Firewalls are facing the internet and saying, 'I am here. Come and connect with me or attack me.' Every firewall is an attack surface. When I started Zscaler, we said firewalls have lived their useful life.
But the name Zscaler stands for zenith of scalability.
Welcome to the CISO podcast.
Sanjay, appreciate the opportunity. Thank you.
Well, thank you so much. Jay, this is your fifth go-round in terms of Zscaler. You had many successful companies, but you also said that this moment feels a little different than before. For our audience, just briefly to kick things off, what is different about this moment?
Technology incrementally changes all of the time. We expect technology to get better every year. Every decade, two decades or so, there have been a big change. I call them mega waves. Internet was a mega wave in the '90s. In the 2000s, we saw mobile and cloud came and changed many things. And now this AI is not even a mega wave, it's a giga wave. It's fundamentally changing everything. Cloud changed how applications are built and run. But AI is changing applications, all the use cases, security and all. So it is big. I compare it to the industrial revolution. The difference is the industrial revolution took place over a few hundred years. This is just happening every week, every day. There are some big innovations happening. So businesses need to learn how to move faster. AI is challenging every CEO, every CIO, and every AI officer to stay on top of it.
Jay, when our audience knew I was coming here to talk to you, there were some questions from the chief AI officers. One of the questions was that Jay has had access to Project MyThos. What did Jay learn that would be helpful to these chief AI officers? What surprised Jay looking at that, and what would be helpful to them?
So we have been part of the Glasswing program from day one, which was early March. We got access to it, and the mission was to go and check our own software infrastructure using MyThos to see what kind of vulnerabilities it can find, so we can fix them. Because over 45% of Fortune 500 companies depend upon us to keep them safe. So our platform has to be safe. We take cyber very seriously. I sometimes say we are always paranoid when it comes to cyber. We are never going to be complacent.
So what did we find? It is able to find a large number of software vulnerabilities that have been hidden for a long, long time in our applications, in the OS, in some of the open source pieces we are using. Now, I think MyThos is powerful, but the way it got launched, probably there's a little bit of marketing mystique around it. When you make it available only to a small group, it's goodness, but others wonder what it is. The notion of making it available to a small group is not new. When Microsoft used to announce those Tuesday vulnerabilities, they'd give us a week's notice so we could fix things. But this model is significantly better at finding vulnerabilities than previous versions. For example, take Opus 4.6, 4.7 — pretty good, but this is a few notches above. So it needs to be taken seriously.
But here's the challenge. Every CIO and CISO is saying, 'I need to get hold of Metasploit so I could work on it.' But here's the problem. Every organization has thousands of software vulnerabilities that are not remediated because there are not enough resources. Software always has bugs. Now Metasploit is going to add 5x more to the list. What are you going to do? You're never going to be able to just patch and patch and get out of it. Resources are limited. Change control windows and upgrades are hard. Vulnerabilities will be found quickly. Patching will be behind. So more breaches will happen. The question is not how do I patch, patch, patch. The question is how do I minimize breaches? Number one, what else can I do besides patching so I don't get breached? And number two, if I get breached, how do I minimize its impact so it doesn't bring my entire business down? Those are the discussions I'm having with many CEOs, CIOs, and CISOs. We have a very focused program to help our customers.
In fact, as I just got off the plane, I had a call with a CIO of one of the top 10 global system integrators. Same topic — what do I do? We have a pretty good game plan to help them. The actions can be taken in weeks, not in months. That's not to say everything gets fixed in weeks. That means if I can take low-hanging, high-impact items sooner, I'm safer. In cyber, nothing is 100% safe. But if everyone has a 4-foot fence around the house, and I can build a 10-foot fence, I'm a lot safer.
So just very briefly, you're saying it'll detect a lot of vulnerabilities. But chief AI officers or CISOs don't have the resources. Is ignorance bliss, or should they still find out their vulnerabilities? What do you recommend?
So they need to. These models, they don't need to wait for MyThos. Opus 4.7 is pretty powerful. Opus 4.8 just got released and is becoming publicly available. They can use it. Then ChatGPT or OpenAI is not sitting behind — they want to be in front of this thing. So they announced a daybreak program. Their model is GPT 5.5. These numbers start getting mixed up after a while — they change so frequently. So they should discover and try to work on patching. But that's only one action.
