Why is SSL inspection required for Zscaler data protection policies to work?

SSL inspection provides visibility into encrypted traffic, allowing Zscaler to examine data content and apply protection policies. Without decrypting HTTPS traffic, the platform cannot see what data users are transmitting, making it impossible to detect policy violations or prevent data loss.

What's the risk of using wildcard exemptions in SSL inspection policies?

Wildcard exemptions (like *.domain.com) bypass inspection for all subdomains under that domain, creating blind spots where malware can enter and sensitive data can exit undetected. This is especially dangerous for AWS and Azure domains, where many applications store data in S3 buckets or Blob Storage that would be completely exempted from protection policies.

Understanding Data Protection in Zscaler Internet Access

Name: Understanding Data Protection in Zscaler Internet Access
Uploaded: 2026-05-19T19:26:43-04:00
Duration: 6 min 2 s
Description: About Zscaler Zscaler (NASDAQ: ZS) accelerates digital transformation so that customers can be more agile, efficient, resilient, and secure. The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks and data loss by securely con...

Zscaler

05/19/2026

0 (0%)

Report Like Favorite

TL;DR

Data breaches cost organizations an average of $4.5 million, driven by targeted exfiltration, careless users, malicious insiders, and cloud misconfigurations—requiring a comprehensive protection program beyond isolated policies.
Zscaler's data protection platform secures data across multiple vectors: inline DLP for traffic in transit, API scanning for data at rest in SaaS tenants, posture management for configuration risks, email security, and endpoint channel controls.
SSL inspection is a non-negotiable prerequisite for data protection—without decrypting traffic, Zscaler cannot see data content or apply protection policies, making proper SSL configuration critical to program success.

Summary

This technical overview introduces Zscaler's data protection capabilities within Zscaler Internet Access (ZIA), establishing the foundation for a comprehensive data security program. The presentation addresses the fundamental challenge organizations face with data distributed across devices, clouds, and locations, where the average breach costs $4.5 million. Zscaler's approach encompasses multiple protection layers: inline data loss prevention for traffic in transit, API-based scanning for data at rest in SaaS applications, posture management for tenant configurations, email security for Microsoft Exchange and Gmail, and endpoint channel protection for USB drives and network shares. A critical prerequisite emphasized throughout is SSL inspection—without visibility into encrypted traffic, data protection policies cannot be applied. The session concludes with essential guidance on avoiding common SSL inspection misconfigurations, particularly around Microsoft 365 services and wildcard domain exemptions that can significantly undermine data protection effectiveness. Organizations must ensure SharePoint and OneDrive traffic is inspected despite Microsoft's recommendations, and avoid blanket exemptions for AWS and Azure domains that would prevent policy enforcement on cloud storage destinations.

Chapters

0:00 - Introduction and Series Overview
0:21 - The Data Protection Challenge
1:21 - Zscaler Data Protection Platform
3:30 - SSL Inspection Misconfigurations

Key Quotes

0:46 "The average cost of a breach is $4.5 million."
1:32 "In order to apply data protection policies, Zetskiller has to have visibility into the data, which means there's a requirement to SSL inspect transactions for any traffic that you want to apply data protection policy to."
4:50 "Since you've exempted every subdomain and every destination under a specific domain, it's entirely possible that subdomains or destinations under that domain need to be inspected both for malware prevention reasons and in order to secure data being sent to those websites."

Categories:

Tags:

Show more Show less

Browse videos

Upcoming Webinar Calendar

05/20/2026

08:00 AM

05/20/2026

Establishing a Robust AI Governance Framework for GenAI Throughout the Deployment Lifecycle

https://www.truthinit.com/index.php/channel/1937/establishing-a-robust-ai-governance-framework-for-genai-throughout-the-deployment-lifecycle/
05/20/2026

10:00 PM

05/20/2026

Establishing a Robust AI Governance Framework for GenAI Throughout Its Lifecycle

https://www.truthinit.com/index.php/channel/1953/establishing-a-robust-ai-governance-framework-for-genai-throughout-its-lifecycle/
05/21/2026

11:00 AM

05/21/2026

Risk in Real Time Demo Series: The Autonomous Era - Orchestrating a Resilient Enterprise

https://www.truthinit.com/index.php/channel/1372/risk-in-real-time-demo-series-the-autonomous-era-orchestrating-a-resilient-enterprise/
05/27/2026

04:00 AM

05/27/2026

Rivoluziona i rischi dell'AI in opportunità con Netskope AI Security

https://www.truthinit.com/index.php/channel/1925/rivoluziona-i-rischi-dellai-in-opportunità-con-netskope-ai-security/
05/27/2026

10:00 AM

05/27/2026

Adopting AI: From Illusion to Intentional Control

https://www.truthinit.com/index.php/channel/1924/harnessing-ai-transitioning-from-illusion-to-purposeful-mastery/
05/28/2026

01:00 PM

05/28/2026

Harnessing AI for Smaller Teams: Strategies for Secure Implementation

https://www.truthinit.com/index.php/channel/1951/harnessing-ai-for-smaller-teams-strategies-for-secure-implementation/
06/02/2026

01:00 PM

06/02/2026

Spring of Satori: Delving into Recent Findings and 2026's Threat Landscape

https://www.truthinit.com/index.php/channel/1930/spring-of-satori-delving-into-recent-findings-and-2026s-threat-landscape/
06/16/2026

07:00 AM

06/16/2026

Transforming Data Risk into Actionable Priorities: What Needs Fixing First?

https://www.truthinit.com/index.php/channel/1952/transforming-data-risk-into-actionable-priorities-what-needs-fixing-first/
06/25/2026

05:00 AM

06/25/2026

Transition from Shadow AI to Regulated AI Access

https://www.truthinit.com/index.php/channel/1975/transitioning-from-shadow-ai-to-regulated-ai-access-strategies/