Zscaler, Inc. (ZS) Earnings Call Transcript & Summary

All right. Thank you all for being here. I'm Roger Boyd, I cover Cybersecurity here at UBS. Very happy to have the team from Zscaler here, Jay Chaudrhy, CEO, Chairman and Co-Founder; and Remo Canessa, Chief Financial Officer. So thank you, gentlemen, both for being here directly after earnings last night.

Thank you.

Maybe just to start on that, pretty good results last night. Maybe we could recap some of the highlights you saw from the quarter. A number of strengths, but if you had to distill it down into a few, what really stood out to you in the first quarter here?

I think to me, at the highest level, beating all metrics for us was a big deal. In today's environment, very few companies are able to do that. Remo, you can talk the specifics.

Yes. I mean, it was a great quarter for us. If you take a look at the top line billings growth rate was 34% year-over-year. Short-term billings, 33%, revenue growth 40% then you go to the next layer down, which is our operating profitability. We've always said, is in a SaaS model with high gross margin, a lot of leverage, and we're able to show that leverage was 18% operating profitability. Free cash flow margin, 45% of revenue, which is a record for us. Our expectations for free cash flow going forward about 20s higher than what it was last year. But also we're having a large data center purchase, primarily for AI capabilities, which will add 3% to 4% basically increase cost. The Federal was very strong for us in the quarter, also 90% growth year-over-year. Record pipeline generation in the quarter, tougher engagements are strong. Just all in all, just a very, very strong quarter for us from a -- just from a running the business perspective. And in addition, I'll let Jay talk about 2 additions we hired or he hired in the quarter.

Yes. I think before I go there, our focus still is on growth rather than bottom line. Our operating profitability was high. Cash flow was high. But I -- Remo and I is internally joking and say, we didn't invest enough. We should invest more. So keep in mind, growth, number one, bottom line 2, Remo and I both work very well to balance the two together. Regarding adding more strength to our leadership, every company go through stages of growth, and you need to make sure you are having the right leaders at the right level type of stuff. On marketing, we had changed CMO several months ago. We knew someone who take us next level. So there's an active such going on and generally, I don't believe in hiring someone unless you feel really excited about it. I would rather have this thing open staring at you then kind of filling the slot. So CMO has come together very, very nicely. On the CRO side, about 8 to 10 months ago, Dali and I started figuring one say, let's hire a CRO, that also gives Dali more opportunity to focus on the COO functions where we need to scale our operational capabilities as your business grows. When you grow like we have grown going from $1 billion to $2.5 billion 7 quarters, you put things in place, you fix 2 things, you break 2 things. That's what happens in hyper growth. So a lot of efficiency, streamlining needs to be done. So having Dali focus on that part was -- has been a part of the process to bring in CRO on board. And we wanted someone who has seen the scale, done it and as we found Mike, who took ServiceNow, he was there from $80 million to $8.5 billion hit and Americas for them riches, which is approximately 70% of the total business that in our sales processes, how we deal with the market we target large enterprises, how we sell to CXOs, concentrate sales that are all aligned with us. So it became a wonderful thing. So we think these 2 leaders position us to take from $2 billion to $5 billion and beyond that we are excited about that.

It's very exciting hires. I think one of the footnotes to the reiterated fiscal '24 guide was that you're expecting some level of disruption on a go-to-market standpoint from Mike coming on board. Remo, can you just talk -- or Jay, just talk about how that's layered into the model and he's obviously going to have a team that he wants to bring on. But if you think about the impacts of the model, is that mostly a fiscal 2 question? Or could we see this kind of impact the latter part of the year?

