Zscaler’s product has done exceptionally well considering the crowded cybersecurity market. This is due to its best-of-breed, singular focus on security edge and zero trust. Primarily, Zero Trust architecture began to replace VPNs in a meaningful way in 2020 and this has sustained due to the Zero Trust model offering deeper and more scalable protection by eliminating implicit trust.
Zero Trust Security is built on the premise that no one should be trusted within or outside the network. In the traditional security systems, it is difficult to obtain access from outside the network while those located inside the network were trusted. With Zero Trust, these trust assumptions are removed with tools such as multi-factor authentication, giving access for a limited time and to also verify, authorize and to have a continuous check on all the data points that are given access.
Zscaler released its third-quarter fiscal year 2022 results on May 26th with revenue accelerating 63% year-over-year to $286.8 million, which beat consensus by 5.6%. The company also raised full-year revenue guidance by 2.9%. The stock rose 13% the following day from the results.
On the bottom line, Zscaler has a 15% free cash flow margin with a goal to increase this to 20% FCF margin this year. The company saw an increase in adjusted operating income and adjusted net income yet is reporting slightly higher losses on a GAAP basis from (25%) to (30%) due to stock-based compensation.
Cybersecurity Spend is Increasing in 2022
We will copy a few points from our upcoming Forbes analysis on Cybsersecurity stocks here for easy reference. Note: we covered these points in our Q2 2022 analysis. For the full article, please check the forum on Friday.our Q2 2022 analysis. For the full article, please check the forum on Friday.
Enterprise spending is expected to increase in 2022 from the previous year, according to Chief Information Security Officer (CISO) surveys. Considering the level of cloud spending in both 2020 and 2021, an increase on already high budgets is impressive. The CISO survey states that 44% increase budgets to increase in 2022 compared to 41% in 2021 and only 2% expect a decrease compared to 6% the previous year.
In a similar study from PricewatershouseCooper, 69% predict a rise in cyber spending for 2022 and 26% expect a surge of 10% or higher spending year-over-year. This survey was done across a broader C-suite and executive sampling.
According to a Gartner survey, 88% of the Board of Directors viewed cybersecurity as a business risk. According to Paul Proctor, VP at Gartner, “The influx of ransomware and supply chain attacks seen throughout 2021, many of which targeted operation- and mission-critical environments, should be a wake-up call that security is a business issue, and not just another problem for IT to solve.”
According to Global Market Insights, the cybersecurity market is expected to reach $400 billion by 2027 from $170 billion in 2020, representing a compound annual growth rate (CAGR) of 15% during this period.
Although that’s a small CAGR, many best-of-breed companies are only reporting around $1 billion in annual revenue right now, therefore, the size of pie is quite substantial for those that outperform competitors.
According to Gartner’s CIO survey concluded in 2021, cyber and information security is the top priority of planned investments by companies for 2022. Monika Sinha, VP at Gartner, said, “There is a continued need to invest in cybersecurity as the environment becomes more challenging. A high level of composability would help an enterprise recover faster and potentially even minimize the effects of a cybersecurity incident.”
Zscaler’s Product Leadership
Zscaler has been successful in capturing the cybersecurity growth trend with evidence the growth can sustain post-Covid. This is key as Covid was a major catalyst as Zero Trust began to replace VPNs. Although employees are returning to the office, the hybrid nature of work will persist, which means companies will face challenges in protecting their network since most of the information is stored in the cloud and the applications are SaaS-based.
Companies have realized that VPNs and firewalls are no longer safe, and the majority of them are adopting Zero Trust Security. The main reason is allowing remote workers to access through a VPN makes it easier for attackers to gain access through the internet to the company’s networks and gain access to data points. This can be efficiently tackled only by Zero Trust Security which is built on the premise that no one should be trusted within or outside the network.
The company has a large serviceable market of $72 billion. The company is benefiting from the shift from traditional cybersecurity solutions to cloud-based Zero Architecture. The Internet of Things and remote working has further increased the long-term opportunity for the company.
Source: Company PresentationCompany Presentation
Zero Trust Product Leadership
Zscaler primarily protects cloud workloads by controlling access through implementing policy-based access and interconnects for a company’s data centers, cloud infrastructure, software and third-party services. Zscaler is cloud native and its growth is related to growth in cloud migrations. SASE and zero-trust became especially important during the hybrid work-from-home rush that occurred during Covid.
The company offers the following products, Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX), and Zscaler Cloud Protection (ZCP). The company offers the flexibility for its customers to purchase products separately, which allows for flexibility in pricing.
ZIA is a security stack that offers reliable access to the internet and apps regardless of their location. ZIA is suited for connecting to external apps like Zoom or Office 365. Since it goes to third-party applications and the public internet, all the traffic is inspected so that no malware attacks occur and the data is secure.
ZPA provides secure access to internal applications that are hosted in data centers or in private/public clouds. ZPA offers secure private app access to its users across all locations with the company’s Zero Trust Network Access (ZTNA) platform. The main advantage is that the apps are not exposed to the internet, limiting external cyber-attacks.
