Zscaler, Inc. (ZS) Earnings Call Transcript & Summary

Great. Hello, everyone. Thank you for joining us for the Zscaler presentation. I hope day 2 of the conference is off to a good start for everyone. I think we've been hearing throughout the conference so far that big shifts in the market, things like cloud delivery and cloud security are likely more in focus after COVID disruptions. So Zscaler is cloud security, so very timely and should be interesting, especially after strong results reported just last week. So I'm lucky to have Jay Chaudhry, CEO and Founder of Zscaler; also have CFO, Remo Canessa; and Bill Choi, Head of IR, on the call. So first, guys, thanks very much for joining us. And maybe I'll kick it off with asking you, Jay, to set some foundation for the discussion before we dig into the products a bit more.

A simple question that I'm sure you answer almost every day, what is different about Zscaler's architecture, and why is it built for the future of network security?

Thank you, Dan. Thank you for the opportunity. Technology evolves all the time, and you can do incremental changes to improve upon. But from time to time, when big changes take place, for example, from on-premise to cloud, from work in the office to working from anywhere, incremental changes can't be done. Security has been done by doing network security. You secure the network. Firewall is a network security device, for example. But when your applications are anywhere out there, your users are anywhere out there, you don't control the network. You cannot secure the network. You cannot do network security because network security is about building perimeters and protecting it. So Zscaler had to take a totally opposite approach, and we say we do not do network security. We aren't like a Zero Trust exchange. We are like a very intelligent switchboard sitting in 150 locations around the globe. So any user of any of our customers connects to through our switchboard, we look at the policy, we connect the user to a right application or service. There's no such thing inside the network, outside the network. We don't deal with IP addresses the way network devices like firewalls do. So unless someone creates a clean multitenant architecture, that's like a Zero Trust exchange. You can't take those firewalls and stick them in a public cloud as a virtual machine and say, "I'm cloud security." I probably quoted a few times that you can't take DVD players and stick them in a data center and say, "I'm a Netflix streaming service." So that's the difference. And that's why you can't build it overnight. You can add features to something, but you can't build the architecture. It has to be done from a scratch. Just like Salesforce did to disrupt stable software and Workday did to disrupt PeopleSoft, we have the same opportunity.

Yes. I think that's a great start. And for the new listeners on the call, Jay, can you also just quickly explain the difference between your 2 main products today, ZIA and ZPA?

Yes, absolutely. Security starts getting confusing. But in a simplistic way, if you think about it, a user needs to access applications to do their job. Those applications fall in 2 buckets. There are external applications like SaaS applications or open Internet that an IT organization doesn't manage or run. They simply make them available to use. And there are internal applications that run in your data center or you may be moving them to public cloud, like AWS and Azure that your IT team builds, runs and manages. The risk is different from each side. When you go to the Internet or SaaS, you're worried about cyber threats, something bad coming and infecting you or you're worried about something leaking out of your company and going out there. So for that, we do full inspection, including SSL inspection to make sure nothing bad comes and infects you and nothing leaks out. Different technology, different inspection, that is ZIA, Zscaler Internet Access. Now on the other side, when you go to access your internal applications like SAP, maybe your internal HR or expense applications, you're not worried about getting infected from SAP, you're worried about who all can get into it or can SAP be attacked with the denial-of-service attack. So for that, we built ZPA. Zscaler Private Access hides your application behind, so they're not visible through the Internet, and we make sure that through Zero Trust, we connect the right user to right application without putting people on the network. So ZIA and ZPA combined allows any user to access any application securely from anywhere, which is what work from home needed. Once you have ZIA, ZPA to work from home, you don't need any part of the network. You don't need any of the other security -- network security devices or technologies. Of course, you need things like authentication, but ZIA, ZPA become very critical part to enable work from home.

Right. So with that foundation set, I did want to then ask about the big drivers because sometimes investors talk about your history and say, Office 365 was the big driver or it's an SD-WAN cycle that's driving deployment of Zscaler. Maybe now it's work from home. But can you kind of list out the top drivers? And maybe you can touch on, if that's even the right way to think about it. It seems like there are many, many market tailwinds for you guys, but maybe walk us through the biggest ones that you're seeing today.

Right. So the fundamental notion of Zscaler was any user can access applications anywhere. So the more applications move to the cloud, the bigger the need. The more people use Salesforce, ServiceNow, Office 365 and the like, the bigger the need because you don't want to go back through your old data center to go out. Now all SaaS applications are driver. The reason Office 365 became the big driver is because the amount of traffic going to Office 365 is massive. It just overwhelms your network. So that is a big driver, but so are all SaaS applications. So it's one part. Two, as your applications -- internal applications are moving to public cloud like Azure and AWS, in the old world, you went through your data center and then from the data center, you went on a dedicated line to those public clouds, slow, you're finished. Zscaler can allow you to directly go there. So those applications became an important driver for us, public cloud applications. Three, as Dan said, you got SD-WAN. So what is SD-WAN doing? SD-WAN says, "I can easily allow you to start doing local breakout with a new generation device that can be cloud managed." Zscaler does not require an SD-WAN to do local breakout at the branch level. Any Cisco or Juniper routers can do it. It's just that the newer routers are. SD-WAN boxes are easier to do it. So network local breakout is a good step to do what Zscaler does, but the ultimate step is any user from anywhere can go out there and benefit from it. So do we really need SD-WAN as a part of our WAN? We don't. We actually really need work from home as the biggest driver because every employee could work from anywhere, not just the branch office. Yesterday, we had a company-wide all-hands meeting, and I had a CIO on the call sharing with my employees what he is doing and how he's thinking. And one comment he made was the following. He said, "I have 70 offices globally, 7-0, and has 7,000 employees." So yes, Zscaler could do local breakout from 70 offices. But now I have 7,000 branch offices because each employee is working from her home. So each employee is going direct with ZIA and ZPA. So we think, while network transformation is a good interim step, the real final step is anyone working from anywhere, and as you have 5G phones or you have 5G chip in your laptop, you'll have 100 meg connection going directly. You won't even get connected to the local Wi-Fi and the Internet. And we are actually getting you ready to do all of that. So many tailwinds. We just need to make sure we focus on the right one to take advantage of it.

Right. Right. And so what you guys are doing, your approach now does have a term that's getting popularized in the market, and that's Secure Access Service Edge, or SASE. And I should say, Jay, it's nice enough to join us again this afternoon for a panel discussing SASE in detail.

Yes.

But for now, I want to touch on SASE and the potential integration with SD-WAN because some definitions do have it integrated with SD-WAN. And we had a very interesting presentation by Cato Networks yesterday. And he was discussing, having an approach similar to Zscaler but pairing it with SD-WAN. Even though they get put in the SD-WAN bucket, he actually made it sound like he agrees with some in the market that SD-WAN is becoming somewhat of a commodity service, and there's little differentiation at the edge there. So Jay, just want to put a finer point on your thoughts about partnering with SD-WAN. And why not more tightly integrate with SD-WAN and potentially go into that market.

So looking at the discussion we just had, look at the comment of the CIO I shared with you. 7,000 branch offices. And while each home is a branch office, where do you put SD-WAN in that world? You don't, okay? So SD-WAN has a role to play where SD-WAN has a cloud-managed box in a branch office is good rather than the old legacy router,, which cannot be centrally managed from the cloud well. But as you said, we think SD-WAN, the branch box will become commoditized over time. And also try to put security in the SD-WAN box. A good security is not very practical. So now you have to do security in the cloud. The Gartner SASE doesn't say that you must have one integrated solution from one vendor. The Gartner says that the SD-WAN should be integrated with the security cloud, so customers can easily deploy and manage it. And that's the approach we have taken. If you really look at it overall, the networking vendors and -- no networking vendor has really provided any good security ever, okay? They attempted to many, many times. And no security vendor has ever provided networking because the core competency to do the 2 things is very, very different. So we have chosen to make sure we have the best security cloud that can take traffic from any SD-WAN vendor, and we're integrating with everyone from Cisco to VMware, VeloCloud, Silver Peak and all these vendors So we'd like to -- here's how I say it, best-of-breed platform is what Zscaler is. We don't think there will be a God platform that puts the pieces together. When you try to bring SD-WAN at any point and even the same things together, you don't do well anything. We're sitting in line for traffic inspection and a policy engine and Zero Trust exchange are far better than anything out there, and that's our positioning.

Right. Right. Makes sense. And I'm curious, when you see customers deploying Zscaler, what legacy security products are they maybe ripping out? And maybe as part of that question, maybe it's best for Remo. What are the typical cost savings that a customer can be looking at when they're switching to Zscaler?

I'll start. And Remo, you can take the second part. So if you think about the old architecture with network security, it's called castle and moat architecture because you're protecting the castle, your data center. And there's a drawbridge to go out of the castle, that's called outbound gateway. And there's a drawbridge to come in, that's called inbound gateway. Each gateway has a bunch of security boxes. With ZIA, we replace the outbound gateway. With ZPA, we replace the inbound stack. So think of this way, an employee sitting at home, going to access Office 365, Salesforce, LinkedIn and SAP within the data center. When you go through Zscaler with ZIA and ZPA, you don't really need any technology in the middle to do anything. What you do need is a few other things. We -- you'll need identity, so we partner with identity providers like Microsoft Azure Ad and uptime Ping. You need to be able to feed log somewhere, so we integrate with logging companies like Splunk and Microsoft Azure Sentinel. You need some endpoint protection. We integrate and partner with CrowdStrike, VMware's Carbon Black and Microsoft. So it's just the picture becomes very simplified. Rather than having 15 vendors, you can probably come down to 5 vendors. And that's where consolidation comes, that's where simplification comes. In today's COVID world, there's a lot of pressure on every CFO and every CIO to consolidate and save money. Actually, our message of cost saving has become far more attractive now than it was before COVID-19. Remo, over to you.

Yes. Thank you, Jay. Two years ago or a little over 2 years ago, we had a couple of cases or customers that had cost savings of 60% to 70%. That was primarily MPLS. That's the cost of the connection between the branch to the headquarters. That's still cost savings. But as Jay talked about the consolidation, going to one vendor, decreasing the number of point products, there's significant cost savings with that. There's savings related to support. There's savings related to the people who have to maintain these -- all these point products. With Zscaler, we point the traffic and we take care of everything. Complexity goes down. So the actual percent savings that you get is -- or the support savings for internal people or external people you have to hire to manage your network -- security network goes down significantly. The difference between a perpetual model and a SaaS model is you got to pay for everything upfront. So basically, that is a major cash out way. With Zscaler, which you have is you have a subscription model.

Yes. Remo, one other point I'll add is the following. Think of how much gear you have sitting in the data center that's related to do network infrastructure and security. The more traffic go through your data center, the more gear you need to buy, more routers, more switches, more firewalls. Today, when traffic is going from home to the cloud and to the Internet and wherever, you don't need all of that gear. At least, you don't need to buy more. You may not replace it overnight, but you'll stop spending money and upgrading those boxes and everything. So there are related cost savings from infrastructure and security that's sitting in the data center because it no longer needs to be enhanced or increased for capacity and volume.

Right. Right. So I think this conversation is definitely emphasizing how unique Zscaler is in the market. But still, I'll try to ask about competition. And maybe besides inertia and team just not wanting to change, who are the biggest competitors in your mind today? Or when you actually have to respond to RFPs, who are you up against most of the time?

Yes. It's rare when we actually get an RFP to respond to because when you drive transformation, it's a new area. There's not a whole lot of RFP. Now there are some RFPs coming in the network transformation space. And those RFPs generally go to service providers. And most -- a large number of times, we have been actually educating a customer to say you need to do local breakout. And quite often, all these service providers end up actually proposing Zscaler for it. So what else would they propose? They could kind of say, "Okay. Here's a Blue Coat. Here's McAfee." In large customer RFPs, they require a proxy architecture, so it's generally limited to proxy vendors. Now on the lower end, sometimes we do see Palo Altos of the world pitching. But on the higher end, that's our sweet spot. The customer is too sophisticated, and they require security. And for security, you must do SSL inspection on that traffic. A firewall can technically claim they can do SSL inspection. But practically, it just doesn't scale because it is not the right proxy architecture. It is a pass-through architecture. So has much changed from competitive landscape for us in the next -- in the past 2 or 3 quarters? Not really. Now are you going to find some customers out there for doing some firewalls? Probably, yes. But if you look at the large customers, they don't really take firewall as a serious solution when it comes to cloud security, when it comes to threat protection. So our goal remains reaching out to CXO level, being able to show them the simple architecture, which requires no firewalls, no perimeter. And that's what we have kind of enhanced in the past 2 or 3 quarters. When we told you that we needed to beef up our sales enablement, we needed to scale our sales process, make it repeatable because we were going from scores of sales reps to hundreds of sales reps. We are going from a dozen or 2 sales leaders to several dozen sales leaders. All those efforts are actually bearing fruit. And we're very happy and pleased with the changes we've gone through in a fairly short amount of time in our sales execution.

Right. I wanted to get to the sales execution later, but now that you mentioned it, I'll sneak it in here. You guys talked last week about how you're still on track to hit your hiring targets by the end of your fiscal year. Can you also just talk about -- are you on -- or meeting your targets for productivity of these new sales hires? Or is it more difficult to get the productivity up in this environment where it's all the virtual selling, it's a different go-to-market motion, different conversation around work from home versus SD-WAN? If you can talk about productivity as well as your hiring plans for this year.

Remo, please.

Jay, I'll talk first. Productivity in the quarter was up. So Q3 sales productivity was up. Again, it was a great quarter for us driven by work from home, digital transformation. But as Jay talked about, we've made a lot of progress over the last 9 months. And sales enablement piece, which is an organization that trains our sales reps, trains our channel, trains our SEs, and from what I've had in my career, absolutely outstanding. So anecdotally, it appears that even in this environment, where people are working from home, our sales reps have been working with customers through web conferencing. Anecdotally, the new hires we're bringing onboard are gaining up to speed faster. And I think the reason for that is the overall structure that's been put in place to the sales organization, in particular, our sales enablement group. And Jay, I'll turn it over to you.

Yes. So a couple of points I'll mention. I was worried about the number of face-to-face meetings going down in hall and what will that do to impact us because I personally meet lots of CXOs. We have a team of CISO, CXOs who get in front of CIOs, CTOs as a part of our sales process. And we have architects who do architectural workshops. I tell you to my surprise, it's a lot easier to get a CIO or CTO or CISO on a video call than it used to be to get to a meeting with him because he or she would be traveling often, and I would be going to the same city and say, "Sorry, it's the third time. When you are coming, Jay, I'm not there." So we're able to have a lot more meetings now with the C-level than we were able to have before. So it's very, very good. Two, on the architectural workshop, similar thing. Now we -- the technology is easy and modern. Look at how quickly we can get on Zoom or Microsoft Teams to do video session. And the white boarding, I can take a surface pad and start drawing and start showing the customer the white boarding. So our architecture workshops are doing well, too. So in terms of our sales engagement, which we measure as a leading indicator of our business, which is new business sales meetings, if we measure that, architectural sessions, we measure that, C-level engagements, we measure that and proof of value, which is a business-centric version of proof of concept, we measure that. All those metrics have gone up during this whole time. So I personally actually now plan to travel less, do far more meetings via video calls because they're pretty effective.

Great. Great. That sounds good. And I want to shift gears to zero in on the COVID impact a little bit more while we have a little bit more time here. The -- maybe we can go product-by-product. Starting with ZIA, can you kind of walk investors through how to logically think about the impact of COVID, both positive and negative in the near term?

Sure. So if you think of COVID, means securely work from home because you can't go to the office. When you need to work from home, you need to access external applications and internal applications. So you really need both ZIA and ZPA to be fully safe. So our growth of ZIA has been good. It was good in the third quarter, even though ZPA growth became exceptionally good because ZIA was needed. So customers who needed to buy ZIA, they actually accelerated some of those things. We had a far larger number of deals where ZIA, ZPA combined was bought upfront than before. Again, because they need both. New customers needed both, and we sold quite a few deals with together ZIA and ZPA. Now the reason the ZPA growth was outstanding is because current customers are easier to sell than getting new customers. So that upsell growth came from 2 sources: one, customers who had already bought ZPA but had bought it to a subset of total users, probably somewhere in the 25% low end to about 60%, 65% on the high end; and because that's all they had where people were working remote. For work from home, everyone is home. So that number essentially went up to 90% to 100% in most cases. So there was upsell to existing ZPA customers. The second came from many ZIA customers had been testing ZPA or were discussing ZPA, but the urgency was kind of there, but not there. It's okay, we can do it next week or next month. And when this thing happened, it just overtook. This happened, and they basically wanted to go and get this done. And those deals happened pretty quickly. Take, for example, I mean, someone like Siemens, 350,000 users around the globe. ZIA -- very happy ZIA customer. They have been playing around ZPA for a while. They loved it. They had all plans to do it. But the plan said we're going to roll it out over the next 9 months or something like that. Because when you're in 185 countries, you have so many business units, different CIOs. You don't even know which user, what plan is. And guess what? A call came to me from their global CIO on Thursday. This is Thursday before Monday the March 14. She's saying, "I want all users to be rolled out for ZPA on Monday." Okay. Why? Okay. Yes, it took us about 2 weeks to get all of them done, not because of the technology, not because they had to be ready on their end, some users weren't on a proper directory and whatnot. But that project accelerated. So there are many, many such opportunities where things happen much faster. So ZPA benefited from our existing installed base. ZIA and ZPA both benefited from new logos. I hope that gives you -- gave you fairly good color, a little bit long answer.

