Zscaler, Inc. (ZS) Earnings Call Transcript & Summary

Welcome everybody to the Zscaler fireside chat that we're going to do here at the Needham Conference. It's great to have Jay and Remo here to provide the great content. Let me start off by saying we have made Zscaler our single best idea in the security space for 2023. We strongly believe that they have the right mix of relatively seamless and easy to deploy upfront technology that in an tough environment, they can deliver that customer growth still, which is the Occam's razor, I think, in terms of where the pressure is on a lot of the security companies. We also strongly believe that this is a time when investors are going to be looking for that quality company that can both deliver growth and strong profitability and cash flow, and that certainly fits the description and the valuation compression, we think, is finally started to bottom out even with the downgrade over at Brand X this morning. Leaving that point aside, Welcome, guys.

Thank you.

Thank you.

One last thing, if you have questions, I'm more than happy to pass them along. There's a box that you can type them into. I'll keep my eye on that all through the fireside. And at any time, please feel free to throw questions in. With that, guys, so the obvious question here is how macro sensitive is Zscaler in this environment? And I actually think that there's some interesting data that I was looking at let me just roll this by and see if this is something that's predictive. So it seems pretty clear that the contagion and the economy started off in Europe and is gradually finding its way to the U.S. Most companies in the security space that have had issues saw it in Europe first and then saw it show up in the U.S. But when I look back over the last 3 years and the last 3 or 4 quarters, there is zero evidence that, that happened in your business. In fact, you guys accelerated from 40% to 45% growth to 46% growth sequentially accelerating in Europe as this pressure has developed. So is that an indication proof point that, in fact, you guys grow well across increasingly pressured macro environments?

So, Alex, first of all, thank you for the opportunity. Yes, Europe has felt some pressure and Ukraine war has also played a role in it. But overall, here is what our European story. First of all, we are very well penetrated in Europe. I mean, take some of the largest companies in France, about 30 of the 40 largest companies are Zscaler customers. Central Europe, U.K., it's the same story. These large companies, they need to make sure that cyber is in good shape. It is true. There is more pressure in Europe. There's more scrutiny in Europe than in the U.S. But there are 2 things that are helping us. One, like U.S. companies, Europe also has to worry about cyber. Europe actually is more worried about cyber than U.S. is because they are sitting right next door to Russia. #2, they have lots of pressure to reduce cost. And our solution, as a platform, can actually reduce costs significantly. Now everyone likes to say, we reduce cost platform, this and that. But think of Zscaler and contrast it with some of the other solutions, endpoint or identity, these guys, they are focused good products, but they don't replace a bunch of point products out there. When we go in, the entire outbound DMZ goes away with ZIA. This is a bunch of products. When ZPA gets deployed, a bunch of products gets removed. So a combination of great savings and good ROI, combined with still interest in cyber is helping us in a better shape than many of our peers out there.

So in fact, it does suggest that you've already demonstrated what people are fearing is going to happen in the U.S. economy as the economy has decelerated month-to-month-to-month. We've actually seen that deceleration in Europe and powered right through it. And based off of those facts, right? I mean that's empirical evidence.

Yes.

So let's talk a little bit about the reason that happens. So One of the things we're hearing very clearly from the VAR community is there are some categories that have significant nut upfront that you've got to digest in order to get to the savings. So I have to decommission something. I have to put some engineering skill into it. I've got to actually spend some money on some other hardware or whatever. I mean that's part of the problem, I think, with the vulnerability management space, in particular, as an example. They're having trouble getting new customers. Talk about what happens, the mechanics of winning a new customer for Zscaler in this environment...

