Zscaler
Subscription SaaS (per-user/per-workload recurring), land-and-expand via Zero Trust Everywhere bundles and Z-Flex flexible-consumption contracts
Earnings, margins, COGS & capex
Zscaler crossed $3.5B ARR in Q3 FY26 ($3,525M, +25% y/y) with revenue of $850.5M (+25%) and a record 23% non-GAAP operating margin, but growth quality shifted: excluding Red Canary (acquired Aug 1 2025), which contributed $127M of ARR, organic ARR grew 21% to $3,398M, and organic net new ARR grew just 14% y/y (total net new ARR was $166M). FY26 guidance was raised (revenue $3.3295-3.3325B, +~24.7%; non-GAAP EPS $4.10-4.11), yet the preliminary FY27 outlook of 16-17% ARR and revenue growth came in below Street, which management attributed to two senior sales-leader departures late in the quarter and cautious uptake assumptions for the integrated SecOps product launching in FY27. GAAP remains loss-making (Q3 FY26 net loss $13.9M) on stock-based comp and acquisition amortization, and FY26 FCF-margin guidance was cut to 22.8-23.3% (from 26.5-27%) to fund AI/datacenter capex.
Income statement — where each revenue dollar goes
% of revenueOf every $1 of revenue, ~23¢ is cost of goods and ~54¢ operating expense, leaving ~23¢ of operating profit.
Revenue trend
Margins
Stable; AI/cloud infrastructure costs cited as a pressure
Improving - up from 22% in Q3 FY25
Still negative on SBC + acquisition amortization
Declining near-term on capex ramp
COGS structure
COGS is cloud-delivery cost: operating 150+ colocation-based service-edge datacenters (bandwidth, colocation, hardware depreciation), public-cloud usage for analytics/AI workloads, and support. Non-GAAP gross margin held 81% in Q3 FY26, but management flagged rising infrastructure costs from AI-driven traffic inspection and new AI security services.
Capex
Capex intensity is rising: the FY26 FCF-margin guide was cut from 26.5-27% to 22.8-23.3% explicitly to fund datacenter capacity and AI infrastructure buildout (Q3 FY26 guidance). Historically capex ran a high-single-digit % of revenue for service-edge expansion.
Latest earnings
Beat on revenue and EPS through FY26 (Q2 FY26 beat and raised the FY26 ARR-growth guide to 24%; Q3 FY26 beat and raised FY26 guidance again) - but the preliminary FY27 ARR/revenue growth outlook of 16-17% missed Street expectations and drove the stock down ~32% the next day (May 27 2026).
FY26 (ends Jul 2026): revenue $3.3295-3.3325B (+24.6-24.7%), ARR $3.740-3.749B (+24%), non-GAAP op income $755-757M (+30%), non-GAAP EPS $4.10-4.11 (+25%), FCF margin 22.8-23.3% (cut from 26.5-27% on capex). Q4 FY26: revenue $875-878M (+~22%), non-GAAP op income $206-208M, non-GAAP EPS $1.08-1.09. FY27 preliminary (earnings call): ARR and revenue growth 16-17%, reflecting two sales-leadership departures and prudent SecOps-uptake assumptions.
- ARR
- $3,525M, +25% y/y; $3,398M / +21% organic ex-Red Canary (Q3 FY26)
- Organic net new ARR growth
- +14% y/y ex-Red Canary (Q3 FY26; total net new ARR $166M)
- Non-GAAP operating margin
- 23%, all-time high (Q3 FY26)
- Deferred revenue
- $2,477.2M, +25% y/y (Q3 FY26)
- Net cash
- ~$1.8B ($3.54B cash/investments vs $1.725B 0% 2028 converts, Apr 2026)
Growth drivers
- Zero Trust Everywhere expansion beyond users to workloads, branches, cloud, and IoT/OT (upsell of ZPA/ZDX/workload segmentation)
- Red Canary MDR (closed Aug 1 2025, ~$675M) + FY27 integrated SecOps launch - entry into the security-operations/agentic-SOC market
- AI security portfolio — SPLX (closed Oct 31 2025, ~$40.6M cash) and Symmetry Systems (intent announced May 21 2026, terms not disclosed) acquisitions plus Project AI-Guardian GSI/technology partnerships - securing enterprise AI agents and data
- Z-Flex flexible-consumption contracts accelerating large multi-product commitments
- Federal/public sector — long-held FedRAMP High plus ZIA DoD/DoW Impact Level 5 provisional authorization (Mar 2026)
- Firewall/VPN replacement cycle as hardware appliances age out
Reported financials — SEC EDGAR
Audited GAAP figures pulled from SEC filings · latest filing 2025-09-11. The audited primary-source spine — not financial advice.
