Zscaler, Inc. (ZS) Earnings Call Transcript & Summary

Hello, everyone. Thank you for joining us today with the chat with Zscaler. I'm Mark Cash, equity analyst covering cybersecurity and networking at Morningstar. As a reminder to the audience, Zscaler is a narrow-moat company with a positive moat trend based on customer switching costs that we believe are strengthening. This high-quality company has really disrupted the security market, and we think it has a long way to go. And we're taking questions in the chat box, so please don't hesitate to send questions in, and we'll try to get to some of those. So turning to introductions. I'm very excited to have see Zscaler's CEO, Chairman and Founder; Jay Chaudhry; CFO, Remo Canessa; and SVP of Investor Relations, Bill Choi, all join us today. So thank you very much. And Jay, could you start with a brief overview and discuss how Zscaler isn't just a network security company, and how you view the opportunity ahead? And you always have some great analogies like how you can't build Netflix by just putting DVD players in the cloud [indiscernible] sneak comparison, it's much appreciated here.

All right. Thank you, Mark, and thank you for the opportunity. You said it right, we are not one more network security company. In fact, we believe that in today's world, network security cannot be done because you no longer control your private network. Internet is becoming your new network. I started this company in 2008 after having built and sold 4 start-ups. And this time, my dream was to build something big, build something lasting. Hence, Zscaler was born to really drive secured digital transformation. So our mission became pretty simple. I believe that applications will move to cloud and users will be mobile. So we really need to make the cloud, the Internet a safe place to do business and enjoyable for users because users complain when their traffic gets routed back to the data center, taking a longer path. So rather than trying to do typical old school network security where you secure the network, we believe that Internet is becoming the network, cloud is becoming your data center, anything need to talk to anything. You mean application to application, user to users. Hence, our focus is to securely connect users, devices and applications using business policies over any network. When you say business policies, that means this user can access this application, not this IP address on this network, not all those cryptic network centric stuff. We started with user to applications. Now we expanded to provide secure any-to-any connectivity, which means it's not just user to applications, it could be applications to applications or it could be machine to machine. Let me give you a quick view of why security and transformation needs to be done this way. Digital transformation is needed for businesses to be agile and competitive, and the 3 steps in making it happen. Step 1 ends up being your application modernization or application transformation. Your apps are moving through SaaS or cloud, either to SaaS or to cloud. And once you do that, your network creates a problem. Your network typically has been what I call hub-and-spoke network, everything coming to the data center, which was the center of the universe. But now, that universe doesn't help. You essentially had to take traffic back to the data center and then go out to the cloud like Office 365. It's like flying from San Francisco to Chicago via Dallas or Houston. Not fun. Hence, you want to transfer your network, you want to go direct. You really want on any 4G network broadband. In fact, you don't even need your MPLS network in this world. Now since security is sitting in the data center, you can't quite do that. So what do you have to do? You really have to transform your security. So in this security transformation, we end up being your Zero Trust exchange, or maybe in layperson's terminology, a switch board, an intelligent switchboard, that's deployed in 150 locations around the globe. So users sitting at home or coffee shop or wherever on any device simply connects to the nearest Zscaler exchange, we validate who you are, we look at the policy, we connect you to the right application or service quickly, short response time, same consistent policy everywhere. So we become the foundation for your application, your network and security transformation. That is why CIOs don't look at Zscaler as another security company that's kind of giving better feeds and speeds. We are the enablers of the transformation. Now we have a North Star, and the North Star says, if you are a Zero Trust exchange, you're sitting in the traffic path, what all could you do to help your customers? In this slide, I show 4 areas of solutions we offer. On the upper left, Zscaler Internet Access, our flagship solution that started on day 1. It's make sure user can access Internet and SaaS applications safely. Cyber protection is one of the biggest benefit we bring to the table without you having to buy, deploy a bunch of proxies, firewall, DLP, sandboxing and the like. We do very solid data protection because your data can leak very easily, especially in today's mobile and cloud world. And three, since we allow local breakout, we