The old Zscaler thesis was about replacing web gateways and remote-access VPNs. The current thesis is more ambitious: can the Zero Trust Exchange become the inline policy and enforcement layer for every enterprise interaction – human, workload, branch device and AI agent – while Data Security supplies context and Agentic SecOps closes the response loop? That is a materially larger opportunity than user access, and it changes both the competitive position and the business model. Zscaler is no longer best analysed as a seat-based security service with several adjacencies. It is trying to monetise the volume of machine activity, data movement and autonomous transactions that will grow much faster than employee numbers.
The franchise: control the connection, not the network
Zscaler’s original insight remains important, but not because zero trust is still a novel phrase. The architectural point is that a user should not be placed on a trusted network merely to reach an application. Zscaler Internet Access inspects traffic to the internet and software-as-a-service applications. Zscaler Private Access brokers access to private applications. The exchange verifies identity and device posture, applies policy, terminates and inspects the session, and creates a separate connection only to the authorised destination.
This changes the object being protected. A firewall controls entry to a routable environment. A VPN extends that environment to a remote user. Zscaler instead protects an individual interaction. The application can remain unaddressable from the public internet; the user receives no general network access; and compromising one credential does not automatically create a path to discover and attack adjacent systems. The design reduces exposed attack surface before an exploit occurs and restricts lateral movement after one succeeds.
That matters more in the AI era because software vulnerabilities are being discovered and operationalised faster than security teams can patch them. Zscaler’s proposition is not that vulnerabilities disappear. It is that an attacker – human or autonomous – should be unable to reach most applications in the first place, and should be unable to traverse the enterprise if one reachable system is compromised. The phrase “make applications, models and data invisible” is directionally correct only where access is actually brokered through the exchange. It is an architectural outcome, not a blanket property of everything a customer owns.
The franchise therefore rests on three linked controls. First, remove inbound exposure by placing applications behind outbound connections to the exchange. Second, replace network membership with application-specific access. Third, inspect the live traffic so that an authenticated user or agent cannot use an approved connection to move prohibited content or perform an unauthorised action. The third control is what turns Zscaler from an access product into a potential data and AI-security platform.
Why AI makes the exchange more valuable
AI agents create a different security problem from employees using a chatbot. An agent can discover services, call tools, read data, generate code and execute actions without pausing for human judgement. It may use a service account, inherit a user’s authority, create short-lived credentials or communicate with another agent through emerging protocols. The number of interactions can rise by orders of magnitude while the time between a bad instruction and a damaging action collapses.
Zscaler is unusually well placed at the communication layer. The exchange already sits between identities and applications, processes hundreds of billions of transactions each day and applies policy inline rather than after the event. Extending the same model to agents means treating every agent as untrusted, disclosing no more of the environment than it needs, granting access only to named applications and data, and inspecting each request and response. A compromised agent can still attempt a malicious action; the objective is to make the action unreachable, unauthorised or visible at the point of execution.
| AI-era risk | Why traditional control is incomplete | Zscaler control point | Residual risk |
|---|---|---|---|
| Internet-exposed models, tools and servers | Patching assumes defenders can fix every reachable flaw before automated exploitation | Private publication through the exchange removes direct discovery and inbound reachability | Public services and traffic that bypass the exchange remain exposed |
| Agent lateral movement | A valid identity may still receive broad network access and discover unintended resources | Application-specific connections prevent general network membership and constrain the blast radius | Poor segmentation or over-broad application definitions can recreate implicit trust |
| Data exfiltration through prompts and tools | Identity confirms who requested access but does not necessarily inspect the content being sent | Inline DLP can classify prompts, responses, files and API traffic and enforce policy before transfer | Coverage depends on decryption, routing and accurate classification |
| Rogue or manipulated agents | Entitlements describe possible access, not whether a particular action is appropriate now | AI Broker, access policy and transaction inspection can restrict agent-to-model, agent-to-tool and agent-to-agent communication | Business intent is difficult to infer; high-impact actions still need application-native safeguards |
| Machine-speed attacks | Human-led triage and ticket-driven response may take hours or days | Agentic SecOps can detect using platform telemetry and enforce containment through the exchange | Zscaler does not own every endpoint, cloud or application signal and must integrate well |
The advantage is not simply having more telemetry. Inline telemetry records what communicated with what, when, under which policy and with what content. Because enforcement sits in the same path, a detection can immediately become a narrower access policy, a blocked transaction or an isolated application segment. That detection-to-enforcement loop is the most defensible part of the AI thesis. It is also the standard against which the emerging products should be judged.
