Zscaler, Inc. (ZS) Earnings Call Transcript & Summary

I'm Fatima Boolani. I jointly head up our software research team here. Thank you for joining us in the afternoon sessions of day 2 of Citi's TMT Conference. I'm very excited to host a fireside chat with the CEO and founder of Zscaler, Jay Chaudhry, thank you so much for being here.

Thanks, Fatima.

Jay, I want to start the session and the discussion of -- by you just setting the stage, you just closed out fiscal '26, which was a pretty transformational and transformative year for you. But before that, I have to say, Zscaler is 19 years old this month. It might have been your first baby, the congratulations on that. But a pretty transformational year for you in terms of a lot of activity, a pretty large acquisition. So just to have you set the stage for us and the table for us on the year-end review, kind of key milestones coming off closing out this year?

So first of all, our platform expanded significantly. Zero Trust everywhere is a big differentiator because you don't want just for users, the branches, devices, workloads and our agents our portfolio of our data security is as comprehensive anything gets. And then security for AI, actually, a year ago, we had 1 product that is Jennie security. Now we've got 6 very good products fully integrated. That has exceeded my expectation the pace at which happened. And we expected it. We set up -- secured AI start-up within Zscaler, it has actually delivered solutions very rapidly. And then the launch of AgentixSEco, that happened today. Great platform on the product side. I think we have a better portfolio platform than anyone out there. On the sales side, we got some great momentum. We started the journey of transformation about 2, 2.5 years ago when Miri came on board. In that time, we changed the sales teams process quite a bit to be enterprise account-focused. And that thing is delivering results. to give you tend data, you may think that overall ARR growth percentages here. But the real number to look at the growth where we have made changes in net new ARR. I mean in '24, we basically had very little net new [indiscernible] '25, we took to 7%. Fiscal '26, first half was 10%, Q4 was 17%. It's tracking very well. So good momentum on the sales side, good on customer side. Customer success is very good. Our NPS, Net Promoter Score has been sitting in the 80% to 85% range. Very, very proud of it. That's reflected in the amount of upsell we are doing. So very pleased and looking forward to further doing better job in '27.

So product portfolio has expanded materially. The go-to-market motion is now getting to a cruise controller, a cruising altitude, if you will. So as we look into fiscal '27, maybe we can spend a little bit of time talking about the security for AI opportunity. That seems to be an area where you're very excited. When you time with customers, what are your most salient and palpable pain points that you're solving today, a lot of vendors are clamoring for the so attention, clamoring for the budgetary attention -- how are you putting a stake in the ground and wedging yourself in the room and saying, these are the focal points for your architecture today. And I don't have to remind anybody that this has been, again, a pretty consequential year of cybersecurity headlines development, right, post methos? Close to hugging phase incidents. So how have those conversations shaped the dialogue that you're having with CISOs today that's different from the conversations you were having 6 months ago?

So first of all, it's not just the is. Now CIOs worry about it. The Board worries about it. After Matos, most large enterprises had a cyber task force whose job was to do some of these things and then report the Board on a frequent basis. So here is what's setting us apart in some of these areas. Think of what the customers are worried about from cyber, frontier models, one, even if you don't plan to embrace Frontier model still cause a risk because anything that's exposed to Internet could be a firewall, VP, an application, AA, application B. They can be discovered and if they are discovered function models are likely to find some vulnerabilities that creates a problem. In the Zscaler world, we're unique that with Zero Trust, we can hide dose application behind. So we are very busy working with customers, hiding their applications, customer after customer, they have in cases customer had 500 exposed domain subdomains applications. And once we go in, we are able to bring that number down to probably 200 in a matter of a few weeks, then it takes more time to go further down. That's number one. Number two, they are worried about embracing AI agents. The powerful. They're excited. Every CEO is putting pressure on them, do it and then they say, wait a second. They read about hugging phase. And they even next week and tropic saying, hey, my agent went rogue, then Meta comes, yes, mine went rogue too. And then last week, what -- and I wanted open AI, oh, one of my agents hacked a German site 3 months ago, okay? All this is happening. So enterprise are worried about it. So for that, they are looking for essentially a solution that can make sure right agent can talk to right agents. There's nobody better suited to solve that problem for solar because we pioneered 0 trust where a user could only connect with an application, not on not the network. Firewall vendors connect to the network. We advanced it to 0 to branches, for devices, for cloud workloads. So doing agent was the natural thing for us to do. So those are the 2 things. I'll give you 1 example yesterday a few customers. Two of them were large federal agencies that you would expect in D.C. that's a natural part of it. And both conversations, tell me metals, they're both using Zscaler, ZIA, ZPA stuff. And now they're looking for help. So now the conversation happens, I talk to the CIO, how we can do this. They are a large agency, thousands of. And the CIO said, I have 90,000 Internet access payments, okay? How long will it take for you to give me an assessment and the risk factor of it. I told you that it will be faster than how long it takes you to go through your paperwork for procurement. How about 4 to 6 weeks? I said done and said, let's get started. We'll figure out. And then our real opportunity comes actually to block all those things. So 1 of the opportunity motion we have is to show them what the risk is as a complemented service, then the opportunity comes to us. So it's sizable, and we are focused on leveraging it.