don't require any network dependence. We can give you better experience for Office 365, your Teams meeting, your Zooms meeting, which is very important. And then from there, we built a second solution shown on the upper right, Zscaler Private Access. Private Access means I can access my internal application sitting in a data center or sitting in a public cloud directly without having to go back using my VPN to the data center and then to a public cloud. So insecure. So we have been not only replacing VPN, but implementing Zero Trust architecture, so we don't put people on the network, which is what's causing lots of security issues with VPNs and firewalls. The third area, since we're sitting between the user and the application as a check post, almost like an international airport, we know when a user experience starts degrading, becoming slow. So we built a new solution that was launched recently where we can create a performance score of every user for each of the key application you want to track. This is a new market because the old user experience tools are about network performance between the branch office and the office out there or the data center. The fourth area, a new emerging market. It's a nascent market, but will be one of the biggest markets. It is all these applications in your data center, all these workloads in your public cloud, they need to talk to each other. They need to talk securely. If you put them on the same network, they are a big security issue. One machine gets compromised, everything gets compromised. Your people are trying to do network segmentation to achieve app segmentation. Zscaler has pioneered this new concept, where you can do app segmentation without having to do network segmentation. So we're investing in this area. We've also done a couple of acquisitions to round out our offerings. But all this is built on a purpose-built platform that's multi-tenant, that's distributed. We did not take an old school legacy appliance and tried to cobble together solutions to, say, I'm a cloud security. That's where my metaphor comes in. You can't take 1 million DVD players and stack them in a factory and say, I am a Netflix service. The design is different, the architecture is different. In this process, with these 4 key solutions, we actually are a very comprehensive platform that essentially can simplify your IT, reduce cost, consolidation, because that's becoming a very high priority in CIOs' minds these days, especially with the economic slowdown recorded. So where do we fit in all these things? We believe that if we should do something, we should do well. Otherwise, we should partner. So as a Zero Trust exchange, we're sitting in line of traffic flow from a user to application or application to application. And only by being in line, you can enforce policy, like an airport, who can go in, who can go out with proper inspection. We integrate with all leading identity vendors such as Microsoft and Okta. We integrate with leading endpoint vendors, endpoint security and management, such as Microsoft, VMware and CrowdStrike. We can take traffic from all leading routers and SD-WAN vendors with single click deployment. So we help secure SD-WAN. We don't have to have SD-WAN. We can work with any routers. We can feed logs to security operation solutions with like Splunk, like Microsoft Azure Sentinel, like Google Chronicle. And we have tied API-based integration to all cloud providers and all SaaS providers or CASB type of solutions. Our customers want to select best-of-breed platform over coin products. And it also allows us an opportunity to work with partners. Today, you saw a press release, we did further integration with VMware on the SD-WAN side of it as well as on the endpoint side of it. So we're proud to have our ecosystem of partners. One last slide before I wrap up. In this, as the cloud is picking up, every legacy vendor is feeling threatened that they're getting disrupted. So they are trying to kind of say, I'll take my appliances, I'll spin some virtual machines in a public cloud, and I become a cloud security company. We know how Siebel Software tried to do that, to really compete against a tiny Salesforce. Siebel used to dominate. PeopleSoft used to dominate HR systems until Workday came around with a cloud-native, multi-tenant architecture. Our architecture, shown on the left, is Zero Trust where we don't build a moat. A firewall is a moat. It's a door. It can never be zero trust. As a Zero Trust exchange, we connect users and devices to applications without putting them on the network because Internet is the new network. In the old world, what I called the opposing architecture with network security, you control and secure the network, you build castles and moats, you build perimeters, and there's no place to put firewalls in because cloud has no walls. So with that, I will open up and pass it back to Mark for any questions.

Yes. That was a wonderful explanation of the business and how you guys are disrupting the market. When I think about security, I think a lot of investors, too, is I think the thought is enterprise is going to be pretty risk-adverse to changing. So what are some of the biggest hurdles you see and how are those overcome?

