Zscaler, Inc. (ZS) Earnings Call Transcript & Summary

Okay. Welcome back, everybody. I'm Brad Zelnick with the Crédit Suisse software team. And this is Day 4 of our 34th Annual Tech Conference this afternoon or at least East Coast time afternoon. We are delighted for this session to be joined by the good folks from Zscaler. It's a great day for Zscaler. It's a great year for Zscaler. A lot of great things going on with Zscaler. With us today, we have Founder CEO, Jay Chaudhry; CFO, Remo Canessa. We have as well, Head of Investor Relations, Bill Choi, and from the IR team as well, we've got Ashwin. Thank you, guys, all for being here.

Thank you, Brad.

So the format of this session is going to be a short presentation from Jay, just to level set us all on what Zscaler is all about. And from then, we will open it up to a fireside chat format, in which I have a number of topics I'd like to ask Jay about. I will also keep my eyes on my Inbox. If any of you all have questions, I'll try to weave them into the conversation as appropriate. But with that, Jay, welcome. And if you would, please share your screen, and let's see the material that you'd like to share.

Brad, thank you for the opportunity. You can see my screen?

I can.

Excellent. I'm going to take only a few minutes to set the stage. So first of all, this is what a typical enterprise network looks like. We call it hub-and-spoke network for obvious reasons. And to enable and protect the network, you need all this stuff in the data center. These are terminations of domestic WAN to international to extranet to Intra-DMZ and B2B, B2C zones. Beautifully color-coded as routers and firewalls and UTMs and load balancers and more and more. This was wonderful when data center was the center of the universe, and you needed to protect it, you need to have fast access to it. Fast forward, the world of cloud applications are everywhere, users are everywhere. Traffic flows over the Internet. All of us are sitting at home. Now don't really use any of that corporate network. The castle has gotten empty because applications are sitting in the cloud or there are SaaS applications. So the right way to do it is, to have a new concept of Zero Trust Exchange. Think of it as an electronics exchange, maybe in layman's terminology. It is an intelligent switch board. A user comes to our exchange. We verify who you are using identity of your choice, and we look at the policy. If the policy, say, yes, we connect you to the right application or service. There's no such thing as inside the network, outside the network. Network is merely the transport in this model, you securely connect users, devices and applications over any network. Simplifies model, makes -- gives you far better security. Now this whole transformation, digital transformation can be looked at in 3 simple steps: the first step driven by CIO. Modernize my application, move them either to SaaS or to a public cloud where I can build and deploy them faster. Great. That's being done, CIO is #1 priority because business is all about applications. But if you do it, your expensive hub-and-spoke network which backhauls traffic to the data center becomes a problem. It's cost issue. It is user experience, response time issue. Who wants to fly from San Fran to Chicago via Houston? I don't. I would rather take a direct flight. So every branch office wants to go direct. But there's a problem because the security is sitting in the data center. That's where we come in. With Zscaler as an electronic exchange, sitting at 150 locations around the globe. So your users could be sitting anywhere, at home, or coffee shop, or airport, it could be your employees, it could be your B2B customers. They simply come to us, we validate who you are. When you want to go to external applications like Internet or SaaS, we are inspecting traffic like an international airport. Do you have the right boarding pass, the passport, the visa and the luggage is all safe, to make sure you can have great experience while we're keeping you safe from fishing, ransomware and make sure nothing leaks out of your company. That's one piece. The second piece, there are internal applications. In your data center, public cloud that you typically go through with the VPN or being in the office. With Zscaler, no need to worry about either of the 2. You come to us. We securely connect the right user to right application without VPN and/or the like. So we enable anyone to work from anywhere with full policy, full security, great response time. And get viewed as foundation of your application, network and security transformation. We're not get viewed as just a security company where you say, where are you going to put my box, right? So your complicated network I show it on the left gets simplified to this architecture with tons of cost saving with wonderful user experience, and with much, much better security than you have today. There are 4 key things on cloud provide: Secure Internet and SaaS access. That's our key product, ZIA. Access to private application, ZPA. Zscaler digital experience, making sure you have great experience. If you don't, the IT can troubleshoot and fix it. Number three, securing your apps; and workload, number four. All these are properly integrated, purpose-built from ground up. They're not bolted on. They work well, single console, and lots of other benefits. Once -- a word about our sales enabled process to sell transformation is not the same as selling security boxes. You can think about our sales in 3 steps, starting with thought leadership, then landing the deal, then expanding and form there. In thought leadership. A lot of work needs to be done with CXO engagements because CXOs drive transformation. Security geeks don't, then leading to lead generation, where our sales team, and SIs, SPs, and some of the selected wards are helping us. And then once we've done that, we engage with proper pain point identification with C-level engagements. We end up doing architectural demonstrations to show to solution architects, how testing changes, and we got business value team to demonstrate ROI we provide. And once that's done, with this ample opportunity to expand from there, we are engaged with deployments. We do quarterly business reviews with CXOs and we got executive level briefing. So this is a differentiator for us. It has been learned and built over several years. You can't put it together overnight. With Zscaler, you end up having a very simplified overall architecture with the ecosystem of partners, where you consolidate around 5 or 6 key platforms. We are a platform to enforce policies, setting in line for policy enforcement. We integrated identity vendors. We are friends with endpoint and management. We integrate, we complement them. We can take traffic from any router in SD-WAN, and we can feed logs to security operations. And we've got tight integration with application and cloud providers, fast response time and secure and fast access. So that's kind of our story in about 7 minutes. Now back over to you.

