarting the app. Client Connector — Client Connector App Release Summary (2025) — 2025-10-15 · Oct 2025 · source · release history
  • Updates the forwarding profile settings to drop IPv6 packets from IPv6-only networks, and renames the Drop IPv6 Packets option that drops IPv6 packets in dual stack networks Client Connector — Client Connector App Release Summary (2024) — 2024-12-11 · Dec 2024 · source · release history
  • Adds App segments configuration option in Traffic Forwarding Rules to enable granular control by selecting specific application segments or segment groups. Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-09-09 · Sep 2024 · source · release history
  • Adds new Traffic Forwarding Method page in Administration > Resources to disable tunnels at specific Zscaler data centers based on forwarding method. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-06-14 · Jun 2024 · source · release history
  • Adds a new Traffic Forwarding Method page in Administration > Resources to add, edit, and delete Data Center exclusions based on traffic forwarding method Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-06-07 · Jun 2024 · source · release history
AI Guard for Generative AI shipped Enforces Zero Trust data-loss-prevention policy natively at the AI model layer — currently integrated with Anthropic Claude — evaluating full conversation context in real time using existing Zscaler platform policies with no additional governance stack required. 30 releases · first seen Aug 2019

release 30 total

  • Supports connecting approved commercial AI clients (Claude, ChatGPT) and custom customer-built agents through an OAuth 2.1 authorization flow, with per-user role-scoped consent and revocation. changelog · Sep 2026 · source · release history
  • Adds Conversation View for Proxy Mode Transactions to the AI Guard dashboard, allowing admins to see full multi-turn conversation threads instead of isolated transactions. Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-09-02 · Sep 2026 · source · release history
  • Adds ZIA configuration URL augloop.office.com to enable AI Guard for Microsoft 365 Copilot in Excel, supporting request and response blocking with custom messages Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-08-10 · Aug 2026 · source · release history
  • Integrates Zscaler AI Guard with Anthropic Claude inference hooks to enforce Zero Trust data-loss-prevention policy natively at the Claude model layer, evaluating full conversation context in real time rather than individual messages. changelog · Aug 2026 · source · release history
  • Extends existing Zscaler platform policies to Claude Enterprise touchpoints with no additional governance stack required — existing Zscaler customers can activate with their current policy configuration. changelog · Aug 2026 · source · release history
  • Adds multi-turn conversation stitching to the AI Guard Dashboard (DAS/API mode) so flagged interactions display as a unified thread instead of individual messages Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-07-31 · Jul 2026 · source · release history
Cloud NSS Feeds shipped Streams logs from Zscaler Cloud and Branch Connectors directly to cloud-based SIEM systems, eliminating the need for on-premises NSS virtual machines. 29 releases · 1 other source · first seen Jul 2020

Also counts toward: REST API, SIEM forwarding

release 29 total

  • Enables Log Streaming Service support for VPN (for Legacy Apps) data types: User Status - VPN Service Edge (IP Address Reservation), User Status - VPN Service Edge, and Traffic Flow - VPN Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-09-01 · Sep 2026 · source · release history
  • Enables the journalctl command on ZPA App Connectors, Private Service Edges, Private Cloud Controllers, and Network Connectors to collect service or system logs remotely. Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-07-14 · Jul 2026 · source · release history
  • appInventoryAppTypes, appInventoryThreatTypes, and appInventoryThreatCategories fields are available in the ZmanageNssFeed model for the /nssFeeds APIs to filter Application Inventory logs. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-03 · Jun 2026 · source · release history
  • Adds %s{ac_doc_subtypes} field to the Feed Output Format for NSS or Cloud NSS feeds configured for Email DLP logs to capture document subtypes like invoices and expense reports. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-17 · Apr 2026 · source · release history
  • Adds urlCategoriesExclude, urlClassesExclude, and urlSuperCategoriesExclude fields to the ZmanageNssFeed model in the /nssFeeds API for URL exclusion in web logs. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-03 · Apr 2026 · source · release history
  • The Entra ID - Devices stream now retrieves registered owners for each device alongside existing inventory fields (device ID, name, OS, compliance, and management fields). Asset Exposure Management — Release Upgrade Summary (2026) — 2026-02-09 · Feb 2026 · source · release history

example

  • Configure the Zscaler Incident Receiver to forward logs to an external syslog server for centralized monitoring. sudo zirsvr configure-syslog-server Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-09-03 · Sep 2021 · source
SaaS Security Activities Reporting shipped Generates reports detailing user activity within SaaS applications and associated security alerts. 28 releases · first seen Apr 2020

release 28 total

  • Adds %s{upload_doc_sub_type} and %s{upload_doc_subtype} fields to NSS Feed Output Formats for web logs and SaaS Security feeds to log uploaded/downloaded document subtypes Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-15 · Sep 2025 · source · release history
  • Detailed report CSV files (downloaded from the Application and User Group Relationships page) now include a Discovered Application column indicating if an application was discovered. Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-09-09 · Sep 2025 · source · release history
  • The 3rd-Party App Governance Catalog now supports Zoom, Webex, and Box apps, allowing you to search for, pre-vet, and manage these applications and upload them to your inventory. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-03 · Sep 2024 · source · release history
  • The 3rd-Party App Governance Dashboard now displays an overview of all active and deactivated apps across your business, including counts for active, deactivated, and risky apps as well as affected users over a specific time period. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-03 · Sep 2024 · source · release history
  • Existing MCAS partner integrations using token-based authentication can no longer have configuration changes made to them; Zscaler recommends converting to OAuth 2.0, after which the Token option is no longer available. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-08-30 · Aug 2024 · source · release history
  • New token-based MCAS integrations are not available as an option in the portal. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-08-30 · Aug 2024 · source · release history
Expanded Predefined DLP Identifiers shipped Adds numerous new predefined identifiers for PII and sensitive data types, including national health indexes, tax IDs, passports, and VAT numbers across multiple regions. 27 releases · first seen Mar 2020

release 27 total

  • Restricts the US Government ID category in Secrets Detector policies to only Detect and Disable options, with automatic transition of existing BLOCK/ALLOW policies to Disabled mode Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-07-31 · Jul 2026 · source · release history
  • Introduces Enhanced Driver's License (United States) predefined DLP dictionary with individually configurable state sub-dictionaries accessible via Administration > DLP Dictionaries & Engines Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-14 · Nov 2025 · source · release history
  • Adds Enhanced Driver's License (United States) predefined DLP dictionary with individual state sub-dictionaries configurable via Confidence Score Threshold, Proximity Length, and Custom High Confidence Phrases Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-05 · Nov 2025 · source · release history
  • Adds Enhanced Driver's License (United States) predefined DLP dictionary with individually configurable state sub-dictionaries (50 states + DC) accessible via DLP Dictionaries & Engines page Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-10-24 · Oct 2025 · source · release history
  • Adds GET /casbDlpRules, POST /casbDlpRules, GET /casbDlpRules/all, GET /casbDlpRules/{ruleId}, PUT /casbDlpRules/{ruleId}, and DELETE /casbDlpRules/{ruleId} endpoints to manage Data at Rest Scanning DLP policies programmatically Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-06-27 · Jun 2025 · source · release history
  • Adds Endpoint DLP support for predefined dictionaries: CNPJ Number (Brazil), Mexico Unique Population Registration Code, National Economic Registry Number (Poland), Personal Identification Number (Croatia), and Unique Master Citizen Number Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-06-20 · Jun 2025 · source · release history
Z-Tunnel 2.0 shipped Provides an HTTP tunnel using DTLS/TLS that supports TCP, UDP, and ICMP traffic forwarding. 27 releases · first seen May 2019

release 27 total

  • Adds support for controlling how Zscaler Client Connector interacts with the Receive Segment Coalescing (RSC) feature on network adapters to resolve compatibility issues. Client Connector — Client Connector App Release Summary (2026) — 2026-01-30 · Jan 2026 · source · release history
  • Adds Redirect Web Traffic to Zscaler Client Connector Listening Proxy and Use Z-Tunnel 2.0 for Proxied Web Traffic options for the Z-Tunnel 2.0 protocol bypass feature Client Connector — Client Connector App Release Summary (2026) — 2026-01-13 · Jan 2026 · source · release history
  • Enhances IPv6 infrastructure to receive traffic directly from remote users via Zscaler Client Connector when Enable IPv6 Resolution for Zscaler Domains is enabled in the Portal Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-21 · Nov 2025 · source · release history
  • Adds TLS as a selectable ZIA tunnel mode for Cloud Connectors, allowing fallback detection that switches from Unencrypted UDP or DTLS to TLS when the tunnel is unhealthy. Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-06-30 · Jun 2025 · source · release history
  • Supports Hi-Fi Cloud Path to Zscaler Internet Access (ZIA) Public Service Edge through the Generic Routing Encapsulation (GRE) and Internet Protocol Security (IPSec) tunnel Client Connector — ZDX Module Release Summary (2025) — 2025-04-30 · Apr 2025 · source · release history
  • Adds HashiCorp Vault as a supported secret store option for new Zscaler Cloud Connectors on Google Cloud Platform (GCP), replacing the requirement for GCP Secret Manager. Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-02-14 · Feb 2025 · source · release history
SaaS Security Posture Management shipped Generates automated reports and enforces policies to monitor sanctioned and unsanctioned SaaS application usage, risk indexing, and certification compliance across the organization. 25 releases · first seen Feb 2021

Also counts toward: Web management console

release 25 total

  • Introduces the SaaS Overview dashboard within DSPM to visualize detected incidents, affected applications/users, and public exposure of sensitive data in SaaS apps. Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-08-17 · Aug 2026 · source · release history
  • Adds support for new posture controls in the Microsoft 365 connector for Power Apps, Power BI, Microsoft Purview, and Viva Engae under Advanced SaaS Security Posture Management (SSPM) Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-07-09 · Jul 2026 · source · release history
  • Adds support for Snowflake as an API-Based Platform in Advanced SSPM, including visibility into posture misconfigurations via the SSPM Scan checkbox during tenant onboarding Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-19 · Jun 2026 · source · release history
  • Introduces Read-only connector option for SSPM scans on GitHub, Jira, Okta, Confluence, Trello, Webex Teams, and Google Workspace to enable least-privilege posture assessments Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-02-20 · Feb 2026 · source · release history
  • Adds Read-only or Read/Write (full access) permission options when onboarding SaaS application tenants (GitHub, Jira, Okta, Confluence, Trello, Webex Teams, and Google Workspace) for SSPM scan Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-02-17 · Feb 2026 · source · release history
  • Exposes two new API endpoints for SaaS Security: GET /casbTenant/scanInfo and GET /casbTenant/validate/status/{tenantId} to retrieve scan configuration and validation status Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-14 · Nov 2025 · source · release history
DLP Incident Workflow Automation shipped Displays Endpoint DLP incidents in the Incidents page and enables automated resolution workflows for data loss protection events. 25 releases · first seen Jun 2022

release 25 total

  • Adds External, Internal, or Any collaboration scope options when creating DLP rules for Microsoft Teams to scan messages and attachments based on channel membership. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-15 · Apr 2026 · source · release history
  • SaaS Security Data at Rest DLP Policy adds a new option to quarantine sensitive content in Microsoft Teams, including a configurable tombstone message for end users. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-18 · Mar 2026 · source · release history
  • Extends DLP policy quarantine capability to sensitive content in Microsoft Teams, allowing admins to specify a tombstone message and remove quarantined items via the SaaS Assets Report. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-11 · Mar 2026 · source · release history
  • Adds Integration Name property to Incident Group Mapping page and Workflow Mappings page for incidents of Source DLP types Inline, Email, Endpoint, and SaaS Security Workflow Automation — Release Upgrade Summary (2026) — 2026-02-23 · Feb 2026 · source · release history
  • Adds Component, Content Location, Domains, and Workspace as mapping properties on the Incident Group Mapping page and Workflow Mappings page for Source DLP type SaaS Security incidents Workflow Automation — Release Upgrade Summary (2026) — 2026-02-23 · Feb 2026 · source · release history
  • Adds Action, Activity Type, Category, Channel, Confirm Action, Date, Department, Destination, Destination Location, Destination Type, Device Name, Device OS, Device Trust Level, DLP Admin, Document Type, Email Subject, Expected Action, File Link Expiry, File MD5, File Modified… Workflow Automation — Release Upgrade Summary (2026) — 2026-02-02 · Feb 2026 · source · release history
Client Device Posture Verification shipped Validates endpoint compliance during client installation and access by checking device ownership, client certificates, and certificate authority chain integrity. 24 releases · first seen Oct 2020

release 24 total

  • Adds checking for specific software versions for device postures: Process Check, Detect Carbon Black, Detect CrowdStrike, Detect SentinelOne, and Detect Microsoft Defender Client Connector — Client Connector App Release Summary (2026) — 2026-03-31 · Mar 2026 · source · release history
  • Adds an option to check for specific software versions for device postures on Windows: Process Check, Detect Carbon Black, Detect CrowdStrike, Detect SentinelOne, and Detect Microsoft Defender Client Connector — Release Upgrade Summary (2026) — 2026-02-13 · Feb 2026 · source · release history
  • Adds Windows device posture checks for specific software versions: Process Check, Detect Carbon Black, Detect CrowdStrike, Detect SentinelOne, and Detect Microsoft Defender. Client Connector — Release Upgrade Summary (2026) — 2026-02-06 · Feb 2026 · source · release history
  • Adds Is Device Managed session attribute passed to Zscaler Identity Proxy for Cloud Apps to determine device management status for access policies. Authentication Service — Release Upgrade Summary (2024) — 2024-06-12 · Jun 2024 · source · release history
  • macOS Detect Carbon Black, Detect CrowdStrike, and Detect SentinelOne posture checks pass if the security product is installed and running, even without a matching thumbprint. Client Connector — Release Upgrade Summary (2024) — 2024-04-05 · Apr 2024 · source · release history
  • Adds real-time posture checks for Process Check, Detect Carbon Black, Detect CrowdStrike, Detect SentinelOne, and Detect Microsoft Defender posture types. Client Connector — Client Connector App Release Summary (2024) — 2024-02-09 · Feb 2024 · source · release history
Unified Authentication Service shipped Provides a single OpenID/SAML-based authentication layer for all Zscaler products, replacing per-product IDP federations. 23 releases · first seen Feb 2021

Also counts toward: Single sign-on, OIDC SSO, SAML SSO

release 23 total

  • Introduces Authentication Service, a single OpenID/SAML-based authentication layer for all Zscaler products on GovCloud, replacing per-product IDP federations with a consolidated Federal ICAM integration point. changelog · Sep 2026 · source · release history
  • Adds native FIDO2 key enrollment within Authentication Service, allowing admins to enroll FIDO2 keys directly in Zscaler independent of IDP provisioning timelines. changelog · Sep 2026 · source · release history
  • Adds JWT Auth for Workload field on the Tenant Details page (Tenant > Tenant Details page > Special Settings) in Management Portal for Partners to enable JWT auth for tenants Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-21 · Nov 2025 · source · release history
  • Adds JWT Authentication support for Cloud & Branch Connector workloads, configurable via Advanced Settings page exemptions and managed via Authentication Service Admin Portal token validators Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-10-24 · Oct 2025 · source · release history
  • Adds the ability to specify email addresses for administrators when configuring a Privileged Portal to receive notifications upon creation, approval, or rejection of privileged approval requests. Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-09-16 · Sep 2025 · source · release history
  • Adds new API endpoints GET /eusaStatus/latest and PUT /eusaStatus/{eusaStatusId} to the cloud service API for programmatic access to End User Subscription Agreement (EUSA) acceptance status Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-22 · Aug 2025 · source · release history
Gen AI Policy Control shipped Enables control of generative AI model access, prompt management, and content classification for supported models like Claude and Mistral. 22 releases · first seen Sep 2024

