Zscaler, Inc. ($ZS)

Great. Good afternoon, everybody, and thanks a lot for joining us. The pleasure of hosting CFO of Zscaler, Kevin Rubin. Really appreciate you joining us today.

To begin with, we'll take questions in the room as we come. So feel free to send it over or e-mail. It's going to be a fireside chat format. So just to jump in, right, I wanted to -- just for audience, not as familiar with Zscaler story or maybe still know you as the original SaaS module story or the most important, I would say, conceptual takeaway from the last quarter was increasingly becoming a control plane, not just for the users and applications but getting more agents and workloads. So just how should investors really think about Zscaler as a platform identity.

Sure. And thank you for having us. So Zscaler started as a zero trust platform for users that included Internet access and then shortly thereafter, private application access and have since expanded into cloud, so being able to provide Zero Trust for workloads and devices sitting in branch locations. And then more recently, we're going to be announcing Zero Trust for agents. So providing the same principles that we applied for users, devices, workloads, also providing it for agent-to-agent and machine-to-machine communication. We have our user conference next week in Vegas, live, and you'll hear a lot more about AI, agentic and our integrated SecOps product next week. So we'll be talking more about it. But essentially, if you think about Zero Trust, provide the least permissioning to solve a particular ask or use don't give access to somebody to jump on a corporate network and potentially have lateral movement access to do bad things. And so we've applied those principles through our Zero Trust Exchange to really provide one-to-one communication paths between users, applications between workloads to end workload between devices and so just a very differentiated approach to network security.

Very helpful. Just on the topic of AI, there's been sort of broader debate around frontier models and AI-native start-ups, especially as the [indiscernible] announcement by Anthropic. Just to kind of elaborate like as AI traffic sort of expands as more and more agents are coming online and even the targets are moving at machine speed. How does that really expand the need for what you offer, which is like an in-line enforcement layer? And how does that opportunity multiply in the agentic as we go out.

Yes. So as [ Mythos ] and other similar frontier models, demonstrate an ability to identify vulnerabilities at a rate and pace that far exceeds what we've seen today, we believe the best security and the best response to that is hydro applications and limit your lateral movement. So ultimately, your blast radius can go down to 1 infected device and 1 only. It doesn't have an opportunity to permeate the rest of your network. If you look at large organizations today, they already have a backlog of patches for existing known vulnerabilities that they are incapable of handling in any reasonable period of time. So they go through a process of prioritizing, which patches I'm going to apply when and attempt to do that without disrupting their organizations and their business. What Mythos and other models similarly are identifying is a volume of vulnerabilities that already exceed what they can handle today, you're just piling on top an order of magnitude more set of vulnerabilities and ultimate patches that would need to get run and it's just incredibly overwhelming. And so our approach and our answer to that is if you adopt Zscaler Zero Trust approach, you end up hiding all of your public-facing applications so they cannot be seen if you cannot reach the application, you cannot reach it and to hide it and then only apply. Only allow those sessions to be activated based on lease permissioning. And so those are the conversations that in response to just an unprecedented level of identification of vulnerabilities.

It's very helpful, Kevin. And I know you did highlight the customer conversations with -- and CIOs, how that's really shifted post-Mythos. But just in terms of big picture, right, what are you seeing as the budget trends for broader cybersecurity, right, in light of mythos. Are you seeing CIOs starting to kind of expand and unlock more budgets because of the extra additional risk that AI is driving. And I was seeing especially point around exposure risk. And recently, there was findings of almost 10,000 high critical vulnerabilities. How is all of that kind of changing the budget landscape for you?

Look, it's incredibly challenging for a CIO who has largely lived within fixed budget domain for a long period of time, and all of a sudden, there's 2 fundamental dynamics. You've got a need for their organizations to deploy AI and to do so quickly. I don't think I've met a CEO who has told an organization to slow down and go forward with AI slowly. Let's get it deployed through the organization and take advantage of it as quick as possible. And so they're reacting to a desire by their business to deploy AI. And at the same time, they have to then understand how do I protect this AI use in a way that protects my organization. And what we've seen is that companies have rushed to be able to deploy AI technologies within their organizations, and then they're coming back behind that to actually provide security for the ultimate use. And so we are working with customers via our AI protect suite of products to be able to provide protection for AI use. So we offer the ability to first, identify and find all of the AI assets that are being used within the organization, not just the obvious ones that you're intentionally deploying but applications that are leveraging AI in the background to be able to do more and to do more work within those applications. So we're able to identify the landscape of threat that you may have within your organization as it relates to AI. The second step then is to be able to actually protect the communication path going back and forth between AI. What data do you want to share? What data do you not want to share? And so we have an AI guardrails capability that will allow you to monitor and inspect that communication in real time to be able to ensure that sensitive data is not being exposed to models when it shouldn't be. And responses back from those models are business appropriate for your particular use. And then finally, we have an AI red teaming solution that allows you to continually monitor those models and understand how those models may change, evolve and drift over time. Fairly new products. We announced those as a collective suite of products at the end of January of this year. but they're actually doing quite well, and there's a lot of interest around just generally being able to protect AI.

