Zscaler, Inc. (ZS) Earnings Call Transcript & Summary

Okay. Great. Well, hey, good afternoon, everyone. Welcome to day 2 of the Barclays TMT Conference. Would not be a Barclays conference without the team from Zscaler. So very happy to have with us Jay Chaudhry, CEO of Zscaler; Remo Canessa, CFO of Zscaler. We've also got Bill Choi, Head of Investor Relations and Strategic Finance. We've got -- just to frame this out, we've got about 30 minutes together. Let's maybe take the first 15 or 20 minutes to go through some fireside chat here with the team, which I know is going to be fun. And then we'd love to make this interactive. [Operator Instructions] I'll make sure we get through as many of those questions as we can. So with maybe all of that as a preamble, Jay, Remo, Bill, thank you so much for being with us here today. We really appreciate it.

Thank you. I appreciate the opportunity.

Sure thing. Jay, maybe just to start it off, I think you've got a helpful PowerPoint here that can -- just walk us through some of the architectural differences with Zscaler that I think are just so foundational, right, the market share gains that you've seen over the last few years. So maybe you can show us that slide and maybe get us kick started here before we go into some questions.

Indeed, Saket. When new architecture comes, it's a little different way of doing it. And I'll show you a couple of ways how and what makes Zscaler unique. First of all, you have been spending millions and millions of dollars buying all kind of firewalls and VPNs. You wonder why are you still getting breached. Well, I'll show you why. In this diagram, you kind of see we built data centers, then we connected those data centers to actually branches, right? The network connectivity was born 30 years ago. You get in the branch network, you've got to where you need to go. Then you want to work from home, VPN, 50,000 people sitting at home can work. They can be on your Internet. Now your network is in 50,000 households. Then you embrace cloud. You extend your network to every cloud region because applications and users must be on the same network. That's wonderful. That has been extremely helpful. And then you wanted to do local breakouts. Since you didn't like local appliance or firewalls, you try to do virtual firewalls. Firewalls with any name is still a firewall. It's a network device. It's an IP device. It stretches your network to every location where the device is. So your network gets bigger and bigger. So what's the problem? Well, number one, your attack surface. Every firewall, VPN or every application that opens to the Internet can be seen from the Internet is an attack surface. The bigger your attack surface, the more enemies can attack you, just like what I'm showing in the right. So that's one. And then number two, once they find you, they want to breach you. So all communication from the Internet can be dangerous because every bad thing comes from the Internet. So this is where you need to make sure that communication is very secure. Number three, if they breach you, now they want to move laterally to find high-value targets. Once they get on your network, they can go anywhere. That's the third problem. When Colonial Pipeline happened, that's exactly what they did. Number four. Well, so -- sorry, this is how one infected machine can infect everything out there. Number four, they want to steal your data, and all of that data gets sent via internet. So you need proper protection for anything that leaves that range. So these 4 foundational things need to be done right to protect yourself. And putting users on the network creates the biggest issue. So what do you do if you don't put people on the network and your network security? Well, you do zero trust. Where? Applications and users are not on the same network. Applications are merely destinations, external apps, internal apps, and you go through a Zero Trust Exchange that Zscaler has built, which is like an intelligent switchboard. A user comes to us, to our nearest data center, and we say, "Stop. Who are you?" We check your credentials, and we use identity system of your choice. Next, "Where are you going?" We can define a group of applications a user can go to. So they can't get on the network and get to everything else. Three, what's the risk? Identity can be stolen. So you look at device posture, device type, user behavior, location can be attributes in defining policy. And next, "Are you carrying bad things?" This is borrowing analogy from the airport. You don't want dangerous luggage to get on the plane. In the same way, if a user by mistake is downloading some zero-rate attack files or clicking on phishing, it should be stopped. If all goes well, we connect you to right applications. On external, that's the view. Internal, shown on the right side, is similar with one thing that's somewhat different, using a connector technology. They open an inside-out connection, so there's no outside-in connection allowed. With that, your files -- sorry, your applications become invisible. Your attack surface goes away. Remember, everything starts with attack surface. Number two, your lateral movement disappears since we only connect you to certain applications, not to the network. These things are fundamentally the opposite of firewalls and VPNs from design architecture point of view. So that's the kind of architecture that sets us different from others. So with that, Saket, back over to you.

