Zscaler, Inc. (ZS) Earnings Call Transcript & Summary

All right. Thanks, everyone, for joining us as part of the Needham Growth Conference. I'm Mike Cikos lead analyst covering Zscaler. And with me today, I'm pleased to say that we have the CEO and founder, Jay Chaudhry as well as the Head of IR and Strategic Finance, Ashwin Kesireddy. We have 40 minutes set aside here for this fireside. Members in the audience will have the option to send in questions as we go. So please pass them along. We'll do our best to get those answered while we have the team here. But before we get into it, Jay is going to open up with some prepared remarks and some slides just to better illustrate the story and where the vision of Zscaler is going. So with that, Jay, over to you.

Thank you, Mike. We appreciate the opportunity. Just to set the big picture straight, Zscaler pioneered Zero Trust Exchange platform. That platform essentially started with protecting your workforce, your employees. That's where you're familiar with our 3 key offerings, ZIA or Internet access, ZPA for private access and ZDX for digital experience. With this solution, any user can access any application from anywhere in a Zero Trust fashion. And that also leads to doing user to app segmentation, the kind of stuff that only was done using some very expensive outdated products, BYOD kind of solutions out there. Then our customers said, "Wow, this is wonderful, why don't I do Zero Trust for my workloads, too. Workloads are somewhat like users. They talk to Internet, they talk to each other. So hence, leveraging the same core platform, same core exchange, we built essentially securing your cloud. This is workload to Internet communication. This is workload to workload communication. As a part of the architect, it fundamentally enables workload segmentation as well. Then our manufacturing customers, logistics and many other companies came and said, why don't you help me secure my IoT/OT systems as well. As you know, IoT/OT, they need to send telemetry and you need to reach to those OT systems generally from the Internet, which is done with using the old school VPN. And telemetry is usually sent by building a little VPN out there as well. Zero Trust fashion, we enable IoT/OT. And now actually with the acquisition of Airgap, we can do IoT/OT device segmentation inside the factory, warehouse and the like. Then fourthly, securing B2B communication. This is your customers and suppliers. More and more businesses are going online and more and more communication is happening with customer suppliers. How do you do it in the old world of firewalls and VPNs, you set up site-to-site VPN. If you are connected to 500 suppliers with VPN, your network is getting extended to those 500 companies, creates a significant supplier risk, third-party risk. We eliminate any of that stuff. So while many of the vendors trying to say, oh, we do what Zscaler does, are barely trying to do what we do on the leftmost side, while our platforms are expanded to do all 4 key entities. Now as the traffic flows through all of this, we are collecting logs. These are transaction logs, over 500 billion per day. That's B for billion. That's a precious data, private log data that now goes into our Zscaler AI fabric because AI essentially depends upon having meaningful logs. So I'll talk to you in a couple of minutes, sorry, in a couple of -- 30 seconds about it. But let me talk to you about the overall sort of picture of AI/ML we put together, one second in a slide here. Number one thing our customers needed as soon as ChatGPT got announced and Microsoft Copilot got announced was, how do I use these services in a secure fashion. For example, submitting code to ChatGPT is not a good thing. So what we did is since we're sitting in line, almost like an international airport, we can see all traffic your employees are submitting to public AI applications. So the first thing our customers wanted was, tell me what services my customer -- my employees are using. That's a discover part. So we offered discovery of uses of AI application, public AI application very early on. Lots of our customers put it in production very early on. The second part was managing policy. I want my developers to use public AI, but they can only go to these 5 services because they are the sanctioned one. My marketing department can use these 4 AI services and my sales can use only these 5 services as well. That's a policy for use of Gen AI. Then the third part became protect part of it, protecting data. So people can use those sanctions, AI services, but they can't be putting data. That's confidential, sensitive and the like. This became important. And as more and more companies are trying to use Microsoft 365 Copilot. Now they're worried about what kind of data can be accessed by their employees. Think of it. Once Copilot has access to OneDrive, SharePoint, there's all kind of sensitive information sitting out there, salary information. These AI tools are powerful. They scan everything, they get trained. They can tell you any information, anyone's salary and all the other information out there. So Zscaler has done data classification using APIs. We actually enforce policy about who can access what kind of information with Microsoft Copilot. So secure the use of Copilot has become an important area. During our last earnings call, I highlighted one important deal that was driven by securing Copilot. That's kind of one thing that's in out there with customers. We often package it as a part of the data protection solution. So it becomes part of the high-end bundle. The second thing we have added AI in all kind of products out there. For data classification, Gen AI is wonderful. We're using it extensively. Zero-day detection, we're using it. ZDX Copilot we launched a few months ago, has been very, very popular to figure out troubleshooting and the like. And in fact, the segmentation of application and all is being powered by AI. That's what we have done. And the next big area we are working on in this area is agent technology for automation, operational efficiencies and better security. The 360 offering we launched out there, the digital experience, we have Copilot. It's natural for us to work on the agent technology to take to the next level. AI agents for breach prediction. These are the new areas, security operations for automation, new areas we're working on. Then the third area that's kind of very exciting area as well. And this is securing use of private AI applications. Our customers actually are building private apps, their private large language model in the data center, in the cloud. How do you secure them? How do you make sure only the right use gets done? So we are doing -- we're essentially building a proxy, large language model proxy. We're sitting in line. This is through API calls. We can check the prompts to figure out if this prompt is good, a prompt is not good, should it be blocked, should it not be blocked. The response coming back needs to be analyzed to see if the right responses get sent back. There's also a risk of data poisoning. There's a risk of prompt injection. Those are the type of things we are inspecting for and detecting to make sure your private AI apps remain secure and they only are used in a meaningful fashion. So that's a high-level view. of the kind of things we're doing in the AI area and for entities that we provide Zero Trust communication for. With that, Mike, back over to you.

