Welcome to the Reboot Chronicles, connecting you to the world's top leaders and CEOs rebooting their organizations and themselves with revealing stories to help you prosper in unprecedented times. I'm your host, Dean DeBias, and as a serial CEO who's led dozens of companies that created thousands of jobs and billions in revenue, my passion is uncovering powerful lessons that can inspire you to reboot your organization, your career, and your life. Listen and subscribe wherever you get podcasts or at rebootchronicles.com.
Cybersecurity impacts all of us, from our organizations to our personal devices. With millions of attacks and trillions of dollars at risk, even your company is likely to get hacked while listening to this episode. This is why we invited Jay Chaudhry to the Reboot Chronicles, and I also love his humble entrepreneurial spirit. Jay is the Chairman and CEO of Zscaler, which he started on a card table in 2007, looking to reboot old models. They built a cloud-based brand that now has 7,500 employees and is approaching $3 billion in annual revenue, used by the world's top corporations. Their Zero Trust Exchange is the largest inline cloud services platform, distributed across 150 data centers. Every day, it prevents 9 billion incidents and policy violations with 500 trillion AI/ML signals, and the list goes on. And oh, they also drive 500 billion transactions every day—that's 20 times Google. Last time I checked. Jay, it's good to see you.
Dean, thank you for having me.
It's always great to have a few entrepreneurs on the program that have turned their companies into multi-billion dollar organizations and haven't lost their spirit, because you've been on a long, long journey and in probably one of the toughest or at least most fluid spaces. We've had cybersecurity people on, everything from Chief of Staff of the DoD to the CEO of CrowdStrike, and one common theme there is that they've all been working on and attacking cyber threats for decades, it seems like. But it just, to me, it seems like it's just never-ending. What is the state of the, I'll call it an industry right now, but let's just say the state of the threat?
So, more and more business is happening online. We're all getting interconnected, and as more and more commerce and business happens online, bad guys want a piece of the action without working hard. So it's natural that threats are going up and up. Now, that's only one part of it—that's a ransom type of, they want to make money. There's a second side: the nation states who also want to steal your intellectual property to get ahead, or they want to get into your infrastructure, they want to get into your critical infrastructure and the like. So in case of war, they got you. So these are some of the drivers that are driving the threat landscape, and it doesn't seem like it's ever going to slow down.
No, from a capitalist point of view, it's a great business to be in, I assume. You mentioned the nation states, so most people always mention China, Iran, Russia, North Korea, but it's not just them. I mean, governments, they've always had different types of surveillance, now it's cyber. I mean, that business alone must be massive.
From an arms dealer point of view, it is. Sometimes it doesn't get talked about. There are also things that go on among friendly countries too, and they don't get talked about either.
So when you look at Zscaler, what's your approach? Why is it different? What's the state of this, your combat right now, and how you've scaled it up?
Right. So before the internet took off, there used to be physical security or security inside your data center, and generally those data centers had IBM mainframes. As the internet evolved, the internet is a wild west out there, and with that, some of these attackers started to come from the internet and attack your website and all that kind of stuff. So at the time, this was in early to mid-90s, internet security was born, and that security was inside my data center, my castle. Everything is good inside, everything is bad outside. So a firewall was invented as a moat around the castle of your data center. And in the last 30 years, nothing has changed fundamentally. They have been incrementally refined. The core security paradigm is still based on firewalls, and the identities and all that come around it. Firewalls are a piece, and the network which is part of it. What happened starting in the early 90s is we invented this TCP/IP network, so you could extend your data center to every branch office. It's like extending your main castle to many, many mini castles with a tunnel that connects everything. The problem is the moat is gone. Once you get inside the castle, you go everywhere, and the moat is useless. It's like trying to really defend your country when the air force is out here, cannons are out here, moat doesn't do anything. And all the security we have seen in the past 30 years is on this old moat-based, firewall-based, VPN technology. When I started Zscaler in 2007, and that's early thinking, most of the work really got done in 2008. Sure, I'm a lucky product of the American dream. I had fortunately done four companies, four startups, and luckily I had failed to raise VC funding in the first startup, and that's where I was forced to use my life savings, where my wife supported me. So we went on and we built these companies. Now I wanted to do something big, something lasting, and say, what's a big challenge I can take? And we said, let's look at cyber in a different light. Let's not keep on building these firewalls when the moat, when the castle has become empty, and even users have gone to greener pastures. So we reimagined security, we reimagined the network, and the reimagination was: you shouldn't build your corporate network, internet should be your network, just like highway systems. And where are you going to put firewalls and VPNs in this mobile and cloud-centric world? Let's not go with firewalls. So Zscaler fundamentally built what we call Zero Trust Exchange. It's, in layman's terms, technology is like a switchboard, literally like a phone switchboard of old days. You come to us, we say, who are you, where are you going, and if you're allowed, we connect to John and John only. So we connect a user to the right application or right service after checking X number of things. Everyone is untrusted, no one is inside the moat, everyone's outside. This is the zero trust model that needs to be embraced by more and more companies to fight off these bad guys.