Great. Really helpful. And -- so the increment will as regarding demand sort of reaction to react or to deploying AI, as you said, sense of urgency to deploy across enterprises. We've also heard from some of the general partners of the customers out there that people are closely looking at sort of longer duration, architectural revolution as well, right? So does Frontier AI ultimately also -- and is it getting evident in your conversation, at risk migration away from. And as you guys have talked about is a lot of the Zero Trust because [indiscernible] talked about from perimeter-based sort of firewall appliance based approach.

I suspect that as we kind of play this forward and organizations recognize the exposure that exists with traditional hardware approaches, network security approaches to AI. And what they will have to do to be able to patch and protect their environments, it's only going to increase the validation of moving to a solution like Zscaler. We already have an incredible ROI for customers that choose to adopt Zscaler in lieu of traditional network-based security and has the burden and overhead of continuing to manage that, you called it printer base. I just used the term network security. I think it's just going to make it that much more compelling. And we have had significant inbound conversations as this myths and Mythos-like exposure has been identified because companies are realizing that there's got to be a better way for us to protect our environments without constantly having to chase our tails and continually patch and chase these vulnerabilities. So we do think that it is a significant tailwind and opportunity for our business.

Great. Very helpful. And just on the high level, the impacts on your revenue margin, right? I mean we all understand like the seat model, of course, will take backseat as we go into this agentic era, and you have talked about how, as you said, right, the AI traffic, the workloads, the agents all those interactions are likely to accurate materially. Like just how should we and investors think about this model holistically evolving from this human seed base towards more sort of nonseat machine agent-based?

So we've actually been exposing some additional color into the texture of our new ACV in a given quarter, specifically to give insights into how much of that ACV is coming through traditional seat-based pricing versus more metered pricing, and it increased in this last quarter to about 30%. So we are seeing a continued increase in non-seat-based priced products in the market. The AI and agentic technologies that I mentioned earlier are not seat-based oriented products by the nature of those products. So they are much more aligned to consumption and how much traffic is actually being exchanged. For AI, it likely is tokens, right? That will be the unit of value that gets monetized. For some of our other products, it may be just traffic and consumption for our branch device by way of example, that starts to look at assets and assets communicating back to other applications and resources. So we have continued to see just continued distribution of our business away from seat-based pricing. And when it comes to agent-to-agent, we think that, that traffic will be significantly greater than what we've seen with user traffic and we expect to monetize that through tokens and consumption as well.

Great. Thanks for laying it out for us. And just, I wanted to get back to the setup into '27, because as you know, the market reaction intensely in to focus on the [indiscernible] part of the early look, as you said, when you think about that prudent -- can you just help us unpack like how you're thinking about the execution piece, right, which is kind of tied to the market transition versus like there are a lot of moving pieces, as you said, around SecOps, how they're looking at the budget, the deployment velocity. And then, of course, the agentic and AI monetization, if you can help us unpack things.

Yes. So I thought it was important in this last call that we provide an early look as to what we were seeing and giving you a perspective on growth that's into fiscal '27. We wanted to make sure that you were aligned with us in terms of how we saw our business. Against that backdrop, I provided 2 fundamental factors that were affecting how I looked at this early look into '27. One was we are replacing 2 senior sales leaders within organization. You may recall, Mike joined us a couple -- 2.5 years ago. This is his second full year running our go-to-market strategy -- one of his leaders got an opportunity with AI pre-IPO startup, and chose to pursue it after spending, I think, almost a decade with us, so a very long-term tenured senior leader. And so he has moved on. And another leader that was a direct report to Mike is also departing the organization. And so we will be welcoming 2 new leaders into the organization. One is an internal promotion into this new role. The other will likely be an outside hire. And given that and given that these are 2 senior individuals, I just took a cautious approach to what that would imply for fiscal '27. And these are not the only direct to Mike, but he doesn't have a large set of directs as well. So just in the interest of being prudent, we took a cautious approach. The other dynamic affecting our perspective on '27 growth is the pace of uptake of the integrated SecOps offering that you'll hear more about next week at [ Zenith Live ]. But if -- but fundamentally, we will be coming to market with an integrated SecOps solution that will leverage our existing technology from a data fabric perspective as well as our very high fidelity rich data set. And that will be the migration from the old Red Canary product into our integrated solution. And what I don't know and what I'm, again, taking just a cautious view is what does the pace of that uptake look like going into next year. So those are the 2 fundamental dynamics as I looked at fiscal '27 growth. Now aside from that, we have a significant number of opportunities that could build momentum, and we're very excited about it. We've talked about AI and just the opportunity that exists, whether it's a catalyst to folks choosing to adopt Zero Trust or it's actual providing security for AI, which, again, is products that we just recently put into market. So they're young, but obviously high-growing products. So -- but that's the tension and balance that we had to strike as we thought about the early look we provided.

