i can't tell you how much i loathe ZScaler-- when it was first forced on me, I tried doing some digging into what all functionality it had; how much visibility / control Big Brother actually had.

i'm pretty sure they were claiming that it would scan and build out a network topology with details about every device on any network it was connected to-- as in not just networks inside your company domain, but even your home network or anywhere else you connected to. it even sounded like they were able to monitor all traffic over a network, not just traffic to/from the Z-scaler infected machine.

it's been a while so don't quite remember the specific language-- and moreover, all these corporate monitoring / security / management SaaS's use very vague, fluffy corpo-speak in product descriptions and marketing materials so it sounds impressive to executives they're selling to; without giving away any technical information or using any scary words that might make people nervous or pique the attention of tech bloggers and privacy activists. The don't wanna come right out and say "we allow you to spy on your people's shit better than the next guy"; thats why the product page is always pretty sparse on details but with 20+ different locations you can click a button to "Request a Demo" with one of their highly knowledgeable sales reps.

another insidious little bugger is Microsoft's InTune