It's wonderful to see all of you at our largest annual conference. I was reflecting on the journey of Zscaler. It was fall of 2007. I'm a lucky product of the American dream. I have founded, funded, ran and sold four startups and I wanted to do something different. I wanted to do something big. So I was wondering what the next phase should be. The first company I did in late '96, early '97 was a company called Secure IT, which deployed firewalls, VPNs and the like. And as time goes on, I learned that companies spent more and more money on these devices, whether firewalls or VPNs or other devices, but the number of breaches was going up. Something wasn't working. So thinking about building something big was the main thing we were doing and thinking about. A lot had changed. We're no longer sitting in the data center with servers and a few offices. The world had become mobile. SaaS applications are taking off. AWS had just announced compute as a service, storage as a service. Apple had just launched iPhone. In this distributed world, we want to do something different. So with that conviction, I decided to fund this company called Zscaler. This is the earliest picture of Zscaler. Actually before Zscaler was formed, for about three months I was flying from Atlanta to Silicon Valley where a number of core engineers including Kalash, the chief architect, were sitting at his dining table debating every weekend what the architecture would look like because the old school firewall-based architecture didn't seem to make sense. And this is essentially the early thinking and the ideas we had, with the goal: applications are everywhere, users are everywhere. We need to turn security on its head. Let's not build the firewall. Let's not do network security. What is there to secure in a network? Packets are flowing, they're encrypted. We need to secure data. What if we start with something like a switchboard where you connect party A to party B, you're not on the network? Life gets simple. It was a very different way of looking at things and it seemed like, how do you get people on board to work with us on this idea? One person who actually stood up very early behind it was Larry Vagini, who was global CTO of GE and global CISO of GE. He was a thought leader who drove transformation. You know, early on I thought that large companies won't work with us because we're too small. But Larry built conviction and he not only deployed Zscaler across this entire company of 350,000 people, when he retired, he joined Zscaler so he could evangelize and talk about the same kind of stuff that other customers could be doing. That's really conviction. Those are the type of convictions that drive us, that they make us more agile, more competitive out there. But what we learned over the past years is inertia is very powerful. We are all comfortable doing what we have been doing for a long time because we know about the stuff, but change is needed. Then we need to shake off inertia. Technology incrementally changes all the time, but every decade or two decades it goes through a step function change. For example, we went from the analog world to the digital world. We went from on-prem software to the SaaS world. We went from data center-based computing to cloud computing. Network and security needed to go through the same kind of change. Before Zscaler, network still had been the same network. It could be faster, it could be wireless, but same thing. Security has been the same castle-and-moat model. And a lot of you actually build conviction. In fact, 285 of you bought Zscaler service at two companies, 84 of you at three companies, and 45 of you at four companies. Think of it. This is conviction. This is really believing in something. And that only happens if we work well together. Our customers, our partners are focused on delivering business outcomes rather than selling technology and moving off. That's really what we have tried to do at Zscaler with customer obsession as one of our key values, and that obsession starts with me. And it's not just our customers, our partners have worked together. I also want to do a special thank you to our valued sponsors who really made this event possible. Let's give a big hand. Now, when I sat at the dining table in 2007, the world was changing with mobility and cloud. But now, we're seeing another big change that's going through. And this change is about AI. In fact, this change seems bigger than any of the changes we've seen in our lives. AI adoption started with Gen AI, but Agentic AI has come on the scene pretty rapidly. This technology is being used in engineering to build code faster, customer support to make sure we can solve our customers' problems more accurately at a faster pace, and in many areas of operations. The big thing that's worrying IT leaders, worrying security leaders, is cyber protection as well as resilience of these agents we are creating. There have been so many instances where Microsoft Copilot exfiltrated data without a user action; an agent did it. We've seen prompt poisoning, credential theft, and there were other cases where databases got deleted, email boxes got deleted, and the like. And it's not the user who is doing it. Each of these agents, they operate independently. They can make decisions, they can take actions. And that's creating some interesting and exciting opportunities, but that's also creating some challenges. Challenges are coming because the AI revolution is different. It's very different. In the internet wave, we had human beings able to access websites. In the cloud wave, we could have people build applications on the cloud and access them. In every prior wave, we were securing humans using new tools. But this time, the