Welcome to Zscaler Board and Zscaler from Zscaler Reach out to them here at the Zenith Live 2026 at Zscaler's flagship user conference. I'm with Jay Chaudhry, CEO and founder of Zscaler. Jay, how are you doing?
Thank you for joining us.
Yeah, I know it's a great I love coming to this event. It's always been about security transformation. Obviously with AI coming, we're going to talk more about that.
Before we get into that, Jay, I wanted to touch on some of the themes that you had in your keynote. In fact, you started off reminiscing about 2007 and when you were working on a kitchen table, I think. When you look at the crowd that you have here today, did you ever think that what you were thinking about doing, 20 years later would turn into this?
I have big dreams. But the big dream was we want to build this company to a billion dollar in ARR.
We already crossed $3.5 billion and on a journey to $10 billion. So, I thought I thought big, but this is bigger than what I thought.
Yeah, now I think you've got a great sales team here, led by Mike Rich, but I think your biggest salesperson is that Zscaler customer that's an evangelist. In fact, you brought up some interesting stats. I want to make sure I get these right. 285 CIOs or CISOs took them with them to a second company, 84 to a third, 45 to a fourth. Why do you think these modern security professionals have become such almost militant evangelists for zero trust and for Zscaler?
Because they are tired of dealing with legacy technology. Every technology has its good days and over time we expanded, bolted on things, and then they become cumbersome. Today's network has become cumbersome. Security is very cumbersome. When we bring a simple zero trust architecture and the customer says, 'What? It works better. It's cheaper. I need to go forward with it.' The CIO of G, Chris Gould, he then moved from G to DXC. He presented at Zscaler Live about 3 or 4 years ago. He said, 'It's rare that you get better security, better user experience, and lower cost, all three things at the same time.' And with Zscaler, that's what customers get. So, that's why they are big fans of us. Plus, we care about our customers. Customer obsession is one of our key values and it starts with me. And we also know that we are a mission-critical service. It better work all the time. So, it's a very good relationship.
Yeah, in fact, I talked to one of your customers yesterday that is one of the people that brought it with him to a different company. I said, and I didn't know at the time I asked him. I said, 'So, what drew you to Zscaler?' And he says, 'Oh, I used them at a previous company. Knew how easily they worked.' And you're right. I think it is rare you see that combination. But I think it's necessary today. When you look at just the overall complexity that IT exists today, securing it is like an order of magnitude more complicated.
Than the environment that it runs on, Rex.
Now, one of the things you talked about in your keynote when you started off talking about AI was the shift from human workers to AI workers. And I think some of the quotes you said was they don't take coffee breaks. They don't take time off. They're going to spawn more agents. And so, when you talk to customers, I know you use this event to talk to a lot of customers. Where are their heads right now? What are the things that scare them when they think about agents brawl and shadow AI and a lot of the trends that we're seeing today?
So, every CIO CISO is under pressure to embrace AI at a faster pace. Because most CEOs I talk to, they feel that they're left behind. They need to move faster to embrace AI for business productivity, agility, and better bottom line. But, they are all scared of security. Agents going rogue, agents getting hijacked. That's the problem. So, majority of the conversation I have with my customers, while they want to look for AI visibility and understanding, they want to have our zero trust exchange solution in place so they can start rolling out these agents. And I tell them, 'Don't try to go with AI across everything. Select a few use cases, learn from it, and roll them out, show success, and then expand from there.' And we're working with our customers. We're taking the use cases, built in our product for our agentic exchange to make sure that works. And it's a good start. This technology will evolve and change. We're going to move at a faster pace. And I think one message I have for our IT leaders is, 'We need to step up and go faster because hackers have no inertia. Larger the company, there's more coordination, more these things, sometimes too many processes. Think about making sure we keep up with the pace at which technology is moving.'
Yeah, well, that's a pretty tall ask to keep up with that. Now, I think when I talk to companies about their AI initiatives, they run into what I think was the authorization problem where one of the things that you know about human workers is they're there, you can tell they're logged in, and they stay logged in. Agents can be very ephemeral. You assign them to do a certain task and just because it's associated with J, doesn't mean that specific agent should have the same credentials you do. Right? And so, I think there's a lot of parallels from what you've done with cloud and mobile agents. But talk about how your new architecture allows companies to control what the agents do through least privileged access, but also make sure that the intent of what they're supposed to do is still be met.