Great. Thanks, Jay. And just sticking with the AI theme for a second while we're already here. But for Zscaler's Copilot's offering, can you talk about what's involved from the customer standpoint to deploy and get those offerings up and running? Have we measured or quantified yet just how quickly customers can generate time to value? Like how quickly does -- is that accelerating because of Zscaler's Copilot's offering?

Yes. Take one of the key Copilot that's out there in production for quite some time is ZDX Copilot. One of the hard problem customers have is when a user calls IT and says, things are slow. I'm at home on this hotel and things are not working well. IT struggles to figure out where to start. Is it application? Is the network? Is the PC, WiFi, what the issues are. ZDX, with ZDX, you could go and look at x number of things to figure it out and we make it easier. But Copilot is actually able to take -- if somebody needs to spend 5 minutes to figure out what the issue is, literally, ZDX Copilot is helping them figure out in a minute or 2. We're seeing customers talking about the time to detect issues can -- it's cut down by somewhere in the 2, 1/3 or half kind of stuff is the data I've on for lots of customers, which is very, very good. That means fewer resources needed for troubleshooting and the customers, the user gets back to what they need to do much faster.

Excellent. Excellent. And just maybe think about this more holistically. But if we just take a step back and look at AI and the monetization opportunity. How does Zscaler think about that monetization, right? We're talking about massive opportunity with Microsoft 365, right? So how is it you guys are looking to make sure that you're capturing value versus other industries who are just going to have to embed this technology and they can't necessarily monetize it, right?

So, I think the answer will be both, some of it will need to be embedded because your technology need to leverage AI, but then when there are tangible areas our customers are willing to pay for it. Copilot, people will start charging for copilot. But eventually Copilot will become the next UI. But then the agents will become the technology you start charging for. So as the sophistication goes up, you charge and over time, you'll probably charge unless the next value needs to be added. That's what we're doing in many of these areas. But for example, our customers are happy to pay extra for ZDX Copilot, okay? But the big area, I believe, for us is as we really work on our security language models by taking 0.5 trillion logs, then start doing better detection, faster detection. This has the potential to essentially disrupt traditional detection technology response and investigation type of stuff. That's a significant -- big opportunity for us for the long run.