tools are the workforce. Think of it. These tools are the workforce because these tools can work on their own. They really don't need a lot of human guidance. And yesterday, a user was the weakest link. Today, these agents are becoming the weakest link. In fact, they are far more dangerous than human beings because they move at machine speed. They need no coffee breaks, no weekends, no time to sleep, and a number keeps them going at a rapid pace. Our focus is to figure out how to use these technologies in a safe fashion. And the technologies we built for security in the past, it used to be firewall, perimeter-based. We built a perimeter, we built a moat around whatever systems we had, and that technology worked reasonably well for data centers because you had a small number of data centers. You built them up. As cloud came, firewalls struggled. Where are you going to keep putting these firewalls in this mobile and cloud world? That's when Zscaler was started. That's why Zscaler was started. But in the agentic world, it totally breaks. That's why, to get ready to embrace AI, we need to really look at this security very, very differently. We need to move from a notion where we said 'my perimeter, my firewall' to the new AI now. And this is where zero trust will play a bigger and bigger role, because in this new world you won't be able to put these boxes. It'll be identity, policy, inline inspection, whether it's users, whether it's agents, no matter where the application sits. That's really the world we're working on securing. And this world of AI will really be secured with that zero trust foundation so that we can make AI safe at scale, working with foundation model companies such as OpenAI and Anthropic. OpenAI has a daybreak program for their newer models. Anthropic has a program called Project Glass. We're part of both the programs where we're learning to use these models and actually integrate these models in our SDLC, our software development life cycle, to make sure we make our infrastructure safe. And that's why we integrated them. But these models alone are not the answer. These models are great. They'll help us identify issues. They'll help us fix those issues. But fixing a bug alone is not the same as securing the enterprise. A bug could be fixed, but there's still lateral movement out there. How do you make sure something getting infected somewhere could be handled safely? The big problem we see in this whole area is lateral movement. If you are reachable, you're breachable. Zscaler was built for the moment with zero trust architecture. There's no such thing that you need to be exposed to the internet. There's no such thing that you're on the network, you go left, you go right. Taking care of those two things became very important. While Zscaler was quite important before AI, the role of Zscaler and zero trust becomes even more and more important in the new world of the agentic era. Let me give you an overview of the architecture we built, the conviction we built around Zscaler. The idea we were debating in 2007 was a very simple vision. Rather than building a moat, why don't we simply have a policy engine that says entity A can talk to entity B based on rules? No IP addresses needed. No need to deal with any of this stuff. And if you deal with that type of notion, if you think of communication like this, then you can go on any network. You don't need private networks. The internet becomes your cyber highway. And if that's the case, then every branch office, every plant, every factory essentially becomes like an island, like an internet cafe. And all these things do not need to be exposed to the internet. Imagine the day where you have no public IP address. That's the powerful thought we had. It took us a while to really build things around it, but the fundamental notion of why and how Zscaler was built is essentially the same. So our goal was to take this complicated network and security picture you see on the left and simplify it. If you look at the network of any company today, it's complex, it's expensive, it's a mesh network. It's powerful. The job of the network is that once you connect to the network, you can move left, you can move right, you can find applications, you connect with them, life is wonderful, but bad guys can do the same thing. That's where a lot of these ransomware attacks are happening. So it's not just cost and complexity. It is cyber. And think of how complicated it gets with agent technology, with all those MCP servers that are springing up in your enterprise, all those agents that are becoming part of your network. Imagine an agent getting compromised or hijacked and it's sitting on your corporate network. That's why the picture we created from zero trust architecture you see on the right: everything simply is an island. A user is an island. A branch is an island. Cloud workloads are islands and an agent is an island. Everything simply connects to the internet. We're an exchange. We're a policy engine that makes sure the right party talks to the right party with the right credentials. Many times I talk to customers, they say, 'You talked about the architecture. I talked to this firewall company. They said they have the same technology. It's essentially the same.' Well, here's a fundamental difference. It's almost like trying to compare a traditional car to an electric car. They may look similar from outside, but there's not much common between them. A firewall is like a bridge. You got your data center with your branch. You got a firewall here. You got a firewall here. You connect the two and once the bridge opens up, the traffic starts flowing. Good things can flow and bad things can flow. Contrast that with zero trust architecture, which