Zscaler: Can the Network It Imagined Become a Profitable Platform?

I. A $3.4 Billion Cloud Security Bet

On September 3, 2026, Zscaler closed the books on its fiscal year and told investors two things that do not usually sit side by side. The first was that a company which, a decade earlier, had been a niche security service with around $80 million of annual sales had just booked about $3.35 billion of revenue, up roughly 25% in a single year.¹[^2] The second was that, after all that growth, all those customers and all that traffic, it had still lost money. The net loss for the year was about $63 million.¹

Neither number on its own is surprising. Software companies grow fast, and software companies lose money. What makes Zscaler interesting is the size of the gap between the two stories it tells at once. In the same year that it reported a loss, the business generated about $1.13 billion of cash from operations.¹ It charged about $842 million of stock-based compensation to its income statement, which is to say that roughly one dollar in every four of revenue was paid to employees in the form of shares rather than cash.¹ And on the afternoon of October 29, 2026, the stock market valued the whole enterprise at about $41.5 billion, or around 12.4 times its annual sales, with the shares trading near $256, roughly a quarter below their high of the past year.[^3]

So which Zscaler is real? The one that throws off a billion dollars of operating cash a year, or the one that has never had a profitable fiscal year in its life? The honest answer is that both are, and the investment case lives in the space between them.

That gap is the thread this story will pull. It is worth stating the questions plainly before going back to the beginning, because they will come back again and again. The first is architectural. Zscaler was built on the claim that the corporate firewall was in the wrong place, and that security should live in a cloud network that follows the user wherever they go. Is that architecture a durable advantage, or was it simply an early insight that every big competitor has now copied? The second is strategic. Zscaler has been buying companies, most recently a managed detection business called Red Canary, to broaden what it sells. Can acquisitions and new products deepen the platform without diluting its economics? The third is the investor's question. At twelve times sales for a business still reporting a loss, how much execution risk is already embedded in the share price, and how much room is left if something goes wrong?

The stakes are easier to see once the corporate structure is clear, because there is no hidden parent here. Zscaler is a standalone Delaware company listed on Nasdaq, consolidating only itself and its wholly owned subsidiaries.¹ There is no conglomerate behind it to absorb a bad year and no private-equity sponsor setting the timetable. Its result depends on three things: how much enterprises are willing to spend on security, whether Zscaler's own products keep winning that spending, and what it costs to build and run the global network that every one of those products depends on. The founder is still in the chair, owns a large stake, and has spent nearly two decades arguing that the industry had the problem upside down.

That argument is where this story begins. Long before there was a $41 billion market value, or a billion dollars of cash flow, or a debate about stock compensation, there was a single, slightly heretical idea: security should follow the user, not the office network. The man who had that idea had already built and sold several security companies. He could have built another one. He chose to build something much harder instead.

Subscribe on LinkedIn

↑ Back to Top

II. Jay Chaudhry's Fourth Company Was the Long Bet

Picture a security entrepreneur in the mid-2000s who has already won the game several times over. He has founded a company, sold it to a famous acquirer, founded another, merged it, and helped build two more that found buyers. He has the money to stop. He has the reputation to raise money for almost anything. And he decides that the next thing he builds will not be another box that sits in a data center and blocks bad traffic.

That was Jay Chaudhry. His path into the business started a long way from Silicon Valley. He earned a bachelor's degree in electronics engineering from IIT BHU in Varanasi, and then went to the University of Cincinnati, where he collected not one graduate degree but three: a master's in computer engineering, a master's in industrial engineering and an MBA in marketing.² He later added an executive program at Harvard Business School.² That combination says something about the man. Plenty of founders are engineers who learn to sell, or salespeople who hire engineers. Chaudhry trained deliberately in both, and his early career reflected it, with engineering, sales and marketing roles at IBM, NCR and Unisys before he started founding companies of his own.²

The first of those companies was SecureIT, which he founded in 1996, just as businesses were connecting to the public internet in earnest. It sold itself as a pure-play internet security service, and in 1998 VeriSign bought it.² Two years from founding to exit is a very short run, and it taught a lesson that would matter later: in security, timing is everything, and the buyer's fear moves faster than the technology. Then came CipherTrust, which Chaudhry ran from 2000 to 2006 and which his company biography describes as the first email security gateway, a box that sat in front of a company's mail servers and screened out spam and malware.² CipherTrust ultimately merged with Secure Computing.² Alongside these, he was involved in CoreHarbor, a managed e-commerce service that went to USi and AT&T, and AirDefense, a wireless security pioneer that Motorola acquired.²

Look at that list closely and a pattern appears. Each company attacked a new surface that the internet had opened up: the web connection, the email gateway, the wireless network. Each was a product designed to plug a specific hole. And each was sold to a larger company that wanted the plug for its own catalogue. That is a perfectly good way to make money in security. It is also a treadmill, because every new attack surface creates a new point product, and every point product eventually gets absorbed into a bigger vendor's suite.

By the time he started Zscaler, Chaudhry wanted off the treadmill. The company was incorporated in Delaware in September 2007 under the name SafeChannel, and it renamed itself Zscaler in August 2008.³ The choice he made was not to find the next hole to plug. It was to argue that the whole idea of plugging holes at the edge of the corporate network was becoming obsolete. Instead of building a better appliance, he would build a security service that ran in the cloud, which the customer never had to install, rack or upgrade.

It is tempting to treat a founder's earlier exits as a proof of genius, and to assume that someone who sold four companies will know how to make a fifth one work. The record does not support that leap. The earlier companies were sold relatively young; none of them had to prove that it could stand alone for two decades as a public company, carry its own infrastructure, and defend a platform against the largest vendors in the industry. Those exits explain Chaudhry's pattern recognition, his comfort selling to big enterprises, and his appetite for a much larger and riskier architectural bet. They say nothing, on their own, about whether Zscaler's current acquisitions will retain their customers or whether its new products will earn their keep. Those questions have to be answered by Zscaler's own numbers.

What the earlier ventures do explain is the shape of the bet. A first-time founder might have built a cloud security product and sold it to an incumbent within a few years, as Chaudhry himself had done before. Instead, Zscaler would spend a decade as a private company building a global network, and it would not reach the public markets until 2018.² That is a long time for a repeat entrepreneur to stay in the game. It suggests a founder who believed he had found something bigger than a feature.

