Zscaler’s AI security has been called into question after recent comments from its CEO regarding the use of its customer logs.

Cybersecurity manager Steven Swift shared comments by Zscaler CEO Jay Chaudhry on how the company is using billions of daily customer logs to train its AI models.

The remarks were made at a virtual summit held by the Cloud Security Alliance (CSA), focused on the safety of agentic AI, or agents, performing tasks autonomously for enterprises.

In the session, Chaudhry echoed remarks made in a 2024 earnings call when referring to Zscaler’s transaction-level logs featuring structured data and unstructured data with full SSL inspection.

“We have over 500 billion transactions per day and hundreds of trillions of signals every day,” he said. “We can use that technology for wonderful threat detection, cyber detection. We’re using it for risk modeling, building copilots, and now more and more agents.”

The same broadcast saw the CEO espouse the tenet of zero trust network access (ZTNA), which sees no user, device, or application on the network implicitly trusted, regardless of its placement in or beyond the network perimeter.

Zero trust underpins the Zscaler USP, with the Z in its company name standing for zero. In his post, Swift questioned the security of the company’s AI training, with a reminder its customers are encouraged to enable deep packet inspection, allowing Zscaler’s security platform to analyze the contents of traffic that would otherwise remain encrypted.

In practice, this means a substantial volume of data – traffic that enterprises typically regard as encrypted and protected – is being intercepted, processed, and effectively ingested into Zscaler’s systems.

Among this data, Chaudhry referred to telemetry derived from its customer logs, including endpoint detection and response (EDR) and internet of things (IoT) device data, to help build an AI data fabric for a mesh of different telemetry types. Zscaler AI agents - as unveiled in July - then use the mesh for data collection, investigations, and policies.

Integration is then possible with Zscaler’s managed detection and response (MDR) platform, inherited from its acquisition of MDR provider Red Canary this year. That deal was touted as driving agentic AI security operations with the integration of MDR workflows into its platform.

“As we are doing proper integration between our Zero Trust Exchange [platform] and our data fabric technology, we can feed back findings and detections in a matter of minutes,” said Chaudhry.

Concerns regarding AI training and data security have increased in the wake of generative AI. Agents made with OpenAI’s ChatGPT platform, for example, have been flagged for posing significant security risks and operational limitations that make it unsuitable for critical enterprise deployment.

Organizations are advised to gain visibility into AI application usage across their networks, while enforcing ZTNA and centralized policy orchestration with distributed enforcement.

Zscaler remains recognized for its zero trust nature, remaining atop Gartner’s latest ranking of secure service edge (SSE) vendors, which defined SSE to include zero trust components such as ZTNA.

According to Gartner, ZTNA is seeing strong adoption among large and mid-market organizations, and the firm forecasts 10% of large enterprises will have a mature and measurable zero-trust program by 2026.