Jay, I'm going to take a little bit of a detour and talk a little bit about the historical context of few things. So you can humor me. You've had the privilege and the benefit of actually witnessing and participating in destruction in prior computing cycles, right? So you saw the rise of the cloud secure web gateway coming filed with Essendant, and we were moving away from the client server model. I think -- and you've been famously talking about that the Castle architecture shouldn't exist. You stack the DVD players, so I think we're familiar with that. So you lived through that computing shift. So cyber attacks and the rise in volume and velocity and variety and sophistication of cyber was an issue at that time Target COVID-era pandemic era, there was an impetus for security modernization. And now we're here when the AI native era, right? So cyber attacks have always been a problem. They've always gotten worse. But in your opinion, what is different, more pernicious more consequential in this period of time that doesn't compare to these past periods?

The number of attacks in the nature or the impact of tax has gone up, what I may call incremental. What meets models have shown it's a step function change. It's a big change. They can use some data points. The number of vulnerabilities that pre-front-model companies who do vulnerability management are able to discover. If it's X, frontier models are discovering 10x. That -- so it's such a big. For example, before metals we would go and tell customers, you should hide your attack surface with Zscaler. It's a good thing. And they'll say, yes, it's a good thing, but it's not a I have a lot of other things to do. It's a kind of priority but not the highest priority. Now if something can be discovered, there's a pretty good chance that the front-end model will find vulnerabilities that can be explored. So the risk has gone up significantly on these assets have to be done. So that's what makes these people nervous. So the biggest change, the 1 of the big attacks that happened what, 10, 15 years ago was target. That was big, it showing up, but nothing like this. This is you're seeing things every day. I mean we were part of the project glassing from day 1, early March, when we tested our own software, we found quite a few vulnerabilities. I changed ports and my team and say, your #1 priority is fixing it and the feature delivery can slip a bit. That's okay. So I think that is very important. The good thing is a cloud-native company like Zscaler can fix those things on its own. If you're selling lots of hire walls, then we have to reach the customer to figure out, upgrade all that kind of stuff. But this is the biggest step function change in Cyber world.

So just bringing it back to your opportunities, your prosecutable opportunities and your capturable opportunities. I think one of the things that's been confounding for investors is that the environment has never been more dangerous. I mean you just obviously gave us some very examples of why the market factors and the exogenous variables are absolutely in your favor. So the confounding element, I think, for a lot of investors has been, well, where is the budgetary explosion, so to speak, right? You would have assumed that the cadence of budgetary growth would have accelerated immediately, right? And you just mentioned to me that this federal agency has a 4- to 6-week time period, right? You also mentioned that your CISO conversations over the last 6 months post MeetThos, there was a task force right? So it's almost like instead of seeing a budgetary explosion that you've been able to capture, there's maybe been a little bit of a pause from an organizational standpoint, as there is such a tremendous amount of change, you want to be deliberate and thoughtful around it. Would you disagree with that characterization, number one? And then number two, how can we -- how can you express comfort and confidence that actually the budgetary explosion, so to speak, is on the come because budgets are only going to need to rise to the occasion of the cybersecurity and cyber attack environment that we're in?

Yes, good comprehensive question. So first of all, I would say the urgency to handle security issues has gone up big time. That's there. Now I will contrast the urgency for during COVID versus today. This question hasn't asked to me, COVID was a catalyst. The difference between the 2 was the following. When you were sent home on Friday, whatever March 14th in 2020. On Monday, you couldn't work unless you had a solution. So we were inundated with calls. We're literally working day and night to turn on Zscaler to get things moving. So it happened very rapidly. On Methos, the risk factor is viewed as far, far bigger. But now they are trying to understand the risk, what how, where prioritization. Those things have played a role, so you did not see a kind of a silver bullet saying, certainly, the budgets are jumping up. But the urgency is going up. Now urgency is in a couple of areas. One is these models, what can I do about protecting it. And then the other pressures, CEO is a push putting on CIOs and sources -- embrace AI safely in a much faster passion. Now they are trying to figure out what do we do? Now embracing AI is happening but bigger rollout are still slowed down because of cyber. Now when I go and talk about AI security or security of AI to customers, which is every conversation. Now looking for, can you give me a comprehensive solution rather than 5-point products. So that's favoring us. We built about -- we built 4 products internally. We acquired 2 products through acquisitions. So it's helping us here. The other thing that's helping us is they're seeing there are 1,000 probably security for AI companies out there. The message from CIOs is, I don't want 1 more point product. I want integration that's helping us in that space. But also, I am also seeing that even though we had done hundreds of deals in the past 12 months for AI security. The deal size has been smaller. They can say, I want to understand and before I do multimillion-dollar deals, so size deal are smaller urgencies there. It's also driving need for 0 trust because either you hide your application behind or if you think somebody got in, you need 0 trust to reduce the blast radio. So branch is infected, it doesn't go beyond the branch. So it's helping data security as well. By the way, the deals we closed in Q4 for AI security, 70% of the deals also had data security as a part of that. A number of our Zero Trust deals did get accelerated because of the sense of urgency here. So we've seen impact, I think we expect to see more impact in fiscal '27.

