Zscaler, Inc. (ZS) June 3, 2026 Conference Transcript

America, and that's for the benefit of the transcript, so we can pass this. And Jay, thank you so much for joining our conference. I really waited for this session because I read an interview with you that you believe that investors, you don't do a good enough job to explain your company to investors. So I want to give you the opportunity to explain your company. And the first thing I want to start with is normally I don't ask about the quarter, but I do want to ask about the quarter. because I thought there was a difference between the way you performed and financially and the way the stock reacted. What is misunderstood by investors in your company's performance?

So first of all, as you saw, the Q3 performance was very good. We beat all metrics that the investors look for. I think for going forward guidance, the two aspects to it, One was Q4, and second was fiscal 27. And the two factors for us to be more cautious about the guidance, one was we had a couple of changes where two leaders reporting to a CRO moved for two various reasons. One for personal reason understood, and second was an opportunity at a pre-IPOA company. And when leaders leave, we want to make a transition involved, and they will have some impact, that factor. And second was the Red Canetti customer base. We have built a new product combining Red Canetti technology with our technology. And that new solution is getting showcased next week at our annual conference. And the uptake of those customers, we still need to understand. So keeping those two things in mind, we kind of set the expectation at what my CFO will call at a prudent level. But in terms of the external market factors, the market for cyber has never been hotter. Mythos has further put fuel to the fire. They're probably the biggest tailwind since COVID for our company. And this platform has gotten bigger and bigger. Loyal, happy customers. And we have essentially gone through the transition of sales that started about a little bit of two years ago. And we've gone through most of it. And we look forward to expecting in Q4 and 27.

So maybe let's start with if you can articulate your target markets, meaning what are the opportunities you're going after? No, I'm not talking about the quarter thing. It could be a three-year, five-year, but what are the opportunities you're going after? And why are you well-positioned for these opportunities?

And it also relates to the question you asked, what investors don't understand. So investors understand mature, established market well. A firewall is a firewall. It doesn't need to be explained much. A router is a router. Maybe the feeds and speeds are better, okay? When you bring transformation, you bring totally new changes. It takes some time to explain itself. And then what happens is the established incumbents fight back because they get disrupted. They like to say, we do that too. It's like internal combustion engine car companies fighting against electric cars. They said, forget it. I'm better. That's the fight that goes on. So take one example. Zero trust is fundamental. With mythos, it's becoming more and more important because there will be more breaches. It's given because you can't be able to patch all the way. And zero trust will make sure that only certain parties talk to certain parties. the breaches don't spread, the blast rates become smaller. Many times people think that, just because a lot of me-toos are trying to say, oh, we do zero trust too. And this fancy new four-letter word, SASE, we do SASE too. First of all, SASE and zero trust aren't the same. SASE allows SD-WAN, lateral movement of light. And then the second part is zero trust started with users. We made user zero trust phase one. Then we made cloud workload zero trust. What's my competition for zero trust cloud? 30-year-old firewall technology, east, west, north, south traffic. Then we made branches zero trust. Each branch is like an island. There's no lateral movement. And then device in a branch. We call it zero trust everywhere store. That zero trust everywhere is just beginning to take off. We shared with you at the earnings that now we have over 700 customers doing zero trust everywhere, which means users, branches, cloud workloads, and devices. That same number was 550 last quarter. So big opportunities to make zero trust everywhere, market number one. And there's really not a real competition from firewall vendors out there it's only probably on the lower end of the market because the high-end customers generally are more savvy they get it the second big opportunity is data security for data security you need to sit in line as a proxy architecture inspect the stuff firewall vendors don't do data security well they're not a proxy architecture we have over half a billion dollar arr business if it were an independent company it'll be the largest data security company perhaps and still growing over 30% of your area. We do that stuff very well. So those are one set of areas. Then look at the newer areas. Securing, oh, before I go there, the most important zero trust next area is zero trust AI agents. Search for Anthropics white paper on zero trust by AI agents. It just came out. two days ago, I looked at it and said, huh, they wrote what I would have written. Literally, they understand it. Their stuff was agent-to-agent communication must happen through zero trust, not through the firewall wall. We actually have been building that solution. We plan to launch it next week at a user conference, and there'll be millions and millions of agents, and they need to be secured. That's an opportunity. Then, securing AI infrastructure and applications and models. We are building that solution. We did an acquisition. And in January, we launched our integrated solution. Our customers want an integrated solution, not five different vendors. And that solution is taking off quite well. We already exceeded $100 million in bookings for that solution. Big opportunity for us. And then, agentic SecOps. While there are many players in agentic SecOps, AI actually is useful for building SecOps. There are probably 500 companies, startups in agentic SecOps, maybe more. And because they think they're going to build it easily, the advantage will be to vendors who actually have telemetry and metadata to do it. We are in line. We probably have the most valuable data from communication. We are on endpoints. We have endpoint telemetry. All authentication goes through it via identity telemetry. So our customers are saying, you got the data. I don't need to pass data to someone to build the sim. I want really output that can be done directly with us. So that's an opportunity for us by itself. So there's no lack of products. And we do products carefully. We don't go on a buying spree for, I mean, say A, B, C. They're well-integrated. They're part of the story.