Revenue — annual (GAAP)
Margins & balance sheet — FY’25
Bull & bear
The zero-trust category leader now trades at a fraction of its historical multiple (~6.6x EV/FY26E revenue, ~29x EV/guided FY26 FCF) after a guidance-driven derating, while still compounding ARR 24-25% with record and rising non-GAAP margins, a ~$1.8B net-cash balance sheet, and two credible new S-curves (SecOps via Red Canary, agentic AI security) about to monetize in FY27.
- Valuation reset: stock down ~53% y/y to ~$146 (Jul 2026); at ~$23.8B market cap the market pays ~5.9x EV/guided FY26 ARR for a 24%-ARR-growth, 23%-op-margin asset - cheap vs CRWD on growth-adjusted terms
- FY27 16-17% guide is plausibly conservative: management framed it as prudent, attributed to transitory factors (two sales-leader transitions, cautious SecOps ramp assumptions), and Zscaler beat and raised every quarter of FY26
- Record profitability trajectory: non-GAAP op margin hit an all-time-high 23% in Q3 FY26 with FY26 op income guided +30% y/y - margin expansion cushions any growth slowdown
- SecOps expansion is a real TAM unlock: Red Canary brought ~$127M of ARR (a ~$140M-ARR MDR leader at acquisition) and the FY27 integrated agentic-SOC product attacks the SIEM/SOC spend pool dominated by legacy tools
- AI tailwind on both sides: Zscaler's 500B+ daily-transaction data scale feeds its own AI detection, and the SPLX/Symmetry/AI-Guardian stack targets the emerging securing-AI-agents market before rivals consolidate it
- ZIA DoD IL5 (Mar 2026) + long-held FedRAMP High make ZS one of few cloud-native vendors eligible for the deepest US federal zero-trust mandates
Organic momentum is decelerating - 21% organic ARR growth and just 14% organic net-new-ARR growth in Q3 FY26 vs the 25% headline - while margins face capex and AI-cost headwinds, GAAP losses persist on heavy SBC, and platform bundlers (PANW, MSFT) plus a newly public Netskope are commoditizing core SSE; a 16-17% FY27 grower at ~36x forward non-GAAP EPS is not obviously cheap.
- Organic deceleration is the headline risk: headline 25% ARR growth includes Red Canary's $127M contribution; organic ARR grew 21% and organic net new ARR grew only 14% y/y - trending toward the 16-17% FY27 guide, not away from it
- FY27 ARR/revenue guide of 16-17% missed Street and management's own explanation (two sales-leader departures, uncertain SecOps uptake) points to execution risk, not just conservatism - the stock fell ~32% on the print
- FCF economics deteriorating: FY26 FCF-margin guide cut from 26.5-27% to 22.8-23.3% for AI/datacenter capex, and Q3 FY26 FCF margin was just 16% - the cash-flow premium thesis is eroding
- GAAP still loss-making (Q3 FY26 net loss $13.9M) with SBC a structural roughly-20%-of-revenue drag; share count keeps creeping
- Competitive squeeze from three directions: PANW platformization discounts, Microsoft Entra Internet/Private Access bundled with E5, and Netskope/Cloudflare undercutting on price - core SSE pricing power weakens
- M&A integration risk: three acquisitions (Red Canary ~$675M, SPLX ~$41M, Symmetry Systems undisclosed) in under a year while entering MDR - a services-heavier business that also antagonizes the CrowdStrike partner channel
What it is worth
EV/revenue and EV/FCF comps vs SASE/security peers (PANW, CRWD, NET, FTNT, NTSK) plus reverse-DCF sanity check; market cap ~$23.8B, EV ~$22.0B net of ~$1.8B net cash (Jul 2026)
~$100-115
organic growth decays toward low-double-digits, MDR dilutes gross margin, capex stays elevated; multiple compresses to ~4.5-5x EV/S (vintage 2026-07 scenario)
~$150-165
FY27 delivers the guided 16-17% ARR growth with continued non-GAAP margin expansion; multiple holds ~6.5-7x EV/S (vintage 2026-07 scenario)
~$210-230
FY27 ARR growth lands 20%+ (SecOps attach + federal), FCF margin rebuilds toward 26-27% as capex normalizes, multiple re-rates to ~9x EV/S (vintage 2026-07 scenario)
At ~$146.55 (Jul 9 2026), ZS trades ~6.6x EV/FY26E revenue ($3.33B guide), ~5.9x EV/guided FY26 ARR ($3.74-3.75B), ~36x FY26E non-GAAP EPS ($4.10-4.11), and ~29x EV/guided FY26 FCF (~$760M at ~23% margin) - a steep discount to its own 3-year history and to CRWD, roughly in line with PANW on growth-adjusted terms. Reverse-DCF: the price implies roughly mid-teens revenue growth fading to high-single-digits with ~25% steady-state FCF margins - i.e. the market is pricing the 16-17% FY27 guide as the new permanent trajectory with little SecOps/AI-security upside. Upside case requires organic re-acceleration (from 21% organic ARR growth today) or proof the FY27 guide was conservative; downside case is organic growth slipping below the guide while capex stays elevated.