This is a good segue into the next question I wanted to ask you was just around you've framed the business by virtue of pillars, let's just say, lose pillars. Zero Trust everywhere, AI security and data security. I'm curious -- what is now -- has tip of the spear for you changed because clearly, in the way you've described it, there is a lot of coincident value in having a 0 trust architecture and portfolio of products from you on the Zero Trust side with a layer of data security, and we'll certainly get into more of the data security implications and what that means for your business. Generally speaking, you frame the business in those 3 particular pillars. I'm curious as it stands today, as you think about fiscal '27 as those budgets open and the urgency is realized and you're monetizing it, where is it -- where should investors expect to see the outcome, the positive outcomes of that budgetary allocation in what domain would you expect that to show up most?

Yes. So great question. So first of all, those 3 pillars you mentioned. We just added a fourth pillar for AgenticSecOp with a launch. It's a new area. It will take some time, but it's also a big opportunity for us. Where does that traction in form, right? So I have been surprised by the speed at which the security for AI products have taken off. I told you a year ago, we had basically one product, not a whole lot of stock.

Times as many products...

And also we disclosed after Q3 was our last 12 months bookings for security by AIS exceeded $100 million. And in Q4, we also that sequentially, our bookings went up 50%. So we're seeing good, very good traction. I expect some serious traction in this area though we haven't quite factored a meaningful upside of skewed AI in our guidance. We just want to prove and we just unless we prove we get comfortable. We don't really want to raise expectations to take AgenticSecOps, too We are working with a number of customers in early stage. We haven't factored a hole after that in because we haven't really proven ourselves. So the big growth areas AI security starting from a small base, but exploring rapidly. AI is impacting data security that is helping. And Zero Trust everywhere is the fine foundational piece if you really need to be secure, there's nothing more fundamental than Zero Trust everywhere -- we're seeing a ideas going up. to every where a number of customers has moved up from 30 a year ago to 950 this year. That's pretty remarkable. We are doing some very large on branch. I'm excited with this area very much so because I've always believed that the network call it, disruption. MPLS. We did that very nicely. People used to say you're crazy. If you say MPLS is going to go away, it can never go away, right? Now Zero Trust branch is disrupting SD-WAN. Even though Gartner talks about SaaS and SD-WAN, we can offer a different game. We are in SaaS without SD-WAN, Zero Trust, branch and all that kind of stuff. We're doing some very big deals in the space. We're also doing deals with 0 brand is bought without having to buy traditional ZISC because they want to do segmentation. So 1 thing new this year for us for growth is, we are now multiple lending solutions. And even though we had some before, we never focused on it. Now we're realizing that. If you go to a customer, if you go with 1 solution and the timing may not be right for it. If you have 4 offerings, they're more likely that is going to say, "I need this. So for example, AI security, a lot of deals we're doing on new logo deals. Data security, a number of those products are new logo products. So you don't toss branch, when I do plant segmentation or I don't need this solution. So I have multiple solutions that are helping us expand our platform. I mean, we shared about 785 customers now with $1 million plus ARR million number has been going up as well. We did a record number of million dollar deals last quarter. We created a record pipeline last quarter. Our productivity in Q4 was the highest in the past some 4 years and productive '26 has been very good as well. So that's how I'm bullish about '27.

There is a kind of a running theme that you're alluding to around this resurgence in Zero Trust principles, the foundational underpinning to build your Agentic workflows and Agentic applications. So as part and parcel to that, historically, predominantly scale business model was sort of based model, right? We've always been acting as a switchboard between the user and the end application, right? I know increasingly, you've been moving towards becoming the communication switchboard for [indiscernible] right?

And branches and workloads, yes.

And so as kind of the end-user units, let's just call it that move away from humans to machines to agents. How are you levered financially to those positive trends? Because I think we've all heard the stats here that an agent to hunt ratio in the next 3 to 5 years, could be 50x, 90x 100x right? Sky is may be the limit on that. So how is the business model benefiting from that today? And where do you expect that to be? And should that actually show up in Zero Trust modem? Or will that show up in the AgenticSecOps pillar that you just launched? How would this -- what is the culmination of this growth of end user units?