Traditional network performance analysis tools have become obsolete due to the applications moving to the cloud and users being in various locations. Previously, enterprises used to own the network and the applications used to run in their own data centers to identify any issues efficiently. ZDX solves this problem in the modern cloud environment since it helps companies know exactly where the issues lie and how many users are affected.
The company is a leader in the Zero Trust Platform, particularly in the Security Service Edge in the Gartner Magic Quadrant which can be seen in the graph below. The company’s demand for products remains strong, evident from the large multi-year contracts signed by the company. In the recent earnings call, the management mentioned they witnessed solid growth in $1 million annual contract value deals broadly across business verticals and geographies. The remaining performance obligation (RPO) grew by 83% YoY to $2.21 billion, indicating future revenue for the company.
Source: Company PresentationCompany Presentation
Zscaler has a strong base of growing enterprise customers. The company also has been able to increase the number of Global 2000 customers. In the last two quarters alone, the company added 80 Global 2000 customers. It currently has 30% of the Global 2000 companies and 40% of Fortune 500 companies as its customers.
The company has been able to upsell its products which is evident with the company maintaining the dollar-based net retention rate of over 125% for the sixth consecutive quarter. The company had 288 customers in the recent quarter with annual recurring revenue (ARR) of over $1 million, up 77% YoY.
How is Zscaler Different?
Zscaler management is often asked how the company is different from its competitors. The main thing Zscaler accomplishes when competing against more legacy virtual private network (VPN) offerings is they are able to replace global load balancers, DDoS protection, external firewalls, intrusion prevention system (IPS) and also VPNs. Hackers use numerous attack vectors and Zero Trust is a solid replacement for VPN systems because it aggregates the appliances while broadening the protection.
One way that Zscaler offers enhanced protection for the attack surface is that nothing sits between Zscaler Private Access and the applications and workloads. Rather than build a VPN replacement, the company has extended ZPA to include browser isolation, app protection, interior deception and EIM based policy. This equates to Zscaler offering the widest and deepest coverage.
Secondly, attackers have a hard time finding where to attack with Zscaler’s Zero Trust architecture because the products act like a shield with the applications hiding behind Zscaler. The company’s proxy architecture scales rapidly as applications and workloads scale rapid. The CEO has said “[Zscaler] scales like nothing else out there.”
Regarding CDNs such as Cloudflare entering the market, Zscaler’s response in the earnings call is that it will take a long time for a CDN and DDoS provider that is focused on servers to catch up to the best-of-breed, singular focus Zscaler has. “We start focusing on users to start with. It takes a lot of time and experience to build our richness and breadth of functionality we have built with ZIA, ZPA and associated functionality. I think it will take a long, long time for someone to try to catch us. And we are setting. We are innovating at a very fast pace.”
With that said, certainly Cloudflare aggregates many products under its umbrella and does well on Zero Trust against more VPN-related solutions.
Notably, Zscaler is moving into machine learning-based cybersecurity. Zscaler processes more than 240 billion transactions per day and the company’s AI/ML models can block many types of known threats in real-time before the endpoint delivery. They are also designed to identify unknown phishing webpages before they appear in the end user’s browser. This proactive approach was not possible with traditional cyber security solution providers.
Financials
The company continued to deliver strong revenue growth. Revenue accelerated by 63% YoY to $286.8 million in the recent quarter. This is the seventh consecutive quarter of above 50% growth. The growth was led by strong adoption of the company’s Zero Trust Platform, as discussed above. The management expects revenue to grow 55% at the mid-point of the guidance in the Q4 FY2022 ending July.
Source: YCharts
The company’s key metrics are growing, indicating that growth is expected to continue. The remaining performance obligation grew by 83% YoY to $2.21 billion. The company’s billings grew by 54% YoY to $346 million.
The company reported GAAP operating margin of -30% compared to -25% in Q3 FY2021. The rise in operating expenses is partly due to the return of travel expenses which was absent during the Covid lockdowns. The company’s adjusted operating margin was 9% compared to 13% in the same period last year. The difference in GAAP and non-GAAP operating margins is primarily due to the stock-based compensation. The management mentioned in the earnings call that it should come down as a percentage of total revenue over a period of time. Recently, the market has been concerned about companies using high stock-based compensation, so this is a risk to watch in the coming quarters.
The company reported a net loss of $101.4 million compared to a net loss of $58.5 million in Q3 FY2021. The adjusted net income was $24.7 million compared to $21.4 million in the same period last year.
The company has strong cash flow. In the recent quarter, the free cash flow margin was 15%, and the management expects it to be 20% for the full year.
Conclusion
The strong revenue growth has given the company a premium valuation. The stock is currently trading at a P/S ratio of 22 with year ending in July and forward one-year P/S ratio of 15. The company is not without GAAP losses yet adjusted operating margin and cash flow margin helps offset profitability concerns.
We had discussed cybersecurity being strong this quarter going into Q2 2022 with our Quarterly Webinar presentation and the current earnings season supports this prediction. Primarily, the cybersecurity sector is insulated from supply issues (which we do expect to ease eventually) and also is a #1 must-have in budgets, per the many CISO and C-suite surveys published by multiple third-party consultants.
Undoubtedly, cybersecurity was the strongest category in tech this past earnings season and Zscaler was one of handful that put up a strong report.