Senior Staff Software Engineer - Test Automation Infrastructure, Zia Core

Beyond VoIP and SCCM: Securing Legacy Applications with ZPA. VPN for Legacy Apps started with VoIP and server-to-client apps like SCCM. New capabilities now extend it to support full zero trust access to IP address dependent systems like mainframes, multi-entity organizations and complex routing environments, so more of your legacy estate can move to Zscaler Private Access (ZPA). Most organizations moving from a traditional VPN/Firewall to zero trust reach the same point: user-to-app traffic moves to ZTNA easily, but a set of legacy apps keeps the old VPN concentrator or NGFW running. VPN for Legacy Apps in ZPA closes that gap. It gives those apps a home on the Zscaler Zero Trust Exchange, delivered through the same Zscaler Client Connector users already have. You can move off your traditional VPN vendor completely, with one agent, one policy framework and one platform for all private access, instead of running Zscaler and legacy VPN solutions side by side. Why the last mile of VPN migration is the hardest. In its earlier post, Zscaler, Inc. introduced VPN for Legacy Apps in ZPA. It covers the applications that have challenges with zero trust design: Cisco Jabber, Avaya and Genesys VoIP, SCCM, follow-me printing and active FTP. These apps need the server to reach back to the client, and many expect a fixed client IP. That is why the VPN concentrator stays on long after everything else has moved to ZTNA. As more customers move these apps onto ZPA using VPN for Legacy App solution, they have told Zscaler, Inc. what would make large migrations even smoother: onboarding large VPN configurations quickly, supporting systems that expect a fixed client IP, bringing acquired companies onboard on their own terms, and fitting cleanly into existing routing. Over the last few releases, Zscaler, Inc. has delivered a set of features that address each of these needs and open VPN for Legacy Apps to use cases beyond where it started. Together, they make onboarding a legacy app to ZTNA as simple as adding it to your VPN, so you can retire your legacy VPN concentrators with confidence. Expanded use-case coverage. The first set of capabilities removes common blockers that keep legacy apps on the VPN, while making onboarding and day-to-day operations simpler. 1. User group-based access policy. Legacy VPN access is often defined by IP ranges alone, which says little about who is actually connecting. Access policies for VPN for Legacy Apps can now use IdP group attributes alongside existing IP criteria. Admins can grant access to a legacy app based on who the user is (for example, the finance or contact-center group), not just which network range they target and coming from. 2. FQDN wildcard support: onboard everything, then migrate in phases. A typical VPN configuration covers a large number of hosts and domains, and discovering and rebuilding each one as an exact ZPA segment before cutover takes time. One missed host can break a VoIP callback or an SCCM push with no obvious cause. Network segments now support wildcard FQDNs, such as *.acme.com, so a single definition covers your legacy destinations on day one. You can move all of your VPN traffic to Zscaler in one step and retire the VPN, with users working just as they did before. From there, migrate to ZTNA at your own pace: use ZPA visibility to see which apps are really in use, then carve out specific network segments with least-privilege policies, one app group at a time. Upfront discovery and rework drop sharply. 3. Static IP assignment to users: keep IP-based controls working. Mainframes and many other legacy systems still trust an IP address. Firewalls, application allowlists and licensing servers key on the client IP, and regulated teams need a stable user-to-IP mapping in their logs. Admins can now statically map a user to an IP address, so the user gets the same address every time they connect to VPN for Legacy Apps. Security teams can track the user by IP across enterprise systems, allowlist-based apps keep working, and IP-based firewall rules need no rewrites. Banks, healthcare providers and other regulated teams keep a consistent user-to-IP record for audit and compliance. 4. Micro-tenancy: isolation inside one ZPA tenant. Mergers, acquisitions and multi-campus organizations bring separate VPN estates, each with its own apps, admins and policies, and often overlapping RFC 1918 address space. VPN for Legacy Apps now works with ZPA Microtenants, which provide isolation inside a single ZPA tenant. Each subsidiary, acquired business or campus can run its legacy app segments, Network Connectors and policies in its own microtenant, on its own timeline, even when its private address ranges overlap with others. Microtenants can also share network segments with each other, with granular control over which segments are shared and with whom. Central IT keeps one platform and one view, while each business onboards fast. 5. BGP summary routes: simpler routing integration. Previously, the customer's router had to advertise prefixes that exactly matched each ZPA segment, so every new or changed segment meant a router change request and coordination between security and network teams. Now your router can send a single summary route to the Network Connectors. Network Connectors then use conditional routing to advertise the specific routes that match your configured segments. For example, if the router sends 10.1.1.0/24 and the network segment is 10.1.1.1, the