Yeah, it's a zero trust model. I liked your flip of that word also. You're doing like service to the edge, you know, SSE. Most people, they don't want to know what all this means, but essentially, companies like yours are trying to basically not just regulate but to authorize access to the web, all the different devices out there, applications you're using, and you don't realize it. Holding up a phone here, it's like every time you do that on your business phone or even your personal phone for business, what you are going through. And so you basically said we need to be able to authenticate anybody, anywhere, anytime, not just peer-to-peer but everything.
Yes. Hence the trillions of pings on your network. So what we do is take your typical employee sitting in a corporation. That employee needs to access Salesforce, Office 365, let's check LinkedIn, how about a little news on BBC or whatever. So we are like an international airport. You come in, we check your boarding pass, your passport, your visa, and luggage to make sure the right person gets on the right plane to the right destination with safe luggage. Now what's the luggage in this case? It's attachments you send back and forth. Those attachments could have bad stuff in it, similar to luggage. So we are inspecting things to make sure fundamentally nothing bad comes and infects you, and nothing good leaks out. Think of it: every bad thing comes from the internet, every good thing leaks to the internet. That's what we are doing to keep you safe at a simple level.
I love your analogies. And by the way, those listening, he has an excellent video that explains this. It's not your typical corporate video where the CEO can actually walk you through it, and the visuals help. But it's funny, your first analogy was about the castles and the moat, and some of the first hackers, they called them Trojan horses. The Trojan gets in, it could be from an email that I didn't... but I like the travel analogy too. The luggage or baggage that you bring to the table might not be as supportive to the corporate entity. A couple of things going on: so the proliferation of data centers, you got the hyperscalers, the big dogs, you know, Microsoft, Google, AWS, Oracle trying to squeeze in, and then you have this whole other tier that is trying to provide not so much just cloud-based but AI and high-performance computing. What has that done to your business?
So our business says the more applications you have, the more people need to access those applications, the better it is for our business because we are the switchboard who talks to who. The proliferation of data centers is natural because so much data is being generated, so many applications are being written. Every company has become a software company in some ways right now. Hyperscalers build their own thing, but there are so many other companies looking for data centers. I don't think enterprises will have their own data centers down the road. You know, the way I think of this computing business is everything starts as a cottage industry, and over time it moves to professionally managed service. When I started Zscaler, I was thinking of power generators we used to have years and years ago in our home. We loved them because they were much better than anything before them. And then power utilities came, you could plug into the wall socket, get power you need. It's a power utility service. Why shouldn't computing be a utility? These hyperscalers are giving you compute as a service, and Zscaler will give you security as a utility service. And the data center companies you're talking about are basically saying, enterprises, build your own data center, I can give you space, I can give you power, ping, and pipe. And that's a natural thing. And as AI is happening more and more, more computers are needed, and it's a good market.
Yeah, the supply and demand on the data centers is crazy because it's like they cannot build fast enough. And as you just pointed out, electricity is probably the next third rail, to use a good pun. But AI and the impact of it is doing a couple of things: it's making it more complicated and more expensive, and you need more space and hardware and cooling and all that stuff. But is AI impacting security in both a good way and a bad way? So we've talked about the bad ways on the show before. How's AI impacting it in a good way? In other words, companies like Zscaler being able to do things better on the security side?