What makes you be successful in these areas? Meaning, the current position that you have with customers, what are the parts that can be levered into the new areas?

So, first of all, zero trust everywhere is expanding from what we have. It's very, very natural. When customers go from zero trust on users to zero trust everywhere, the ARR either becomes 2x or 3x. Similarly, and we're natural. If you've got a user of zero trust, natural to the nest. Data security. We're sitting in line, inspecting traffic. Most of the time, data leaks to the internet. We are the natural player to be able to do that. If you think about for agentics stuff, it's natural to do that. And if you think about the SECOP, SECOP was driven by the fact that we got all the telemetry and metadata. We can do that. But one more point. In minutes, I can figure out some of the new threats. I can do a closed feedback system to the inline system to block those threats in near real time. That doesn't happen otherwise. So very synergistic platform expansion.

Is there a risk of slow take rate? Meaning what I'm referring to is the majority of the revenues today are ZIA and ZPA. You have new areas you're going after. Is there a risk of a kind of transition period?

So if you look at the ARR or emerging growth, a new ACV has been growing rapidly. And we have been giving some stats, for example. Great to see data security agree so well. We have seen in the past couple of years, we used to do emerging products, and some of them already emerged. So we stopped doing emerging. The emerging went from about 8% or 9% to 30% in two, three years. That's a remarkable expansion thing. So if the products are synergistic and the decision makers are similar, it becomes meaningful. If decision makers are very different, it becomes a lot harder. That's how we elect our products. One more thing, as products have expanded, we now do have specialty overlays, salespeople, who can go deeper in certain areas, but they work with account execs.

Got it. You mentioned data security, and this has been the focus of yours for quite a few years. Double click on this market, meaning what is attractive within data security is a big space. What is attractive and what are you addressing within data security?

About five, six years ago, We only used to do DLP, inline DLP. And our large customers said, doing data security with one vendor is hard enough. If I buy three products from three vendors, it would be impossible. Zscaler, you should focus on building a complete platform for data security. And that's when we expanded to CASB, SAS security. Then we added endpoint DLP, ended email DLP. And we added cloud security, S3 buckets and all. recently we added last year we added dsbm discovery classification data so it is the most comprehensive integrated platform we think we have a big edge we have very good uptake by our customers so yeah very pleased with the performance and again what same question i asked you before what makes you better positioned for this market given that it is being addressed by other players as well? Not really that much. Think of which SASE vendor does data security very well. Not a whole lot. There is a class of vendors coming from the startup side. They call them so DSPM. DSPM, one more four-letter acronym. It's called Data Security Posture Management. At a simplistic level, it does two things. One, it allows you to discover data. Where is my data? data center, AWS, Snowflake, wherever, and then it helps you classify the data. That's important, but it doesn't do data DLP, okay? You do classification and discovery, then you combine it with a DLP, and then it becomes a complete solution. We came from DLP side, we added DSPM, so we have a complete solution. And generally, there's a lot of wording about DSPM is important. it is important. And you hear about some of those vendors, but they will have to do DLP to be successful in data security. And we are ahead of anyone in this area. And then the customer engagement, track record working with us. DLP should only be done with somebody who is already setting the traffic path. Some new vendor to come and say, put me in the traffic path is a big ask.