And deploying it because it's all about deployment, right? If you go back to prepandemic, the customers wanted to go through network changes and deploy Zscaler from brand offices and then the customer moved on to protect remote users who work from home. If there's one thing COVID did that was good, it showed CIOs and CTOs that the network -- in network security got in place in the data center, and network connecting various branches is not needed. It's not relevant. During COVID, we start -- we flipped our deployment model, don't even touched the network. Go and deploy this endpoint agent on a laptop. It simply comes through us, ZIA, ZPA happens seamlessly. So we were able to see the deployment that took 5 or 6 months could be done in actually 2, 3, 4 weeks. So our deployment model has fundamentally changed. It's helping us do much faster deployment. And once they see, no, eliminating some of the network and all that stuff becomes a lot easier. But once traffic starts flowing through us, look at the outbound DMZ, what ZIA does, all those products can be decommissioned, and a lot of that can be decommissioned in a -- probably in 2, 3, 4 months, okay? ZPA, it starts with VPN replacement, then it starts looking at doing the rest of displacement. Our customers, they're asking us, say, just don't -- I don't just trust you, show me business value assessment. Show me quarter-by-quarter, what can be rolled out? What can be removed and what not? And that's what we're doing. So the extra scrutiny is actually asking us to do that kind of stuff. We have been doing business value assessment for now several years, but no IT environment is asking us to do it more granular, do it more precise. A year ago, we would do business value assessment, ROI year 1, year 2, year 3. Today, we actually go quarter 1, quarter 2, quarter 3 and quarter 4 and so on. Our business value is strong. ROI is strong, and that's really what's helping us get our deals done.

So In that context, can you talk about the -- some of the other platforms, for instance, the ZDX product? How does the uptake of adjacent products to the existing customer base?

ZDX has taken off faster than we expected. It has taken up even faster than ZPA. Now why is that? If you think about what companies need to do in today's cloud and mobile world, ZIA gets them secure and fast access to internet and SaaS. ZPA provide access to any internal applications in the data center and factories or public cloud like Azure or AWS, without doing anything special or networking. The 2 together is what we have been now selling for quite a while. The only thing missing in this equation was, if this performance issue along the way, when user is sitting somewhere reaching some applications, how do you figure out? There's no meaningful product out there to do so. We are sitting in between. So ZDX was a natural thing for us to do. We are using the same endpoint agent. We turn on telemetry, we start collecting this telemetry, and we can tell them what's going on. So now we are packaged 3 services, ZIA, ZPA and ZDX into 1 bundle called Zscaler for Users. The 3 together is all you need for your users, and that's what we're selling more and more. And ZDX is naturally benefiting from it.

So when exactly did you hit that transition in selling process?

Yes. All of these things, we possibly learn about 15 months ago, we start to sell more and more ZIA, ZPA and ZDX, but there were separate SKUs. Once we see in traction, we create a bundle build. The bundle got enters the larger market, what, a few quarters ago.

So I do have a couple of questions that came in from the audience. And we thank -- I thank you guys for that. I love when it's not me asking the questions, even they pay me that to just repeat them, it's great. In any case, the first 1 was, can you talk about the competition with each of the 2 prime competitors that they note here, Palo Alto and NET, Cloudflare. And I would love to start off with Palo Alto. What's going on relative to -- have they improved what you're doing? Do you see them more? Do you see the [indiscernible] ? How is pricing playing out some of those metrics on Palo?

So if you think about the high-end market, these folks understand security. They understand what really is Zero Trust, what's a firewall. We actually -- I would say, the firewall companies have become less there. They used to show up. They have a story. Everyone knows what their story is. And I would say, the less competition from them on the high-end space. In fact, I talked about a large bank that probably has spent well over $100 million with this firewall company. And when they looked at securing their users, there was no backhaul, okay? They told us that they has the Palo Alto vendor came to us and say, we got a great Zero Trust solution. We can do better than Zscaler, and we'll give you at half the price, okay? The customer said, sorry. You build great firewalls. We love your firewalls, we'll have you in the data center, but when it comes to user protection, it's a different architecture. Proxy was a requirement, scalable, proven proxy and then the real cloud-native stuff. So I think there may be some noise more with investors than it is in customers. When you come to the lower end of the spectrum in probably the enterprise, low-end enterprise 2,000, 3,000 kind of numbers, we do see a number of vendors there. Firewalls company show up, even Cisco Umbrella shows up there as well. And that's where we have limited presence. In the past 2 years, we increased the presence significantly. So do I think these firewall guys could be real threatening competition for us? Not really, unless they change the architecture. It's like trying to say that, do you think a traditional car company by bolting on an electric engine becomes a real competition. Not really, no. Eventually, if they wake up and say, I need to invest and build an real electric engine and go with that, that could be -- that's something for us to worry about and see how do we keep on innovating and get ahead. But good to our benefit. Traditional companies keep on bolting things more and more because they think it's an easier and faster way to get there. Building something from scratch takes a long time. So no worry about the firewall front. You talked about this cloud comp, what's out of cloud something -- what is that cloud thing?