Thank you so much, Jay. Yes.

Thank you. And Ashwin, if you want to move off, then 4 of us will be seen by the audience in big 4 blocks.

Thank you so much Jay.

Thank you.

Really appreciate it. And as they say, a picture is worth a thousand words, and I've hosted several CEOs and CFOs this weekend, you were the only one to think that it would be helpful to use a great visual presentation like that. So thank you so much. That was great. With that said, I'm going to take that beautiful message and ask you maybe almost an insulting or a simple question, which is the notion of proxy versus firewall. And as much as I think I may understand it, there are still vendors out there from the past that are suggesting they can deliver on the value proposition that you talk about, that they can solve this problem. The world is obviously going in a completely different direction. But as we think about that -- and before I don't yet want to get into the great results you just reported last night, we'll get there. But I just wanted to touch on this higher level debate so as we think about how network security has transformed over the years, it's amazing to me that this debate really still exists, but can you opine or weigh in on whether a proxy solution such as yours is more appropriate for cloud applications? Or if organizations might be able to get away with leveraging virtual firewalls or taking that firewall stack, putting it in the cloud somewhere. Why is that thinking flawed?

So there's really no debate, except one company that's hung up on it, and that's because they're threatened. The notion is very clear. If you look at for the last 20 years, all large enterprises are dependent upon proxy architecture from vendors like Blue Coat and Websense and McAfee of the world to inspect the use of traffic. Proxy is designed to able to terminate connection, inspect traffic and let that connection go. A firewall is a pass-through device. It's like a highway check-post. In one case, you're not allowed to stop the car, but you're supposed to inspect. How much inspection can you do? In the second case, you can stop, open the hoods, open the trunk, inspect and let it go without introducing latency. That's why building proxy is much harder. But if you asked any expert out there who is smart enough, they'll say, there's no issue between proxy and firewall. Firewall is a pass-through device. Proxy is designed for inspection, including SSL. I think it's a matter of time in a few years, market will speak as they are speaking, our sales are driven by the fact that enterprises understand it and appreciate it. You can fool some of the smaller customers who really don't understand security. But when it comes to Fortune 500, you can't. Talk to any of the large banks who are pretty savvy, say, would you give up your proxy for a firewall? I don't think you'll find a single one.

It's actually a good segue to my next question, Jay, because I think there are some anecdotes out there of proxies breaking applications and interceding and creating issues with application behavior. Probably the biggest debate here, I think, is around Office 365, and I've often heard back and forth as to what's Microsoft's recommended approach? And last night, you actually touched on a -- your recent success in financial services driven by Office 365 adoption. So what do you say to that notion? And why is that perception even still out there in the market?

