Zscaler CFO Kevin Rubin said the company’s zero-trust approach is being extended into “agents” and other machine-to-machine use cases as organizations prepare for an expanding wave of AI-enabled cyber threats. Rubin, speaking in a recorded interview published by The Motley Fool, argued that the same least-privilege principles that govern human access should increasingly control agent permissions to limit the damage from a compromised actor.
The discussion also framed zero trust as a longer-term security build-out rather than a one-off platform change, with Rubin pointing to platform ROI, faster vulnerability discovery driven by frontier models, and the company’s push to combine threat detection and response with its security cloud capabilities.
Key takeaways
- Price move: The article does not report any stock or market price reaction.
- Catalyst: The interview focused on Zscaler’s zero-trust strategy, including how it is evolving toward agentic AI security and how its integrated security initiatives are designed to address accelerating vulnerability and threat volumes.
- Key implication: Investors may view zero-trust adoption as durable because it aims to reduce lateral movement and shrink the blast radius—two outcomes that Rubin said become more important as workloads and agents proliferate.
- What investors should watch: Progress on the company’s expansion from user and cloud protections into branch security and agent-focused zero trust, along with execution on any integrated secOps roadmap.
What Zscaler is trying to secure in a zero-trust model
Rubin described cybersecurity outcomes in two primary objectives. First, it is about preventing bad actors from entering corporate networks to access sensitive information. Second, it is about ensuring that sensitive data and corporate assets do not leave the corporate environment inappropriately.
On zero trust specifically, Rubin said the core idea is to grant the least amount of access necessary for a specific use—whether that access is for an individual, a workload, or a device. He argued that this differs from “zero-trust washing,” where vendors market complex policy-driven designs as zero trust without delivering what he described as genuine one-to-one, time-bounded authorization.
In Rubin’s explanation, Zscaler Exchange functions as a broker for access: users request access to a particular resource, authentication and authorization are performed, access is granted for the required session, and connectivity terminates when the task is complete. Rubin said this design approach limits the ability for attackers to move laterally across the network, since users or devices have no need to access unrelated applications.
Growth levers: extending zero trust across users, cloud, branch—and agents
Rubin tied Zscaler’s growth strategy to expanding the scope of zero trust. He said the company began with protections for user-to-application traffic and then extended the model to workload-to-workload communication in cloud environments.
He also emphasized “zero-trust branch,” describing a shift away from traditional mesh-like connectivity between branch resources. Rubin’s argument is that branch devices should connect only to the application each device needs, rather than forming a broader network that could enable an attacker to spread if one component is compromised. In that framing, segmentation limits the attack surface and localizes breach impact.
Rubin’s central theme was the next extension: zero-trust principles for agents. He said AI agents and machine-to-machine systems will require explicit permissioning for each action, including communication between agents and between an agent and an individual. The concern, Rubin said, is that a compromised rogue agent could potentially access resources it otherwise would not, making least-privilege control more important as agentic systems become embedded in business workflows.
AI security backdrop: vulnerability discovery outpacing patching capacity
Rubin argued that frontier models are changing the operational tempo of security. He cited the pace at which AI-enabled tools can identify vulnerabilities at “machine speed,” noting that this increases the number of issues organizations must address. In his view, many companies already have security backlogs that are difficult to close, and faster vulnerability discovery increases the burden on IT teams tasked with patching and mitigation.
Rubin said Zscaler’s approach is designed to reduce exposure by hiding applications behind Zscaler Exchange, so that what cannot be seen cannot be breached. He also linked this to blast-radius reduction, arguing that segmentation confines potential compromise to the single device or session needed to complete the authorized work.
Partnerships, acquisitions, and the push toward integrated secOps
Rubin discussed Zscaler’s participation in AI-related security partnerships, including an early role with Anthropic on Project Glasswing and an early partnership with OpenAI on Daybreak, as described in the interview. He said the value for Zscaler is not only learning how models behave, but applying those learnings internally and sharing relevant implications with customers and prospects as AI capabilities evolve.
He also addressed Zscaler’s acquisition of Red Canary, describing it as a way to combine Red Canary’s detection and response experience with Zscaler’s security cloud data. Rubin said Zscaler processes very large volumes of traffic through its exchange and that the company’s goal is to use this high-fidelity security-oriented data to provide contextual insight that stands out versus vendors relying primarily on narrower sources.
According to Rubin, the acquisition is intended to support a near-term “integrated secOps solution,” with an aim to migrate legacy Red Canary customers into that integrated offering while also expanding availability to existing Zscaler customers.
Bigger picture for cybersecurity budgets and AI ROI
Rubin suggested that cybersecurity spending is often resilient even in tougher macro conditions because it is mission-critical, and he argued that Zscaler’s value proposition can be especially compelling when CFOs and IT leaders scrutinize costs. He said deploying Zscaler can reduce total cost of ownership relative to architectures built around multiple network security hardware components, including deprecating items such as firewalls, VPNs, and other network devices in favor of a service model.
On the ROI debate around AI—especially concerns about token costs and budget allocations—Rubin said Zscaler is seeing both immediate productivity gains from AI use and also treating agentic AI as an industry-level shift that is early in its adoption cycle. He framed the priority as balancing model and token expenses with the outcomes delivered, while preparing for the disruptive role agents could play in how businesses compete.
Looking ahead, investors focused on Zscaler’s trajectory may want to monitor how quickly the company scales zero-trust capabilities from users and cloud into branches and agentic environments, as well as how the integrated secOps effort progresses after the Red Canary acquisition. The next potential signposts will include updates tied to customer adoption of these extensions and any further detail on how Zscaler incorporates insights from AI model partnerships.
