Zero-trust vendor Zscaler has acquired AI security firm SPLX.

Founded in 2023, New York-based SPLX specializes in AI security posture management (AI-SPM), with various tools focused on AI system governance and testing.

With the acquisition, Zscaler is incorporating SPLX features such as shift-left AI asset discovery and automated red teaming into its flagship Zero Trust Exchange platform.

Zscaler will also be adding AI runtime guardrails and prompt protection capabilities to protect against the rising threat of shadow AI, where unsecured AI usage can unknowingly lead to data leaks.

Zero Trust Exchange will also feature AI governance and compliance initiatives, which Zscaler said would aid organizations move from a reactive to proactive security posture. These features can enable security teams to better safeguard their AI investments while ensuring adherence to established governance and compliance frameworks.

The firm added the SPLX system brings over 5,000 specialized attack simulations to proactively uncover vulnerabilities in AI systems, while scanning for AI models, workflows, and code repositories in both public and private domains. This includes retrieval-augmented generation (RAG) and model context protocol (MCP) servers, helping to create a complete AI bill of materials (AI-BOM) for users.

The SPLX investment follows Zscaler’s Red Canary acquisition, in a deal which was touted as driving agentic AI security operations with the integration of managed detection and response (MDR) workflows into its platform.

Zscaler recently updated its Digital Experience Platform (ZDX) with Device Scoring and Remediation, helping security teams better spot devices likely to cause poor user experiences before problems are reported.

With shift-left features such as this and those inherited from SPLX, the security vendor is bolstering security testing automation for earlier deployment in security workflows with an AI twist, rivaling recent security posture management releases from the likes of Palo Alto Networks.