If you don't a build proxy, you're going to break applications because you're inspecting and letting them go. With firewall, you never break any application because you never stop them. If a highway has open gate, why would you brake any car, you just won't do inspection. Okay. So that's point number one. If you do the right proxy, nothing is broken, about 140 billion, 150 billion transactions going through our Zscaler Cloud every day. That is about 15x higher than Google searches done in a given day. That's about 15x more than the number of Salesforce transactions done. And if we really broke any of the stuff, you won't be seeing all this stuff happening out there. So that's really -- it's a matter of, can you build the right product or not, that's what we have built, okay? That's one. Office 365 becomes an interesting point. There was a time when Microsoft used to say, if you really want fast user experience, don't put any security in the middle because security can -- anything in the middle can break it, go direct, and CCS said wait a second. Yes, you may be a big company, but I can't have a backdoor. I need a security check post to know even who went and who did not and whatnot. So Microsoft, no longer says go direct, okay. Microsoft says, make sure your security system doesn't break us. That's their recommendation. Microsoft recommends Zscaler, has certified Zscaler because we don't slow things down, and we actually deliver performance. Now there's an issue about what to inspect, what not to inspect in Office 365. Thing is there's no point in inspecting Microsoft Team's communication, is not a big data loss issue. But the files that are being attached and sent over to SharePoint, you want to make sure they are inspected. So we do smart inspection of Office 365, things that don't need to be inspected, like streaming traffic, we don't, things that should be inspected, we do. That's why some of the largest companies depend upon Zscaler for Office 365. That's why some of the largest banks are working with us to roll out Office 365.

Thank you for that, Jay, that makes a lot of sense. Maybe just talking -- switching to another topic. 2020 has just been a remarkable year in so many ways. COVID caused significant disruption to how business actually gets done, the majority of employees shifting to working remotely, knowledge workers, in particular. And you said last night, again, you've said it before that the market is now coming to you. And we see this with an acceleration of billings growth from 55% to 64%. And I think that helps really substantiate, at least puts numbers to what you're saying. But maybe talk to us about how you're able to help customers, both existing and new customers, to ensure business continuity and reflect on maybe some of the conversations that you've had, what gives you confidence that we have hit an inflection point in adoption rather than maybe just a temporary increase or pull forward of demand?

You know our story is validated by 5,000 enterprises and just shy of 25% of the large enterprises, or the G2K companies. And I actually have lots of dialogues out there. I talk to about 10, 12 customers every week, and this is at the CIO levels, or CSO level, or Head of Infrastructure level. They're all -- they all brought into fact more so now than before that they can work from anywhere. The biggest change that has happened to CIOs are saying, "Wow, my enterprise can work without using my expensive network." Because when you're working from home, you aren't using company network at all. So now they are actually accelerating and say, if I need to save money, I am under pressure. I'll make a switch faster. And the question they're asking us is, you're giving me this, what else can I get? And what other legacy products can I move out at a faster pace? So it is actually -- so number one, CIOs are feeling more comfortable in making a bigger change because inertia is powerful sometime, it holds you back. When somebody says, CIOs slow down because change is risky. We all know that, yes, change makes people a little bit uncomfortable, but change has to be made, and CIOs are pushing it with far more conviction than they did before. That's number one. Number two, there is cost pressure because of COVID. So there's a bigger push to move out the legacy technologies than it was before. That's helping us because we are able to sell bigger bundles and bigger platform upfront than we did before. That's two. The third part is, we used to lead with ZIA. Then we started saying, then we would go and say, "Hey, we have ZPA too." Okay. That's shifting. The customer really needs ZIA and ZPA together to fully enable people to work from wherever they need to work for them, that's all they need. And with that combination, our sales have shifted where more and more sales are happening with ZIA and ZPA together, which is helping us, which is helping the deal size. And the last point I'll make is ZDX is getting tons of interest. This is user experience. If you got ZIA, ZPA, you're working, having great time. But if there's an issue somewhere over the network or here and there, ZDX can help you figure it out. So it's my strong belief that it's a matter of time when each customer in Zscaler, every employee will have ZIA, ZPA and ZDX, all 3 of them.

Excellent. And maybe just for Remo, when we think about the opportunity in front of Zscaler, how should we think about the potential for continued growth in ZIA and the penetration of ZPA at this point? I mean, Jay mentioned having 25% of the Global 2000 as customers, would seem to be a lot of headroom, but I think skeptics would say that you're approaching a point of saturation relatively quickly. How do you think about that?

Well, quite frankly, I don't think there's much merit with that. As Jay mentioned, 25% of the Global 2000, there's a lot of other companies that can basically use the Zscaler platform. So I think there's opportunity for us with that, not only within the Global 2000, but also outside the Global 2000. I look at transformation, about half our customers are at the transformation phase. So there's still opportunity with our existing customer base to sell transformation. And ZPA is 13% of our revenue. So it's not -- and if you take a look at our G2K customers, 38% have ZPA. So there's an opportunity still with our existing customer base. The -- you take a look at the size of the TAM and you take a look at how big we are and how strategic we are and how we're expanding that TAM with ZDX and workload segmentation, there's a lot of room. There's a lot of headroom.

