DeepInspect vs Zscaler AI Guard: Identity-Bound Enforcement vs Content-Layer DLP

A compliance lead at a mid-size insurer I spoke with in July had Zscaler's Zero Trust Exchange running across nine regional offices. DLP policy blocked Social Security numbers from landing in ChatGPT's web interface, and browser isolation kicked in automatically for a dozen GenAI sites the security team had not yet reviewed. Three weeks later, the actuarial group wired a Python script directly into the Anthropic API to summarize 40,000 claims files a month, authenticated with a project-level credential an engineer had generated back in April. No browser, no Zero Trust Exchange session, no policy in view. The traffic left the building as a plain HTTPS POST to api.anthropic.com.

That gap is the subject of this piece. Zscaler AI Guard and DeepInspect turn up in the same AI security shortlists because both touch traffic that passes between people and language models. The similarity ends there. Zscaler AI Guard runs content-level detectors and DLP policy inside the Zero Trust Exchange, evaluated against a configured policy ID. DeepInspect sits on the HTTP path between an authenticated caller and any LLM, binding every request to an identity and committing a signed record of what happened.

TL;DR

• Zscaler AI Guard runs inside Zscaler's Zero Trust Exchange, scanning prompts and responses with content detectors (prompt injection, toxicity, sensitive data) tied to a configured policy ID, alongside browser-based risk scoring for GenAI apps like ChatGPT.
• DeepInspect is a separate proxy on the LLM API path that resolves the caller's identity, applies role-based policy, and writes a signed audit record for every request before the model sees it.
• Zscaler reads what a prompt contains against configured rules. DeepInspect decides who was allowed to send the prompt in the first place.
• Direct API and agent-to-model calls made outside a browser session sit outside the pattern Zscaler's detectors were built to classify. Regulated programs commonly run both.

Zscaler AI Guard

Zscaler AI Guard is a detection and guardrail layer built into the Zscaler Zero Trust Exchange, the company's Security Service Edge platform, per Zscaler's own AI Guard product page. The product runs inline inspection on prompts and responses moving between an AI application and a model, applying a set of detectors covering prompt injection, jailbreak attempts, toxic or off-topic content, and DLP scanning against more than 100 predefined data dictionaries.

Deployment happens in one of two shapes. In proxy mode, AI Guard sits between an enterprise's AI application and the LLM provider, decrypting and inspecting traffic in transit. In sidecar mode, sometimes marketed as Detection as a Service, AI Guard runs alongside the application and receives prompts and responses for scanning without sitting directly in the request path. Either way, a violation is evaluated against a policy configured in the Zscaler dashboard and referenced by a policy ID at request time, rather than against a per-request identity resolved from a corporate directory.

That detection layer sits on top of a capability Zscaler has sold for longer: browser-based control over GenAI app usage through the Zero Trust Exchange itself. Zscaler Internet Access proxies a user's web and SaaS traffic, decrypts TLS, and scores destinations like ChatGPT, Gemini, and Copilot for risk, per Zscaler's generative AI security page. Security teams can block a GenAI app outright, isolate it in a rendered browser session that restricts copy and paste, or allow it while applying DLP rules to what a user types into the box. Zscaler's own ThreatLabz group reported in June 2026 that its customer base moved 18,033 terabytes of data into AI tools over the prior year, ChatGPT traffic alone triggering 410 million DLP violations.

Both layers do real work inside their traffic pattern. A browser session tied to a corporate SSO login, decrypted at the Zero Trust Exchange proxy, is exactly where AI Guard and Zscaler Internet Access are positioned to catch a pasted customer record. A prompt sent through an internal chat application that AI Guard sits in front of, in proxy or sidecar mode, is where its content detectors get a look at the payload. Traffic that skips both positions, an API call authenticated with a credential instead of a session, made from a backend service or an autonomous agent, follows a different pattern than either capability was built to inspect.

The inline enforcement proxy

DeepInspect is a stateless proxy that sits inline between an authenticated user or agent and any LLM. Every HTTP request to a model API, OpenAI, Anthropic, Bedrock, Azure OpenAI, or a self-hosted endpoint, passes through it before the model sees the request, and the response passes back through before the caller sees the answer.

The decision runs on the request itself, not on a browser session or a policy ID configured in advance. DeepInspect resolves the identity behind the call, a human authenticated through the corporate IdP or a service account bound to an agent, checks the role and policy that identity carries, classifies what the prompt contains, and produces a pass, redact, or block decision before the request reaches the model. A direct API call from a backend service gets the same treatment as a request from an internal chat interface, because the proxy operates on the HTTP request itself rather than on a known browser destination or a manually configured policy reference.

This is the same inline enforcement pattern I argued for in 22-Second Breach Windows Mean Your AI Enforcement Must Be Inline. Google Mandiant's M-Trends 2026 report found the median handoff time from initial access to a secondary threat group fell to 22 seconds. A detector tuned to catch a browser paste event has no reason to be watching a service key calling a model API at that speed.

Every decision produces a signed, tamper-evident audit record: identity, policy version, data classification, outcome, timestamp. The record commits before the response reaches the calling application, so the evidence lives outside that application's own custody. That is the property a regulator or an internal security review is actually asking for.

AI traffic is a first-class data channel

When an employee pastes a paragraph into ChatGPT's web interface on a managed laptop, Zscaler's Zero Trust Exchange has a real shot at seeing it: the browser session ties to a corporate identity, TLS decrypts at the proxy, and DLP dictionaries scan the pasted text. When that same employee's team builds an internal tool that calls the OpenAI API directly, authenticated with a project credential instead of an SSO session, the traffic travels as an HTTPS POST to api.openai.com, and neither the Zero Trust Exchange nor AI Guard's policy-ID-based detectors sit in that path unless someone deliberately routes the service's egress through the proxy and configures TLS inspection for that specific destination.

