Zscaler, Inc. (ZS) Earnings Call Transcript & Summary

I appreciate you joining us today. I am Patrick Colville, a senior analyst at DB covering cybersecurity software. The format of this session will be a fireside chat with a listener Q&A. There's a chat box where you can ask questions. Any questions are anonymous, so we will not mention your name or your company affiliation. Let's kick it off with introductions. We've got Jay Chaudhry, the CEO and Co-Founder of Zscaler with us, not co-founder, the founder; and Remo Canessa, the CFO of Zscaler with us today. Thank you guys for joining us.

Thank you, Patrick.

I'm sure the audience know this, but Zscaler is a cloud security pioneer and meter in SaaS. I think I'll just jump straight into questions. So Jay, I mean, from a technology perspective, can you just talk to us about what differentiates Zscaler ZIA and the Zscaler ZPA versus peer group?

Of course, [indiscernible] use a couple of slides to set the stage and visually, it's easy. On the left side, you see what's known as network security you get on the company network, either by being in the office or remotely doing a VPN, your own the network as a user, you can access any application that's wonderful, but a malicious person can also access anything and bring everything down. That's why zero trust was invented. Zero trust is the opposite of network security. You do network security with a castle mode architecture with firewalls and VPNs. You do not do zero trust exchange with firewalls or VPN. Zero trust trust means, trust no one. In this model, your applications are merely destinations. Your users are all untrusted. And if user to access applications, they go through a zero trust Exchange, which is like a switch board. Just like an intelligent switch board. A user comes to us. We validate who you are, we check policy, and we connect you to a particular application and that application only period. The [indiscernible] no ones a no network. So fundamentally, a very different architecture. Now there are 2 kinds of applications out there at a broad level. External applications like internet and SaaS that every user needs to go to. They go through our ZIA service. We want to make sure we block the bad, we protect the good from leaking out, that's ZIA. For internal applications, you're less worried were getting infected because you went to SAP in your data center, you're worried about who can get there. So for that, we built Zscaler Private Access where you can access applications without being on the network without doing any VPN and the like. If you have been reading news all these big attacks, including Colonial Pipeline, they all happen because people got on the network through VPN or otherwise. And then last comment I'll make here is, when do you go through your transformation. You don't see much of a network in this diagram because internet becomes -- excuse me, internet becomes your corporate network. Over any network, you come through Zscaler exchange, we connect you to the provider, cloud providers, SaaS provider or your data center applications. We complement identity vendors. We work closely with endpoint vendors. We can take traffic from any SD WAN, and we can feed logs to security operations. We allow customers to consolidate around point products, but you essentially get away from doing traditional network and traditional security. With that, let's go into Q&A. Patrick. I hope it was easy to follow.

Yes, that was excellent. So I appreciate you taking the time. The standard opening question I'm asking every company can you just talk about the demand environment? And I guess kind of the second part would be, how does that demand environment compared to a quarter ago? And how do you think the demand environment will trend over the coming year?

Good question. We always said we were about to drive secured digital transformation, which was happening pre-COVID. COVID Accelerated it. COVID also accelerated the need for working from anywhere. That's the market we pioneered. And in the past 3 or 4 quarters, since we saw a big solar wind attack. Then we saw colonial pipeline. We saw Microsoft issues. All these things have further heightened the need for doing zero trust because ransomware exploits lack for movement. So we've seen zero trust becoming the center of everything. Biden administration has raised further visibility for it. We're getting inbound calls. Now the interest in implementing zero trust has gone up significantly, while legacy vendors are trying to cause confusion in this place by really spreading this information where they like to say, we are the best zero trust network security company. Like come on. It's oxymoron. Either you are network security or your zero trust. You don't do zero trust with firewalls or VPNs even if you spin them in the cloud. Good thing is when Gartner starts writing good articles on on zero trust network access, when NIST start highlighting the need for zero trust, where you don't connect to the network, it's becoming clear. And that's what's driving our business. That's what driving our growth, and we don't see it slowing down.

