Zscaler acquired AI security startup SPLX on Monday in a bid to deepen protection for enterprise-built generative AI models. The move underscores the speed AI is reshaping the traditional zero trust stack.
Based in San Jose, Zscaler said the New York-based SPLX startup’s tools will extend Zscaler’s platform into AI red-teaming, risk scoring, and compliance mapping for both public and private model deployments. SPLX specializes in helping developers connect projects to code repositories such as GitHub to identify how AI models are used, test them for jailbreak or prompt-injection weaknesses, and map risks to frameworks such as NIST or ISO.
The rise of shadow AI – much like shadow IT before it – is creating unseen risks as employees and developers experiment with unapproved models and tools outside official security controls. More than 80% of IT leaders say their organization has experienced negative outcomes from unsanctioned AI tool use, according a recent study by Komprise (gated content).
SPLX was founded in 2023 by former Zscaler executive Kristian Kamber and had raised $9 million in funding before the deal. Its red-teaming tools are already used by several enterprise AI builders, giving Zscaler a head start in what’s becoming one of cybersecurity’s fastest-forming submarkets: AI model assurance.
“By joining forces with Zscaler, the global leader in Zero Trust security, we’re combining SPLX’s expertise in AI threat inspection, red teaming, and governance with Zscaler’s trusted cloud platform and vision for securing AI at enterprise scale,” Kamber said on LinkedIn. “This isn’t the end of the SPLX story – it’s the next level,” he added.
Industry analysts say the acquisition positions Zscaler to be first mover among major security vendors to target the model layer of the AI stack, beyond infrastructure or API protection. By focusing on securing the AI models themselves and the algorithms that generate or analyze data, Zscaler is doing more than other similar security firms that limit focus to the systems that host or connect to them.
Rivals such as Palo Alto Networks and Google Cloud have introduced early-stage model scanning or guardrail tools, but few have integrated code-level testing or compliance tracking.
Still, Zscaler faces a fragmented and hype-heavy market. Many startups now claim to secure generative AI systems, yet most focus narrowly on training data or runtime policies. SPLX’s differentiation, according to Zscaler Chief Product Officer Adam Geller, lies in combining continuous red-teaming with lifecycle visibility that starts at model creation and ends with deployment.
Whether enterprises will consolidate AI risk management under existing zero-trust frameworks remains an open question. For now, the acquisition signals that AI security is moving from theory to integration, with large platforms racing to turn experimentation into usable defenses.
Stay on point and visit the latest SecPointBreak Marketplace headlines.
