ZScaler (ZS) — Earnings Review – December 1, 2023
Zscaler is a next-generation, predominantly cloud-based network security company. It competes with firms like Palo Alto Networks and Cloudflare.
Demand
Zscaler beat revenue estimates by a comfortable 4.9% and beat its own guidance by 5.0%. Its 51.6% 3-year revenue compounded annual growth rate (CAGR) compares to 53.5% as of last quarter and 55.9% 2 quarters ago.
Billings were roughly in line with consensus, but about 2.4% below the buy side hedge fund surveys that I had access to.
Source: Brad Freeman – SEC Filings, Company Presentations, and Company Press Releases
Source: Brad Freeman – SEC Filings, Company Presentations, and Company Press Releases
Margins
- Beat EBIT estimates by 25.6% & beat its EBIT guidance by 26.3%.
- Beat $0.49 earnings per share (EPS) estimates by $0.18 & beat its same EPS guidance by $0.18 as well.
- Beat free cash flow (FCF) estimates by 68.0%.
- GAAP & non-GAAP gross profit margins (GPMs) were both comfortably ahead of consensus estimates.
Source: Brad Freeman – SEC Filings, Company Presentations, and Company Press Releases
Source: Brad Freeman – SEC Filings, Company Presentations, and Company Press Releases
Balance Sheet
- $2.32 billion in cash & equivalents.
- $1.1 billion in convertible senior notes. No traditional debt.
- Share count rose by 2.9% Y/Y.
Fiscal Year 2024 Guidance
- Raised revenue guidance by 1.8% which beat estimates by 1.6%.
- Reiterated billings guidance which missed estimates by 0.5%-1% depending on which data source we use.
- Raised EBIT guidance by 8.2% which beat estimates by 7.6%.
- Raised $2.23 EPS guidance by $0.23 which beat estimates by $0.22.
- Reiterated low 20% FCF margin for the full year.
Next quarter guidance was similarly ahead of expectations across the board. It does not guide to billings on a quarterly basis.
Call & Release Highlights
Zscaler & Zero Trust 101
ZScaler’s Zero Trust Exchange is its latest and greatest cloud security platform. It blazes a trail between users (remote and in-office), apps and devices across eligible networks. Zero Trust is exactly what it sounds like: never trusting a device or end user. The exchange constantly vets and verifies all endpoints and users as they move within a company’s perimeter. It does not allow bad actors to breach a vulnerable infrastructure or freely move about it thereafter without any subsequent verification. ZScaler assigns risk scores for requests to assess needed levels of verification.
This approach replaces an antiquated network security philosophy that every device and user within a perimeter automatically getting unconditional access. So? Zero Trust is safer AND allows remote workforces to responsibly work from anywhere. Zero Trust is rapidly replacing firewalls and virtual private networks (VPNs) to reduce security risk and enhance productivity. As all strong software platform plays do, Zscaler’s Zero Trust infrastructure also cuts costs by diminishing the need for on-premise security apps and through vendor consolidation.
I know readers are most familiar with endpoint security and CrowdStrike based on what I’ve most closely covered. While Zscaler and CrowdStrike do compete in some areas, they partner more frequently and even offer joint products.
More Sector Definitions
- Secure Access Service Edge (SASE) provides access to software for users regardless of where they’re working.
- Virtual Private Cloud (VPC): These are subsections of public cloud environments. They offer users more autonomy with their network and apps. They also allow for secure connections between cloud and self-hosted (on-premise) environments with no public network exposure. This is especially key for highly regulated industries.
- Virtual Desktop Infrastructure (VDI): Allows software to be accessed on remote devices. Zscaler’s Zero Trust Exchange ensures this is done safely and securely.
- Firewall is a legacy form of network security that uses a fixed set of rules to authorize outbound and inbound traffic.
Zscaler Product Definitions (which exist under the Zero Trust Exchange Platform)
- Zscaler Internet Access (ZIA) protects internet connections. It’s the middleman between a user and a network which ensures proper authorization & access.
