Zscaler, Inc. (ZS) Earnings Call Transcript & Summary

Great. Thank you very much, everybody, for joining us for the last session of the day for me. We kept the best for the end. I'm hosting Zscaler's senior management, Jay Chaudhry, CEO; and Remo Canessa, CFO. And I'm going to take them through 2 pages of questions, whatever I can squeeze into 30 minutes. And I want to start with a high-level question. And I think that's going to set the stage for the discussion later on this afternoon.

So you reported a very strong 3Q, and I must say, despite the concerns of investors over post-COVID deceleration. Your revenues were up 60%. Your billings were up 71%. And just to put it in perspective, these were almost double The Street expectations. The question is, why? What is driving such strong growth even on the yields for after a year of excellent performance? So despite the tough comps, you are still performing well, what is driving it?

I think we have said several times that COVID did not create a burst for us to fill the demand for a certain time and go away. COVID has the biggest catalyst. It has shaken off inertia. The kind of evangelism we used to do and say, Internet is becoming your corporate network, you don't need MPLS, you can go direct. Internet showed that it can happen. And CIOs and CTOs became bolder, and now they are accelerating their transformation journey and we are essentially a critical piece of the journey. So as acceleration of transformation is are happening, as customers are kind of shaking off inertia, they're buying more and more Zscaler architecture and products.

Got it. Jay, you mentioned zero trust as a key growth driver. You mentioned it multiple times in the last few months and quarters. Can you discuss it into -- in more depth? What does it mean zero trust? Why is it creating growth for you? And discuss your positioning to benefit from the migration to zero trust?

Yes. Zero trust is fundamentally a new architecture of doing security. Architectures don't change every year, every 5 years. Architecture change every 15, 20 years. The legacy security architecture that was pioneered by firewalls was to build castle-and-moat. Either you're in or you're out. Zero trust says no one is trusted, no one is in my castle. So it really moves to the notion of Zero Trust Exchange. The easiest way to understand is think of a smart switchboard. If you have one person who wants to talk to another person, you go to a switchboard. If switchboard has permissions to connect, it gets connected. So in the zero trust world, there's nobody getting inside, there's no such thing as you got infected and the infection moves laterally. And partly, zero trust has become a lot more urgent, is because of SolarWinds and some of these ransomware attacks. In SolarWinds, you are breached. Your infection is going to traverse laterally to find high-value targets and get them out. Zero trust helps with that, firewalls don't. Look at the latest Colonial Pipeline attack. It happened through VPN. VPN puts people on the network. As long as you have VPNs, whether they are in the cloud or wherever, they are dangerous. And once they got them there, they move laterally and they can't hold up billing systems of this company. If you control billing systems, and how do you really supply gas to whom, it doesn't work. That's why it has a big impact. So zero trust is becoming more and more important. It is probably the best way to reduce business risk and protect against ransomware and a bunch of other attacks.

And why are you positioned well for zero trust?

Because zero trust is a new architecture, you can build zero trust architecture on top of firewalls. The legacy vendors are trying to hijack it because they're getting disrupted, and they need to do something about it. A couple of weeks ago, I saw a big line from a vendor that said, "We are the best zero trust network security solution." So there's nothing more oxymoron than combining zero trust with network security. Either you're doing network security or you're doing zero trust. But the world is learning. It is great to see the Biden administration issue this EO that clearly said zero trust, and it should be based on NIST's recommendation. NIST is a very respectable organization that spells out what zero trust is. And it's clear forming. It's not firewalls, it's not castles-and-moats, it's a switchboard approach.

So you speak about the concept, and I think here, you didn't mention it by name, but that's exactly what you're explaining. You speak about the concept that your platform is isolating the applications. You mentioned also on the last conference calls, you mentioned multiple times browser isolation. So isolation is the big factor in all our discussions so far. Can you elaborate on the topic of isolation, meaning speak about -- if you can speak about -- talk about application isolation and browser isolation and your platform, how it enables it. And maybe we can explain it to those that don't know Zscaler very well?