is like a switchboard. A switchboard where every connection comes to the switchboard, it gets examined for policy, and then you get connected to a specific application resource, not to the network. That's the fundamental difference. The architecture is very, very simple, and we've used it in many, many different ways. One of the things I'm very proud of is that the North Star we set out from day one is still the same North Star. We have been expanding the functionality in a concentric circle. This platform started with the same common thing where we call zero trust for users. A user could access any application from anywhere on any device on any network. It could be your traditional broadband, Starlink, 5G, 6G. It won't really matter. And once we did that, and most of you have already rolled out zero trust for users, which included internet access, private access and user experience, then we went ahead and built zero trust branch where each branch becomes an island. No lateral movement. The mesh network goes away. Then we took zero trust cloud workloads where workloads could talk to each other in a zero trust fashion. And now we are excited that last week we announced zero trust for AI agents. It's a very exciting, challenging problem to solve, but we're excited that we spent a lot of R&D and resources to solve it, and it'll expand and grow over time. D Shivakumar is going to talk more about it in his next presentation. And by doing zero trust for all these entities, we're essentially doing four things for you: Security of AI infrastructure and application building, that's becoming important, a new area where we've built a very strong solution; data security, comprehensive data security no matter where the data sits; cyber protection from a whole range of threats; and agentic ops. I'll give you a high-level view of these issues, then Adam will give you a deeper view of it in his presentation tomorrow. Think of cloud security, cloud workloads. In the old world before the cloud, we had physical firewalls in the data center for north-south or east-west traffic. Now we are lifting and shifting those firewalls and we have virtual firewalls in the cloud for north-south, east-west. Managing firewalls in the data center is hard enough. Many customers would tell me they have like 10,000 rules out there. These are all IP-based, source IP to destination IP. In the cloud, when things are a lot more ephemeral, they're moving at a much faster pace and AI is going to move faster and faster. Imagine trying to keep track of all these IP address-based rules. In the world of Zscaler with zero trust architecture, you simply can do things like: workloads in VPC A can only talk to workloads in VPC B. Workloads with tag A can only talk to workloads with tag B. Simple, elegant, and your workloads are hidden from the internet. Powerful concept. Think of it. It's literally what you've done for users with ZIA and ZPA for users. Now ZIA for workloads and ZPA for workloads. Powerful, simple, same concept, same back end, fully integrated platform. Think about IoT. Kurt is going to talk about how he is driving segmentation in these factories. But imagine a plant with simple zero trust architecture with no firewalls. The plants are hidden from the internet. They cannot be discovered. No need to deal with VLANs, NATs. A plant is an island, and every IoT device is an island. There's no lateral movement and the like. All these things are possible. We built them on the same architecture. Then extending to the next world of IoT communications. There'll be more and more IoT devices out there. How do you have them communicate with each other? Well, more and more of them are at different places. Imagine being able to take a simple SIM card without having to worry about setting up a VPN, where the IoT device using a SIM card as the transport connects to our back end, our exchange. We make sure that telemetry goes to the right place. There are so many use cases of these types of IoT devices for secure communication. This is the power of the platform. This is what gets me excited: to be able to simplify a lot of complex problems our customers are trying to solve by building network extensions and all these things. In our world, the internet is the network. You need the transport. Transport is extremely important, must be reliable. But you don't need to really secure the network. You don't have to deal with managing route tables and the like every day. Another example of the innovation that we've driven using the same platform, same technology, is B2B supply chain connections. So many CIOs are worried: we're getting compromised because your supply chain partner got compromised and you are connected to the network by site-to-site connection, system to system. It's becoming a bigger problem with the NIST CSF-like model coming out, where more and more security vulnerabilities will be discovered. This will become a bigger issue. Imagine the world where you don't have to connect to your supplier through a site-to-site connection. No VPN needed. Each supplier is untrusted. That kind of zero trust communication, system-to-system, can be achieved with Zscaler. That's where we built B2B exchange. Simplifies life, makes it far more secure out there. So that's really the conviction we built. It's so exciting to be able to drive some of these things in a wonderful fashion. And our customers, a lot of you have done it. I want to bring up a leader who has done it extremely well through many stages of this journey: Kurt, the CIO of AkzoNobel, a global leader in paints and coatings. AkzoNobel runs an internet-only model, no corporate network. That's what driving conviction looks like. Please welcome Kurt to join me on stage.
