Zscaler has expanded its Zscaler Zero Trust SASE solution with the introduction of the ZAgent Framework and additional innovations to simplify SASE operations and extend Zero Trust SASE everywhere.

Unveiled at Zenith Live 2026 conference in Las Vegas, the cybersecurity vendor said the move was motivated by the belief that legacy SASE, built on firewalls and virtual private networks (VPNs), was never designed for environments where work happens on unmanaged devices, across supply chains.

With AI-driven attacks outpacing teams' ability to defend, this often exposes applications to the internet and enables lateral movement, as legacy management consoles create an administration nightmare, Zscaler warned.

"Legacy SASE was built in the post-pandemic rush, based on a firewall and VPN model for a network perimeter that no longer exists," Jay Chaudhry, founder, chairman, and CEO of Zscaler, said.

"In a world of AI with distributed users, partners, and cloud workloads, that model leaves enterprises exposed.”

Updated SASE platform with AI automation and cloud security features

To simplify SASE operations and extend Zero Trust SASE everywhere, Zscaler has introduced the ZAgent Framework, an orchestration system designed to automate administrative tasks such as configuration and troubleshooting across its platform.

This allows network administrators to interact with the system using natural language prompts through the Zscaler Experience Center. As part of this framework, the Zscaler Digital Experience (ZDX) Agent has been integrated to help administrators diagnose and fix end-user connectivity issues, including Wi-Fi, internet service provider, or hardware problems, before they impact performance.

To secure remote users and third-party partners, Zscaler added two new browser-based deployment options: a cross-browser extension and a standalone Chromium-based Enterprise Browser. These tools embed localized data controls and threat detection directly into the browser, aiming to replace virtual desktop infrastructure (VDI) and VPNs for unmanaged or personal corporate devices.

The operator also expanded its workload protection capabilities across multi-cloud environments by launching the Zero Trust Gateway for Google Cloud Platform (GCP), matching its existing support for Amazon Web Services (AWS). This gateway standardizes security policies for traffic moving between workloads and the internet across different cloud providers, reducing reliance on cloud-specific firewalls.

The update also introduced automated microsegmentation for Google Kubernetes Engine and other Kubernetes environments to restrict lateral threat movement between virtual machines and containers without changes to the underlying application code.

Brad Skibitzki, CISO of Zebra Technologies, and a Zero Trust SASE user, said: "Legacy VPN and firewall models have failed to provide the granular control and visibility required for a distributed workforce and multi-cloud environment.

“Zscaler’s Zero Trust SASE platform gives us the confidence to innovate rapidly. By leveraging the ZAgent Framework and the new Zero Trust Browser, we can secure every connection, whether it involves employee BYOD devices or cloud workloads, all while dramatically simplifying our security management."

In March, Zscaler extended its data sovereignty platform, adding a dedicated European control plane, as well as bringing in-country data and logging services to new regions, including Canada.

Other global and in-region services across markets already include the U.K., the European Union, Switzerland, India, Singapore, Australia, and Japan.

The cybersecurity operator also previously announced new features in Zscaler's Zero Trust Exchange cloud security platform, including in-region SSL inspection and malware analysis to help decrypt and inspect encrypted traffic locally.