ZDX Agent: Bringing Agentic Intelligence to SASE Operations

Help IT teams quickly pinpoint whether user experience issues stem from the device, network, Zero Trust Exchange, or application so secure access through the Zscaler Zero Trust Exchange also delivers a better digital experience.

SASE has changed how users connect to applications. Instead of backhauling traffic through legacy networks, users connect from anywhere, over any network, to private apps, SaaS platforms, and the internet through a cloud-delivered security architecture.

That shift is essential for Zero Trust transformation, but it also changes how IT teams troubleshoot. Traditional monitoring tools rely on siloed point-agents, one for device health, another for network pathing, and another for application monitoring. Because these point-products operate in isolation, they lack the shared end-to-end context required to solve complex SASE performance issues, resulting in war rooms and finger-pointing.

When a user says, “Salesforce is slow,” “Zoom is choppy,” or “I can’t access an internal app,” the issue could be caused by the endpoint, Wi-Fi, ISP, DNS, Zscaler Zero Trust Exchange, or the application itself.

For IT, network, security, and service desk teams, the hardest question in SASE is often:

Is this performance issue caused by my SASE deployment, the network, the user’s device, or the application?

That is where Zscaler Digital Experience (ZDX) becomes critical and where ZDX Agent, built on Zscaler’s ZAgent framework, brings a new agentic approach to SASE operations.

The operational gap in SASE

SASE brings networking and security together in the cloud. But when troubleshooting still depends on manually pivoting across dashboards, logs, tickets, and team handoffs, IT operations can remain slow and fragmented.

A single user issue can trigger multiple teams:

• The service desk checks the endpoint.
• Network operations checks Wi-Fi, ISP, and routing.
• Security teams check access policy, ZIA, or ZPA behavior.
• Application teams check SaaS or private app health.

Each team may have a piece of the answer, but not the full picture. The result is often finger-pointing, escalation, and lost productivity.

ZDX helps solve this by monitoring digital experience across the full user-to-application path, including the SASE deployment, the network, the user’s device, or the application. ZDX Agent takes that one step further by allowing teams to ask questions in natural language and receive a structured root cause analysis with supporting evidence and suggested remediation steps.

What is ZDX Agent?

ZDX Agent is an AI-powered digital experience agent that helps IT teams investigate user experience issues using natural language.

Instead of starting with, “Which dashboard should I open?” teams can start with the issue they need to solve:

• “Why is this user having a poor experience?”
• “Analyze Wi-Fi health for all users in the San Francisco office.”
• “Troubleshoot Zoom call performance for this user.”
• “Which network leg is causing latency?”
• “Why did users experience poor performance for Salesforce Lightning in the last 12 hours?”

ZDX Agent can help analyze signals across device health, Wi-Fi, network path, ISP performance, application response, collaboration tools to suggest remediation steps.

To move teams from symptom to resolution instantly, ZDX Agent combines three core AI skill sets into a single interface:

• Knowledge Skills: Instantly answers how-to queries and architectural guidance, eliminating time spent searching through technical documentation.
• Data Analytics Skills: Automatically scans days of raw network, endpoint, and security telemetry in seconds to surface hidden Wi-Fi, ISP, and application anomalies.
• Troubleshooting Skills: Executes end-to-end root cause investigations across the entire SASE path and delivers clear, actionable remediation steps for IT teams to execute immediately.

The goal is simple: help teams move from symptoms to evidence to resolution faster.

Why ZDX Agent matters for the Zscaler Zero Trust Exchange

The Zscaler Zero Trust Exchange securely connects users, devices, workloads, and applications without placing users on the corporate network. It enforces policy close to the user, brokers access based on identity and context, and helps organizations deliver secure connectivity at scale.

But secure access and great user experience must go together. If users are protected but struggling with slow SaaS performance, poor call quality, or intermittent access, IT needs to know why and fast.

ZDX provides the experience telemetry. ZDX Agent helps turn that telemetry into answers.

Together, they help teams understand:

• Whether a problem is isolated to a user, location, app, ISP, or network path
• Whether performance degradation is related to endpoint health, Wi-Fi, Zscaler path, policy, or application response
• Whether an issue should be owned by IT, NetOps, SecOps, an ISP, or an application team
• Which actions can help restore user productivity faster

In other words, ZDX Agent helps make the Zero Trust Exchange not only secure and scalable, but also observable, explainable, and easier to operate.

Use case 1: Determining whether the issue is SASE, the network, or the app

In a SASE environment, users connect through multiple layers: endpoint, local network, internet, Zscaler services, and the destination application. When performance drops, IT teams need to understand where the degradation occurred before they can engage the right team.

With ZDX Agent, teams can start with a prompt such as:

“Troubleshoot slow application performance for this user.”