Yes. Thank you. You can think about isolations in 2 buckets to simplify it. One is isolating applications from users. Traditionally, users and applications connect to the same network, hence, user can access the application. The problem is if malware gets in the network, it can also take over the application. So the zero trust notion was isolate applications from users. Don't put them on the same network. A user comes to our switchboard, we validate who you are, then we create a new connection to connect to the application if the policy said, yes. So applications are isolated from the user. That's the fundamental part of zero trust. Traditional firewalls don't do that. They have a pass-through connection. They don't stop and then reconnect. That's one part. Browser isolation is a little bit different kind of isolation. If you access an application on a normal laptop, for example, the data comes down to your laptop. And you can see it, you can copy it, you can save it, you can copy and paste it. So there are many applications where people want to make sure that doesn't happen. So we run essentially a simulation as if the application runs in Zscaler Cloud, and we are streaming pixels to the end point. So with that, it can do better data protection of people. The data doesn't get to the screen. It's like the image gets to the screen. So it provides better data protection. It can also provide better cybersecurity because none of the threats like phishing links and all go through it. So 2 types of isolation both help in 2 different areas.

Got it. In the last -- on the last conference calls, you have also mentioned another concept, and I want to go over it. Your ZIA solution was designed originally, I'm talking about originally, it was designed or maybe it was not designed this way, but was sold in a very specific kind of environment. And it was not about campuses. It was more about branches. And it was -- and you mentioned on the last call that you see that also organization in campuses are starting to use ZIA. So this is the situation that you talked about. Can you take a step back and can you explain, first of all, the environment for ZIA and the growth for ZIA that was -- traditionally been in the market and the change that you're seeing, the evolution that you're seeing?

Yes. Of course. So ZIA, Zscaler Internet Access, was designed such that any user anywhere should be able to get to Internet or SaaS applications through our cloud, which is like a security check post. Think of us like an international airport. We're checking your boarding pass, visa, passport and luggage to make sure we keep you safe. So we were never designed to sales for branches and remote users only. We are always designed to take any traffic from branch office, campus, headquarters and home or wherever. And ZIA has actually been always used for almost all employees because you want to protect all of them. Now contrasted, ZPA started out with remote users. And now they want to really use ZPA for every user even in the office as well.

Okay. So that takes me to the next one, which is I want to understand the ZIA and ZPA. I'll start with a very basic question, just for those of us that do not know the company. I want to understand the problem that ZIA and ZPA are trying to solve separately, and then I want to understand the synergy between the 2 products?

Yes, of course. So if you think about users, we all need to work. We go to access the application. You can put all the applications in 2 simple buckets. Bucket one, we all go to Internet, or LinkedIn, Gmail, Facebook, whatever. And we also go to SaaS applications like Office 365. When we go out there, we want to stay safe because all bad things come from the Internet or they leak off out of the Internet. So ZIA is an inspection check post for Internet and SaaS application access to keep users safe. Now that's half the applications. Then there are other half of the applications that are sitting in your data center or in a public cloud-like Azure or AWS that an enterprise is hosting or they route to themselves. And those applications are like SAP, for example, you are not worried about that your employees are going to SAP and they're going to get infected. They're worried about who can get to SAP and really cause damage. So for that, you need a different kind of policy inspection, and Zscaler Private Access does that without requiring VPN and the like. So a combination of ZIA and ZPA, it ensures that any user can access any application, internal or external, transparently with consistent and great user experience. Between the 2, they are ready to work from anywhere, work from home, work from anywhere.

ZIA was first launched, ZPA is a later addition. The majority of sales are still ZIA today. What are the hurdles to have higher ZPAs? Is it just a question of time? Or are there culture issues or deployment hurdles? What are the drivers basically for ZPA deployment?