Got it. I want to go back to ZIA, ZPA, just because it's a big portion of your business. How's the growth like? And what are the drivers? I mean, when I talked to Cisco or Fortinet, yesterday I hosted Ken Z here and Ken said, I'm a third of the price. He said, that's my thing. I'm bundling it together with my firewall. I'm writing on top of the firewall. I'm a third of the price. What kind of a disruption do you see from companies who are trying to bundle firewall with SASE or SSE?

So two things. First, if you want product functionality A and you get B, I'm not sure in cyber, if someone gives it to me free, I won't take it. Got it. So if it doesn't work, so they are all firewall functionality. There's nothing zero trust about it. In many product areas, good enough is good. Perhaps HR system. Now, they are pretty important, but not as important as cyber. Yeah, I'm OK with a good enough HR system, but I'm not OK with a good enough cybersecurity. So CEOs have to think that if I get compromised, what's the consequences? That's point number one. Point number two is that customers are understanding more and more the need for zero trust. I think the wind is not towards I can give you cheap firewalls. Now it is true that lately, in my view, firewall vendors have been helped from two things. One, the prices have gone up. Heck, if you raise the price 15%, if you beat the quarter by 15%, what's the big deal about it, right? It's an external factor that brought you in. Two is, I think they're also getting some tailwind from the AI data centers being built. But we are clearly seeing zero trust momentum building up. Our growth should not be looked at ZIS-EPA for users alone. That's a starting point. It's not a core versus non-core. Our product to stay zero for the users to branch through cloud, how well is the overall portfolio growing is really an important part of it. Overall, they're doing quite well.

And is there just because of the fact that there is more competition today on SASE, even inferior solutions, Cisco is in the market and Fortinet is in the market and Checkpoint is in the market. These are new players. They were not in this market before. Does it translate into pricing pressure or shorter duration of contracts, or do you see an impact of the new competition?

So on the high end of the market, which we actually do extremely well, we don't for two reasons. One, they understand architecture value. But many times procurement likes to bring someone in, even just to put pressure on the pricing. This is how many times the dialogue goes in. A firewall vendor goes in and says, you're spending $20 million with me, Mr. Customer. Just, you need to expand. Here's $5 million more. And for $2 million, I'll give you what ZSkill has for free. And they're probably paying us $5 million in that account. And we are able to go in and say, oh, you're spending $20 million on firewalls, which is becoming like mainframes. The future is not firewalls. So what if I bring that number down from 20 to 10 in 15 months or 12 months, and rather than $5 million, you give me $8 million? When the customer sees them out, it becomes a no-brainer. I had seen many of these pricing pressure calls have come from time to time. Say, oh, Zscaler, my budget is down 15%. I'm asking every vendor to bring the price down by 15%. That call happens to CIO from time to time. Generally, less pressure on security, but many times they come, I can say, Mr. CIO or Ms. CIO, why do you only want to reduce 15%? Why don't I help you reduce actually $5 million or $10 million? You say, really, how? Here are the things we can take out. When that discussion happens, CIO is not worried about saving $500,000. He wants to save $5 to $10 million. And we're able to open new areas and new opportunities in there. So overall, there's not a meaningful change in pricing pressure. Got it. I understand.

Can you talk about new customers versus upsell to existing customers? What are the dynamics of gaining new customers versus the other part?

