Zscaler CEO Jay Chaudhry on AI agents: 'The best way to secure them is don't trust them'

Zscaler CEO Jay Chaudhry says AI agents are becoming a weak link in corporate security and identifies rogue agents as a major company risk. He discusses applying zero-trust security to agents and Zscaler's role in the agentic stack ahead of its first investor day since 2021.

Analysis

The investable question is whether agent security creates incremental budgets for Zscaler or merely reframes existing zero-trust spend. Agents expand the number of machine identities, permissions, and actions that must be governed; that can raise the value of network-level policy enforcement, but it also increases the importance of identity, endpoint, and application controls. Microsoft, Palo Alto Networks, CrowdStrike, and Okta can compete for pieces of that control plane or bundle features into existing contracts, limiting standalone pricing power.

Treat the CEO’s framing as strategic positioning, not evidence of customer adoption or revenue contribution. Near term, the investor-day discussion may move expectations faster than fundamentals. Over 1–3 months, look for concrete product availability, customer deployments, and evidence that agent security is incremental to deal size or renewal rates. Over 6–18 months, the structural upside depends on enterprises standardizing controls for non-human identities; fragmented agent architectures or platform bundling could dilute Zscaler’s role.

The contrarian risk is that “agents are the weakest link” is directionally compelling but may not yet translate into a distinct budget line. Avoid chasing a thematic rerating without commercial proof. Falsify the positive thesis if management offers no measurable adoption or monetization indicators, or if subsequent guidance and customer commentary do not show agent-related demand. No valuation or adoption data here supports a standalone directional position.

Key Decisions for Investors

• Keep ZS on the watchlist into investor-day disclosures; do not treat the interview’s threat framing as a revenue catalyst by itself.
• For any long exposure, require evidence of agent-security deployments and incremental contract value, renewal impact, or a separately identifiable pipeline—not just product vision.
• Monitor bundling and control-plane competition from Microsoft, Palo Alto Networks, CrowdStrike, and Okta; stronger bundled alternatives would weaken Zscaler’s pricing and attach-rate opportunity.
• Reassess the thesis over the next 1–3 months using product availability, customer references, and management’s measurable adoption disclosures; absent those, prefer no trade over a thematic chase.