Zscaler, Inc. (ZS) Earnings Call Transcript & Summary

Yes. So let's start with where the market started with what the market has been. It used to be Secure Web Gateway dominated by Blue Coat, Websense, McAfee and Cisco of the world, that used to be our primary competition. And then where is that competition now? It's kind of gone essentially. Then we pioneered Zero Trust private access to applications. That not only eliminated VPNs, it eliminated the entire inbound gateway. That inbound gateway has a collection of things starting with load balancers, external firewalls, VP and internal firewalls, DDoS protection and the like. The whole thing went away. The market expanded, and we added -- sorry, Zscaler digital experience measuring end-to-end performance. We look to market very differently than any market segments were looked at before. I think investors make the mistake of trying to put the things in old buckets. Those buckets are going away. None of those buckets really matter at all. This thing was done for users, okay? That's users the starting piece. And then this thing had to be done for next level. Cloud workloads, cloud workloads are someone like users. They talk to Internet. They talk to each other. How is that secured today? Firewalls, North-South virtual firewall, East-West virtual firewall. We're taking the Zero Trust to really revolutionize that stuff. No one else -- there's no other competition in the market other than legacy firewall. Then branches had to be Zero Trust side. Device segmentation had to be Zero Trust side. The portfolio has expanded far bigger. When somebody says, I do what Zscaler does at 1/3 the price or half the price, they're barely trying to give a basic functionality of Zero Trust for users or many of them don't even has Zero Trust or users because they're spending off firewalls. Let me give you a simple example. If you went out and talked to Fortune 500 companies, there's are lots of these regional communication hubs, regional data centers. The traffic comes to those places, then it goes out to cloud or it goes to Internet. And that investment is hundreds of billions of dollars. With Zscaler, all that stuff goes away [indiscernible] directly in the branch, you go direct. We are able to take out all of that stuff and gives customers a lot of value, better ROI. So Zero Trust has moved from Zero Trust users to Zero Trust branches, Zero Trust cloud, Zero Trust devices. That's what we call Zero Trust Everywhere. And we're giving you some of the data about customers. Now about 350 customers doing Zero Trust Everywhere. This is enterprise. If you look at the total number of enterprises we have, Kevin, the definition we use is 2,000 users minimum enterprise definition, Kevin -- sorry, Ashwin. How many total enterprises do you count when you say that are our customers today? 4,000, 4,000 enterprise customers, 350 -- that means there's a lot of upsell opportunity in that space. This year, we crossed a milestone to go to 45% of the Fortune 500 companies. And when we say 45%, we don't mean we sold you a little bit CASB here, some firewalls there. When we go in, they take all the users, essentially to take us. There's most of the market sitting up there. So tons of opportunity in Zero Trust space. But then the next area, think of Zero Trust agentic communication. That will be massive. The user count in enterprise is not going to go up a whole lot. There's a lot of pressure with agents and AI. But a number of workloads is going up significantly. Number of agents will grow in billions of dollars. We are very well positioned to really keep on driving the market growth. So if you ask me, do I worry about people trying to come from behind? Not really. I'm focused on innovation, I'm focused on solving the next generation of problem, and we solve it in very, very innovative way rather than trying to be copy cats.

You brought up Agentic, and I wouldn't be a software analyst if we didn't talk about AI. So we'll absolutely get to that. But before we do, clearly, a lot of expansion and the vision on the Zero Trust side for traditional SASE that's expanding, like you said, to cloud and devices, that's helping you mitigate some of the pressures on the headcount model or seat-based model perspective. But the other area of excitement that I think has surprised to the upside is the type of momentum you're seeing on the data security side. I think you sized that business for you, frankly, at $400 million in ARR. And so there has been a renaissance of sorts in the data security world. It's gathering a lot of attention for what I think are very obvious reasons. But I'd love to have you kind of talk to the opportunity here. Many ways to skin the cat, we've heard different ways to do data security from some of your -- some of the pure plays, the backup and recovery vendors and some of the larger platform vendors like yourselves. So why is it -- why would you think, Jay, the Zscaler's way of in-line cloud data, DLP-centric data security prowess is the right set of ingredients to be the AI security player?

