Zscaler, Inc. (ZS) Earnings Call Transcript & Summary

Good afternoon. I hope everyone is doing well and staying healthy. I'm Nick Yako, Cowen Security Analyst. Joining us today are Jay Chaudhry, Zscaler's Founder and CEO; Remo Canessa, CFO; and Bill Choi, VP of Investor Relations. Guys, thanks for being here.

Thank you for being with us.

Maybe before we jump into Q&A, I'll turn it over to you, Jay.

Nick, thank you. Thank you for the opportunity. I'll take a few minutes to set the stage. I founded this company with a simple notion that once cloud and mobility happens users will want to access any application from anywhere. And what you see on this diagram on the left side is the old infrastructure architecture. It can be described in 2 words: hub-and-spoke network and castle-and-moat security. You are securing the network user security. In a new world, when you are anywhere and everywhere and applications are anywhere out there in Office 365 to AWS to Edge to data center, that model just doesn't work. You can't stretch that old firewall kind of technology to solve the connectivity problem. So it's -- we built a cloud-native platform and we act like a zero trust exchange, almost like an intelligent switchboard service. A user connects with us, we connect the user to an application or service. The notion of inside the network, outside the network goes away. There's no room for firewalls, no room for typical on-prem technology. So that's really the architecture customers are driving towards as they are doing transformation, and that's where Zscaler starts playing a very, very important role. In terms of how we do it, I'm zooming in a little bit. You can look at all applications in 3 buckets: external applications that an enterprise doesn't manage, they simply access them; their internal application for the employees; and a B2B application for their B2B customers. Zscaler is sitting as a switchboard as an exchange in the middle. A user connects with us, we validate the user, we apply the policy, a business policy and connect the user through external applications through ZIA or Zscaler Internet Access product line that make sure nothing bad comes in, nothing will leaks up. And to internal applications, we use Zscaler private access that make sure that your application is safe, they are invisible, they're hidden, they can't be attacked and only the right user can access. And for your B2B customers, which is becoming more and more important every day, we have an offering called Zscaler B2B, built around the same zero trust principles of ZPA. It makes access to those applications simple without having to buy and deploy any technologies. And then ZDX is a zero trust digital experience to make sure a user has great experience when they're accessing these applications from anywhere. So those 4 product lines are there to help us protect their users, and that we have done very well. Now our next natural step was to start protecting applications and cloud because a lot of data is sitting there. For that, we have done 3 things. API-based CASB, or we call out-of-band CASB are recently released. It's doing well. We're closing some deals. CSPM, that is Cloud Security Posture Management, that functionality came to us through acquisition of Cloudneeti. And lastly, yesterday, you saw Zscaler's acquisition of Edgewise Networks. This will allow us to do application-to-application secure communication to be able to do micro segmentation in the data center so you don't need any firewall type of traditional network segmentation technology, so with the portfolio goes from protecting users to also protecting your data in a cloud or data sitting behind applications. And lastly, last slide, what does the blueprint architecture look like in this new world of cloud and mobility? In this new world, it doesn't matter where you work from. So at the bottom of the slide, I'm showing you users sitting anywhere and everywhere. On the top, I'm showing application, they should be viewed as a destination, not a part of your network. And Zscaler sitting in the middle as a zero trust exchange or a switchboard service. We make sure the right user has access to right application security. There are 4 key areas of partnerships, technology partnerships as a part of the ecosystem, identity providers like Microsoft, like Okta, like Ping and many others. These logos here are only example logos. We like to work with all leading players in all of these 4 areas. Endpoint protection and management is very good partnership area for us. We've done integration there. Security operation, we can feed logs to Splunk, to IBM, to Microsoft, Azure, Sentinel in real time. And lastly, we integrated SD-WAN vendors with router vendors so the traffic from branch office or a data center can be sent directly through Zscaler cloud. So having good integration helps our customers to easily deploy and operate the stuff. And this simplifies the whole thing, increases security, improves user experience and ends up resulting in tons of ROI. So with that, Nick, let's move on to our dialogue.