So what did he see? What did Chaudhry notice about the internet and the cloud that the incumbent security companies, the ones selling the firewalls and gateways he had spent his career competing with, were built to resist?

↑ Back to Top

III. The Firewall Was in the Wrong Place

Imagine a large bank in 2007. Its headquarters sits behind a wall of hardware: firewalls, web proxies, intrusion detection systems, all stacked in a data center. Its branch offices, scattered around the country, do not have their own security stack. Instead, every branch sends its internet traffic back along private lines to headquarters, where it is inspected before it is allowed out to the web. Employees working from home log in through a virtual private network that drops them onto the corporate network as if they were sitting at a desk inside the building. The applications they use, from email to payroll, live in the same data center. The castle has a moat, and everything valuable is inside it.

Zscaler's founding argument was that this castle was about to empty out. Its IPO prospectus later described the problem with unusual clarity. In the old model, a company protected its network with a perimeter of security appliances, and traffic from branches and remote users was hauled back through a small number of central gateways, which made the network costly, complex and slow for cloud applications.³ Worse, the VPN that let remote employees in was itself a point of vulnerability, because once a single compromised user was inside, the whole network could be exposed.³ The castle was not just inconvenient. It was dangerous.

The reasoning ran like this. If applications move to the cloud, to Salesforce, to Microsoft's online services, to thousands of software-as-a-service tools, then the corporate data center stops being where the work happens. If employees work from laptops and phones in airports and kitchens, they stop sitting behind the firewall. And if neither the users nor the applications are inside the castle, then guarding its walls makes less and less sense. The internet itself becomes the corporate network, and the internet is what needs securing.

A simple analogy helps. The old model was like a city that checked every visitor's papers at the city gate, then let them wander freely once inside. Zscaler proposed abolishing the gate entirely and instead posting a checkpoint at every door, wherever that door happened to be. A user in Mumbai or Minneapolis would connect not to the corporate network, but to the nearest Zscaler data center. There, Zscaler would inspect the traffic, apply the company's policies, and then connect the user directly and only to the specific application they were allowed to reach. The user would never be put "on the network" at all. That last point, connecting users to applications rather than to networks, is the core of what the industry later called zero trust.

The comparison that cloud founders of that era reached for was Salesforce, which had shown that large enterprises would run something as important as their customer records as a cloud service rather than as software they installed themselves. Chaudhry's wager was that security could follow the same path. It was a bolder claim than it sounds. Customer records are sensitive, but security is the control point for everything else. Asking a bank's chief information security officer to send every byte of employee traffic through an outside company's data centers was asking for a level of trust that many of them were not ready to give. Early skepticism was the rational response, not a failure of imagination.

That skepticism shaped the build. A cloud security service cannot be sold as a pilot in one office and then scaled later, because its whole value depends on being close to users everywhere. Zscaler had to construct the network before it could fully prove the demand. By the time of its IPO prospectus, the platform ran across more than 100 data centers around the world, and the company said it blocked more than 100 million threats a day.³ It had also grown to more than 2,800 customers, including more than 200 of the Forbes Global 2000.³ Those are the numbers of a company that had persuaded large enterprises to trust it, but they took ten years to accumulate.

The cost of that patience shows up in the record. The prospectus stated flatly that Zscaler had incurred net losses in every period since its inception.³ In fiscal 2017, the year before it listed, revenue was about $126 million, and the net loss was about $35 million.³ For a business founded on the idea that the market was about to shift, a decade to reach nine figures of revenue is a sobering reminder that being right about the direction of technology does not dictate the speed at which customers follow. Enterprises have budgets, existing contracts, sunk investments in appliances, and security teams whose careers were built on running them. The architecture was coherent. It could not force anyone to change.

What eventually helped was the world moving in Zscaler's direction. The rise of cloud applications through the 2010s, and then the sudden shift to remote work, made the castle's emptiness obvious to everyone. But that, too, is worth stating carefully. Zscaler did not create those shifts; it positioned itself to benefit from them, and it had to keep winning against incumbents who were also adapting.

So the founding question resolves into a narrower and more interesting one. Zscaler was not simply early to a difficult market, and it was not simply proven right. It was early to a real change that arrived more slowly than its founding thesis implied. The test that mattered was commercial: if the architecture was better, could Zscaler persuade cautious enterprises to buy it, deploy it and, most importantly, renew it? The answer to that question was about to be published every ninety days.

↑ Back to Top

IV. The IPO Made the Bet Public

On March 16, 2018, Zscaler became a public company on Nasdaq.² For a decade, Chaudhry's thesis had been answerable mainly to customers, employees and private investors. Now it was answerable to a quarterly scoreboard, an analyst community and a share price that would react to every wobble in growth.

The IPO is the hinge of the story, because it changed the question. Before the listing, the open issue was whether the cloud model could attract enterprise customers at all. After it, that was largely settled, at least for the companies that were already buying. The new question was harder: could Zscaler sustain rapid growth while simultaneously building out global infrastructure and hiring an enormous sales force to sell into the largest organizations in the world? Every quarter would test both halves of that equation.

For the first few years, the answer looked like an emphatic yes. Revenue rose from about $190 million in fiscal 2018 to about $673 million in fiscal 2021, and then crossed $1 billion in fiscal 2022, reaching about $1.09 billion.[^6]¹ Growth rates were remarkable for a company of that size: roughly 59% in fiscal 2019, 43% in fiscal 2020, 56% in fiscal 2021, and a peak of 62% in fiscal 2022.[^6] In four years, the business had grown more than fivefold.

It is easy to tell this chapter as a pandemic story, and the popular version usually does: offices emptied in 2020, remote work became universal, and every company suddenly needed a way to secure employees who were nowhere near the firewall. That is true, as far as it goes. But the record suggests remote work accelerated a trend rather than creating it. Zscaler was growing around 50% a year before the pandemic, in fiscal 2016, 2017 and 2018, and it grew 59% in fiscal 2019, a year that ended in July 2019, well before anyone had heard of COVID-19.[^6] What the pandemic did was make the logic of the architecture visible to the boardroom. A chief executive who had never thought about where the firewall sat suddenly had thousands of employees connecting from home and a VPN creaking under the load. The case Chaudhry had been making for over a decade was suddenly a crisis on the chief executive's own desk.

