Zscaler Posture Control

No entries match these filters. Clear filters

1. changelog Sep 4, 2026 · issue 064

   Zscaler adds Endpoint AI Security Attack Chain Analysis, using OpenAI GPT models to reason over full endpoint state and produce prioritized attack-path remediation roadmaps.

   • New Endpoint AI Security Attack Chain Analysis capability reasons over the full state of an endpoint — AI agents, coding assistants, IDE and browser extensions, installed software, packages, and system configuration — to construct a realistic, step-by-step attack chain rather than a flat list of findings.
   • Attack chain output labels each step as confirmed on the host, inferred from state, or flagged for verification, and produces a prioritized remediation roadmap ordered by attacker progression.
   • Runs as an endpoint agent either standalone or as a module within the existing Zscaler client, which is deployed on more than 70 million devices, and is fully controlled and policy-scoped.

   3 details in Everything

2. changelog Jun 26, 2026 · issue 009

   Zscaler Posture Control adds AI-SPMAI-SPMAI Security Posture Management: a discipline for continuously discovering, assessing, and remediating risks across AI pipelines, models, and data, giving cyber tools a structured way to govern AI infrastructure the way CSPM governs cloud. with shadow AI discovery, drift detection, and automated red teaming mapped to MITRE ATLASMITRE ATLASA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured taxonomy for AI-specific threat modelling., NIST AI RMFNIST AI RMFA voluntary framework published by NIST that gives organizations a structured process for identifying, assessing, and managing risks introduced by AI systems, giving cyber tools a common vocabulary and governance scaffold., and OWASP LLM Top 10OWASP LLM Top 10A ranked list of the ten most critical security risks specific to large language model applications, maintained by OWASP, giving cyber tool developers a shared taxonomy for prioritizing LLM attack surfaces..

   • New AI Security Posture Management (AI-SPM) provides continuous discovery and posture assessment of AI assets including shadow AI, unsanctioned models, embedded SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. AI, developer-built agents, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers.
   • New AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk.) maps model lineage across discovered AI assets for full supply-chain visibility.
   • Adds posture assessment for AI-specific risks: misconfigurations, excessive permissions, vulnerable RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining. frameworks, and exposed data pipelines.
   • New AI posture drift detection continuously compares permission scope, configuration state, and data access patterns against established baselines to surface slow-erosion changes point-in-time assessments miss.
   • Automated red teaming runs continuous, high-scale tests across the AI lifecycle and maps findings to MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATLAS, NIST AI RMF, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Top 10, and the EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe..

   +1 more show less

   • Remediation workflows integrate with ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. (Jira, ServiceNow), DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., and DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. platforms, with prioritized alerts and least-privilege access enforcement.

   6 details in Everything