Zscaler just put an agentic SOC on the GA board. The underwrite is not “AI in the SOC.” It is who owns the telemetry.
On September 9 Zscaler (Nasdaq: ZS) announced Zscaler Agentic SOC, described as purpose-built from the ground up with an AI-first approach to detect, investigate, and stop threats at machine speed — and said it is available globally today. The company argument is blunt: layering AI onto the existing security stack will not keep up with AI-driven attacks. ThreatLabz cites rising evasion via trusted sites, abuse of legitimate remote management tools, and browser-based attacks. Source: the press release, not a blog paraphrase.
Differentiation Zscaler prints: unique Zero Trust telemetry, “the world’s largest decoy mesh network,” expert-validated agents, integrated Zscaler Zero Trust controls, plus customers’ third-party controls. A hard number in the release: Zscaler sits inline across 750 billion daily Zero Trust transactions that teams can operationalize for real-time detection and response. Specialized agents are said to have been trained and continuously tuned on more than 10 years of frontline SOC, MDR, and threat-hunting experience. Closed-loop remediation claims: isolate compromised users, block command-and-control, and cut off lateral movement natively — with outbound actions into third-party tooling for nuanced response.
Model stack matters for the category fight. Zscaler says it partnered with frontier labs including Anthropic and OpenAI, integrating those models alongside proprietary threat intelligence and Zero Trust telemetry so agents “reason with greater depth, accuracy, and explainability than any single model.” Product pages and secondary coverage (Security Today) echo the same architecture: a context graph correlating Zero Trust and third-party data into incident chains; agents for triage, root-cause investigation, verdicts, and response workflows. EVP Deepen Desai frames it as reducing exposures proactively, extending human expertise, and containing at machine speed. Analyst Allie Mellen’s quote in the release is a reminder, not a TAM: double down on Zero Trust fundamentals and make AI attacks expensive.
Customer color in the release stays anecdotal: Maire Tecnimont’s Andrea Licciardi describes drowning in alert noise and using Agentic SOC for full attack-path context from telemetry already in place. That is a reference quote, not a win-rate dataset. The strategic read is clearer. Zscaler is attaching agentic SecOps to the Zero Trust data plane customers already buy — exposure reduction plus reactive defense in one narrative — rather than selling another SIEM that starts empty.
POV: this is the platform counter to best-of-breed SIEM/XSIAM and MDR pure-plays. Zscaler’s wedge is data it already sees inline — including the claim that customers can fully investigate 100% of their Zscaler logs inside Agentic SOC without shipping that high-volume stream to a SIEM for retention theater. That is a budget argument dressed as architecture. Attach rates, win rates, and a revenue guide for Agentic SOC: Undisclosed. Underwrite: GA date, 750B daily transactions, Anthropic/OpenAI pairing, closed-loop Zero Trust containment, open integration with third-party controls. Question whether “agentic SOC” becomes a Zscaler module customers expand into — or another console analysts ignore. Source: Zscaler Sep 9.
Underwrite sheet — sourced only: Agentic SOC GA / available globally (Sep 9, 2026); AI-first SOC framing; 750B daily Zero Trust transactions; decoy mesh; >10 years SOC/MDR/hunting experience informing agents; Anthropic + OpenAI partnerships; agents for triage / RCA / verdicts / response; native isolate / block C2 / cut lateral movement; third-party inbound context + outbound actions; customer quote (Maire Tecnimont) on alert noise (Zscaler press, Sep 9, 2026). Platform telemetry is the moat. The SIEM displacement claim still has to clear a buyer’s console count.