Key Highlights

  • Zscaler (NASDAQ:ZS) announced on Monday, October 5, 2026 a collaboration with IBM (NYSE:IBM) and its Red Hat unit to protect private applications from vulnerabilities found and exploited with frontier AI models.
  • The pact targets the patch gap, the period between the disclosure of a software flaw and the installation of a fix, which faster AI-led discovery is expected to widen.
  • Two critical PHP flaws disclosed on Wednesday, October 21, 2026 gave a live example, as attack traffic appeared before fixes shipped and some European government sites went offline.
  • No revenue figures were attached to the collaboration, so its financial value to Zscaler rests on distribution through IBM and Red Hat enterprise accounts over time.

What the Three Companies Agreed

Zscaler (NASDAQ:ZS), a cloud security company built on zero trust, the principle that no user or device is trusted by default, said on Monday, October 5, 2026 that it would work with IBM and Red Hat. The stated aim is to protect private applications, the internal software that companies run for staff and partners, from frontier AI-powered threats. Red Hat supplies enterprise Linux and container software used to run many of those applications, while IBM brings consulting and a large base of corporate clients. The announcement came in the same week as Zscaler's 2026 investor day, at which it reaffirmed fiscal 2027 guidance. It describes a technical and commercial collaboration rather than an acquisition or an equity investment.

How Hiding Applications Narrows the Patch Gap

For Zscaler (NASDAQ:ZS), the logic is that an application an attacker cannot reach cannot be exploited, even before it is patched. Zero trust access connects an approved user to a specific application through the cloud, so the application does not sit openly on the internet. That matters when AI models shorten the time needed to find and weaponise flaws. The PHP case on October 21 showed the problem: Cloudflare (NYSE:NET) reported that the flaw leaked before the fix and that attack traffic aimed at its customers followed. Public websites cannot be hidden, which is why some government sites went offline instead, but internal applications can. For IBM and Red Hat, the pact adds a security layer to software they already sell.

Risks and What to Watch

The first risk for Zscaler (NASDAQ:ZS) is that partnership value is slow and hard to measure, since no revenue figures were disclosed and channel deals often take several quarters to show up in bookings. The second is that IBM is not exclusive: it also works with Palo Alto Networks (NASDAQ:PANW), which bought IBM's QRadar cloud software assets in 2024. The third is IBM's own momentum, with its shares trading about 6% lower before the bell on Thursday, October 22, 2026 despite third-quarter revenue of USD 17.1 billion, up 5%. Investors should watch the Fed decision on Wednesday, October 28, 2026, the end of Zscaler's fiscal first quarter on Saturday, October 31 and the midterm elections on Tuesday, November 3.

Where Things Stand

The answer is that the IBM and Red Hat pact gives Zscaler (NASDAQ:ZS) a route into enterprise applications at the moment AI is speeding up vulnerability discovery, a risk the October 21 PHP flaws made concrete. It adds distribution and a sharper sales argument rather than reported revenue. The next catalysts are IBM's trading after its results, the Fed decision on October 28 and Zscaler's first-quarter report after the October 31 quarter end. Partnership benefits are not guaranteed, and this is not investment advice.