Feature · Smart Analysis

Smart Analysis 1000+ expert checks, from finding to fix.

Zscaler offers hundreds of configuration options, and knowing the optimal settings takes deep expertise and constant vigilance. Smart Analysis scans your ZIA and ZPA configuration continuously against an evergrowing library of expert-validated checks, ranks every finding by severity, and turns each one into a concrete remediation proposal you review before anything changes.

Start Free Trial ▶ Watch Demo

ZHERO Analysis Engine with findings grouped by severity, from critical to info, and filters by tag and status

~60% fewer configuration errors with continuous automated analysis.

Why it matters

Expert knowledge, running continuously

Feature

Continuous background scanning

Benefit

Lightweight analysis runs in the background with zero configuration required

Outcome

An expert-level configuration review that is always on, without adding work for your team

Feature

Evergrowing expert library

Benefit

1000+ automated checks consolidating Zscaler best practices, organized by category across ZIA and ZPA

Outcome

Best practices applied to your tenant instead of scattered across documentation

Feature

Severity-based prioritization

Benefit

Every finding is classified from Critical to Info based on real impact

Outcome

Your team fixes what matters first instead of drowning in noise

Feature

Resolution proposals

Benefit

Each finding comes with a clear explanation, specific remediation steps, and in many cases a proposed change ready to review

Outcome

From problem identified to fix staged in minutes, not weeks

Smart Analysis closes the expertise gap: optimal Zscaler configuration normally requires years of hands-on experience and constant manual review. ZHERO packages that expertise into 1000+ automated checks that run continuously against your ZIA and ZPA tenants, so weak configurations, drift and dead policies surface as prioritized findings with a clear path to remediation.

Analysis templates

Best-practice analysis across ZIA and ZPA

Expert-validated templates cover access policy security, application segment hygiene and configuration cleanup, so unreachable policies, overly broad segments and unused configuration surface automatically with clear guidance.

Broad Scope Domain Detection in ZHERO flagging first-level wildcard domains in an application segment, with severity and guidance

Beyond ZIA and ZPA

Best-practice analysis reaches your Client Connector fleet

The same finding-to-fix approach scores your ZCC App Profiles, Forwarding Profiles and PAC files against best practice, so the check-up nobody wants to do by hand becomes a ranked, fixable list. Explore it on the Security Posture page.

ZHERO ZCC Fleet Health remediation plan with a Score Recovery Waterfall projecting the fleet grade once the top fixes are applied

How it works

From scan to safe fix in four steps

Step 1

Scan continuously

Smart Analysis runs lightweight checks in the background, with instant alerts for critical findings. Zero configuration required.

Step 2

Prioritize by impact

Every finding is classified by severity: Critical for weak configurations that need immediate attention, High for significant risks, Medium for optimization opportunities, Low for incremental improvements, Info for best practice guidance.

Step 3

Review resolution proposals

ZHERO does not just flag issues. Each finding includes a detailed explanation of the problem and the specific steps to remediate it, and many come with a proposed change ready to review.

Step 4

Apply with confidence

Nothing changes automatically. You review each proposal, and supported change types can be staged and applied through ZHERO's guided change workflow. Everything else comes with step-by-step remediation guidance.

Without ZHERO vs With ZHERO

Without ZHERO

With ZHERO

Security reviews

Manual reviews that take weeks

Continuous automated scanning, always current

Best practices

Scattered across documentation and tribal knowledge

Consolidated into 1000+ expert-validated checks

Configuration drift

Goes unnoticed until something breaks

Detected in real time as it happens

Dead configuration

Unreachable policies and unused segments accumulate silently

Detected automatically, with clear cleanup guidance

Remediation

Research the fix, then apply it by hand

Ready-made proposals you review and apply

FAQ

Questions, answered

Does my Zscaler configuration leave my browser?

No. The analysis is 100% browser-based: ZHERO reads your configuration through your existing Zscaler API session and processes everything locally. Your configuration never leaves the browser, and no configuration data is transmitted to ZHERO servers.

Does Smart Analysis change my configuration automatically?

No. Smart Analysis proposes, you decide. Every finding produces a remediation proposal that you review first. Supported change types can be staged and applied through ZHERO's guided change workflow; for everything else, ZHERO provides precise step-by-step remediation guidance.

What do the analysis templates cover?

Expert-validated templates across three areas: access policy security (catch-all rules that bypass intended controls, overly broad application segments), configuration hygiene (unreachable policies shadowed by higher-priority rules), and cleanup (application segments not referenced by any access policy).

Will continuous scanning slow down my browser or my tenant?

No. The checks are lightweight and run in the background. There is no performance impact on your Zscaler tenant or your day-to-day admin work.

How do I know which findings to fix first?

Every finding is ranked by severity, from Critical to Info. Critical weak configurations trigger instant alerts, so your team always starts from the issues with the highest real impact.

Smart Analysis in action

Watch a 4-minute demo.

Ready to see Smart Analysis in your tenant?

Start Your Transformation!

Install in two minutes. No servers, no migration, no training.

Start Free Trial Schedule a Demo