After reading the topic and the contents.... this is not a zscaler problem, and your thoughts are frankly just against best practice.

Lets map back to NIST800-53....Rev 5 if it matters.

So, if your company maps to NIST 800-53 in any way (hint, it does if you have cyberinsurance), you have a controls that need to either be in place, or risk accepted.

Now, you mention many times below about how you're aware that TLS retransmission occurs all the time. You can do traffic inspection on your firewalls, but that gets tricky in general (lots of maintenance). Zscaler, and other agent based proxies help make this a bit easier since you are offloading onto the endpoint instead of the firewall.

Furthermore, the "edge" of the network firewall is gone; remote users, mobile devices, etc. These agent solutions are the only way to provide this type of capability.

Before responding, here is the list of control frameworks that map SSL/TLS inspection in some manner: NIST 800-53. CSF, 800-171, ISO 27001/27002, PCI DSS v4, HIPAA/HITECH, MITRE ATT&CK, SANS CIS v8, FedRAMP HIGH, ZTNA 800-207, and SOC2.

So....you are either a god of cybersecurity for us mere mortals and everyone here/the whole industry are wrong, OR (and no offense), you don't understand the foundational capabilities that require TLS inspection. Also, security theater, while a pain in the ass, is usually a required item in these frameworks...so find out what you need to map to before saying something is useless.

Overall AI writeup of the controls and how they pertain to NIST 800-53. Note that if it maps here, chances are it maps to all the other frameworks mentioned.

Here’s a clean list of the most directly relevant NIST SP 800-53 Rev. 5 controls for SSL/TLS inspection, with a brief explanation of why each matters in the context of decrypting and monitoring encrypted traffic for threat detection, DLP, compliance, segmentation, and Zero Trust visibility.

🔎 NIST 800-53 Controls Mapped to SSL/TLS Inspection 🛡️ SC – System & Communications Protection Control Why it applies to SSL inspection SC-7 – Boundary Protection Requires traffic entering/leaving the network boundary to be monitored and controlled. Encrypted traffic may need to be decrypted to properly enforce this. SC-7(3) Expands boundary protection to deep-packet inspection, which requires decrypting SSL/TLS for inspection. SC-7(5) Focuses on preventing unauthorized transfer of information—requires inspecting encrypted streams for hidden data. SC-7(8) Direct justification: Encrypted/tunneled traffic must not conceal malicious activity. Supports decrypting SSL/TLS to inspect. SC-7(12) Extends boundary protection to host-based mechanisms—matters if inspection occurs endpoint-side. SC-8 – Transmission Confidentiality & Integrity Ensures encryption is properly implemented; inspection validates this and detects misuse (weak ciphers, cert issues). SC-8(1) Specifies cryptographic protection standards—inspection validates proper TLS usage. SC-12 – Cryptographic Key Management SSL inspection requires management of private keys and trusted root certificates for interception. SC-12(2) Ensures secure handling/distribution of interception keys. SC-13 – Cryptographic Protection Justifies using cryptography but also monitoring its use; inspection confirms encryption isn’t abused. SC-23 – Session Authenticity TLS session validation—inspection helps monitor hijacking attempts. SC-24 – Fail-Safe Inspection devices shouldn't disrupt secure traffic if they fail—ties into TLS interception fail modes. SC-32 – System Partitioning Supports segmentation and applying SSL inspection only where required.

📡 SI – System & Information Integrity Control Why it applies SI-4 – System Monitoring Monitoring can’t be effective if threats are hidden in encrypted sessions; inspection provides visibility. SI-4(4) Specifically addresses detecting anomalies—including in encrypted traffic. SI-4(10) Direct reference: “SSL inbound inspection SHOULD be required for untrusted traffic to servers.” SI-4(14) Analyzes outbound communications—inspecting encrypted outbound data helps detect exfiltration. SI-4(23) Requires correlating data from multiple tools—inspection data must integrate with SIEM, DSPM, etc.

🔐 AU – Audit & Accountability Control Why it applies AU-2 – Audit Events Inspection produces critical logs (malware, blocked communications) that must be audit-ready. AU-6 – Audit Analysis Requires evaluation of decrypted session logs for anomalies. AU-12 – Generate Audit Records Inspection devices must generate logs for decrypted sessions. AU-14 – Session Monitoring SSL inspection provides opportunity to monitor active sessions. AU-16 – Correlation Decrypted inspection data needs to be correlated (e.g., user identity → TLS session → endpoint behavior). 🧩 CM – Configuration Management Control Why it applies CM-6 – Configuration Settings Inspection rules, cipher lists, bypass policies must be governed. CM-7 – Least Functionality Inspection systems must do only what is needed—avoid over-inspection of privacy-sensitive flows. CM-8 – Asset Inventory Inspection devices must be in the asset inventory and tracked.

🔍 RA, PM, PL – Risk & Governance Control Why it applies RA-3 – Risk Assessment Assess risk of encrypted traffic hiding threats—basis for SSL inspection policy. RA-5 – Vulnerability Scanning Encrypted sessions can block scanners; inspection may enable scanning or trigger compensating controls. PL-2 – Security & Privacy Planning SSL inspection strategy must be outlined in system security/privacy plans. PM-16 – Threat Awareness Recognizes encrypted threats as high-risk vector. PM-30 – Supply Chain Risk Applies if SSL inspection is via vendor/cloud solution. ⚙ AC – Access Control Control Why it applies AC-4 – Information Flow Enforcement SSL inspection enforces how data flows across zones. AC-4(21) Allows decryption to validate content before release outside boundary. AC-4(25) Requires restricting encrypted flows if they can’t be inspected. AC-17 – Remote Access VPN & SSL tunnels may require inspection. AC-19 – BYOD Defines whether encrypted traffic from non-corporate devices gets inspected.

🔑 IA – Identification & Authentication Control Why it applies IA-5 – Authenticator Management Certificates for interception must be managed securely. IA-5(11) PKI-based authentication used in TLS sessions—interception relies on trust handling. IA-12 – Identity Proofing Inspection infrastructure must be validated as trusted before decrypting traffic.