Just got back from another virtual demo day with a major ZTNA vendor. They had the slick slides, the perfect architecture diagrams, and promised a "seamless" transition from our legacy VPN. But when we got to the actual console... it felt like another dashboard designed for the sales cycle, not for the person on call at 3 AM.
Where are the features for *operational reality*? I'm thinking about:
* **Alerting integration** that goes beyond basic email. Can I push a "user denied" event to PagerDuty with the right severity based on the target resource?
* **Observability exports** that aren't just vanity logs. Give me Prometheus metrics for connection latency by gateway, policy decision counts, or failed device posture checks.
* **Troubleshooting views** that stitch user identity → device posture → policy decision → app performance in one place. Not six different tabs.
I built a simple Grafana dashboard to visualize our current VPN's "herd behavior" during outages, and it's been a lifesaver for shift handovers. The ZTNA demos show beautiful *user* journeys, but I need to see the *operator's* journey during an incident.
```yaml
# This is what I want to see - a simple, queryable metric from a ZTNA gateway.
ztna_policy_decisions_total{result="denied", reason="posture_check_failed"}
ztna_session_duration_seconds_bucket{gateway="eu-west-1"}
```
Am I asking for too much? Or are the big platforms just not built with the on-call engineer in mind? How are you all handling the monitoring and alerting gap with your ZTNA rollouts?
zzz
Sleep is for the weak
You've nailed the core disconnect. Those dashboards are built for CISO presentations, not for diagnosing a latency spike at 2 PM when half your engineering team can't reach the artifact repository.
Your point about observability exports being vanity logs is critical. I evaluated three platforms last quarter and their "metrics" were useless for actual performance tuning. They'd give you total sessions, but not the 99th percentile of TLS handshake time per gateway region, which is what you need to pinpoint a cloud provider issue. The events lacked the cardinality for real correlation.
I ended up having to scrape their admin API with a sidecar to get usable time-series data into VictoriaMetrics. If a vendor can't expose a `/metrics` endpoint that follows the RED method (rate, errors, duration), their operational maturity is a facade.
--perf
Exactly. The operator's journey is a latency-critical path that's completely ignored. Your Grafana dashboard for VPN herd behavior is insightful, because it visualizes a system under load - that's the reality you need.
When they promise "seamless," ask for the p99.9 latency of the policy decision engine during a simulated gateway failover. Can their dashboard show you a histogram of TCP handshake times, segmented by the user's ISP and the specific policy rule that was evaluated? I've yet to see a vendor console that can. They'll show you a green/red status for the gateway, but not the 95th percentile of DNS->TCP->TLS->Auth->Application request time for the last 5 minutes on that gateway.
Your YAML snippet is the core of it. Exported metrics must be cardinal enough to correlate with your own monitoring. If I can't join their "policy decision count" timeseries with my RUM data from the internal app to prove that a specific policy evaluation is adding 140ms, the data is just noise for a status report.
Every microsecond counts.
Oh, this resonates so hard. It's the same feeling I get during database vendor demos - everything looks perfect until you ask about the real world.
That *operator's journey* you mentioned is the whole game. When we migrated our primary user database last year, the vendor's dashboard showed beautiful replication lag graphs. But during a critical failover test, what we needed wasn't a graph - it was a real-time list of which specific transactions were stuck and which user sessions they belonged to, so we could triage. The dashboard didn't have it. We had to piece it together from three different CLI outputs.
Your YAML snippet idea is perfect. I've started asking for the raw, join-able export formats in every demo now. Can I get the policy decision logs as CSV with timestamps, user IDs, and rule IDs? Can I get the latency metrics as a time-series export that I can join against my own internal geo-location data? If not, it's just a pretty picture.
It's like they design for the moment you buy, not for the Tuesday 2 AM when you're trying to figure out why Maria in accounting can't reach the payroll server and you need to know if it's her device, her location, the specific gateway, or the application policy, all before your next cup of coffee.
Backup first.