Zscaler

Zscaler reported fourth-quarter earnings that included sales of $898 million, up 25%, and adjusted operating margins of 24%, up 200 basis points. The firm's annual recurring revenue, or ARR, grew 25% to $3.8 billion.

Why it matters: Similar to its cyber peers, Zscaler is benefiting from a healthy cyber demand environment. Artificial intelligence models' increasingly impressive cyber offense capabilities are expanding cyber defense budgets as enterprises improve their security infrastructures. We like the firm's focus on focusing on security solutions that benefit from this secular tailwind, with AI security solutions' bookings growing more than 50% this quarter. Also, 70% of these AI security wins also included data security modules, highlighting Zscaler's growing platform.

The bottom line: We maintain our $250 per share fair value estimate for narrow-moat Zscaler, and with shares trading mostly flat after hours, we continue to view shares as undervalued. We think investors are still overly pessimistic about Zscaler's top-line growth prospects in the face of increased competition from larger vendors. In our view, the security market is large enough to accommodate multiple winners, with Zscaler one of them.

Coming up: We see its 2027 17% sales outlook as conservative, considering the AI tailwind behind its business, improving sales productivity, and cross-selling success. Beyond 2027, we think growth will stay strong into 2028 as AI security becomes a larger part of the mix.

Bears say: Zscaler's platform is still limited in breadth when comparing it with CrowdStrike and Palo Alto. This lack of breadth is a disadvantage during a period when customers are trying to consolidate security spending on fewer vendors. In our view, the firm is actively trying to move beyond network, with the Z-Flex model that allows customers to sign up for minimum commitments and try out different modules a key part of expanding its product portfolio beyond network security.

Our fair value estimate for Zscaler is $250 per share, implying a 2027 enterprise value/sales multiple of 10 times.

We forecast Zscaler’s revenue growing at a 16% compound annual growth rate over the next five years. As enterprises increasingly shift network traffic routing directly to cloud applications, we see massive greenfield opportunities for the firm to take advantage of and grow its business. Additionally, we think Zscaler’s “land-and-expand” model will continue to bear fruit. The firm has shown great success in upselling its existing customers by either offering additional modules within a platform or cross-selling its Zscaler Private Access after initially landing with its Zscaler Internet Access offering. Going forward, we project continued up/cross-selling activity for the firm.

Zscaler’s gross margins have hovered in the mid- to high-70s range since its IPO. However, as the company grows and software becomes a larger part of its top line, we expect margin expansion on the gross margin front. We see this phenomenon across our coverage as software firms can distribute their costs over an increasing revenue base, driving the cost of sales down as a fraction of sales. As a result, we are modeling GAAP gross margins to get to 80% over our 10-year explicit forecast.

Zscaler has spent heavily on research and sales in the past. However, as the company scales, we expect these line items to decrease as a percentage of sales. While we expect fiscal 2028 to be the first year of GAAP profitability for the firm, we forecast strong margin expansion in the years ahead as the firm scales. In particular, we believe there is plenty of room for Zscaler to drive its sales spending down as a percentage of revenue.

We assign Zscaler a narrow Morningstar Economic Moat Rating owing primarily to strong switching costs and secondarily to a network effort associated with its offerings. We believe Zscaler’s industry-leading zero-trust security solutions will continue to see robust enterprise adoption, allowing the firm to both retain and expand its footprint within existing organizations, while also allowing the company to land new customers. As a result, we forecast Zscaler to generate excess returns over invested capital over the next decade.

As we look at the broader cybersecurity space, we believe the complexity and intensity of threats are ever-increasing. Enterprises continue to adopt SaaS solutions, undergo digital transformations, and migrate to the cloud, all while employees continue to work remotely part-time. In turn, we see the number of attack vectors (or entry points for nefarious players) rapidly growing. Similarly, the intensity of digital threats is also on the rise, with higher costs of a data breach, including punitive fines, for any customer data theft.