So our customers are overall very happy customers, very loyal customers. So upsell is a lot easier. In fact, quite a few times, the call comes in, a customer, a CIO, a CISO moves from company A to B. They call us and say, hey, I want to bring CISCRA in. So, in fact, it's probably one of the most effective lead sources for us. We got hundreds of customers who have gone from company A to B to C. And early on Monday, I got an email from a CISO who just joined a Fortune 10 company. And he was in a Fortune 25 company. Before, another one, he bought us a company on, company two. And this company three, he wanted to connect. And he said, hey, I don't even have to do much work. Zscaler is already deployed here, but I can probably expand it. So expansion is obviously easier when you're a good customer base. New logos do take more effort. There have been discussion inside the company over the past few years. Do we give more attractive comp plan for new versus old? And part of the discussion was, do I want people to too much focus on new at the cost of upsell? If you are a company with a small portfolio of products, you must get new logos to grow. If your platform keeps on growing, you have two ways to grow, upsell and new. We have both of those opportunities for us. If you think about the total customers, about over 45% of Fortune 500, and if you go to the bigger enterprise level, from 2,000 up, 2,000 is a threshold for enterprises, and about 20,000 enterprises, and about 4,500 of customers, that's about 23%. This is a sizable market to go after new. So one of the things we're changing going forward this year is, as we add new salespeople, when company is growing, you need to add salespeople. So we are more being added between 2,000 to 10,000 space, which is largely new logos because our penetration is limited. So we're adding new reps for new logo focus. We are making sales comp plan more attractive for new logos. and we're also going to be more targeted with VARs because at that end of the market, you do need to work with VARs to have proper coverage.

I asked you about competition and I forgot to ask you about Microsoft. So I want to go back to it and see, do you feel the pressure from Microsoft? I mean, they have very disruptive pricing, but product quality is not the same. So how do you see Microsoft in the market?

So over the years, Microsoft has been a great partner. We were the one who helped Office 365, local breakout, big time. That's when we got the highest level relationship with Microsoft. We're integrated with Endpoint, EDR, Identity, Microsoft Sentinel. And about three and a half years ago, they launched a competitive product. And I was kidding, not kidding, really telling Microsoft, you guys even stole my name. It became Internet Access or Private Access. At that time, as I talked to Satya, Scott, Guthrie, And they basically said, look, you've got a 15-year lead over us. We need to offer the product. But to work with my sales team, my sales team's quota is $100 million. Security in a given customer will be $5 million. They're not focused on security. If your product is good, a customer likes it, they'll be fine. So three and a half years later, I don't even recall last time, I had to say, man, we're competing with Microsoft. Now, my data points are more on the higher end of the market because that's where I spend more time. But it is not a meaningful factor.

So working on the portfolio is one challenge, and you've done great. You have a very articulate product strategy. The second part of the battle is working on go-to-market. So talk about the efforts on go-to-market, the success stories, the challenges. Kind of give us the whole picture of how you evolve your sales organization to address the new opportunities.

So about two and a half years ago, we made the decision that we need to move from opportunity-centric sales thing to account-centric stuff. We brought Mike, Rich CRO. He has done a great job in making changes. We made big changes at that time. We wanted leadership and salespeople who knew how to deal with large accounts, borrowing from the service no model, which was successfully done. So over the past two years, we have actually successfully made all the changes. I mean, if you look at the numbers we have delivered over the past two years, they're pretty impressive. Now, they slowed the absolute growth in net new ARRs, slowed down in 24. It picked up in 25. In 26, you saw the numbers. Net new ARR growth has gone up, going from 24 in the 0, 1% range to 7%. The first half of 26% was about 10%. The last quarter was about 14%. It's been pretty good now. We want to do better. I mean, I'm an ambitious person. I mean, I have big aspirations. So really need to keep on moving in that direction. We did have a little setback with a couple of sales changes. That we are factoring the guidance. But the market is good. Essentially, as we pass through the transition of a couple of sales theaters and changes, Everything is pretty well aligned. GSIs, we made a lot of good progress. They're working, doing some very good deals with us.

What are your challenges? I want to ask you other questions, but before that, I want to understand where do you put your focus? Meaning, what are the things that you think you need to address for the next two to three years, five years?