Also counts toward: REST API

release 22 total

  • Adds AI Prefill automated workflow in the AI Red Teaming interface to suggest application description, language, multi-step attacks, and supported modes after initial connectivity is established Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-09-03 · Sep 2026 · source · release history
  • Adds ability to select a model developer (OpenAI, Anthropic, Google, Meta, Mistral, DeepSeek, xAI, Alibaba/Qwen) for Standalone prompt hardening to generate provider-specific protection instructions. Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-08-19 · Aug 2026 · source · release history
  • Introduces the AIRT Broker feature to establish inside-out connectivity for AI Red Teaming without firewall changes, managed via the Administration > Red Teaming > Brokers page. Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-07-03 · Jul 2026 · source · release history
  • Administration > Account Onboarding flow added to connect GitHub as a Code Repository provider for automated discovery of AI models and workflows in source code AI Asset Management — Release Upgrade Summary (2026) — 2026-06-24 · Jun 2026 · source · release history
  • Public AI Overview page adds Upload Volume, Download Volume, and Embedded AI Apps widgets while removing Sensitive Data and Sensitive Data Transactions widgets AI Asset Management — Release Upgrade Summary (2026) — 2026-06-24 · Jun 2026 · source · release history
  • Adds enableQuillbotAIPrompt and enableGoogleAIPrompt Boolean fields to the AdvancedUrlFilteringCloudAppOptions model in /advancedUrlFilterAndCloudAppSettings API Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-08 · May 2026 · source · release history
Data Posture Management for Cloud Providers shipped Offers data inventory and posture monitoring capabilities for AWS, Azure, and GCP resources, detecting misconfigurations in encryption, access control, and logging. 21 releases · first seen Jul 2024

Also counts toward: REST API

release 21 total

  • Zscaler DSPM introduces ZAgent Skills for Data Protection, enhancing its AI virtual assistant to troubleshoot complex tasks and analyze data protection in multi-cloud platforms. Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-09-02 · Sep 2026 · source · release history
  • Adds the Data Duplications tab and report to identify identical files across cloud services, on-premises shares, and SaaS services (M365, JIRA, Google Drive, Salesforce) for DSPM + CASB subscriptions Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-07-06 · Jul 2026 · source · release history
  • DSPM no longer provides support for using cloud scanners to scan on-premises databases; only on-premises scanners are supported. Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-04-23 · Apr 2026 · source · release history
  • Adds new data posture policies for Azure AI Foundry, Azure OpenAI, and Azure Cosmos NoSQL (17 policy titles) to detect sensitive data exposure and misconfigurations Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-04-23 · Apr 2026 · source · release history
  • Support for using cloud scanners to scan on-premises databases is removed; only on-premises scanners are now allowed. Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-04-22 · Apr 2026 · source · release history
  • Introduces new AWS, Azure, and GCP Data Posture Policies covering Databricks, MongoDB, OpenAI, Cosmos DB, Vertex AI, and BigQuery configurations with sensitive data Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-03-13 · Mar 2026 · source · release history
Cloud Application Tenant & Workspace Controls shipped Restricts and manages access to cloud applications by allowing administrators to define tenant-level restrictions, team IDs, and granular controls for specific SaaS services. 21 releases · first seen Sep 2020

Also counts toward: Web management console

release 21 total

  • Adds CLAUDE_AI enum to the appType query parameter in GET /tenancyRestrictionProfile/app-item-count/{appType}/{itemType} and to the TenancyRestrictionProfile model. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-14 · Aug 2026 · source · release history
  • Adds Read-only connector role option for GitHub, Jira, Okta, Confluence, Trello, Webex Teams, and Google Workspace SSPM tenants to avoid default Read/Write (full access) permissions Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-02-18 · Feb 2026 · source · release history
  • Cloud Application Tags tab added to Administration > Labels & Tags and Tags field on Application Information page for grouping cloud applications. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-06-30 · Jun 2023 · source · release history
  • Adds custom cloud applications to the Cloud Applications page for use in Cloud App Control and DLP policies, with support for custom access rules Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-05-26 · May 2023 · source · release history
  • Adds Cascade to URL Filtering option to the Add/Edit Cloud App Control policy rule page (Policies > URL & Cloud App Control > Cloud App Control Policy > Add). Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-05-12 · May 2023 · source · release history
  • Sets Follow Redirect to disabled by default for Box, Microsoft Teams Web App, OneDrive for Business, Outlook Online, ServiceNow, and SharePoint Online web probes Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-05-12 · May 2023 · source · release history
Private Service Edge shipped Allows hosting service edge functionality within the organization's own environment. 21 releases · first seen Nov 2019

release 21 total

  • Updates ZPA Private Service Edge OVA images for Nutanix and VMware platforms to support Red Hat Enterprise Linux 9, automated OS security updates, and OAuth 2.0 enrollment. Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-12-03 · Dec 2025 · source · release history
  • Adds Local traffic forwarding option to enable securing east-west, internet ingress (AWS only), and bidirectional private connectivity (AWS only) traffic on Cloud Connector and Zero Trust Gateways. Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-11-10 · Nov 2025 · source · release history
  • Introduces a new Zscaler-managed Business Continuity Cloud capability in limited availability, providing a fully managed single-tenant Private Cloud solution built on isolated ZIA and ZPA infrastructure. Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-06-02 · Jun 2025 · source · release history
  • Adds Red Hat Enterprise Linux 9 App Connector and Private Service Edge VM images for Microsoft Azure that support Security Technical Implementation Guide (STIG) requirements without disabling password expiration Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-03-21 · Mar 2025 · source · release history
  • Adds STIG-hardened Red Hat Enterprise Linux 9 App Connector and ZPA Private Service Edge images for Nutanix and VMware, with automatic password expiration after 95 days. Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-12-16 · Dec 2024 · source · release history
  • Adds Minimum Version Control for App Connectors and ZPA Private Service Edges to enforce version checks and automated upgrades during initial connection. Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-12-02 · Dec 2024 · source · release history
DLP Dictionary Engine Configuration shipped Supports specifying match counts, combining DLP dictionaries with Boolean operators, and using advanced pattern syntax. 20 releases · first seen Apr 2020

Also counts toward: User-defined detection rules

release 20 total

  • Replaces legacy Driver's License (United States) dictionary with Enhanced US Driver's License dict, exposing individual state sub-dictionaries configurable via Confidence Score Threshold and Proximity Length Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-21 · Nov 2025 · source · release history
  • Updates the /webDlpRules API endpoints to include new attributes: parentRule, subRules, and severity for exception rule configuration. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-12-05 · Dec 2023 · source · release history
  • Adds severity field configuration and child exception rule support (allowing exclusion of specific users or groups) when Evaluate All Rules mode is enabled. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-12-05 · Dec 2023 · source · release history
  • Adds EDM with No Primary Keys option to the DLP Advanced Settings page in the ZIA Admin Portal, allowing Exact Data Match policies to use templates without primary fields. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-09-22 · Sep 2023 · source · release history
  • Predefined DLP dictionaries (Names Canada, Spain, US and NDC Number Package/Product) now support an Action option to configure how matching items are evaluated. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-09-22 · Sep 2023 · source · release history
  • Adds Administration > Domain Profiles UI path and support for domain profiles in SaaS Security API DLP rules to remove external collaborators from file share apps Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-09-08 · Sep 2023 · source · release history
Unified API Gateway (OneAPI) shipped Provides programmatic access to management, configuration, analytics, and event-monitoring capabilities across Zscaler products for integration with CI/CD, SOAR, and SIEM workflows. 18 releases · first seen Feb 2021

Also counts toward: CI/CD pipeline integration, REST API

release 18 total

  • Introduces OneAPI, a unified API gateway providing programmatic access to management, configuration, analytics, and event-monitoring capabilities across Zscaler products, enabling integration with CI/CD, SOAR, and SIEM workflows for GovCloud tenants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ changelog · Sep 2026 · source · release history
  • Adds GET /ecRules/self, POST /ecRules/self, PUT /ecRules/self/{ruleId}, and DELETE /ecRules/self/{ruleId} endpoints to manage log and control forwarding rules programmatically. Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-09-24 · Sep 2025 · source · release history
  • New API endpoints for alert subscriptions: GET /alertSubscriptions, POST /alertSubscriptions, GET /alertSubscriptions/{alertSubscriptionId}, PUT /alertSubscriptions/{alertSubscriptionId} Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-23 · May 2025 · source · release history
  • Adds GET /orgInformation, GET /orgInformation/lite, and GET /subscriptions endpoints to retrieve organization details and subscription information Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-12-06 · Dec 2024 · source · release history
  • Adds GET /eun and PUT /eun endpoints to the Cloud Service API for retrieving and updating browser-based End User Notification (EUN) configurations Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-12-06 · Dec 2024 · source · release history
  • Adds GET, POST, PUT, and DELETE endpoints for /forwardingRules and /zpaGateways to manage forwarding control and ZPA gateway resources via the Cloud Service API. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-11-10 · Nov 2023 · source · release history
File Type Control Category Expansion shipped Extends the file type control policy engine with new categories, including executable scripts and online gaming. 18 releases · first seen May 2019

Also counts toward: Python scripting support, Scripting language support

release 18 total

  • Replaces fileTypes attribute with fileTypeCategories in /webDlpRules and /fileTypeRules endpoints to support both predefined and custom file types by ID, name, and category Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-30 · Sep 2025 · source · release history
  • New REST endpoints (GET /customFileTypes, POST /customFileTypes, PUT /customFileTypes, DELETE /customFileTypes/{id}, GET /customFileTypes/count) for managing custom file types via API. Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-26 · Sep 2025 · source · release history
  • Adds support for user-defined custom file types in DLP and File Type Control policies, with filters for Download User-Defined File Type and Upload User-Defined File Type added to Web Insights Logs and NSS feeds Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-15 · Sep 2025 · source · release history
  • Adds Browser Notification Template field to File Type Control rule configuration in the ZIA Admin Portal to display custom notifications on endpoints when access is blocked or cautioned. Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-06-25 · Jun 2025 · source · release history
  • Enables password-protected criteria (.pdf, Encrypted Office, ZIP, RAR, 7-Zip, etc.) for File Type Control rules and adds passwordProtected criterion to /fileTypeRules endpoints. Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-30 · May 2025 · source · release history
  • File Type Control rules can now be configured based on Password-Protected criteria for PDF, Encrypted Office Docs, ZIP, RAR, 7-Zip, ZIP w/Suspicious Script, and Zipx formats Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-23 · May 2025 · source · release history
Unified Administration Console (Experience Center) shipped Consolidates management, configuration, monitoring, reporting, and dashboards across all Zscaler products into a single interface. 17 releases · first seen Jan 2020

Also counts toward: Web management console

release 17 total

  • Introduces Experience Center, a unified administration console that consolidates management, configuration, monitoring, reporting, and dashboards across all Zscaler products into a single interface for GovCloud tenants. changelog · Sep 2026 · source · release history
  • Adds adminScopeSupport query parameter to GET /groups and GET /groups/lite endpoints and USER_GROUP enum value to AdminScope/AlertDefinition scope fields. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-15 · May 2026 · source · release history
  • Adds multiple new GET/POST/PUT/DELETE endpoints under /mgmtconfig/v1/admin/customers/{customerId}/application/ for application management, including export and validation Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-10-30 · Oct 2025 · source · release history
  • Adds a Total Users or Group Size column to the Users and Attributes tabs in the Recommended Configuration drawer to compare observed user counts against total population. Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-09-05 · Sep 2025 · source · release history
  • Provides support for the current status of Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA), as seen in the Zscaler Client Connector Portal Client Connector — Client Connector App Release Summary (2023) — 2023-05-03 · May 2023 · source · release history
  • Adds support for configuring a default global log mode for all new Zscaler Client Connector profiles that customers can override in App Profiles. Client Connector — Release Upgrade Summary (2023) — 2023-03-03 · Mar 2023 · source · release history
Virtual Service Edge for Public Service Edge shipped Provides horizontally scalable, virtual form factor deployments of the full ZEN feature set. 17 releases · first seen Oct 2019

release 17 total

  • Adds Layer 4 (L4) ingress support for Cloud & Branch Connector with Source Network Address Translation (SNAT) and Destination Network Address Translation (DNAT) capabilities in AWS, Azure, and GCP. Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-07-06 · Jul 2026 · source · release history
  • Adds GET, POST, GET .../{privateCloudId}, PUT .../{privateCloudId}, and DELETE .../{privateCloudId} endpoints on /mgmtconfig/v1/admin/customers/{customerId}/privateCloud for Private Cloud Management Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-05-26 · May 2026 · source · release history
  • New API endpoints GET /virtualZenNodes, POST /virtualZenNodes, GET /virtualZenNodes/{virtualZenNodeId}, PUT /virtualZenNodes/{virtualZenNodeId}, and DELETE /virtualZenNodes/{virtualZenNodeId} for creating and managing Virtual Service Edges. Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-05 · Sep 2025 · source · release history
  • GET /virtualZenClusters, POST /virtualZenClusters, PUT /virtualZenClusters/{virtualZenClusterId}, DELETE /virtualZenClusters/{virtualZenClusterId} for managing Virtual Service Edge clusters Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-23 · May 2025 · source · release history
  • New Virtual Service Edge cluster endpoints: GET /virtualZenClusters, POST /virtualZenClusters, GET /virtualZenClusters/{virtualZenClusterId}, PUT /virtualZenClusters/{virtualZenClusterId}, DELETE /virtualZenClusters/{virtualZenClusterId} Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-02 · May 2025 · source · release history
  • The Public Service Edge Proximity Override feature considers all ZPA Private Service Edge groups and their proximity override configuration before redirecting users. Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-06-03 · Jun 2024 · source · release history
Interactive Analytics Reporting shipped Generates interactive, drill-down reports for specific traffic categories, such as SSL usage, within the analytics dashboard. 17 releases · first seen Jun 2019

release 17 total

  • Extends DLP rule name reporting by adding DLP Rule Name as a Data Type in Interactive Reports widgets and Web Insights, allowing users to schedule incident reports filtered by rule name. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-17 · Apr 2026 · source · release history
  • Web Insights Logs gain Request Latency Due to Bandwidth Control (ms), Response Latency Due to Bandwidth Control (ms), and Total Latency Due to Bandwidth Control (ms) columns/filters Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-13 · Mar 2026 · source · release history
  • Adds HR-related columns (Employee Type, Business Group, Home Site Code, Active Status, Job Profile) to scheduled workplace report CSVs for User and User Aggregated Daily report types Business Insights — Release Upgrade Summary (2025) — 2025-04-04 · Apr 2025 · source · release history
  • Adds Top Application Segments by Bandwidth widget to visualize top application segments using the most bandwidth for your organization in a specified time frame. Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-01-31 · Jan 2023 · source · release history
  • Adds Sandbox Offensive Security Tools, Sandbox Ransomware, and Suspicious to the Threat Category filter in Web and Mobile Insights Logs pages Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-08-26 · Aug 2022 · source · release history
  • Adds Response HTTP Version and Request Version as new data types, columns, and filters in Analytics > Web Insights > Logs. Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-08-19 · Aug 2022 · source · release history
PAC File Management shipped Provides version control, history tracking, and management capabilities for Proxy Auto-Configuration (PAC) files. 17 releases · first seen Mar 2021

release 17 total

  • Deprecates the legacy PAC parser option and replaces it with V8 JavaScript engine-based PAC parser. For Zscaler Client Connector versions 4.3 and later for macOS, the legacy PAC parser option is unavailable. Client Connector — Client Connector App Release Summary (2024) — 2024-07-05 · Jul 2024 · source · release history
  • New applications available for SaaS Security Posture Control policy and report: Bitbucket, GitHub, Google Workspace, Microsoft 365, Salesforce, Jira Software, and Confluence. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-03-24 · Mar 2023 · source · release history
  • ${TRUSTED_NETWORK}, ${ZS_CUSTOM_PORT}, and ${ZT2_REQUEST} are now available as new variables in custom PAC files written via the ZIA Admin Portal Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-03-17 · Mar 2023 · source · release history
  • Adds Audit Log actions for PAC versioning: Change Deployed PAC Version, Create New PAC Version, Delete PAC, Delete PAC Version, Stage PAC Version. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-02-03 · Feb 2023 · source · release history
  • Adds Hosted PAC Files table columns (Name, Number of Hits, Currently Deployed Version), Export icon, Preview Version Details, and Manage PAC File pages. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-02-03 · Feb 2023 · source · release history
  • Includes the option to intercept Zscaler Internet Access (ZIA) traffic from any network adapter in the Zscaler Client Connector profile Client Connector — Release Upgrade Summary (2022) — 2022-12-09 · Dec 2022 · source · release history
Administrative Role Permission Management shipped Refines administrative access controls by granting read-only role permissions for audit log viewing and settings visibility. 17 releases · first seen Jun 2019