Very good question, Fatima. So customers want data security, no matter where the data is. And they want to make sure the data doesn't leak from any channel. So traditionally, there have been in-line DLP. What's in-line DLP? Before your traffic gets out to the Internet, somebody needs to inspect it. Okay. Every bad thing comes from the Internet, every good thing leads to Internet. If the loss of data happens to Internet, that's the best place. If there's one place you could do data security, you should be sitting there. And that's the place where we came from. All of our customers, all traffic that goes out to the Internet goes through us. And that's how we got a jump start. This market used to be dominated by Symantec 12, some of the McAfee offerings of the world and a little bit coming from Websense. We had taken a lot of those large customers out. If we are sitting in line doing traffic inspection, we are the natural player to do DLP. It makes no sense for our customers to go somewhere else. Now the question, Fatima, you're asking is, now the data is changing. Data is sitting in SaaS application. Data is sitting in SC buckets. Data is sitting in Snowflake. Data is sitting in Endpoint. Over the past half a dozen years, we expanded our portfolio to cover all the places of the data sets because the customers are saying, I have hard time actually enforcing policy of the data, okay, with one vendor trying to deal with 3 vendors or 5 vendors is a nightmare. So we had the most comprehensive solution. The point you alluded to, different approaches, it's not really different approaches. It is being able to understand the data in different places. So this new 1 more 4-letter acronym DSPM, Data Security Posture Management, started out and say if data is in the cloud, how do I discover it? How do I classify it? So we have expanded in that space. We've built over time. I can discover, classify your data that may be sitting in SaaS application, Cloud, Endpoint, even in data center on-prem. It's a very holistic most competent solution with one policy. We've built endpoint DLP, which has taken off very nicely, built e-mail DLP, which is going very well. We have 8 DLP modules covering all areas. If a business unit of data security for an independent company, it will probably be the largest data security independent company on its own. And this also requires inspection of traffic, a proxy architecture plays an important role. That's why you never hear that a firewall vendor is a great data security vendor.

And just to kind of close the loop on this, clearly, a burgeoning opportunity. But from a pricing model perspective, are you tethered to the exponential growth of data that's happening today and that is only going to continue to be more exponential as AI acts as a force multiplier on data creation? And how does that influence the way you think about having a variety and diversity of pricing models within the base?

Our pricing has been evolving and will further evolve. People always think about user-based pricing. User-based pricing worked for a while. What I do is even Zero Trust for cloud workloads. The workload-based price works kind of, but the amount of traffic starts playing a big role into it. So our pricing has evolved. When you talk about data in SC buckets, for example, how much is the data? What's going on? The user base pricing no longer makes sense. The volume plays a role in it and the traffic both play a role in it, and it's evolving, and it's should evolve.

I think this is a good segue into the next area that I really wanted to touch on was Red Canary. Would be really helpful for you to give us a reminder of the impetus of bringing on that acquisition. I think there's a perception that, hey, this was a very services-heavy orientation of an asset. What is it really bringing to the table? And ultimately, and I think you've wrapped that conversation around advancing your Agentic AI aspirations. How does Red Canary service that vision?

So if you think about historically, what we've done about 18 months ago or so, we acquired a company called Avalor to help us build a Data Fabric. Data Fabric is a new approach to analyzing your logs for security operations point of view. Traditionally, you have built the data lake, tons of transactions. You [ fire ] queries against it. The bigger the database, slower the query, the hard it gets. The Data Fabric approach is create census of the logs, which is much smaller, but it works. Think of it, how many of you use Tableau. You get all that reporting from Tableau versus going to a sales force against millions of transactions. Tableau can do 95% of the stuff and 5% you go to the source of data. Similarly, Data Fabric technology in a simplistic fashion is like Tableau. It allows you to do a lot of work. I don't want my customers to go and buy one more data lake. I want to eliminate the need for having data lake and we have the source data sitting, we have that Tableau equivalent, which is our Data Fabric. We have been on that journey, but also then we need to build the tools for security operations on top of that. We have been building it, but to accelerate, we said, let's go ahead and buy an AI SecOps company. We spent about 8 months doing it. And we looked at about 25 AI SecOps companies, okay? And guess what? We couldn't really find anyone that a real solution deployed in real life, okay, with real customers. If they gave me 5 customers, 4 were friends and family customers. Then I came across Red Canary. They're very good Agentic AI, where the agents are actually doing what security analysts do in production. We are excited about that. And also with 10 years in business, they actually had real expertise in detection engineering. So number one reason to acquire Red Canary was accelerate our completion of security operations solutions that can be sold as a solution and technology to our customers. But also then it gives the option and say, if customers want us to manage that solution, I can offer as a managed service as well. But solution also be available to other partners to run it that way. So that's the rationale, but also what I'm finding from many of our now Zscaler customers is, oh, I want the solution, and I want some managed service as well. There's a large Fortune 100 company that did a deal in the past -- the recent past where their Zscaler customer, they bought Red Canary to augment their security operations, not to outsource it all the way. So there's plenty of opportunity. But think of the revenue -- ARR, sitting at about $95 million projections or some $3-plus billion. It's what, about 2% to 3%. It's not going to make us an MDR company. That part gives us some expertise, but we remain focused on technology and -- but leveraging some of the key technology they brought to the table.

Jay, just to play devil's advocate. AI-powered SecOps and the modernization of the SecOps and SIEM, very attractive areas because we know the competitive and the technology dynamics are very similar to maybe what you saw in the Secure Web Gateway land almost 10 years ago, right? But the reality is there is a lot of competition. There are very fierce forces that are advocating to displace and disrupt those very, very large budgets. So I want to understand how do you think you are going to be a very formidable player in the AI SecOps movement as companies look to completely refresh and modernize their SecOps stack?