Awesome. And on that Copilot's point in the top of the call with the presentation, when you had said it that had led to one of the deals on the most recent quarter. I imagine that's the 7-figure ACV deal with that Global 2000 customer. I'd love to get a sense of when copilots or when these AI offerings are being introduced. How does the sales process change? Are the cycles slightly longer? Is there a different cast of characters as far as the procurement process? Anything that would be incremental.

So if a customer is actually accelerating the deployment of some of these AI technologies, the sales process accelerates. The example we gave for this securing Microsoft Copilot. This customer actually wanted to roll it out and start using, they're holding it back because they're not sure about the data privacy to see who has access to what data. Concern was could someone be checking salaries of these different employees because copilot essentially picks it up from all of these OneDrive and SharePoint kind of stuff. So that type of stuff accelerates. I think if you are starting a totally new AI project, it'll have it's own sell cycle, we are leveraging AI along with the traditional sell cycle to add value to increase the deal size or accelerate the deal size -- accelerate the deal timing, sorry.

Got it. Got it. And I know we were -- I think it was the first slide you had brought up was really talking to how Zscaler has been built and maybe some of those architectural decisions that you guys went through the nitty-gritty and the hard stuff early to ensure that you have this platform today. Again, just for the audience here, but can you walk through how those architectural decisions have led to this unique value prop versus how competitors may not have the same kind of inside baseball that you guys have at this time?

Yes. If you look at it from an architecture point of view, what we built is fundamentally different. In the traditional world, what you do is it's a network-centric world. You build a mesh network, then you connect everything to everything, you manage route tables, and you would firewall as a moat, VPN and all that kind of stuff. We reimagine the network, we reimagine security in the Zscaler world. You don't have to have your own network, Internet becomes a corporate network. Just like when you have public highways, you do not need private roads. And then our world was, you don't need any firewalls. We're not building moats, everyone is untrusted. That's why we are fundamentally a switchboard. We all like a policy engine, that engine says who can connect with whom. If I use one diagram to show you a little bit view of our architecture, very clean and simple. Applications are sitting out there, just like an island, user device is sitting out there somewhere. We have a policy engine. We start with identity checks. We're not in the business of offering identity. We work with all the leaders. We can define which application, which user can access. We are continually checking risk based on the behavior and the like. And then we can make connection with the right application, period. Everything is untrusted. There's no such thing as trusted network. This is what we've done with Zscaler now, when a firewall company says, we do Zero Trust too. What do they do? They build this mesh network. You've got traditional model, firewall sitting in various locations out there. But since they want to claim they can do Zero Trust in cloud security, they'll say I'll spin these firewalls in the cloud as virtual firewalls, don't worry about buying my boxes. How about VPN? Well, they can spin VPN in the cloud as well. In spite of that, it's still a mesh network. Everything connects to everything, there's a lateral movement out there. Doesn't solve any of the problems. In fact, this gives a false sense of security. So in this model, this architecture is like a bridge, once the firewall opens up traffic starts flowing, good and bad. We unlike a switch one thing gets connected at a time, unless these firewall guys rearchitect, start from scratch, you can't keep on bolting things on a firewall and say, I got a Zero Trust architecture. It's fundamentally different.

Excellent. Excellent. And it's probably starting to go into the go-to-market angle here. But from a high level for these Gen AI offerings that you guys have, are we at a significant enough volume with your customers at this point to start thinking about what that associated uplift to the deal value is at this time?

So it is still early stage from a volume point of view, but the traction is in the right direction. When we add our AI-based technology to some of our bundled, we are able to get the bundle price up in the 20% range. So we are not trying to say I need to lead in as a separate AI product because AI is making things smarter. The example I gave you, ZDX and ZDX with Copilot, customers see distinct value, and that's where they're ready to give more -- a better price.

Excellent. Okay. And from a go-to-market standpoint, does that require you to introduce more sales heads into the sales process? Like I know that you have your CRO Mike Rich who's been implementing some go-to-market changes, but just interested if you need more architects now as a result of this kind of sale?