ZPA is giving a very good competition to ZIA. While ZIA is going fast, ZPA is going much faster. I mean, 40% of our Global 2000 customers have ZPA already. I mean we are in the fifth year, right? We went from 4% to 10% to 15% to what, about 27%, 28% of new business. That's pretty remarkable. So it's growing fast and it's a little bit different sell. But it -- because in this case, you really need to educate the customer about zero trust, not putting people on the network segmentation. It has big, big potential. I won't be surprised that one day ZPA can become bigger than ZIA from a market opportunity point of view. But both are doing very well. We're very pleased with the performance of both and they are cost synergistic, and now more and more customers are buying them together, ZIA, ZPA bundle upfront.

Yes. What market are you disrupting? Meaning, when you go to a customer and they don't have Zscaler at all, and they take ZIA, they take ZPA, what kind of product are you disrupting?

So if you really think about ZIA, ZPA together, it eliminates the need for any network secured. So if you think about a network security TAM or whatever it is, it basically goes away with us. Now having said that, we don't really try to go and say, I'll take it all. We look for a beachhead. For ZIA, the beachhead ends up being proxy because that's what people are doing with Blue Coat, which was our traditional Professional Bundle. But customers see the need for the rest of the stuff. So they soon say, "No, no, I want Business Bundle." Then they say, "No, no, I want Transformation Bundle." So majority of the stuff you're selling with ZIA is Transformation Bundle, which eliminates most of the stuff that should be sitting in the Internet gateway, like not only just proxy, antivirus, sandboxing, cloud firewall, DLP, bandwidth control, all those things are gone because when you're working from home, you don't have anything in the middle of it. We offer all that functionality. With ZPA, it started out with replacing VPN for remote access. But we are not just VPN, we are actually taking care of being a global load balancer, being your DDoS protection, external firewall, IPS and the like. So imagine going to AWS and Azure applications directly over the Internet, you don't need to buy anything. ZPA takes care of it. And none of the DMZ's products are needed.

Yes. So I'm going back to the first question I started with. I expected billings to grow 39% this last quarter, and you grew 71%. Where was the surprise? What are the key drivers for such a high growth in the quarter that we all were worried about COVID deceleration?

Right. I think the COVID deceleration was just overblown by investors. We told them so many times that we were not bought for a short duration for COVID. We are being bought for transformation. Most of our deals were 3-year deals. I think the growth is coming from the fact that we have a stronger sales organization now. We have been acquiring at a faster pace, and it's more efficient. And the market is coming to us. All those things are happening.

I hosted today Fortinet, and I hosted Palo Alto. If -- when I was involved in your IPO, if you were the only one talking about SASE, today, every company speaks about your market. How is competition? How do you define competition? And is it more difficult today versus, let's say, 2 years ago when you had less competition?

No, it's no more competition today than it was 2 years ago. Especially on the higher end, we dominated a large enterprise space. Think of it this way. When it comes to being a secure web gateway, building a proxy architect is very hard. There's only one vendor who built a good proxy architecture on-premise, that was Blue Coat. They had 85% of the Fortune 500 companies as their customers. They just couldn't pivot to build a multi-cloud, multi-tenant architecture. So they just failed. I think -- so we have lots of competition on that end from Blue Coat, from McAfee, from Cisco for years. These are not small companies. And they've all withered away over time. And now firewalls are trying to kind of say we can do it, too. While Blue Coat's world had one thing against them, they lacked multi-tenant architecture, firewall companies have 2 things against them. They don't even have a basic proxy architecture and they are multi-tenant. It's like Siebel software trying to compete with Salesforce because Siebel is 5x bigger than Salesforce, but the right architecture wins.

Got it. Got it. So we can talk about ZIA and ZPA for a long time -- sorry, before I go on to the next question, I had another question I had in my mind. We spoke about competition. We spoke about your architecture. There is another set of companies that are basically stating that they have a similar solution. And I wanted to know how do you view them as growing competition, if at all. If the CDN players, companies like Akamai, Cloudflare, and Cloudflare specifically speaks about SASE and et cetera, so how do you view CDN players being that they have their own network? How do you view them in the market as competitors?