Super helpful, Jay. I mean, again, I think the architectural point here is just so foundational, right, to what makes Zscaler different. And so maybe a good place to start then here, Jay, right, is just -- is the core, right, where Zscaler started, which is Zscaler Internet Access, or ZIA. I want to ask the question, so I know this is not all that ZIA is. But ZIA really started really disrupting the Secure Web Gateway market. It's expanded to so much more than that. But maybe the question for you is -- maybe it's a 2-part question. How much more share is there to go after in the Secure Web Gateway market? And do you feel like by really manhandling this market to cloud, has that actually helped the Secure Web Gateway market actually expand as we've moved away from the appliance and towards a cloud solution? There's a lot there. Does that make sense?

Actually, it does. The answer is yes and yes. So let me explain both the questions. First of all, let me talk about expansion of the market. In the old world, if you had 600 branch offices like automation, they were about 350, all traffic come to the data center and then secure web gate would sit at the data center, and it goes through. Now they want to really create 360 local breakouts. That means security needs to be done at 360 locations. So if they were to replicate the old way of doing it, it would be very expensive. But it is expanding. You no longer have one gateway. You had the number of gateways equal the branches to make things worse. With COVID, as one of the CSOs, actually the CSO from Takeda Pharmaceutical, who said, "Jay, I used to secure and manage 7,000 branch offices before COVID. Now with 75,000 employees, I'm really securing 75,000 households." So that market is expanding. It's no longer how many branches do you have or how many Internet gateways that you have, it is number of employees. That's point number one. Point number two. Secure Web Gateway that companies like Blue Coat sold did a couple of things, URL filtering or antivirus. Now we need advanced threat protection. We need sandboxing. We need DLP. We need bandwidth quantity of service. We need browser isolation and the like. So the number of things you could do to improve better security, to provide better security has gone up significantly. So the market has expanded in both ways.

Got it. Got it. Very helpful. Remo, you've given some nuggets of information on revenue from different parts of the business, whether it's ZPA, whether it's emerging products. Can you just remind us of some of those nuggets that you've put out there that could just maybe help us frame the relative sizes of some of these major product areas, right, whether it's ZIA or ZPA or any of the emerging -- anything that can help us sort of look at the business through that product lens, if you will?

Yes. I mean they're all doing well. I mean ZPA as a percent of ZIA and ZPA is in the high 20% range. So consistent to what it's been in the past. And you take a look at our overall revenue growth year-over-year at 62%, you can see that it's growing really well. ZCP and ZDX, which are emerging products, we were expecting them to be low teens of our total new and upsell in fiscal '22. So again, what Zscaler started out was ZIA. When we went public, we just started ZPA. And now ZPA as a contribution of revenue is about 16% of our revenue. ZDX and ZCP just got introduced about a year ago, so very early stages. And again, we call them pillars, so we expect these pillars to be meaningful contributors as we go forward.

That's great. That's super helpful. Jay, you talked about this a little bit on the prior slide and I hope as part of the answer, you give the DVD player or Netflix analogy here. But some of the firewall companies out there have built businesses that are also trying to compete in the SASE space. I guess the first question is, have you seen any changes from a competitive perspective because of these players? And also, maybe you could just spend a minute talking about what do you think is a structural difference between that type of solution hosted in the public cloud versus what I'll call Zscaler's purpose-built cloud for this?