Great. Thanks, Jay, and thanks for that overview. And I think it's fair to say you guys have been talking about this architecture for over a decade now. But when you think about the adoption of cloud-delivered security stacks, how have your expectations changed in terms of where you thought we might be in the adoption curve 2 to 3 years from now and then ultimately, what that could mean for a Zscaler's trajectory?

Yes. When you come up with something disruptive and innovative, you have to evangelize. There's no other way to do it. We have been evangelizing. Then along the way, there have been some tailwinds that have helped us. SaaS applications were the first big tailwind and Office 365 became the mother of all SaaS applications because there is so much traffic. The SD-WAN has been offering another tailwind for us, and traffic moving to public cloud is helping us. And in the past 2, 3 months, as COVID-19 happened, it actually has changed lots of mindsets because employees suddenly had to work from home. They have to access all those applications, the vision I've been talking about. So COVID-19 is actually accelerating digital transformation. CIOs are suddenly finding that the corporate network that they are spending so much money with is not even needed because when you work from home you aren't really on the corporate network at home. So this acceleration is helping customers to become more agile, faster. And also, it's helping them to save money because every CFO and CIO is under pressure to cut cost in today's environment. So the one change we have made in the past couple of months based on the input from our customers, we have a bigger portion consolidation of point products to simplify and save cost. So we are seeing this requiring less evangelism now and more of being able to scale and engage with customers.

Right. Right. Well, that's a great sort of overview. And I guess, there -- obviously, there's been a lot of focus on ZPA this quarter. But could you -- maybe going against the trend, could you maybe speak to ZIA's performance and sort of your ability to manage deployments during a time when most organizations were under some form of lockdown?

Yes. Thank you. Yes, those are 2 questions. So the first question, when you work from home, you need both ZIA and ZPA because ZIA will secure you against all the Internet threats and ZPA lets you go to the data center. But the reason you're hearing more about ZPA is because lots and lots of our customers -- ZIA customers who have been buying Zscaler for years while ZPA is the relatively new product. So when COVID happens, they found that their employees were safe who go to the Internet with ZIA, but they needed ZPA. So it is easy for them to pick up the phone and call and say, I need ZPA deployed next Monday. Hence, there was a big push. So we saw a lot of uptick on ZPA because the customers who know you, upsell is easier with them. Having said that, we had a good number of ZIA deals. Our ZIA had very good growth in the quarter. And in addition, we had a good actually uptick on ZIA and ZPA sales combined. There are many customers who are only looking for buying ZIA before COVID, actually added ZPA along with it, and it kind of became the joint sale. So overall, good traction across the board, but ZPA was outstanding because of the customer base. The second part of the question was deployments. This is one thing I actually discovered. We used to talk about network and when this thing happened, the Siemens called us. And if I recall, the CIO reached out to me on Thursday. Monday, March 14 was the day when Europe went in the shutdown. She said, we have been a happy customer with 350,000 employees using ZIA. I need ZPA deployed in the next 2 days. And on Monday, I want everyone to do the ZPA, wait a second, I mean you don't even know who your users are, I mean they're in every country out there. But it took us about, I think, 3 weeks to get over 200,000 people deployed, literally. I mean all that stuff happened now, why is deployment easy? Because to get Zscaler going, all you need is deploy a lightweight agent on your laptop. This agent figures out. She's ZIA traffic, ZPA traffic. No other thing is needed in our cloud. You define in the policy and you integrate with the directory service like I'll tell you that. So in fact now, our preferred approach is not to touch the network, just go directly over the Internet, which is what we have been talking. Siemens, our early customer, 4 years ago said, my corporate network is Internet these days. So deployment is not an issue at all. We had record time in deploying ZIA and ZPA.

Right, right. And I guess there's also a shift in terms of the traffic patterns. I guess the question would be sort of how did you guys contend with the change in patterns from, say, thousands of locations to millions of users homes in a short period of time?

