What changed, what to check, what shipped. For the people who run Zscaler. | |||||||||||||||||||||||||
|
A note from Daniele I started this newsletter for a selfish reason. I run Zscaler tenants for customers. Every summer, release notes pile up, a few trust advisories carry a date I should have written down, and I find out in October. So I built the email I wanted to receive: once a month, what changed in Zscaler, what to check in your own tenant, and what shipped in ZHERO. One thing struck me this summer. Zscaler shipped Health360, a free score of how healthy your deployment is. That is Zscaler making our question official. Health360 grades the plumbing. ZHERO grades the configuration, rule by rule, and lets you change it. Both belong on the same desk. This first issue covers July to mid-September, so the Release Radar counts 85 releases. Nothing was cut: the important ones are on top, the rest is one click away. Reply and tell me what you want more of next month. Daniele | |||||||||||||||||||||||||
|
WHAT CHANGED Zscaler is moving into the browser. Enterprise Browser for Zero Trust Browser (1 Jul) puts private app access and daily browser protection in one place; WebMCP Security Controls (27 Aug) extend policy to the tool calls AI agents make inside the browser; and the Zero Trust Browser extension now runs inside the embedded browser of the ChatGPT desktop app (9 Sep). The browser is becoming a policy enforcement point in its own right, next to Client Connector. If Zero Trust Browser is in your entitlement and nobody ever turned it on, this is the quarter to ask why. AI governance is now a configuration item, not a PDF. Tenant Profiles now cover Claude (14 Aug): you can restrict access to specific workspace IDs, with API support. Cloud App Control gets a granular Upload action for Google Gemini (31 Aug). And Zscaler announced policy enforcement inside Claude via inference hooks (5 Aug). Practical reading: open your AI & ML rules in Cloud App Control. If they still say Allow with no granular action and no tenant profile, the policy your board thinks you have is not the one in the console. Zscaler now answers "is my deployment healthy?" itself. Health360 (5 Aug) scores your deployment on best practices, connector health and service health, with trends and remediation steps: tunnel redundancy, double tunneling, load distribution. Free in Experience Center, GA planned for the second half of 2026, ZIA and Client Connector first. Our reading: Health360 tells you whether the plumbing is sound. Which rule or access policy is missing a posture condition is the layer ZHERO reads. Read the Hugging Face breach for the questions, not the drama. Zscaler's write-up (31 Aug) of the incident where an unreleased model broke out of its sandbox and ran a full kill chain on its own ends with a list every security leader is now being asked: who can reach what, from where, with which device. Those are configuration questions. They are the reason this newsletter exists. Also worth a line: the AI/ML categorization model for Miscellaneous and Unknown URLs was upgraded (10 Aug; if you allow those categories anywhere, expect some traffic to move); Sandbox Patient Zero alerts changed (29 Aug; check your alert subscriptions); ZDX replaced Copilot with ZAgent (2 Sep); and if you ever need to explain SSE to a non-technical audience, Zscaler's SSE Architecture Explained is the cleanest version I have seen. | |||||||||||||||||||||||||
|
ACTION NEEDED Advisories worth a calendar entry. All from the Zscaler Trust Portal.
| |||||||||||||||||||||||||
|
RELEASE RADAR Every Zscaler release from 1 July to 12 September, by product.
Worth your attention
| |||||||||||||||||||||||||
|
WHAT TO CHECK Is your Client Connector fleet ready for October? Three of the advisories above land on the same layer: Windows 10 devices lose ZCC support on 13 October, 4.8 builds before 4.8.0.190 need the mitigating installer, and Mac fleets on Tahoe or Sequoia may need a forwarding profile decision. The risk is not one device. It is the long tail nobody counts: the laptops that never got the OS upgrade, the pilot group still on an old 4.8 build, the ten Macs in a country office. How to check it by hand. In Experience Center (or the Mobile Admin Portal, while you still have it) open Client Connector > Enrolled Devices. Filter by OS version and export the list; then filter by Client Connector version and export again. In a spreadsheet, pivot on OS version to count Windows 10 devices, and on client version to find every 4.8 build below 4.8.0.190. Do the same for macOS by version. Repeat monthly until October, because the fleet moves. The shortcut. ZCC Fleet Health in ZHERO shows the version and OS distribution of the whole fleet on one page, with a drill-down to the devices behind each bar, and scores each app profile so the worst ones come first. Same data, no pivot table. 
| |||||||||||||||||||||||||
|
FROM THE BLOG
| |||||||||||||||||||||||||
|
FROM ZHERO Four releases of ZHERO since July. The two that change what you can do: v3.1.15 (14 Aug), "Posture Enforced, Audit Unified". New analysis checks flag ZPA Access Policies that grant access with no domain-join and no EDR/antivirus posture condition (machine-tunnel and block rules correctly excluded), plus a firewall default rule left on Allow and SSL inspection bypasses spread across policies. ZCC posture profiles become first-class entities, cross-linked both ways with the ZPA criterion that enforces them. One audit timeline now merges changes made directly in the Zscaler console with the work your team drove from ZHERO. And the privacy line gets stronger: no configuration snapshots in our cloud, field-level diffs from a store that never leaves the browser. v3.1.0 (13 Jul), "Change at Scale, a Score You Can Trust". Mass Edit applies one reviewed change to many entities, with a plain-language diff before commit. The posture score becomes a trend with per-change attribution, and a projected score previews your staged changes. Also shipped: v3.1.13 (15 Jul) makes QUIC exposure detection exact per tenant and places the one-click Block QUIC rule right above the rule that let QUIC through, plus resizable side panels; v3.1.24 (4 Sep) is a performance release, with the initial analysis of a large tenant completing in about half the time and the ZCC fleet import surviving very large device exports. Full notes in the changelog. | |||||||||||||||||||||||||
|
Before you go If one of the checks above turned up something you would rather not have found, bring your tenant to a demo: in about an hour we read it together, on your configuration or on one of ours. Pick a time here. Or just reply to this email. It lands in my inbox, not in a queue. Daniele Tieghi | |||||||||||||||||||||||||
|
You receive The ZHERO Digest #001 because you subscribed at zhero.ai or asked ZHERO to keep you posted. One email a month, no automation in between. ZHERO Srl, Via Friuli 8/B, 20135 Milano, Italy |