So let's talk about what we are trying to do because the answer may be different. For Internet-bound traffic, traditionally, customers have done Secure Web Gateway, not firewalls, because Secure Web Gateway is a proxy architecture, which could allow you to open SSL, inspect for threats and data loss. That's why in the on-prem world, Blue Coat had 85% of the Fortune 500 companies as their clients. They're not firewalls. This was the proxy architecture. I used to worry about Blue Coat as a big major competition because they had very good proxy architecture for -- on the on-prem world. When market moved to the cloud, they, just like Siebel, tried to spin these VMs in the cloud. Siebel tried to compete with Salesforce. They didn't just give up, okay? The architecture wasn't multi-tenant. So Blue Coat, for lack of multi-tenant architecture, couldn't really compete and kind of faded out. Now the firewall guys are trying to do the same thing for Secure Web Gateway. They -- first of all, they're not even a proxy architecture. Well, some of them have throughput proxy for years. And now they say, of course, we are going to build one. And then they're not even multi-tenant. So I think for them, to do Secure Web Gateway is not an easy thing at all. That's why, I mean, most of these investors understand large banks. If you talk to these large banks, the top 10 banks, and fine, if anyone really will trust a firewall for Secure Web Gateway, the answer will be no. The second part for ZPA is access to applications. What do firewall guys do for access to applications from remote places? VPN. And everyone knows that VPN is the biggest security risk for any enterprise. Now they're taking VPN and spinning that VPN in the cloud and trying to hide the name of VPN. I was talking to a customer, this is a small company, a few weeks ago. They said, "Oh, we are doing now zero trust in the cloud, and we no longer have VPNs." And so what do you have? They said, "GlobalProtect." I said, "Wow, whatever you call it, it's still VPN." So I think marketing hype only goes so far. You have to protect the customers. You saw me how we eliminate attack surface. And then we do in-line malware protection. We remove lateral-type movement and then #4, data loss. That's the right architecture. As attacks are getting more and more dangerous, customers are waking up to realize that they may be having a false sense of security with legacy devices. They need to embrace true zero trust.

Got it. Got it. Remo, maybe just to pivot to pricing for a second. The pricing here, of course, is per user per year with several bundled options. Can you just remind us what you said -- maybe 2-part question. Remind us what you said about the number of users on the platform because certainly, it's users that drive it. But then also, maybe just talk about the pricing or relative pricing of ZIA and ZPA roughly as well? Does that make sense?

Yes. Yes. I mean users, I can't remember what we said last time. I think it was over 26 million users on our platform or something like that. We have to give an update to that. On a pricing basis, when you take a look at companies of 5,000 employees and you take a look at ZIA, ZIA, we sell in 3 bundles, which is pro, business and transformation. Transformation is the highest bundle. And that's about $45 per user. The ZIA add-ons, so browser isolation, CASB, out-of-band and DLP, that's about $30 per user. ZPA, same. We do 3 bundles similar to ZIA, $45 per user. And ZDX is $25 per user. So that's basically $145 per user for a company of 5,000 employees. The workload protection piece of it, that's by a workload, is how we price, and 3 parts to it. One is CSPM at $40 per workload, workload segmentation at $60 and workload communication, $55. So $155 per workload is the pricing we have. So -- and we are seeing pricing at this level. And so it's a -- and these are for companies with substantial workloads is what we're seeing.

Yes. That's really helpful detail actually there, Remo. Thank you. Maybe building on some of that detail, just to pivot to some of those newer products with you, Jay. I guess you've said maybe specifically ZDX and ZCP. You said that in the past that most customers would benefit from tools like ZDX and ZCP kind of similar to the way that they did with ZIA and ZPA. Can you just remind us why? I mean maybe ZDX in particular because it feels like customers have actually pulled into ZDX rather than the other way around. I wonder if you could talk about those 2 products maybe.

Yes. ZIA, ZPA and ZDX are all 3 are for user protection. So ZIA, ZPA combined give you access to any internal or external applications. That's why we're seeing more and more customers buying the 2 together. ZDX was introduced just about 15, 18 months ago. It is needed to make sure if a user has a performance issue sitting at home or hotel or coffee shop, we can help the customer identify what the issues are, so they can be resolved. So I believe it's a matter of time when every customers, each user will have ZIA, ZPA and ZDX. We are seeing early trend where customers are beginning to buy all 3 things at the same time or a customer who have ZIA and ZPA are also buying ZDX. Three things together complete all you need to protect your users and deliver good performance from anywhere. Outside that, what else do you need? Identity being one, endpoint being two.

Got it. Remo, maybe just to carry that forward. I think Zscaler had another great quarter of net revenue retention. I think it was over 125%. Can you just talk qualitatively to how much of that is maybe coming from the cross-sell opportunity that's created by some of these emerging products like ZDX or ZCP? And maybe how you think about that NRR may be trending over the next -- over future quarters, if you will?