Absolutely. So there are 2 big traffic shifts we had to deal with. One was for ZIA where we get in the so much traffic, 100-some billion transactions. 80% of used to come from branch offices, maybe 70%, but 20% to 30% used to come from individuals from home or hotel or airport. Overnight, the pattern shifted. So if your cloud is architected right, so it could take literally -- I mean, we are probably taking 20 million connections every day from individual users. It all worked fine because we do have a very scalable architecture, and we got some notice because early February is when China started going into shutdown mode, and we had about 1.5 months to make sure we all are ready for it, we expected it. And for ZPA, it's just the traffic went through the roof, while it came from a small base. But literally, going over 10x. So that's where the architecture was scalable, but we did need to get some help to use a public cloud like Azure and AWS, where we could spend some of the services quickly. But we did realize that those things are too expensive, and we're moving the traffic back to our own data center, which is happening in the next few months. But it was a lot of hard work but it was very satisfying because we are not just selling stuff, we were actually helping to keep the economy going because this economic activity is so important for the livelihood of millions.

Right. And maybe one for you, Remo, on that topic. I think we saw sort of the impacts from the spend with Azure and AWS sort of weigh on gross margins. So I guess the question would be, do you think that this is temporary? And sort of can you talk about sort of the course from getting where you are now to maybe back to that 80%.

Yes. I'm happy to. So if you look at the gross margin impact in Q3, we came in at 79.54%. The impact to gross margins related to AWS and Azure was about 2%. So the entire margin decline was basically AWS and Azure. We'll be deploying servers in Q4 and through Q1 into our data centers. That has already started. We've shipped about half currently. We're currently procuring half additional. We expect gross margins to be in the 76%, 77% in Q4, going to 78% in the first half, then 80% in the second half. For me, what it speaks to is just the strength of Zscaler's platform. With 10x increase in traffic, there's no disruption to our customers. The quality that they receive, the quickness that they're brought on, there's absolutely no disruption. What it also shows us, which is what Jay talked about is that the cost, the cost associated with ZPA, which doesn't have nearly the compute of ZIA, the impact it had on our gross margins was pretty significant. What that tells me is that other companies trying to duplicate what Zscaler is doing and trying to do it through the public cloud it's going to be very, very difficult. That shows the strength of technology that Zscaler has created. And it is a significant competitive advantage for Zscaler.

Right, right. And obviously, there was a surge in demand for ZPA in the quarter, Jay. But do you expect demand levels to remain at what you saw in the first quarter? Or do you expect a lot of that is behind you?

Actually, we see demand growing, but nothing will grow the way it suddenly grew overnight. But the common question being asked out there is, do you see the traffic going back when the employees come back to the office. We actually don't because in -- with CPA, whether you're sitting in the office or you're sitting at home, you go through the same switchboard exchange that Zscaler offers for better security. So you never own the network where the applications are. So we like the fact that it has accelerated this transformation trend and the opportunities we are seeing are better. And it's largely because a big part of it is that CIOs have become confident that they can do business over the Internet, and they don't need to spend tons of money on their network. So I see that role of network getting diminished as a result of when customers saw they could do all the work without their own corporate network.

Right, right. Okay. Maybe pivoting a little bit. If I think back -- I think most of us were blown away by Dali's presentation at RSA earlier this year, just given the magnitude of initiatives and the speed at which you guys were able to operationalize a lot of those programs. But I was wondering if there was maybe 1 or 2 examples you could share where you saw these in action or saw an opportunity materialize that maybe wouldn't have prior?