Appreciate that. And Remo, a kind of key question, I guess, do you have any thoughts to add on that question around the kind of demand environment, and how it compares to quarter go and how it might trend?

Yes. I mean Jay pretty much said it. I mean the world changed with COVID back 2 years ago and really put the spotlight with the problems with today's networks. Since then, with the attacks that have been occurring, it just has created more and more of an awareness. That in addition to our broader platform, the introduction of new products, in particular, emerging products, which did very well this past year in the high single digits of new and upsell of ZDX and ZCP. I mean the platform play for Zscaler is really resonating with customers. We saw that with the -- our record 7-figure deals in the quarter. Every metric that we saw in Q4 was very, very strong. Short-term billings, 71% CRPO growth rate an 80% RPO bookings growth rate at 113% just across the board, every metric that we looked at was strong. that appears to be carrying over. I'm not going to say to the same level as we had in Q4, but things are very -- looking very good for Zscaler.

I mean probably good time to say congratulations on [indiscernible] prices at results. It was -- so I've been following Zscaler for a long time. It's -- it was very impressive to see. So, yes. Jay, can I talk about something technology? So the Palo Alto Networks was fairly dismissive of the proxy architecture delivered as a service. They have now reverse their course and now support a proxy architecture in Prisma Access 2.0. Can you just help me understand why that hasn't made the environment more competitive for the Zscaler?

Changing your views to say we want -- we need to do a proxy versus building a proxy of 2 different things. Creating PowerPoint is a lot easier than building products, especially building a proxy. Think of this way, how many proxy vendors have tried to come out and build a sizable, scalable proxy out there. The one I think was Blue Coat. That's why they had 85% market share at one time. They had the best on-prem proxy. They just could not pivot to make a multi-tenant to do what we did in the cloud. They're the best shot at winning this business. These guys don't have a proxy. Cisco, McAfee, Websense, they all try to build proxies, they couldn't scale proxies hard, you terminate, you inspect, you send it back without introducing any latency. It's opposite of firewall. A firewall is a pass-through architecture. It tried to scan whatever it can scan while the traffic is flowing, okay, period. So it's a hard architecture. We don't expect any meaningful enterprise class proxy from any of these competitors in the next year or 2.

A conclusive answer Okay. So I appreciate it. I guess in terms of new logo acquisition. I mean that was definitely something that -- fiscal '21 has been pretty impressive. You talked increasingly about focusing efforts in the mid-markets. So you're adding more sales reps, more marketing programs, more kind of channel partners. Just help us understand why is now the time to go off that, mid-market opportunity? And then how is that mid-market opportunity evolving?

Yes. I'll start Remo, and then you you can add.

Okay.

Cloud mid-market, we call it the lower end of the enterprise market, and we define it as 2,000 to 6,000 users. It's a natural thing for us to expand and come down. We aren't really pushing on the SMB market, which will be maybe a few hundred users or less than 100 users. So our sales process hasn't changed a whole lot. It's expanding. It is simpler, it's fewer stakeholders. Channel can actually play a bigger role in 2,000 to 6,000 user range, then they play in a 50,000 person range. In 50,000 companies, we actually need to get involved, no matter what happens. That's what happens with everyone. In this sense, channel is helping, our Summit program is helping. This is our fastest growing market segment. We are very happy about it. Remo?

Yes. Our customer count went up to 5,600 over 5,600 this fiscal year compared to 4,500. So real strong growth. And also, we saw an acceleration new customer growth in Q4. Just as a reminder, major companies of 40,000 employees or greater, large enterprise is 6,000 to 40,000 and enterprise as the 2,000 to 6,000 and commercial is under 2,000 employees. Our focus up to this year has been in the majors and large enterprise. So we put in place a summit program at the end of last year, about a year ago. And we're seeing the contribution from VARs increasing. So VARs we're seeing increasingly embrace cloud and cloud transformation. And so the message for the large enterprises and the majors that we had is starting to resonate also with smaller companies, and it's going downstream.