We have been working together for quite some time. I've seen you start this journey and go through a number of phases. Before we get into it, let's talk about, give us an overview of AkzoNobel, the size and scale of the business.
So, AkzoNobel is a paints and coatings company. So we paint planes, boats, cars. You may know the papaya orange maybe on the McLaren. So we have a variety of things. And of course we also make paint for your home or those types of things. So from a size point of view, we have around 35,000 employees. We operate in 150 countries. We have 126 sites, of which 122 will get the branch connector. So that's in process. From an IT point of view, we're providing technology to support basically all the back ends, but also all the way to the OT environment. So keeping all this safe, different factories, locations, headquarters and the like.
Yes. So let's talk through your journey. You moved in a pretty meaningful fashion. What are some of the phases you went through?
So I think maybe first of all, it's three companies that I deployed Zscaler with, not four yet, so there are some people here that have a few more. But if you look at AkzoNobel, we started back in 2014 with Zscaler Internet Access. A few years ago, we started with ZPA, I think initially for instance with Russia and to secure a few things. In the meantime, we fully deployed that. We're now also since October starting the deployment of the branch connector. We're about halfway there. You just alluded to the SIM card. So rather than replacing Wi-Fi in warehouses because it wasn't good enough for the scanners, we now in several sites also have deployed the SIM. We're also implementing ZPA for secure dial-in into the factories.
Yeah, ZPA is interesting. Before, every company had a separate deployment product to do privileged remote access. Now if you think about what you're trying to do, we're trying to provide access to certain third parties, quite often to very mission-critical maybe PLC systems alike. For us, it's essentially a feature on top of ZPA. ZPA is about secure access, and ZPA says for these applications we're going to have some more checks and balances. Maybe this will involve session recording, time-on-access and the like. It's wonderful to see all these creative things. Now, thank you for your partnership this year. And maybe also one more is the Zscaler Digital Experience.
Digital experience. So we were with the CFO with his team on the manufacturing side, and Teams was really terrible. So we said 'Hey, what is going on?' And then two weeks later, the network team told me internet utilization was 46%, and that was it. That was the time that ZDX became available. I think we were one of the first customers. So really seeing basically what happens to your applications, to your users is of big benefit.
Yeah. I tell you, ZDX was an interesting story about how we built it. I thought a lot of things to be built when we started Zscaler. There were some big ambitious ideas and goals, but we hadn't thought of building ZDX. I recall when we rolled it out at General Electric, GE, a massive company globally, and they had lots of issues. They'd point those issues to us and say 'Gee, Zscaler, it must be you. It must be you.' And as we looked at the stuff, sure we had some issues, but 80% of the performance issue had nothing to do with us; it was somewhere in the network somewhere. So we got inspiration from this area, this problem. And we said, 'Oh, we're sitting on the endpoint.' Rather than doing a traditional network performance approach where your stuff sits on each network device in the branch and the data center, we said we're going to use our client on the endpoint to collect telemetry all the time. So it knows the health of the endpoint. It knows your DNS resolution time. And when traffic goes over ten hops over the internet, it knows any packet loss and latency, and it knows how long the application took to respond. That's how ZDX was born. It has become extremely powerful in figuring out any performance issues and resolving them pretty quickly. Let's dig a little deeper into the branch area. What drove you, and how you drove the branch transformation? Do you have a big network, is it MPLS or SD-WAN, or both?
So basically we have 995 connected sites. Most of them were connected with business-grade internet. So as part of the whole idea to go to an internet-only environment, we want to get rid of all the firewalls, all the SD-WAN by the end of the year. Then of course we need to have a solution for the factories, because with the PLCs you can't load the agents on them. So that's how we came to the branch connectors. We started, I think we had the first site back in October. We're now halfway through, so we'll do 122 sites. And it's really, if you look at it, with zero trust you can add all kinds of layers. I think with Zscaler, we're eliminating layers while eliminating complexity. And I think you had one quote: 'If you can reach it, you can breach it.'
When we deployed, Socomec was the first site. So I told my SI: 'Break it.' And then a few days later, he came back: 'Hey, I can't find it.' So that was the whole thing. Yeah, okay, work is designed.