More disruption is too strong of a term. We -- I think we believe we broaden a leader who is aligned with our sales process and all to start with. Okay. So he doesn't have -- he's not coming to plan and say, I'm going to reorganize the whole thing, okay? None of that, there are no big changes expected. Okay. Now, any time you have a new leader come in place, you need to give them some breathing room, some room to -- there are always things to adjust and understand. So it was essentially keeping that in mind or new leader to succeed rather than kind of, hey, we hear the targets up there. That's really part of adjustment. This adjustment doesn't indicate any change in comparative landscape or any change in macro environment per se. It's just being the right and prudent thing to do. We feel good about the business, the pipeline is strong. All things are strong. It's our job. The primary job is to make sure we move from this stage to next stage to get a steady for the longer term without really having any negative impact. And that's our job as a management team to maneuver through it.

We have a world-class sales organization that is in place number one. All we're trying to do is create prudence related to our guidance just because when you do have sales changes, there could be some changes or disruption along the way. As Jay mentioned, we're not expecting that at all, but it could happen. So that's the reason for our prudence with our guidance.

Very helpful clarification. Maybe to zoom out, Jay, the threat environment continues to evolve. We've seen ransomware evolve into double extortion ransomware now where we'll file SEC reports for SEC complaints for you. I think all of it's kind of highlighted in the shortcomings of overly flat networks. And I guess the question is, how does this show up in your pipeline, demand for your products? Frankly, you called out a hospitality win this quarter where it sounds like a breach specific breach environment very clearly helped accelerate deal timing.

Yes. So if you listen to our earnings call for the last year or so, I've been talking about 2 big drivers that are driving our pipeline in spite of the tougher conditions. Fiber has been one drive for cost savings has been two because of these MGM and Caesars kind of stuff and combined with SEC reporting requirements, then on top of that, SEC sewing solar veins and the CISO personally. It has kind of turbocharge the fiber need the demand is certainly being boosted by that significantly. I'll give you an example, after the casino things happen. We had so many inbound calls coming from CIO CISO largely our customers, their friend, we have very good tight relationship with the CISO and CIO community. They're coming in. In fact, I ended up doing special briefing, ransomware briefing to our customers. One of the fascinating things was, I sent personally about 400 e-mails for doing 3 sessions. One for Americas one for EMEA and one for APJ. I never expected that about 250 people signed up out of 400. And about 200 of them attended those 3 sessions. It's just an indication of the degree of interest. So it is, it's fueling interest. It's also showing the fact that all of these customers are basically seeing I'm putting so much money in these firewalls and VPN they're all finally being to understand that once you own the network, you can go wherever you want to go, that's how ransomware attacks happen and which is what we fix. We don't put you on the network like firewalls and VPNs they're like a switch. It is helping grow our pipeline. And then we have to do -- still work hard to close business. Now business closing acquired 2 things. One, C-level engagement is important now we are doing it sooner than we used to do. We have more C-level engagement than we used to do 18 months ago and then having business value assessment. [ AXEIA ] studies that are important. We do both of them. Those 2 help us close deals and the previous to help us build pipeline.

Makes sense. Last night, you noted that the demand environment is starting to stabilize. And I think part of it is everything that's going on in the threat environment, probably a little bit nuance to get after from a budget environment standpoint, what are you seeing in terms of sales cycles, budget scrutiny, you feel like we've hit a trough there. And as the threat environment continues to remain difficult, are we going to see some improvement going forward?

So I haven't met a CIO so who said, I'm reducing my cyber budget, okay? None whatsoever. Budgets are going up. One other change I'm seeing now is, a year ago, CISO cared about Cyber very much. CIO had interest in Cyber. Now CIO is equally interested in Cyber as CISO was. And with SEC reporting and SEC lawsuit every Board member is actually very interesting Cyber far more than they used to be. So budget availability is not an issue. Now they're all trying to figure out where do you spend money. There are 1,000 cyber vendors. I think since we are instrumental in eliminating lateral track movement, knowing that there'll be some compromise because of social engineering and what our people will click on something. There will be a beautiful phishing e-mail, which will look like an e-mail coming from your CFO, CEO, you're going to open it and you're going to get infected. That do happen somewhere. Once the factory machine is a network of things move laterally since we play an important role in that area, we end up being at -- getting a seat on the table to really engage. That's helping us. But still, this scrutiny is there. Deal scrutiny hasn't gone away. They want to make sure they're getting proper money for the investment, proper sorry, value for the investment they're making. But it's a good -- it's a similar environment from a macro point of view. But if we execute right the way we have when it works.