Three structural gaps show up once network and content-layer tools meet AI traffic instead of browser traffic. Identity correlation is the first: a credential generated for a service account carries no natural mapping back to the person who requested it, the way a browser session tied to SSO does. Data classification is the second: DLP dictionaries and AI Guard's detectors pattern-match known sensitive strings and known attack signatures inside a payload, built for that purpose rather than for holding the multi-turn context of a conversation. Policy timing is the third: a proxy-based inspection point only sees traffic actually routed through it, and API clients calling a model provider directly, especially from inside a cloud VPC, routinely skip that point entirely.

Browser-based GenAI usage on managed devices is a real and common source of exposure, and Zscaler's tooling covers real ground inside that scope. The architectural point holds regardless: content detectors and network DLP operate on traffic they can see, and API traffic authenticated by a key rather than a session needs an inspection point purpose-built to sit inside that specific request path.

Feature comparison

• Traffic layer inspected: Zscaler AI Guard inspects prompts and responses inline for AI applications it sits in front of (proxy or sidecar mode), while the broader Zero Trust Exchange inspects browser and web traffic for GenAI app access. DeepInspect inspects HTTP requests specifically on the path between a caller and an LLM API.
• Detection method: Zscaler's detectors pattern-match content against configured rules, prompt injection signatures, toxicity, DLP dictionaries. DeepInspect evaluates identity, role, and data classification together as a single policy decision.
• Identity binding: Zscaler ties Zero Trust Exchange policy to an authenticated browser session or device, and AI Guard's detections reference a configured policy ID that can optionally carry user metadata. DeepInspect binds every decision to the caller's resolved identity, human or service account, at the request level by default.
• Direct API and agent traffic: Zscaler's visibility into a service-to-service API call depends on egress routing and TLS inspection being configured for that destination. DeepInspect sits directly in the API request path by construction.
• Audit output: Zscaler AI Guard returns a transaction ID and a list of triggered detectors per scan. DeepInspect produces a signed, per-decision audit record built for regulatory disclosure.
• Enforcement point: Zscaler enforces at the network and web proxy edge or, for AI Guard, in front of a configured AI application. DeepInspect enforces at the LLM request boundary itself.
• Primary buyer: Zscaler is typically bought by network security and SSE/SASE teams already standardized on the Zero Trust Exchange. DeepInspect is typically bought by security, platform, or compliance teams that own LLM access control specifically.
• Model dependency: Zscaler's AI app policies are written per known destination or configured application. DeepInspect is model-agnostic by construction, operating on any LLM endpoint reachable over HTTP.

Pick Zscaler AI Guard if...

Zscaler AI Guard and the surrounding Zero Trust Exchange fit organizations whose main exposure is still browser-based GenAI usage plus a defined set of internal AI applications they control end to end.

• Your priority is discovering which GenAI apps your workforce uses across a large, varied population of managed devices, and scoring the risk of each one.
• You already run the Zero Trust Exchange for broader SSE coverage and want AI-specific detectors layered onto infrastructure your network team already operates.
• Your AI applications are internally built and centrally proxied, so deploying AI Guard in proxy or sidecar mode in front of them is a straightforward addition.
• Your open question is what a given prompt contains, not which authenticated identity was allowed to send it and whether you can prove that decision later.

Pick DeepInspect if...

DeepInspect fits teams whose exposure has moved past browser usage and internally proxied apps into direct, programmatic calls to LLM APIs, including agent-to-model traffic that never touches a browser or a configured application.

• You need per-request, identity-bound enforcement on LLM API calls regardless of whether the caller is a person, a backend service, or an autonomous agent.
• A regulator or auditor can ask who accessed a model through the API, under what policy, and you need a signed record that answers it rather than a detection log that implies it.
• You are running toward the EU AI Act's Article 12 logging deadline, which took effect August 2, 2026, and your evidence needs to stand independent of the calling application's own logs.
• You are securing agent-to-model traffic specifically, covered in more depth in the post-authentication gap in AI agents and shadow AI usage inside the enterprise.

Teams that end up running both layers rarely planned it that way from day one. The Zero Trust Exchange usually arrives first, because SSE coverage is close to a baseline purchase for a large enterprise already. The API-layer gap surfaces later, typically when a security review asks about an integration that never went near a browser or a proxy. Watching a nine-figure Zero Trust rollout still get asked for an identity-bound audit trail it was never built to produce is a genuinely odd, and slightly deflating, moment to sit through.

DeepInspect

This is the request-level gap Zscaler's Zero Trust Exchange and AI Guard were never built to close on their own. Their detectors read prompt and response content against configured rules; resolving a service key back to the natural person who requested it, and binding a policy decision to that identity by default, sits outside what those detectors do. Shadow browser usage and direct API traffic from a backend service or an agent are separate exposure paths, and closing the second one means sitting on the request itself.

DeepInspect sits at that AI request boundary as a model-agnostic proxy, resolving identity, evaluating policy, and classifying content on every request, then writing a signed audit record for the decision. It runs alongside Zscaler's tooling rather than replacing it. Zscaler answers what a prompt contains and which GenAI apps a workforce is using in the browser. DeepInspect answers who was authorized to call which model through the API, and proves the answer months later when a reviewer asks.

If you are facing the August deadline, let's talk.