Network Connector advertises only 10.1.1.1/32. The network team configures BGP once, and the security team adds or changes network segments in ZPA without opening a router ticket. Enterprise-ready: resiliency, control and visibility. With these capabilities, VPN for Legacy Apps goes beyond the handful of use cases to supporting all the use cases large enterprises run need Get started: ZPA trial for VoIP and legacy application Zero Trust migration. ZPA now supports VoIP, server-to-client (S2C) applications, and all IP address dependent use-cases. This enables customers to move all their applications and streamlines operations by consolidating their secure remote access solution with Zscaler Private Access. Check out the latest product innovations with ZPA in addition to network connectivity. And read the Forrester Total Economic Impact study to learn how ZPA customers have realized 289% ROI. Contact your regional sales team to learn more about the solution and get a free 30 day trial to explore the solution, or take a quick tour. Was this post useful? Yes, very! Not really Disclaimer: This blog post has been created by Zscaler for informational purposes only and is provided "as is" without any guarantees of accuracy, completeness or reliability. Zscaler assumes no responsibility for any errors or omissions or for any actions taken based on the information provided. Any third-party websites or resources linked in this blog post are provided for convenience only, and Zscaler is not responsible for their content or practices. All content is subject to change without notice. By accessing this blog, you agree to these terms and acknowledge your sole responsibility to verify and use the information as appropriate for your needs.

Zscaler works with IBM, Red Hat on cybersecurity for private apps. Published on 10/05/2026 at 11:00 am EDT By Kelly Cloonan Zscaler is working with IBM and Red Hat to offer a cybersecurity solution aimed at protecting businesses' private applications from artificial intelligence-driven threats. The companies said Monday the offering is tailored for the gap between when a cyberattack happens and when a company prepares and deploys fixes, helping organizations reduce risk as cyberattackers use AI tools to exploit vulnerabilities faster. The collaboration combines Zscaler's Autonomous Application Shield offering with IBM and Red Hat's Lightwell solution to assess a private app's current risk profile, provide protections while remediation is under way and deliver software fixes to resolve underlying vulnerabilities. "As attackers weaponize newly disclosed vulnerabilities faster than enterprises can respond, organizations need a way to protect private applications immediately while fixes are being prepared and deployed," said Joby Menon, senior vice president of product management at Zscaler. Zscaler said its Autonomous Application Shield offering is currently available through an early access program. Write to Kelly Cloonan at [email protected] (END) Dow Jones Newswires 10-05-26 1059ET (C) Dow Jones - 2026

Zscaler collaborates with IBM and Red Hat to protect private applications from frontier ai-powered threats. New collaboration combines Zscaler Autonomous Application Shield with Lightwell from IBM and Red Hat to help organizations reduce exposure between vulnerability disclosure and patch deployment through inline protection and validated remediation. October 05, 2026 08:00 ET | Source: Zscaler, Inc. SAN JOSE, Calif., Oct. 05, 2026 (GLOBE NEWSWIRE) - Zscaler, Inc. (NASDAQ: ZS), the cybersecurity platform for the AI era, today announced a collaboration with IBM and Red Hat to help organizations protect private applications during the period between vulnerability disclosure and patch deployment. The collaboration combines Zscaler Autonomous Application Shield, delivered through the Zscaler Zero Trust Exchange(TM) security platform, with Lightwell from IBM and Red Hat to deliver adaptive, application-specific protection with validated software remediation in a single coordinated response. "Lightwell helps keep open source safe by patching and fixing these vulnerabilities at machine speed. Collaborating with partners like Zscaler brings..." "As attackers weaponize newly disclosed vulnerabilities faster than enterprises can respond, organizations need a way to protect private applications..." "Our collaboration with IBM and Red Hat brings together inline, application-specific protection and validated remediation to help customers reduce risk during..." "AI is shrinking the window between vulnerability discovery and vulnerability exploitation. A window that was months or weeks is now hours and minutes," The economics of exploitation have shifted. Capabilities that once required elite skills and weeks of manual effort are now widely available, and attackers are weaponizing newly disclosed vulnerabilities faster than enterprise patch cycles can respond. According to Mandiant's M-Trends 2026 report, the mean time to exploit a vulnerability has fallen below zero, meaning vulnerabilities are increasingly exploited before a public patch exists. Patching remains necessary, but on its own it can no longer keep pace. Organizations need protection that can be applied at machine speed while remediation is prepared and deployed. This collaboration extends Zscaler's protection-first operating model for private applications, which assumes a remediation window will always exist and builds resilience around it: hide applications with Zscaler Private