And Remo on your side, it sounds like no change to what's embedded in the guidance as it relates to the macro environment.

That's correct. No change.

Okay. The last 2 years have been remarkably strong for the firewall market. It seems like that's slowing down a little bit now, and some of those vendors need into the security edge, the SASE space.

Everyone's become SASE overnight.

Right. I feel like we've been talking about the decline and the relevancy of the firewalls and basically the IPO. Do you think that past these 2 years of high demand for firewall, do you things start to look a little lower from here on that? And how do you think that impacts budgets, interest levels, projects-based demand?

Inertia is a powerful thing. It keeps on running things still certain things happen. We are seeing a meaningful shift in the firewall area. I'll tell you where and why and how. These are my views on what I see with customers and what's not out there. When you have Zscaler customers, they do local breakout stuff happens, and there's less traffic going to data centers. And some of these guys have been removing firewall the branch. Others have still kept firewalls because -- they don't know quite what else to do. They have been pushing us to say, give me some kind of solution at the branch. We offer them a piece of software they can deploy and eliminate firewalls and all that stuff. But they kind of said, this software, I deploy, manage, monitor, I need something better and easy. So we launched a plug-and-play appliance, which takes a small piece of software we call branch connector, which eliminates the need for firewall all that stuff. It's a way to send traffic to a cloud. That's the solution we launched a few months ago. There's tons of demand for it. All of our customers are saying, I will actually go to your advocacy of my branch becomes just like Starbucks, like a coffee cafe. I think it's a matter of time when almost all branches will go away from firewall. It's a very clear signal. Our customers are certainly headed in that direction. That's accelerating will accelerate with launch of our plug-and-play points. The second part, the big part of revenue is not coming from branch. The big part of firewall revenue is coming from data centers. And it is funny how things play out. Inertia. I have a typical conversation these days with almost every CIO. It's part of my top track. What percentage applications have you moved to the cloud? 40%, 50%, 60%, that's the number, say, oh 60% move. You only have 40% application in a data center. They say, yes, we've done a good job. I said that means you probably aren't buying or upgrading any route grew switches, firewalls, load balancers in your data center, right? And typical answer, I wish that was true. So you're still upgrading? Why? Well, because traffic is still flowing through my data center to public cloud. Why? Because that's a natural traditional way of doing it. Now what's Zscaler way? Every user, every branch directly over the Internet talks to cloud applications. And then they say, oh, that can be done. All that stuff is moving. As long as traffic flows through the data center, you needed devices to process that traffic. We see not only impact of this thing under firewall, we see it impacting load balancers, router switches market as well. Because once you go direct to the cloud, they're not going to -- that market is very different. The market of data center firewall does not directly translate into market in the cloud market for routers and data center doesn't directly translate into market for Cisco in the cloud. In the cloud, you end up getting your software-defined route rooms, you end up getting cheaper firewalls, azure and all the stuff out there. So I do think firewalls will be there for a while, but they will become like mainframe. And we -- as we push for the market, we will make a -- now we have become fairly significant. Five, seven years ago, my 100% growth didn't matter, going from $100 million to $200 million for first tiny thing, no, as we go from $2 billion to $4 billion and $5 billion, I think it's making a dent.