Yes. What's common with CDN players is that they have a number of distributed data centers, perhaps. Why? Because they need to do content caching. They need to put the content near where the user is. The similarity ends there. They are sitting in front of servers to really make sure they can protect servers against DDoS attacks, and they can do CDN. We sit in front of users. Everything about us is protecting users on one side, workload on the other side. ZIA protect users from external stuff. ZPA secure access to internal stuff. ZDX, user performance. So we are sitting on the opposite side. Now folks like Akamai have tried to come into our space for the last 5, 6 years. They even bought a proxy company 5, 6 years ago. I've never seen them in any deal out there. I think the challenge I see is that CDN is a commoditized market. Okay? And it's going -- it's being subsumed more and more by hyperscalers because as they offer applications, they will offer CDN as well. They are offering CDN as well. So these vendors need to find some space to look and go somewhere else. So I have read about them. I haven't really competed with Cloudflare. I don't even recall the last time I saw a competitive situation. We competed with Akamai on 3 deals in the past 1 year for ZPA, period.

Got it. You built your own cloud. Other companies like Palo Alto, they use GCP. What are the advantages and disadvantages of your approach, of building your own cloud?

If you are a real cloud company, you build your cloud. If you are an application company running -- you run on someone else's cloud. Okay? Very simple. Do you think Azure will ever run on AWS? Do you think Salesforce will run on top of AWS or Azure? They won't. Do you think a small SaaS company will run on AWS? Of course, they will. Do you think enterprises should run on AWS? Yes. We are the security cloud. We are designed for optimal performance in all kind of locations because we sit in that traffic path. We are not a destination. Cloud vendors, hyperscalers sit as destinations because that's where applications are. That's only one part of it. That's part to do with performance. And if you look at the ROI gross margin issue, there are all kind of articles about it. If you have a real cloud business, you can't be a profitable company by running on a public cloud. Read an article written by the Dropbox CEO and Founder. He quantifies the bunch of other articles around it.

Got it. Switching gears. The company is talking -- management team and yourself talking about 3 products as cornerstones of the business. ZIA, ZPA, which is understandable, but you also add ZDX. And the question is, what is ZDX? What does it provide, that it's so important to your customers?

So ZIA and ZPA make sure that you can access any application from anywhere, it doesn't matter, which is wonderful most of the time. Once in a while, something goes wrong and your performance is slow. You don't even know what's wrong. Your laptop may have issues, maybe that DNS locally has some issues, WiFi at your home or hotel has issues, and your traffic goes over 10 hops over the Internet. There is issue somewhere in the application mechanisms. The IT organization doesn't know where to start. Since we're sitting in the middle, we exactly know where the issues are, and that's the hardest part. Where is the problem, then they can go and try to fix it. So we have the network, full understanding. I mean, today, we'd let you know that this network path has hacker blocks. Tomorrow, I want to read out your traffic through a different path to eliminate that kind of stuff. So today, identify and help resolve issues. If you don't even identify, you can't. You can spend hours trying to figure out and tomorrow do automated remediation as well.

Do you provide any stats on what percentage of the ZIA and ZPA customers are using ZDX?

I think it's early stage. Remo, go ahead.

No, we haven't. Just like Jay said, it's early stage. But we did say at the end of Q2 with hundreds of customers who are on ZDX, and that's increased, but we have not given any stats out.

And Remo, is this an independent product? Or is this a product that is only sold to customers of ZIA and ZPA?

I can answer that. It can be sold either way, independent with ZIA, with ZPA. See it really doesn't have much to do, but it's not dependent upon ZIA or ZPA. It's collecting telemetry you need to show where the bottlenecks are. The bottlenecks may be for internal application, internal or external, doesn't matter. So it's independent. But when a customer, buying ZIA or ZPA, that's where they're enabling work from anywhere, and this becomes a natural place to buy along with it.

Got it. So before we run out of time, I want to make sure I cover all your portfolio. So I want to also touch on ZCP. And you recently launched this product. Can you describe the main offering and what is, in simple terms, what is the problem that you're trying to solve?