Identity is the starting point, not the enforcement layer
The common objection is that identity platforms should secure AI agents because every agent needs an identity. That is only partly right. Identity answers who or what is requesting access, authenticates the principal and describes its entitlements. It usually does not inspect the complete transaction, understand the sensitivity of the payload or decide whether a permitted identity should perform a particular action in the present context.
An employee may be entitled to use a model but prohibited from submitting source code. An agent may have permission to read a customer database but not export the full table, invoke an administrative tool or pass the result to another model. Those are transaction and data-policy decisions. The inline exchange can combine the identity assertion with device or workload posture, destination, application, requested action, data classification and behavioural risk, then enforce the outcome in real time.
Zscaler therefore complements rather than replaces identity. Microsoft, Okta, CyberArk and other identity systems remain authoritative for authentication, lifecycle and privilege. Zscaler’s potential control point begins after authentication: what may this identity do, through which path, with which data, under which conditions? The distinction becomes more valuable as non-human identities proliferate, but it also creates dependency. If the underlying identity, delegation chain or entitlement context is wrong, an inline gateway may enforce the wrong policy with great efficiency.
Symmetry’s access-graph technology is strategically important for this reason. It maps relationships between human and machine identities, services and sensitive data, including indirect access paths that a directory alone may not reveal. Combined with Zscaler’s transaction data, the graph can move policy from static identity rules towards effective access: not merely who an agent claims to be, but what it can reach and how that reach could expose data. This is promising technology integration, not yet proof that Zscaler owns the identity-security layer.
Security for AI: an emerging control stack
Security for AI should be separated into distinct jobs rather than treated as one product label. The first is discovery: identify approved and shadow AI applications, internally deployed models, agents, model-protocol servers and the data relationships around them. The second is access governance: decide which users and agents can reach which models and tools. The third is transaction security: inspect prompts, responses, files and API calls for sensitive data, malicious instructions and prohibited actions. The fourth is application assurance: test internally built AI systems for prompt injection, unsafe output, data leakage and model-specific attack paths.
| Capability | Security job | Why the Zscaler architecture helps | What must be demonstrated |
|---|---|---|---|
| AI Asset Management | Discover models, agents, AI services, shadow usage and data lineage | Inline traffic reveals tools actually being used, not only assets registered with IT | Coverage of private and machine-to-machine AI activity, not just employee web traffic |
| Secure Access to AI | Apply role, posture and risk policy to approved and unapproved AI services | Existing user and application policy can be extended to AI without a separate access path | Granular control that permits useful adoption rather than reducing governance to allow or block |
| AI Gateway and AI Broker | Govern model calls, APIs, tool invocation and agent communication, including MCP and A2A | The exchange can inspect and enforce every routed AI transaction in real time | Broad protocol adoption, low latency and controls that survive rapidly changing agent frameworks |
| Endpoint AI Security | See local models, browser extensions, plugins and endpoint-resident agent activity | Closes blind spots where activity begins on the device before it reaches the cloud exchange | Depth against endpoint incumbents and integration with the existing client connector |
| AI Access Graph | Map identities, permissions, data and indirect paths | Combines relationship context with observed communication and policy enforcement | Native integration of Symmetry rather than a separate graph and administrative console |
| AI red teaming and posture | Test applications, models and infrastructure for AI-specific weaknesses | Findings can feed the same access, data and remediation controls | Evidence that testing changes production policy and reduces exploitable paths |
This portfolio has a coherent architecture. Asset discovery determines what exists. The access graph shows who and what can reach it. The exchange controls the connection. Data Security inspects the payload. Red teaming identifies weaknesses in the application. Agentic SecOps investigates suspicious behaviour and can drive containment. A customer can therefore move from visibility to policy to enforcement without exporting every finding to another system.