Here is the second most important thing they should do. How do attacks happen? Your applications, your resources, your firewalls, your VPN — they're all facing the internet. Anything facing the internet can be scanned and discovered by anyone. And now with AI tools, they can scan and find that this VPN can be compromised, this firewall can be compromised. Then they compromise those devices or applications. Once they get on the application, that application is connected to the rest of the company's network. Now they move laterally on the network. They get to your crown jewel applications, encrypt them, break them down. That's where the bad thing happens.
So our number one recommendation is hide your applications behind a zero trust exchange like Zscaler. The model we pioneered is the opposite of firewalls. Firewalls are facing the internet and saying, 'I am here. Come and connect with me or attack me.' Every firewall is an attack surface. When I started Zscaler, we said firewalls have lived their useful life. We need a new architecture. In this new architecture, you don't build a moat behind a firewall. We built an exchange, a switchboard, which assumes everyone is untrusted. Your applications are hidden behind us. When people try to come to us, we check them — are you allowed to access? If they get validated, we make the connection. Otherwise, they don't even know where the applications are. That is the biggest innovation Zscaler brought to the market. We call it hide your attack surface. If they can't reach you, they can't breach you. Our customers are already doing a lot of it.
That's number one. Number two is assume some user got breached or some firewall in a branch office got compromised. How do you make sure the malware doesn't spread from that machine everywhere? For that, zero trust architecture becomes very important. Zero trust says trust no one. Every employee is untrusted. Every branch is untrusted. So an employee, whether sitting in the office or at home, connects to our exchange, our switchboard. Just like the old school phone switchboard — you'd call the switchboard and say, 'I want to talk to John,' and you got connected to John and John only. Then you'd say, 'I want to talk to the president of the US or the prime minister of India,' and they'd say, 'Sorry, go away. You're not allowed to.' Policy-based access after checking who you are and what access you have. That's what we do with our model.
With that, even if a user got compromised, the worst that can happen is he can reach one application and do some damage — can't go anywhere else. If a branch network got compromised, the blast radius is confined to the branch. Doing that type of zero trust architecture becomes extremely important, and that's what we have been doing from day one. That's why we feel Zscaler was designed and built for this kind of moment. Maybe I should say it is built for two moments. Even though I started the company in 2008, knowing that breaches were happening and customers were spending more money on firewalls and VPNs, it wasn't working. The security model wasn't working, so we wanted to come up with a new model of zero trust. It took a fair amount of time to evangelize.
Then COVID came. Suddenly people had to work from home. That was the first moment that actually realized the value of zero trust widely. Now with AI in the mix for the whole world, people are saying you'll get compromised unless you can do zero trust. It's an important moment for us, and we are busy helping our customers.
So patching is one thing to do. Hiding your applications is number two. Embracing zero trust is number three. There's a number four actually — a very simple thing they can do. It doesn't take a lot of time and it's not very expensive. It's decoy technology — honeypots. If a bad actor gets into your data center somehow, they look for mission critical applications. They look for Active Directory. If I get into Active Directory, I can escalate privileges and do all kinds of bad stuff. Or I find your SAP deployment and do bad things.
So we have a technology called Zscaler Deception. Those deploys can be turned on pretty quickly. Even I can have a deploy for an AI model. When they scan and say, 'Oh, I found this company's AI model,' as soon as they touch it, the alarm bell goes on. We pick them up and they can be taken out. You can do the same thing in your hyperscalers too. If somebody broke into your data center, catch them quickly. These are pragmatic things customers should be doing.
So I think Jay has given four great examples. If they can't reach you, they can't breach you. He's also talked about decoys, setting up honeypots. This is fantastic. Jay, another chief AI officer had a question for you. You said that an average employee is going to have between 50 to 100 AI agents across the board. According to this chief AI officer, there are two concerns. One is organizational: where do these agents reside in an organization? Second is what is the governance framework? How do you protect? You were just talking about employees. Now you raise the scale by 100 to 150.
