Zscaler is a large player in network security. It competes with Palo Alto’s next-gen suite, Cloudflare and many others. Zscaler’s Zero Trust Exchange (ZTE) is its latest and greatest cloud security approach. It blazes a trail between users, apps and devices across eligible networks while securing data at rest and in motion. Zero Trust is exactly what it sounds like: never trusting a device or end user. The exchange vets and verifies all traffic as it moves within a company’s perimeter. It does not allow bad actors to breach the most vulnerable piece of infrastructure and freely move about it thereafter, without any subsequent verification. That’s called “lateral threat movement.” Zscaler uses risk scores to assess needed levels of security for requests. That makes sure it’s only creating user friction when there’s actual security concern.

This Zero Trust approach routinely cuts infrastructure costs for customers. How? By shrinking the attack surface down to grant permission to one app one user and one piece of traffic at a time. Permissions are based on client policy.

ZTE replaces an antiquated firewall and virtual private network (VPN) based philosophy in which every device & user within a perimeter gets perpetual and unconditional access. So? Zero Trust is safer, cheaper AND allows remote employees to responsibly work from anywhere.

Zscaler Network Security Definitions:

Zscaler GenAI Product Definitions: 

Zscaler Data Product Definitions:

More Sector-level Definitions:

As discussed last quarter, Zscaler signs 3-year contracts with customers. Macro headwinds during this past cycle were strongest over the first half of 2022 and the first half of 2023. Meaning? That weakness is currently being reflected in its scheduled, contracted billings growth. Macro headwinds abated during the second halves of both 2022 and 2023, which is why it guided to 7% billings growth during the first half of this year and 23% growth during the second half. Based on this context, 13% Y/Y growth was strong and better than sell-side expectations. This was related to outperformance in non-scheduled billings.

It’s always uncomfortable to bank on future accelerations to meet guidance. In this case, however, its forecast is not related to optimism or aggression, but observed data. Zscaler’s billings contracts are non-cancelable; it’s basing its second half optimism on already scheduled and signed business and pipeline conversion strength. For more optimism surrounding forward-looking demand, bookings rose faster than 30% Y/Y.

In the midst of rolling out several new products, Zscaler is optimizing for time-to-market and innovation, rather than input costs. This is leading to GPM headwinds, which will persist for the time being. It will eventually revisit all of this work to extract as much gross margin from the revenue as it can. Current headwind… future tailwind.

Next quarter guidance was ever-so-slightly ahead across the board for everything besides GPM. It guided to a “roughly 80%” GPM, which missed 80.4% estimates. For the full year:

Zscaler will trade for about 65x forward EPS and 43x forward FCF when the chart below moves one quarter into the future and based on the after-hours move. EPS is expected to fall Y/Y due to a sharp rise in Y/Y tax rate. EPS is expected to compound at 24% over the following 2 years. FCF is expected to rise by 9% this year due to more data center CapEx. Over the following 2 years, FCF is expected to compound at a 30% clip. Expensive. And for good reason, in my opinion.

Zscaler’s CFO announced his retirement after 8 years with the company. While I never like CFO turnover, he is staying with the firm until a new hire is brought in to ensure a smooth transition. And in addition to the team’s sterling track record, this is another strong sign of the breakup being amicable and there being nothing to worry about here.

Zscaler securing next-gen apps for its clients is a large growth area. On the public app side of things, it helps customers safely onboard and integrate tools like ChatGPT, Microsoft Copilots and Github Copilots with its “Zscaler for Copilots” product. It ensures they can embrace this massive opportunity, without jeopardizing security configuration and hygiene in the process. The Zscaler tool organizes and monitors data, scores AI app risk, implements principle of least privilege (nobody has access to more than they need) and fixes copilot misconfigurations. More generally speaking, as Founder/CEO Jay Chaudhry puts it, it offers “granular visibility” into and “control” over GenAI app and model environments. Chaudhry thinks this public app opportunity is as exciting as the Office 365 launch was for Zscaler product demand.

A larger attack surface simply means a growing need to embrace platforms like ZTE… and GenAI is rapidly growing that surface. During the quarter, public GenAI app security led to a 7-figure upsell with a Global 2,000 service company to protect the customer’s Microsoft Copilot introductions.

For private AI apps, the conversation was a bit more brief. Leadership spoke about prevention of prompt injections. Prompt Injections are cyberattacks that attempt to hack into GenAI models with prompts to take control of the model’s actions.

“We are expanding the private app functionality of our in-line, proxy-based Zero Trust Exchange with a large language model proxy to analyze prompt queries and results to detect and prevent prompt injections and other malicious activities.”

CEO Jay Chaudhry 

With Zscaler’s own ZDX Copilot, customers are “gaining visibility into end-to-end user performance issues.” This helps expedite time to issue remediation across networks. Now, it’s extending the ZDX Copilot utility to a new AI agent that “automates root cause analysis” and further shrinks remediation timelines. The increasingly powerful AI agent also now uncovers, flags and suggests remedies for network performance issues. All of this helped it land another 7-figure upsell with a “large healthcare provider.” To build on this product, Risk360, Business Insights and Unified Vulnerability Management, it plans to launch GenAI-powered breach prediction and threat hunting in the quarters ahead.