The competitive claim should not be accepted uncritically. AI gateways can be embedded by cloud providers and model platforms. Identity vendors can govern agent credentials. Endpoint vendors observe local processes with greater depth. Cloud-security platforms see workloads and configurations that never cross an enterprise proxy. Zscaler’s advantage is strongest when heterogeneous users, agents, models and applications communicate across organisational and cloud boundaries and the customer deliberately routes those interactions through one neutral enforcement layer.
Data Security is the connective tissue
Data Security is not an optional attachment to the AI strategy. It is the context that tells the exchange why a technically valid interaction may still be dangerous. Zscaler’s historical advantage is inline DLP: it can inspect content moving through web, SaaS and private-application sessions. Endpoint DLP extends control to local channels. Data security posture management discovers and classifies sensitive data at rest across cloud and on-premises stores, identifies public exposure and misconfiguration, and maps excessive access.
The combination matters because AI collapses the boundary between data at rest and data in motion. A model or agent finds a repository, reads records, transforms them and transmits an answer. A posture tool may know that the repository contains sensitive information but cannot necessarily stop the transfer. An inline DLP engine may see the transfer but lack the ownership and effective-access context needed to distinguish normal use from abuse. Zscaler is trying to join those views: classify the asset, map access, observe the transaction and enforce one policy across endpoint, web, SaaS, cloud, email and AI channels.
The commercial evidence is already meaningful. In the latest quarter, roughly seven in ten Security for AI transactions also included Data Security. That supports the view that customers see AI governance and data protection as one buying problem. The stronger test is whether customers retire separate DLP and posture products, apply one classification system across channels and use the access graph to remove risky permissions. Attaching another module without consolidating policy would be packaging, not a platform advantage.
The competitive pressure is substantial. Netskope has deep cloud-application and data-security credibility. Microsoft controls large parts of the productivity and identity estate. Palo Alto Networks can connect cloud posture, network enforcement and security operations. Varonis begins from data permissions and usage. Zscaler’s differentiated claim is the union of high-scale inline inspection with endpoint coverage, data-at-rest discovery and an access graph. Its vulnerability is that each competitor may remain deeper at its original control point.
Agentic SecOps: close the loop or become another console
Agentic SecOps is the most consequential move beyond access and the least proven. Zscaler already generates unusually rich network and application telemetry because it processes more than 750 billion transactions each day. Customers have historically sent much of that data to a separate SIEM or security-operations platform. Zscaler is now using specialised agents to detect, prioritise, investigate and respond, combining its telemetry and enforcement with the investigation knowledge acquired through Red Canary.
The strategic logic is closed-loop remediation. A conventional workflow exports logs, correlates an alert, waits for an analyst, opens a case and then calls a separate control to contain the threat. Zscaler can potentially recognise suspicious communication and change the access path through the same exchange. The value is not another AI-generated incident summary. It is the ability to move from evidence to a reversible containment action before an automated attacker can exploit a second system.
There are important limits. Network telemetry does not replace endpoint process data, identity events, cloud control-plane logs or application audit trails. Red Canary brings detection engineering and managed-response experience, but its historical service model is different from a globally distributed inline platform and carries higher customer churn. Zscaler must prove that the acquired expertise has become productised detection and response rather than an MDR service sitting beside the exchange.
The launch therefore creates a clear falsification test. Agentic SecOps succeeds if customers retain Zscaler telemetry within the platform, investigations use first- and third-party signals, and automated containment measurably reduces verified time to remediation without unacceptable false positives or change failures. It fails if the product becomes a thin incident console, if enterprises continue exporting the same data to their primary SIEM, or if closed-loop response works only for Zscaler-controlled traffic.
The business model is moving beyond seats
The old model grew with protected employees. ZIA and ZPA remain large user-based subscriptions, but the newer portfolio is tied to different units. Zero Trust Cloud monetises workload communication. Zero Trust Branch protects locations and non-user devices such as IoT and operational technology. Parts of Data Security are linked to data volume. Security for AI can be linked to queries, transactions, tokens and consumption. Agent activity can expand even when employee headcount is flat.