So, first of all, the core architecture to make sure the right agents can reach the right application or talk to the right agents is the same zero trust architecture. We are the exchange. Now, the question is what all do you do in the exchange? Agents are somewhat like people. We call them digital workers. But agents are code. So, they'll have workloads. We've already done zero trust for users and workloads. So, we had a good starting point. Identity needs to be checked at the starting point. That's only the starting point. Authorization level, what skills, what tools should they be able to access, intent, we need to look at the prompt inspection all this. So, that's the kind of stuff we built. I kind of said that about 70% of what we needed in the exchange for agents was already there. 30% is being added. And your point about what authorization should an agent have? So, what we are learning from our customers is an agent should have no more authorizations than the user on behalf of whom that agent is starting. But many times less. If there are four agents for a user, this agent may only have these authorizations, this may have only this, this may only this. That's really what we are building as a part of the policy. So, you can actually get that but no more than that. In fact, if an agent is spawning another agent, the authorizations and access and permission shouldn't be any more than what the parent is. The notion of passing the policy and authorizations and privileges is an important part of the design of what we have built.
Yeah, and a follow-on to that is one of the comments you made and I actually thought it was something people should think about: if your agents can't talk to your data, they're just demos. I think you probably remember saying it. Yes. But, if they do talk to data, now your attack surface goes from this big to it explodes, right? And so, how are you ensuring that agents can safely interact with that data without introducing a massive risk of data loss because that's what's holding people back.
This is a big new problem. Before, you went through an application. Application has certain controls. If I go to Salesforce today through Salesforce, it basically has controls that I can access certain fields, certain type of records based on geo and areas and whatnot. Now, imagine AI bypasses all that application. Now, you can directly reach the data and get information. It's a big challenge. So, that's where we actually can play an important role. This area is not fully solved. What kind of data comes in, all the controls are sitting in the applications. What should they access? So, this is where our access graph technology comes in. Access graph being able to say identities to data sources, what, when, where, how, that access graph will play a very important role. That access graph first tells you what's happening, then you can use it to enforce policy. That becomes an important part. And then also I learned from one CIO recently, he said I need to do SOC certification. With Salesforce, when I went to applications, I could tell them that these controls are in place. How do I prove the controls in place when I'm going directly to the data? And we believe this access graph kind of technology will play an important role there as well.
Yeah, the access graph was part of the innovation payload here, and I think correct me if I'm wrong, this might be the biggest innovation payload you've had at a Zenith, right, to date. And one of the things I found really interesting about the AI access graph is it connects a lot of the disconnected endpoints to the cloud resources and things. And one of the things you talk about a lot is container blast radius, because then if you are breached, you minimize it. So dive deep in the access graph. Talk about how it does that.
So, first of all, if only certain things are able to talk to certain things by policy by going through our zero trust exchange, we reduce the blast radius. The problem is knowing who should have access to what. In the case of human beings, it's hard but not that hard. Because marketing department may have access to these 10 applications here, five in my data center, and so on and so forth. But in the gigantic world, these numbers will grow, traffic will grow all the time. Nobody really knows what should access what. So you start with understanding who is talking to who. So our access graph technology gets metadata and actually logs from various application resource sources and brings it and it runs through an AI ML engine. That's where it gives the view of this group of applications or this group of identities, this group of agents are reaching those sources and whatnot. So, the business can decide whether that stuff should be allowed or should not be allowed. So, this converts into policy that we enforce through our exchange.
Yeah, so it starts with this ability.
So, you can't secure what you can't see.
So, you can see what you have and you can map it into policy and then put it into action.
Exactly. That's exciting. So, the exciting innovation we launched, access graph. But access graph will essentially become a piece of an exchange. So, from my point of view, the most exciting thing that our customers are asking for is an exchange for agents.
Yeah, now another announcement was the expanded partnership with OpenAI that you've been working with OpenAI for a long time. Yes. The integration with Codex with project Guardian.
