Zscaler (ZS) – Earnings Review – February 29, 2024
Zscaler 101:
Zscaler is a large player in network security. It competes with Palo Alto’s next-gen suite, Cloudflare and many others. ZScaler’s Zero Trust Exchange (ZTE) is its latest and greatest cloud security platform. It blazes a trail between users, apps and devices across eligible networks. It also secures data at rest and in motion.
Zero Trust is exactly what it sounds like: never trusting a device or end user. The exchange vets and verifies all traffic as it moves within a company’s perimeter. It does not allow bad actors to breach the most vulnerable piece of infrastructure and freely move about it thereafter without any subsequent verification. ZScaler uses risk scores to assess needed levels of verification for requests. That makes sure it’s only creating user friction when there’s actual security concern.
This Zero Trust exchange is delivering benefits like a 70% infrastructure cost reduction for Siemens. It does so by shrinking the attack surface down to grant permission one app, one user and one piece of traffic at a time. Permissions are based on client policy. This approach replaces an antiquated network security philosophy in which every device & user within a perimeter gets perpetual and unconditional access. So?
Zero Trust is safer, cheaper AND allows remote employees to responsibly work from anywhere. Zero Trust is rapidly replacing firewalls and virtual private networks (VPNs) for these reasons.
I know readers are most familiar with endpoint security and CrowdStrike based on what I’ve most closely covered. While Zscaler and CrowdStrike do compete in some areas (sort of), they partner more frequently and even offer joint products.
Zscaler Product Definitions:
- Zscaler Internet Access (ZIA) protects internet connections. It’s the middleman between a user and a network that ensures proper authorization & access.
- Zscaler Private Access (ZPA) offers remote access to internal apps. This is an upgraded VPN by “connecting directly to the required resources without public exposure” per Zscaler filings.
- Zscaler Digital Experience (ZDX) ensures the high quality and always-on performance of cloud apps. It sifts through networks to identify sources holding back performance to be remediated.
- Risk360 flags vulnerabilities and offers end-to-end risk quantification with intuitive next steps for remediation.
- Breach Predictor is a newer Zscaler product. It uses GenAI models to “anticipate potential breach scenarios.” It eliminates those scenarios before they even surface.
More Sector Definitions:
- Secure Access Service Edge (SASE) provides access to software for users regardless of where they’re working.
- Virtual Private Cloud (VPC): These are subsections of public cloud environments. They offer users more autonomy with their network and apps. They also allow for secure connections between cloud and self-hosted (on-premise) environments with no public network exposure. This is especially key for highly regulated industries.
- Virtual Desktop Infrastructure (VDI): Allows software to be accessed on remote devices. Zscaler’s Zero Trust Exchange ensures this is done safely and securely.
- Firewall is a legacy form of network security that uses a fixed set of rules to authorize outbound and inbound traffic.
The aforementioned Zero Trust Exchange is the overarching platform layer tying all of this utility together to drive network security vendor consolidation, cost savings & enhanced efficacy.
Demand
- Beat revenue estimates by 3.6% and beat its revenue guidance by 3.8%. Its lofty 49.5% 3-year revenue compounded annual growth rate (CAGR) compares to 51.6% Q/Q & 53.5% 2 quarters ago.
- Beat billings estimates by 2.7%. Some buy-side estimates called for 30% Y/Y billings growth (well ahead of sell-side consensus). It fell short of this expectation as it delivered 27.1% Y/Y growth.
- Dollar based net revenue retention (DBNRR) was 117% vs. 120% Q/Q, 121% 2 quarters ago, and over 125% in the quarters before that.
Source: Brad Freeman – SEC Filings, Company Presentations, and Company Press Releases
Profitability
- Beat EBIT guidance by 41.8% & beat estimates by 42.5%.
- Beat $0.58 EPS estimates & beat beat guide by $0.18 each. It earned $0.76 per share vs. $0.37 Y/Y.
- Beat free cash flow (FCF) estimates by 25%. FCF rose by 60.5% Y/Y.
Source: Brad Freeman – SEC Filings, Company Presentations, and Company Press Releases
Balance Sheet
- $2.4 billion in cash & equivalents.
- $1.1 billion in senior notes.
- Diluted shares rose 2.8% Y/Y.
Guidance & Valuation
- Raised revenue guidance by 1.2%, which beat estimates by 0.7%.
- Raised billings guidance by 0.8%.
- Raised EBIT guidance by 9.7%, which beat estimates by 9.2%.
- Raised its earnings per share (EPS) guidance from $2.23 to $2.75, which beat estimates by $0.27.
- Reiterated a low 20% FCF margin for the fiscal year.
Zscaler’s guide balances a “still challenging macro environment and sales leadership change uncertainty” with broad “business optimism.” This is code for “we set guidance at a level that we think we can easily surpass.”