You said it right that inertia can be a powerful thing. And you start with progressive thought leaders who want to make their businesses more agile and competitive. So digital transformation is not just by about a cool new technology. If companies aren't transforming, they'll disappear. So there's a lot of pressure on CEOs and CIOs to transform, and that's why our sale starts very differently. We don't go through a security technical guy who owns and manages boxes because they love their boxes. We call them box huggers. We start with CIOs, CTOs, CISOs who are driving transformation, who are sick of all these boxes. And a big push came from Office 365 a few years ago because Office 365 just killed the network with so much traffic being generated and user experience becoming slow. So that became a very good catalyst for us. In fact, COVID-19, it is interesting enough. It did 2 things: One, customer had to switch over. You say my people need to work from home over any network. So they realize the value of something like Zscaler, even though they did buy some of the VPNs to get things going. But it opened their eyes. There's one CIO who talked to me during COVID. I talked to him that we enable network transformation from hub-and-spoke to direct-to-cloud. He paused and smiled, he said, "Jay, what network transformation? I am talking about network elimination." "So what? Tell me more." He said, "Well, my employees, thousands of them are working from home. They go over broadband connection to wherever they need to go. I'm not using any of my corporate network. So why do I need a network?" That's very interesting, is the mindset of CIO where they used to think that I need to go slowly to make some of the changes, have realized that actually the legacy network, legacy security boxes they really thought were important aren't really that important. So it's actually helping drive transformation even further.

It's very interesting. And speaking of COVID, since you brought it up there. We looked at it as this huge, all-of-a-sudden issue and exposed the big security holes enterprises probably had when they had to go to shelter-at-home, but you see this as a secure -- I'm sorry, as a temporary tailwind that should subside? Or do you think this is a big fundamental shift, and it's just a constant -- it's a new concept, really, for the security network?

Yes. We believe that the way things are happening, 2 things: number one, the workplace will become hybrid, okay? No one is ever going back exactly the same way. And CIOs are asking for ability to work from anywhere all the time. There's a big mind shift change that happened, and CIOs and CTOs realizing that they can actually have better security, better user experience if they're able to go direct over the Internet to access their cloud applications than trying to do the old way. So the case for trying to have your proprietary private network is no longer there. Trying to have a stack of boxes in the data center is no longer there. So users need to go direct, and Zero Trust architecture has become a very high priority. Because if they don't do it, imagine, you got 10,000 people sitting in 10,000 cities, connecting to your network, they are on your network who could be causing a lot of havoc because they infect the machines and all the stuff. So we see that buying VPN during COVID was a temporary phenomenon. But buying Zscaler, ZIA and ZPA together to implement Zero Trust is the direction our customers are taking. That's why none -- all the deals, our customers, their almost all deals are long term, multiyear deals. None of them were short-term deals.

Okay. Great. And as this is the Management Behind the Moat Conference, I just want to hit a few questions on the moat specifically. So how is the adoption of ZIA different than other security offerings in the market? And what are customers really signaling to you when they choose Zscaler for security?

Right. So yes, there's a fair amount of confusion that vendors are trying to do. ZIA is about making sure when users go to the Internet and SaaS application, they are safe. Okay? So for over the past 10 years or 20 years, the user security has been done by a kind of product Gartner called Secure Web Gateway. It's a gateway to the web, to the Internet. And that architecture is required to be a proxy architecture because proxy allows you to inspect traffic, even traffic encrypted with SSL. Dominant players traditionally in this market before Zscaler were Blue Coat, Symantec, McAfee. Cisco had Secure Web Gateway offering. Websense had their offering which became Forcepoint later on. So we have been actually displacing those solutions. They also offer so-called cloud solutions, the same kind of stuff that firewall vendors are trying to do. Now lately, firewall vendors are feeling threatened because they're being disrupted because there's not a whole lot of traffic that will be going to the data center. Because firewalls are designed to protect servers. They're like doors in front of your house so bad guys can't come in. They were never designed to protect users. That's why Gartner never included a firewall in its Secure Web Gateway design for the user protection. So when customers look at us, they say, I need a proper Secure Web Gateway, which can inspect my SSL traffic, users can come from anywhere, there's minimum response time because you have a distributed cloud everywhere. So we really -- when they look at Zscaler, they say, wow, who -- I get this question quite often from C level. I love your architecture, Zscaler. Who is your competition? I flip around and ask them, "Every vendor talks to you, who do you think our competition is?" 98% of the time, the answer I get is, "I can't think of anybody." A couple of times, they say, "Yes, I think it's Blue Coat or Websense." Then we haven't really communicated it across. I think we are enjoying a very well-differentiated solution out there, just like Salesforce and Workday have enjoyed. Our key thing is to get the message out. As a young company, it takes a little bit of time. But our brand is building. CIOs are moving from place to place, and they call us back and said, "I need Zscaler here." So a lot of our sales are happening because our customer love us. Our Net Promoter Score, which is the satisfaction score of customers, is 76. Average NPS score of a SaaS company is about 30. So it's helping us. We're excited about it.