So two points to start with. One, is the market ready for disruption? The answer is absolutely yes. It's hard to find customers who say, I love my current SIEM solution. That's starting point. And the second point is why is it that way? Because traditionally, everyone has gone in, give me a SIEM solution and they're charged by a number of gigabytes. It's crazy because they all build a big lake on it. Our view is that if you go in a market, you go in with different architecture, different approach. And then you must have some core competencies. The biggest core competency we have in the space is data, 0.5 trillion transactional logs a day that allow us to create metadata and train our models on top of that while keeping the customers' data private. AI is only as good as the data and we have the best quality data. If you look at the logs that matter in this area, they are endpoint logs, they are communication logs, identity logs and the like. Old school, firewall logs, routers, switches logs aren't really meaningful. If you have the best logs to [ train ], if you have technology like Data Fabric, which is very different, I think we -- it positions us far better than others trying to go and do it all the way.

Bringing this back into the discussion around go-to-market and how customers are consuming a much wider Zscaler platform. Kevin, maybe the question is for you. Z-Flex is 4, 4.5 months, about the age of my newborn daughter. So a lot of learnings in that period. Can you give us a sense of outside of the $100 million in bookings that you did on Z-Flex this past quarter. What is the ultimate goal and outcomes that are aspired to with this initiative? And just from, again, a guidance perspective, how is this being considered in the way you're thinking about ARR and you're thinking about revenue and even RPO, if you can comment on that?

Sure. So Z-Flex just by way of background, was introduced, I think, halfway through our third quarter. We did about $65 million in bookings in Q3. We did over $100 million in bookings in Q4. And it's really a packaging and pricing solution for customers that makes it far easier for them to ultimately consume more modules on the Z-Flex -- the Zscaler platform and have the flexibility to do that over time. So it's designed for multiyear contracts. It's designed for flexibility. We prenegotiate pricing. So every time there is an upgrade or a desire to expand, you don't have to go through a procurement process. So it's really intended to reduce friction in that buying process and that expansion process for a customer over time. Aside from that, it really is a growth opportunity as we think about continuing to grow this business from an ARR perspective. It's not the only vehicle that we have to be able to support our customers, but it's a very elegant vehicle that allows them to adopt today and have confidence that their investment is as flexible as they go forward in terms of the modules that they'd like to use.

If I may add, in some of the investor research I find, I think people are [ overfavor ] into Flex. It's a pricing and packaging to make it easier. The real measurement of the business success is ARR growth. That's what it should be. Because before I do Z-Flex, I actually do discovery and architecture workshop to understand what all can be taken out. Then we go through business value assessment to quantify what can be saved. And then Z-Flex allows you to create a package that's flexible for your needs. So it's a natural evolution for us, but our focus remains growth of ARR. And this helps grow ARR.

And just to be clear, is the orientation of Z-Flex primarily a commitment-based model that a customer draws down against a solution or SKU of their choice within Zscaler or there are just more favorable amenable financing terms? I mean, because we've seen different variations and permutations of this. So is it a little bit of both? Is it something else?

So our Z-Flex is not a committed spend over a multiyear period of time. It's an annual commitment, no different than other subscriptions. It adds to a traditional subscription, the ability to swap out modules. It gives flexibility on future expansion pricing. So it's really a more flexible subscription arrangement that again encourages and facilitates expansion. It is not a consumption-oriented model. It's not you commit to spend and you can wait until the end of the contract and spend it all in the last year. There are annual commitments. There are a set of specified modules that the customer is going to deploy. There's the opportunity to flex into more modules over time as well as swap modules.

I wanted to quickly shift gears to the other side of the ledger. We talked -- checked the box on talking about the revenue opportunities, the secular dynamics. But just from a capital allocation and reinvestment standpoint, there -- the growth in the emerging product suite has been remarkable, right? And to continue to feed that growth, you have been leaning and you are leaning into reinvesting in the business alongside inorganic activity. I'm wondering if you can talk about where the preponderance of that investment is going and expected to go in fiscal '26. And how should we think about M&A as a complementary force in your capital allocation efforts?

So you can start with capital allocation. I'll talk about M&A.

Yes. No, of course. So look, we have a very efficient financial model, as you've seen play out over the last several years. I earlier mentioned, we have been a consistent Rule of 50 company. As we go into '26, you can see the guide as it implies to the areas that we're going to invest. We continue to focus on innovation. You see that manifest in how we support engineering and product. And so I don't expect any change in approach there.

Regarding M&A, we have been very selective. We don't go out to buy companies for revenues. We look for disruptive new technology that could be embedded with our platform to make a very integrated solution for us. If you look at what we've done, maybe if you show 1 slide the 4 pillars out there, Ashwin, one slash, I know we're out of time. Can you show one more? Go ahead. Here, this is our platform evolution. The first pillar, Zero Trust Everywhere. That's a big opportunity for us, data security everywhere, second area. And under AI security, there are 2 buckets. Security for AI applications, the models you're building. We announced products like AI guardrails for that. And then Agentic operations is where security operations fits in and IT operation fits in. I think we got a big lead. The innovation will continue, and we've got a sales force engine in place, and we're excited about 2026 fiscal year.

I'd like to end the conversation on that positive note. Thank you so much. Appreciate the time.

Thanks for having us.

Great.