Also counts toward: Administrative audit log, Role-based access control

release 17 total

  • Adds Restricted Full permission option when assigning administrative roles in the ZIdentity Admin Portal to enforce permission checks before entitlement changes. Authentication Service — Release Upgrade Summary (2024) — 2024-06-12 · Jun 2024 · source · release history
  • Adds GET /adminRoles/lite with new includeApiRole query parameter to retrieve API roles for OAuth 2.0 client configuration Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-11-04 · Nov 2022 · source · release history
  • Adds support for admin user deletion actions via SCIM in the Advanced Configuration section of Administrator Management. Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-10-21 · Oct 2022 · source · release history
  • Adds GET /adminRoles/lite endpoint support for the includeApiRole query parameter to include API role details in responses Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-09-30 · Sep 2022 · source · release history
  • Adds Advanced Configuration setting in Administrator Management to define future actions for admin accounts deleted via SCIM Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-07-15 · Jul 2022 · source · release history
  • Allows Cloud Connector Admins to set None as their Location scope when creating admins, deferring location creation until later. Cloud & Branch Connector — Release Upgrade Summary (2022) — 2022-06-03 · Jun 2022 · source · release history
Microsoft Information Protection (MIP) Label DLP Integration shipped Supports defining inline web DLP policies based on Microsoft Information Protection labels via a new dictionary type for enhanced data classification enforcement. 14 releases · first seen Aug 2022

release 14 total

  • Adds the ability to manually apply Microsoft Purview Information Protection (MIP) labels to multiple files in on-premises file shares directly from the Resource Inventory page Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-09-15 · Sep 2026 · source · release history
  • Manual File Actions in Data Inventory now supports applying Microsoft Purview Information Protection (MIP) labels to single or multiple on-premises and Azure file shares Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-08-20 · Aug 2026 · source · release history
  • Adds Action Rules feature to define criteria for identifying specific data types and automatically apply Microsoft Information Protection sensitivity labels to files (initially supports Azure File Shares). Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-02-05 · Feb 2026 · source · release history
  • Outbound Email Data Loss Prevention (DLP) allows policy enforcement on email content sent to external domains using the same tools as Inline Web DLP, Endpoint DLP, and SaaS Security API DLP Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-10 · Jul 2024 · source · release history
  • Enables Optical Character Recognition (OCR) configuration at the organization level for SaaS Security API DLP via the Administration > DLP Advanced Settings page, removing the need to configure OCR per individual rule. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-11-03 · Nov 2023 · source · release history
  • Adds support for Tax Identification Number PII dictionaries in new predefined DLP sets (Austria, Belgium, Denmark, France, Germany, Hungary, Luxembourg, New Zealand, Portugal, Sweden). Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-05-19 · May 2023 · source · release history
Cloud Browser Isolation Session Management shipped Manages and validates Cloud Browser Isolation sessions with support for multiple simultaneous active sessions on the same device across different browser window types. 14 releases · first seen Nov 2021

release 14 total

  • Retrieves supported browser versions, updates Smart Browser Isolation, and manages Votiro CDR policies/tokens via new API endpoints under /browserControlSettings and /isolationVotiroCdr. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-15 · May 2026 · source · release history
  • Enables admins to enable language translation via Google Translate per isolation profile, accessible via the isolation bar menu or right-click context menu. Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-12-18 · Dec 2024 · source · release history
  • Adds Language Translation in Isolation profile setting to enable Google Translate within isolated sessions via the isolation bar or right-click menu. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-23 · Sep 2024 · source · release history
  • Debug recordings generate diagnostics including basic session information, HTTP Archive format files, console logs, and network logs from the web browser. Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-08-12 · Aug 2024 · source · release history
  • debug toggle for isolation profiles enables recording of troubleshooting data (HTTP Archive, console logs, network logs) for any isolation session. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-04-05 · Apr 2024 · source · release history
  • Adds ability to disable printing for ZIA Isolation Profiles, blocking right-click print, Isolation Bar print button, and browser File > Print/CTRL+P shortcuts. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-02-07 · Feb 2024 · source · release history
Sandbox Machine Learning Analysis shipped Integrates machine learning models into static sandbox analysis to improve automated malware detection accuracy. 14 releases · first seen Aug 2019

Also counts toward: ML-based detection

release 14 total

  • Adds three new disabled-by-default Advanced Sandbox rules (Sandbox_Docs_Trusted, Sandbox_Docs_Archives, Sandbox_Exes_Web) for Microsoft Office, PDF, Archives, Executables, and Web Content. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-10 · Apr 2026 · source · release history
  • Introduces Python-based handlers for Vulnerable Application Datasets to replace YAML-based definitions, enabling multi-step exploit simulations and dynamic response handling Deception — Release Upgrade Summary (2026) — 2026-03-24 · Mar 2026 · source · release history
  • Adds automatic dual VM sandbox report generation for Advanced Sandbox users, producing both Zero Day Report and Regular Report outputs for every malicious sample to compare mitigation effectiveness. Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-03-13 · Mar 2025 · source · release history
  • Adds /behavioralAnalysisAdvancedSettings endpoints (GET, PUT) and file hash counting endpoint to manage custom MD5 file hashes. Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-10-21 · Oct 2022 · source · release history
  • Adds minimum threat score customization (40-70) in Sandbox Policy with new categories: Sandbox Offsec Tools, Sandbox Ransomware, Sandbox Suspicious Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-09-23 · Sep 2022 · source · release history
  • Adds new Sandbox Rules categories: Sandbox Offsec Tools, Sandbox Ransomware, and Sandbox Suspicious for policy configuration Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-08-26 · Aug 2022 · source · release history
End User Traffic Notification shipped Sends configurable notifications to end users regarding unauthenticated traffic at location or sub-location boundaries. 13 releases · first seen Jun 2019

release 13 total

  • Adds a Caution Interval drop-down menu to the Administration > End User Notifications > Browser > EUN Templates > Add Custom Message window for configurable intervals per template Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-25 · Jun 2026 · source · release history
  • Adds a Caution Interval drop-down menu in the Administration > End User Notifications > Browser > EUN Templates > Add Custom Message window to configure per-browser caution intervals Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-19 · Jun 2026 · source · release history
  • Enables End User Notifications (EUNs) for ZIA Firewall Filtering, DNS Control, and IPS Control policies when using Zscaler Client Connector version 4.8 or later on Windows. Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-10-31 · Oct 2025 · source · release history
  • Adds End User Notification and Custom Message fields to granular Cloud App Control policy rule windows to enable Zscaler Client Connector-based notifications. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-24 · Jul 2024 · source · release history
  • Enables selection of Show/Hide EUN messages and custom text in Inline Web DLP policy rules, configurable under Administration > End User Notifications > Client Connector Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-17 · Jul 2024 · source · release history
  • Adds Browser Notification Template field to Cloud App Control and URL Filtering rules to show custom end user notifications when application access is blocked or cautioned Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-17 · Jul 2024 · source · release history
SSL Inspection Policy Configuration shipped Enables administrators to scope SSL inspection policies to specific URL categories for targeted traffic decryption. 13 releases · first seen May 2019

release 13 total

  • Adds Evaluate Other Policies and Bypass Other Policies options under the Do Not Inspect action for the O365 One Click predefined rule in SSL/TLS Inspection Policy. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-17 · Apr 2026 · source · release history
  • Advanced Threat Protection now enables allowing the Web Proxy Auto-Discovery (WPAD) protocol from external sources to automatically discover proxy settings via DHCP or DNS queries Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-31 · Mar 2026 · source · release history
  • Adds IoT group to the Device Groups criterion in the ZIA Admin Portal (Policy > SSL Inspection > SSL Inspection Policy) to create SSL Inspection policies based on IoT AI/ML classifications. Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-12 · Sep 2025 · source · release history
  • Adds Block No Server Name Indication (SNI) toggle under Policies > SSL Inspection > Add SSL Inspection Rule to block traffic lacking SNI in Client Hello Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-27 · Sep 2024 · source · release history
  • Adds Insert XFF Header for SSL Inspected Traffic field in Advanced Settings to insert XFF headers for traffic forwarded from ZIA to Zscaler Private Access (ZPA). Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-06 · Sep 2024 · source · release history
  • Adds Intermediate CA Protection Type weblog field and new SSL Policy Reason actions (e.g., Not inspected because of HSM error) to Web Insights Logs Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-02-17 · Feb 2023 · source · release history
SaaS Security API DLP and Malware Detection shipped Enables configuring data-at-rest DLP and malware detection policies within the SaaS Security API. 12 releases · first seen Feb 2020

release 12 total

  • Enables DLP watermarks for file sharing via the SaaS Security API, with removal of applied watermarks available as a remediation action on the Assets with Incidents page Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-27 · Sep 2024 · source · release history
  • Adds quarantine capability for sensitive content in Webex Teams with configurable tombstone messages via the SaaS Security API DLP Control policy. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-11-10 · Nov 2023 · source · release history
  • Supports OCR for SaaS Security API DLP with organization-level configuration in Administration > DLP Advanced Settings, removing per-rule ocrEnabled attribute support. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-11-10 · Nov 2023 · source · release history
  • Adds quarantine capability to user root folders in Box, OneDrive, and SharePoint with configurable tombstone templates via SaaS Security API DLP Policy Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-09-01 · Sep 2023 · source · release history
  • Adds Quarantine to User Root Folder support for Box, OneDrive, and SharePoint in SaaS Security API DLP Policy with tombstone template selection Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-25 · Aug 2023 · source · release history
  • Allows configuring the quarantine malware action under Malware Detection Rules in SaaS Security API Control policies for Salesforce and ServiceNow Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-05-20 · May 2022 · source · release history
DLP Template and Notification Management shipped Automates updates for Exact Data Match templates and enriches DLP notification templates with transaction tracking macros. 11 releases · first seen May 2019

Also counts toward: Scheduled jobs

release 11 total

  • Adds an Update Template button to the Notification Template page for editing published templates, replacing the previous Save as Draft and Publish Template buttons. Workflow Automation — Release Upgrade Summary (2024) — 2024-08-21 · Aug 2024 · source · release history
  • Adds Add Template option, Template Family and Language filters, Template Family column, and Translate action for notification/survey templates Workflow Automation — Release Upgrade Summary (2024) — 2024-01-18 · Jan 2024 · source · release history
  • Displays an EDM Indexing Failed Schemas notification in the ZIA Admin Portal when an EDM template exceeds the 2048 duplicate primary key limit. Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-09-24 · Sep 2022 · source · release history
  • Adds ${TOTAL_TRIGGERED_DICTIONARIES} macro for DLP notification templates, showing total dictionaries triggered across rules Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-02-04 · Feb 2022 · source · release history
  • Adds new ${FILENAME} macro to DLP Notification Templates to specify the name of the file that triggered a DLP rule Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-06-18 · Jun 2021 · source · release history
  • ${FILENAME} is now available as a macro in DLP Notification Templates to include the name of the file that triggered the rule Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-06-11 · Jun 2021 · source · release history
DLP Log Field Enrichment shipped Adds DLP-specific identifiers and hit counts to NSS web logs and web insights for precise transaction auditing and filtering. 10 releases · first seen May 2019

release 10 total

  • Fields %s{dlp_policy_action} and %s{dlp_confirm_justification_msg} added to NSS/Cloud NSS Feed Output Format for Web logs; %s{dlp_confirm_justification_msg} added for Endpoint DLP logs Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-07-06 · Jul 2026 · source · release history
  • Adds fields %d{srv_dport}, %s{other_dlprulenames}, and %s{all_dlprulenames} to NSS Web log Feed Output Format for Server Destination Port and Other DLP Rules logging Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-08-23 · Aug 2024 · source · release history
  • Adds a Blocked - Tenant Restricted option to the Policy Action filter in Web Insights Logs to isolate transactions blocked by Tenancy Restriction policies. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-06-05 · Jun 2024 · source · release history
  • Adds a verbose logging feature, configured in the Zscaler Client Connector Portal, that users can enable in Zscaler Client Connector to add extra debug logs. Client Connector — Client Connector App Release Summary (2024) — 2024-03-28 · Mar 2024 · source · release history
  • Adds Endpoint Data Loss Prevention with new logs accessible via Analytics > Endpoint DLP Insights > Logs and a new Endpoint DLP log type for Nanolog Streaming Service (NSS) Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-25 · Aug 2023 · source · release history
  • Increases DLP visibility in Insights Logs to display up to 16 dictionaries and 8 engines per transaction (previously 4 and 1). Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-02-24 · Feb 2021 · source · release history
Deception Policy Management shipped Allows configuration of access policies and decoy deployment for deception technology via the admin portal and API. 10 releases · first seen Feb 2022