And then the growth rate came back down to earth. In fiscal 2023, revenue grew about 48%. In fiscal 2024, about 34%. In fiscal 2025, about 23%. In fiscal 2026, about 25%.¹[^6] Over the decade from fiscal 2016 to fiscal 2026, revenue compounded at roughly 45% a year; over the five years from fiscal 2021, about 38%; and over the last three years, about 27.5%.¹ Each shorter window is slower than the one before. The pandemic-era growth rate, in other words, was never a permanent baseline. It was a peak.

The slight uptick from 23% to 25% in the most recent year deserves a footnote of caution rather than celebration, because it included a newly acquired business. Quarterly growth bottomed out at about 21.5% in the quarter to July 2025, then rose to around 25% to 26% through fiscal 2026, the same period in which Zscaler folded in Red Canary.¹ Some of the reacceleration was bought rather than grown. That distinction will matter later in this story.

The public markets also changed how Zscaler financed itself. Before the listing, the company carried no borrowings at all. In fiscal 2020, as the pandemic hit and investors rushed toward anything that helped employees work remotely, Zscaler tapped the convertible bond market, and its balance sheet went from no debt to roughly $0.9 billion of borrowings in a single year, alongside a cash pile that jumped to about $1.4 billion.[^6] Convertible notes are a distinctly public-company tool: they let a fast-growing business borrow at a very low coupon by giving lenders the option to swap into shares if the price rises. That choice kept the company comfortably funded through its heaviest years of losses. It also meant that the cost of the money would eventually be measured partly in dilution rather than interest, a theme that will return.

Meanwhile, the losses tell a parallel story about what the growth cost. Through the hypergrowth years, Zscaler's net loss widened sharply, from about $28 million in fiscal 2019 to about $390 million in fiscal 2022, when the net margin was around negative 36%.¹[^6] The company was hiring, building data centers and paying heavily in stock to attract talent in a hot market. Since that trough, the losses have narrowed dramatically, to about $57 million in fiscal 2024, $41 million in fiscal 2025, and the $63 million recorded in fiscal 2026.¹ Operating margins have improved from about negative 30% to about negative 4%.¹ That is real progress, and it would be wrong to wave it away.

But it is not yet profitability, and the company is candid that it never has been. Its annual report states that it has incurred net losses in every annual period since inception.¹ The scale story, from a startup to a $3 billion revenue vendor, is complete. The profit story has not yet started in GAAP terms. What has instead emerged is a business that throws off substantial cash while reporting a loss, which raises the most important question of all: what exactly are customers buying, and what makes them stay?

↑ Back to Top

V. The Contract Is Simple; the Cash Conversion Is Not

Follow a single customer through the door. A global manufacturer with, say, forty thousand employees decides to replace its aging web proxies with Zscaler. It signs a contract to protect its users' internet traffic, and perhaps a second module to give employees access to internal applications without a VPN. The price is set mainly by the number of users, with some usage-based components.¹ The contract runs three years, which is typical: Zscaler's agreements generally last one to five years and are generally non-cancelable.¹ And the customer pays the first year up front, because Zscaler commonly bills annually in advance.¹

Now watch what happens on each side of the ledger. The cash for year one arrives at the start. The revenue, however, is recognized evenly, a little each day, across the year in which Zscaler provides the service.¹ Professional services are immaterial; this is almost entirely a subscription business.¹ So at any moment, Zscaler is holding customers' money for service it has not yet delivered, and that money sits on the balance sheet as deferred revenue. Meanwhile, the remaining years of the contract, which have been signed but not yet billed, sit in a separate pool called remaining performance obligations.

That pool is large. At the end of fiscal 2026, Zscaler's remaining performance obligations stood at about $7.37 billion, more than twice the year's revenue, with about 45% of it expected to be recognized as revenue over the following twelve months.¹ That gives the company unusual visibility. Roughly $3.3 billion of next year's revenue was already under contract before the year began.

Visibility is not certainty, though, and this is where precision matters. Remaining performance obligations tell investors what has been signed. They do not tell investors what will be renewed when the contract ends, how many users the customer will have next year, or whether a customer will negotiate a lower price at renewal. The company itself warns that some customers do not renew.¹ A booked obligation is a promise, and promises still depend on budgets, usage and competition when they come up for renewal.

The more consequential puzzle is how the cash works. In fiscal 2026, Zscaler reported a net loss of about $63 million, and yet generated about $1.13 billion of cash from operations.¹ How does a company that loses money produce more than a billion dollars of operating cash?

There are two big clues. The first is stock compensation. In the cash-flow statement, Zscaler added back about $822 million of stock-based compensation as a noncash charge, and total noncash charges came to about $1.29 billion.¹ Paying employees in shares does not consume cash, so it is added back to arrive at operating cash flow. But it is not free. Every share issued to an employee is a share that dilutes existing owners, and the company still has about $1.81 billion of unrecognized equity compensation to amortize over roughly two and a half years.¹ A business that pays a quarter of its revenue in stock is spending real economic value, just not cash.

The second clue is advance billing. Deferred revenue rose by about $380 million in fiscal 2026, because customers paid invoices before Zscaler delivered the service.¹ As long as the business is growing, this effect is a tailwind: each year's new and larger invoices bring forward more cash than the previous year's. It reverses only if growth stalls or customers shift to shorter billing terms, which, as the story will show, has happened before.

Not every working-capital line helped. Zscaler pays its salespeople commissions when they sign a deal, but under accounting rules it spreads that expense over the life of the customer relationship. In fiscal 2026, the balance of these deferred contract acquisition costs rose by about $312 million, a real cash outflow that did not hit the income statement at once.¹ Receivables also rose by about $140 million.¹ Together with other items, working capital used about $98 million of cash in the year.¹

Then there is the cost of the network itself. Capital expenditure on property, equipment and other assets, most of it the servers and data-center capacity that every product rides on, came to about $277 million in fiscal 2026.¹ Subtracting that from operating cash flow gives the conventional free cash flow of about $852 million. But Zscaler also capitalized about $73 million of internal-use software development, which is spending on engineers that is recorded as an asset rather than an expense.¹ Take that out as well and the cash remaining after the year's investments was about $779 million.¹ Both numbers are legitimate. The lower one is the more honest measure of what was left after the company paid to keep building its platform.

