Zscaler is launching a Bring Your Own IP (BYOIP) capability, letting enterprises use their own IP address ranges for internet egress through its cloud security platform.

The vendor already offers dedicated IPs to customers, but the new offering allows organizations to maintain ownership and control of their address space, a need for firms that require static or customer-owned egress IPs.

Zscaler’s chief reliability officer, Michael (Misha) Kuperman, and principal product manager Mithun Hebbar explained the offering in a blog post: “You bring an IPv4 prefix you own, Zscaler securely validates your authorization to use our ASN to originate it, then Zscaler advertises the route from the designated region and makes the IPs available as Zscaler Managed Dedicated IPs for policy and egress.”

Despite zero trust principles moving away from IP-based authentication, many enterprises still operate legacy SaaS platforms, partner networks, and regulatory environments that require allowlisting by static source IP addresses.

To support customers wanting static support, Zscaler’s BYOIP relies on industry-standard Route Origin Authorization (ROA) validation through RPKI, combined with X.509 certificate-based attestation to cryptographically verify prefix ownership and prevent IP hijacking.

Zscaler operates region-specific ASNs for the service, AS22616 for the Americas, AS62044 for EMEA, and AS53813 for APAC, with support for IPv4 prefixes as small as /24.

For the less technically minded, all that means is that customers wanting to take up the service are required to prove they legitimately own their IP addresses through cryptographic signatures verified against public internet registries. Zscaler will only then announce those addresses from specific geographic regions tied to designated routing identifiers, ensuring both security against IP address spoofing and compliance with data residency requirements.

“Zscaler supports both Zscaler-assigned Dedicated IPs and customer-owned Dedicated IPs (aka BYOIP), giving enterprises maximum flexibility while preserving the benefits of a modern Zero Trust architecture,” Kuperman and Hebbar wrote.

The launch of BYOIP comes as Zscaler continues to expand its zero-trust offerings.

Back in August, the vendor integrated managed detection and response (MDR) tools into its Zero Trust Exchange platform, which were inherited from its acquisition of Red Canary earlier this year.

On the network front, Zscaler refreshed its ZDX and ZDX Network Intelligence platforms to provide users with improved visibility across entire network traffic paths. The revised offering provides network teams with real-time alerts based on custom thresholds, detailing whether other Zscaler users are similarly affected by network issues.