Great. I appreciate it. I mean, as a reminder to the audience, there's a chat box where you can ask questions. Any questions are going to be anonymous. So we're not going to miss your name. I've actually got a question over e-mail, Remo, can you just talk about the quota-carrying sales reps? And how -- like how many were added in fiscal '21, how are you thinking about quota-carrying sales reps in fiscal '22?

Yes. So let me make a few comments on that. We increased our field quota sales reps since fiscal '20, over 60%. We talked about for fiscal '21 was that we'd increase our quota-carrying sales reps on a number basis in which we did total headcount. For the comment we made for fiscal '22 is that we're going to increase the number also from fiscal '21. Now just to give you some perspective, we -- when we came into the year in fiscal '21, we did the plan, we expect that productivity to be lower. Actually, sales productivity was higher in fiscal '21 versus fiscal '20. The reason for that is the -- we really beat our plans on the top line very, very strongly. Going into fiscal '22, the comment we're making is that growth is really important. It's the most important thing for Zscaler. It will balance growth with operating profitability. And you've heard the comments we made on the call yesterday. Having said that, we're going into our plan for fiscal '22 is that we're going to have sales productivity to be flattish slightly down. So we are going to be increasing our sales risk. Hope that gives you some sense of what we're seeing. The market is really good. As I mentioned, things are going very well, and we're going to take advantage of it.

For sure. Can we just switch gears to, I guess, upsell? The I'd like to understand, I guess, better beneath upsell opportunity. And like -- and I guess the reason I ask is your trailing 12 months net retention rate metric that you disclosed yesterday was very impressive, 128%. I know on the call, you're kind of walking us away from putting an undue focus on that. So let's maybe not focus on the number quite so much, but just talk about the upsell opportunity from here from existing customers. Is that higher bundles? Is that cross-selling? Any way to quantify that would be great.

I'll start, and then we can contribute. Our new and upsell mix for fiscal '21 was 45% new and 55% upsell. It is -- we're also seeing our transformation metal increase. So at the end of last fiscal year, for ZIA transformation was 49%. For fiscal '21, it was 55%. So what we're seeing is that customers are moving to higher transformation -- And also, we're seeing the breadth of our platform. We're selling a lot more. As I mentioned, ZDX and ZCP, high single digit of our new and upsell. ZTA being 27%. But when you look at that 27% -- in CCP, if you looked at just no contribution from the emerging products. ZPA contribution on an apples-to-apples basis is close to 30%. So browser isolation, CASB out-advance we've reduced a lot of new products and applications and features, which has really contributed to that upsell opportunity. We also mentioned on our Analyst Day that if you take a look at our installed base of customers. Just for ZIA and ZPA, not including CDx or ZCP, there's a 6x opportunity for us to upsell more into our installed base, which is very, very significant. Going forward, when you think about new and upsell, think about upsell being in the -- more in the 50% to 60% range on a quarterly basis. It's just the opportunity is really big. And with the breadth of platform that we're introducing, we see a lot of opportunity in our existing installed base. And Jay?

Yes. I think the product innovation is accelerating. 3 years ago, I would be working on 3 new streams now I'm working on 6 new streams. And we should because we are a larger company, we have more capacity, more cycles. So we don't plan to slow it on the innovation side. I think what's exciting that I am becoming more and more convinced is that security market will keep on accelerating and changing massively. All of us think about security. We put them in a couple of buckets. Here's a firewall VPN. Here's end point here's identity, and in the whole range of other things out there. But trying to compare the change in security to what happened when clouds started when AWS start to sell, what did they sell? Compute, storage and connective period. Now do you really go there for cloud computing story? Yes, yes, it's kind of basic. It's table stakes. You go there because there's so many new products being offered they're making it easier to develop product and even building network as a part of the cloud. Did you ever think that router is going to be all part of the cloud they are because they're making it easy. They're using load balances should be part of the cloud offered by AWS. Well, they are. They're being offered. So you're seeing innovation. We think the same kind of innovation is going in the security space, and we are leading it. And the biggest disruptor of this is zero trust, which is upending the traditional firewall, which was a linchpin of network security. We are basically saying, if we are the switchboard, we should be doing everything we could be doing. The most exciting part of our new offering besides ZDX, okay, which is better is under ZCP product line, cloud protection is really how do workloads communicate with ECA. Just like we did ZIA for users, ZPA for users, now we have available what we call ZIA or workloads and ZPA for workloads. And we kind of bundled it under the name we announced in December called Workload Communications. Who else is talking about that? Nobody. You know why? Because for workload communication, they're basically extending their current corporate network to every availability zone, if you got 16 zones, you create a mesh network in 16 zones, almost like a branch network and you put lots of virtual firewalls around it. That's only where the world knows how to do it. We are the pioneers who are taking zero trust for workloads to the market. So that's in early stage. We recently launched the product, and we think there will be a big opportunity. So these are the kind of innovations that will further disrupt the market, we don't think the market will remain almost status go, the way firewalls have had run since starting one in early '90s, 30 years, VPNs for 25 years. All that is changing, and we are well positioned to really take advantage of the new model.