So Cloudflare has put out a lot of press suggesting they are much nicer than Zscaler. And to be fair, Cloudflare's focus as a cross WAN Internet accelerator does give them some advantages in rapid communication across the WAN. When I hear that, my response to it is that, okay, but the comparison is between Cloudflare and Zscaler, it's a comparison between Cloudflare, Zscaler and hairpinning of the traffic back to their data center and a difference of a couple of milliseconds 1 way or the other when you're doing 3 ops instead of 30 ops, is it meaningful? So it's really a functionality problem. So can you look at that...

I think these guys make a lot of nonsense noise. Even last year, once they told investors, we replaced Zscaler at a very large oil company, really? And they named the company, you kind of said, because I know them well. So I called the CIO and say, what are they talking about? Do you have them? They said we -- in 1 of our business units, I am using CDM and [indiscernible]. That's it. Now that funky little thing became, we replace there guys, okay? Some [ live ] companies like to stretch, some companies grow too far beyond stretching. That's one. I had one other conversation with someone and they said, "Wow, these guys have lots of experience in selling large enterprise. I said, do the following, rather then all of this debate, ask them, show me 10 large enterprise customers that are actually using [ Equinor ], ZIA or ZPA,okay? I bet you'll struggle to find even one. So it's easy to make a lot of noise. So you're putting in all that stuff. They're trying to bait us to respond and get into -- they want credibility. They want some coverage. We're not going to get [indiscernible] into that stuff, leave it alone. It's sometimes I think they're trying to do, they have the better [indiscernible] and lots and lots of little, little things in it. But everything is 2 inches deep.

Right. So it's -- from a feature parity perspective, it's nowhere near there. Even if there's some speed advantage, that's the -- measuring the wrong thing, right?

So okay, not even quite a bit. Okay, when can they have the speed advantage. If the traffic, say, coming from Singapore to New York needs to come on a wide data network, yes, they can do acceleration. But our goal is not to backhaul traffic. The goal is that applications are getting set up everywhere. Why is Microsoft putting its data centers in every part of the world? So no backhauling is needed. So the advantage of doing some funky test to show that I can bring on my backbone to do something is not a real thing. My traffic, my customer's traffic in Singapore goes through Singapore data center. Then it gets on Microsoft network to get to wherever Microsoft is. If Microsoft in Singapore, it's one hop away from me. So all these papers are trying to get attention. We would rather focus on our customers. So do you think I even worry about Cloudflare or thing? Not really. My worry is to make sure we keep on executing with our focus, our sales team fully enabled, and we don't get complacent. We don't let success go to our head, and with that, we are focused on customer obsession. That's why our NPS is sitting way up it's sitting. That's why our score, promoter score is sitting very good, over 125% net retention rate. We are proud of those numbers, and we keep on driving.

So another question came in on the competitive front. The question is specifically have you seen any changes in the win rates against Netskope and Cloudflare? And I think you already answered the Cloudflare, so let's hear on the Netskope piece.

Look, Netskope is still, by and large, a CASB vendor. If you ask them, how many Fortune 500 companies do their -- do you have at their customer? They'll give you a big number. And actually, their number will be technically right. Probably, there are a couple of dozen CASB customers who fall in that bucket. Do you said how many of these companies are actually taking all the traffic like ZIA or ZPA? I bet you'll struggle to find companies out there. So becoming a CASB is one thing, sitting in line to inspect all the traffic without intruding latency and having a cloud that works, how to make sure it has availability is much, much harder task. What's making things worse for private companies is now CIOs are looking for more and more consolidation and simplification. Do you think they will consolidate with a private company they don't even know what the financials are, or if they check an audited financial statement they'll find that these folks are losing tens of millions of dollars every quarter, okay? So I do believe that most private companies will be struggling in today's market. Our position as a public company with focus on cloud security with the best architecture is putting us in a much better position.

So the question though was, is there any change in win rates? It sounds like the answer is no. Please confirm.

We aren't even competing on our main segment of enterprise and major. On the lower end, we do see them like we see firewall companies and Cisco as a wall. Once we engage, we almost always win.

Great. Another question coming in form the audience does your contribution margin construct of 60% still hold in a slower macro environment and with more products on the menu?

Remo.

The answer is yes. I mean it's -- we typically do 3-year contracts. But yes, the -- no change in contribution margin. Yes. No change at all. It's still 60% plus for years 2 and 3.