- Zscaler Private Access (ZPA) offers remote access to internal apps. This is an upgraded VPN by “connecting directly to the required resources without public exposure” per Zscaler filings.
- Zscaler Digital Experience (ZDX) ensures high quality and always on performance of loud apps. It sifts through networks to identify sources holding back performance to be remediated.
- Risk360 flags vulnerabilities and offers end-to-end risk quantification with intuitive next steps for remediation.
- Risk360 has already closed more than 10 deals.
- Breach Predictor is a newer Zscaler product. It uses GenAI models to “anticipate potential breach scenarios.” It eliminates those scenarios before they even surface.
Strong Demand
Zscaler enjoyed a record quarter for $1 million+ customers. Its pipeline reached new records and its net revenue retention rate remained at a strong 120%. As a clear sign of the platform and vendor consolidation approach working, roughly 50% of its new client wins purchased ZIA, ZPA and ZDX. Similarly to CrowdStrike this week, outperformance despite no improvement in macro. The firm continues to overcome elevated deal scrutiny and sales cycle elongation. Importantly, while those headwinds aren’t abating, they are also not getting worse. Whether it’s due to growing attack instances, new SEC disclosure requirements, the Biden Administrations Zero Trust executive order, or a combination, demand remains resilient.
Inbound requests to replace firewall-based SASE continue to briskly rise as Zero Trust is increasingly known as the superior option.
Deal Highlights
- Leading software firms shifted to Zero Trust Exchange after firewall-based SASE failed miserably and expanded the attack surface too widely. Zero Trust shrunk the attack surface by blazing a more direct and secure connection between apps and networks. The client went with ZIA, ZPA and ZDX.
- Expanded with a Fortune 500 travel and hospitality service provider, which doubled their annual data protection spend.
- Won a Fortune 200 financial service firm. It used ZScaler’s full product suite to safely migrate to the cloud and shed half of its data center requirements. It was able to do this despite operating in one of the most tightly regulated sectors. It expects to enjoy a 500% return on investment.
Scaling
Zscaler is enhancing go-to-market efforts. This move is to cater to strong demand and rising adoption of and interest in its full platform. It hired Mike Rich as its new Chief Revenue Officer and President of Global Sales. Dali Rajic, who had been handling some of these duties, will now be fully focused on his other role as COO. Rich was most recently the President for Americas at ServiceNow. Joyce Kim was named its new Chief Marketing Officer. She previously led marketing teams at Microsoft, Arm and Twilio.
Public Sector
The firm delivered 90% Y/Y growth within the public sector. It now has 12 of the 15 cabinet level agencies as customers. These types of clients usually start small and offer significant expansion opportunities if products work well over time. For example, it expanded ZIA and ZPA deployment from 25,000 users to 100,000 users for one of these agencies while cross-selling ZDX to all 100,000 of these users.
Billings and Free Cash Flow
Total billings fell a bit more sharply than expected Q/Q due to a $20 million “upfront billing on a multi-year deal” last quarter. The billings pull-forward last quarter meant outperforming cash collections this quarter and propped up its free cash flow margin. The firm continues to expect a low 20% FCF margin for the year.
Generative AI
Zscaler is enjoying a 20% average spend uplift with clients opting for its newer GenAI products. 95% of organizations are now using GenAI in some capacity while 48% of them think it’s a threat. This puts Zscaler in an ideal position for future up-selling.
Final Notes
- 1/3 of its customers are using its newer cloud workload protection tool. It added real-time cloud resource discovery as a new tool for this offering.
- Gross margin was helped by extending the useful life of some cloud infrastructure from 4 to 5 years. Google and Meta did the exact same thing. Nothing shady here.
Take
This quarter resembled the strong results from other vendor consolidators and platform plays in software. They’re winning through better efficacy and efficiency with lower cost. That’s what Zscaler provides within the realm of network security. This quarter is simply more evidence. Some will pick at the mere reiteration of billings guidance. If I were a shareholder, as long as it doesn’t become a trend, I’d take that as a sole negative 10/10 times.