I like to say AI is wonderful and AI is dangerous. Okay, I'll give you one simple... there's a war metaphor in here somewhere, you're going to go to the next war metaphor: we need to fight AI with AI. Okay, there. And let me explain a little bit how. Before, you were to launch an attack on a corporation, and you had to collect information with all the firewalls, VPNs, and applications, it could take weeks and weeks. Now you can ask a simple question to ChatGPT, say, give me all the firewalls and VPNs and application portals that have vulnerabilities, and give it to me in a nice table format with a risk number associated with it. You can get it. Wow. Or you want to say, I want to send a phishing email that's using the kind of language my CFO writes, please create one. Much easier. Now, how does AI help companies like Zscaler to do better protection? You know, there are two aspects of AI. One is what I call traditional AI, or maybe call it predictive AI. You're looking at lots of data, machine learning, it can actually predict likely events. It's a statistical model that has been used for several years by Zscaler to detect zero-day attacks and many, many other things. What's recent is generative AI that consumers can relate to. Predictive is very hard for an average person. Generative AI, when it can produce music for you, it can write stories for you, it can do all kinds of stuff out there, so everyone is very excited about it. And for the business world, it offers lots of opportunities as well. Let me give you an example of how Zscaler uses AI. We got these 500 billion transaction logs every day. These logs are communication: who is talking to who, what kind of IP to destination, good, bad, malware, botnets, phishing, all that kind of stuff. Now using AI/ML, especially machine learning, we were able to comb through all of that to find a needle in a haystack: what's bad, malicious transactions hidden among all of these things. And by then we further analyze it, and we create a risk score of a company based on all these transactions. Say this company's risk score on a scale of 1 to 100 is 70, and another company's is 80. So we can create actual scores, just like you have credit scores for consumers. We can compare it against the peers, we can see the trend and the like, which is very powerful because every CISO, every CEO wants to understand the holistic risk rather than all these geeky security terms like phishing attacks and all that stuff. Then GenAI can read all of that stuff and can create a beautiful report that can be committed to the SEC. SEC wants the disclosure of your risks and all that stuff. So this is a great example: we are using GenAI and traditional AI in many, many things. We are using it to figure out performance issues you may have. We have over 50 million users who go to a cloud every day. Now you're sitting at home, once in a while you feel like, huh, things are slow. Where are they slow? Is it your laptop, is it your Wi-Fi, is it the internet, or is that application? Zscaler collects all that telemetry for every user, and we can pinpoint the problem. And AI plays a very big role for us to figure that out.
You know, you mentioned governance there, and you and I both are on a lot of boards. I wrote an article on AI agents in Forbes a few weeks ago, and it caused a bit of a storm. I've never had more pings about what does this mean to us. And what advice would you give to corporate boards right now in the next, the second half of this decade? You know, what should they be doing? Because right now, they're very high level in terms of cybersecurity or cyber risk, understanding the risk as it relates to AI and cybersecurity.
Yeah, look, till about five years ago, six years ago, CISOs would often complain to me that they aren't getting enough attention. And that's true, they weren't. Okay, not anymore. Not anymore. Now they have too much attention. Now they claim, now they are worried that they have to present at every board meeting. By the way, listeners, CISO: Chief Information Security Officer. So it's a company's top security person. But no, CIOs, boards, and CEOs all actually care about security because there have been so many high-profile attacks out there. A lot of them have committees now. Yeah. Now on top of that, when the SEC starts filing lawsuits against information security officers, and SEC starts saying you will be disclosing some of the risks, cyber risks you have, suddenly it starts getting the attention of the audit committee and the board. You know, we do need better education for board members. I think it's happening. There are some third parties that are doing some of the work. We are spending some time educating board members. The other move I'm seeing out there is, and it's a good move, lots of boards are looking for at least one board member who is fairly educated in the topic of cybersecurity and whatnot. So this awareness is good, and I think companies are making progress in this area. The main message I have for large corporations is the following: don't be sitting behind inertia. Things can... hackers have no inertia. Larger companies have inertia. There's not a lack of technology, there's a lack of adoption. Human beings like to keep on doing what they are doing, what they're comfortable with. We need to change from this traditional firewall and VPN-based security to zero trust architecture, because without the right architecture, no matter how much money you throw on old technologies, it gives you a false sense of security. It's not good. So the boards and CEOs should challenge the teams to say, are you really looking at the latest and greatest technologies, or are you sitting on the same old stuff?
Exactly that. And you know, Marc Benioff wrote a piece in Time Magazine saying similar things, and the boards were like, wait a minute. So Zscaler is monitoring our person-to-person communication or person-to-things, but some of these agents are just doing their own thing now. A couple of years out, I'm predicting where they're just doing stuff. Your agent, Jay's agent, my agent are working on stuff. So how do we monitor that? And you're already doing trillions of pings now, you're going to get into quintillions at some point. And so A, how are you going to do it? B, how do you scale it?
