Attackers exploit vulnerabilities faster than patch cycles can respond. At it-sa 2026, Zscaler outlined how a platform approach, inline protection and European partnerships are meant to close the gap.
A redesigned booth, constant crowds and one topic everywhere: at it-sa 2026, artificial intelligence dominated the halls. Zscaler used the event to make a point: patching alone no longer protects companies. The vendor is betting on a platform that combines Zero Trust, inline protection for private applications and security for AI use.
AI everywhere
According to Zscaler, its newly designed booth was overrun on the first day, without a moment of calm. The company described itself as a magnet for visitors and said it intended to answer every inquiry. The mood matched the show floor, where almost every booth was pulsing with AI and agentic AI. Data loss prevention also gained priority, not least because confidential data can end up in public language models. This is where Zscaler’s cloud proxy comes into play.
Patching alone is no longer enough
On the threat landscape, Zscaler was candid. AI-driven attacks are a growing concern; the apocalypse has not arrived yet, the company said, but it expects it within the coming months. A press release from 5 October backs this up, citing Mandiant’s M-Trends 2026 report: the mean time to exploit a vulnerability has fallen below zero, meaning flaws are increasingly exploited before a public patch exists.
Zscaler’s answer is a collaboration with IBM and Red Hat. Autonomous Application Shield, delivered through the Zero Trust Exchange, is combined with Lightwell from IBM and Red Hat. App Connectors continuously assess the exposure points of each private application, and the cloud evaluates every application individually. When a new vulnerability emerges, adaptive protection can be applied inline and in real time, without waiting for a patch. Lightwell then supplies validated remediation for affected open source software so customers can fix the flaw at its source. Autonomous Application Shield is currently in an Early Access Program; availability and timing are subject to change.
Joby Menon, Senior Vice President of Product Management at Zscaler, said the aim is to reduce risk during the gap between disclosure and fix. Gunnar Hellekson of Red Hat added that this window has shrunk from months or weeks to hours and minutes.
Zero Trust: well-prepared enterprises, gaps elsewhere
Zscaler sees DACH organizations divided. Larger enterprises have largely done their homework, the company says, while smaller firms and the public sector struggle. As a Zero Trust pioneer with Fortune 500 experience, Zscaler says it covers everything from SIM cards to small branch offices on the same basic architecture. An MSP broker model is planned, and AI agents are a new field of attention.
Platform instead of point solutions
The consolidation trend is not new, Zscaler notes, but point solutions reach natural limits. Identity and access management, Zero Trust, endpoint and cloud are growing together. The vendor argues that legacy systems can be replaced, expensive components drop out and no additional hardware needs buying; a wave of interest is now reaching mid-sized and smaller companies. Whether this convenience comes at the price of dependence on a single provider remains a question each customer must weigh.
Sales run through partners. Since all customers work on the same SaaS architecture, partners can bundle offers and sell a broad portfolio. Zscaler names Telekom, Bechtle, NTT, Westcon, Infosys and Wipro, along with smaller specialists and the Amazon and Microsoft marketplaces.
Securing AI and addressing sovereignty
For AI usage, Zscaler detects agentic and LLM flows, classifies their risk and relies on AI Guard with AI-based guardrails that take an agent’s assigned task into account. An MCP gateway is planned. The roadmap foresees expanding AI further, much deeper agentic interaction and an agentic SOC.
On sovereignty, the company says it has heard concerns for a long time. For two months, Zscaler and STACKIT have offered what Zscaler calls a genuinely European solution for larger customers. Zscaler says it is open to further partnerships, is talking to French providers and wants to open its channel further, particularly for defence customers. The US government cloud runs separately.
Compliance and outlook
On NIS2 and DORA, Zscaler makes clear that no tool covers every requirement. It supports customers with ISO certification, data protection and TISAX, and likens its Risk360 product to a Rosetta Stone of compliance that creates transparency. For SAP RISE migrations, direct connectors to SAP are meant to simplify troubleshooting and keep the trust chain seamless.
Zscaler wants to grow with the market; the German team is expanding continuously, and larger scaling is possible. Next on the calendar: a Gartner conference in December, the Zscaler User Group and an AI roadshow.
For DACH companies, the takeaway from Nuremberg is twofold. The time between disclosure and exploitation is shrinking, so protection has to be in place before a fix arrives. At the same time, platform promises, sovereignty claims and early-access features deserve scrutiny, and buyers should test them against their own architecture and regulatory obligations.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de