Yes. Clearly, as you said, like the headline early look seems to obscure some of the healthier sort of underlying signs and signal as we've just talked about and especially around the health of the upsell pipeline, the AI pipeline and the nonseat business. So just I know historically, you guys have often guided prudently. I remember the times around the branch connector launch around the cloud before they showed that sort of inflection point, right? So investors think about central monetization of AI protect, SecOps, agentic exchange, you have all of those stack together in a similar way where like you have the architecture, you have the demand already there. And just it's a matter of like timing and scale of monetization. Just curious how would you...

I mean I think the answer is a little bit different depending on the suite of products. AI is very dynamic. It's changing frequently, as you know, we are very confident in how we're approaching AI, both in terms of securing it partnering with the large frontier model companies. We are part of Glasswing and DayBreak. And so that does give us a good perspective into what is coming and how we should think about releases like that. So we're very bullish about the AI opportunity. It does take time to build products in market are fairly early. I think as we think about the SecOps product, to me, it's really a pace of uptake question, right? We know we have customers that are on the existing product. We know that there's incredible amount of value and insight we could provide. So how that rolls out and what that uptake looks like to me is kind of the measure of success going forward. And then not to mention cloud and branch. I mean, those are 2 very well-performing products that kind of build out the suite of Zero Trust Everywhere, right, moving from users to those 2 particular products. And then soon, we'll have agents. So I think there's a lot of opportunity for us to see building momentum going into next year.

So interesting, you mentioned about the project Glasswing partnership and the potential for commercialization and monetization. Couple of partners, some of your larger peers have talked about some of the frameworks around that. Can you just kind of at a very high level, sort of laid out, like how do you plan to you utilize and leverage this partnership to kind of drive the commercialization? And what does that look like as a monetization model?

Yes. I mean it's a little premature for me to do that here. You'll hear a little bit more from us at Zenith Live next week. But we have had access to these models. We are part of these programs. We've been able to run them against our environments and use those as well as have meaningful conversations with customers as to how these models may affect them and where there's opportunities. So you'll hear more from us going forward.

Got it. And just to double click a little bit on the agentic exchange is, the reason I brought it because you and Jay sounded and for the right reasons, as the biggest long-term opportunity, right? And I'm pretty sure we're going to hear more about that in live. As a quick preview, right, I mean, if there is a kind of traffic-based monetization opportunity there, you talked about tokens, you talked about sort of transaction processing layer. It seems like the air traffic has already kind of exploded and as you see like a lot of numbers and metrics, how should we think about like monetizing that, right? I know we are -- you are kind of still figured out and trying to settle in a more stable model, more durable model. But just kind of any sense of how to think about that monetization.

Yes. I mean just to level set, the agentic exchange is not actually in market yet. The principles of how we will apply it are very similar to what you've seen us do with other Zero Trust approach, and again, you will hear more. But the concept is simple. We have over 50 million users today that we apply Zero Trust to through the Zero Trust Exchange. I would expect that number of agents and machine-to-machine connectivity is going to be orders of magnitude greater than that. And so the ability to be able to broker those communications inspect that traffic and provide protection is going to be very similar to what we've been able to do with the other forms of communication. And it just it represents an opportunity, very likely greater than we've seen thus far with users, branches and devices. So very excited about the potential. And I feel like we've got a scaled track record of providing the Zero Trust approach to other forms of communication.

Very helpful. I know we'll definitely wait until -- live for understanding how that agentic traffic translates into kind of more monetizable markets. But before that like AI product, as you started off with, already is achieving scale, right? I mean it's already at [ 100 million ] bookings, still relatively early compared to all your other opportunities. Just wanted to understand, I mean, you gave us a good kind of sense of like what's resonating. But like across AI, there are bunch different components and you have guardrails and you have ways to protect like the prompts and, which is starting to become more significant or are there multiple levers right now already showing growth just from a perspective of like AI protect?

