Notifications
Clear all
Topic starter
11/06/2026 10:57 pm
TL;DR: Access decisions increasingly depend on correlating identity, access, and workload exposure rather than treating them as separate control planes, according to Orca Security. Its integration with Zscaler Unified Vulnerability Management and ZPA adds access context to cloud exposure data, enabling more accurate alert prioritization, lower false positives, and faster remediation across private apps and cloud workloads.
NHIMG editorial — based on content published by Orca Security: Zscaler and Orca Security partner through ZPA and cloud risk integration
By the numbers:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption.
Questions worth separating out
Q: How should security teams use ZTNA context in cloud alert triage?
A: Security teams should use ZTNA context to confirm whether an observed connection came through a managed, policy-checked access path before raising severity.
Q: Why does cloud exposure data become more useful when paired with access context?
A: Cloud exposure data becomes more useful when paired with access context because it explains not only what is vulnerable, but how the access path was established.
Q: What do security teams get wrong about trust in zero-trust access models?
A: Teams often treat zero trust as if the access layer alone settles the trust question.
Practitioner guidance
- Correlate access metadata with cloud exposure data Feed managed connector details, egress pools, and private-app endpoints into your exposure workflow so suspicious traffic is evaluated against actual trust context before escalation.
- Define trusted access paths explicitly Document which ZTNA sources can reduce or suppress alert severity, and require evidence of identity and posture validation before any trust decision is automated.
- Separate trusted traffic from unknown-origin traffic Create triage rules that treat verified ZPA-managed paths differently from unmanaged sources, but keep the original event available for investigation and audit.
What's in the full article
Orca Security's full article covers the operational detail this post intentionally leaves for the source:
- How the ZPA metadata ingestion and correlation logic works in practice across managed egress pools and private-app connectors
- Examples of how Orca adjusts severity when ZPA context matches a known trusted access flow
- The specific customer-facing workflow changes for SecOps teams using the consolidated exposure view
- The partnership framing around access infrastructure and cloud workload exposure as separate domains being tied together
👉 Read Orca Security's analysis of the Zscaler ZPA and cloud risk integration →
Cloud risk context and ZTNA signals: what changes for SecOps?
Explore further
12/06/2026 7:24 am
Access context is becoming a security control, not just a logging enrichment. This partnership reflects a broader shift in cloud defence: the question is no longer only whether an IP is suspicious, but whether the access path was already validated by identity and posture controls. That matters because modern cloud estates generate too much noise for source-based triage alone. Practitioners should treat access context as part of the decision engine, not as an after-the-fact investigation aid.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to The 2026 Infrastructure Identity Survey.
- Only 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments.
A question worth separating out:
Q: How can organisations decide when to suppress an alert versus escalate it?
A: Organisations should suppress an alert only when the source is positively identified as a managed, expected access path and the destination context does not raise separate risk. Otherwise, escalation is safer. The decision should be documented in policy so suppression remains reviewable and does not become an informal exception process.
👉 Read our full editorial: Zscaler and Orca integration raises the bar for cloud risk context