Also counts toward: REST API, Web management console

release 10 total

  • Introduces Cloud Lures feature to deploy GCP service account decoys in endpoints via landmine policies to detect adversarial interactions with other GCP decoys. Deception — Release Upgrade Summary (2026) — 2026-02-11 · Feb 2026 · source · release history
  • Adds new columns Type (Static, Dynamic, or High Interaction) and Public IP to the Threat Intelligence Decoys page, removing Internal NAT IP. Deception — Release Upgrade Summary (2023) — 2023-11-02 · Nov 2023 · source · release history
  • Adds visibility controls (show/hide) for internal (built-in) safe processes on the Safe Processes page under Deceive > Landmine > Safe Processes. Deception — Release Upgrade Summary (2023) — 2023-03-15 · Mar 2023 · source · release history
  • Adds configurable custom response headers for Threat Intelligence (TI) decoys and web services on Internal decoys to manipulate HTTP responses seen by adversaries. Deception — Release Upgrade Summary (2023) — 2023-03-15 · Mar 2023 · source · release history
  • Enables forwarding of events marked as safe by Zscaler Deception to connected SIEM solutions via the new Service Connectors (formerly SIEM Connectors). Deception — Release Upgrade Summary (2023) — 2023-01-04 · Jan 2023 · source · release history
  • Adds viewing of bookmark folder names for Google Chrome and Mozilla Firefox favorite lures on the Policy Preview page for a landmine agent Deception — Release Upgrade Summary (2022) — 2022-10-20 · Oct 2022 · source · release history
Client Connector Version Management shipped Allows administrators to configure and display minimum Zscaler Client Connector version requirements in the portal. 9 releases · first seen Feb 2020

release 9 total

  • Adds an installation parameter to launch Zscaler Client Connector without waiting for the Windows desktop to display, allowing silent autostart during boot sequences like Autopilot Client Connector — Client Connector App Release Summary (2026) — 2026-09-29 · Sep 2026 · source · release history
  • Adds selection of upgrade sequence (Serial or Parallel) and upgrade strategy (Halt next agent upgrade or Skip to next agent) when initiating on-demand upgrades. Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-09-18 · Sep 2026 · source · release history
  • Adds a platform setting that enables control of the Use 64-Bit Installer for Windows option when configuring an app update in the Zscaler Client Connector App Store Client Connector — Release Upgrade Summary (2026) — 2026-09-11 · Sep 2026 · source · release history
  • Adds support to block enrollment of devices running very old versions of Zscaler Client Connector (versions 1.x/2.x on Windows/macOS/iOS/Android; 1.5 and earlier on Linux). Client Connector — Release Upgrade Summary (2026) — 2026-02-06 · Feb 2026 · source · release history
  • Provides administrators control to configure an automatic update of 64-bit images of Zscaler Client Connector for specific groups. Client Connector — Release Upgrade Summary (2022) — 2022-02-11 · Feb 2022 · source · release history
  • Adds support for selecting specific devices and registration details to create a filtered list for enrolled devices in the portal. Client Connector — Release Upgrade Summary (2022) — 2022-02-11 · Feb 2022 · source · release history
Privileged Remote Access shipped Enables clientless, fully isolated access to applications using SSH and RDP protocols for remote administrative workflows. 9 releases · first seen Feb 2022

release 9 total

  • Adds keyboard language, display resolution, display quality, and time zone options in the PRA Portal Settings icon to control privileged console properties Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-11-19 · Nov 2024 · source · release history
  • Adds a dedicated search bar and pagination controls to the Privileged Remote Access (PRA) Portal sections: Microtenants, Shared Sessions, and My Consoles. Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-05-02 · May 2024 · source · release history
  • Adds customer-facing APIs for managing privileged portals, privileged approvals, privileged consoles, privileged credentials, privileged policies, and emergency access users Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-02-28 · Feb 2024 · source · release history
  • Supports Microtenant Role-based administration control for Privileged Remote Access (PRA) with approval-based access without an authentication domain Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-02-28 · Feb 2024 · source · release history
  • Enables copy-paste text between local devices and privileged consoles via Privileged Remote Access (PRA) using a privileged capabilities policy Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-06-02 · Jun 2023 · source · release history
  • Enables Privileged Credentials Policy to allocate specific credentials for users accessing designated privileged consoles via Privileged Remote Access (PRA) Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-05-05 · May 2023 · source · release history
DNS Gateway Control shipped Provides DNS high availability, protocol translation, and policy-driven redirection for secure DNS traffic. 8 releases · first seen Jul 2023

release 8 total

  • Zscaler Client Connector on macOS now supports always bypassing DNS requests using the Zscaler Client Connector UDP proxy regardless of the setting in a user's app profile. Client Connector — Client Connector App Release Summary (2026) — 2026-10-01 · Oct 2026 · source · release history
  • Adds support for configuring Private Link Domains that match private link CNAME records (e.g. Azure Private Link) to identify and route traffic to resources behind private link endpoints. Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-03-31 · Mar 2026 · source · release history
  • Allows separate configuration of WAN and Private DNS servers for a site in DNS settings, populating distinct system groups (e.g., System-Private-DNS-Servers-Group) for different query resolution paths. Zero Trust Branch — Release Upgrade Summary (2025) — 2025-10-28 · Oct 2025 · source · release history
  • Adds GET /dnsGateways, GET /dnsGateways/lite, POST /dnsGateways, PUT /dnsGateways/{gatewayId}, and DELETE /dnsGateways/{gatewayId} endpoints for full lifecycle management of DNS Gateways. Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-09-24 · Sep 2025 · source · release history
  • DNS Gateway feature enables DNS high availability and protocol translation (DoH, TCP, UDP) via Administration > Proxies & Gateways > DNS Gateways. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-11 · Aug 2023 · source · release history
  • DNS Control Policy rules add Redirect Request Using DoH, Redirect Request Using TCP, Redirect Request Using UDP, and Redirect Request & Keep Sender Protocol actions. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-11 · Aug 2023 · source · release history
Outbound Email DLP shipped Enforces data loss prevention policies on email content sent to external domains using existing Inline Web, Endpoint, and SaaS Security DLP tools. 8 releases · first seen Jan 2024

Also counts toward: REST API

release 8 total

  • Adds Personal Email as a selectable condition in Outbound Email DLP policy rules to match sender org name against external recipient domains (e.g., Gmail, Yahoo) Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-09-22 · Sep 2026 · source · release history
  • Adds REST endpoints for recipient email profiles: POST /emailRecipientProfile, PUT /emailRecipientProfile/{profileId}, DELETE /emailRecipientProfile/{profileId}, and count/list variants Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-02-27 · Feb 2026 · source · release history
  • The fileTypes attribute used in /webDlpRules and /fileTypeRules endpoints is replaced with the new fileTypeCategories attribute. Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-15 · Sep 2025 · source · release history
  • Updates /webDlpRules and /casbDlpRules endpoints: receiver attribute is now supported for all incident receiver types; zscalerIncidentReceiver and icapServer attributes are deprecated in favor of receiver. Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-29 · Aug 2025 · source · release history
  • Adds the ability to configure notification templates in Administration > Notification Templates > DLP to send automatic email alerts to auditors when Outbound Email DLP rules trigger Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-04-23 · Apr 2025 · source · release history
  • Outbound Email Data Loss Prevention (DLP) allows policy enforcement on email content sent to external domains using the same tools as Inline Web DLP, Endpoint DLP, and SaaS Security API DLP Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-10 · Jul 2024 · source · release history
Deception Technology Endpoint Support shipped Enables endpoint deception capabilities for users running supported versions of the client connector, allowing deception to be enabled without separate installation. 8 releases · first seen Sep 2022

Also counts toward: REST API

release 8 total

  • Supports deploying Zero Trust Network decoys with different FQDNs that share the same hostname (e.g., decoy.corp-internal.com and decoy.corp.com sharing the hostname decoy). Deception — Release Upgrade Summary (2026) — 2026-09-18 · Sep 2026 · source · release history
  • Preserves unusually large POST request payloads as http_request evidence for web events across static, dynamic, and high-interaction containers (TI and internal decoys). Deception — Release Upgrade Summary (2026) — 2026-09-18 · Sep 2026 · source · release history
  • Adds SCADA/IoT decoy datasets: DNP3 Water Treatment RTU, IEC 61850 Substation Protection Relay, Oil & Gas Pipeline Compressor Station RTU, SIEMENS S7 1500 PLC, and ABB AC500 PLC Deception — Release Upgrade Summary (2026) — 2026-05-13 · May 2026 · source · release history
  • Adds new Gen AI MCP server decoy capability, allowing deployment of a decoy that mimics a standard Model Context Protocol (MCP) server for AI applications or LLM chatbots. Deception — Release Upgrade Summary (2026) — 2026-02-11 · Feb 2026 · source · release history
  • Adds ability to allow all IP addresses to access a particular module via the Allowed IPs page (Settings > Network Settings > Allowed IPs) in the Zscaler Deception Admin Portal Deception — Release Upgrade Summary (2022) — 2022-10-20 · Oct 2022 · source · release history
  • Adds support for OpenAPI Specification version OAS 3.0.0 for Orchestrate, Miragemaker, Deceive, Landmine, Investigate, and Settings features to programmatically configure and deploy decoys Deception — Release Upgrade Summary (2022) — 2022-10-20 · Oct 2022 · source · release history
CIPA Compliance Automation shipped Provides preconfigured rules, URL categories, and reporting to automate CIPA compliance workflows. 8 releases · first seen Oct 2019

release 8 total

  • ZIA enhances Malware Protection Policy with targeted download controls for remote access tools and adds OAuth 2.0 support for Microsoft Cloud App Security partner integration. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-08-30 · Aug 2024 · source · release history
  • Enables adding custom URLs to the Legal Liabilities super category within CIPA compliance settings Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-01-20 · Jan 2020 · source · release history
  • Adds Alcohol/Tobacco and Newly Registered Domains as new predefined URL categories for CIPA Compliance Rules Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-12-13 · Dec 2019 · source · release history
  • Allows adding custom URLs to the Legal Liabilities sub-category under the URL super category for compliance workflows Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-12-13 · Dec 2019 · source · release history
  • Adds the CIPA Compliance Report to view insights on blocked traffic and users. Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-11-01 · Nov 2019 · source · release history
  • Adds the Enable CIPA Compliance control to activate the CIPA compliance feature. Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-11-01 · Nov 2019 · source · release history
User Risk-Based Policy Enforcement shipped Applies user risk profiles (Low, Medium, High, Critical) as configurable criteria in security policies and enforces automated risk reduction by logging out users or forcing MFA upon triggering suspicious events. 8 releases · first seen Aug 2021

release 8 total

  • Replaces Proxied via Zscaler and Proxied via Zscaler with IdP Attribute options with Device Trust Attribute Matches the Configured Value for tenants without Authentication Service Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-06-12 · Jun 2024 · source · release history
  • Adds User Risk Scores as a new criteria type in access policy rules, allowing view, edit, and override capabilities for scores and expiration dates to enhance role-based access control. Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-08-30 · Aug 2023 · source · release history
  • Introduces UEBA Alert rules for the inline channel, with configurable trigger criteria and dynamic actions (Alert, Place user in a group, Trigger Multi-Factor Authentication) Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-05-26 · May 2023 · source · release history
  • Adds User Risk Profile levels (Low, Medium, High, Critical) as a selectable criterion in Cloud App Control, DLP with Content Inspection, DLP without Content Inspection, and URL Filtering policies. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-03-31 · Mar 2023 · source · release history
  • User Risk Profile allows filtering users by risk score levels (Low, Medium, High, Critical) in Cloud App Control, Data Loss Prevention with Content Inspection, Data Loss Prevention without Content Inspection, and URL Filtering policies. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-03-24 · Mar 2023 · source · release history
  • Adds User Risk Profile (Low, Medium, High, Critical) as a configurable criterion in Cloud App Control, DLP with/without Content Inspection, and URL Filtering policies Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-09-02 · Sep 2022 · source · release history
Intelligent Application Segmentation shipped Provides automated recommendations for adding applications to existing segmentation policies to streamline network access configuration. 7 releases · first seen Sep 2022

Also counts toward: REST API, Web management console

release 7 total

  • Adds a new Flow Log Aggregations page for Microsegmentation, allowing view of aggregated network flows up to 14 days and filtering by AppZone, source, and destination resource groups. Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-09-18 · Sep 2026 · source · release history
  • Adds new UI columns (Definition, view/edit/filter controls) on the Application Services page to define and manage custom application service groups when Advanced Firewall is enabled Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-12 · Jun 2026 · source · release history
  • Anti-tamper protection for the Microsegmentation Agent ensures that reporting, enforcement, and upgrade processes cannot be maliciously disabled or altered, even by actors with admin privileges. Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-04-09 · Apr 2026 · source · release history
  • Microsegmentation extends support to Azure Kubernetes Service (AKS) and Google Kubernetes Engine (GKE), enabling visibility into Kubernetes inventory and flow logs via the agent. Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-04-09 · Apr 2026 · source · release history
  • Adds POST /customers/{customerId}/application/multimatchUnsupportedReferences endpoint to manage unsupported references in application segment multimatch programmatically Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-08-13 · Aug 2025 · source · release history
  • Adds Application Segments Usage reports (view/download) in ZPA Admin Portal for customers with Segmentation add-on, providing visibility into actively used segments and user group access. Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-07-14 · Jul 2025 · source · release history
Google Drive Link Expiration Remediation shipped Supports automatic expiration of Google Drive links via remediation actions such as removing collaborators or sharing links after a set time. 7 releases · first seen Aug 2026

release 7 total

  • Enum values OFLCASB_DLP_REMOVE_COLLABORATORS_EXPIRY, OFLCASB_DLP_REMOVE_SHARING_EXPIRY, OFLCASB_DLP_REMOVE_INTERNAL_LINK_SHARE_EXPIRY, and OFLCASB_DLP_REMOVE_EXTERNAL_LINK_SHARE_EXPIRY added to the action field in CASBDlpRule model. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-31 · Aug 2026 · source · release history
  • Google Drive DLP rules gain expiration-based remediation actions with new fileSharingExpiryTimeType and fileSharingExpiryTime fields in the /casbDlpRules API Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-26 · Aug 2026 · source · release history
  • New enum values OFLCASB_DLP_REMOVE_COLLABORATORS_EXPIRY, OFLCASB_DLP_REMOVE_SHARING_EXPIRY, OFLCASB_DLP_REMOVE_INTERNAL_LINK_SHARE_EXPIRY, and OFLCASB_DLP_REMOVE_EXTERNAL_LINK_SHARE_EXPIRY are added to the action field in the CASBDlpRule model Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-26 · Aug 2026 · source · release history
  • Adds four new expiration actions (Remove Collaborators After Expiry, Remove External Sharing Links After Expiry, Remove Internal Sharing Links After Expiry, Remove Sharing After Expiry) and two fields (fileSharingExpiryTimeType, fileSharingExpiryTime) to the CASBDlpRule model for Google Drive link… Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-21 · Aug 2026 · source · release history
  • Adds enum values OFLCASB_DLP_REMOVE_COLLABORATORS_EXPIRY, OFLCASB_DLP_REMOVE_SHARING_EXPIRY, OFLCASB_DLP_REMOVE_INTERNAL_LINK_SHARE_EXPIRY, and OFLCASB_DLP_REMOVE_EXTERNAL_LINK_SHARE_EXPIRY to the action field in the /casbDlpRules APIs. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-21 · Aug 2026 · source · release history
  • Supports automatic expiration of Google Drive links (internal/external) via new remediation actions: Remove Collaborators After Expiry, Remove External Sharing Links After Expiry, Remove Internal Sharing Links After Expiry, and Remove Sharing After Expiry. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-14 · Aug 2026 · source · release history
AI Agent Tool Control (WebMCP) shipped Monitors and enforces policy on WebMCP-enabled site tool calls, allowing detection of tool identity, arguments, and provider origin to block or monitor agent actions in real time. 5 releases · 2 other sources · first seen Aug 2026

Also counts toward: User-defined detection rules

release

  • Policy rules support matching on tool identity (webmcp.tool.name), argument content (webmcp.tool.arguments), provider origin (webmcp.tool.provider_origin), and cross-origin and untrusted-content signals (webmcp.tool.is_cross_origin, webmcp.tool.has_untrusted_content_hint), enabling DLP-style argument-level… changelog · Aug 2026 · source · release history
  • Adds WebMCP Policy Enforcement: inline policies match on any of the seven webmcp.* attributes and apply one of three effects — Allow, Monitor, or Block — intercepting tool calls before the site's handler runs, with blocked calls surfaced to the user directly inside the agent's reply. changelog · Aug 2026 · source · release history
  • Adds WebMCP Runtime Monitoring: every tool invocation is captured with full context (the seven webmcp.* attributes plus user identity, device posture, extension version, browser, IP, geolocation, and URL) and surfaced in the Zscaler admin console as a searchable, filterable, exportable detection in the same event… changelog · Aug 2026 · source · release history
  • Adds WebMCP Capability Discovery: the Zero Trust Browser Extension enumerates every tool a WebMCP-enabled site registers before any can run, capturing seven attributes per tool — webmcp.tool.name, webmcp.tool.description, webmcp.tool.arguments, webmcp.tool_count, webmcp.tool.provider_origin,… changelog · Aug 2026 · source · release history
  • Blocked tool calls return a structured failure to the agent ('The Zscaler Zero Trust Browser blocked this action for security reasons') with the exact rule reason (e.g., webmcp.tool.name is equal to UPDATE_CART) logged as a Low-severity Block detection in the admin console. changelog · Aug 2026 · source · release history

example

  • Start in monitor mode to baseline all AI agent tool calls across sites before writing any block rules — every webmcp.* attribute is logged as an Informational/Allow detection without disrupting users. In the Zscaler admin console, create a policy named 'Monitor WebMCP' with all seven webmcp.* attributes enabled, default effect set to Allow, and assign it to the target user group. changelog · Aug 2026 · source
  • Block a specific AI agent capability by tool name — for example, prevent any agent from invoking update_cart on any covered site, with the block surfaced inline to the user. In the Zscaler admin console, create a policy named 'Block WebMCP' with condition: webmcp.tool.name is equal to update_cart, effect: Block. changelog · Aug 2026 · source
Adaptive Access Management shipped Provides programmatic management of adaptive access profiles and their rules to control user access based on dynamic context. 7 releases · first seen Nov 2019