Step back and look at the whole history, and the pattern is stark. From fiscal 2015 through fiscal 2026, Zscaler generated about $4.0 billion of cumulative operating cash flow while recording cumulative net losses of about $1.3 billion.¹ Free cash flow over the same period totaled about $2.9 billion, none of which was paid out as dividends.¹ That is a business whose cash generation is real, durable, and growing. It is also a business whose cash generation flatters its economics if one ignores who is paying for it. The answer, in large part, is shareholders, through dilution, and customers, through paying in advance.

There is one more subtle support beneath the reported results. Because Zscaler holds billions of dollars of customer prepayments and investments, it earned about $136 million of interest income in fiscal 2026.¹ Its operating loss for the year was about $133 million.¹ In other words, nearly the entire operating loss was offset by interest on the company's cash pile, which brought the pre-tax loss down to only about $17 million.¹ Treasury income is welcome, but it is not the subscription engine, and it would shrink if interest rates fall. Operating progress should be judged before it.

The tax line adds one more wrinkle. Between a pre-tax loss of about $17 million and a net loss of about $63 million sits a tax charge of roughly $46 million.¹ A company that loses money overall can still owe tax, because its profits and losses are spread across many countries and its foreign subsidiaries earn taxable income even when the consolidated group does not. For an investor, the practical meaning is that the path from operating break-even to net profit will be slightly longer than the operating line alone suggests.

Receivables tell a similar story about timing. Zscaler's receivables equal about 125 days of revenue, roughly four months, which looks high for a company whose customers are typically given 30 days to pay.¹ The explanation lies in the billing model. When Zscaler sends a customer an annual invoice in advance, the full year's charge appears as a receivable and, simultaneously, as deferred revenue, so a business that bills large annual invoices near the end of its fiscal quarters will always appear to carry a heavy receivables balance relative to the revenue it recognizes. The figure has drifted down from a peak of about 139 days in fiscal 2021.¹ The company says its credit losses have historically been immaterial, with no material write-offs over the past three years.¹ The watchpoint is not the level but the concentration: some channel partners are given up to 90 days to pay, and one partner alone accounts for an outsized share of what is owed, a detail that will return when the story turns to how Zscaler reaches its customers.

The verdict on the contract, then, is two-sided. Recurring, non-cancelable, prepaid subscriptions are a fine foundation, and they explain why Zscaler has never needed to worry about running out of money. But headline cash flow overstates the earnings picture if stock compensation, capitalized commissions and the cost of the infrastructure are left out of view. That brings the story to the infrastructure itself. A contract is a promise of revenue. The question of whether those revenues are defensible is a question about what happens inside the network, and whether scale there can produce a real moat.

↑ Back to Top

VI. The Moat Lives or Dies in the Traffic

Go back to the manufacturer. In its first year with Zscaler, the security team routes employees' web traffic through the service. Nothing dramatic happens, which is the point; the old proxies are switched off and the help desk gets fewer complaints. In year two, the team adds private application access and retires part of its VPN. In year three, the chief information security officer is presented with a proposition: since all the traffic already passes through Zscaler, why not also use it to protect sensitive data, to monitor how employees use generative AI tools, and to segment the network so that a single compromised laptop cannot reach everything? Each additional product is a policy toggled on a platform the customer already trusts, rather than a new box to buy and install.

That is the economic logic Zscaler sells, and it is worth taking apart carefully, because it is the heart of the bull case.

Start with the machine itself. Zscaler runs what it calls the Zero Trust Exchange, a global network of data centers, or points of presence, where traffic from users, devices and workloads is inspected.¹ When an employee opens a browser, the request goes to the nearest Zscaler location; there it is decrypted and checked for malware, data leakage and policy violations, then forwarded to the destination if it passes. The same layer connects users to internal applications without placing them on a broad corporate network. A single policy, written once, is enforced everywhere.

Scale here works in three ways, at least in theory. First, the more traffic Zscaler sees, the more threats it observes, which can improve detection for every customer. Second, a common policy layer means the customer manages one set of rules instead of a dozen separate products, which is a genuine operational benefit. Third, once traffic flows through the platform, adding a new product means enabling a feature rather than redesigning the network, which gives Zscaler a lower-friction path to sell more to each account. Investors call this land and expand.

The evidence that land-and-expand is working is real. Zscaler ended fiscal 2026 with approximately 11,000 customers.¹ Management reported net revenue retention of about 115% in each quarter of fiscal 2026, which means that the average cohort of existing customers paid about 15% more over the past year than in the year before, after accounting for those who shrank or left.[^7] Gross retention, which measures only what customers kept without counting upsells, was described as being in the mid-90s.[^7] And management said that existing customers' upgrades and added users contributed about $475 million of new revenue in the year.[^7] Those numbers describe customers who mostly stay and gradually buy more.

There is also external evidence of scale. Dell'Oro Group, which tracks the networking market, ranked Zscaler first by revenue among secure access service edge vendors, the category that combines networking and security delivered from the cloud, in its third-quarter 2025 ranking.⁴ Gartner's 2025 Magic Quadrant for SASE platforms evaluated Zscaler alongside a field that included Cisco, Palo Alto Networks, Netskope, Cloudflare and Fortinet, among others.⁵

Now test the claim against what would break it. A moat in enterprise security does not mean customers literally cannot leave. It means leaving is expensive, painful or risky enough that customers rarely do, and that the vendor can hold or raise prices at renewal. On that stricter test, the evidence is more qualified.

Net retention of 115% is strong, but it is not extraordinary for enterprise security software. Gross retention in the mid-90s means that a few percent of revenue walks out the door each year; customers can and do downsize or leave. Nothing in the disclosures shows that Zscaler can raise prices independently of adding users or products, and the company does not publish price-realization data. Large enterprises also commonly multi-source security, keeping one vendor for one function and another for a different one, precisely to avoid dependence. And Dell'Oro's ranking measures revenue position, not market share or exclusivity; it does not tell an investor how much of each customer's traffic Zscaler actually controls.