Yes. Great. And talking about switching costs and establishing them, what is the learning curve for using Zscaler solutions? And how do customers become reliant on your products?

So first of all, being a cloud service, a customer has to do a little in terms of managing and operating it. In fact, a couple of our customers did studies of several years ago. They said, "If I needed 5 people to run an appliance-based architecture to handle x thousand users, with Zscaler, I need less than 1." Okay? So it's less than 20% of operating cost because you no longer have to worry about buying, deploying, managing, upgrading, load balancing all these boxes. If traffic went up, you have to buy more and more of that. That's one part of it. The second is, let's talk about switching cost. There are 2 things out there. Many times, people think that everything Zscaler sells is actually a replacement of something. That's actually not true. We are drivers of local Internet breakout because in the world of cloud, you can't do hub and spoke. So if you look at the diagram up there, take AutoNation as one of the big retail auto shops. They had 2 data centers and about 360 retail stores. Traffic from 360 stores came to 2 data centers, where they had some proxies and security appliances go out. They found that as they had to go more and more to the Internet, user experience was getting slow. They wanted to go direct from every branch office. They could be buying a bunch of boxes, or they could simply configure the router in each branch office and say traffic should go to the Internet through Zscaler, period. So it is actually, in this case, while we replaced 2 gateways in 2 data centers, we actually added 360 new. So there's lot of greenfield opportunity for us when it comes to doing local breakout or replacing some others. So the cost justification is extremely easy. The ROI is impressive. Siemens of the world have said that they have actually had 70% cost savings because of 3 big factors: Factor one, the cost of MPLS network goes down, it's massive. A typical Fortune 500 company, some spend somewhere from $20 million to $200 million on MPLS network per year. That's number one. Number two, security appliances, [ a lot so ] than you need. Our platform integrates all of them. Often, the CISO will talk to me and say, "Gee, we got appliance overload." One CISO called it appliance fatigue. They are keen to get rid of them. Three, operational cost, which I talked about the cost of operating a cloud service, is much less because we are managing all of the application infrastructure and the customer manages the policy and whatnot. Did I answer your question, Mark?

Yes, that's great. Very good color. And I could throw one at Remo's way. So what are some tangible metrics that you could share indicating that the customer switching costs are strengthening over time?

Yes. I mean we're looking at deal sizes are increasing. Our pipeline generation is basically stronger right now. We're looking at the -- just the overall interest of our customers coming to Zscaler. Related to -- as Jay talked about, COVID was kind of the accelerant which made -- which companies had acute needs related to having their employees access internal applications. And that started the thought -- accelerated the thought process related to the need for digital transformation and not going through the traditional legacy hub-and-spoke type structure. So as Jay mentioned also, if you are a remote worker, you don't need the network. You can go directly to the application. And if you're going to the application, if you're going to go to an internal application, you're going through ZPA, which is the private access. But if you're going through the Internet, you're going through our ZIA, which basically is our security stack with the full suite of security products and cloud sandboxing, firewall, data loss protection, antivirus, browser isolation and so forth. So what we were seeing is with that increased need on the part of CIOs and companies looking to the future and seeing where they're at right now, changes occurring fast or faster. If you look at our recent financial performance, we've had an acceleration in the second half. Our billings growth in Q3 was 55% billings growth year-over-year, and Q4 billings growth also is 55%. So it's a good place to be. We feel we have the right product at the right time, and we feel the market's coming to us.