So lots and lots of workloads are being launched in the public cloud. Like users, workloads talk to Internet. Like users talk to applications, a workload needs to talk to other workloads. The zero trust architecture we've built by users through application access, they have taken it, now applied to workload-to-workload communication. That's a big differentiator for us today. This is being done with virtual firewalls and a traditional network security model. We believe we will disrupt that model with our workload communication. That's one side of it. Then this segmentation is the second part. Then security posture with CSPM and CIEM is the third area. So cloud protection will evolve as a pretty large portfolio because this is a young market, it's evolving, and you'll see more offerings coming in that space.

Got it. Remo, maybe we can talk about financial targets. Talk about 2 things, if you don't mind. One is, what are your targets in terms of growth and profitability? And second, as a CFO, what are the challenges that you see for the next year? What are the areas where you were paying your attention?

Good question. So what we talked about on our earnings call is that the growth that we're seeing is exceeding what we expected. So we are going to put growth over profitability and put the premium on growth. The challenges I see from a technology perspective, not really, I don't see it. I mean the things that we've done, the products we've come out with, the acquisitions, it's going very, very well. From a competition perspective, Jay talked about it. I don't really see it, at this point, competition really being an issue. And legacy companies basically have to retrofit and go through public cloud, which is the -- not the way you want to do it. And Zscaler built this platform from the ground, that's going -- building its own TCP stack 10, 12 years ago for throughput and speed. So we have the ability to put additional applications and services on our platform, which where we are and the growth that we're having and the people we're adding to the company should increase the lead. What are the challenges? Really, it's execution on our part. We're going from a $600-plus million company to a much bigger company. You could see by our growth rates, and as you mentioned, 60% revenue growth rate year-over-year. The challenge is basically how do you fit into that, making the right decisions, executing, working as a team. And so that's the real challenge. But we're making a transition into being a bigger company, a very, very substantial company.

What about scaling up your infrastructure given that you're just growing much faster than expected? Is there an issue -- general question, first of all, is there an issue of supply chain, getting devices, et cetera, in order to scale up your network, number one? And number two, what about capital allocation and the capital required to do it?

Let me answer the first part. Remo, you answer the second part. I think the more Zscaler stands for zenith of scalability, the architecture, the design to scale, so the throughput we get is pretty massive from standard Intel boxes, that's number one. Number two, we don't really ship tens and thousands of boxes out there of our own consumption with a highly optimized software. The number of boxes we need every month is not monumental. So we haven't really faced any supply chain issues and we plan accordingly and we are little bit extra careful. Remo, you can take the second part.

Yes. And also from a capacity perspective, we try to maintain 50% excess capacity in our data centers also. So we -- there's plenty of headroom. If something occurred, like last year, we had 10x increase with ZPA, we have the ability to offload that into public cloud. Now as Jay mentioned, public cloud has lower gross margins. So we got that back into our data centers. From a capital application -- from a capital perspective, I would say high single-digit percent of the revenue on a quarterly basis, I really don't see that changing. It's just the efficiency of the platform that we've created, so from my perspective of a low capital allocation related to maintaining our cloud.

Got it. So same question to Jay. Jay, what keeps you awake at night when it comes to the business?

Well, on the product side of it, we are innovating at a very fast pace, very proud of our engineering team. Our customers are happy. Things are happy in front. The go-to-market engine, which we needed overall a couple of years ago, has gone through most of it. I am focused on 2 things. One, I keep on looking for people who walk on water, so keep on adding to the team. Growing the team is my #1 priority. Number one -- number two is to make sure we don't become complacent, success doesn't go to our head, and we keep on serving our customers and keep on delighting them. But it's all going good, but I believe in being paranoid like Andy Grove.

That's good. Paranoid is good for business.

Yes.

Great. Thank you so much. We are almost running out of time. We only have a minute left, but I ran out of questions. So we got to the end of my list, 2 pages. You're very efficient. Thanks, Jay, and thanks, Remo, for the time and effort to educate our investors. Have a great day.

Thank you all very much.

Thank you. Goodbye.

Goodbye.