Yes. So the guardrail product has been in market longest. I think we're actually probably just coming up on a year that, that has been in market. The asset management and the red teaming are newer. Red teaming was part of the SPLX acquisition that we completed a couple of quarters ago. And the AI Asset Management, we rolled out, I believe, in January as part of that announcement. So each of those components have had a different shelf life so far. But collectively, we are very excited about the proposition of all of them and think that they do form the basis for what companies need to be able to protect their AI use.

Just a quick follow-up. Is AI protect eventually and even like early signs are you seeing it becoming a stronger -- so landing motion, because I know you are focusing on new logos you have been talk about some of the adjustments you made in terms of prioritization of go to market. Is that going to be 1 of your big focus areas? And I believe you mentioned you're already seeing some traction there.

Yes. So the AI suite of products do not require the Zero Trust Exchange or ZIA, ZPA specifically. So it is an opportunity for us to land and have conversations with customers and we are having traction in these conversations. Some of the other products are more tightly embedded with ZIA, ZPA. So it would be natural that, that would be the landing point for those the AI products do give us an alternative kind of side door, if you will, into introducing Zscaler to prospects.

Got it. And you did announce an acquisition, Symmetry, very recently, seems to be when strategically aligned with your gene exchange sort of framework. Of course, the way you describe [indiscernible], enabling agents kind of in force and policy around it, it seems it's an innovative way of orchestrating the context in identity. Can you just outline like how that's differentiated from love these agentic identity, let's say, [indiscernible] and sort of paradigm out there.

Well, I'll answer as the finance guy. It's a fairly technical question. So Symmetry has built an access graph that allows us to understand and infer permissions that may have been inherited to an agent through its need to work. And so it just provides us yet another differentiated way to be able to understand identity and understand permissioning so that as we are providing in-line policy enforcement, we can ensure that the agents are only accessing permissible assets and/or applications. So it's just -- it's another piece of the agentic exchange puzzle.

Got it. And I'm presuming we'll hear more on like the monetization model. Okay. Just in terms of Z-Flex, right, and this was 1 of the, I would say, market products for you guys who closed $480 million worth of [ TCV ] this quarter, and that was like 1 of the big, I would say, inflection I've seen over the last year. So I know you've underscored that it's about flexibility and broader platform adoption. As other kind of larger players out there, like, I mean, I'm referring, have been leveraging this strategy. Can you just talk a little bit about like what has now resonated this quarter, especially I was just driving these sort of big kind of uptake of very, very large deals? And anything particular that stands out in terms of underlying drivers?

Yes. So Z-Flex is our approach to providing customers that are looking to make large commitments over a long period of time to us, the flexibility to not have to identify each piece of technology and specific counts of everything upfront today, right? So if somebody knows that they are a long-standing Zscaler customer or intend to use our technology over a long period of time. It allows them to have flexibility for the different capabilities that they can deploy over a period of time if they want to be able to swap into other pieces of technology or flex into other pieces of technology. It provides the vehicle to do that. It gives them fixed pricing across all of our portfolio of products. In most cases, some are in some cases, we only give them a menu of lesser product. But by and large, it gives them fixed pricing that they've already prenegotiated. So they don't have to go through another procurement cycle. 5 years into a contract to procure more. It's already been baked into that contract. And it allows them to make those commitments with the understanding that they've got protection if they want to use different combinations of product or they want to be able to try something else that maybe they didn't anticipate at the time they made the commitment. So it's a very flexible way for customers to consume Zscaler. And for us, it gives us certainty. It gives us that commitment, and so we're happy to provide that flexibility as well in that relationship. And we did cross $1 billion in bookings this last quarter as a result of the strong Z-Flex bookings in the quarter.

A quick follow-up. I think in the interest of time, there's a question which came up. So you do and you mentioned about your M&A strategy as well, you have over, let's say, $3.5 billion cash in the platform, really mature and as you said, like across the board. How do you think about the capital allocation right here? I mean I know you've been doing a bunch of like tuck-in M&As mostly, it's still organic execution. Are there categories where like a larger sort of move would make sense. I mean a lot of your peers have done very big, at least compared to their standards? Is there something that you'll have in mind or looking at it closely.

So we have really focused on teams and technology that we feel are highly complementary to the Zscaler platform that we have today. We have not sought to expand into adjacencies or by populations of customers we've really been very focused on how do we bring complementary technologies to market faster. And that's how I would expect us to continue to operate at least in the near to midterm.

Great. It's all the time we had. Really appreciate you joining us Kevin.