Access(TM)(ZPA(TM)) so they are harder to discover and target, segment access with Autonomous User-to-App Segmentation so a foothold does not become broad reachability, and shield reachable applications with Autonomous Application Shield so exploit attempts are stopped inline while the root cause is fixed. By uniting Zscaler Autonomous App Shield with Lightwell, the collaboration provides customers a coordinated path from immediate protection to durable fix. Operating through the Zero Trust Exchange, Zscaler App Connectors continuously perform safe assessments of each private application's exposure points and vulnerabilities. The Zscaler cloud individually evaluates each application, ensuring only necessary protections are applied. When a new vulnerability emerges, adaptive protections can be applied inline and in real time, without waiting for a patch. Through this collaboration, Lightwell helps Zscaler defend its customers from potential cyber threats, with Zscaler blocking exploit attempts immediately at the network level. Lightwell then provides validated remediations for affected open source software, enabling customers to fix the underlying flaw at the source. "As attackers weaponize newly disclosed vulnerabilities faster than enterprises can respond, organizations need a way to protect private applications immediately while fixes are being prepared and deployed," said Joby Menon, Senior Vice President of Product Management at Zscaler. "Our collaboration with IBM and Red Hat brings together inline, application-specific protection and validated remediation to help customers reduce risk during that gap." Through this collaboration, Zscaler, IBM, and Red Hat will deliver integrated capabilities across the application security lifecycle, addressing critical needs including: * Exposure Discovery: Providing a current understanding of a private application's actual risk profile, updated as fast as applications change, rather than relying on periodic scans. * Preemptive, Application-Specific Protection: Bridging the gap between vulnerability and patching. Applying only the protections a given application needs during the gap between disclosure and patching, reducing exposure while remediation is underway and avoiding one-size-fits-all policy noise. * Machine-Speed Response: Deploying protections inline and in real time when a new vulnerability emerges, informed by global threat intelligence from across Zscaler's worldwide customer base. * Validated Source-Level Remediation: Delivering tested software fixes through Lightwell so organizations can resolve the underlying vulnerability, with advisory and deployment support to prioritize and validate protections across complex environments. "AI is shrinking the window between vulnerability discovery and vulnerability exploitation. A window that was months or weeks is now hours and minutes," said Gunnar Hellekson, vice president and general manager, Lightwell, Red Hat. "Lightwell helps keep open source safe by patching and fixing these vulnerabilities at machine speed. Collaborating with partners like Zscaler brings Lightwell's capabilities to the forefront of enterprise networks, mitigating potential vulnerabilities head-on while patches are applied to critical systems." Autonomous Application Shield is currently available through an Early Access Program. Availability, capabilities, and timing of the collaboration described herein are subject to change. For a deeper dive into how Zscaler is helping protect against AI threats, please visit this blog. Forward-Looking Statements This press release contains forward-looking statements that are based on our management's beliefs and assumptions and on information currently available to our management. These forward-looking statements include the expected performance and benefits of Zscaler Autonomous Application Shield and its collaboration with IBM and Red Hat, including the delivery of adaptive, machine-speed protection for private applications. These forward-looking statements are subject to the safe harbor provisions created by the Private Securities Litigation Reform Act of 1995. A significant number of factors could cause actual results to differ materially from statements made in this press release, including those factors related to Zscaler's ability to achieve partner and customer adoption of Autonomous Application Shield and the collaboration described herein. Additional risks and uncertainties are set forth in our most recent Annual Report on Form 10-K filed with the Securities and Exchange Commission ("SEC") on September 3, 2026, which is available on our website at ir.zscaler.com and on the SEC's website at www.sec.gov. Any forward-looking statements in this release are based on the limited information currently available to Zscaler as of the date hereof, which is subject to change, and Zscaler will not necessarily update the information, even if new information becomes available in the future. About Zscaler Zscaler (NASDAQ: ZS) accelerates digital transformation so customers can be more agile, efficient, resilient, and secure. The Zscaler Zero Trust Exchange(TM) platform protects thousands of customers from cyberattacks and data loss by securely connecting users, devices, and applications in any location. Distributed across 200+ public data centers globally and thousands of private sites at the edge, the SASE-based Zero Trust Exchange is the world's largest in-line cloud security platform. Media Contacts Nick Gonzalez, Director of Public Relations, [email protected]