What is our primary use case?
You can have mobile employees who forward traffic into a Zscaler client, or you could use a PAC file. So, if users connect at the beach, a hotel, coffee shop or something outside their actual office, it will give them protection.
You can use it with a secured Internet using a web gateway to deliver to the cloud.
How has it helped my organization?
The benefits of Zscaler Internet Access are the speed of the solution and never having performance issues or limitations. The fact that none of my end users are experiencing any threats, zero-day, bots, or malware says a lot about the solution.
Zscaler Internet Access enables the inspection of traffic, including SSLs. You want to make sure that nothing is coming in through your HTTPS traffic. For anything that is coming in that might be a threat, you want to ensure that you are using a good proxy for that. There is malicious traffic out there, so you want to make sure you are tracking and viewing that. There are a lot of threats that come through as well as a lot of programming languages, so you definitely need to inspect traffic.
It is worth it. It works. I don't need multiple alerts, because it is set up with the right policies. Definitely, it is a beneficial device which doesn't always need constant monitoring. It inspects the encrypted traffic and verifies what threats are coming in. It intercepts incoming traffic and decrypts it, then reviews it. So, why have antivirus scanning or web filtering if Zscaler can do it? It protects me from man-in-the-middle attacks as well. When you use a firewall, you have alerts and false positives, but Zscaler Internet Access pretty much decreases those errors and alerts.
There isn't congestion on your network when you are inspecting traffic with Zscaler Internet Access.
What is most valuable?
- The integration of the gateway that inspects all ports and protocols. So, there is threat prevention.
- The cloud sandbox
- VNS security
- Access control that will protect URL filtering and the cloud firewall.
- Data protection that will protect your gateway, like your CASB or your cloud DLP. The capabilities of this will point your traffic to Zscaler Cloud.
The proxy architecture is the way to go. Zscaler uses it to protect their applications on the cloud. So, if you are using Box, Office 365, or even have an end user using LinkedIn or YouTube, then it will give you updated threat updates. It will also inspect all your traffic so you don't get compromised.
Advanced Threat Protection on Zscaler Internet Access has a few functionalities. It has ways to find threats. So, if they are actually hiding, you could do an inspection of your SSL traffic. You also have DNS security in Zscaler Internet Access that will help you route suspicious command-and-control attacks as well as detect threats when it does a full inspection.
Zscaler Internet Access protects using data loss prevention. If you have a CASB exposing your cloud out into the network, then Zscaler Internet Access will go ahead and control that unknown cloud application in the CASB, protecting it. There is also data detection with exact data match. This improves the data coming into your cloud so you are protecting it.
It offers a Cloud Browser Isolation feature, which exfiltrates browser activities from the end user's device. This feature can eliminate our exposures on that.
I like its features because they help me eliminate firewalls. I don't need to have firewalls, SIEMs, or an IPS/IDS. So, if all my end users are remote and using Office 365, I am already protecting them because they are in the cloud. I just have to attach the security application, which makes sure that any user who is mobile or remote is protected, without spending money on other solutions.
What needs improvement?
I wish there were a lot less products to learn, because there are a lot. They just keep surprising me with new features, even in the SaaS arena, and they keep improving in every facet. We are Zscaler partners, so I got certified in two platforms, but there is a lot room for improvement. There is just too much training, where they focus a lot on protecting the Internet as everyone is moving to the cloud. I would love for the training to be shortened.
Buyer's Guide
Zscaler Internet Access
November 2024
Learn what your peers think about Zscaler Internet Access. Get advice and tips from experienced pros sharing their opinions. Updated: November 2024.
823,795 professionals have used our research since 2012.
For how long have I used the solution?
I have been exposed to it for a year.
What do I think about the stability of the solution?
My clients have never really called to tell me that stability has been an issue. Feedback has always been positive.
What do I think about the scalability of the solution?
It is a scalable solution. It is easy to scale and secure remote users. If a company hires 100 more people, I don't think it would be a problem.
The largest environment, which I reviewed, had 2000 employees.
How are customer service and support?
I would rate their professional services or technical support as five out of five based on their experience and expertise. They know how to answer all my client's problems. They are really quick to trigger and understand the client's needs as well as be very supportive. They do very well when helping their clients.
How would you rate customer service and support?
How was the initial setup?
What I have seen when I am doing PoCs is you need some perimeters to start building this platform and integrating policies from day one.
An improvement would be if they could provide an out-of-the-box experience, like 20 to 30 features all ready to go. In comparison, LogRhythm offers out-of-the-box features. With Zscaler Internet Access, there is firewall IPS, multiple security services, filtering, DLP, and CASB browser isolation. These are things that all users are going to be using. However, when an administrator or architect would start building this, I would definitely need to engage professional services to help clients do it.
Every customer is different. On average, it could be a two-week deployment. If you are using other devices, like Fortinet SD-WAN deployment, you definitely have to make sure your configured IPsecs are correct. You might have to review policies and your SD-WAN roles. You need to do a lot of cleaning up before you start deploying.
What about the implementation team?
We have a client who wants to start deploying the Cloud Browser Isolation feature. You can embrace this cloud platform using IPAC Files, which is just a clean way of deploying it.
I have personally worked for other vendors doing professional services as part of a professional services team. Every client decided to purchase professional services because deploying Zcaler Internet Access is too complex.
What was our ROI?
I am saving money right now because I am not using old technology, like when we had everything on-premise and in the data center. Now, I just have to direct my end users to the Zscaler file and make sure that they are connected and secure. So, I am eliminating the total cost of ownership and the headaches of on-premise devices. I am also reducing their risk by making sure that they are protected in real-time.
When I talk to clients, they mention that there is a return of investment from improving the real-time protection. There is no need anymore to buy:
- An antivirus
- A third-party vendor to protect your DNS, like Cloudflare.
- Check Point SandBlast
- Symantec DLP, Forcepoint, or Netskope since you already have DLP protection.
- LogRhythm or Splunk for logging.
Those are the benefits. I have a lot of clients explaining this to me that this is the reason to have this solution. Zscaler Internet Access is transforming all that for web traffic security.
What's my experience with pricing, setup cost, and licensing?
The pricing is fair based on its competitive market.
Which other solutions did I evaluate?
Palo Alto's vulnerability assessment requires an on-prem solution to work with your cloud. Zscaler Internet Access has already been bundled up to provide no-hassle, free Internet network connectivity that ensures protection. When you are using Palo Alto and want to assess vulnerability in your network, you probably need to use on-prem and cloud workloads. There is no reason to do that with Zscaler Internet Access.
Zscaler Internet Access has ease of development, like minimal setups needed for connectivity. You can continue securing protection, allowing your remote users to have access to your applications. Then, it is pretty quick to set up for Zscaler Internet Access. Some companies don't have many tools, so there are no delays there. When it comes to LogRhythm, there are a lot of things that you have to deal with. You have to deal with your log server as well as setting up your authentication server, firewalls, policies, rules, and zones, then you need to get it running and customize it based on your company's needs. Because LogRhythm has 30-plus features ready to go, it can be easier and smoother to deploy. However, there will always be a couple things where you have to do some preliminary requirements before you continue.
What other advice do I have?
Overall, it is a secure platform.
I actually interviewed with Zscaler to work with them because I have been impressed with their technology overall, especially over Palo Alto Networks technology who is their competitor and has a SaaS solution as well. From the top to bottom, Zscaler Internet Access is a great security product that protects my end users and remote users in the cloud.
If you want total cost of ownership and zero-trust architecture, Zscaler is the right solution to fit the needs of any environment.
I would rate the solution as 10 out of 10.
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner