Zscaler, Inc. (ZS) Earnings Call Transcript & Summary

Hello, everyone. I appreciate you joining us today for this call with Zscaler. I am Patrick Colville, a senior analyst at DB, covering the cybersecurity and the infrastructure software space. The format of this session will be a presentation followed by a listener Q&A. There's a chat box where you, the audience, can ask questions. The questions are anonymous, so we're not going to mention your company name or affiliation. So I guess let's kick this off introductions. So we've got Jay Chaudhry, CEO of Zscaler; and CFO, Remo Canessa, with us. Zscaler, as the audience will know, is a pioneer in cloud-based network security or a space also known as SASE by Gartner. And so I guess Jay, Remo, thank you so much for joining us. The floor is yours.

All right. Patrick, thank you. This is Jay Chaudhry. I'll take about 5 minutes or so to set the stage. If you are looking at the slide, my first slide talks about our architecture. We were not designed to do network security with a castle-and-moat model. We're designed for the world of cloud where applications are anywhere, users are anywhere, so you can't do network security. And we don't do network security. We securely connect a user to application or an application to application, over any network, so because Internet is becoming the new network, and cloud is becoming the data center. So with that, if you move on to the next slide. And if you -- so number one, this whole digital transformation happens in 3 steps: One is application transformation, when your applications move to cloud or SaaS; two, if that happens, your network must change. It's no longer good to have this hub-and-spoke network. You need to go direct, just like you're doing when you work from home; three, if you do that, your security breaks, because it's sitting in the data center, protecting your data center network, your branch network, it's meaningless. So you need a security transformation, whereby, we sit as a zero trust exchange or in a layman's terminology, as a very smart switchboard. So user connects to us. If you really see, this is Slide #3, I'm showing. You go to external applications, ZIA. You do external applications with ZPA. So user can work from anywhere on any device. So we are not just a security company. We're the foundation of your application, network and security transformation, very different than traditional companies. Built 4 solutions on top of it: user to Internet; user to private apps; user to app experience; and user app-to-app. You are familiar with ZIA or Zscaler Internet Access. This is the product that is designed for secure web gateway and evolved beyond that. And Zscaler Private Access, it starts to replacing VPN, but it's a lot more than that. It is about securely accessing the application with zero trust. And user experience was a natural thing for us to do because we're sitting between the user and the application to let the customer know where the bottlenecks are and why. And app-to-app is a new nascent, young market. We are taking our core technology of zero trust as a switchboard to really control which app can talk to which app, without trying to do old school network segmentation. All this built on a purpose-built platform, not some kind of old technology and we're not cobbling together things. This platform helps us simplify, consolidate a bunch of own products and reduce IT costs. So in the Zscaler world, we work together 5 key areas. We're sitting in line as the Zero Trust Exchange. We securely connect applications and users. Identity, our friendly partners; endpoint management, our partners. We integrate with SD-WAN vendors, so they can send traffic to us to secure SD-WAN. We can feed logs to security operations. And we integrated all leading cloud providers and SaaS vendors. Our logos here are example logos. We integrate with all leading vendors in these areas. The last point I'll make here is, Zscaler architecture is WAN for the cloud. It is any-to-any connectivity, the old school architecture, whether it is from proxy vendors like Blue Coats of, Symantecs of or McAfee of the world or it's firewall companies, they all tried to do network security. These are 2 opposing architecture. It's not a matter of adding a feature. It's a matter of doing the right architecture. We think the only way the legacy will catch up with us, if they start with a clean slate and try to build something like a multitenant cloud-native we have built, which is not a trivial task. So with that, Patrick, over to you.

Thank you, Jay, for that. Really appreciate you taking the time. I guess the elephant in the room right now for every business is COVID. So I think many investors will understand that cybersecurity risks in the enterprise are increasing. But how -- what are you seeing as Zscalers, the effect of COVID on cybersecurity risks and I guess, your business?

Yes. So we handle about 130 billion requests going through us to the Internet every day. So we're seeing a whole lot of things out there. In fact, in the first 2 months of COVID, between late March to April and early May, we saw about 0.5 million threats that are COVID-related. People were trying to sell COVID masks, COVID test kits, all kind of trying to lure you and infect you. So the number of risks have gone up, the ransomware attacks have gone up. That's where -- that's why customers need us, because they can go direct with Zscaler, ZIA to the Internet, ZPA to internal applications, totally safe. And that's driving a lot of interest in our areas. So threats aren't slowing down with COVID, they are actually increasing.

Yes, that's very clear. I want to make this as interactive as possible. So any audience members have any questions, then please use the chat function, which is in your browser or alternatively, e-mail me on patrick.colville, which is C-O-L-V-I-L-L-E, at db.com. So it's patrick.colville@db.com or the chat function for any questions that are -- it will be fully anonymous. So I guess, Jay, I mean, back to you. You briefly talked about ZPA. But can you just help us understand why it's differentiated versus the likes of Prisma Access and VPN capabilities and other, I guess, remote application access tools that are out there?

Yes. If you don't do ZPA, the traditional vendors, whether it's a firewall VPN company or it is traditional VPN company like Cisco AnyConnect. They connect user to a network while the user is sitting wherever and they put you on the network. That means the user could be sitting in Moscow, but it acts like he's sitting in your [ headquarters ] and when this [indiscernible]. They can have access to all kind of hundreds of servers and applications sitting on the network. It's a dangerous thing. If you guys are interested, you should read a story about a ransomware attack on a mega-shipping company called Maersk, M-A-E-R-S-K. And the 1 machine got infected and everything came -- brought down. So it's a most dangerous thing. In fact, the reason zero trust network access became popular was that once user got connected [Technical Difficulty] It does not connect users to the network. It connects only to the applications and none of those risks and spread, that's number one. Number 2 ends up being the attack surface. You know, when you've got a VPN kind of box, the VPN kind of broadcasts the Internet, "I am here, if you want to connect with me, and I am here, if you want to attack me." So you can actually -- if any bad guy can find all the VPN servers of every company out there and attack them with [Technical Difficulty]

Jay, we might be having some connection problems. Remo, you still on?

I am.

Should we -- shall I jump to my next question with you and once Jay dials back in...

Yes.

My next question is going to be about ZPA adoption because it's pretty clear in your numbers that COVID-19 and ZPA has been a pretty big tailwind for Zscaler. So can -- I mean I'd love to understand from your perspective, how should we think about where we are in the adoption curve? And you gave guidance last week. And I guess what ZPA kind of contributes to that guidance for fiscal '21?

Yes. So I mean, ZPA, over the last 4 years has increased from 4% of our new and upsell business to 10% to 14% and then to 29% this year. The adoption of ZPA, really accelerated...

Hey guys, sorry. I'm back. Somehow I got kicked off. Sorry. This is Jay.

No problem.

Hey, Jay, I'm in the middle of an answer. Do you want to start or do you want to go from here?

No, no. Carry on please. Carry on. Thank you.

Okay. Okay. Yes. ZPA contributed 43% of our new and upsell business in Q3. And that was driven primarily by COVID-19. Companies basically with workers going remote. They were -- basically had problems. So they came to Zscaler. In Q4, ZPA represented 28% of our business. And when I take a look at our pipeline, our pipeline is well balanced between ZIA and ZPA. The question that came up in Q3 was, is this a onetime event? And basically, once COVID, this surge of curve -- COVID adoption goes away, is ZPA going to tail off? And our feeling at the time in Q3 was no, it wasn't. We're looking at our pipeline. We see what customers want. And that, in fact, has been the case. We've not seen a drop off related to the interest in ZPA. And what that says basically to me is -- and to us is that companies now are focusing on -- that their networks of yesterday are not adequate for today's world. And so they're rethinking their networks. And that is the digital transformation, which is occurring, which is what Zscaler was built to do 10 years ago. So for 10 years, we've been developing this platform. And it started off with secure web gateway with ZIA. And then we put ZPA. And now we're putting -- now we're expanding the platform with more services like CSPM and CASB out-of-band and the browser isolation. But in addition, we're moving towards basically user experience, because when you sit between the user and the application, you know everything along the way. And if you're a company, if something breaks down or users getting poor performance, we are in position to basically tell you where that is. So that the expansion into that ZDX is an important avenue that we're taking currently. In addition, we're moving to workload segmentation, which is basically server-to-server, workload-to-workload, app-to-app and basically segmenting the work of the network -- company's networks, whether it's on-prem or any public cloud that go into micro segmentations. So what Zscaler basically has done is really expanded its TAM. And ZPA is an important part of it and again, the balance is good. And we're excited about the new products coming out.

Got it. That's very clear. Well, Jay, I mean, I think the area we should probably discuss now is ZIA. And I guess, again, it's all through the competitive dynamics because SASE is a domain that Zscaler arguably kind of pioneered. And fast forward now to September 2020, and you've got Prisma Access there, you've got Cisco Umbrella and Check Point, Fortinet have also released solutions. I mean so when you're in front of customers, how do you -- why do you win versus those guys?

So it's architecture. SASE has become a buzzword. SASE is actually a framework, collection of things. If you read SASE properly, SASE says, for users going to the Internet, you should have a proxy architecture. Do these firewall vendors have a proxy architecture? They don't. Do they want to overlook their claim? Yes. They still want to claim that they are a SASE. So really, the discussion, the project doesn't start around, say, do you have SASE or not from a customer's point of view. I think SASE is more of a term pushed by vendors, and maybe it'll get adopted over time by customers. The customers call us and say, I would like to do my digital transformation. And when we go in and we walk them through how we do their transformation, it starts with them saying, look, Internet is becoming my network, I don't need to do network security. I highlighted a couple of wins during my prepared remarks that in 2 cases that I highlighted, their existing firewall vendor went to them and say, I could do that, too. And the customer said, you don't have a proxy architecture to do security and inspection. Sorry, they got disqualified upfront. Would you call that competition? I don't. If somebody tries to get in our areas and get disqualified, they're not competitors. I hardly have any bake-offs with firewall vendors, especially on the high end because that's where we play. It is possible that they'll be able to win some deals on the low end, where enterprises aren't security savvy, and they can't tell the difference. But if you talk to any of the Global 2000 companies, they're savvy. In almost every case, we essentially help them drive transformation. I don't really get into bake-offs with the traditional legacy competitors.