Yes. I mean it is the cross-sell. That's the real opportunity with customers. For our G2K customers, 46% have ZPA. So -- and that continues to increase on a quarterly basis. In addition, the ZDX and ZCP, the contribution they're making is certainly also contributing to that. So they're the new products. Also, going to higher bundles and to a lesser extent, to the transformation bundle for ZIA, that's another piece of it. Our net retention rate is outstanding. In particular, when you think about that when you buy ZIA, you buy for all users. So it's a high bar that we set for ourselves from a net retention rate. But because of the additional products that we have and services that we offer, our net retention rate was higher in this quarter than it was in Q4. Q4 is 128%. We're higher than 128%. What we feel is that anything over 125% is outstanding, given our company. So going forward, if we do go below 125%, we'll call it out. And if we don't, we won't be calling it out in our net retention rate.

Got it. Very helpful. And I'm sorry, I said 125%. It was greater than 128%. I want to make sure that's clear. Jay, maybe we can shift to the distribution strategy here a little bit because it feels like over the last few quarters, you've talked more about leveraging the channel for what I think you referred to as enterprise accounts. Maybe the question is, how do you sort of envision the mix of the business between direct and channel long term? And what other enhancements could be seen in your channel strategy over the next year or 2?

So first of all, I don't think we think about business between direct and channel. We like to get all business through channel even if it's fulfillment. So direct business is only very small because some customers insist that they must do direct purchase with them. So it's all channels. The question is how much leverage is channel providing. Are they doing fulfillment? Or are they really helping and doing some heavy lifting? Any time you bring in new transformational technology that customers don't understand, channels don't understand, it needs a little bit time and effort. And that's what we have done over the last 10, 12 years. Over the years, as cloud became very common, mobility became common and COVID further fueled it, so now we really don't need to evangelize much. Two years ago, some of our channels that thought that appliances will be there forever, they don't need to pivot to the cloud, are waking up. The smart ones are calling us and partly because a brand has gotten bigger, more and more customers are telling the channel that I want Zscaler. So we started the Summit program where we are selecting channel partners who are progressive, who want to move away from legacy box selling and they're willing to do more transformational services. We give them more discount based on deeper engagement with us. So that -- actually, that business is growing. You combine that with our focus on enterprise segment. The lower the segment, the more role a channel can play. Because if you take Fortune 500, we'll always be working with them closely, even though the channel is doing fulfillment. So we are seeing enterprise segment is rapidly growing for us. Channel is helping a lot. And over the past several quarters, we're adding a number of new salespeople in that area, and we are stepping a market. So combination of all 3 is growing our enterprise segment significantly. And it's good to see traditional channel business growing because no, the service is becoming mainstream, and they want to be part of it.

Absolutely. No, that makes sense. And I know, Jay, in a prior life, I mean, you were alive in this channel a lot as well. And I can imagine they see the value, right, in offering a cloud service like this versus boxes. So totally understood. And Remo, maybe staying on the same topic, just on the direct side of the business, it sound like last year really felt the tailwind, right, of increased sales capacity. I thought it was really well executed. Can you just talk about how you think about that sales capacity equation this year and where it makes sense to add?

Yes. So the comment that we made was that we're going to increase our field quota sales headcount more this year on absolute headcount basis than we did the prior year. And we're certainly on that path. Related to where we're going to hire, it's broad. It's across the board. We've made more investment recently in APJ, in particular in Japan, and we called that out on our call that we got very strong Japan performance. We see Japan as a large market. As we go forward and as we mature as a company, we'll go into other markets, which are not as big, Latin America being one of those markets. We're starting to get in Latin America a little bit. Middle East, we're in the Middle East, but we'll expand our operations also in Middle East as we go. So as we mature as a company, we'll continue to increase our sales organization broadly across the world. But we'll start expanding into smaller markets, too.

Yes. Yes. No, absolutely. It's funny. We talked -- we've spoken so much about the most near-term results. We've talked about the product a bunch. I actually like to zoom out a little bit, maybe with you, Jay. You laid out a couple of longer-term kind of aspirational goals, I'll call them, right? I mean I think it was -- we've talked about maybe targeting 200 million users at Analyst Day, I think, back in January. I think most recently, you kind of talked about, again, an aspirational target of $5 billion in ARR. Can you just walk us through what you think Zscaler needs to do to reach those goals? And what parts of the business are going to drive the growth needed to get there?

