Hello and welcome to the India Today Business Today studio here at the World Economic Forum in Davos. I'm Sidharth Zarabi and with me one of the most successful Indian-origin founders in the United States of a company that's very well known in the security space, Jay Chaudhry, founder, CEO, and chairman of Zscaler. Thank you very much for your time with us today. It's always a pleasure to have you here. We keep talking at Davos. I look forward to having more conversations, but the age of AI is fully and well upon us. Yes, productivity benefits, ROI, a separate matter, but on your core area of specialization, how is the world of AI and cyber threats, cybersecurity converging, and what are the learnings that you can share with us?
So AI is powerful, but AI is dangerous. So it's being used for good things, and bad guys are using it. In fact, bad guys are today moving faster than the good guys. So the risk is there. But companies like Zscaler are also using AI to make sure we can do better protection. I'll give you one example. What's the risk of AI today? You can ask ChatGPT and say, 'Tell me all the firewalls deployed in this company that have security vulnerabilities and give it to me in a nice tabular format and sorted by the risk.' You can get it in 30 seconds. It used to take weeks and weeks to find it.
So it makes it so much easier. Now we can also use AI to figure out some of the hidden threats. Like many times you have to find a bad guy communicating, doing reconnaissance, and the data sits in those logs and telemetry. AI can help us find those things too. So companies are stepping up, and there'll be more risks, just like any new technology that comes in. You can do good with it, you can do bad with it.
So what you're essentially saying is that it can accelerate defense, but it can also accelerate the attackers. It's doing both. Hackers are using automation of AI. So they can set up an automation. These agents are smart. One agent goes and does discovery. Second agent does the second thing, third, fourth, all automated fashion. Therefore, is there a framework of regulation or oversight that is required that can, you know, keep control and a lid over the negative aspects while letting the positive aspects of this technology proliferate?
The issue of regulation for security or new technologies often comes, and that regulation leads to compliance. In my world, in my view, compliance is not security. By the time we get to compliance and regulations, the market has moved on. The threat actors have moved on. There is a need for regulations and compliance, but if governments overdo it, they stifle progress. So yes, pursue it, but be conservative.
If you had to pick one control that corporations should implement to blunt any AI-amplified attacks, what would that be?
That's a very good question because in security there's a long list of things to do. There's not enough budget. There's not enough time. The fundamental problem with cybersecurity today, even before AI, is the way security has been done for the last 30-plus years. The framework, the model of security was what we call castle-and-moat. Inside my data center, inside my company, here's my secure network, my trusted network, and there's a firewall sitting facing the internet as a remote. That model was pretty useful early on when your application sat in the data center and you had a few offices. Now applications are everywhere. Users are everywhere. So the device handles everything on the network. So they connect everything to everything, almost like a highway system. But once I get on Highway 18, San Francisco, I can reach New York, Miami, Dallas without hitting a single light. Now bad guys can do the same thing. So similarly with this traditional network security model, the hackers compromise your laptop, your laptop on the network, the malware spreads everywhere. Now AI makes it even worse. So the best security for that is what we call zero trust security. In that model, you don't trust anyone. There's no trusted network. The user is not trusted. They're even in the office, they're on a guest network. So in the zero trust architecture, we are like an exchange, a switchboard. User comes to us, and we check who you are, what you're allowed to access, and we'll connect you to application A or B or C. The lateral movement goes away. This is the foundation for AI and everything else. Think of today's problem is user, the weakest link. Tomorrow's biggest security will be AI agents. Every company will have thousands of agents in use. Imagine the AI agents get hijacked or compromised. So that's the kind of solutions Zscaler now is working on.
Many companies, and you know, even as a user and as part of a corporate group and also as a journalist, I observe the advent of ChatGPT-style apps and lots of agents, tools, all of this. And I wonder if the evolving security scenario—you kind of touched upon it—but my question really is, how should corporations approach it? Should they sort of implement first the control on the apps that reside on devices, particularly personal devices that their employees use and somehow end up using within the network, or should it be complemented by enforcing, like you said, a zero trust but also controls on devices?
So personal versus business becomes an interesting challenge. This is my personal phone. It has my personal application. It has business applications, personal applications, your transaction applications, your online payments, your banking, your ID, all of it. But when I go through my business stuff, it goes through Zscaler as a checkpoint. We are looking and figuring out what's good and what's bad. But for private, many people don't want it to go through any special scrutiny. So you can actually mix the two together. Now, our focus is really on the business and business users. Consumer is a little different approach, but I want to make sure our enterprise customers, their employees are safe. They're not getting phished and they don't divulge company intellectual property and the like to bad guys out there.
The bad guys are always ahead of the good guys. For a company like yours where your entire sort of focus is on preventing the bad guys from having any amount of success, how does it kind of work for you? How do you keep ahead of them? How do you keep doing breakthrough security technology development?
So bad guys are not ahead of companies like us. We have the latest and greatest protection. The challenge is that larger the company, the more inertia they have. Even government sector even has more inertia. So technology is available. They take time to implement it. And hackers have no inertia. That's the difference. So our job is partly to evangelize and show the business then they need to move at a faster pace to embrace security. In fact, in this world everything is picking up pace. Everyone needs to be able to move at a little faster pace.