The competitive field explains why caution is warranted. Palo Alto Networks is a much larger security company overall, sells firewalls, cloud security and security operations tools, and has spent years building its own SASE offering, though it does not report SASE revenue in a way that is separately comparable to Zscaler's. Cisco owns a vast installed base of enterprise networking gear and the relationships that go with it. Cloudflare runs one of the largest networks on the internet and has been moving deliberately into enterprise security. Netskope is the most direct cloud-security rival, built on a similar architecture. Fortinet sells integrated firewalls and networking at aggressive price points. None of these competitors needs to beat Zscaler on every feature. They need only to be good enough, bundled into a broader relationship, at a lower total price.

The structure of the market, analyzed force by force, reinforces this picture. Buyer power is meaningful: Zscaler's customers are large enterprises and governments with procurement departments, multiple vendors to choose from, and the ability to negotiate hard at renewal. The company's customer base is diversified, with no single customer accounting for 10% or more of revenue in any of the past three years, which limits the damage any one buyer can do.¹ But distribution is more concentrated than revenue: one channel partner accounted for 13% of net receivables at the end of fiscal 2026, and some channel partners receive payment terms of up to 90 days.¹ Partners matter in reaching customers, and partners can steer customers toward vendors that pay them best. Supplier power is moderate; Zscaler depends on cloud capacity, equipment and services, with about $559 million of non-cancelable purchase commitments extending beyond a year.¹ The threat of substitutes is real, because a customer can replace part of Zscaler's function with a firewall vendor's cloud service or with the security features embedded in a broader platform. And rivalry is intense, because every major security and networking vendor has identified SASE and zero trust as a growth market.

Through Hamilton Helmer's seven powers lens, the strongest candidates for Zscaler are switching costs and scale economies. Switching costs are real but bounded: once a company has rerouted its traffic, written policies and trained staff, ripping out Zscaler is a significant project, but it is a project, not an impossibility, and competitors offer migration help. Scale economies exist in the sense that a larger network spreads data-center costs over more traffic, and Zscaler's improving margins suggest some of that is happening. Network effects are weaker than they sound; better threat detection from more traffic is a real benefit, but every large competitor sees enormous traffic too. Brand matters in a market where a chief security officer's career rides on the choice, and Zscaler's reputation as the cloud-security pioneer is an asset. There is little evidence of counter-positioning today, because the incumbents that once could not copy the cloud model without cannibalizing their hardware sales have now largely accepted the cannibalization. Cornered resources and process power are not evident.

The verdict is that Zscaler has a real platform advantage, built on switching costs and scale, but it is a narrower moat than the bull case sometimes claims. Retention, expansion and SASE scale prove that customers value the platform and generally stay. They do not prove pricing power or exclusive dependence, and the competition is too well-funded to assume either. Keeping even the narrower moat is expensive. Research and development consumed about 27% of revenue in fiscal 2026, up from about 23% two years earlier, and the company ended the year with more than 8,700 employees.¹ Every new data center, every new inspection engine and every new AI feature must be built before a customer will pay for it. A moat that requires a rising share of revenue to maintain is still a moat, but it is one whose economics have to be watched as closely as its width. The proof still needed is concrete: retention and expansion sustained at current levels while growth holds and GAAP margins improve, plus evidence that usage and pricing hold as customers consolidate onto fewer vendors or add a competitor alongside Zscaler.

Which points to the uncomfortable corollary of the platform strategy. A platform is only as broad as the products it can sell, and Zscaler has increasingly been buying those products rather than building them. A product acquired at a high price still has to keep its customers.

↑ Back to Top

VII. The Platform Is Expanding by Acquisition—and Integration Is the Test

When Zscaler reported its fiscal 2026 results, there was a new line in the story. Red Canary, a managed detection and response business, had become part of the company. Red Canary does something quite different from Zscaler's original product. Rather than inspecting traffic as it flows, it watches what is happening on a customer's computers and systems, detects attackers who have already got in, and provides a team of analysts to respond. It is part software, part service, and it moved Zscaler further into security operations, the work of the people who run a company's defenses day to day.

Zscaler paid about $675 million in cash for Red Canary, plus equity awards for its employees.¹ By the fourth quarter of fiscal 2026, Red Canary contributed about $141 million of annual recurring revenue.[^2][^7] And the company was careful to separate it out: excluding Red Canary, total ARR grew about 20%, and net new ARR, the amount of recurring revenue added during the year, grew about 17%.[^2][^7]

The purpose of the acquisition program is coherent. Over the past few years, Zscaler has bought capabilities around the edges of its core platform: cloud security posture, data security, network segmentation, browser security and threat detection.¹ Each fills a gap that a rival platform might otherwise use to win the account. The logic is the same as the land-and-expand story inside the network: buy a product that customers want, then sell it through the platform to the thousands of customers who already trust Zscaler with their traffic.

Avalor was a notable earlier example. In March 2024, Zscaler agreed to buy the Israeli startup, which uses AI to analyze security data, in a deal reported at about $310 million in cash and stock.⁶ The aim was to make sense of the vast amount of data Zscaler's platform sees and turn it into insight for customers. That is an appealing story. But Zscaler does not disclose standalone revenue or returns for Avalor, so there is no way to test from the outside whether the purchase has earned its cost. The same is true of most of its smaller deals.

Red Canary is the first acquisition large enough to show up clearly in the numbers, which makes it the first real test. A rough benchmark is possible, but only so far. Zscaler paid about $675 million for a business that reported about $141 million of ARR after being folded in, or roughly 4.8 times that ARR figure. That is a modest-sounding multiple next to Zscaler's own valuation of more than twelve times sales. But it is not a clean comparison: the ARR figure is a post-acquisition disclosure, not the business's run rate on the day it was bought, and the cash price excludes the equity awards granted to retain employees. It is not possible, from what the company publishes, to say whether the price was cheap or expensive against comparable deals.

What the company does say is more cautionary. On the fourth-quarter call, management acknowledged that Red Canary had experienced elevated churn, and said it did not expect the business to make a separate contribution to net new ARR in fiscal 2027.[^7] Translated: the acquired customers were leaving at a higher rate than Zscaler's core customers, and the new business was expected to replace roughly what it lost, rather than grow. That is the opposite of the cross-sell thesis, at least for now.