Remo and I joke around, I like to call it a short-term goal. But let me tell you how we think. For me, everything starts with do we have the right market conditions? Where is market ready? With enough TAM? Is it coming to us? People used to question just 2 years ago. I don't think anyone is questioning today that it's enough of a market and that's ready. And COVID further accelerated it. The biggest thing COVID did was shook off inertia. It certainly showed the CIOs that they don't even need a corporate network to do business. You can come over the Internet, something we have been advocating for a long time. So market is ready. It's big. Two, do you have the right architecture in the platform. I think one thing investors generally kind of forget is that this is no longer incremental change from firewall type A to B to C. It's an architectural change that only happens once every 30 years or so. This is like what I call going from DVD players to Netflix streaming service. This change is like going from traditional internal combustion engine cars to electric cars. So when customers say, "Well, which product is better? Yours or a firewall?" It's like asking do you want an electric car or do you want a traditional car, right? Maybe some people still want traditional car for a while, okay. But in our case, it's a clean architecture we built and there's a big platform. We have plenty to sell. There's no lack of products. That's number two. Number three, do we have enough credibility? Do we have enough happy customers? And in the market, that's proven. So with 35% of Fortune 500 and some very good customers with NPS score of 76, we are sitting in a very good position where customers are actively recommending other customers who buy us. So with all these things in a good place, what I don't worry about is the competition. I do worry about the ability to execute so that my team doesn't become complacent. It doesn't become arrogant. Often, success goes to people's head. We want to stay humble. We want to stay focused on customers, hire the right people, enable them and make things happen. I think that's the focus. If we do that, I think we can have some very, very good growth rates to achieve or exceed our $5 billion ARR target.

Being hungry, right?

Yes.

Absolutely. No, that makes a lot of sense. Remo, I'd love to maybe -- we talked so much about growth, right? I mean I think one of the hallmarks of this model is that there's real profitability here, right, to also complement this growth. And so I'd love to turn a little bit to the investment framework. You've mentioned that the team is going to prioritize growth over profitability really on the back of some really strong quarters recently. Can you just talk about how you think about that balance between profitability and growth? And maybe what we can expect for margins, I guess, for the rest of '22 and beyond?

Yes. I mean, we gave our guidance on margin for '22, so we've done that. Related to longer term, Jay and I recognize the size of this market, and it's huge. And we recognize where we are in this market at the very early stages. And what we're looking for, we -- the framework we put is that if we're growing over 30% revenue growth, then you can expect less than 300 basis point margin expansion. And if we're growing less than 30% revenue growth, you can expect 300 basis point expansion. The -- as you're aware, Saket, and I think a lot of investors, in a SaaS model, when you're growing at the type of rates we are, at the gross margins we have, it doesn't take much to get to your -- our operating target, which is 20%, 22%. You can do that relatively quickly. That's not hard. That's easy. But that would be the wrong thing to do for our investors and for our company. We're -- Zscaler created a platform of today and the future. And they did this -- purpose-built this multi-tenant platform 13 years ago when people weren't even dreaming of where the world was going. Zscaler saw where the world was going. Your applications are going to the cloud. Users are mobile. What do you want to backhaul? What do you want to -- why do you want to expose your network? They saw the vulnerabilities basically of today's networks that a lot of companies have and developed a platform which addresses that head on. So because of that and the opportunity that we have, you can see the pace of innovation that we're doing. It's not only getting to the $5 billion. I mean that's a piece of it. For me, the bigger piece is what can we continue to develop really to make the world safe. We're truly making the world safer. And that's the piece: continue to innovate, continue to do things to help basically our customers. And it's a wonderful place to be. And because of that, we're going to prioritize growth over profitability. From a free cash flow basis, this last quarter, 36%. Whoa. I mean that's incredible, right? Granted, you've got the strong quarters, Q2, Q4, your billing quarters. You collect in Q1, Q3. But last year, our free cash flow was over 20%. So the model is just -- it's -- when I first got to Zscaler, I looked at all the levers you can pull, you don't have that basically in appliance company. You just don't. Here, there's so many levers you can pull. Now the lever we're pulling is we're going after it. So that's where we're at.

Well, whoa to that, Remo. I can't think of a better way to end, folks. As you know, these 30 minutes always go fast. I've got a ton more questions but also want to be respectful of everyone's time. Jay, Remo, Bill, again, a real pleasure having you folks and the team from Zscaler back, as always. Thanks again so much for being with us here today.

Thank you. Take care. See you. Bye.

All right, folks. Enjoy the rest of your day. Bye.