Zscaler founder says AI needs a new security playbook

Zscaler Founder and CEO Jay Chaudhry told the CAIO Connect Podcast that AI is accelerating cyber risk and forcing companies to rethink security around zero trust, deception, and faster response. He said AI agents will create a new layer of exposure that organizations must control before attackers can exploit it.

Why it matters: - AI is increasing the pace and scale of cyber threats faster than many security teams can respond. - Companies now face more software vulnerabilities, more automated attack capability, and more risk from AI agents working inside business systems. - Chaudhry said the shift requires organizations to move from perimeter defense to proactive controls that reduce both attack surface and blast radius.

What happened: - On a recent episode of the CAIO Connect Podcast, host Sanjay Puri spoke with Jay Chaudhry, founder and CEO of Zscaler, about AI and cybersecurity. - Chaudhry described AI as a transformational force that is moving faster than the internet, cloud, or mobile technology. - He said AI is evolving every week, which is pressuring CEOs, CIOs, CISOs, and Chief AI Officers to keep up with new developments. - Chaudhry called AI a “giga wave” because of its impact on applications, business processes, and security.

The details: - Chaudhry discussed Project Mythos, an advanced AI system designed to uncover software vulnerabilities. - Zscaler accessed the technology through the Glasswing program and used it to test its own infrastructure. - The tests surfaced many vulnerabilities in applications, operating systems, and open-source software. - Chaudhry said AI tools can find far more weaknesses than security teams have resources to fix. - He argued that companies should focus on preventing breaches and limiting damage, not only on finding every flaw. - Chaudhry urged organizations to place critical applications behind zero-trust architecture instead of exposing them directly to the internet. - He said traditional firewalls increase attack surface because attackers can see them. - Zscaler’s model places applications behind a secure exchange that verifies users before granting access. - Chaudhry said, “If they can’t reach you, they can’t breach you.” - He also stressed reducing lateral movement so an attacker cannot easily move deeper into a network after compromising a device or account. - Chaudhry highlighted deception technology, including honeypots that draw attackers and alert security teams when touched. - Zscaler’s deception platform can create fake AI models to lure threat actors. - Chaudhry said these defenses can be deployed quickly and at relatively low cost. - He said deception tools can detect intruders before they reach mission-critical applications or sensitive data.

Between the lines: - The comments point to a broader security shift: AI is not just a new target, but also a new tool for both defenders and attackers. - Chaudhry’s emphasis on zero trust and deception suggests Zscaler sees visibility and access control as more effective than trying to patch every weakness after the fact. - His warning about AI agents reflects an emerging risk category where software can act autonomously at machine speed.

What's next: - Chaudhry predicted employees may soon work alongside dozens or even hundreds of AI agents. - He warned that compromised agents could cause major damage quickly. - Zscaler is extending its zero-trust exchange model to AI agents to enforce policy, monitor communications, and control access between agents, applications, and data sources. - Chaudhry urged Chief AI Officers to move aggressively, launch focused AI projects, and help their organizations adapt as the technology evolves.