Thanks for that Remo. And Jay, I want to go back to -- I think what I understood in the presentation that you made at the beginning, but maybe to expand on it a little bit more, you continue to add features and other capabilities to the platform, whether that's browser isolation, CASB, digital experience, B2B. Can you just maybe give us an appreciation of how the platform's evolved? And what should we expect into the future? What's in the R&D lab today that's going to be the next exciting great thing that's going to help us to sustain growth for many years to come? And then before you answer that, also for Remo, many of these solutions are still pretty nascent. But just curious to know how you're thinking about attach rates of some of these newer offerings and the contribution to the model in fiscal '21 and beyond?

Yes. The contributions to the model is not going to be material in fiscal '21. We talked about all the products, our emerging products, new products, mid single-digit type contribution for new and upsell business, and you're clearly with revenue because ratable is a lot lower. But we do expect them to increase as we go forward. As Jay mentioned, ZDX, one of the products. One of the pillars we have, the expectation is that if for every user, you're going to have ZIA, ZPA and ZDX, so that should be a big driver. The CASB out of band, the browser isolation, the workload segmentation. Those -- as Jay mentioned, the workload segmentation, more of a nascent market. It's going to take longer, but hard to say what the contributions are going to be in future years. But it's a platform. It is a platform play. And the platform is a very significant platform with a lot of capabilities. So we expect good contribution going forward.

Yes. If I may add to the first part of the question, Brad. First of all, we are expanding the use cases within each of the mature pillar. ZIA is not the same ZIA we had 4 years ago. The things have been added more and more. In fact, we are also discovering the new use cases, where almost every workload from a public cloud needs to talk to the Internet. How should they talk? Well, ZIA is the policy engine that inspects for any threats coming in. So we'll see more and more known user traffic, okay, being inspected with ZIA, and we had to build some technologies to be able to redirect traffic from public cloud to our ZIA platform out there. So there will be a lot of expansion within each of the platform -- sorry, each of the pillars, like ZIA started to return thing. Then we started with being able to do app segmentation beyond VPN. Now we added browser isolation to it. And you'll see more and more. B2B became an important part of ZPA because it's not just good for employees. It's also good for B2B customers. We had to add a few more functionality to make it more useful for B2B customers to use. So we look at 4 big pillars: ZIA, ZPA, ZDX, and they'll expand within each pillar. And cloud protection is the newest one. That's where a lot of R&D is coming in because this market will grow. If you look at beyond that, to give you a little bit futuristic view of where we are headed. I'll highlight 3 areas: Number one, all the stuff being done in the enterprise, in the office area, so to speak, needs to be done for IT and OT in plants and factories. They're all still sitting on old school system, remote VPN access, this and that type of stuff. We're beginning to put more focus in that area. Most of our technologies work in that space. There are some things that need to change, are things need to run on ruggedized system that are sitting in factories that are high-temperature and the like. Need to integrate some of the IoT device providers and the like, but that's one big opportunity for us, taking 0 trust to a factory flow. That's one. Two, we got 5G as the new area merging. 5G will happen. It's a matter of time. 5G is going to push the edge of the cloud further and further out. Okay. That means you need a very distributed architecture where policy can enforce at the very edge. So a number of data centers needed to do it will go from hundreds to several thousands. Okay. And we are working in that area. There is some newer technology needed, new traffic, inspection, traffic forwarding capabilities needed that need to be built to fully leverage 5G kind of technologies. And there will be areas for partnership in that space. You're going to see more of that happening in that direction. The third thing I would say is, which is, work in progress, what we are still in very early stage, is leveraging machine learning. Today, we use machine learning to detect threats more and more. There's a lot more needs to be done. We are doing it. We are investing in that. But machine learning is also playing a bigger role in user experience, figuring out experience, problem where, where you've got tons of sets of data, you need this kind of stuff. And then figuring out the behavior of applications, user anomalies, all that stuff becomes extremely important. So tons of areas for to expand and build a bigger gap between the want to be versus us.