This transition is no longer theoretical. Non-seat metered offerings represented about 30% of new and expansion contract value in fiscal 2026, while the recurring base attached to those products more than doubled. Those are the two financial statistics that matter most to the long-duration thesis. They show that machine traffic and data volume are already becoming a material second growth engine rather than a distant total-addressable-market claim.
| Consumption unit | Products | Strategic benefit | Investor risk |
|---|---|---|---|
| Users | ZIA, ZPA and user-facing security modules | Predictable subscriptions anchored in a mature installed base | Seat growth is limited by employment and the core categories are mature |
| Workloads and traffic | Zero Trust Cloud and workload communication | Expands with applications, services and machine-to-machine activity | Cloud-native controls may keep traffic inside hyperscaler environments |
| Branches and devices | Zero Trust Branch, IoT and OT segmentation | Opens firewall, SD-WAN and non-user estates | Requires networking credibility, hardware at the edge and channel execution |
| Data volume | DLP, DSPM and related data-security modules | Monetises the growth and distribution of sensitive information | Scanning and storage can add infrastructure cost while specialists compete on depth |
| AI queries and agent transactions | Security for AI, AI Gateway and AI Broker | Growth can compound with autonomous usage rather than human seats | Demand may be volatile and application providers may enforce policy natively |
Metered consumption improves the addressable market but makes forecasting and unit economics more complex. AI usage can accelerate rapidly, yet customers will optimise expensive queries and demand volume discounts. Zscaler also operates much of its own distributed infrastructure, so traffic growth requires capacity, memory, storage and processors. The relevant question is not whether usage rises; it is whether incremental consumption produces durable recurring revenue without eroding the economic advantages of the cloud model.
Z-Flex is designed to bridge subscription commitments and a widening product set. Customers make a multi-year commitment and can activate or exchange modules without reopening procurement. This can shorten expansion cycles and lets a customer shift spending towards AI, data, branch or cloud products as needs develop. It can also obscure product-level demand. Bookings are less informative than deployed modules, actual consumption, renewal behaviour and recommitment before the original pool is exhausted.
Competitive landscape: Zscaler’s right to win
Zscaler does not have a unique claim on zero trust, AI security or cloud inspection. Its right to win comes from combining four assets that competitors more often hold separately: a high-scale inline exchange, mature application-specific access, one policy engine across different traffic types, and an installed route through which data and AI controls can be deployed. The more products genuinely share telemetry and enforcement, the more valuable the platform becomes. A collection of acquired consoles would have the opposite effect.
| Battleground | Strong alternatives | Zscaler’s edge | Zscaler’s weakness |
|---|---|---|---|
| Zero Trust SASE | Palo Alto Networks, Netskope, Fortinet, Cisco and Cloudflare | Proxy-first direct access that avoids extending a trusted network | Broader platforms can bundle networking, firewalls, endpoints and cloud security |
| Identity and agent access | Microsoft, Okta, CyberArk and SailPoint | Observes and enforces the live interaction after authentication | Depends on identity systems for principal, lifecycle and entitlement truth |
| Data Security | Netskope, Microsoft, Palo Alto Networks and Varonis | Inline DLP plus endpoint, posture and access-graph context on one exchange | Competitors may have deeper productivity-data, SaaS or permission analytics |
| Security for AI | Platform vendors, cloud providers and specialist AI gateways | Existing position in heterogeneous enterprise traffic and data enforcement | AI activity that remains inside applications or clouds may never traverse Zscaler |
| Agentic SecOps | CrowdStrike, Microsoft, Palo Alto Networks and Google | Native path from inline detection to access containment | Less endpoint, SIEM and cloud-control-plane depth than established SecOps platforms |
Palo Alto Networks is the broadest strategic competitor because it can combine SASE, firewalls, cloud security and SecOps. Netskope is the closest architectural competitor in SSE and data. Microsoft owns the strongest identity and productivity distribution. CrowdStrike owns high-value endpoint telemetry and is expanding into identity, data and cloud. Cloudflare can combine security and connectivity on a large internet edge. Zscaler’s defence is not a longer checklist. It is that a neutral exchange designed to connect identities directly to applications can enforce policy consistently across vendors without preserving the network constructs the incumbents are paid to manage.