Also counts toward: REST API

release 7 total

  • Adds GET /adaptiveAccessProfiles and GET /adaptiveAccessProfiles/profiles/rules API endpoints to retrieve Adaptive Access profiles and their rules on zia, zscalerone, zscalertwo, zscalerthree, and zscloud platforms. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-17 · Apr 2026 · source · release history
  • Supports automatic ZPA reauthentication settings on the app profile that can override the global setting and can be applied based on a user’s network environment (e.g, On-Trusted or Off-Trusted) Client Connector — Client Connector App Release Summary (2025) — 2025-10-30 · Oct 2025 · source · release history
  • Step-up authentication can be configured via URL Filtering and Cloud App Control policies to require additional identity verification before accessing sensitive resources. Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-19 · Aug 2025 · source · release history
  • Updates the Device Details window to automatically refresh one-time passwords (OTPs) every 60 minutes and adds a manual Refresh Status button in the Compliance Status section Client Connector — Release Upgrade Summary (2025) — 2025-07-11 · Jul 2025 · source · release history
  • Enables authentication time extension when the ZPA Private Service Edge cannot reach the ZPA cloud during a network outage (limited availability). Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-09-19 · Sep 2023 · source · release history
  • Adds Process Check, Carbon Black, Crowdstrike, and SentinelOne options to device posture profiles Client Connector — Client Connector App Release Summary (2020) — 2020-03-26 · Mar 2020 · source · release history
Security Alert Management shipped Provides a centralized console for viewing, managing, and creating security alert rules with severity-based statistics and configuration. 7 releases · first seen Jun 2022

Also counts toward: User-defined detection rules, Web management console

release 7 total

  • Adds a Digest Type field to the Notification Templates page to separate configuration for end user/admin digest templates versus user/escalation notification templates. Workflow Automation — Release Upgrade Summary (2026) — 2026-03-23 · Mar 2026 · source · release history
  • Adds the ability to calculate ticket Service Level Agreement (SLA) based only on active findings, ensuring remediation timelines reflect current work rather than inactive items. Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-02-17 · Feb 2026 · source · release history
  • Adds usage metric notifications (Bandwidth, CPU, Disk, File Descriptors, Source Port, System Memory limits) for Private Cloud Controllers and Network Connectors via Notifications and events diagnostics services Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-11-21 · Nov 2025 · source · release history
  • Adds Current Hour, Last Hour, Last 2 Hours, Last 6 Hours, and Last 12 Hours options to the time range selector on the Incidents page and Incident Analytics dashboard. Workflow Automation — Release Upgrade Summary (2025) — 2025-10-13 · Oct 2025 · source · release history
  • Adds a dotted reference line to the Impacted User Devices chart in individual Alert Details pages, calculated from the configured alert rule criteria. Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-02-24 · Feb 2023 · source · release history
  • Adds the Security Alerts feature in the ZIA Admin Portal to view, manage, and adjust alert rules with high-level statistics and threat severity views Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-09-02 · Sep 2022 · source · release history
URL Policy and Non-RFC Traffic Handling shipped Increases the maximum number of custom URLs across policies and enables explicit allow or block rules for non-RFC compliant HTTP traffic. 7 releases · first seen Jun 2019

release 7 total

  • Adds UI drop-down for SafeSearch Applications on Advanced Policy Settings page (Policies > URL & Cloud App Control > Advanced Policy Settings) when Enforce SafeSearch is enabled Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-19 · Sep 2025 · source · release history
  • Adds safeSearchApps field to the AdvancedUrlFilteringCloudAppOptions model referenced in the /advancedUrlFilterAndCloudAppSettings endpoint for granular SafeSearch app control Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-19 · Sep 2025 · source · release history
  • Adds new HTTP request methods PROPFIND, PROPPATCH, COPY, MOVE, MKCOL, LOCK, UNLOCK, and PATCH to URL Filtering rules (Policy > URL & Cloud App Control > URL Filtering Policy) Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-01-24 · Jan 2025 · source · release history
  • Adds PROPFIND, PROPPATCH, COPY, MOVE, MKCOL, LOCK, UNLOCK, and PATCH HTTP request methods to URL Filtering rules, listed in the Add URL Filtering Rule page. Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-01-22 · Jan 2025 · source · release history
  • Adds Requested Categories and Resolved Categories as separate fields in the DNS Filtering Rule policy configuration Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-04-15 · Apr 2022 · source · release history
  • Increases Custom URLs limit to 25,000 across all policies Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-06-28 · Jun 2019 · source · release history
Firewall Policy Action Logging shipped Captures and displays specific firewall policy actions, such as allowing traffic due to insufficient application data, within insights logs. 7 releases · first seen May 2019

release 7 total

  • Updates Firewall Insights Logs to use new Blocked by Web Proxy Policy firewall filtering rule to indicate sessions handled by the web proxy. Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-10-07 · Oct 2022 · source · release history
  • Introduces the Blocked by Web Proxy Policy firewall filtering rule in Firewall Insights Logs to indicate sessions handled by the web proxy Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-09-02 · Sep 2022 · source · release history
  • Adds Threat Name, Client Server IP, and Server Destination IP as selectable data types in Firewall Insights Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-06-26 · Jun 2020 · source · release history
  • Adds Allow due to insufficient app data Action in Firewall Insights Logs Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-06-28 · Jun 2019 · source · release history
  • Adds a new Allow due to insufficient app data Action in Firewall Insights Logs Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-05-31 · May 2019 · source · release history
  • Adds Allow due to insufficient app data action in Firewall Insights Logs Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-05-17 · May 2019 · source · release history
External Attack Surface Management shipped Automates the discovery and scanning of internet-exposed assets using configured seeds to identify potential entry points. 6 releases · first seen Jun 2024

release

  • Adds Azure Application Discovery that investigates service principal metadata to categorize Azure applications as internal, third-party, Microsoft, or various managed identity/agent types in the Resource Inventory graph Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-09-15 · Sep 2026 · source · release history
  • Adds three 3rd-party connector-based External Attack Surface risk factors for web applications: Is WAF Enabled, Is WAF Enforced, and Is DDoS Protection Enabled. Risk360 — Release Upgrade Summary (2026) — 2026-07-20 · Jul 2026 · source · release history
  • Adds integrated External Attack Surface Management (EASM) capabilities to the Zscaler SecOps platform, enabling automated discovery and scanning of internet-exposed assets starting from admin-configured seeds. Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-03-30 · Mar 2026 · source · release history
  • Adds ability to filter and view data for Zscaler decoy domains within your network when investigating problem cards under the External Surface Attack category Risk360 — Release Upgrade Summary (2024) — 2024-09-10 · Sep 2024 · source · release history
  • Adds SSL/TLS Certificate Expiration as a new scoring factor in the External Attack Surface category, quantifying risk from expired and soon-to-be-expired certificates Risk360 — Release Upgrade Summary (2024) — 2024-08-08 · Aug 2024 · source · release history
  • Integrates with the Tenable Vulnerability Management solution by calling its API to pull vulnerability data into Risk360's External Attack Surface category. Risk360 — Release Upgrade Summary (2024) — 2024-06-11 · Jun 2024 · source · release history
SaaS Security Scan Configuration shipped Allows scheduling automated DLP and malware detection scans on SaaS tenant data using configured policies. 6 releases · first seen Apr 2020

Also counts toward: Scheduled jobs

release

  • Adds support for Jira Application Labels as an action in SaaS Security Data at Rest Scanning DLP Policies (Policies > Data Protection > Policy > Out-of-Band CASB). Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-28 · Aug 2026 · source · release history
  • Adds CASB Collaborator Count field under Special Settings of the Tenant Details page as a new scoping criteria for SaaS Security Data at Rest Scanning DLP policies in file sharing applications. Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-03-27 · Mar 2025 · source · release history
  • Adds Exceptions page under Policy > SaaS Security > Data at Rest Scanning for Collaboration applications to bypass content inspection for specific users/groups. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-11-08 · Nov 2024 · source · release history
  • Adds New Data Only option in SaaS Security API Scan Configuration to ignore historical data. Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-11-20 · Nov 2020 · source · release history
  • Adds Scan Configuration to schedule inspections of SaaS tenant data using DLP and Malware Detection policies Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-04-24 · Apr 2020 · source · release history
  • Adds Scan Configuration settings to schedule DLP and Malware detection scans on SaaS tenant data. Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-04-10 · Apr 2020 · source · release history
Cyber Risk Reporting shipped Generates analytics reports that calculate a risk score based on policy configuration, traffic patterns, and deployed capabilities. 6 releases · first seen Sep 2022

release

  • Adds Application End-of-Life and Application End-of-Support as quantifiable risk factors under the Compromise category for application lifecycle risk assessment. Risk360 — Release Upgrade Summary (2026) — 2026-07-02 · Jul 2026 · source · release history
  • Adds support for the NIST SP 800-53 framework, enabling analysis of risk against this publication's guidance on selecting and assessing security and privacy controls for federal information systems. Risk360 — Release Upgrade Summary (2025) — 2025-06-30 · Jun 2025 · source · release history
  • Adds Threat Category, Threat Name, URL Category, and URL Name columns to the Events Contributing to Risk Score for Last 7 Days section in the Asset Details UI Risk360 — Release Upgrade Summary (2024) — 2024-11-15 · Nov 2024 · source · release history
  • Adds Recent Risk Increases section to the User Risk Report Overview in the ZIA Admin Portal, showing trends when real-time scoring is active. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-30 · Aug 2023 · source · release history
  • Enables viewing recent risk increases in the User Risk Report by toggling the real-time risk score option in Advanced Settings (Administration > Advanced Settings). Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-30 · Aug 2023 · source · release history
  • Adds Cyber Risk Report under Analytics with a risk score evaluating policy configuration, traffic patterns, and feature capabilities Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-09-23 · Sep 2022 · source · release history
Enhanced GitHub Cloud App Control shipped Adds granular action controls (Creating, Editing, Sharing, Commenting, Reacting) for the GitHub application in Cloud Application Control policies. 6 releases · first seen Jun 2019

release

  • Adds GitHub App installation token authentication to the GitHub Repositories connector, enabling centralized, least-privilege org-level access with short-lived tokens. Asset Exposure Management — Release Upgrade Summary (2026) — 2026-06-15 · Jun 2026 · source · release history
  • The 3rd-Party App Governance Dashboard now displays an overview of all active and deactivated apps across your business, including counts for active, deactivated, and risky apps as well as affected users over a specific time period. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-03 · Sep 2024 · source · release history
  • Adds region filter support on the Dashboard, Not In (≠) exclude filter for DLP Engines/dictionaries on the Data Inventory page, Fixed/Relative time operators and Included In (⊆) operator for investigation/policy queries, and Associated With predicate for secondary resources Data Security Posture Management (DSPM) — Release Upgrade Summary (2024) — 2024-08-21 · Aug 2024 · source · release history
  • Adds Creating, Editing, Sharing, Commenting, and Reacting action options for the GitHub application in the Add System & Development Rule window of Cloud Application Control Policy Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-09-08 · Sep 2023 · source · release history
  • Adds new cloud app controls for Google Classroom, MailBigFile, Meetup, and Zoom Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-06-28 · Jun 2019 · source · release history
  • Splits Outlook cloud application into Outlook and Outlook (Personal) with separate access control Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-06-28 · Jun 2019 · source · release history
Tunnel Health Monitoring shipped Monitors the operational status and health of IPSec and GRE tunnels through dedicated analytics pages and UI panels. 5 releases · 1 other source · first seen May 2019

release

  • Enables defining a preferred order of WAN interfaces for establishing IPSec tunnels to ZIA or site-to-site, prioritizing link quality/cost while maintaining automatic failover. Zero Trust Branch — Release Upgrade Summary (2026) — 2026-03-17 · Mar 2026 · source · release history
  • Enables retrieval of systemd journal logs for App Connectors, ZPA Private Service Edges, Private Cloud Controllers, and Network Connectors directly from the ZPA Admin Portal Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-11-21 · Nov 2025 · source · release history
  • Adds visibility of underlay hops through reverse traceroute from ZIA Public Service Edge or Private Service Edge when ICMP responses are blocked. Client Connector — ZDX Module Release Summary (2023) — 2023-11-10 · Nov 2023 · source · release history
  • Adds Tunnel Insights (Analytics > Tunnel Insights) for monitoring IPSec/GRE tunnel health Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-06-28 · Jun 2019 · source · release history
  • Tunnel Insights page (Analytics > Tunnel Insights) visualizes IPSec/GRE tunnel health and status Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-05-03 · May 2019 · source · release history

example

  • Monitor tunnel health and status in the new UI panel. Analytics > Tunnel Insights Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-05-03 · May 2019 · source
SaaS Application Tenant Onboarding shipped Provides configuration pages to integrate and manage sanctioned SaaS applications as tenants via the SaaS Security API. 6 releases · first seen Feb 2020

release

  • Allows configuration of Custom SaaS Connector using Client ID, Client Secret, and Tenant ID (in addition to private key JSON) when onboarding Microsoft SharePoint tenants. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-11-08 · Nov 2024 · source · release history
  • Allows choosing between Salesforce Sandbox or Production environments when adding a Salesforce tenant via the SaaS Security API. Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-08-20 · Aug 2021 · source · release history
  • SaaS Security API now supports configuring tenants for Slack, enabling integration with the collaboration application. Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-07-02 · Jul 2021 · source · release history
  • Adds SaaS Application Tenants page to integrate sanctioned SaaS applications with the Zscaler service Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-04-24 · Apr 2020 · source · release history
  • Adds SaaS Application Tenants page to integrate and manage sanctioned SaaS applications via the SaaS Security API. Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-04-10 · Apr 2020 · source · release history
  • Adds SaaS Application Tenants configuration page to integrate sanctioned SaaS apps as tenants Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-02-07 · Feb 2020 · source · release history
SSL Certificate and Cipher Management shipped Provides configuration options for SSL response signing certificates and cipher filtering within web inspection logs. 6 releases · first seen Jun 2019

release

  • Deprecates /sslSettings endpoints in favor of /intermediateCaCertificate endpoints for SSL inspection policy management Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-12-16 · Dec 2022 · source · release history
  • Deprecates /sslSettings endpoints in favor of new /intermediateCaCertificate endpoints for managing intermediate CA certificates Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-11-04 · Nov 2022 · source · release history
  • Deprecates /sslSettings endpoints in favor of the new /intermediateCaCertificate resource for certificate management. Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-10-21 · Oct 2022 · source · release history
  • /intermediateCaCertificate endpoints added for managing intermediate CA certificates with software or Cloud HSM protection Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-10-14 · Oct 2022 · source · release history
  • Adds Response Signing SSL Certificate selection for Identity Proxy SAML responses Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-06-28 · Jun 2019 · source · release history
  • Adds SSL Cipher Filters for encrypted SSL traffic in Web Insights Logs Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-06-28 · Jun 2019 · source · release history
Proxy Traffic Firewall Rules shipped Adds predefined firewall filtering rules to independently evaluate inner and outer 5-tuples in HTTP tunnel connections. 6 releases · first seen Jan 2020

release

  • Enables self-provisioning of GRE tunnels and static IPs via Administration portal or API endpoints /greTunnels and /staticIP Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-04-30 · Apr 2021 · source · release history
  • Adds new cloud service API endpoints for Firewall Policies (/firewallFilteringRules) and Traffic Forwarding (/greTunnels, /staticIP) Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-04-02 · Apr 2021 · source · release history
  • Adds Zscaler Proxy Traffic as a new predefined firewall filtering rule for HTTP Tunnel connections Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-04-17 · Apr 2020 · source · release history
  • Adds Zscaler Proxy Traffic as a new predefined firewall filtering rule for HTTP tunnel connections with independent evaluation Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-04-03 · Apr 2020 · source · release history
  • Adds Zscaler Proxy Traffic predefined firewall filtering rule for HTTP tunnel connections with independent evaluation Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-03-20 · Mar 2020 · source · release history
  • Introduces Zscaler Proxy Traffic firewall rule for independent evaluation of inner/outer 5-tuples in HTTP tunnel connections Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-01-17 · Jan 2020 · source · release history
VDI Tunnel Support shipped Deploys a lightweight agent within virtual desktop environments to authenticate users and establish secure tunnels to cloud or branch connectors. 5 releases · first seen Dec 2023