Great. And I think another metric to point out is the dollar-based net retention, 120% in Q4 or 119% the quarter before that. So does this really speak to the cross and upselling nature of your offerings? Is that what's happening here?

Yes. What's interesting is if you take a look at the penetration that we have into our customer base and you look at ZIA, we have 3 bundles we sell. We sell the Pro business and transformation. The pricing is basically 1x. If you take Pro 1x and you take business at 1.5x, transformation is 3x. 49% of our ARR for ZIA is transformation. So there's an upsell capability or opportunity with our ZIA. In addition, ZPA, over the last 4 years, was representative of our new and upsell, 4%, 10%, 14% and 29% of our total new and upsell business. So still significantly selling more ZIA versus ZPA. You look at the penetration we have in our Global 2000 customers, which is about 450 customers, 35% have ZPA. So there's an opportunity to sell ZPA to a lot of the customers. And the penetration that we have of ZPA in those customers may not be as high as it can be or will be. So those are a couple of things. But in addition, as we go forward, if you think about Zscaler as a platform, the user experience, ZDX, is a new solution coming out with, which we just recently announced. And that is being sold for all users. And so what that does is, basically, it gives the ability of network administrators to see where there's a user performance issue. And that's important because it's hard in a -- if you are a SaaS cloud, there's no other solution out there that can do this. And with Zscaler, because we sit between user and the application, we see potential issues or problems along the way. So ZDX can also potentially increase our net dollar retention. As Jay mentioned also, the workload segmentation related to micro-segmentation is a nascent market, which we expect to grow. But in addition, we've come out with CASB out-of-band. We've come out with the browser isolations, we've come out with CSPM. So as we go forward, what you're going to see, you're going to see the expansion of the platform, we're going to put additional services under our platform, which we can upsell. Having said that, as you get bigger, the pressure on net dollar retention gets more difficult because you're starting with a bigger base. So we'll see where it goes, but yes, I mean, from my perspective, our penetration to our existing customer base is fairly low, and there's an opportunity to continue to sell more.

Okay. Great. Something I think you just mentioned and referred on some recent calls is about the market really coming to Zscaler. And what are some of the deliberate choices you guys have made recently to really accelerate that market adoption? And do you think there's a long way for that to continue?

Yes. We believe we are in the very -- yes, yes. We're in the very early innings of the cloud journey. If you look at our penetration, on the high end, we dominate. Literally, there's -- the only solution that has dominated in the past the Secure Web Gateway user protection business has been Symantec Blue Coat. And they used to be in 85% of the Fortune 500 companies because they offer a very good proxy architecture. Now we have a great proxy architecture, which is needed for security, but we also have a cloud-native, multi-tenant architecture. Where are we? We are a little over 450 of the Global 2000 companies. And the rest of the market is wide available. But today, I'll tell you, I'm taking a guess because I don't have concrete data. 5 years ago, Blue Coat was about 85%. And then about 2 years later, it became about 70% of the Fortune 500. Those 16%, that will be about 80 large customers, probably most of them came to us. It's my guesstimate that number is down to about 40%. That means about 200 customers still have something like Blue Coat sitting out there, and we become the choice because of the right architecture there. So a big market for us to go after. And to take advantage of that, we have actually ramped up our go-to-market effort. As I've been pretty transparent in the past couple of quarters, we needed to hire a CRO, a sales leader, who could actually take our sales processes to scale and execute at a much bigger level as we want, as we're ambitious. We want to go from $400 million to $1 billion and $2 billion in revenues. So we have invested significantly in sales and marketing and sales enablement, in our leadership team, the number of quota carrying sales reps. All those things are really designed to invest aggressively because the market is big. And when you also build a cloud-native platform, you are in a much better position from an operating margin point of view because you've more room, unlike someone who is taking some legacy boxes and try to go through a public cloud. So massive market, we're investing. Our #1 priority is growth. And Remo and I are both conservative. We are always watchful of our bottom line.