Architectural purity can also become commercial rigidity. Most enterprises will remain hybrid, retain firewalls and prefer gradual transformation. A bundled platform that is technically adequate may beat a superior standalone service if it reduces suppliers and operating effort. Zscaler must therefore demonstrate that its architecture produces measurable security and operational outcomes: fewer reachable applications, less lateral movement, simpler branch estates, consistent data policy and faster containment. Marketing the absence of a network is not enough if the customer still operates one everywhere else.
The investment debate has changed
The central debate is no longer whether zero trust can replace VPNs. That is established. The question is whether Zscaler’s inline control point becomes more or less strategic as AI shifts enterprise activity from human sessions to autonomous transactions. The bull case is that every new agent, workload and model creates another high-frequency interaction that requires identity context, least-privileged access, content inspection and real-time enforcement. Zscaler can sell all four through infrastructure already trusted with critical traffic.
The bear case is that control fragments. Identity platforms govern agent credentials; model providers enforce guardrails; cloud platforms keep machine traffic local; endpoint vendors monitor local agents; and SecOps platforms correlate the rest. In that world Zscaler remains a strong access and inspection franchise but does not become the strategic AI-security layer. Its new products add revenue yet fail to create a compounding platform.
| Strategic claim | Why it is credible | What would falsify it |
|---|---|---|
| The exchange is uniquely equipped for AI-era risk | It combines private application access, inline inspection, transaction context and immediate enforcement at global scale | Agent traffic bypasses the exchange or competing gateways deliver equivalent control inside identity and cloud platforms |
| Security for AI is a new platform leg | It spans asset discovery, access, data, gateways, endpoints and application testing | Customers buy only shadow-AI controls while agent, model and application security remain separate markets |
| Data Security compounds the exchange | At-rest classification and access relationships make inline policy more precise | DSPM and the access graph remain separate products without common policy or measurable consolidation |
| Agentic SecOps closes the response loop | Zscaler owns both high-volume telemetry and an enforcement path capable of immediate containment | Customers continue exporting telemetry and treat Zscaler as a data source rather than the system of investigation and response |
| Growth decouples from employee seats | Workloads, devices, data and AI transactions are already contributing materially through metered products | Consumption growth slows, is heavily discounted or produces weaker renewal and infrastructure economics |
What to monitor
- Non-seat mix: sustained growth in workload, branch, data and AI consumption, with healthy renewal and gross-margin behaviour.
- Security for AI depth: movement from governing employee chatbot use towards agent-to-tool, agent-to-agent and private-model enforcement.
- Data integration: one classification and policy model across inline DLP, endpoints, DSPM and the Symmetry access graph.
- Agentic SecOps outcomes: verified reductions in detection-to-containment time, not alerts summarised or agents announced.
- Traffic coverage: evidence that private cloud, workload and endpoint activity is entering the exchange rather than remaining outside its view.
- Platform consumption: actual deployment and use within Z-Flex commitments, rather than headline contract value.
- Competitive displacement: branch and cloud projects that remove firewalls and routing complexity rather than merely adding another security layer.
Bottom line
Zscaler’s relevance to AI is not that it has added AI-labelled products to a zero-trust franchise. It is that the Zero Trust Exchange occupies a control point identity alone cannot fill. Identity establishes who or what is asking. The exchange can decide what that user, workload or agent may reach, inspect what it is attempting to send or receive, and enforce the decision while the transaction is still in flight. That is precisely where exposure, lateral movement, prompt abuse and data exfiltration become preventable rather than merely observable.
The platform now has four connected legs: Zero Trust SASE Everywhere controls access; Data Security identifies and protects the asset; Security for AI governs models, agents and AI transactions; Agentic SecOps turns telemetry into response. The emerging non-seat model shows that this expansion is beginning to change the economics, with machine and data consumption becoming material alongside user subscriptions.
Our view: Zscaler has one of the strongest architectural claims on the enterprise AI-security control plane, but the claim is conditional. Traffic must traverse the exchange, acquired data and response capabilities must become native, and metered usage must convert into durable economics. If those conditions hold, AI makes Zscaler’s original design more valuable because autonomous activity multiplies the need for least-privileged, inline enforcement. If they do not, the company remains an excellent access franchise surrounded by faster-growing adjacencies. The investment debate is now about whether the exchange becomes the policy engine for machine activity – not whether zero trust was a good idea.