So it doesn't. We are not trying to change all things work. In fact, we are reducing the complexity of interacting with our application. In fact, it is reducing the amount of training we have to give it to our customers to use our services and products. On sales point of view, we do need to train our salespeople, so they can have AI-centric discussion, explain how the functionality works. But they don't need to explain how the large language model gets trained underneath, okay? All by and large, customers need to know if I did these things, and it took me so long in this level of complexity, I can do it faster and better with all of my training.

Got it. And again, just thinking about that sales process, the different persona is brought in, are you potentially -- or were you already in some way already tackling, let's say, compliance, legal, like, again, I think about the number of people that may need to be brought in for these kinds of decisions and the implications that might have for sign off on a deal, right?

Yes. So Zscaler has traditionally dealt with 3 C-level people, CIO, the overall leader in IT who is responsible for application, security and network and the like and Head of Networking and Head of Security. Compliance has been part of it all along, actually Zscaler helps you achieve a lot of compliance. Now in this new world, with AI stuff, our customer is looking at is you're solution compliant, for example. The question does come up, but we are actually out there to make sure you are using AI with compliance, okay, the first thing I talked to you about, secure use of AI. Being able to enforce policy and compliance who can access what, who could be posting what kind of data where. Do additional questions, are they beginning to come up? Yes. Are they a big part of it in our solution today? Not quite.

Okay. Got it. Got it. Well, you're obviously seeing traction there, especially given the AI analytics stat that you gave, I think it was that new and upsell ACV was up north of 90%. So kudos on that. If we shift gears for a second to going back to the earnings call you guys hosted in early December, you had gone out of your way, I think in the prepared remarks, to talk about ZPA as being a large growth driver in the upcoming year. I guess what are you seeing and hearing in customer conversations that gives you that confidence? Is there anything from a competitive landscape or maybe the pipeline build? Just help walk us through that comment, please.

So I think we shared with our investors that in large customers, over 60% of large customers already bought ZPA, which is pretty remarkable. We also shared that if you look at the new ACV, new business of ZIA and ZPA, ZPA now forms over 40% of it, okay? I mean but 6 years ago, 7 years, it was 0, okay, okay? To take out 40-plus percent of a ZIA, which has grown pretty rapidly is a pretty remarkable thing. I mean, could it get to 50%? Only, yes. And via internal discussion and say, man, if it goes over 50%, I'll be unhappy because then ZIA is not growing fast enough, okay, other opportunities out there. So it is -- it started by VPN replacement early on. But now the biggest driver of ZPA has become is minimizing or eliminating ransomware attacks. The typical way ransomware attacks happen is they get on the network, this so-called trusted flat network by stealing identity and logging through a VPN or something out there. Once they're on the network, they move laterally, they find high-value asset, encrypt it and the game is over, okay? ZPA, by default doesn't allow you to do lateral movement on the network, you never own the network. Then you can go a step beyond. ZPA allows you to do application to user segmentation like so if somebody got in, you can get into one application, but you can't literally go laterally and try to find others and spread against them. These are the type of values our customers are doing more and more. In this -- in fact, one of the exciting use case of ZPA ends up being when it started out, you used it from home. Now every office is becoming such that the users at the headquarters or your regional office are not on your corporate network. They're on a guest network. And through ZPA, they come through our policy engine and access applications, not just moving on the corporate network. It's a big deal. The next phase of Zero Trust is becoming the branch. That's where we launched a Zero Trust branch appliance. Your branch becomes an island. It's like Starbucks. In fact, I'm excited to see more and more customers are saying, I need to eliminate my SD-WAN because SD-WAN helped me reduce the cost of MPLS. But SD-WAN is like any other network. Once you get in the branch, you get on the network, you move laterally, you can infect everything out there. So the opportunities to further simplify this network complexity and reduce lateral movement and the risk and the like is massive. That's why customers see the difference even when the competition comes and says, oh, we got ZPA like stuff, too. The biggest thing they got is some basic VPN replacement functionality.