ZHERO Blog & News

Field notes for Zscaler admins

Posture, hygiene, investigation and change safety, from the people building ZHERO.

Series From the Trenches The Hidden Cost Feature Spotlight

Cover of the video Can this user reach it?: the title on a navy background next to a tilted card of the ZHERO reachability verdict, Reachable with 92% inspected and the Firewall, DNS and SSL Inspection tiles

Can this user reach it? From a vague Zscaler ticket to the cause

"Claude stopped working for me on Wednesday." No time, no error, just a day. The configuration says the destination is reachable, the logs say there were blocks, and the answer sits in the gap between the two. This is how the Troubleshooting Engine closes that gap, step by step.

Oct 6, 2026 · 7 min read Feature Spotlight

A Zscaler SSL Inspection Policy table with the ZHERO Enhancements switch turned on, showing a usage counter next to each cloud application in the rule criteria

Visibility & Inventory

Inside your console, not another tab

Every tool that promises visibility on top of a platform risks becoming a second place to look. Here is the design decision that avoids it, demonstrated by a switch above a Zscaler policy table: off, and you see the console exactly as Zscaler renders it. On, and every entity in every rule carries its usage, its configuration and its history.

Oct 1, 2026 · 5 min read Feature Spotlight

ZHERO Score History panel showing two weeks of Zscaler posture score as a candlestick chart, with daily open, close, high and low movements

Posture & Board-Readiness

Your posture score dropped 3.33 points. Here is what moved it, and who.

Most configuration assessments tell you where you were on the day somebody ran them. Here is what changes when the score becomes a trend with attribution: you can see a regression, name its cause, and preview a fix before you apply it.

Sep 23, 2026 · 6 min read The Hidden Cost

Hygiene & Remediation

App profiles, forwarding profiles, PAC files: the assessment nobody wanted to do

The Client Connector layer is the part of a Zscaler assessment everybody postpones: three configurations that depend on each other, spread across screens you cannot open at the same time. Here is how ZHERO turns it into two scores, a heatmap and a recovery plan.

Sep 16, 2026 · 9 min read From the Trenches

ZHERO's ZPA Diagnostics Engine showing a search result drilled down into users, domains and domain-port combinations, with an export to Excel button

Investigation & MTTR

Your ZPA discovery wildcard is a black box. Here's how to open it.

Every ZPA environment starts with broad discovery wildcards. They are necessary, and they go opaque fast. Here is how to see exactly what is flowing through one, then tighten it.

Jul 23, 2026 · 3 min read From the Trenches

An Excel workbook generated by ZHERO listing Zscaler firewall rules with action, state, labels and a column of real traffic volume per rule, ready to filter and hand off

Investigation & MTTR

The work you'll never do: the mental list every Zscaler admin carries

One tenant had 290 locations and nobody knew which were still live. An export with one extra column showed 180 were ghosts. The work that was too expensive becomes done.

Jul 13, 2026 · 5 min read The Hidden Cost

Ring gauge in ZHERO blue showing a security posture score of 44.53 out of 100 over a dark dashboard, with scattered critical findings and a rising candlestick chart

Posture & Board-Readiness

Your Zscaler tenant now has a score your board can read

A real production tenant scored 44.53/100, Grade F, with 495 active findings its team did not know about. Why posture blindness is normal, and what a readable score changes.

Jul 7, 2026 · 5 min read The Hidden Cost