Also counts toward: Agent-based deployment

release

  • Cloud Connector now adds a VDI Provisioning permission when adding admin roles, with Full, View Only, or None options for role-based access control over virtual desktop infrastructure (FedRAMP Moderate and High). changelog · Oct 2026 · source · release history
  • Adds the HIDEAPPONUILAUNCH installer parameter to the Zscaler Client Connector for VDI (v1.2.0.19) to minimize the application window upon launch. Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-05-24 · May 2024 · source · release history
  • Moves Zscaler Client Connector for VDI's user configuration file to the user's roaming profile folder to enable restoration with tools such as Citrix UPM or FSLogix. Cloud & Branch Connector — Zscaler Client Connector for VDI Release Summary (2024) — 2024-03-15 · Mar 2024 · source · release history
  • Introduces the Zscaler VDI Agent, a lightweight Windows application that runs in the VDI session user space to authenticate multiple users and exchange user context Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-01-16 · Jan 2024 · source · release history
  • Introduces the Zscaler VDI Agent, a lightweight Windows application that runs in the VDI user space to authenticate users and establish tunnels to Cloud or Branch Connector Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-12-15 · Dec 2023 · source · release history
ZPA Microtenant API Management shipped Provides programmatic control over Zscaler Private Access microtenants, allowing movement and sharing of application segments via new REST endpoints. 5 releases · first seen Aug 2023

Also counts toward: Multi-tenant management, REST API

release

  • Zscaler Client Connector on macOS adds granularity to restrict Private Access partner logins to specify which partner tenants can access your organization's tenant. Client Connector — Client Connector App Release Summary (2026) — 2026-10-01 · Oct 2026 · source · release history
  • Adds GET /apps-services, POST /apps-services, GET /apps-services/{appServiceId}, PUT /apps-services/{appServiceId}, and DELETE /apps-services/{appServiceId} endpoints to manage custom application service groups via API Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-12 · Jun 2026 · source · release history
  • Adds new API endpoints GET /endPointApplications/customApps, POST /endPointApplications/customApp, PUT /endPointApplications/customApp/{id}, DELETE /endPointApplications/customApp/{id}, GET /endPointApplications/customApps/{id}, GET /endPointApplications/customApps/lite, GET /endPointApplications, GET… Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-04 · Jun 2026 · source · release history
  • Adds new API endpoints GET /endPointApplicationGroups, POST /endPointApplicationGroups, GET /endPointApplicationGroups/{id}, PUT /endPointApplicationGroups/{groupId}, DELETE /endPointApplicationGroups/{id}, PUT /endPointApplicationGroups/resources/{groupId}, GET /endPointApplicationGroups/policies for… Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-04 · Jun 2026 · source · release history
  • Adds customer-facing ZPA API endpoints for managing Microtenants, moving application segments between Default tenants and Microtenants, and sharing segments between Microtenants Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-08-01 · Aug 2023 · source · release history
DLP Sub-dictionary Cloning shipped Allows cloning of predefined DLP sub-dictionaries to customize Confidence Score Threshold, Proximity Length, and Custom High Confidence Phrases. 5 releases · first seen Apr 2023

Also counts toward: REST API, Web management console

release

  • Adds cloning capability for predefined DLP sub-dictionaries in the ZIA admin console, allowing customization of Confidence Score Threshold, Proximity Length, and Custom High Confidence Phrases without modifying originals. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-28 · Aug 2026 · source · release history
  • Updates /dlpDictionaries API endpoints to include dictionaryCloningEnabled and customPhraseSupported attributes in the DlpDictionaryDom model. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-05-03 · May 2024 · source · release history
  • Updates the /dlpDictionaries API endpoint to include dictionaryCloningEnabled and customPhraseSupported attributes in the DlpDictionaryDom model Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-04-19 · Apr 2024 · source · release history
  • Adds support for cloning identification-based predefined DLP dictionaries (e.g., Credit Cards, SSN) using the predefinedClone and dictTemplateId API attributes. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-04-21 · Apr 2023 · source · release history
  • Adds predefinedClone and dictTemplateId attributes to DLP endpoints within the cloud service API to clone identification-based predefined DLP dictionaries. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-04-07 · Apr 2023 · source · release history
Unified Threat Visibility Dashboard shipped Consolidates security event telemetry from ATP, sandbox, firewall, and isolation into a single analytics page. 5 releases · first seen Aug 2023

release

  • Adds AI/ML Detection Source filter, column, and field across Web Insights Logs, Threat Incidents table, Details tab, and NSS Cloud NSS feeds using %s{ai_ml_detection_src}. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-15 · May 2026 · source · release history
  • Adds the Overview Dashboard for consolidated viewing of findings from ingestion to remediation, featuring risk-adjusted severity breakdowns and Mean Time to Remediate (MTTR) metrics Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-04-30 · Apr 2026 · source · release history
  • Adds AI Assist Dashboard (limited availability) using AI/ML for dynamic threat views, customized recommendations, Breach AI Agents monitoring overview, and dynamic prompts from any screen. Breach Predictor — Release Upgrade Summary (2025) — 2025-06-30 · Jun 2025 · source · release history
  • Adds Cybersecurity Insights page at Analytics > Cybersecurity Insights providing unified visibility across ATP, Sandbox, Firewall, and Isolation Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-31 · Aug 2023 · source · release history
  • Introduces new Cybersecurity Insights page at Analytics > Cybersecurity Insights for unified visibility into threats from ATP, Sandbox, Firewall, and Isolation. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-18 · Aug 2023 · source · release history
Incident Workflow Integrations shipped Connects incident management and notification workflows to third-party platforms like Jira Software and Microsoft Teams. 5 releases · first seen Aug 2023

Also counts toward: Ticketing integration

release

  • Adds External Collaborator Group and Internal Collaborator Group columns and advanced filters in the Files tab of Assets with Incidents (Analytics > SaaS Security > Assets > Assets with Incidents). Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-07 · Aug 2025 · source · release history
  • Adds %s{intcollab_groups}, %s{ointcollab_groups}, %s{b64intcollab_groups}, %s{extcollab_groups}, %s{oextcollab_groups}, and %s{b64extcollab_groups} to NSS Feed Output Format for File applications. Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-07 · Aug 2025 · source · release history
  • Adds the ability to base alternative cloud name detection on the Zscaler Internet Access (ZIA) Public Service Edge location rather than the client location, supporting distinct names per ZIA edge Client Connector — Client Connector App Release Summary (2025) — 2025-04-29 · Apr 2025 · source · release history
  • Workflow Automation integrates with Jira Software to create and associate Jira tickets directly from the Incident Details page during remediation. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-11 · Aug 2023 · source · release history
  • Workflow Automation integrates with Microsoft Teams to deliver incident notifications (user, escalation, digest) as messages instead of emails. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-11 · Aug 2023 · source · release history
Multi-IdP SSO Configuration shipped Allows the configuration of multiple identity providers to support unified single sign-on for both users and administrators. 5 releases · first seen May 2019

Also counts toward: Single sign-on, SAML SSO

release

  • Moves Login ID attribute mapping from Provisioning tab to Basic tab in Add Primary/Secondary Identity Provider window under Integrations > External Identities Authentication Service — Release Upgrade Summary (2024) — 2024-08-16 · Aug 2024 · source · release history
  • Adds Login Hint toggle in the ZPA Admin Portal IdP configuration to prepopulate usernames on the external IdP sign-in page Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-12-05 · Dec 2022 · source · release history
  • Enables configuration of multiple identity providers for SAML single sign-on via the Identity Providers settings Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-04-17 · Apr 2020 · source · release history
  • Adds Zscaler Client Connector Portal as IdP automatic configuration Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-06-28 · Jun 2019 · source · release history
  • Enables adding and configuring multiple IdPs for user and admin SSO via the Add IdP Configuration window Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-05-23 · May 2019 · source · release history
Remote Assistance Privacy Controls shipped Adds manual controls to obfuscate usernames during Remote Assistance sessions. 5 releases · first seen Jan 2020

release

  • Assigns a virtual IP address to Zscaler Client Connector to support Server-to-Client applications like remote troubleshooting and software distribution Client Connector — Client Connector App Release Summary (2023) — 2023-12-14 · Dec 2023 · source · release history
  • Supports server-initiated remote administration workflows (remote assistance, troubleshooting, software distribution) using FQDN or IP-based connectivity Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-08-01 · Aug 2023 · source · release history
  • Device information obfuscation configurable for admins via Administration > Role Management and for Zscaler Support via Help > Remote Assistance. Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-01-28 · Jan 2022 · source · release history
  • Adds client-based remote assistance functionality for domain-joined Windows devices in Zscaler Private Access. Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-12-01 · Dec 2021 · source · release history
  • Enables manual selection to obfuscate user names in Remote Assistance (auto-obfuscates SSO users) Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-01-17 · Jan 2020 · source · release history
ChatGPT Embedded Browser Policy Support shipped Extends Zero Trust Browser policy enforcement to the ChatGPT desktop app's embedded Chromium browser for DLP, paste controls, and URL category blocking. 4 releases · first seen Sep 2026

Also counts toward: Administrative audit log

release

  • Supports monitoring, paste-block (with clipboard content capture), and URL-category block policies (e.g., Gambling) enforced directly inside the ChatGPT embedded browser, with the Zscaler Paste Blocked and Content Blocked interstitials rendered in-page. changelog · Sep 2026 · source · release history
  • Surfaces agent-driven page loads in the Zscaler admin console as standard detections carrying user identity, device posture, extension version, browser, IP, geolocation, and URL — making ChatGPT-opened pages visible alongside all other Chromium tab activity. changelog · Sep 2026 · source · release history
  • Extends the Zero Trust Browser Extension to run inside the ChatGPT desktop app's embedded Chromium browser, enforcing the same policies (DLP, paste controls, URL category blocking, file upload/download, credential protection, tenant restrictions) that already apply in Chrome, Edge, Firefox, and Safari — with no… changelog · Sep 2026 · source · release history
  • Deploys into the ChatGPT embedded browser via the same MDM-based method used for other browsers, requiring an explicit change to the deployment script to target the ChatGPT desktop app's embedded browser (installing for Chrome does not cover it automatically). changelog · Sep 2026 · source · release history
AI Access Graph shipped Maps human, service-account, and AI-agent identities to data objects and cloud endpoints to trace access paths and flag overprivileged or toxic permission combinations. 4 releases · first seen Dec 2024

release

  • New AI Access Graph maps human, service-account, and AI-agent identities to data objects and cloud endpoints, traces access paths, flags overprivileged or toxic permission combinations, and ranks risks by business impact, blast radius, and resource confidentiality across multi-cloud environments. changelog · Sep 2026 · source · release history
  • Enables direct navigation from the AI Security console to corresponding resources in CSP consoles for MCP Servers, Agents, Data Stores, Workloads, Guardrails, and Identities AI Asset Management — Release Upgrade Summary (2026) — 2026-07-08 · Jul 2026 · source · release history
  • Adds relationship predicates for investigation/policy queries: Can be accessed by for unmanaged PostgreSQL; Has Entitlement, Has Access to, Can be accessed by for GCP Compute VM. Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-05-05 · May 2025 · source · release history
  • Adds aws:PrincipalTag/tag-key, aws:ResourceTag/tag-key, aws:PrincipalOrgID, and aws:PrincipalArn context keys support in IAM policies for access control analysis Data Security Posture Management (DSPM) — Release Upgrade Summary (2024) — 2024-12-04 · Dec 2024 · source · release history
Private Cloud Controller Group Management shipped Enables programmatic creation, update, and deletion of Private Cloud Controller groups for managing on-premises service edge deployments. 4 releases · first seen Jul 2025

Also counts toward: REST API

release

  • Adds OAuth 2.0 enrollment support for Private Cloud Controllers, allowing devices to obtain OAuth tokens via the zpa-oauth.private.zscaler.com server instead of provisioning keys Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-06-02 · Jun 2026 · source · release history
  • Adds GET /mgmtconfig/v1/admin/customers/{customerId}/privateCloudController/{privateCloudControllerId} and PUT .../{privateCloudControllerId} for private Cloud Controller management Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-05-26 · May 2026 · source · release history
  • Adds POST, DELETE, GET .../{privateCloudControllerGroupId}, DELETE .../{privateCloudControllerGroupId}, and PUT .../{privateCloudControllerGroupId} endpoints on /mgmtconfig/v1/admin/customers/{customerId}/privateCloudControllerGroup for controller group management Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-05-26 · May 2026 · source · release history
  • Adds new API endpoints GET, PUT, DELETE for /mgmtconfig/v1/admin/customers/{customerId}/privateCloudController/{privateCloudControllerId} and related restart endpoint Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-07-21 · Jul 2025 · source · release history
DSPM Asset Inventory shipped Provides programmatic discovery and inventory management of public cloud assets, services, technologies, and certificates across AWS, Azure, and On-Premises. 4 releases · first seen Sep 2022

Also counts toward: REST API

release

  • Adds GET /organizations, GET /organizations/:orgId/findings, GET /organizations/:orgId/findings/:findingId/details, GET /organizations/:orgId/findings/:findingId/evidence, GET /organizations/:orgId/findings/:findingId/scan-output, GET /organizations/:orgId/lookalike-domains, and GET… External Attack Surface Management — Release Upgrade Summary (2025) — 2025-09-30 · Sep 2025 · source · release history
  • Adds new API endpoints GET /{orgId}/assets, GET /{orgId}/assets/{assetId}/services, GET /{orgId}/assets/{assetId}/technologies, and GET /{orgId}/assets/{assetId}/certificates to retrieve discovered assets, their running services, technologies, and SSL/TLS certificates. External Attack Surface Management — Release Upgrade Summary (2025) — 2025-09-30 · Sep 2025 · source · release history
  • Adds Inventory Data Collection toggle in Inventory Settings under the Administration menu to enable inventory data ingestion Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-09-23 · Sep 2022 · source · release history
  • Adds Software Inventory view under the Inventory menu to show current and historical software versions on user devices Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-09-23 · Sep 2022 · source · release history
Cloud Application Control Granular Action Mapping shipped Defines granular user actions (e.g., chatting, uploading, sharing, editing, creating) for supported SaaS and AI applications within Cloud App Control rules to enable precise traffic and data handling policies. 4 releases · first seen Sep 2024

release

  • Adds Posting, Chatting, Sharing, Editing, Commenting, Uploading, and Creating actions for LinkedIn in Cloud App Control Social Networking Rules Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-04 · Sep 2024 · source · release history
  • Adds Sharing, Editing, Creating, Downloading, Chatting, Uploading, Inviting, and Meeting actions for Webex Meetings in Cloud App Control Collaboration Rules Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-04 · Sep 2024 · source · release history
  • Adds Sharing, Editing, Renaming, Creating, Downloading, Deleting, and Uploading actions for SharePoint Online in Cloud App Control Collaboration Rules Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-04 · Sep 2024 · source · release history
  • Adds Editing, Creating, Downloading, Deleting, Chatting, Uploading, Inviting, and Huddle actions for Slack in Cloud App Control Collaboration Rules Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-04 · Sep 2024 · source · release history
Machine Token Authentication shipped Provides Windows device authentication capabilities via Zscaler Client Connector profile rules using machine provisioning keys and tokens. 4 releases · first seen Nov 2020

release

  • Adds Basic Authentication Exemption capability to exempt specific URL categories, cloud app categories, or cloud apps from basic auth enforcement in Advanced Settings Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-04-19 · Apr 2024 · source · release history
  • Supported Authentication Methods field available when configuring locations to enable IP surrogacy for known browsers with Kerberos, digest, or basic authentication Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-01-19 · Jan 2024 · source · release history
  • Adds Machine Tokens to provide authentication capabilities for Windows devices via Zscaler Client Connector profile rules. Client Connector — Release Upgrade Summary (2020) — 2020-11-13 · Nov 2020 · source · release history
  • Adds Machine Tokens authentication capability for Windows devices via Machine Provisioning keys. Client Connector — Release Upgrade Summary (2020) — 2020-11-06 · Nov 2020 · source · release history
SNI-Based DNS Resolution and CONNECT Host Validation shipped Introduces toggles to prefer SNI over CONNECT host for DNS resolution and block connections with mismatched SNI/CONNECT hosts for enhanced security. 4 releases · first seen Dec 2023

Also counts toward: Web management console

release

  • Adds Block CONNECT Host and SNI Mismatch option to Advanced Settings to block forward proxy connections where the CONNECT host doesn't match the SSL/TLS client hello SNI Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-01-12 · Jan 2024 · source · release history
  • Adds Prefer SNI over CONNECT Host for DNS Resolution option to Advanced Settings to use the SSL/TLS client hello SNI for DNS resolution instead of the CONNECT host Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-01-12 · Jan 2024 · source · release history
  • Adds the Block CONNECT Host and SNI Mismatch toggle in Administration > Advanced Settings to block forward proxy connections where the CONNECT host doesn't match the SSL/TLS client hello SNI Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-12-12 · Dec 2023 · source · release history
  • Adds the Prefer SNI over CONNECT Host for DNS Resolution toggle in Administration > Advanced Settings to use the SSL/TLS client hello SNI for DNS resolution instead of the CONNECT host Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-12-12 · Dec 2023 · source · release history
Business Continuity Settings Management shipped Allows programmatic retrieval and configuration of business continuity settings, including metadata and certificate management. 3 releases · first seen Sep 2025

Also counts toward: REST API

release

  • Zscaler Client Connector 5.0 for Windows adds Wi-Fi Name (SSID) as a trusted network criterion, TLS 1.3 support with automatic fallback to TLS 1.2, and machine tunnels in Business Continuity mode to keep devices connected to Private Access apps when the Zscaler cloud is unreachable (requires Windows 11 24H2 build… changelog · Oct 2026 · source · release history
  • Adds GET /mgmtconfig/v1/admin/customers/{customerId}/businessContinuitySettings, PUT .../BusinessContinuitySettings/{id}, GET .../metadata, and GET .../certificate endpoints for programmatic Business Continuity settings management Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-05-26 · May 2026 · source · release history
  • Adds Support for backup and restore with database encryption to enable encrypted database backups for the Private Cloud Controller, preserving confidentiality of stored configuration. Private Access (ZPA) — Private Cloud Controller Release Summary (2025) — 2025-09-23 · Sep 2025 · source · release history
Endpoint DLP Configuration Granularity shipped Provides granular exclusions and controls for Endpoint DLP, including file system exclusions, OCR disabling, and per-channel application exclusions. 3 releases · first seen Nov 2025

release

  • Zscaler Client Connector 5.0 for Windows now adds Endpoint DLP on ARM-based Windows machines (requires ZDP Module 26.08 or later). changelog · Oct 2026 · source · release history
  • Adds granular Endpoint DLP Configurations options: exclude file systems/folders, skip high-volume application files in continuous classification, disable OCR, and per-channel application exclusions Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-21 · Nov 2025 · source · release history
  • Adds Application File Access and Clipboard as channels in Endpoint DLP policy rules to detect and block sensitive data at rest and paste operations on Windows endpoints Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-21 · Nov 2025 · source · release history
Workload Group Management shipped Groups cloud and branch workloads for centralized policy application and management. 3 releases · first seen Sep 2025

Also counts toward: REST API

release

  • Cloud Connector now adds support for AWS account tagging across cross-account deployments with workload communications for multi-account environment organization (FedRAMP Moderate; Limited Availability). changelog · Oct 2026 · source · release history
  • Adds CRUD REST endpoints for Workload Groups: POST /workloadGroups, GET /workloadGroups/{workloadGroupId}, PUT /workloadGroups/{workloadGroupId}, DELETE /workloadGroups/{workloadGroupId} Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-19 · Sep 2025 · source · release history
  • New API endpoints POST /workloadGroups, GET /workloadGroups/{workloadGroupId}, PUT /workloadGroups/{workloadGroupId}, and DELETE /workloadGroups/{workloadGroupId} for managing Workload Groups. Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-05 · Sep 2025 · source · release history
Endpoint OS Lifecycle Monitoring shipped Monitors and reports on devices running End-of-Life or End-of-Support operating systems. 3 releases · first seen Sep 2025

release

  • Adds OS Update Filter dropdown and OS Update status field with hover details in App Connector, Private Service Edge, Private Cloud Controller, and Network Connector detail views Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-05-01 · May 2026 · source · release history
  • Adds Version Profile, Software Update, and Manager Update columns in the table to display version profiles and update status with hover details for target versions and upgrade windows. Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-02-03 · Feb 2026 · source · release history
  • Adds the OS End of Life dashboard to view summary tiles, charts, and tables for assets running operating systems that have reached or are approaching End-of-Life (EOL) or End-of-Support (EOS) status. Asset Exposure Management — Release Upgrade Summary (2025) — 2025-09-25 · Sep 2025 · source · release history
DLP Content Location Matching shipped Enables targeting DLP policies to specific sections of files or transactions using content location criteria. 3 releases · first seen Sep 2025

Also counts toward: REST API

release

  • Enables DLP rules to use Content Location as a match criteria, targeting specific sections of a file or transaction (File metadata/properties, File content, File name, or HTTP Body). Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-10 · Sep 2025 · source · release history
  • Adds dlpContentLocationsScopes attribute to the WebDlpRule API model in /webDlpRules endpoints to configure content location matching (File, File Content, File Name, HTTP Body). Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-10 · Sep 2025 · source · release history
  • Adds Content Location match criteria (File Document Properties, File Content, File Name, HTTP Body) for Web DLP rules targeting specific sections of files or transactions Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-08 · Sep 2025 · source · release history
NSS Collector Integration shipped Ingests third-party vendor logs (e.g., Palo Alto Networks) into Shadow IT Reports via NSS Collector configuration. 3 releases · first seen Jun 2023

release

  • Instance Discovery Report now supports Google Drive, Gmail, Box, OneDrive, Microsoft Outlook, Microsoft Teams, Salesforce, ServiceNow (Level 1), SharePoint, Slack (Level 2), and GCP (Level 3) with Domain, Tenant, Site, and Workspace instance types Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-02 · May 2025 · source · release history
  • Supports configuring Cloud NSS for Zscaler Cloud & Branch Connector by selecting NSS for Firewall, Cloud and Branch Connector as the NSS type in the Admin Portal. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-09-22 · Sep 2023 · source · release history
  • Adds NSS Collector server configuration under Administration > Nanolog Streaming Service > NSS Collector Servers for ingesting third-party vendor logs (e.g., Palo Alto Networks) into Shadow IT Reports. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-06-16 · Jun 2023 · source · release history
HTTPS/2 Default Protocol Support shipped Sets HTTP/2 as the default web protocol for organizational applications and SSL Inspection rules to improve compatibility and performance. 3 releases · first seen Aug 2022

release

  • Supports Zstandard (ZSTD) encoding (application/zstd) in proxy servers, allowing inspection of traffic from sites like Meta and Instagram without disabling browser-side compression. Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-26 · Jul 2024 · source · release history
  • Enables HTTP/2 as the default web protocol for organizational applications and SSL Inspection rules via new settings in Administration > Advanced Settings and Policy > SSL Inspection. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-11-10 · Nov 2023 · source · release history
  • Adds Administration > Advanced Settings toggle to set HTTP/2 as the default web protocol for organizational application access. Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-08-19 · Aug 2022 · source · release history
Cloud Deception Support for AWS and Azure shipped Enables deployment of platform-specific decoy resources in AWS and Azure environments to detect threats, replacing the deprecated single-cloud AWS Decoys feature. 3 releases · first seen Jul 2023

Also counts toward: Web management console

release

  • Adds the option to add tags to decoys and resources on AWS directly from the Zscaler Deception Admin Portal at Deceive > Cloud Deception > AWS > Settings. Deception — Release Upgrade Summary (2023) — 2023-11-02 · Nov 2023 · source · release history
  • The existing AWS Decoys feature (Deceive > AWS Decoys) is deprecated; all existing AWS IAM decoys and AWS S3 decoys will no longer work and require manual migration to the new Cloud Deception with AWS. Deception — Release Upgrade Summary (2023) — 2023-07-27 · Jul 2023 · source · release history
  • Integrates Microsoft Azure and Amazon Web Services (AWS) via Cloud Deception to deploy platform-specific decoy resources such as AWS IAM, S3, RDS, ECR, DynamoDB, VM Images and Azure Users, Service Principals, Managed Identities, App Services, Storage Account Containers/Shares, Key Vaults, ARM Templates, Container… Deception — Release Upgrade Summary (2023) — 2023-07-27 · Jul 2023 · source · release history
Performance Threshold Alerting shipped Configures automated alerts for application, device, and network performance events based on preset thresholds and delivers notifications via email or webhook. 3 releases · first seen Oct 2020

Also counts toward: Outbound webhooks (the product notifies you)

release

  • Introduces the Incidents Dashboard to display issues affecting multiple users across Wi-Fi, Last Mile ISP, Zscaler Data Centers, and Application Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-08-25 · Aug 2023 · source · release history
  • Adds the ability to configure alerts based on preset thresholds for application, device, and network performance events Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2020) — 2020-10-16 · Oct 2020 · source · release history
  • Enables alert delivery via email or webhook in addition to viewing triggered alerts in the ZDX Admin Portal Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2020) — 2020-10-16 · Oct 2020 · source · release history
Enhanced Isolation File Support shipped Enables decompression and viewing of additional file formats (ZIP, TAR, 7Z, RAR) and Office files within Browser Isolation sessions. 3 releases · first seen Jun 2023

release

  • Isolation now supports password-protected Office files by prompting the user for the file-specific password to render the content in the isolation browser. Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-06-13 · Jun 2023 · source · release history
  • Isolation now supports password-protected Office files by prompting the user for the file-specific password before rendering in the isolation browser. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-06-13 · Jun 2023 · source · release history
  • Enhanced File Type Support for Isolation allows users to decompress and view .ZIP, .TAR, .7Z, and .RAR files, as well as view .PPT, .DOC, .XLS, .CSV, .RTF, .TXT, .ODP, .ODS, and .ODT Office files. Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-06-13 · Jun 2023 · source · release history
Custom TLD Categories shipped Defines and matches traffic to specific Top-Level Domains (TLDs) across DNS, Firewall, DLP, and other policies. 3 releases · first seen Aug 2019

release

  • Custom TLD Categories can now be defined and matched in DNS Control, File Type Control, Firewall Filtering, IPS Control, Sandbox, DLP (with/without content inspection), Forwarding, SSL Inspection policies, and URL Filtering Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-06-09 · Jun 2023 · source · release history
  • Adds TLD Categories as criteria in URL filtering policies to match traffic by top-level domain Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-08-10 · Aug 2019 · source · release history
  • Adds top-level domain (TLD) categories as a matching criterion in URL filtering policies Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-08-02 · Aug 2019 · source · release history
AI Security Policy Recommendations shipped Adds security requirements and checks for Azure and Azure OpenAI AI applications, including unencrypted API endpoints and code interpreter status. 2 releases · first seen Sep 2026

release

  • Adds Azure Guardrails support to the Policy Generator, providing generated API requests with Azure Resource Manager commands and JSON policies using Azure's RAI schema. Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-09-30 · Sep 2026 · source · release history
  • Adds nine new Azure and Azure OpenAI AI Security policies including checks for unencrypted API endpoints, Bing search, empty instructions, missing descriptions, API key usage in security schemes, code interpreter, and file search status AI Asset Management — Release Upgrade Summary (2026) — 2026-09-03 · Sep 2026 · source · release history
Telemetry Integration with CrowdStrike shipped Streams Zscaler telemetry and AI-event metadata directly into CrowdStrike Falcon Next-Gen SIEM for unified cross-domain visibility. 2 releases · first seen Mar 2020

Also counts toward: SIEM forwarding

release

  • Zscaler telemetry and AI-event metadata now stream directly into CrowdStrike Falcon Next-Gen SIEM, enabling unified cross-domain visibility and end-to-end investigation across user behavior and network traffic in a single console. changelog · Sep 2026 · source · release history
  • Integrates CrowdStrike Falcon API to provide endpoint detection and response visibility for Sandbox detected malware Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-03-20 · Mar 2020 · source · release history
SMTP Strict TLS Enforcement shipped Requires strictly valid SSL/TLS certificates for SMTP connections, rejecting self-signed or expired certificates. 2 releases · first seen Aug 2026

release

  • SMTP connections now require strictly valid SSL/TLS certificates; self-signed, expired, or invalid certificates are no longer accepted. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-09-03 · Sep 2026 · source · release history
  • Strict SSL/TLS enforcement and server certificate validation are now required for SMTP connections; self-signed, expired, or invalid certificates are no longer allowed for Email tenants. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-26 · Aug 2026 · source · release history
Data Duplications Reporting shipped Identifies identical files across cloud services, on-premises shares, and SaaS services for data posture management. 2 releases · first seen Jul 2026

release

  • If the management interface was reachable in existing versions via LAN or WAN, the management IP address becomes unreachable after the upgrade as it is moved to a separate VRF instance. Zero Trust Branch — Release Upgrade Summary (2026) — 2026-07-21 · Jul 2026 · source · release history
  • Data Duplications Report and Data Duplications tab for identifying identical files across SaaS services (M365, JIRA, Google Drive, Salesforce) on subscriptions with DSPM and CASB Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-07-02 · Jul 2026 · source · release history
Subcloud Management shipped Allows administrators to manage subcloud resources and temporarily disable specific data centers for maintenance or incident response. 2 releases · first seen Oct 2022