And I mean Zscaler 3 years ago, IPO was an easy company understand because you had ZIA and ZPA. Now there's a lot more products. Just help us conceptualize which of those products you think are most excited about? Which are the ones in which we should really focus on and spend the time speaking to your customers and partners about because these are the products are like really exciting?

Yes. Sometimes we wonder how to communicate this message because ZIA and ZPA or IPO times are very different than CI and ZPA today in terms of the number of modules in each have expanded quite a bit. For example, out-of-band CASB, it's subsumed in it. In brand CASB is part of it. has fully owned has become very big. The whole market for data protection that vendors like Symantec want to did for traditional line. It's all part of it. So I think it is increasing our TAM. It's making it easier for a customer to say, "Oh, I can turn this thing on and this thing starts working." So ZIA and ZPA are growing, they will keep on growing. It won't going to stop. For example, Brazil isolation, I didn't think that it will be needed for both. It is not part of ZPA for data protection. It's part of ZIA for cyber production. And so those 2 are obviously big pillars. But ZDX is exciting. It's a fairly well-defined specific product. We priced it at actually pretty attractive price of we get about $25 per user. That's what we shared at the Analyst Day, but that pricing makes it easy for a customer to buy ZDX for every user. We think it's a matter of time when every customer will have ZIA, ZPA and ZDX, for all users. So that's one. That's all about users. Then you look at all about workloads. And that's where I already talked about Zia and ZPA for workloads. I think that will be our biggest horse. It will be highly -- it is highly differentiated, different architecture, and that will be supplemented by 2 more areas. Workload micro segmentation, which is more advanced segmentation at the process level. We entered in the market through the acquisition of Edgewise Networks. And the other piece, which all of us read about because it's written so much. It is the cloud security posture, cloud entitlement. I think about that almost like API-based CASB, We make API calls to the database of logs. We see, is it configured right? Is it not configured right. Nobody will have a highly differentiated long-term advantage in that market because the barrier to entry are small. But I think if you -- we are there because we need to round out and offer the whole portfolio. But I think overall, ZCP market is a massive opportunity. It will keep you to grow, but it is in the early stage. And we are investing heavily in that market.

And actually -- and one of the pros I want to talk about was Zscaler Cloud Connector. And I guess the reason why because we spoke to a partner of yours we've got phenomenally excited about Zscaler Cloud Connector. And so it's always interesting kind of to hear that where partners are like you guys have got to check the sales. Just help us understand that product and the use case solving.

Yes, it is -- it is interesting how partner is describing it because some of my engineers and team talk about Cloud Connect. So Cloud Connector a mechanism to send traffic from a workload, or a VPC to either ZIA cloud or ZPA cloud. So when I said, we now have ZIA workloads and ZPA for workloads. It's the same engine -- but the way we can get traffic to it through Cloud Connector. Now you could think about Cloud Connector is actually similar to client connector, which we deploy on a laptop. So traffic comes to us. So Cloud Connector is fairly simple, -- But without this workload communication module, which is actually ZIA and ZPA workloads won't work. So it is the enabling piece for us to sell ZIA and ZPA for workloads. Makes sense?

