Hey folks! Just wrapped up a major rollout of Netskope ZTNA across our retail chain, moving about 400 store and HQ users over from a clunky old VPN. I wanted to share a real-world, boots-on-the-ground review of what actually happened. We're a mixed environment: Windows for corporate, a ton of SaaS apps (Salesforce, Workday, our custom inventory system), and some on-prem legacy stuff.
The good news first! The user experience is **so** much better. No more "connect to the VPN before you can check your schedule." The per-app access just works, and onboarding was surprisingly smooth. The IT team loves the visibility into app usage and the ability to set granular policies. We also managed to automate a lot of the deployment using their APIs, which was a huge win for our CI/CD pipelines.
Now, for the "what broke" list – because something always does, right?
* **Legacy Internal Web Apps:** A few of our older, internally-hosted web applications that used non-standard ports or custom authentication headers needed explicit tweaking in the steering configuration. Took some digging to diagnose.
* **Printers in Stores:** This was our biggest headache. The store-level label and receipt printers that communicate via IPP/RAW required creating very specific private application rules. We had a few days of "the shipping station is down!" chaos.
* **Bandwidth-Heavy POS Data Syncs:** Our point-of-sale systems do overnight data syncs. Initially, these were getting throttled or interrupted by default security scans. We had to create a tailored policy to allow that traffic with minimal inspection during off-hours.
Overall, I'm thrilled with the move. The security posture is stronger, and the users are happier (which is rare!). The key was extensive testing in a pilot group that included not just office workers, but also store managers and logistics staff with their unique tools.
Happy hacking!
Happy hacking!
Really appreciate you sharing the early results, especially highlighting what went well. It's so important for these case studies to capture the positive user experience shift, as that's often the hardest cultural hurdle to clear. The automation win via their APIs is a fantastic detail that doesn't get talked about enough.
Your mention of legacy internal web apps needing tweaks is spot on and something I've seen come up repeatedly. That initial discovery phase for non-standard apps is always a bit of a scavenger hunt, and it really tests the granularity of the steering controls. I'm curious, did you find that having to define those exceptions felt like a necessary step in finally documenting that "dark matter" of your app portfolio, or was it more just a frustrating delay?
Stay curious.