In general, I have only two focus areas. Yeah. Build amazing products, sell and support customers. OK. Now, in that context, if you look, I think we got the building product and platform. We got it pretty well under control. We have done very targeted tokens acquisition, which actually had had some differentiation to a platform. The symmetry acquisition was especially very, very good. On the go-to market side, I think the number one thing I wonder about fixing is the FUD being created by non-zero-task companies to confuse the market. I know why they're doing it, because they need to protect themselves. But in some ways, it's kind of doing disservice to enterprises who believe that this is real security when it's not. So that's one initiative. We have a CMO who is very good now. We got a number of initiatives in marketing to create brand and awareness. That's number one. Number two, I think related to market somehow has discounted the role we are playing in AI security. And if you really think about that, the biggest thing to be done in AI security, among all these things, is securing agent-to-agent communication. Nobody's better positioned for that. A number of other areas, can you give me visibility into their products? Of course, everyone will do it. It will become like Hatsby kind of stuff. Can you do red teaming? Everyone will do red teaming about it. And we have it in our portfolio. We have to have it. But the hardest problem to solve is communication of agents. And that's what we built. We'll be launching it next week. And I wonder about why has market discounted us for AI? i know the one thing that comes to mind is you know this mythos thing while we have been part of the glass wing project from day one just that when the press release came out at short notice uh our name was missing so we had to go hey i mean well they did it on their own time in a short window we missed out and then the following week or so we're able to go to them get approval to go out there but we missed the window and can somehow the real investors and market felt that only two companies that are listed there aren't actually AI ahead in the market. I think coming quarters will prove that we'll generate some real real numbers in AI security to convince investors that we are the real game. Got it.

Most companies in the space are offering some kind of flex programs and you have your Z-Flex. Right. Talk about the importance of it to the customer, to you, and then what's the take rate of Z-Flex?

Z-Flex has exceeded all of our expectations. It's probably four quarters or less than four quarters, about four quarters.

Maybe we start with what is it? For those that don't know, what is the issue?

What's a Flex program? As name implies, Z-Flex. It gives you flexibility to buy certain products and being able to even swap certain products. Otherwise, the customer says, basically, you've got these eight data security products. I'm not sure if I want A or B or C. I'm going to test and test and test. It could take many quarters. Now we're able to say, look, you can select X products, and we'll give you the ability to swap. And swap is linked to similar price ranges, so to speak. So they can swap. That's number one. Number two, they said, I want six products, but I'm not ready to roll out all things. It'll take me time. So I want to be able to do these four and then do two. So we gave you staggered the ramp product. We had done ramps before. It just formalizes ramps after I need it. And number three, if I want to buy a new product, there's a rate card already available. So this thing removes the procurement cycles back and forth. All that stuff makes it easy. Now, our program is fairly conservative. We basically are recognizing the revenue for the next 12 months or ARR for the next 12 months. So it's, but it's worked very well. We just got past a billion dollar in the Z-Flex booking, which is good. It's good for customers. It's good for us. And the deal size length has gone up. Most of the Z-Flex deals are five-year deals.

Is there a risk, and I've seen it with CrowdStrike before, Or is there a risk that Z-Flex makes it very easy for customers to try and test and systems, etc.? And upon renewal, though, you'll see a slowdown. Meaning companies are trying it, companies are testing it, but maybe renewal rate won't be as strong. Like, what's the risk that what we're seeing today, some of the growth we're seeing today, is really customers trying.

So, first of all, Z-Flex is a headwind for ARR recognition. Okay, because some of that is staggering. Number two, our focus as a company has been to make sure the products that are sold are deployed. I get a personal review on a monthly basis to look for deployed versus undeployed products. Many of the compensation of product leaders are linked to deployment. Our customer support team, the deployment team link to it. So I think companies should be careful, but we are already very focused on making sure products we sell get deployed.

We officially ran out of time, and I didn't leave enough time for questions. But thank you very much, Jay. It has been great, and I'm always happy to host you at our conference.

I think if I leave the last word for you, METOS will probably drive zero trust need faster than anything else that's driven out there. And we have the right products, and we intend to do the right execution. Absolutely. Thank you.