SWOT
Strengths
- Largest inline cloud-security network — 150+ service edges processing 500B+ transactions daily - data scale feeds threat detection and now AI models (FY25/FY26 disclosures)
- $3.5B ARR growing 25% (21% organic) with record 23% non-GAAP operating margin (Q3 FY26) - rare growth-plus-leverage profile
- High switching costs — sits inline on all user/workload traffic; rip-out requires re-architecting enterprise networking
- Gartner-leader position in SSE/zero trust; FedRAMP High plus ZIA DoD IL5 (Mar 2026) unlock deep federal spend
- ~$1.8B net cash and ~$760M guided FY26 FCF fund M&A and buildout without leverage
Weaknesses
- Organic growth decelerating — 21% organic ARR growth and only +14% organic net-new-ARR growth in Q3 FY26 vs 25% headline (Red Canary inorganic)
- GAAP loss-making — SBC and acquisition amortization keep GAAP operating margin negative (Q3 FY26 GAAP op loss $29.6M)
- FY26 FCF-margin guide cut ~4pts for AI/datacenter capex - near-term cash economics worsening
- Sales-leadership churn — two senior sales leaders departed late in Q3 FY26, cited by management as a driver of the cautious FY27 guide (May 2026)
- Integration load: Red Canary, SPLX, and Symmetry Systems all closed/announced within ~10 months
Opportunities
- SecOps/agentic-SOC market entry via Red Canary MDR + FY27 integrated SecOps product - expands TAM beyond SSE
- AI security (securing LLM apps, AI agents, and data) — SPLX + Symmetry + Project AI-Guardian (GSI launch partners Cognizant, EY, HCL, Infosys, TCS, Wipro; tech partners incl. CoreWeave, Databricks, NTT DATA, OpenAI) position ZS early in a nascent category
- Zero Trust Everywhere: branches, workloads, B2B, IoT/OT still under-penetrated vs user-security base
- Firewall/VPN refresh displacement as PANW/CHKP/FTNT hardware installed base ages
- Federal expansion post-IL5; sovereign-cloud and international buildouts
Threats
- Palo Alto Networks and Microsoft bundling SASE/SSE into broader platform deals at discount (platformization pressure)
- Netskope (Nasdaq — NTSK, IPO Sep 18 2025) and Cloudflare competing aggressively in core SSE on price and architecture
- CrowdStrike relationship shifting from partner to rival after Red Canary pushes ZS into MDR/SecOps
- Macro/budget scrutiny lengthening enterprise security deal cycles; seat-based pricing exposed to headcount softness
- AI-driven infrastructure cost inflation compressing gross margin and FCF if pricing cannot keep pace
Moats, dependencies & bottlenecks
Moats
Zero Trust Exchange sits inline on all user/workload traffic with policy deeply embedded; replacement requires network re-architecture and long parallel-run migrations
150+ service edges inspecting 500B+ daily transactions; threat telemetry (ThreatLabz) improves detection for all tenants and now trains AI models - scale rivals only PANW/MSFT can match
Consistent Gartner SSE leader and the name most associated with VPN replacement; brand matters in risk-averse security purchasing but is contested by platform vendors
FedRAMP High (ZIA and ZPA) and DoD IL5 (ZPA since 2021; ZIA Mar 2026) are multi-year, capital-intensive gates few cloud-native competitors have cleared
Transaction-log corpus is a genuine asset for agentic-SOC and AI-security models, but monetization (FY27 SecOps launch) is unproven
Dependencies
Digital Realty DLR) infrastructure supplier 150+ service edges ride third-party colocation; power/space costs and AI-era datacenter scarcity feed the rising-capex problem
infrastructure supplier Analytics/AI workloads use hyperscaler capacity; MSFT is simultaneously a supplier and an SSE competitor
AI infrastructure supplier AI security services and internal model training depend on accelerated compute availability and pricing; Zscaler has a publicized NVIDIA security partnership
technology partner Zero-trust policy keys off identity; deep integrations required, and Entra doubles as a competitive wedge for Microsoft
GSIs and telcos (Accenture ACN, Infosys INFY, Wipro WIT, AT&T T) Large-deal motion is partner-led (AI-Guardian launched with six GSIs); the Q3 FY26 sales-leadership departures show GTM concentration risk
customer concentration IL5/FedRAMP momentum is a growth pillar but exposes ZS to appropriations timing and shutdown risk
Advantages