Keep the scale of acquisition spending in view. In fiscal 2026, Zscaler spent about $918 million in cash, net of cash acquired, on acquisitions across several purchases, not Red Canary alone.¹ That is more than its entire free cash flow for the year after capitalized software. It means that in fiscal 2026, Zscaler effectively reinvested all its free cash, and more, into buying adjacent businesses. Acquisitions also bring judgment into the accounts: the company's auditor flagged the valuation of acquired intangible assets as a critical audit matter, an area where estimates are consequential.¹

Management's case for the strategy rests on how quickly new products are catching on. At its Investor Day in October 2026, management said that newer products drove roughly one-third of new-logo ARR, meaning that among the brand-new customers Zscaler signed, about a third of the recurring revenue came from products beyond the original core.[^11] That is a meaningful signal of interest. But product interest and pipeline are not yet durable revenue. New-logo ARR measures what customers signed this year; it will become a retained revenue stream only if those products are renewed and expanded.

The verdict on the acquisition strategy, therefore, is narrower than management's framing. Adding capabilities has broadened what Zscaler can sell and given it a credible foothold in security operations, a market large enough to matter. But the only acquisition big enough to measure is currently losing customers faster than the core business, and the earlier deals have no disclosed returns. Buying a product line does not automatically add retained customers, and Red Canary's churn is a present-tense warning that integration is a skill Zscaler still has to prove.

There is a structural reason this particular integration is harder than it looks. Zscaler's core business is software running on its own network, which scales by adding servers. Managed detection and response is partly a people business, in which analysts watch alerts and respond to incidents around the clock. Its margins, its hiring needs and its customer relationships work differently from a cloud subscription. Customers who bought Red Canary for the quality of its analysts may worry about what changes under a new owner, and rival vendors have every incentive to tell them it will. Some of the churn may reflect exactly that kind of uncertainty, which tends to fade once integration settles; some may reflect customers who never wanted a single vendor for both traffic inspection and incident response. The company does not split the churn by cause, so the next renewal cycle is the only way to tell which explanation dominates. That raises the question of who is running this machine, and whether their record justifies confidence.

↑ Back to Top

VIII. The Founder Still Owns the Story; the Stock Plan Owns a Lot of the Economics

Nearly two decades after he incorporated SafeChannel, Jay Chaudhry is still Zscaler's chief executive and chairman.¹⁷ In an industry where founders are routinely replaced by professional managers once a company goes public, that continuity is unusual, and it is worth asking what it has delivered.

Chaudhry's style, visible across a decade of earnings calls, is that of an evangelist who never stopped making the founding argument. He talks about architecture first and products second, about why firewalls and VPNs are obsolete, and about how zero trust should be applied to every new frontier, from workloads to AI agents. Beside him, Kevin Rubin, the chief financial officer, plays the counterweight: the executive who explains margins, cash flow and guidance, and who sets the numbers the market will judge.⁷

The founder's economic alignment is substantial. As of November 1, 2025, Chaudhry beneficially owned about 16.8% of Zscaler's shares, and trusts for the benefit of his family members, held through a trustee, owned a further 18.2%.⁷ Together, the Chaudhry family's interest exceeds a third of the company, which gives it considerable influence over shareholder votes. Vanguard was the largest institutional holder at about 7.1%.⁷ As a U.S. issuer, Zscaler reports ownership through these beneficial-ownership tables rather than the promoter and institutional shareholding schedules familiar from other markets.

Chaudhry's own pay is almost a curiosity. His reported compensation for fiscal 2025 was about $30,000, because he received no new equity grant that year; he was still covered by a multi-year performance award granted earlier.⁷ The headline is accurate but can mislead. What matters to shareholders is not the CEO's pay but the company's broader equity spending, and there the numbers are large. Other named executives received substantial equity awards, including new-hire grants.⁷ And across the company, stock compensation in fiscal 2026 ran at about a quarter of revenue, with nearly $2 billion more in the pipeline.¹ Zscaler has not reported a share buyback to offset this dilution.¹ A founder who owns a third of the company is aligned with long-term value, but the rest of the company's incentive system is a substantial, recurring cost to every other owner.

Credibility is best judged through a specific episode, and fiscal 2024 provides one. On the first-quarter call in November 2023, management described its full-year guidance as prudent, reflecting an uncertain macroeconomic environment.[^13] By the fourth-quarter call in September 2024, the explanation for the year had a different emphasis. Management described changes in sales leadership and higher-than-expected sales attrition earlier in the year, said attrition had since stabilized, and laid out a plan to rebuild the go-to-market organization.[^14] When Zscaler issued its fiscal 2025 forecasts, investors were disappointed and the shares fell.⁸

What does this episode reveal? On the positive side, management did name the problem, explain it, and describe a remedy, rather than blaming the economy alone. Revenue growth did hold in the low-to-mid 20s afterward. On the negative side, the problem originated inside the company's own sales organization, and it surfaced only after the earlier guidance had been framed around external caution. The episode is not a scandal. It is a reminder that execution in a sales-driven enterprise business is fragile, and that leadership changes have real consequences. The fourth-quarter call of fiscal 2026 brought a reminder of that fragility: two sales leaders had departed in the prior quarter.[^7]

Shareholders have recently sent their own signal. At the January 2026 annual meeting, they approved executive compensation in the advisory vote, but a nonbinding proposal to declassify the board, so that all directors face election every year rather than in staggered terms, passed narrowly, with about 67.0 million votes in favor and 63.2 million against.⁹ Given the size of the family's holdings, a majority in favor of a governance change that management did not sponsor is a meaningful statement from the outside shareholders. It is a governance signal, not evidence of an activist campaign. A related-party employment arrangement disclosed in the proxy, involving the CEO's son-in-law in a senior product role, is small in financial terms but is the kind of relationship that independent directors are expected to watch.⁷

On the accounting side, the record is clean. PricewaterhouseCoopers issued unqualified opinions on Zscaler's fiscal 2026 financial statements and its internal controls over financial reporting, with no material weakness.¹ Its critical audit matters were the recognition of subscription revenue and the valuation of acquired intangibles, the two areas where management's judgment most affects the numbers.¹ There was also about $117 million of gross unrecognized tax benefits, an ordinary item for a multinational with open tax years, and management said no pending litigation was likely to have a material adverse effect.¹

The verdict on management is a balanced one. The record supports strategic consistency: Chaudhry has pursued the same architectural vision for nearly twenty years and built a company of real consequence around it. The record does not support the claim that execution is automatic. The 2024 sales disruption, the churn at Red Canary, and the size of the stock compensation program are all evidence that the company's per-share economics depend on more than the founder's vision. Capital allocation, after all, is not only about where the cash goes. It is about how much of the return actually reaches each share.