ZDX Agent can analyze the user-to-app path and help determine whether the issue is tied to endpoint resources, Wi-Fi signal, network latency, Zscaler path, or the application itself.

Why it matters for SASE: Teams can distinguish between security service issues, network conditions, and application-side degradation faster, reducing unnecessary escalations and helping users get back to work.

Use case 2: Reducing MTTR across Wi-Fi, ISP, and routing issues

In hybrid work, many user experience issues start outside the enterprise network. Employees connect from home, branch offices, airports, cafés, and customer sites. Local networks and ISPs are often outside IT’s direct control, but they still shape how users experience SASE.

ZDX Agent can help teams investigate questions such as:

“Which network leg is causing latency?” OR “Analyze Wi-Fi health for users in this office.”

The agent can correlate Wi-Fi quality, roaming behavior, access point health, ISP latency, packet loss, and application experience. This is especially useful for NetOps teams trying to determine whether an issue is local, regional, ISP-related, or tied to a broader service path.

Think about a complex escalation that requires many people and many hours to diagnose before it gets traced to an intermediate ISP. With ZDX and agentic troubleshooting, that type of investigation can be accelerated because the relevant telemetry is already correlated across the user-to-app path.

Hear directly from our customers, on how to use ZDX Agent to diagnose and solve his Wi-Fi and app issues. 

Why it matters for SASE: A poor network underlay can look like a SASE issue. ZDX Agent helps prove where the problem lives, so teams can take targeted action instead of guessing.

Use case 3: Distinguishing policy issues from performance issues

Security teams are often pulled into performance escalations because users assume the security platform is blocking or slowing access. Sometimes the issue may involve policy. Other times, the root cause is Wi-Fi, ISP latency, DNS, application response time, or endpoint health.

ZDX Agent can help security and IT teams ask:

“Is this access issue caused by policy or network degradation?” OR “Which apps have slow server response times on a direct path?”

This helps teams determine whether an issue is related to ZIA, ZPA, policy behavior, or something outside the security control plane.

Why it matters for SASE: Zero trust requires strong policy enforcement, but users still expect seamless access. ZDX Agent helps teams validate whether policy is working as intended while identifying non-policy causes of poor experience.

Use case 4: Empowering the service desk with expert-level troubleshooting

Many digital experience issues begin as service desk tickets. The challenge is that L1 and L2 teams may not have deep expertise across networking, endpoint performance, Zscaler architecture, SaaS behavior, and collaboration tools.

ZDX Agent helps close that skills gap by giving analysts a guided way to investigate issues such as:

“Why did this user’s experience drop today?” OR “Troubleshoot Teams call quality for this user.”

Instead of escalating immediately, the analyst can receive a structured report with likely root cause, supporting evidence, and recommended next steps.

Why it matters for SASE: As SASE environments scale, operational expertise must scale with them. ZDX Agent helps more teams resolve issues directly and escalate with better context when specialized support is needed.

From dashboard-driven to question-driven operations

The broader ZAgent framework points toward a new model for operating SASE.

Traditional operations are dashboard-driven. Teams must know where to look, which metrics matter, and how to connect signals across tools.

Agentic operations are question-driven. Teams start with the outcome they need:

• “Find the root cause of poor experience for these users.”
• “Show me whether this issue is isolated to one location.”
• “Identify whether the problem is Wi-Fi, ISP, Zscaler path, or the application.”

That shift matters because SASE operations are inherently cross-domain. User experience depends on multiple systems working together. ZDX Agent helps analyze those systems together.

Making ZDX value clear in a SASE architecture

ZDX makes digital experience visible across the full path from user to application. ZDX Agent makes that visibility easier to consume and act on.

For organizations adopting SASE, this means:

• Faster troubleshooting: Reduce time spent manually correlating data across domains.
• Clearer ownership: Identify whether the next step belongs to endpoint, network, security, ISP, or application teams.
• Better user experience: Detect and resolve issues that affect productivity.
• Stronger confidence in zero trust: Prove that secure access is working—and quickly isolate when something else is not.
• More scalable operations: Give service desk, NetOps, and security teams a common experience-driven source of truth.

The result is a stronger operational foundation for the Zscaler Zero Trust Exchange: security teams can enforce zero trust, IT teams can monitor experience, operations teams can troubleshoot faster, and users can stay productive.

The future of SASE is autonomous and experience-aware

SASE has already transformed secure access. The next step is transforming how that environment is operated.

Because in a SASE world, the question is no longer just:

“Is the user secure?” It is also: “Can the user work, and if not, do we know why?”

With ZDX Agent, IT teams can answer that question faster, with evidence, and with a clearer path to resolution.

Watch the latest ZDX Agent webinar featuring a customer panel with Salesforce.