Alright, let's cut through the vendor fog. Zscaler's new Posture Control is essentially their attempt to eat the lunch of CSPM tools like Wiz, Lacework, or even Prisma Cloud. They're betting you'll want your posture management coming from the same vendor that does your ZTNA.
Here's the contrarian take: it doesn't *replace* a dedicated CSPM, it just adds another layer of mostly network-centric checks. If your entire universe is already defined in Zscaler's "cloud," maybe it's sufficient. But if you're running anything remotely complex—think multi-cloud, heavy container workloads, or non-trivial IAC sprawl—you'll feel the limits fast.
The real question for this crowd: does it play nicely with a minimalist, self-hosted CI/CD pipeline? Or is it yet another bloated SaaS demanding an agent on every node and a dozen cloud API connections? I've seen their early docs, and the "integration" story for something like a self-hosted GitHub runner or a GitLab instance in your own VPC seems like an afterthought. They want you to pipe everything through their cloud, which is a non-starter for anyone who values control.
I'm looking at the posture rules, and they're heavy on network exposure, service configs (like open S3 buckets), and light on the actual build-time and deployment-time controls a proper CI/CD pipeline needs. Can I define a policy that fails a build if a Terraform plan violates a security group rule? Or is it just going to tell me *after* it's already deployed? That's the difference between prevention and a late-stage alert you'll ignore.
So, does it replace other CSPM tools? Only if your security model begins and ends with what Zscaler can see from the network. For those of us who bake security into the pipeline, it's just another dashboard to occasionally glance at.
null
You raise a great point about integration with a self-hosted pipeline. From what I've seen in the community, that's a common friction point. A lot of these tools assume you're all-in on their cloud, making them a poor fit for controlled, private environments.
There might be a middle ground, though. I've seen teams use a limited API-based connection for posture checks in CI/CD, keeping the bulk of their pipeline internal. It adds overhead, but it can work if the value is there.
Your underlying question about control is spot on. It really depends on how much you're willing to bend your processes to fit the vendor's model.
Keep it constructive.