These trends have rendered the traditional castle-and-moat version of enterprise cybersecurity obsolete. Traditionally, firewalls have stood guard outside corporate networks, inspecting traffic entering and exiting the network. However, with enterprises increasingly using cloud-based solutions (whether it be SaaS applications like Salesforce or public cloud vendors like AWS), the need for hardware firewalls to inspect network traffic is significantly reduced. Instead, enterprises have increasingly shifted to cloud-based solutions that provide a robust way to secure network activity stemming from and traveling within the cloud. In this shifting landscape, Zscaler’s zero-trust infrastructure allows enterprises to not only maintain a robust security posture but also eliminate areas of excessive IT spend by reducing reliance on costly hardware appliances. While the need for hardware firewalls still remains, we think that the market buying activity has heavily tilted toward cloud-based solutions such as Zscaler. We believe that the shift away from hardware firewalls is part of a broader convergence of networking and security (with Zscaler’s products materially benefiting from it).

Zscaler’s solutions can be broadly partitioned into two key areas: Zscaler Internet Access, or ZIA, which provides secure access to external applications (SaaS apps like Salesforce, Office 365, and so on), and Zscaler Private Access, or ZPA, which provides secure access to internally managed applications (which could include internal APIs, databases, and so on). Within each vertical, Zscaler provides a slew of modules ranging from sandboxes to application protection and browser isolation. By remaining agnostic to network, location, or device, Zscaler’s solutions can help enterprises create policies that secure access to both internal and external applications while being able to enact changes to these policies instantly at a companywide scale.

We often see high switching costs for enterprise-focused cybersecurity vendors that often have an expansive footprint across an enterprise. To uproot such a vendor requires not only a competitive offering from another vendor, but often retraining staff to use the new set of security solutions, and a period of increased vulnerability. Additionally, we believe security-related IT decisions are driven by security analysts and engineers who focus on performance, rather than price, so enterprises are unlikely to rip out cybersecurity solutions as a source of potential cost savings. Zscaler’s stickiness is evidenced by the firm’s high-90% gross retention rate and a solid net retention rate above 110%. Both metrics highlight the fact that existing customers not only keep on using Zscaler’s solutions but also spend more on the company with the passage of time.

Along with high switching costs, we believe a network effect reinforces Zscaler's economic moat. Cybersecurity, in its essence, is a data problem, and attacks are now too overwhelming to be handled manually. In turn, vendors have developed AI solutions to automate processes and pick up threats (especially never-seen-before, zero-day attacks). However, artificial intelligence and ML solutions are only as good as the data that is fed to them. This need for good-quality data is where we see vendors such as Zscaler having an edge, as they have data streaming into their security solutions from across the enterprise. For some context, Zscaler’s security solutions monitor more than 250 billion requests each day, allowing the firm to monitor activity at a scale very few cybersecurity firms can.

By collecting and analyzing this rich data coming into its platforms, a vendor such as Zscaler can uncover threats and new threat signatures that can then be used to update its entire client base’s security posture. As more data comes in, Zscaler’s platforms become better at detecting and mitigating cyber threats. As a result, more customers opt for Zscaler’s solutions due to superior products, which, in turn, leads to more data, and the flywheel spins faster. We see this network effect as reinforcing switching costs as well, with customers hesitant to leave Zscaler as it may entail losing this shared threat-detection and response capability.

Zscaler has strong secular tailwinds behind its back as the convergence of networking and the security market is in its early innings.

Zscaler has market leadership and high enterprise penetration through its offerings related to secure web gateways and zero-trust network access.

Consolidation of security vendors should benefit Zscaler, which has a wide array of solutions across an enterprise’s network security stack.

Large public cloud vendors often offer their own cybersecurity solutions, which could hamper Zscaler’s growth opportunities.

Zscaler faces competition from vendors like Palo Alto and Fortinet that have increasingly invested in the key areas where Zscaler holds a market-leading position.

There always remains a risk that Zscaler may miss out on the next big technology, thereby allowing its competitors to catch up.