↑ Back to Top

IX. Analysis & Bear vs. Bull Case

On October 29, 2026, an investor buying Zscaler shares paid roughly 12.4 times the company's annual sales, or about 12.2 times on an enterprise-value basis once its cash and debt are netted out.[^3]¹ The trailing earnings per share were negative, about minus 40 cents, so there was no price-to-earnings ratio to quote. The free cash flow yield, the cash the business generated relative to its market value, was about 2.1%.[^3]¹ Measured against earnings before interest, tax, depreciation and amortization, the multiple was more than 200 times.¹ Those are the prices of a company the market expects to grow quickly for many years and eventually to earn substantial profits. The question is whether the evidence justifies that expectation.

The bull case starts with the market. Enterprises are still moving security away from appliances and toward cloud-delivered platforms, and that shift has years to run. Zscaler has the installed base to benefit: about 11,000 customers, net retention around 115%, and the leading revenue position in Dell'Oro's SASE ranking.¹[^7]⁴ The business is still growing about 25% a year at a scale above $3 billion of revenue, and remaining performance obligations of about $7.4 billion give it unusual visibility into the coming year.¹ Operating margins have improved from about negative 30% to about negative 4% over four years, and in the final quarter of fiscal 2026 the operating margin was close to break-even, at about negative 1.7%.¹ If that trajectory continues, GAAP profitability is no longer a distant hope but a matter of a few more quarters. And the cash flow, whatever its caveats, is real: the company does not need outside capital to fund its growth.

The bear case starts with deceleration. Revenue growth of about 25% in fiscal 2026 is below the company's five-year average of about 38% and its ten-year average of about 45%, and part of that 25% was acquired.¹ Management's fiscal 2027 revenue guidance of about $3.91 billion to $3.94 billion implies growth of roughly 17% to 18%, a meaningful further slowdown.[^2] Palo Alto Networks, Cisco, Cloudflare and others can bundle SASE into broader relationships, sell through existing accounts and pressure price. Losses persist on a GAAP basis, and stock compensation remains one of the largest costs in the business. Cash generation depends heavily on noncash add-backs and advance billings, both of which would weaken if growth slowed further. The company has already lived through a version of that risk: when it set its fiscal 2025 outlook, management said it expected more customers to be billed annually rather than for several years up front, which would reduce the cash collected in advance even where contract values were unchanged.[^14] And the most significant recent acquisition is losing customers.

How do these weigh against each other? The bull case has operating evidence: contracts, retention and scale are not management rhetoric, they are reported numbers. But the bear case also has operating evidence, and it is pointing in the direction of slower growth at a time when the valuation still assumes a long runway. The two cases are not equally weighted by the market. At twelve times sales, the share price already embeds much of the bull case.

A simple thought experiment makes the point concrete. Suppose Zscaler eventually earned a GAAP operating margin of 25%, a level that mature, highly profitable software companies reach but that Zscaler has never come close to. On fiscal 2026 revenue, that would mean operating profit of roughly $840 million; on the midpoint of fiscal 2027 guidance, roughly $980 million. Against an enterprise value of about $39.9 billion, the stock would still be priced at around 40 to 47 times that hypothetical operating profit.[^3][^2] In other words, today's price does not merely assume that Zscaler becomes profitable. It assumes that it becomes very profitable and keeps growing for years after it does. The illustration is not a forecast. It is a way of seeing how much of the future is already paid for.

A skeptical long-short investor, or an activist with a seat at the table, would push on four points. The first is stock compensation: a company paying about a quarter of its revenue in equity, with no buyback to offset the dilution, is asking existing owners to fund a large share of its operating costs.¹ The second is acquisition spending: in fiscal 2026, cash spent on acquisitions exceeded the free cash flow left after capitalized software, and the largest of those deals is shedding customers.¹[^7] The third is reported profitability: the year's operating loss was almost exactly offset by interest income, so the near-break-even pre-tax result owed as much to the treasury desk as to the subscription engine.¹ The fourth is governance: a staggered board that a majority of outside votes asked to declassify, at a company where the founder's family controls more than a third of the shares.⁹⁷ None of these is a crisis. Together, they describe a company whose per-share economics depend on management choosing restraint in areas where it has so far chosen growth.

The balance sheet is not the fault line. Zscaler's debt consists mainly of $1.725 billion of convertible senior notes due July 2028, carrying a zero coupon.¹ They were issued in July 2025 alongside capped call transactions intended to reduce dilution if the notes convert.¹ Against that, the company held about $3.3 billion of cash, cash equivalents and short-term investments at the end of fiscal 2026, plus additional long-term investments.¹ Operating lease liabilities of about $159 million are separate and modest.¹ No covenant problem or refinancing pressure is disclosed. The real balance-sheet risk is not solvency but dilution: whether the notes convert, how much stock compensation adds to the share count, and whether the returns on the cash spent on acquisitions justify it.

Three numbers can settle the debate, and they should be tracked above all others. The first is organic ARR growth, excluding acquisitions. At the end of fiscal 2026, ARR excluding Red Canary grew about 20%, and net new ARR excluding Red Canary grew about 17%.[^2] If organic growth holds near those levels, the deceleration in reported revenue is a math problem, not a demand problem. If it falls sharply, the market's assumptions about the runway will be tested. The second is retention, gross and net. Net retention was about 115% throughout fiscal 2026, and gross retention in the mid-90s.[^7] Watching those numbers through fiscal 2027, especially as Red Canary's customers come up for renewal, will reveal whether the platform's switching costs are as durable as the bulls believe. The third is GAAP operating margin after stock compensation. It was about negative 4% for the full year and about negative 1.7% in the fourth quarter.¹ Crossing into sustained positive territory, without help from interest income, would be the clearest evidence that scale is finally converting into earnings.

