The OSFirewall is useful in preventing rootkits and other spyware. 'Operating System Firewall' (OSFirewall) monitors programs and generates alerts when they perform suspicious behaviors. This monitors internet traffic and generates alerts for disallowed access. In the processes list its Image Name is 'vsmon.exe'. 'True Vector Internet Monitor', also known as 'TrueVector Security Engine', is a Windows service that is the core of ZoneAlarm. before the first use) or ZoneAlarm will ask the user to grant permissions on the first access attempt. The user can grant permissions (trusted zone client, trusted zone server, Internet zone client, Internet zone server) to programs before they attempt to access the Internet (e.g. The 'Internet zone' includes everything without the trusted zone. The 'trusted zone' which generally includes the user's local area network can share resources such as files and printers.

In ZoneAlarm, program access is controlled by way of 'zones', into which all network connections are divided.