So the goal is every branch goes dark and cannot be discovered on the internet. If you think about Nithos, we have been working with the Nithos model from early March. We are part of the original Glass program. The model is quite powerful. It's finding quite a few vulnerabilities, quite a few fairly high-risk vulnerabilities, and we have been busy patching them, fixing them. Every company has lots of un-remediated vulnerabilities today. Nithos will give you 5x more or 10x more. You'll never be able to patch all of them. If you can't, there are bound to be more breaches out there. So what can you do besides patching to be safe? The most important thing you can do is hide your attack surface. If they can't find you, they can't attack you. A typical branch setup: yes, there's an MPLS or SD-WAN, there's a firewall built in. What is the firewall saying to the branch? 'I am here. Come and connect with me. Come here and attack me.' Our goal is that none of your branches, none of your factories, and none of your plants should be discoverable on the internet. That's really what we bring to the table. And each branch becomes simple. Kurt talked about removing a lot of stuff: firewalls go away, north-south, east-west firewalls go away. You no longer need to do traditional VLANs. If things aren't on the network, you don't need to do that. The branch becomes simple. A simple branch, especially on the low end, will simply have our appliance, a switch and Wi-Fi. Everything else goes. That's the power of the zero trust branch technology we bring to the table. Let's look at looking ahead, using M&A integration with the same technology.
So we plan to do a merger with Xalta, which is mainly an American company but they also have a global footprint. So they are not a Zscaler customer. But we will basically implement the ZPA clients on their side and then to connect from them to us, we will implement the cloud connectors into selected places because they still have a fairly traditional network. And that basically will allow us full connectivity on day one without physically connecting the networks. That's really one of the things. As mentioned, what is coming is the completion of the branch connector rollout, getting rid of SD-WAN, getting rid of the firewall. So all of that is coming. And of course, in terms of AI, currently we do a lot of enterprise agents. We will start in Q3 with also citizen development, and then of course you get into a whole range of new challenges where I think also Zscaler has some interesting products to help manage that totality. It's fun to work with progressive customers like yours who challenge us, and you allow us to challenge you, and we all make progress together.
So, now I want to switch gears and give you a little view of some of the AI innovations we're driving. AI is playing a bigger and bigger role out there. While you're going to get a deeper view about AI from Deval in the next session, I'm going to give an 80,000-foot level view. Everything starts with understanding what you have and what's talking to what. We have a very strong solution called AI Protect, which we launched in January. It brings together multiple solutions: starting with AI asset management, to securing AI access, and securing AI applications and infrastructure. This is the starting point all of you should be looking at: something like this, because to really take any action, you've got to understand what you have and what the risk associated with it is. The next big thing we're working on, probably the most exciting and challenging project, is extending our exchange for agents. Agents are somewhat like people, right? We call them digital workers. But agents are like code. We already built zero trust for users. We already built zero trust for workloads. So for us to be able to extend the same global infrastructure and policy engine, the control plane and the like, was relatively easier. 70% of the pieces that are needed for this are already there. We had to build 30% of it. So some of the new areas we worried about were starting with MCP or A2A brokers. So as the communication comes, it can handle that kind of stuff. Then understanding the tasks being done, understanding prompts properly, and being able to inspect prompts to understand the intent. So building an engine for prompt inspection, for response inspection, was important. And based on that, being able to make a point-to-point connection. This is a powerful technology. This is just evolving, and we are making sure that we have all the key pieces you need to have secure communication for your agents. You'll hear more about it in the world sessions. And the other exciting piece I want to highlight is our AI Access Graph. This is a hard problem to solve in an enterprise. You've got all these entities, you've got all these data sources, they talk to each other. How do you know who is talking to whom? Who has what kind of access? This problem was solved by a bunch of PhDs from the University of Texas in Austin, in the company Symmetry Systems that we recently acquired. It takes basically metadata and telemetry from all these sources on different systems, applies AI on top of that, and creates a powerful graph that allows you to connect the dots, that allows you to get data lineage, to say which entity is accessing what data sources. The reason it's especially exciting for Zscaler is: when you have lots and lots of agents, how are you going to define