URL Category Data for ZTNA Products

Zero trust network access is built around private apps, but the agent behind it sits on every laptop and phone and sees where that device goes on the internet. URL categories turn that view into routing rules and risk signals.

This guide is for product managers and engineers building ZTNA, and for the security architects who deploy it. It covers where category data fits, which categories matter and how to deliver it to agents and connectors.

Example access decision

User: Finance analyst
App: Internal payroll system
Device: Managed, patched
Last 24h: 2 visits to Phishing category
Now: Tunnel open to VPN / Proxy site

Step-up authentication, read-only session

Why ZTNA needs to know about the public internet

A ZTNA policy decides who reaches which private app. The agent that enforces it also handles, or hands off, everything else the device does online.

Private app traffic

Identity, device posture and app-level policy decide access. Category data is not used for the private destination itself.

Per-app tunnels, not network-wide access
Continuous checks during the session
Context from identity and device health

Internet traffic from the same device

Categories decide whether this traffic goes direct, through a gateway or not at all. They also say whether recent browsing should lower trust.

Split tunnel and steering rules
Bypass for privacy-sensitive sites
Risk signals for the policy engine
Usage reporting for the security team

The zero trust architecture published by NIST (SP 800-207) describes a policy engine that weighs many inputs, including threat intelligence and activity logs. URL categories are one practical input of that kind. Check the current publication for the exact model.

Where category data plugs into a ZTNA product

Six places in a typical ZTNA architecture use categories. Most products start with steering and add the others over time.

Endpoint agent

Checks each new destination against a local list and picks a route: direct, via gateway, or blocked. Works offline for listed domains.

Compact list on device

Split tunnel engine

Sends high-volume, low-risk categories such as video conferencing or streaming direct, and the rest through inspection.

Steering by category

Policy engine

Uses recent category events from the device as context when it grants or keeps access to private apps.

Risk input

Cloud gateway

For traffic that is steered to the cloud, a full category lookup applies the customer's web policy. See URL category data for SASE.

Full database

App connectors

Connectors near private apps can refuse outbound calls from those apps to risky categories, which limits damage if an app is compromised.

Egress control

Admin console

Shows usage and blocked events by category per user and device group. It is the place customers see the data most.

Reports and investigations

Categories that matter for zero trust

A ZTNA product needs fewer categories than a full web gateway. These carry nearly all of the routing and risk logic.

Category	ZTNA use	Typical rule
VPN / Proxy / Anonymizers	Detect devices tunnelling around the agent	Block, and lower device trust while the tunnel is open
Remote Access Tools	Spot unapproved remote control sessions	Allow the IT-approved tool only, alert on others
Malware / Phishing / Suspicious	Risk signal and block	Block, and require fresh sign-in for sensitive apps after a hit
File Sharing/P2P	Data movement and malware risk	Block on managed devices
Cloud Storage / File Hosting	Data leaving after a private app session	Steer through inspection, see the URL category data for DLP guide
AI / LLM Tools	Pasting from internal apps into AI tools	Steer through inspection, allow sanctioned tools
Online Banking, Health & Medicine	Privacy	Route direct, never decrypt
Streaming Media, Webinars/E-learning	Bandwidth	Route direct to keep tunnels light
Parked / For-Sale Domains	Low-value and often abused	Steer through inspection or block

Each domain can carry several categories ranked by how much of the site they describe. Steering rules usually follow the top label, while block and risk rules should check all labels. The category list describes all 59 categories.

What a ZTNA team receives

The licence delivers data and access that your engineers control end to end. Nothing runs as a black box inside your agent.

120M

Domains

Categorized domains in the full file, with hosts and registered domains.

Delta files

About 300,000 newly registered domains a day, plus rechecks after a week and a month.

API

Lookups

Single and batch lookups for misses and console tools, included with licences.

Files come as CSV, Parquet or JSON. Because the 20 million most visited domains cover 99.99% of web traffic and usage, a well-chosen agent list handles nearly every lookup without leaving the device.

Category events as trust signals

Zero trust assumes trust can change during a session. Browsing events are one of the fastest ways to see that a device may be at risk.

Normal use

Business, news, developer tools and other ordinary categories. No change to trust.