Some pointed to its guidance of -7% Q/Q billings growth as a red flag for the quarter. It isn’t. Billings always seasonally fall between its fiscal Q2 and Q3. And furthermore, the annual guide was raised.
Zscaler trades for 80x fiscal year 2024 earnings guidance. Earnings are expected to grow by 53.6% Y/Y based on its updated guidance.
Call & Release Highlights
The Zero Trust Exchange Platform & Winning:
Evidence of Zscaler effectively delivering a cohesive, overarching network security platform was on full display this quarter. $1 million+ annual recurring revenue (ARR) customers rose 31% Y/Y while $100,000+ ARR customers rose 21% Y/Y. Its ability to consolidate point solutions in on-premise, private cloud and public cloud network security with overarching (user, infrastructure, traffic and app) security is resonating. This makes a lot of sense considering its point solution displacements routinely deliver a 3x return on investment for clients.
Zscaler set a new record for customers added in a single quarter with 50% of year-to-date bookings coming from brand new clients. It’s not just expanding with existing customers, it’s landing a lot of new logos too. These wins included:
- New 8 figure contract for its overarching Zero Trust Exchange Platform with a large tech firm. This firm wanted to eliminate its legacy firewall infrastructure and turned to Zscaler to do so with a 2x return on investment.
- Two other 7 figure contracts for ZIA, ZPA, ZDX and its data protection product with two customers looking to reduce cost and complexity. Cost and complexity reduction was a common theme across all of its large deals, as was the desire to replace legacy firewalls and VPNs.
- A large cabinet-level agency upsell will double that client’s annual spend. Zscaler still is only used by 15% of its users and devices. Plenty of up-selling left.
- With FedRAMP certification for ZIA and ZPA secured, it’s turning focus to jump-starting efforts for certification abroad. “This will take time.”
It’s not just ZIA, ZPA and ZDX enjoying scaled growth, but newer products too. Zero Trust for Workloads was included in two large contracts this quarter, which led to 2x spend levels in one of the deals. This, as the name indicates, is Zscaler’s Zero Trust program for specific workloads in the cloud. Business Insights was included in a Global 2000 contract. This product gives firms a global view of software and app usage to cut redundant costs. It’s a big piece of its AI cloud tools, along with Risk360 and breach predictor (coming soon).
Go-to-Market Updates:
Zscaler updated its go to market in a few subtle ways. It’s introducing new account designs that are more granularly aligned with customer objectives; it’s also partnering with customers to develop product migration roadmaps with them. Interestingly, it’s adding a lot of industry-specific talent (“Vertical Domain Expertise”) to better-cater to areas like healthcare and the public sector. This program is working well and it’s now expanding to other verticals. Finally, it’s more intentionally and aggressively pursuing system integrator (SI) partnerships to add that compelling channel to its list of demand sources. As a reminder, Mike Rich was brought in as the Chief Revenue Officer last quarter to lead this re-vamped go to market.
Secular Tailwinds, Palo Alto Networks & Macro:
Demand for Zero Trust was called “robust” by CEO Jay Chaudhry, with budgets for this product type set to rise Y/Y. It threw a bit of shade at other competition like Palo Alto and Fortinet as Chaudhry told us “spinning up firewalls and VPNs in the cloud” and calling it Zero Trust-based SASE doesn’t solve anything. Speaking of Palo Alto and Fortinet, this strong quarter, paired with Cloudflare’s strong results, Okta’s great print and Palo Alto’s strong next-gen performance is encouraging for another reason. It gives me all of the evidence needed to be confident in competitive pressure and weak demand cited by Palo Alto coming from its legacy firewall business. The weakness is not coming from Zero Trust, next-gen endpoint or next-gen identity demand.
“We’re operating in a strong demand environment for Zero Trust architecture.” — CEO Jay Chaudhry
Profitability:
Gross margin expansion was due to extending the useful life of some of its cloud infrastructure. This diminished input costs and raised unit economics. This is not shady in any way. Meta, Google, Cloudflare, Amazon and many others have done the same thing. This is Zscaler not wanting to invest in more general compute infrastructure while the accelerated compute movement enters full swing. It wants to extract as much value out of its current general compute as possible rather than spending more here.
Take
I see what the stock is doing after-hours. That does absolutely nothing to change the fact that this was a great quarter. The company is navigating the backdrop far more effectively than Palo Alto, and the boosts to annual guidance are the effect. More rapid compounding paired with more growth opportunities, secular tailwinds, superior products, expanding margins and a pristine balance sheet is always a good recipe. That’s exactly what Zscaler brings to the table. This is a very expensive name and the quarter offered us more signs that it deserves to be. Well done.