- Largest pure-play inline cloud-security network and transaction-data corpus (150+ edges, 500B+ daily transactions)
- Growth-plus-margin profile: 24-25% ARR growth with record 23% non-GAAP op margin and ~$760M guided FY26 FCF
- ~$1.8B net cash funding M&A optionality without leverage
- Federal certifications (FedRAMP High, DoD IL5 for ZPA and now ZIA) few rivals hold
- Early consolidation of AI-agent security (SPLX, Symmetry, AI-Guardian) ahead of category formation
Weaknesses
- Organic ARR growth of 21% (and organic net-new-ARR growth of 14%) vs 25% headline once Red Canary is excluded (Q3 FY26)
- GAAP unprofitable; SBC-heavy income statement and rising share count
- FCF margin compressing on AI/datacenter capex (FY26 guide cut)
- GTM execution risk from senior sales departures into the FY27 plan
- Core SSE increasingly bundled/discounted by platform rivals (PANW, MSFT)
Bottlenecks
- Organic net-new-ARR generation (+14% y/y in Q3 FY26 — organic ARR +21%) - the core motor everything else compounds on
- Sales leadership rebuild after two senior GTM departures ahead of FY27
- Datacenter/AI infrastructure capacity and its capex bill (FY26 FCF-margin guide cut ~4pts)
- Integration bandwidth across Red Canary + SPLX + Symmetry while shipping the FY27 SecOps product
- Seat-based pricing model in a flat-enterprise-headcount macro (Z-Flex is the partial answer)
Top signals & trends
Top signals
The derating driver; watch whether the Q4 FY26 print (Sep 2026) raises it - management beat-and-raised all FY26
Cleanest read on core-business momentum; a re-acceleration would flip the thesis
Margin expansion continuing through the growth slowdown
Watch whether capex proves front-loaded (bullish if FY27 FCF margin rebounds) or structural
The main new S-curve; management explicitly guided cautiously on its uptake
Q3 FY26 milestone; federal zero-trust mandates are a multi-year demand floor
Two senior departures late in Q3 FY26 cited by management; watch for stabilization in named GTM hires
Sentiment washed out; positioning more balanced into the Sep 2026 FY-end print
Trends
Zero-trust adoption grows the pie, but PANW/MSFT bundle SSE into platform deals, pressuring standalone pricing
Red Canary + FY27 SecOps product aim ZS at the SIEM/SOC spend pool being disrupted by AI
Nascent category ZS is buying into early (SPLX, Symmetry, AI-Guardian); TAM unproven but strategic
Aging PANW/CHKP/FTNT appliance estates remain the core replacement funnel
Direct driver of the FY26 FCF-margin guide cut and a gross-margin watch item
IL5/FedRAMP High position ZS for defense and civilian agency rollouts (serving 14 of 15 cabinet-level agencies)
Ecosystem & competitor graph
Suppliers feed the company; customers pull from it. Line thickness shows the strength of each tie (supply-chain dependency, customer earnings contribution). Hover to isolate a tie.
Colocation for service-edge datacenters
Colocation/interconnection capacity
Public-cloud capacity for analytics/AI workloads
GPU/accelerated compute for AI security services; publicized security partnership
Cloud supplier and identity integration - simultaneously a competitor
Large global enterprises (40%+ of Fortune 500 disclosed) Core base: Global 2000 users, branches, and workloads
US Department of Defense/War and federal civilian agencies FedRAMP High solutions serve 14 of 15 cabinet-level agencies; ZPA IL5 since 2021, ZIA IL5 Mar 2026
Longstanding flagship zero-trust enterprise deployment
Publicly referenced large enterprise customer
Prisma Access/SASE plus platformization bundling; the largest and most direct strategic threat
Closest pure-play SSE rival, public since Sep 2025 (~$707M ARR at IPO); competes head-to-head in Gartner SSE leader deals
Entra Internet/Private Access bundled with E5 - good-enough SSE at marginal cost for Microsoft-centric shops
Zero Trust/SASE on a massive edge network, priced aggressively; strong with developers and mid-market
Historically a partner; Red Canary MDR and the FY27 SecOps push put ZS into direct competition in the SOC
FortiSASE riding its huge firewall installed base; wins on price and unified hardware+cloud story
Cisco Secure Access + Splunk SecOps; broad enterprise reach, slower innovation cadence
Harmony SASE (ex-Perimeter 81); legacy installed base defends rather than attacks