At the intersection of GenAI products and its budding data protection business, it recently launched automated data classification (including unstructured data from images). This significantly cuts the labor hours needed for that tedious task. ZS also launched app segmentation to help with optimizing access and permission controls. These products are already helping it stand out in contract bidding processes and find more revenue. And when you think about it, rapid adoption makes sense. Zscaler’s platform sees 500 billion transactions per day and is placed at the heart of traffic. This gives it a massive sum of data to understand what its clients need and to build it for them. It can continuously recycle these learnings to create more and more products in a hyper-efficient fashion. And it has nearly 50% of the Fortune 500 as clients to upsell to.

Zscaler introduced a conjoined ZPA and cloud browser product offering. With ZPA’s remote internal app access and web browser’s safe environment for public apps and data, Zscaler can now extend ZTE to a client’s 3rd party vendors. Competitors here are either point solution vendors or VDI-based vendors that are “complex to deploy” and are being readily “exploited by attackers.” To the team, neither of these alternatives match the streamlined simplicity and efficiency of Zscaler’s overarching product suite. This combined offering has already procured several sizable upsells for the company.

Zscaler’s emerging products are growing at more than 2x the pace of its core offering. While ZDX remains the biggest piece of this bucket, others are meaningfully contributing. Its cloud workload protection product led to another 7-figure contract. Branch-level network security and Zero Trust SD-Wan (Zscaler’s SD-Wan offering) are helping it win more 7-figure contracts while GenAI products materially contribute to growth. 

Zscaler secured two large upsells with a Fortune 500 insurer and another Fortune 500 pharmaceutical company. The insurer added ZPA and expanded usage of ZIA and ZDX. It’s now up to 70,000 seats (vs. 45,000 previously) for all three product pillars, while it also added data protection for those 70,000 seats. The customer wanted ZPA to “expedite M&A integration” as the product provides localized zero trust access without exposing existing networks to vulnerabilities. Chaudhry sees ZPA remaining one of its “biggest growth drivers” this year. Specifically, this product is now 40% of all upsell revenue vs. under 10% when it went public. The Fortune 500 pharma company was drawn to ZS’s data protection tools and ability to consolidate more than 3 point solutions. Both customers roughly doubled annual spend with Zscaler.

Within the public sector, Zscaler won a 14th cabinet-level agency (15 total). Like many of its other wins here, the client is starting small and represents a massive upsell opportunity down the road.

“With the new administration coming on board, we are all reading about the push for cost reduction. I believe that's a positive for us, for our federal business. This is because we reduce cost and complexity.”

Founder/CEO Jay Chaudhry

Per the company, ongoing investigations from countries like Japan, the UK, Australia and several other allies are leading them to realize a need for embracing zero trust architecture. Between its product offering and its well-entrenched, highly-regarded presence within the U.S. government, it should win its fair share of these opportunities. The U.S. often serves as compelling proof of concepts for international public sector expansion.

Generally speaking, 45% Y/Y growth in industry-level Internet of Things (IoT) attacks and 111% Y/Y growth in spyware are fueling continued need for Zscaler’s products. But it isn’t just the exogenous backdrop leading it to victory. Zscaler’s effectively-integrated platform is helping it secure all of these wins. Many competitors claim to offer a cohesive platform, but in the eyes of leadership, these are simply “disjointed point solutions” stapled together and falsely labeled. They add cost, complexity and vulnerability. Zscaler does the opposite. Chaudhry offered an example of a Fortune 50 retailer that purchased a “platform” solution from a legacy firewall vendor, only to realize what they really purchased was “consolidated billings and nothing more.”

Zscaler is now a few quarters into its go-to-market (GTM) overhaul. The beats this quarter were despite ongoing large deal scrutiny and were related to progress being made in this department specifically.  Its new Chief Revenue Officer (Mike Rich) has been tasked with beefing up Zscaler’s selling division with better people, better focus, optimized incentives and more global system integrator (GSI) partner emphasis. So far, the team is pleased with developments.

It hired a lot of new sales reps that it’s excited about and enjoyed better-than-expected sales attrition amid all of the change. Customer engagement was called “stronger” while leadership spoke about robust pipeline growth, higher deal closure rates and bigger contracts. It still has work to do on bringing in more people and training all of those workers, which is another reason why 2nd half of fiscal 2025 billings growth is expected to reaccelerate. It’s confident that sales rep productivity will keep rising over the coming quarters as it begins to match world-class technology with world-class GTM. We’re seeing Cloudflare (NET) and SentinelOne (S) undergo similar transformations.

I see what the stock price is doing after-hours… That does not affect how I feel about these results. Strong quarter in my view. Some buy-side pundits were expecting a slightly higher billings number, but it comfortably beat sell-side consensus in this metric and every other one. I hope “the beat should have been a little bigger” is the most pressing issue in all of the quarters that I cover. That’s a high-quality problem.

It continues to take market share within its core offering and briskly expand Y/Y margins. It continues to rapidly innovate and create more avenues for cross-selling. It continues to delight its customers and enjoy rock-solid retention and net promoter score scores. It continues to print cash and boast a pristine balance sheet and ample flexibility. It continues to be led by one of the most underrated founders in public markets. And? It continues to win. If the stock price opens around $190 tomorrow morning, I will be adding to my stake. I will update Max subs in real-time as always. We shall see what happens.