Health360: The Answer to the Question, "Is My Zscaler Deployment Healthy?"

Over time, cybersecurity platforms typically expand to include more products, admin interfaces, and dashboards. So, while their breadth of functionality increases, it often leaves their customers with important questions about the overall health of their security platform deployment, such as:

1. How do I understand my overall adoption of the platform, including what I'm entitled to and how much of it I'm actually utilizing?
2. How do I keep pace with the platform’s growth and stay compliant with best practices that keep everything running well?
3. How do I get a bird's-eye view of all connectors like client connectors, app connectors and tunnels in my environment to confirm they're operating properly?
4. How do I proactively know that the services I depend on are resilient and performing within the agreed SLOs?

Answering those questions usually requires stitching together dashboards, reports, spreadsheets, and institutional knowledge, but that takes a lot of time. Fortunately, at Zscaler, Health360 solves that problem.

The Power of Zscaler’s Platform

Zscaler holds an architectural advantage when it comes to understanding deployment health. The Zero Trust Exchange serves as an intelligent switchboard for customer traffic—brokering every connection between any entity and any destination. That produces telemetry of a volume and quality that no bolt-on monitoring tool can replicate. It lets us see how well customers have deployed Zscaler, gain unique insights into components around Zscaler (ISPs, network paths, apps, and more), and baseline individual deployments against what we observe across our entire cloud.

Health360 is a new platform capability (included for free in Experience Center) that takes advantage of this unique architecture to show customers their full deployment health in an objective, intuitive, and quantitative fashion—scored, trended, and paired with prescriptive remediation steps. Health360 is not a troubleshooting tool or a risk quantification tool—Zscaler has purpose-built products for both of those needs (ZDX for the former and Risk360 for the latter). Instead, Health360 tells you whether your Zscaler deployment is performant, resilient, and mature.

The Three Pillars of Health

Health360 organizes the answer to "is my deployment healthy?" into three pillars. The first—best practices—is about architectural hygiene: have you deployed the platform correctly, completely, and effectively? The other two pillars—connectors health and services health—are about operational health: is everything running well right now, and trending in the right direction?

That ordering is deliberate. A well-architected deployment will, more often than not, operate in a healthy fashion. Customers should get the architecture right first, then monitor the operation of the platform continuously.

Pillar 1: Best Practices

The first pillar answers the most fundamental questions about your Zscaler investment:

• What products are you entitled to? 
• How is utilization trending? 
• And—the question behind those questions—how effectively have you deployed them?

Health360 offers a single, self-serve, portfolio-level view of each product's deployment status, entitlement, and utilization. Executives can see at a glance how much of the purchased portfolio is live and delivering value. Admins can see where deployment gaps exist. And renewal conversations start from shared, objective data rather than manually assembled snapshots.

That deployment and utilization information tells you what you've deployed. Best practices then tell you how effectively you’ve done so. That matters because a best practice you followed at initial deployment may quietly erode as suppliers change, teams rotate, and configurations accumulate—not to mention, Zscaler continuously adds new features that improve stability, resilience, and performance. With this pillar, Health360 operationalizes the collective experience of Zscaler's Professional Services and Customer Success teams (across thousands of deployments) to continuously evaluate your tenant’s configurations. Two examples illustrate the range:

• Tunnel resilience: If you forward traffic over GRE or IPSec, Zscaler has always advised that each office location should have a redundant pair of tunnels pointed at different Zscaler data centers, with IP SLA or health monitoring enabled. It’s simple in principle, but across dozens of locations, multiple ISPs, and equipment from different suppliers, it becomes difficult. Now, the tunnel best practice check evaluates every location against redundancy, monitoring, and capacity criteria and shows you which sites fall short.
• Double-tunneling and load-balancer entropy: If you tunnel inside a tunnel—encapsulating traffic within a GRE/IPSec envelope—the inner flows can lack the entropy our load balancers need to distribute them. So, your traffic pins to the same worker node(s), producing performance issues that are hard to diagnose even for our support teams. Health360 detects double-tunneling and suboptimal load distribution and flags affected locations for you—unlocking visibility that you would otherwise lack.

This pillar also includes peer benchmarking, letting you see how you compare to organizations of similar sizes and industries, and offers flexibility to exclude best practice checks that don't apply to your deployment—your score reflects your reality because no two environments are the same.

In the LA release, this pillar ships with v1 of the Adoption Dashboard (per-product deployment, entitlement, and utilization) and the first batch of 15-20 resilience and performance best practices focused on ZIA and Client Connector. ZPA practices will fast-follow shortly after LA. We will continue adding best practices on a regular basis, targeting 50+ across all products by GA later this calendar year. At that time, the Adoption Dashboard will also add per-product best practice evaluation to show how effectively you deployed each individual product.

Pillar 2: Connectors Health

Zscaler offers different connectors for specific traffic-forwarding use cases: GRE/IPSec tunnels for traditional site-based forwarding, Client Connector as the preferred path for user traffic, App Connector for outbound connections for private app access, and Zero Trust Branch and Cloud Connectors for extending zero trust to branches and workloads. Large enterprises typically run several of these at significant scale, and need a consolidated method of seeing how the whole fleet is performing.

Connectors health provides that unified view. Rather than answering "which connector is down?" (a triage question), it answers "how is my fleet performing today?" (a general health question). It evaluates each connector type across availability, performance, and capacity, with drill-downs when something needs attention.

In the LA release, connector and edge health covers:

• GRE/IPSec tunnels: Availability and capacity metrics across all locations
• Client Connector: Health signals spanning software issues, tunnel and networking issues, and user disabling of services—and for customers who have ZDX entitled and configured, Client Connector health is also enriched with insights surfaced from ZDX telemetry, including device health and ZDX scores

Insights on App Connector health, covering availability and capacity, will fast-follow shortly after LA, while Zero Trust Branch and Cloud Connector health will follow in subsequent phases as we approach GA later this calendar year.

Pillar 3: Services Health

Even a perfectly architected and healthy deployment depends on services beyond your direct control, including Zscaler's own infrastructure, your ISPs, and the apps your users consume. The services health pillar gives you a contextual view of how these services are performing for your traffic specifically.

This begins with Zscaler's own infrastructure, where we are committing to a level of transparency that is rare in the industry, showing:

• Which Zscaler data centers are processing your traffic
• Which traffic-steering mechanisms are directing traffic to those data centers
• What latency Zscaler is adding to your traffic, and if it is within our SLOs

We can offer this level of granularity because of the confidence we have in the reliability and performance of our multitenant infrastructure. No other vendor offers this level of visibility, but we believe it is exactly what customers need if they are to trust a cloud security platform.

In the LA release, services health launches with China Connectivity insights, one of the most consistently requested items from our global customers. For whatever China Premium SKU you purchased, you will see your current bandwidth utilization as well as the health of that connectivity—with no support ticket required. On the path to GA, we plan to extend services health to cover ZIA cloud health and enhanced visibility into ZIA Private Service Edges.

What Ships in July and the March to GA

To make the scoping unambiguous, here is the release picture in one place:

Health360 will develop iteratively. Between LA and GA, we will regularly add support for additional best practices, connectors, and services, which we will prioritize based on feedback from early customers. 

Get Started

The health of your Zscaler deployment shouldn't be a quarterly conversation or a support escalation. It should be a number you can see, a trend you can track, and a list of actions you can take every day in Experience Center.

If you’d like to get started with Health360, you can:

• Watch our webinar to see Health360 in action and walk through each pillar in detail. 
• Sign up for the limited availability (beta) release by contacting your Zscaler Sales Engineer or Technical Success Manager.