Maybe keeping on the competitive environment for a second, all these new entrants to the market or not new entrants but greater emphasis a lot of the made of Microsoft entry into the market. Looking past architecture, how do you think about the competitive environment, specifically as it relates to the trust that he's built up with enterprise customers and the amount of effort and time it takes to run a solution like yourselves at scale. Because when you talk to enterprise customers, it's reliability, five9 availability, that's what truly matters. And it's -- how do you assess the competitive environment of these new entrants to reach that credibility

Yes. I'll mention 2 things. Number one, to sit in line like a switch or inspect everything without slowing things down and catch all the bad stuff, make sure good stuff [indiscernible] is not a trivial task. It's a proxy architecture, unless downright, it slows things down. That's what we have built. But running a cloud of scale with 360 billion transactions a day, just a data and Google searches add up to only 10 billion a day in the searches. They did a 36x as much traffic as Google search is to handle all the stuff. That running management cloud is much, much bigger task than even I expected when I started the company. There lots of cars over the years learned about how do you run the cloud because it's mission-critical. So it takes time. The second point, the criticality of application. There's funny dialogue with the CIO last year. He said, Jay, congratulations, you have been selected. Zscaler has been really selected as 1 of our 5 strategic vendors and I to fight hard to get you in there, I said Why? He said the threshold to be a strategic vendor in our company is about $50 million and we spent only a few million dollars per year with you. And so, I don't know if you need to feel good or bad about it, but that's what it is. The point is, in most of my large customers, we get viewed as a very strategic vendor in the top 3, top 4 top 5. There's one CIO said, I am more dependent upon you than Microsoft. Microsoft is down office or Azure is impacted. If you are down, nothing works, okay? It just highlights the importance of this service being so mission-critical. So some of the customers I talked to recently, one guy said, yes, there's a private company trying to tout everything you do at 1/3 the price okay? Would they be here? For buying what we sell, they don't want the cheapest stuff. They need something that works, they're reliable and whatnot, and that's really what we bring to the table. And the credibility, the brand we have established the reputation build is very good. It's taken time for us. I think I'm less worried about competition are more focused on how do I keep on innovating and using our solution to solve customers' problems, where these customers save money and they deliver better user experience and we're doing a good job. You've seen the expansion of the platform. Also one other thing we do is we don't try to force Fritz solution, firewall try to spin it as Zero Trust. We built our core architecture for users. Now we have taken it to workload. It's the same thing. ZIF users, not the ZPA for users. ZPA for users is -- sorry, CPF workloads. Workflows, IoT, BOT, this expansive market opportunity for us. And our focus will remain keep on building it and make sure go-to-market execution happen very well. That's why you're seeing some of the additional leadership team have brought them.

Makes sense. You evolved your own strategy this year with the introduction of the hardware branch connector. And our initial conversation with customers suggests that it's been very positively received. And even relative to the software branch connector you launched a year ago.

That was -- so they said, hey, I had to work hard to make it work make it.

Yes. Well, no, I think that's exactly it. It truly creates plug and play branch connectivity I'd love to get your perspective on any other anecdotes you can share about the reception of that? And really, like who do you see that being sold to relative to the whole SD-WAN cycle?

Yes. So with branch connector, you do not need any SD-WAN, okay? SD-WAN has been helpful to reduce cost, it has been helpful to reduce the operational overhead but SD-WAN enables lateral threat movement, that's the #1 thing that ransomware guys explored. So there's a need for it. Also, SD-WAN still has to do route table management, all the stuff. Branch our branch solution requires nothing on that. It's literally branches like your home, it's Starbucks. So tremendous interest. But every new product, it takes some quarters before it really starts getting to the kings adoption, all that stuff. So I think in fiscal '24, we're going to learn and do a reasonable business. Fiscal '25, we think we'll see some big adoption in there. But every customer I have talked to, they feel like this is my dream solution. There's 0 pushback. Now there may be some pushback from some networking guys we say, I've been Cisco certified for 30 years. But overall, it's very, very exciting.

And Remo, just on your side, Zscaler is not a hardware company. How should we expect branch connector to show up in the financial model?

Yes. It will be a subscription-based basically sell for us. It will be based on traffic volume by location. And so anything outside of user, like printers, cameras and things like that, we'll go through our branch connector.