Yes , Yes, that does make sense. I appreciate that.

And it's Free. By the way, we don't charge for Cloud Connector just like we don't charge for Client Connector. It's a way of sending traffic for our users. We charge by a number of users for workloads. We charged by a number of workloads and the mechanism and softer to send traffic to us is always free.

Got it. And I guess, I mean, switching to kind of ZPA. When we do our checks speaking to customers, it typically the ZIA product is scaled to 100% of users almost from the get-go at the point of license, we got 100%. What we found is ZPA is typically scaled to a subset of users and then kind of gradually expand -- Is that -- I mean, do you think that dynamic will remain -- is probably, is like, or do you think there's a point where ZPA gets to 100% of users?

Even before Corvid, I said that it is a matter of time when every customer -- every user will have ZIA and ZPA. And actually, I've been saying ZDX too now. Pre-COVID customers will start somewhere in the 30%, 40%, 50% of the total ZIA users will be ZPA. COVID certainly changed that because everyone needed to go and access those applications. And now with zero trust, customers want to make sure whether users are at home or back in the office, they really need to go through zero trust switchboard for Zscaler. So we are seeing more and more and more deals. Most of our deals are actually Zia equal to ZPA, though it's not the same in most cases. But think of even a couple of years down the road, as most of the applications are sitting in public cloud. Data center has a minimal role to play. You may be sitting in the office. You need to go through Zscaler ZPA to access those applications. That's the only right approach. So I'm pretty convinced that it's a matter of time when the number of users for ZIA, ZPA and ZDX will be pretty close to each other.

And how does this translate into numbers? Remo, you shared that ZPA was 27% of new and upsell, thinking about -- I actually don't know where that's trended from, so like has that declined over time as butane and upsell has increased over time? And I guess, help us understand how we should conceptualize going forward that kind of mix?

Yes. I mean -- and again, when you compare apples-to-apples because the last year before this past year, we did not have really any substantial ZDX or ZCP business. And if you just compare purely to ZIA and ZPA on a year-over-year basis, ZPA has increased as a percentage, it's close to 30%. If you take a look at our entire platform, ZPA was 27% in fiscal '21. So slightly down from where it was in fiscal '20. But again, we're selling our broader platform with the emerging products, which represented the higher -- which represented high single digits of our new and upsell. Going forward, as Jay mentioned, our view is that all companies will buy for 100% for users, 100% for ZPA and 100% for ZDX. How that happens and what time frame? That's hard to say. What I can say also is that basically, there's a lot of opportunity for us to upsell the ZPA. 44% of our G2K customers have both ZIA and ZPA. So there's an opportunity still to upsell. So our view, like Jay said, one for one for one, ZIA, ZPA and ZDX. That's going to take time.

And what's the catalyst? I mean, Jay highlighted the catalyst for ZPA adoption was coronavirus. Do you need another global pandemic to catalyze ZDX and ZCP adoption?

So ZDX -- so first of all, yes, ZPA became pandemic because everyone had to work from home, but then all these ransomware-related attacks, which happen because people get on the network and move laterally. So now the bigger catalyst for ZPA's zero trust, don't put people on the network. Now ZDX Catalyst became working from anywhere when users are working somewhere. IT doesn't know how to troubleshoot when users complain. So as we know, the world is not going to go back to the same old thing. It always will be a hybrid environment. And that essentially will keep on driving the need for ZDX and ZPA further.

Thank you so much. I mean, I think for me, the key takes on the call is the demand environment remains really healthy. The COVID tailwinds still there. But now increasingly, the demand driver is zeru trust adoption channel playing an increasingly important role, especially in the mid-market segment, which is now the fastest-growing segment in Zscaler. Zscaler is increasing quota-carrying sales rep on an absolute basis, more in fiscal '22 than happening in fiscal '21. Really fascinating conversation, Jay, Remo, thank you so much for your time and great.

Patrick, thank you.

We'll see you later.

Stay healthy. Bye-bye.

Goodbye, you too.