the policy of which agent can access which application? It would be very hard. This access graph allows us to actually be ready to really apply those policies. So you are actually building the foundation by doing the AI Access Graph today, and in the agentic world it'll become more and more important. As you deal with the agentic world, one thing is fundamentally going to change: the volume of traffic, the number of agents. Various studies out there indicate that the number of agents per user is somewhere in the 50 to 100 range. And today, we take pride in handling 750 billion transactions a day. When I started Zscaler, I was thinking big. I didn't think big enough to say we'll be doing 750 billion requests a day. That number is probably going to get to trillions a day pretty soon. And that's why the name Zscaler: it stood for 'xenos' for scalability. That's why we named the company. Now it's going to be even more and more important. Imagine with agentic stuff, we are able to add one or two zeros to this number. That's the scale our engineering team is working towards. That's the scale we want to build, so you can have performance and response time to be able to process these policies. At the end of the day, policy enforcement will be happening, and that's really what we're getting ready for. Good. So to put this number of 750 billion into perspective: we essentially secure twice as many transactions as the number of stars in our Milky Way. It's about 50 times the number of Google searches per day. Think of that, it's pretty remarkable. And this is being done at a pretty high performance, with minimal latency. And knowing that this cloud has to be global, we have some 160 exchanges around the globe. These are public exchanges, plus a few thousand private exchanges that are dedicated to our customers for their own stuff. Europe is a very important part of our business. In fact, our two largest markets outside the US are in Europe. So you see, we have 25-plus data centers in Europe, and we started building our cloud with data sovereignty in mind from day one. We made sure every log sits here. We don't really store any traffic, only logs sit here. GDPR and DORA compliance were important parts of us, and that's what we built around. And now we are able to do full operational capabilities in Europe. So all operations can happen. There's no kill switch outside Europe. We are essentially getting ready for that, understanding that that's the requirement that's evolving from our customers. And the last point I'll mention briefly is AgentSecOps. One of the key things our customers are asking is: if you've got so many logs and so many transactions, why do I have to send all these logs to one of these SIEM solutions and cost extra money and delay? Why can't you give me better insights to understand what's going on, and potentially a closed-loop system where I can find something and fix it in the inline policy engine? That's the newer area for us. You're going to hear about some of the new announcements, the new products we're building in this area. And the last point in the solution area I want to talk about briefly is data security. Extremely important. At the end of the day, security is making sure your data is safe. We have very extensive offerings for inline security over the years. Now we expanded into DSPM so we can really understand the posture of the data, where the data is, find it, classify it, and we can make sure we can work together to do what we call adaptive data defense. You'll hear more about it tomorrow during Adam's session. So with that, now let me welcome Dr. Stefan Hahnel, from Siemens Healthineers, who has actually gone through a very extensive journey of zero trust to build, to deploy all these solutions at scale at Siemens Healthineers.
Good to see you.
It's wonderful. We started working together with Siemens, then they became part of Healthineers, and then you further accelerated the journey together with us. Give us an overall view of the scale, the business focus of Siemens Healthineers.
Thank you, Jay. Thank you, Jay, for inviting me on stage and talking about our journey. Siemens Healthineers is a global medtech player. So perhaps the majority of you don't know exactly what a medtech player is. If you or one of your relatives go to the hospital for a good reason like a birth or something, you are most likely diagnosed with one of our systems, by probability higher than 60%. So for diagnostics, it's a CT or MRI. If it's for an illness, then we have the systems who help you to get back to a better quality of life. It's about oncology care, cardiovascular care, neurovascular care. So this is what we are. We are present in more than 70 countries. We are a spin-off of Siemens because we are a pure medtech player focusing on healthcare, pioneering healthcare for everyone, everywhere, sustainably. This is our mission. And our backbone is innovation, and this brings us together with Zscaler. With the spin-off, I think we found a great partner who is also an innovation leader who helps us to go into the future.
Well, we have been innovating together. Some ideas coming from your company, some ideas coming from us. So it is a business driver for you. You guys have been out there. The number of patents you guys have done, the AI adoption you've done, it's remarkable. So tell us about what helps you drive some of these things. What were some of the calculus and drivers for this?