But also, if you look at setting over $2 billion in ARR this thing is starting to 0. The amount of stuff, the margin implication item will be negligible.

Jay, you've talked about the 6x upsell opportunity you have in the installed base, I think, just on the user solutions side. Do you feel that investors are fully appreciating that runway? And as you think about unlocking that, you have a new CRO, a new CMO coming on board. Is there anything that you're thinking you do fundamentally different to help your existing installed base expand even further?

No. I think one of the big thing we will do, we have been focused on upselling, but ServiceNow has done something remarkably well on top accounts. Their top accounts process and programs really upsell have been very amazing. We've done a number of those, but I want to take it at scale to top x-100 customers. Imagine if I could take ARR of my large customer from $3 million to $6 million or $9 million kind of numbers, those are real opportunities for us to take advantage of. There is no lack of products for us to tell. What makes it hard is the harder the bigger the platform, it makes it a little bit harder for salespeople because they need to understand position it all the way. So we are essentially evolving, where we have people, we have told you we have CXO. These are former CIO CISO type who are part of the team to help position be of architects. And we also have some people in what we call the take-off team. Who are fastest in some product area. These are natural evolution that have to take place. And that's the process that we are doing. Our sales process is not simple. Here's an SC has a sales rep. Let's go and do it. But we are -- we have shown success. If you asked me when we went for IPO, we had ZIA with CP just coming out. ZIA was largely even the business bundle. We've shown how we can embrace evolve the platform and sell it successfully. About half of our new logos, I think it is new logo this quarter came from what we call Zscaler for users bundle. These kind of users bundle combines ZIA CPS ZDX, all 3 things together. We have felt that every customer we have, every user should have those. We are getting there. That's the platform expansion. The data protection on top of that is a massive opportunity for us. We think we're clicking into data protections. If you ask me, where are the big product areas for growth, Zscaler for users, which takes everything. I have a large installed base that's still only the ZIA. ZPA is sitting somewhere in the 60% penetration of large customers. But the ZDX, Zscaler users an upsell opportunity for new -- for existing customers and then new logo. That's one. Data protection is sizable. I think we said it was approaching $0.25 billion that at the end of Q4, I haven't looked at the math after end of Q1. It may have exceeded as it. Bill said, the number has exceeded $5 billion. That's good. And the third is emerging all products. Emerging Products, the workload communication side of it, the new products coming to the Risk-360 side of it. I think it's a good opportunity. Then we have to talk about AIML products. I briefly touched during the earnings call. AIML, we are adding -- AIML is not -- you shouldn't think of a market and product by itself. AIML has to be embedded in everything. It's like somebody said I'm an Internet company in 20s. What do you mean Internet company, every company is intent. Everything will have AIML. So we're bundling some of the future enhancements in our current bundles, we are creating bundles calls. We have Zscaler advance. Now we call Advanced Plus. The plus includes functionality that's power that's powered by AIML. So it can give us about 20% more. That's one area. Risk-360 is fully powered by AIML. And we've got new products we're working on. We hired some very, very powerful people who come from AIML background. And they recently come on board in the past month or 2, we are making some significant investments in our data cloud, taking all the logs we have every company will tell you about AIML. Every company has to because without that, there's no future. But #1 thing for AIML is data. If you don't have good data, you can't do AIML because it's all about training. Now Chat GPT was able to train on world's open data, any data that's out there, they're training on it, the most thing for them was, the amount of GPUs needed to train on world data is so expensive, so massive, that's for only Microsoft and some of these folks would do it. But for us, I don't care about public data. That's a piece of it. I care about the private data of logs of communication, all employees, workloads talking to each other. That's the most important log data to train large language models and the like. We have that. Now we are building our infrastructure to be able to take full advantage of it for training and the like. So I'm very bullish about what we we'll be bringing to the market in terms of the AIML.

Got it. I think that's about it for us. Thank you, gentlemen, both for being here, a great session. Thank you all for joining this morning.

Thank you.

Good conference.

Thank you.