-1

Watch

Parked domains, URL shorteners, unknown new domains. Logged, small trust effect if repeated.

-2

Concern

Unapproved remote access tools, file sharing on a managed laptop. Re-check posture.

-3

High risk

Phishing or malware hits, active anonymizer use. Step-up or restrict sensitive apps.

These weights are illustrative. Each vendor tunes its own model, and customers should be able to change thresholds per app sensitivity. For combining category data with other risk feeds, see content risk intelligence integration.

Delivery: agent lists, cloud store and API

Agents run on laptops and phones with limited memory and patchy networks. The data has to be split into tiers that fit each place.

Agent list

A compact list built from the full file: security categories, steering categories and the most visited domains. It updates daily from your own update service, not from ours.

Cloud store

The full database in your cloud, loaded from CSV, Parquet or JSON files. Agents query it on a miss, and the answer is cached on the device.

Lookup API

A fallback for domains your store does not hold and for console tools. Single lookups and batch requests of up to 1,000 domains are available, as described in the API documentation.

Signed updates

Ship each list update with a signature and a version number. The agent rejects lists it cannot verify and reports its current version, so admins can see which devices are behind.

Per-platform size

Phones and older laptops can take a smaller list than modern desktops. Build two or three list sizes from the same file and pick one by device class.

Offline mode

When the device has no connection to your cloud, the agent list still covers the security and steering rules. Unknown domains fall back to the safest route.

How compact lists are built for limited devices is covered in blocklist formats. The full file contents are on the web filtering database page.

Latency and freshness on the endpoint

Users notice every pause when a new connection opens. Freshness matters most for risk categories, where new domains appear daily.

Decision	Where it runs	Data used	Update rhythm
Route new connection	Agent	Local list	Daily list update
Block risky destination	Agent, then gateway	Local list, cloud store on miss	Daily deltas with about 300,000 new domains
Adjust device trust	Policy engine	Category events from agent logs	Near real time from events
Web policy for steered traffic	Cloud gateway	Full database	Daily deltas plus monthly refresh
Reports	Console	Full database	Monthly refresh for content labels

New domains are checked again after a week and after a month, because many sites add content after launch. The real-time URL classification page explains that cycle.

Policy examples for ZTNA customers

These are the policies security architects ask for most when they move from a legacy VPN to zero trust access.

Steering profile for remote staff

Direct: Streaming Media, Webinars/E-learning, sanctioned conferencing
Direct, no decryption: Online Banking, Health & Medicine
Via gateway: everything else
Blocked: Malware / Phishing / Suspicious, VPN / Proxy / Anonymizers

Sensitive app protection

Payroll and source code apps require high device trust
Any phishing hit in the last 24 hours triggers step-up sign-in
An open anonymizer session pauses access until it closes
Events are logged with the category that triggered them

Contractor devices

Browser-only access to private apps
AI / LLM Tools and Cloud Storage steered through inspection
Remote Access Tools blocked except the client's approved tool
Short session lifetimes

Connector egress

Private apps may reach only the update and API domains they need
Remote Access Tools and File Sharing/P2P blocked from servers
Unknown domains blocked from server segments
Alerts go to the security team, not the end user

Remote workforce policy design is covered in remote workforce web filtering. Ready lists of anonymizer domains are on the VPN and proxy domains list.

Legacy VPN versus ZTNA: what changes for category data

Moving customers off a full-tunnel VPN changes where internet traffic flows. Category data has to follow the traffic to the places that now make decisions.

Topic	Full-tunnel VPN	ZTNA with an agent	Effect on category data
Where internet traffic goes	Back to the head office, then out through the office gateway	Direct or through a cloud gateway, chosen per destination	The agent needs categories to choose the route
Who sees browsing	The on-premise gateway sees everything	The agent and cloud gateway share the view	Both need the same data version
Access to internal apps	Network-wide once connected	Per app, checked continuously	Category events can feed access decisions
Bandwidth	Video and updates fill the tunnel	Heavy, low-risk traffic goes direct	Streaming and conferencing labels drive steering
Bypass risk	Users disconnect the VPN	Users try personal proxies or anonymizers	The anonymizer category becomes a core control

Mistakes to avoid in ZTNA integrations

These issues come up after launch and are hard to fix once customers depend on the behaviour. Design them out early.