None of these KPIs requires faith. Each will be reported. The point is that the price paid for uncertainty can fall even if the company keeps growing. A high multiple does not need a disaster to compress; it needs only a couple of years in which growth is good rather than exceptional. Zscaler's share price fell by about three-quarters at its worst point in the past five years, a reminder that the market has repriced this story sharply before.[^3]

↑ Back to Top

X. Playbook: Business & Investing Lessons

In 2007, the incorporation papers for a company called SafeChannel were filed in Delaware.³ There was nothing in them about zero trust, SASE or AI agents. There was only a founder who had decided that security belonged where the users were going, not where the firewall stood. Nearly twenty years later, the lessons of that decision are clearer than they were at the time.

The first lesson is about architecture. Zscaler's entire business rests on Chaudhry's early judgment that the corporate perimeter was dissolving, made at a time when most enterprises still believed in the castle and the moat. The judgment was right, but it took a decade and the arrival of cloud applications and remote work for the market to agree. The lesson is not that being early pays off. It is that being early is a cost, paid in years of losses and patient network-building, which is only recovered if the direction is right and the company survives long enough to see it. Build for where the network is going, not where the firewall sits.

The second lesson is about proof. Zscaler's platform story is persuasive at the launch of each new product, but the evidence that matters is what customers do when their contracts come up. Net retention around 115% and gross retention in the mid-90s say that customers mostly stay and gradually buy more. They do not say that customers cannot leave or that Zscaler can name its price. A platform is proven at renewal, not at launch.

The third lesson is about cash. Zscaler generates more than a billion dollars of operating cash a year and has never reported an annual profit. Both facts are true, and the reconciliation lies in stock compensation, advance billing and the cost of the network. A business can be cash-rich and still transfer a large share of its value to employees through dilution. Cash is a result; per-share value is the test.

The fourth lesson is about acquisitions. Red Canary was a reasonable strategic fit, a credible step into security operations, and a sizable addition to recurring revenue. And yet its customers began leaving at elevated rates almost immediately, and management expected it to add nothing net to growth in its second year. The lesson is that a platform does not automatically turn an acquired customer base into a retained one. Buying adjacency is not the same as cross-selling it.

The last lesson concerns the founder. Chaudhry's career shows that a repeat entrepreneur can see a market shift years before incumbents admit it, and that ownership of a third of the company can keep a founder focused on the long term. But the company he built still has to earn the right to keep scaling, quarter by quarter, through the sales force it hires, the acquisitions it integrates and the margins it delivers. Vision opens the door. Execution decides how long the company gets to stay in the room.

↑ Back to Top

XI. Epilogue

On October 6, 2026, Zscaler's management stood in front of investors at its Investor Day and described the next frontier.[^11] Its pitch was that the same zero-trust architecture that once secured employees connecting to the internet should now secure AI applications and the autonomous software agents that enterprises are starting to deploy. Some of these new AI security products are priced on consumption, by queries or tokens, rather than by user, which management presents as a way to monetize beyond headcount.[^7] At the same event, management acknowledged the work of integrating new businesses.[^11]

That is where Zscaler stands tonight: a scaled, cash-generative platform with a founder still at the helm, a new frontier in AI security, a recently acquired business with elevated churn, and a valuation that already assumes it will navigate all of this successfully. Shortly after year-end, the company also disclosed a plan to reduce global headcount by about 3%, reallocating resources toward AI and growth.¹ A company that still hires aggressively and still pays heavily in stock is choosing, for the first time in a while, to trim. That is a small signal, but it is the kind of signal that margin-focused investors will look for again in the coming quarters.

The guidance for fiscal 2027 sets the first marker. Management expects revenue of about $3.91 billion to $3.94 billion.[^2] Red Canary, which contributed about $141 million of ARR at the end of fiscal 2026, is not expected to make a separate addition to net new ARR in the coming year.[^7] So the year ahead will be a clean test of the core business, without the flattering effect of a newly consolidated acquisition.

Four things will decide the story over the next twelve months. The first is whether organic ARR growth holds near 20% as Red Canary is fully integrated, and whether management continues to separate acquired growth from organic growth in its disclosures. If it does, and organic growth holds, the deceleration in reported revenue will look like an accounting artefact of the acquisition cycle. If organic growth slips toward the mid-teens, the market will be forced to reprice the runway. The second is retention: whether gross and net retention hold, and whether Red Canary's customers renew through fiscal 2027 at rates closer to the core business. Retention that holds would vindicate the switching-cost argument; retention that slips would narrow it. The third is the AI bet: whether the newer AI and data-security products convert pipeline and new-logo interest into recurring revenue that renews. Today, they are a future-material opportunity, not a replacement for the core subscription engine. The fourth, and perhaps the most decisive, is margins: whether GAAP operating profit turns sustainably positive after stock compensation, capitalized software and data-center spending, without help from interest income.

The central questions this story began with will be answered by the filings Zscaler publishes in the coming year. Whether retention holds will be visible in the quarterly calls. Whether acquisitions earn their cost will be visible in organic growth and Red Canary's renewals. And whether profitability arrives without sacrificing growth will be visible in the margins. Each answer will matter. Together, they will decide whether the platform is compounding, or merely getting broader.

↑ Back to Top

XII. Outro

Somewhere, in an office building that is half empty on a Wednesday, a firewall is still running. It guards a data center that holds fewer applications every year, for employees who are mostly somewhere else. It does its job faithfully, inspecting the traffic that still comes through its doors. The traffic that matters, though, has gone elsewhere, out to the cloud, through the nearest Zscaler data center and on to wherever the work is happening.

That image is Zscaler's defining achievement. A company that began as an idea filed under the name SafeChannel made the internet itself a security perimeter for some of the largest enterprises in the world. It moved billions of dollars' worth of security spending onto a cloud network and built a business that throws off a billion dollars of cash a year. And yet the equation is not finished. More traffic, more products, more cash: all of it is visible on the page. The last term, durable earnings that reach each share, has not yet appeared. Zscaler proved the firewall was in the wrong place. Its next test is proving that the place it chose instead is where profits live.