Yes. No, that's perfect. And I actually -- I have a good follow-up question from the audience. And I encourage everyone in the last 5 minutes, if you do have a question to type it into the box, and I'll try to get to it. But the question is about the risk that this is a temporary spike or the risk that there are temporary spikes in demand due to work from home. And then these customers can potentially turn that off when people go back to the office. Are you guys able to assess that risk?

Yes. So I'll give you my views. When we offer customers our short-term contract that you can have a 3-year -- sorry, 3 months and then go to a year if you want, in most cases, they chose to have a multiyear contract with us. That's because ZIA, ZPA is not viewed as a temporary thing like a VPN. It's viewed as the new way of doing it. It's ZPA. It's Zero Trust. When they work in the office, they'll use ZPA to go to all the applications they need to go to. So -- and the data center will become one more destination. So we do believe that it's accelerating the trend to embrace Zero Trust and not a temporary blip that will go away. Now a lot of customers have told me that the VPN boxes they bought to augment capacity in the short term are actually tactical. We do believe that a lot of them will go away, and that's an opportunity for us to simply replace all of that VPN with ZPA because ZPA is a lot more than VPN. It is the new Zero Trust security architecture.

Got you. Got you. Makes sense. And Remo, one came through for you on financials. Can you talk about -- there's a recent pressure on gross margins as you guys shifted some of your infrastructure. Can you talk through the strategy, what's causing the pressure on gross margins and when you expect it to lift back up again?

Yes. No problem. So in Q3 -- in the middle of Q3, traffic for ZPA increased 10x, so we had the traffic move to AWS and Azure. The entire impact on gross margin in Q3 was 2%. So overall gross margins in Q3 came in at 79.54%. If we didn't push that traffic to AWS and Azure, our gross margins would have been 81.5%, which is what we ran pretty close to the prior quarter. Going into Q4, what we'll -- what we're doing, we're doing -- we're deploying additional product to our data centers. That will happen throughout Q4 and get deployed in Q4 as well as probably a portion of Q1. The overall gross margins -- because of that, the overall gross margins that we expect in Q4 is going to be 76% to 77% because it takes time to get those deployed. First half, we expect the gross margins to be 78%, and then we'll go back to our -- what our target is, which is 80% in the second half. What that says is that we found firsthand related to what the impact is by going to public cloud. And as for ZPA, the compute required for ZPA is nowhere near the compute required for ZIA. ZIA order of magnitude is much, much higher than ZPA. Even by moving the ZPA traffic to Azure, we saw how big of a negative impact it has on gross margins. Therefore, companies trying to get to do what Zscaler is doing from a outbound security stack as we have ZIA, it's a very big barrier to entry.

Great. Yes, you're right. Good problem to have, and that's helpful. And we only have 2 minutes left, and I really wanted to ask about ZDX. I'm excited about the product. So Jay, can you talk about Zscaler digital experience? It does seem like it's a hot space, and we just saw Cisco acquire ThousandEyes just last week, I think. So can you discuss what the product is and does it have the potential to be another ZPA or even ramp faster than ZPA?

Yes. So network performance, user performance is an important area as users go over the Internet to all these applications. The user response time is becoming very important. All of the tools traditionally were really meant for figuring out performance bottleneck between the branch office and the data center, and a service provider actually manage the network. Now when your CIO, CEO calls from Sydney, Australia and says, "Sorry. My Office 365 is slow." It could be something wrong with his laptop, with his DNS resolution, with local Wi-Fi, 1 of the 10 hops he needs over the Internet to get to Office 365 or the application could be slow. Where do you start? Well, there's no easy way to start. None of the traditional tools work. And our customers said, "You're sitting in the middle." As a switchboard, you're seeing everything on the application side. You're seeing everything on the end user side. So we -- because where we sit, we can easily start monitoring some telemetry information about the response time of every user, every application without worrying about the network because we do know which network is going over. So we are in a great position to provide that information in a meaningful fashion. That's what ZDX does. So we think it's a massive opportunity. It's a great upsell opportunity because we have a lot of credibility in our installed base. It will probably open new doors as well, but it has a big potential, and we are very excited about it. It's just -- it's going through. We're working with a set of selected customers. And we're seeing very, very positive feedback. From revenue point of view, Remo, you have any significant stuff in fiscal '21?

That's correct.

But beyond that, we think it'll add. Any new product, it takes a little bit of time to raise awareness and gain traction, but the initial indicators are very good.

Fantastic. Sounds great. Unfortunately, we're out of time, guys. So thank you very much for joining us. And thanks, everyone, for tuning in.

Daniel, thank you.

Thank you very much.

Appreciate it. Bye-bye.

Thank you.

Thank you. Bye.