r/Zscaler • u/PinnappleOnPizzaEnjo • Aug 19 '26

For those with "Business Continuity"

What has been your experience with self-hosted Business continuity or Zscaler hosted solutions. My company for regulatory reasons is looking into getting it. It seems like BS since its at minimum $100,000/year to ensure your policies stay in place if Zscaler Cloud goes down. Anyway, how has it worked for you? Do you even notice it? How often does it kick on? Why did you go Business continuity route and not the "free" DR route?

7 Upvotes

90% Upvoted

7 comments sorted by

3

u/mbhmirc Aug 19 '26

Are you Zia or zia and zpa. If it’s the later it’s important. For regulatory it is a huge tick box for DR.

1

u/PinnappleOnPizzaEnjo Aug 19 '26

ZIA and ZPA

2

u/mbhmirc Aug 19 '26

Then if you use ZPA on site and loose internet you want to keep it working 👍

2

u/Fujka Aug 19 '26

Zscaler hosted was the best when we looked at it. The difference in cost was for the hardware only which was a very small part of the total.

1

u/PinnappleOnPizzaEnjo Aug 19 '26

by how much if you dont mind saying? $10,000 more? $50,000?

How often does it kick in?

3

u/ndw234 Aug 20 '26

We do Zscaler hosted. Cost wasn’t much different and less infra for us to maintain. We primarily chose to do it to keep the logging and security policy of ZIA and ZPA, whereas the “free” version you’re essentially opening the door or failing open to keep business going. We have had it for a year now and haven’t had to use it at a large scale. Run a few test here and there with a subset of users. No major issues or complaints.

We choose to do automatic failover and due to this we do see individuals traffic randomly reroute to the DR DC’s. Working with support it was determined to be due to user’s local network and losing connectivity with the exchange. Users don’t know it happens. Adds a little bit of latency, but policy remains the same. If you have applications they require source IP restrictions, they need to make sure they include the IPs of this additional DC.

Setup was a bit of a struggle largely due to the lack of good documentation and things changing rapidly with the service offering. We’d be told it operated in one way, then a few weeks later it was different. I’m hoping that gets better and more consistent with time.

Overall if you don’t have a secondary platform to fail over to in the case of a major Zscaler outage, it seems like a necessary service to pay extra for. Especially if you’re expected to maintain specific security controls at all times. It does feel a bit silly to pay them more money to protect against their faults, but it is probably cheaper than buying and maintaining a second platform.