Also counts toward: REST API, Web management console

release

  • Adds GET /smpcInstance and PUT /smpcInstance/dc API endpoints to update SMPC instance details by data center ID and retrieve status for all instances in a data center Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-26 · May 2026 · source · release history
  • Adds Subcloud Management feature in ZIA Admin Portal to view/edit subclouds and temporarily disable data centers during maintenance or incidents. Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-10-07 · Oct 2022 · source · release history
Identity-based Block Override shipped Provides an override option in URL & Cloud App Control to bypass blocks based on user identity. 2 releases · first seen Apr 2020

release

  • Supports process-based application bypass using custom application bypasses defined in the Zscaler Client Connector Portal when using Transparent Proxy-based Traffic Interception Client Connector — Client Connector App Release Summary (2026) — 2026-03-02 · Mar 2026 · source · release history
  • Adds Enable Identity-based Block Override option under Policy > URL & Cloud App Control > Advanced Policy Settings Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-04-03 · Apr 2020 · source · release history
Legacy App VPN Support shipped Enables secondary Layer 3 network-based VPN tunnels for applications requiring IP-based connectivity through ZPA. 2 releases · first seen Dec 2025

release

  • Adds VPN Tunnels support for Zscaler Client Connector users connecting to ZPA Private Service Edges, routing traffic through tenant-provisioned public VPN Service Edges in the Zscaler cloud Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-02-24 · Feb 2026 · source · release history
  • Introduces VPN for Legacy Apps as a preview add-on, allowing ZPA to support secondary Layer 3 network-based VPN tunnels for applications requiring Layer 3 IP-based connectivity. Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-12-04 · Dec 2025 · source · release history
User Threat Profiling shipped Provides a dedicated user risk and threat profile dashboard with visualizations of MITRE ATT&CK stages, departmental trends, and geographic data to identify at-risk users. 2 releases · first seen Aug 2022

release

  • Introduces the User Threat Profile page (Breach Predictor Portal > Users) with an Overview tab of charts/graphics and a Users List tab for individual user details, broken down by MITRE ATT&CK stage, department, threat type, and geography. Breach Predictor — Release Upgrade Summary (2025) — 2025-06-30 · Jun 2025 · source · release history
  • Adds User Risk Report page to monitor organization risk exposure from a user perspective based on anomalies, DLP violations, and suspicious behavior Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-08-26 · Aug 2022 · source · release history
IoT Device Discovery shipped Discovers IoT devices at the location and sub-location level and generates reports on their presence. 2 releases · first seen Apr 2023

Also counts toward: REST API

release

  • Adds enableIOT query parameter to GET /locations, GET /locations/lite, and GET /locations/{locationId}/sublocations for IoT discovery status Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-03-08 · Mar 2024 · source · release history
  • Adds IoT Device Discovery and Report features: new City Geolocation and Enable IoT Discovery fields in Location/Sub-Location management; CSV support for bulk enabling IoT discovery. Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-04-21 · Apr 2023 · source · release history
Dynamic Service Edge Assignment Threshold shipped Allows administrators to configure the threshold rank for dynamic service edge assignment in forwarding profiles to control load distribution. 2 releases · first seen Jun 2021

release

  • Allows admins to configure the Threshold Rank for the Dynamic ZIA Service Edge Assignment and the Dynamic ZPA Service Edge Assignment in Forwarding Profile by selecting a value from 1 to 5 Client Connector — Release Upgrade Summary (2023) — 2023-09-08 · Sep 2023 · source · release history
  • Adds Adaptive Mode protocol option for Probe Configuration to auto-select the best protocol per cloud path leg Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-06-11 · Jun 2021 · source · release history
URL Category Customization shipped Enables adding custom URLs to predefined URL categories under specific super categories like Legal Liabilities. 2 releases · first seen Jan 2020

Also counts toward: REST API

release

  • Updates the Cloud Service API to support reading, creating, and updating IP address ranges for predefined and custom URL categories. Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-02-18 · Feb 2022 · source · release history
  • Enables adding custom URLs to predefined categories under the URL super category Legal Liabilities. Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-01-10 · Jan 2020 · source · release history
UCaaS Direct-to-Cloud Access shipped Enables direct-to-cloud routing for UCaaS applications via one-click configuration. 2 releases · first seen Jun 2020

release

  • Adds predefined UCaaS One Click rules for Zoom, RingCentral, or LogMeIn when selected on the Advanced Policy Settings tab. Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-11-19 · Nov 2021 · source · release history
  • Enables direct-to-cloud access for UCaaS applications (Zoom, LogMeIn, RingCentral) via UCaaS One Click Configuration Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-06-26 · Jun 2020 · source · release history
Policy Rule Expiration Management shipped Allows administrators to set start and end dates for URL Filtering and Cloud App Control policy rules to automatically enable and disable enforcement. 2 releases · first seen Sep 2020

release

  • Enhanced port range configuration using single-value fields replacing deprecated tcpPortRanges/udpPortRanges Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-10-20 · Oct 2021 · source · release history
  • Adds Enable Rule Expiration control to URL Filtering and Cloud App Control policy rules to set start/end dates and time zone. Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-09-18 · Sep 2020 · source · release history
AI/ML Content Categorization shipped Enables analyzing uncategorized website content using AI/ML-based content categorization in advanced policy settings. 2 releases · first seen Mar 2020

Also counts toward: ML-based detection

release

  • Extends AI/ML-based content categorization to 21 additional URL categories including Finance, Social Networking, and Shopping Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-09-04 · Sep 2020 · source · release history
  • Adds Enable AI/ML-based Content Categorization option in Advanced Policy Settings to analyze uncategorized website content Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-03-20 · Mar 2020 · source · release history
Index Tool VM Explicit Proxy Mode shipped Configures the Index Tool virtual machine to operate in explicit proxy mode for tailored traffic routing and inspection. 2 releases · first seen May 2019

release

  • Enables explicit proxy mode configuration for Index Tool VM Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-06-28 · Jun 2019 · source · release history
  • Enables configuration of an Index Tool VM in explicit proxy mode Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-05-31 · May 2019 · source · release history
IPSec Encryption Algorithm Support shipped Expands supported cipher suites for IPSec IKE Phase 2 negotiations to include AES-128-GCM, AES-192-GCM, and AES-256-GCM. 2 releases · first seen May 2019

release

  • Adds AES-128-GCM, AES-192-GCM, and AES-256-GCM with 128-bit ICV to IPSec IKE Phase 2 Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-06-28 · Jun 2019 · source · release history
  • Adds support for AES-128-GCM, AES-192-GCM, and AES-256-GCM with 128-bit ICV in IPSec IKE Phase 2 Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-05-17 · May 2019 · source · release history
Real User Monitoring shipped Captures and analyzes browser-level user interactions with applications within Zscaler Digital Experience to provide visibility into client-side performance bottlenecks. 1 release · first seen Oct 2026

release

  • Zscaler Digital Experience now adds Real User Monitoring to capture and analyze browser-level user interactions with applications for visibility into performance bottlenecks (FedRAMP Moderate).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ changelog · Oct 2026 · source · release history
Trusted Network Criteria Expansion shipped Extends Zscaler Client Connector trusted network detection to include Wi-Fi SSID as a criterion, alongside TLS 1.3 support with automatic fallback, enabling more precise control over when zero trust policies engage. 1 release · first seen Oct 2026

release

  • Zscaler Client Connector 5.0 for Windows adds Wi-Fi Name (SSID) as a trusted network criterion, TLS 1.3 support with automatic fallback to TLS 1.2, and machine tunnels in Business Continuity mode to keep devices connected to Private Access apps when the Zscaler cloud is unreachable (requires Windows 11 24H2 build… changelog · Oct 2026 · source · release history
Browser Control for Brave shipped Extends Browser Control Policy to create policies and configure HTTP header control for the Brave browser. 1 release · first seen Sep 2026

release

  • Extends Browser Control Policy to create policies, configure browser control, and HTTP header control for the Brave browser (User Agent criterion in Cloud App, SSL/TLS Inspection, URL Filtering, Browser Blocking) Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-09-25 · Sep 2026 · source · release history
Landmine Agent Installation Hardening shipped Adds security requirements for the Landmine Agent installation configuration file on macOS and Linux endpoints. 1 release · first seen Sep 2026

release

  • Adds security requirements for the /tmp/landmine.txt configuration file during Landmine Agent installation on macOS and Linux endpoints (must be root-owned, not a symlink, not writable by non-root users). Deception — Release Upgrade Summary (2026) — 2026-09-18 · Sep 2026 · source · release history
Agentic Operations Gateway shipped Handles routing, identity, authorization, approval controls, and auditing for all agent interactions within the Agentic Operations layer. 1 release · first seen Sep 2026

Also counts toward: Administrative audit log

release

  • Provides an Agentic Operations Gateway handling routing, identity, authorization, approval controls, and auditing for all agent interactions, with client registration and token lifecycle events recorded in Zscaler audit logs. changelog · Sep 2026 · source · release history
Agentic Operations for SOC shipped Enables analysts to trigger enforcement actions and automated remediation from within third-party platforms like CrowdStrike Falcon using Agentic Operations. 1 release · first seen Sep 2026

release

  • Analysts can trigger Zscaler enforcement actions and automated remediation directly from within the Charlotte Agentic SOAR interface, running natively inside the Falcon platform with no middleware or separate infrastructure. changelog · Sep 2026 · source · release history
Cross-Domain Risk Signal Integration shipped Allows continuous sharing of user-risk signals between endpoint platforms like CrowdStrike Falcon and Zscaler's Adaptive Access Engine. 1 release · first seen Sep 2026

release

  • New integration with CrowdStrike using the OpenID Shared Signals Framework (SSF) lets the CrowdStrike Falcon platform continuously share user-risk signals with Zscaler's Adaptive Access Engine (AAE) so that access policies adjust dynamically in real time when suspicious endpoint behavior is detected. changelog · Sep 2026 · source · release history
Endpoint AI Security Attack Chain Analysis shipped Evaluates an endpoint's full state and constructs a realistic attack chain from initial lure to code execution using AI models. 1 release · first seen Sep 2026

release

  • New Endpoint AI Security Attack Chain Analysis capability (powered by OpenAI GPT cyber models) evaluates an endpoint's full state — including local AI agents, browser extensions, packages, and system configurations — and constructs a realistic attack chain from initial lure to code execution, producing a prioritized… changelog · Sep 2026 · source · release history
Slack DLP Incident Integration shipped Extends Data Loss Protection incident reporting to include chat-based violations in Slack, forwarding them to Zscaler's incident and workflow automation systems. 1 release · first seen Apr 2026

release

  • Enables forwarding of Slack chat-based DLP policy incidents to Zscaler Incident Response, Workflow Automation, Web Insights, Logs, and the DLP policy auditor, in addition to existing file-based violations. Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-17 · Apr 2026 · source · release history
Privileged Access Credential Management shipped Automates the lifecycle management of privileged credentials through automated discovery, rotation policies, and secure credential pools. 1 release · first seen Mar 2026

Also counts toward: Agent-based deployment

release

  • Adds capability to deploy the credential agent via the Zscaler Admin Console to automate privileged credential lifecycle management, including LDAP/search queries, rotation policies, and credential pools. Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-03-03 · Mar 2026 · source · release history
Third-Party URL Categorization shipped Classifies uncategorized URLs using an external database. 1 release · first seen Aug 2025

release

  • Adds Enable 3rd-Party URL Category Lookup option on the Advanced Policy Settings tab (Policy > URL & Cloud App Control) to allow lookup for uncategorized URLs using a third-party database Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-22 · Aug 2025 · source · release history
End User Self-Service Diagnostics shipped Provides diagnostic tools and recommendations to help end users troubleshoot and resolve local connectivity and performance issues, such as high CPU usage and poor Wi-Fi connections. 1 release · first seen Sep 2024

release

  • Adds Self Service to improve end user experience by diagnosing and providing recommendations to resolve issues due to high CPU usage and poor Wi-Fi connection Client Connector — Client Connector App Release Summary (2024) — 2024-09-26 · Sep 2024 · source · release history
Privileged Session Recording shipped Adds session recording capabilities for privileged console sessions, enabling review of activities within Privileged Remote Access workflows. 1 release · first seen Aug 2023

release

  • Adds session recording capability to privileged console sessions for Privileged Remote Access (PRA), enabled within privileged capabilities policies and reviewed on the Privileged Sessions page. Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-08-31 · Aug 2023 · source · release history
Endpoint Process Monitoring shipped Tracks and displays top resource-consuming processes on user devices at configurable intervals. 1 release · first seen Jul 2023

release

  • Adds Process Inventory feature to monitor processes impacting user devices, displaying top processes every five minutes based on configured CPU usage thresholds Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-07-28 · Jul 2023 · source · release history
Cloud Application Instance Control shipped Enables granular policy enforcement for cloud applications by targeting specific tenant instances or workspace identifiers. 1 release · first seen Oct 2022

release

  • Adds Cloud Application Instances feature allowing granular control based on instance identifiers in Cloud App Control and DLP policies. Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-10-21 · Oct 2022 · source · release history
Session Deep Tracing shipped Collects process-level information at one-minute intervals during network sessions to enable detailed troubleshooting and visibility. 1 release · first seen Dec 2020

release

  • Adds Deep Tracing capability to collect process-level information every minute during a session Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2020) — 2020-12-18 · Dec 2020 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Command line

8 commands for Zscaler, each with where it came from. This tool has no source analysis yet, so there is no option reference and no captured run beside them.

Source

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface

Five scores for Zscaler, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail Zscaler puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Website history

zscaler.com, every change

Zscaler's home page and 40 more pages as they looked each month from August 2021 to October 2026: 172 renders, 68 changes of tagline or palette. Step through them, play them, or put any two months side by side.

Website history is included with Researcher and Business.

See plans →

Coverage

Missing something? Tell us

What Zscaler connects to, runs on and detects, read from its release notes and docs. So far: 1 new integration.

Show

1 change, tracked since Oct 19, 2026.

  • Oct 192026

    new Zscaler AI Endpoint Security integration with Cursor

    Zscaler and Cursor are partnering to help enterprises secure agentic activity on managed devices. Cursor provides enterprise controls for its platform, while Zscaler complements them with endpoint visibility and policy controls to help engineering and security teams better manage risk.

    Source ↗

How we count

Read from 1 of 1766 release notes and docs updates we hold for Zscaler. "First seen" is the earliest note that names something; "last" is the latest. Our history may start partway through Zscaler's life, so an old integration can show a recent first-seen date.

Each change counts once: "added 40 checks" is one line, so the numbers measure how often coverage moves, not how big the catalogue is or how well it detects.

Releases

Show
Coverage in all entries

1766 entries

  1. October 20266
  2. September 202648
  3. August 202647
  4. July 202636
  5. June 202640
  6. May 202638
  7. April 202632
  8. March 202646
  9. February 202639
  10. January 202637
  11. December 202538
  12. November 202534
  13. October 202531
  14. September 202551
  15. August 202542
  16. July 202527
  17. June 202532
  18. May 202537
  19. April 202527
  20. March 202533
  21. February 202529
  22. January 202532
  23. December 202427
  24. November 202427
  25. October 202428
  26. September 202431
  27. August 202430
  28. July 202437
  29. June 202429
  30. May 202427
  31. April 202418
  32. March 202423
  33. February 202426
  34. January 202416
  35. December 202320
  36. November 202320
  37. October 202311
  38. September 202323
  39. August 202329
  40. July 202315
  41. June 202322
  42. May 202325
  43. April 202310
  44. March 202315
  45. February 202310
  46. January 202313
  47. December 202212
  48. November 202216
  49. October 202218
  50. September 202220
  51. August 202214
  52. July 202210
  53. June 20228
  54. May 20227
  55. April 202215
  56. March 202212
  57. February 202214
  58. January 202214
  59. December 20216
  60. November 202110
  61. October 202117
  62. September 20218
  63. August 202117
  64. July 202110
  65. June 202111
  66. May 202111
  67. April 202115
  68. March 202118
  69. February 202110
  70. January 20219
  71. December 20209
  72. November 202011
  73. October 202016
  74. September 202013
  75. August 202011
  76. July 20209
  77. June 20209
  78. May 20203
  79. April 20207
  80. March 20209
  81. February 20205
  82. January 20208
  83. December 20192
  84. November 20196
  85. October 20198
  86. September 20194
  87. August 20194
  88. July 20192
  89. June 20193
  90. May 20196
  91. April 20191
  92. March 20191
  93. February 20192
  94. January 20191
    Show
    Coverage in all entries

    1766 entries

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →