Example Corp (Demo) · ZPA · generated 2026-11-03 01:06 EST · v1.0.0 · Read-only (HTTP GET only)
A sanitized example of the report a read-only ZPA hygiene audit produces. No real customer data is shown.
Needs improvement: several high-priority controls fail; plan remediation in the next change cycle.
33 controls
Filter the control set, then open a row for the expected state, evidence, findings, and step-by-step remediation.
13 findings from the Findings Detail sheet
Issues are grouped when they share a control and the same fix. Each card has what we found and how to fix it.
| Severity ↑ | Control ↕ | Object ↕ | Finding ↕ | Why it matters ↕ | Remediation ↕ |
|---|
3 rule-to-segment paths
Each row is an enabled access-policy rule and the application segment it grants. Read left to right: who is allowed, under which device or context conditions, to which segment (domains and ports). Rule order matters — a later, more specific rule can take precedence over a broader earlier one. The Access Pivot below restates the same paths as a segment-by-audience grid: Yes means that audience can reach the segment; Yes +device means a posture or trusted-network check is also required.
Datasets that could not be collected
Some controls are reported as Not Assessed when a required API dataset is missing — for example a product scope the API client was not granted, or a feature that is not licensed. The gaps in this example are listed below, with the controls they blocked.
The API client was not granted read access to this dataset (missing product scope or invalid credentials), so ZPA-CLT-03 (Client Connector fleet and versions) could not be assessed and is reported as Not Assessed. Grant the API client the required read-only scope and re-run the audit. Recorded result: 401 Unauthorized (credentials invalid or API client lacks this product scope).
The API client was not granted read access to this dataset (missing product scope or invalid credentials), so ZPA-CLT-05 (Client Connector forwarding profiles) could not be assessed and is reported as Not Assessed. Grant the API client the required read-only scope and re-run the audit. Recorded result: 401 Unauthorized (credentials invalid or API client lacks this product scope).
Manual controls are a different case: the API data was available, but a human review is still required (for example MFA at the IdP, failover testing, or SIEM retention). They are listed on the Controls tab with status Manual, not here.
How this report is produced
ZPA Hygiene Audit is a read-only configuration and hygiene assessment for Zscaler Private Access, published by Root333.
The tool evaluates 33 controls across eight domains: access policy, application segments, hygiene, identity, client and posture, App Connectors, logging, and administration. Each control receives a status, the evidence observed, and a remediation. Individual problems are listed as findings with a severity, the affected object, why it matters, and a recommended fix.
.env or the environment; they are never written into reports.Priority-weighted across automated results. Manual and Not Assessed controls are excluded until they are reviewed.
Score = 100 × Σ (weight × value) / Σ weight
Weights: High 3, Medium 2, Low 1
Values: Pass 1, Partial 0.5, Fail 0
Grades: A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, F < 40
This example scores 60.2 (Grade C).
ZPA Hygiene Audit is an independent tool, not affiliated with or endorsed by Zscaler, Inc. Findings are heuristic and must be validated by a qualified engineer. “Zscaler”, “ZPA”, “ZIA”, and “Zscaler Client Connector” are trademarks of Zscaler, Inc., used only to describe compatibility. ZPA Hygiene Audit is an independent product and is not affiliated with, endorsed by, or sponsored by Zscaler, Inc. Results must be validated by a qualified engineer before you change production policy.
Request a read-only ZPA hygiene audit from Root333. The example on this page uses only dummy data.