Brazil’s first digital-only bank relies on Zscaler to roll out zero-trust security everywhere – News

Inter is a large digital financial services corporation based in Brazil with its U.S. headquarters in Miami. It began operating in 1994 as Banco Inter, a traditional bank, and became Brazil’s first fully digital, cloud-based bank in 2015. Inter provides online banking and other financial services, ranging from investments to travel, shopping and rewards, to companies and individuals throughout the Americas via its super app.

As Inter expanded and evolved, the company needed to ensure it was doing everything possible to protect the transactions and financial information of its 40 million customers against relentless threat actors. That led the Inter cybersecurity team to form a close working relationship with Zscaler Inc. and its cloud-based Zero Trust Exchange Platform.

At this year’s Zscaler Zenith Live 2025 event in Las Vegas, I sat down with three key members of Inter’s cybersecurity team — Orlandino Neves, executive cybersecurity manager; Paulo Calvo, data protection manager; and Rickson Martins, cybersecurity analyst — to discuss the company’s unique needs and its successful relationship with Zscaler.

Overcoming the limitations of traditional cybersecurity solutions

Neves said that as Inter began its rapid expansion in Brazil and beyond, the cybersecurity team faced limitations with its existing security infrastructure. “It was a big problem for us because the firewall-based VPNs,” he said. “We have 4,000 users on the firewall, and as we began expanding globally, our executives who traveled the world needed to connect from Europe to Brazil. The latency was so high it was a big problem.”

Another challenge the team faced was how to protect uploads in the cloud. “It was impossible to use traditional firewall connectivity because we had so much traffic, it was hard to have reliable throughput,” Neves recalled.

Enter Zscaler

It was clear the firewall-based VPN had reached its limit, and the bank needed a different type of solution to meet the growing demands. “As we moved to the cloud, we knew we had to rethink security and the legacy firewall approach would not scale so we looked at moving all of Inter to a zero-trust environment,” stated Neves. “We started a POC with Zscaler that turned into a major project. We deployed ZIA [Zscaler Internet Access] for our security service edge and workloads, and ZPA [Zscaler Private Access] for users. As the first digital bank in Brazil, Inter was also the first bank in Latin America to move our load 100% to the cloud. It was a big challenge, but it’s working very well.”

Neves said Inter has long been a disruptive, forward-thinking company, especially around its vision for the cloud. Inter worked with the Brazilian government to deliver on the promise of digital transformation and led the effort to change policies that had required financial services organizations to maintain an on-premises presence.

From that beginning in 2022, Inter has deployed essentially the entire Zscaler platform and its broad capabilities. Neves said Inter was Zscaler’s first-ever workload protection use case to secure its AWS workloads. Inter is also using Zscaler’s zero-trust based solutions for better data protection. This includes the data security and posture management or DSPM solution, for which Inter worked with Zscaler as design partner in the development of the product.

Expanding the relationship

Since 2022, Inter has been continuously evaluating new ways of working with Zscaler to support its aggressive growth and international expansion strategies. One of the more advanced use cases is to use Zscaler to secure its generative AI initiatives. Inter’s use of its own generative AI solution, InterGPT, and public AI tools such as ChatGPT is secured by Zscaler’s Generative AI Security solution, which provides Inter with full visibility into what users are sharing and alerts the security team so they can investigate any risky chats.

Martins discussed with me the importance Zscaler will play in Inter’s ability to roll out gen AI securely. “We use the gen AI report that Zscaler offers so we know what kind of LLMs are being used and what kind of prompts they are sending as well as what data is going into those prompts,” he said. “Zscaler is crucial for us to know what kind of data is going to AI, and what kind of models the users are using, and what kind of information they are sent. This gives us the confidence to know the company data is protected.”

Paulo Calvo, Inter’s data protection manager, talked about the quality of collaboration between Inter and its Zscaler counterparts. “When you have a good team, you can do anything,” he said. ” They let us know everything new that is happening,” Martins added. “We have QBR meetings that are very productive. They come to our headquarters and we chat about everything. We expose the problems we are currently having, the things that we like, and anything we don’t like. They haven’t changed, despite Zscaler acquiring many companies and adding a lot of new features and converting a lot of features in its products. They remain easy to work with.”

Martins added that “we always get at least a due date for something they are researching for us. And we are heavy users. So when we open tickets, they are not always easy. Usually, when we come to them with a bug, they have to open internal tickets to solve it, and they always provide feedback and update us about everything. Sometimes we can’t even keep up with them because we have other things to do, and I sometimes forget to answer the support team, but they are awesome. They play a big role in our environment. They always help us with our issues.”

Maturing Inter’s security risk posture

As with many large organizations, the Inter cybersecurity team is always interested in improving its security posture. For that, it used Zscaler’s Risk360 solution to understand the issues they face and the current state. “We have a big and complicated environment with a lot of APIs and the like. Risk360 allowed us to understand where the critical issues were and what actions we need to take,” explained Martins. He added, “With the ability to measure where we are and then take action, we have improved our score by 25%.”

Inter’s commitment to the highest level of security throughout its operations is tied to the company achieving its growth objectives.

“Inter has about 40 million customers and wants to add a million more each month through 2026,” said Calvo. “We are an aggressive digital bank. We don’t use security for protection. We use security to support expansion. And the numbers tell the story.”

Final thoughts

Cloud, AI and other digital technologies have changed the way business use and operate technology faster than ever before. These changes must be accompanied by a complete rethink of security as protecting an ever-eroding perimeter no longer works. Placing security devices at strategic points in the network is expensive and manually intensive and does not scale.

Zero trust reimagines security by applying the concept of least-privilege access to every device, user and application. Zero trust was initially used to replace edge firewalls and VPNs for remote users but it’s a concept that can be applied everywhere.

Inter’s security evolution should be looked at as a good lesson learned for other companies as the cloud forced businesses to modernize the network, compute and applications and it’s time to modernize security.

Zeus Kerravala is a principal analyst at ZK Research, a division of Kerravala Consulting. He wrote this article for News.

Image: News/Ideogram