All right, welcome to the drill down. We've got the business story behind stocks and the move. I'm Corey Johnson, chief market strategist for Apiste Capital Research. And just ahead, a $3 billion cyber security company says AI agents may become the biggest new attack surface in corporate networks. Zscaler's founder and CEO joins us to talk about how security is being built and sold and how that's changing in the world of AI. But first, the drill down is brought to you by ERA. Never miss a critical event or insight ever with ERA. Customize your company watch list. Track key events, mentions, filings, and more. All with an easy to use customizable AI powered interface. That's era AIRA.com.
All right. I'm Cory Johnson. Welcome to the drill down. You explain a business stories about a stock on the move and one stock that's been on the move in the different direction in the last year. Even though the company seems to be going great guns, Zscaler, they sell cloud-based cyber security systems and they argue that the shift to AI agents is reshaping enterprise network design and security budgets and products as well. Jay Chaudhry joins us now as founder, CEO, and chairman of Zscaler. Jay, good to see you. It's been a little while. We've talked about machine learning and artificial intelligence many years ago, but my goodness, where we are right now is a very hard to imagine world.
Indeed, Corey, I appreciate the opportunity. It's great to talk to you. What's happening, I thought the most intriguing thing in your quarter was really this discussion you've been talking about a little while, but this notion that when AI agents are acting like employees, suddenly this new security vector is created. In a world of zero trust, it's a really challenging thing to deal with. Talk to me about how you imagine users on networks and how you guys are designing security to deal with these new realities.
Right. So, let's start with users, employees. Users typically have been the weakest link for security. And once malware gets on the corporate network with an infected machine of a user, it goes everywhere. It can bring everything down. That's why we pioneered zero trust architecture where you don't get on the corporate network. You're always untrusted. Zero trust. You come through our switchboard, our exchange. We check who you are, where you're going, are you allowed to go and make a one-to-one connection to that application, not to the network. That's users.
And that's always been the case with Zscaler.
That's all. Yes. Tomorrow for every user there'll be scores of agents being used by every user. And that's the story of benefit of AI. Now users are dangerous but AI agents will be far more dangerous. They move at a faster speed. The numbers are big. Imagine an agent getting hijacked or hacked on your network. It could cause havoc. So the best security for AI agents to work in your enterprise is to use a zero trust exchange for agents. So the right agent can access right application and right service. And that's not a piece of code you just write. That's a global distributed exchange infrastructure that allows this safe and zero trust communication. We have all the pieces in place. And we are excited about the opportunity to secure our customers.
It's such an interesting problem because I would imagine that an AI agent looks a lot like a threat in ways that an individual user, a human would not.
It is quite dangerous to start with. It's simple code. The challenge is the code can change on the fly. The challenge is identity of the agent. Identity changes on the fly as the code changes. So it is important that in near real time you're able to enforce policies and cut off access if you need to cut off access. There could be unusual behavior of the agent. We sit in traffic path. We can look at unusual behavior and take those actions. That's why we are excited about securing our customers. Every conversation I have with the CIO, here's how it goes. I'm looking at automating many use cases in my company because I need to really get ahead otherwise I'll be left behind. But I'm very scared of these agents doing bad things out there. And then on the consumer front, every AI agent is launched every other week. A couple of days ago, Perplex launched computer because Claude had launched a few of them before. And then we have Open Claw. So many of these things are coming. They are consumer AI agents. So our customers are asking, can we keep them off my network? So there's an opportunity for us to identify unsanctioned or unauthorized agents to make sure they don't really cause any harm or leak data out there. Then there'll be enterprise agents coming from say ServiceNow or Microsoft or customer built them for a given application, right access for those. I was at Oracle CloudWorld a few months ago now, but they were talking about just the explosion that they've seen in customers creating new agents or the framework for new agents for all of their customers to use.
Absolutely. So customers are building applications and that really use agents. So somebody has to worry about making sure these agents created on a platform from Google or Microsoft or Snowflake.
We become the Switzerland, the exchange to make sure right party talk to right party. That's the opportunity for us.
Is it as simple as thinking that you've got kind of an exponential opportunity and the number of users has just gone way up because the number of agents are sort of effectively look like more users of Zscaler software?
The numbers will be large but it won't be number of agent-based opportunity. It'll be linked to the agentic traffic flow. Some agents will come and go, others will be living for a longer time. So in the AI world, everything is priced based on a number of tokens used. Tokens are a proxy for traffic flow and request and that's what this gets priced.
It's just so interesting. It's such a different sort of construct of thinking about how networks work. I guess this is what you do. Zero trust itself is a different construct. We used to have firewalls, we used to have moats and then we have zero trust and it's such a fascinating way to deal with things. Why not have yet another paradigm?
Yes, actually it's a simple extension. When I started Zscaler, I started with zero trust of users. Then we extended for zero trust for workloads, cloud workloads. They don't need to sit on the same network secured by firewalls from source IP to destination IP. We have simple construct. Workload A can only talk to workload B going through our exchange. Then we took it to branches. Today branches are connected with a meshed network with SD-WAN or MPLS. A single infected machine in one branch, the malware traverses laterally and can bring everything down. In the world of Zscaler, every branch comes through our exchange. We validate and only certain devices can talk to certain devices. So for us, it's a natural extension to extend our exchange to AI agents.
I guess it does make a little more sense there in that terms. It is actually kind of fitting into the construct that you've already created.
Absolutely. And this construct is not easy to build having this global infrastructure. And what makes it interesting and hard to do is the policies that are created for users, they were very tricky. A user may be in San Jose today, in Tokyo tomorrow, and Mumbai day after tomorrow. I need to make sure the policy of the user shows up in whatever data center that policy is being processed on because that's where the user is going through. Agents have the same kind of need. I need to be able to handle that which is already in place. Then as you execute that stuff, logs need to be created. Where will logs go? Which logs sit? What country should log it? All that stuff is already done by Zscaler to make sure the sovereign data concept is honored.
Let me ask you about Red Canary and what you acquired there and how that integration is going.
Red Canary was acquired so we can actually use some of the agentic technology they have to build our SecOps solution. We're building with over 500 billion transactions a day that we process, lots and lots of telemetry and data to do security operations without having to move those logs to a different provider costing extra money. And since Red Canary has been doing MDR service which is managed SecOps service, they had lots of playbooks and we took the playbooks, creates agent tasks around it. So lots of good experience and we're bringing that technology in the solution. We're getting ready for agentic SecOps. That integration is going very well for us.