Yes. Yes. So if you look at what we talked about at RSA, when Dali gave the presentation and my earnings comment, we had a pretty scientific process where we had x number of things that had to be done. One of the important things are to do something like PG, pipeline generation. There's a process with certain tools that salespeople actually are engaged for 1 day a week at least, figuring out new opportunity. And that has made a huge impact in making our pipeline stronger in Q3 and for Q4 and beyond as well. And there are other aspects of it. But since you said, highlight one thing, I think that will be one thing. I want to give you one more since it's so important, increasing sales capacity and training them properly was very important. So we've done a very good job in hiring and catch up on our plan. But the training program, the enablement we had done was very good. We had to shift it to the virtual training for our sales organization. But we got adjusted to very well, and people are well-trained to carry the right message. So we have a repeatable sales process with far better consistency than we used to have before.

Right. Right. Okay. No, that makes sense. And Remo, maybe one for you. And I know you guys are providing sort of guidance for next year. But as we sit here and think about where the company is going to be, I guess, in a year, meaning you're going to have 60% greater sales capacity. ZPA is maybe hitting nerve. And you have B2B ZDX and some of the acquisitions you've just done. Is there any kind of framework or qualitative comments that you could offer that could help us think about sort of growth over like exiting this year?

Yes, good question. We're still -- I feel we're still in the early innings related to this transformation. Jay and I talked about it a lot related to what kind of investment are we going to make, we're going to continue to invest in the company when we see this market opportunity as big as it is right now, which we feel is bigger. We are -- from a -- when you look at the framework, of where we think we're going to be. Think about the $800 million to $1 billion, we expect to be in that 20%, 22% range operating profitability at that time. So how we get there, what type of investments we make. That's going to be fluid. Of course, it's going to be fluid on the part of myself and Jay and others on the executive staff, making the right decisions how to grow the company. It is a unique position that we're in, a very, very unique position, and we don't want to shortchange ourselves and be a penny wise and pound foolish. But having said that, both Jay and I come from somewhat background sort of related to, I think, fiscally responsible. And you can see from our cash flow from the very beginning, we've been positive free cash flow with positive operating profitability. We understand the importance of increasing our profitability. We're going to do it in a way that we feel it's going to maximize shareholder value.

Right. I know it's early for some of the new products like B2B, digital experience. But how should we be thinking about the contribution from those products over the next couple of years?

I wouldn't think much for that contribution in fiscal '21. In fiscal '22, I would expect it to increase. How it increases? We'll see. But I think that if you think about the path that ZPA was going from like 2% to 4% of new and upsell to 10% to 14%. And I think along those lines, that's what we're thinking. But this next fiscal year, I would not think about a whole lot of contribution.

Okay. You guys had an interesting announcement out this morning around the partnership with the DoD. I'm just wondering if you could talk about that and maybe talk about how that may jump-start your federal vertical.

We have been talking about the investments we have been making in federal vertical for the last 2 years. We had to go through a process called FedRAMP certification, which is treacherous. I mean it's just long, very, very strict. We got FedRAMP certification at a medium level, at the high level. And FedRAMP is needed for civilian agencies. And then DoD agencies need FedRAMP plus some more testing on their own. So DIU, which is department -- the defense innovation unit of Department of Defense that they gave us the initial order to foo and test that which gives us the freedom or license to sell our offerings to any agency and Department of Defense. So it's the first step to make it happen. But certainly, it opens up much bigger opportunity for us. And this is a result of a lot of work that got done over the past 2 years. We are very excited about it. The timing of these federal things, it takes its own time for some of these things. But we have a team in place in federal team, pretty good-sized team for the last, what, 15, 18 months. And we're seeing very, very good growth in that area.

Right. And will that follow more of a private cloud type of deployment or...

So yes, first of all, even for non-defense, this is a private separate cloud for even civilian agencies, and DoD takes it to a next step where it's totally private cloud. And that's where we have partnerships, some of these big public cloud vendors who can work with us for that area.

Right. Okay. I have a question from the audience. Asking if Zscaler intends to get into additional markets over time, like identity, endpoint security or access management?

Right. Is my slide still shared or it's not? It's probably not. Do you mind if I share the slide because this helps get a good picture. Nick, you can see the slide?

Yes. I could see it.

