What it is and what it does
Zscaler Private Access, or ZPA, connects authorized people to specified private applications. Zscaler Internet Access, or ZIA, addresses internet and cloud service traffic. They solve related but different problems. A CFO should ask which business workflows each subscription protects. Zscaler: Private Access.
What that means for your business
Your controller can reach an internal finance application from an approved laptop while an engineering supplier reaches only its approved service. That reduces the number of systems exposed if one account is misused.
Is this a baseline system?
The baseline is verified, limited remote access. Zscaler is one way to deliver it. Consider the platform when several locations, remote workers, or supplier connections make consistent policy difficult to maintain.
Will insurance ask about it?
Be prepared to explain MFA, remote connections, administrator access, and access reviews. Do not describe “zero trust enabled” as proof that all remote routes are protected. Insurer questions and required evidence depend on the actual application and business exposure.
See the insurance sources and how to interpret the levels.
Minimum operating position
Identify private applications, require strong sign-in, grant access by role, and remove unused accounts and older bypass paths.
When the business needs stronger protection
Add device checks, monitored supplier sessions, application separation, and a tested continuity plan. Verify which capabilities are in the contracted package.
Evidence to request from IT
- Application and user access map.
- Exceptions for legacy VPNs or direct remote desktop connections.
- Access review results and documented outage arrangements.
What belongs in the budget
Compare total implementation and support cost with the current service. Include connectors, licenses, application testing, migration, and support for users who cannot connect.
A documented incident
Change Healthcare, 2024: check the exceptions
The CEO’s Senate testimony described compromised credentials used against a remote portal without MFA, followed by ransomware and operational disruption. UnitedHealth CEO testimony to the Senate, May 2024 (PDF).
What this case shows: This was a missing authentication control, not proof of a missing Zscaler product. A migration only reduces this exposure if old, unprotected access paths are closed.
Sources and scope
- Zscaler: Private Access
- CISA: require multifactor authentication
- UnitedHealth CEO testimony to the Senate, May 2024 (PDF)
The baseline and stronger-protection positions are editorial planning guidance. Confirm your company’s required controls and insurance answers with the accountable IT owner and broker.