For review, AI Protect debuted one quarter ago as a bundle of AI security product utility. It has already crossed $100M in bookings (inclusive of some pre-existing AI revenue before that was included in AI Protect) and covers three distinct needs. First, AI Asset Management gives customers a bird’s-eye view of all agent-based activity and identities across a customer’s digital estate. Knowledge is power, and this end-to-end knowledge of AI presence and traffic is step one in making sure agentic innovation is secure. During the event, Zscaler introduced AI asset discovery within SaaS and internet traffic, unveiled agent and Model Context Protocol (MCP) discovery in public cloud environments, and added visibility into agent permissions and activity on endpoints like Claude Cowork. 

The second bucket is secure AI access for employees, or making sure people are using AI tools in permissible, responsible ways. Zscaler added support for secure usage of OpenAI and Anthropic compliance APIs and also debuted intent-based activity guardrails and scanning to uplevel traditional keyword strategies and find issues faster. The last one involves the actual securing of AI apps and infrastructure from adversaries, which places them in more direct competition with close partners/frenemies like CrowdStrike. This part of AI Protect includes its Red Teaming (or simulated agent-based attacks to test AI systems for vulnerabilities), which extended to MCP servers. Zscaler also added prompt hardening capabilities, which shield models from malicious prompt injections to try to extract sensitive information or gain impermissible access.

The most exciting launch this year was Zscaler’s Agentic Exchange. This features all of the existing innovation in AI Protect that we just covered with some compelling new tools layered in. For example, Zscaler’s “AI Broker” tracks, vets and handles authorization for all agentic access requests on its exchange. It’s purpose-built for interoperability with MCP and agent-to-agent (A2A) frameworks – both of which are ubiquitously popular for agent-based communication. The Agentic Exchange accomplishes its mission with a 4-step process. The first step verifies an agent’s identity and pulls important information like agent risk and rules from an integrated registry of agent permissions (Agent Registry). Next, the technology assesses what the request entails and what granting it would open up access to. This exposure assessment yields an ability to assess how risky the request is, with Zscaler’s new AI Access Graph providing a map of human and agent-based traffic to see what everything is doing and assess whether or not that’s allowable. This represents invaluable context to enrich this work and was obtained via its Symmetry Systems acquisition. Finally, with all of this automated information gathering and analysis complete, the request will be accepted or denied. All of this happens inline, enabling autonomous work to stay amazingly efficient without sacrificing security. This serves as the network security guard, reliably filtering traffic and allowing for safe innovation. Importantly, this AI Broker is not attempting to be a new identity directory to supplant Microsoft or Okta. Instead, it uses existing identity providers and infuses its own authorization, intent and risk analysis on top, sharpening Zscaler's ability to provide compelling customer outcomes.

Importantly, this Agentic Exchange is perfectly suited for monetization via consumption-based mechanisms. Zscaler last quarter pushed non-seat-based net new annual contract value as a portion of total from 25% to 30% sequentially. This should help keep that trend moving in the right direction, especially considering customers do not need to use Zscaler’s core platform to purchase this. That should mean Agentic Exchange morphs into a strong top-of-funnel source more quickly.