This is our partner ecosystem. And you talk about 4 areas of partnerships. Those are important partnerships for us. If you go back to the previous slide I shared with you guys and the product line we have already available with us. It's pretty massive TAM. I don't think product lines are holding our growth from any stretch. So -- but our focus was, one, user protection, being in the middle, enforcing policy; and second, getting to data protection in the cloud. And that's where you've seen us do with CASB, CSPM, APIs -- CSPM and Edgewise acquisition. But we won't really jump into random, adjacent markets like some of the other vendors. Take, for example, endpoint, there's nothing common from core competency point of view, to offer endpoint products and to sit in line to enforce policy. I have not seen a single vendor ever succeed in the gateway market and endpoint market at the same time. And it's because of competency. So we will not jump into these adjacent markets but we have very clear vision into protection of data in the data center [indiscernible].

Right, right. Makes sense. And another question from the audience, and I know it's one of your guys' favorites, but it's on the competitive market. And any changes that you've seen from some of the more traditional network security firewall vendors and/or your thoughts on some of the growth that they may be seeing in their cloud products?

We haven't seen much names in the comparative landscape. We always led our sales from transformation point of view. It's generally top-down C-level led sale with architectural transformation. It's rare that we get into a breakoff, which is typically how it gets done in the appliance world. In the space, we are playing at the enterprise level. Firewall guys don't really play with us. Our competition has traditionally been in that space, proxy vendors Symantec, Blue Coat has been incumbent there. McAfee has been there. Cisco has been there. All these companies quite could go a cloud using their single-tenant architecture. It hasn't worked. So it's kind of fading away. At least they had, out of the 2 key technologies, which are multi-tenant architecture and proxy, they had one right, okay? But they didn't have multi-tenant. Now as you look at the firewall vendors, they don't have multi-tenant architecture, and they don't even have proxy architecture, which is needed for proper inspection of traffic to detect threats. So I think probably, I'm sure they'll have some opportunity in the lower end of the market, the market that's not security-sensitive. But if you talk to most of these, 80%, 90% of Global 2,000 companies, they require a proxy because they care about security. And we don't feel there's a threat on the high end from legacy firewall vendors.

Right. Okay. And maybe on that point, do you think with COVID, do you think that architecture design becomes more or less important moving forward?

Yes. So COVID basically said, you want to be able to work from home. When you work from home, you're not on the corporate network at home. You go to the data center, you go here, you go there. It literally -- it fulfills our dream. So I think it is accelerating the vision we talked about and it's making network security and traditional network more irrelevant, much faster.

Right. And I guess you guys have talked about sort of local Internet breakouts, SD-WAN as being drivers for you guys over the last couple of years. Do you think that dynamic changes?

It already has. Okay. So if you think about where the world had to go, the world, if I show the slide again, world came from network security. You're all sitting on the network, everything coming to the data center. The first natural step was maybe call it a baby step, do local breakout in the branches and let branches go out directly. What's the ultimate step, go direct from wherever. What's the difference between you're sitting in a branch office versus you're sitting at home or a coffee shop? There shouldn't be any. COVID-19 forced people to be able to work from home and they certainly realize that I can work from home without using my corporate wide area network. So we think the role of network has got diminished, the role of Internet as a network has become more important. That shift has actually has helped us with massive deployments much faster. While when customers go back in the branch, I'm sure they'll pick up some of the SD-WAN projects. But right now, SD-WAN projects got -- going on hold because there's no one in the branch offices. So the phenomena is helping us to get to the end state. While when they do deploy SD-WAN, they still need security like ours, we won't be securing those SD-WANs. But the urgency of doing local breakout becomes less when you can protect any user from anywhere all the time.

Right. Right. Okay. No. Well, I think we're unfortunately out of time, but thank you, guys, for making the time. And...

Great. Thank you. We appreciate the opportunity. Bye-bye, Nicholas.

Thank you.

Thank you, everyone. Bye.