Zscaler performs TLS interception in order to analyse the traffic and “protect the users”. [https://support.zscaler.com/hc/en-us/articles/205059995-How-does-Zsc

Zscaler performs TLS interception in order to analyse the traffic and “protect the users”. [https://support.zscaler.com/hc/en-us/articles/205059995-How-does-Zscaler-protect-SSL-traffic- https://support.zscaler.com/hc/en-us/articles/205059995-How-...] The issue is that Zscaler may have flaws, and that even if the validation is performed flawlessly then the introduced risk is not zero… Usually one would have to trust the root CAs, but with TLS interception we have to trust the trust of the MiTM software in the root CAs. This increases the attack surface instead of decreasing it. For a security appliance it’s a pretty bad job; sure, there may be reasons why you want to look into traffic, but then the aim is to control the communication. And control doesn’t come for free.