Yeah, so with our strength in patient screening and precision therapy, connected by healthcare AI. You already see in our products there's a lot of digital. You cannot be a market leader in medtech without having a strong digital foundation. So therefore, we are a business enabler, a business driver. If IT gets disrupted somewhere around the world, there's a patient at serious risk. And this is the mantra which every one of our 75,000 employees has in his genes. So every disruption has an impact on the quality of life of someone. One of your relatives in the audience who may be at a hospital, who has a heart attack, a stroke, who got a critical diagnosis, he needs our help. At the same time, we have threats like we all have in the industry. There are cybersecurity threats out there. We have regulatory compliance. Jay talked about GDPR, localization, nationalization, which makes it difficult to build global networks and global security. And then for sure, technology, technology like AI. AI is like every technology a great lever to bring us to a better world. At the same time, it's a threat because it can be used by all the enemies we have outside there who are trying to hijack us. And healthcare is a top target. You just saw it in the US with the Change Healthcare incident, where a payer—and it's just a payer, but he's managing all of, not all, but 80% of the reimbursement of the doctors, of the universities, of the hospitals in the US—got hijacked by a ransomware attack, which at the end leads to the fact that no customer, no healthcare provider knew if they could provide this service. So for sure they service the patient, but it took a while until you could switch from digital back to analog. And the overall damage was $872 million, so almost $1 billion in costs. And for me, more important, I don't know how many lives suffered or even how many deaths had been caused. So that's why ransomware is not just for us a business threat; it's a threat for life.
Absolutely. And you started on a journey. You did a phased journey. Walk us through some of the phases you followed for this transformation.
Yeah. We started with a spin-off from Siemens and we said, 'Okay, let's use the opportunity not just as we have done it in the past, building a network with firewalls, copying the legacy we have.' We started with Zscaler. We had a great innovation partner with you, and I'm very thankful for my team. Couple of you are here, couple of you in the US. So the users are the first one: replacing VPN and firewall, building a Zscaler foundation for everyone, and making sure that we have Zscaler always on. I still remember the discussion when our engineers said, 'Okay, let's turn it off. I can do much more stuff if I turn it off.' But for good reasons, we are over this. Then we went to the separation, the M&A acceleration you could call it, during the pandemic. We merged together. It was an acquisition, but from a culture point of view, I would say we merged two market leaders merged together with Varian, an oncology treatment global player. And we could use Zscaler to provide the Varian colleagues direct access to our core assets to build, particularly the engineering, these routes, particularly in the sales and engineering environment, and then stepwise forward. With that, we could scale up the connectivity from, I would call it, quarters or even years to weeks and months in order to get access for the right people to the right asset and not providing access to everyone everywhere. So security was built in, I would call it.
Absolutely, very well done.
And then we are now going, which is very exciting. We are not so far as Kurt is with AkzoNobel, but we are now bringing zero trust to our OT area. The next big change management field is the OT environment, and we want to use the branch connector really to drive there more security by connecting the different, I would call it, cells in the factory, not just each factory, and drive it forward because we believe at a certain point in time there will be an incident, and the better we have micro-segmented our factories, the better we are. A proof point for us was the acquisition from the Vates, a radiopharmacy distribution network. So many localized sites across Europe, and we could connect each of those sites. So this showed us, together with you and the great innovators from Zscaler, it's possible.
Absolutely. And the last thing, phase four, right?
It's all about B2B connectivity. And we are emerging. We want to get out of the classical way of connecting with partners. And you mentioned this: the next risk is in the supply chain. And we are in healthcare; you are very much connected. You have connectivity to our customers, you have connectivity to suppliers. And bringing this on a zero trust network without firewalls would be the last phase that we can assume.
Absolutely. That's wonderful. Let's talk about AI a bit. You have been doing a lot of work in the AI area. What are you doing, and how are you securing it?
Oh, where we are? First, we have AI in our product since 2014. We at the moment have 110 FDA-cleared, publicly available, more than 110 products you can buy as a healthcare provider. So AI is in our company. That's why we have a lot of AI innovation. Engineers are running around with it. And we see we use Zscaler in the first level for the surveillance. We know where AI is and who is using what model, where the data streams are. We also asked, and had a discussion with the board: should we block it? And it was a clear rejection. Don't block it. We need the innovation. Try to guide it. And this is our mantra. We don't want to be the blocker, the one who stops doing things. We want to guide the user, not restricting innovation, but guide them to do it in the right way. And if we can do this with having more intelligence in Zscaler, talking to the users, guiding them with the knowledge base we have, this would be the next thing.
Well, that's where we're working together. We like our design partners. So we learn from you, you learn from us, we make things. I'm very happy about this partnership.