Stale agent lists

Agents that miss updates for weeks fall behind on new risky domains. Report list age in the console and flag devices that are out of date.

Hidden trust changes

If access drops without a reason, users call the help desk. Show which category event changed trust and when it expires.

Over-weighting one event

A single click on a parked page should not lock someone out of payroll. Weight events by severity and let them decay over time.

Decrypting privacy categories

Inspecting banking and medical sites can break local privacy rules. Ship a default bypass for these and make it visible.

Ignoring host labels

Large platforms host many kinds of content on different hosts. Look up the full host before the registered domain.

Unknown means allowed

A brand-new domain with no label is a higher risk than average. Route unknown destinations through inspection by default.

Build steps for a ZTNA engineering team

A typical integration takes these steps. The first four give customers value quickly, the rest add depth.

Load the file into your cloud

Import the database into a key-value store keyed by host and registered domain. Index both for fast parent lookups.

Build the agent list

Pick the categories and the domain count that fit your agent's memory budget. Sign the list so the agent can verify it.

Ship steering defaults

Provide the direct, inspect and block groups above as a starting profile. Admins can edit it per group.

Log category events

Send compact events with domain, labels and action to the console. This powers reports and trust scoring.

Feed the policy engine

Turn recent high-risk events into a trust input with clear, editable weights. Show admins why trust changed.

Apply daily deltas

Update the cloud store and regenerate agent lists each day. Alert if a delta is late.

Privacy and licensing questions to settle early

Enterprise buyers will ask how browsing data is handled. Licensing should match every place categories appear in your product.

Local first

With the licensed database, lookups run on the agent or in your cloud. Browsing data does not need to leave your platform.

Domain only

If the API is used for misses, send only the domain. Paths and query strings can contain personal data.

Short retention

Keep raw category events only as long as trust scoring and investigations need them. Keep aggregates for reports.

OEM licence

Categories shown in your console or used in your product's decisions need an OEM licence.

Group-wide option

Vendors with ZTNA, gateway and endpoint products can cover them all under one group-wide licence.

No raw resale

The raw data may not be resold or published, for example as a downloadable list in your console.

Starter database tiers from $999; enterprise and OEM licences are quoted per deployment. Our own data handling is described on the data privacy page.

ZTNA category data questions

Why would a ZTNA product need URL category data at all?

ZTNA protects access to private apps, but the same agent sees the device's internet traffic. Categories decide which internet traffic is steered, inspected or bypassed, and they add risk signals about the device to access decisions.

Can category data run on the ZTNA agent itself?

Yes. Many products ship a compact list on the agent, built from the full file, holding security categories and the most visited domains, and ask the cloud service only on a miss.

Which categories matter most for zero trust access?

VPN / Proxy / Anonymizers, Remote Access Tools, Malware / Phishing / Suspicious, File Sharing/P2P, Cloud Storage / File Hosting and AI / LLM Tools carry most rules. Online Banking and Health & Medicine are used for privacy bypass.

How does category data feed a trust score?

Recent visits from a device to high-risk categories, such as phishing or anonymizers, can lower its trust level. The policy engine can then require step-up authentication or limit access to sensitive private apps.

How often should agent lists be updated?

Daily for security categories, because about 300,000 newly registered domains are categorized every day and shipped as delta files. Content categories change slowly and can follow the monthly refresh.

Does this replace a secure web gateway?

No. ZTNA and gateways solve different problems, and many platforms run both on one agent, so category data lets the two share the same view of the internet.

Do user URLs leave the customer's environment?

Not with the licensed database, which runs inside your own systems or on the agent. If you use the lookup API for misses, send only the domain, never paths or query strings.

What licence fits a ZTNA vendor?

An OEM licence, since the data drives decisions inside the product you sell. Group-wide licences cover companies with several products, and resale or publication of the raw data is never allowed.

Give your ZTNA agent a view of the internet

Tell us about your agent footprint, memory budget and cloud regions. We will suggest how to split files, lists and API use, and the OEM licence that fits.

Talk to us OEM licensing