Jay, I just want to make sure I understood something that you said there, and that's all really helpful. But as you talked about 5G moving closer and closer to the edge, coincidentally, I'm in New York City and my mobile device actually is on 5G. I think except if it's raining or very cloudy then it degrades. So I don't know that we're all the way there just yet. But you talked about needing more and more presence. Are you specifically speaking about Zscaler? And can you just remind us of, ultimately, on the horizon, how many points of presence does Zscaler need?

So we enforce policy in 150 locations around the globe. I want to make sure it's clear. It's enforcement of policy. Some of the firewall guys try to talk about hundred some data centers, but they don't tell you that those are collector point to send traffic back to a few big data centers where actual firewalls can be spun. And that number for each of the cloud providers sits somewhere in the range of a couple of dozen. That's where things happen. We actually do policy enforcement in all these 150 locations.

Okay. Great. We only have a few minutes left. I want to make sure there's so many topics to cover. I would just want to touch on go-to-market. It's just been such an important part of the story and such fantastic change that we've seen just over the last year or so. Dali Rajic came in. I remember it was right about -- maybe a little over a year ago when he first started. He came in. He moved very quickly in transforming everything from people and process and underlying systems. I won't forget the presentation he gave us at RSA earlier this year. And I think the results speak for themselves. But if you had to pick 1 or 2 things that he could be doing differently or better, do we think of this now as fully optimized? Or is there always room for improvement?

So I think everything moves in steps and phases. And I'd like to say that there is always room for improvement. If someone said there is no room for improvement, there's a problem with it. Having said that, I think on the sales execution, the enablement, the better hiring, the better training, the better inspection, more disciplined. Those things are fully in place. What still needs to be done is, the sales team was really start with focus, then the channel became the next step that where we start working on the channel, taking Channel to call it Channel 2.0, about 6 months ago. So we -- that's in early stage. We're seeing good results, but we will -- we expect Channel to create more and more leverage, and that's where Dali and team are focused on. That's the second area. The third area to have your sales or call it, go-to-market engine, really fully work well, is the marketing area. Marketing and sales have to both work very well together. When our sales engine moved up a few notches, now marketing had to be moved up. So that's why you saw the announcement of Chris Kozup joining us as a Chief Marketing Officer. Chris will move marketing in tandem with sales to the next level to create brand awareness, more demand generation programs, more CXO engagements and the like.

Thank you, Jay. I've got one last one for Remo, and then I think we're out of time. But just on hiring, I think you had said last night that you hired more folks in Q1 than you did in Q4. But as we think about the linearity of your hiring, I don't believe -- I mean -- I'm sorry, last year, you had increased your quota-bearing headcount, I believe, by 60%, and productivity was better than expected. This year, you're telling us that you're going to accelerate the pace of hiring, but I don't think you've given us any specific numbers. Can you frame it for us? Do you even have a target that you're aiming for? And what would -- are you going to -- quarter-by-quarter, month-by-month, lift your foot up and down on the pedal? How should we think about this? And are you supply-constrained at this point in finding talent?

Great question. So we've become a destination for top talent. So no, I do not feel that we're supply constrained. You're right, Brad, last year, we increased our field quota sales reps by 60%. Most of those field quota sales rep increases were in the second half. We had a record quarter of hiring in Q4 for field quota sales reps. We had a comparable number in Q1 for hiring. So we have stepped on the gas to do the hiring. One comment I made last night was that it's that we changed our plans to hire more. So based on where we're seeing the business, we've actually going to -- we've increased the amount of sales heads that we're expecting to hire for fiscal '21. Why did that come about? They came about because we're seeing the market come to us. We see the opportunity. Will we be looking at on a quarterly basis? The short answer is, yes. We will. I mean, if the business is there, we're going to keep going. I mean, we've talked about putting growth over profitability, we did 14% operating profitability, and we hired over 260 people in the quarter. Pretty good results. It's just a -- we're in a unique position. And as Jay mentioned, our gross margin is at 80%, gives us the ability to do a lot of things. Also with the SaaS model, a lot of leverage you can pull, a lot of levers. So we're just in a unique position, strong market, strong team and just a great position to go forward.

Fantastic. Well gentlemen, congrats once again on all the success, to Jay, you, and the entire team. Thank you so much for joining us this year at the conference. It's always a delight to see you, even better to see you at the CS Conference. And hopefully, we can all get together in person at some time not too far away. So with that, thanks, everyone, for joining, and have a wonderful day.

Thank you, Brad.

Thanks, Brad.

Good seeing you. Take care.