Zscaler: A Long-Term Winner In Cybersecurity (NASDAQ:ZS) | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacking | #aihp

Looking at cloud software, many of the best companies provide software to enterprise-level companies. More specifically, enterprise-level companies offering a service that’s effectively mission-critical, or so deeply ingrained in operations that companies are loathe to cut back spending. Churn is lower, and once the foot is in the door, it’s easier to spread to other large companies based on the brand recognition. Cybersecurity definitely counts as a mission-critical service. These software products are something companies want to spend whatever they need to, so they don’t have to worry about security risks.

However, hybrid work and the shift to cloud represents new risks. With workers logging in from anywhere around the world and the absence of a blocked off internal server architecture, the door is opened to bad actors.

Zscaler (NASDAQ:ZS) fills an important need there. The company’s two main segments, ZIA (Internet Access) and ZPA (Private Access) contain many individual solutions aimed at improving the security posture of companies beyond a traditional firewall. Scale is everything in cybersecurity. Companies want to be able to trust the solution by seeing successful use cases, and the more data a cybersecurity company has on potential threats, the more effective they are in preventing attacks. The overall cybersecurity market is estimated by Fortune Business Insights to grow from $163.6B in 2022 at a 13.8% CAGR to $424.97B in 2030. Zscaler is growing much faster than that, as it takes over from legacy providers. Here’s some discussion from a recent earnings call:

As you know, every company has some kind of legacy solution for internet gateway or even VPN access. Those are the two starting points for us. ZIA starts with replacing some kind of secure web gateway and ZPA starts replacing some kind of VPN, then expands from there. So almost all of business we do starts by replacing something, except — well, upsell too. Actually, if you look at our upsell, that means we may have ZIA some pieces deployed. We may be upselling to replace [ZLT] of some vendor or we may be replacing VPN some vendor or some of other stuff. So almost all business is replacement for us.

You can call some of the stuff expansion. For example, when customers want to have direct access to applications sitting in Azure and AWS without going through the data center, we’re still replacing some of the upselling in the data center and some of the direct connects they may have bought. So, it’s replacement of a bunch of point products into a fewer interior offerings. That’s really where the savings come from, that’s where the simplicity and operational ease comes from.

Looking at where Zscaler’s offerings rank out among peers, G2 has them among the highest performers in customer satisfaction, but behind Cisco (CSCO) and Symantec in market presence. However, the considerable growth rates the company is driving currently should improve the market presence over time. Here’s a use case from the earnings call, which I always find useful when researching companies:

In one such new logo win, we’re excited to partner with an innovative retail leader that’s using facial recognition technology and cashless checkouts to redefine their future store experience. This is a significant win for us as retail was a smaller vertical for us historically, where we are now enabling new digital transformation possibilities. This retail company committed to an 8-figure total contract value for a multi-phase ramp to secure over 90,000 ZIA users, 20,000 ZPA users and 400 petabytes per month of data from their 20,000 retail store operations. This customer had bought a firewall-based SASE solution which failed to scale as well as expanded their attack surface. Leveraging our highly scalable and reliable Zero Trust Exchange platform, they will use ZIA to create direct internet access for employee tablets and terminals, while using ZPA to secure private access for store managers. Additionally, Zero Trust for Workloads will secure all traffic from cameras and terminals in the retail stores to the cloud. Workload protection accounts for approximately 40% of the total deal value.

Recent earnings were solid. The company drove 52% revenue growth year over year, with billings up 34% or 45% sequential. Zscaler maintained a net revenue retention of over 125% showing continued strong expansion among existing customers and accounting for churn. Customers over $1M ARR grew 51% yoy to 380 and customers over $100K grew to 2337 out of the company’s total ~6,700 customers.

However, the growth doesn’t come cheaply. Operating expenses were up 44% yoy and 6% sequentially, leading to a 380 bps improvement yoy in operating margin. Looking above, hiring has almost exactly kept pace with revenue growth over the past few years as the company seeks to continue grabbing market share. Cybersecurity is a bleeding-edge type space where companies have to invest heavily to stay ahead of both competition and bad actors, and Zscaler appears to be expanding its R&D and selling footprint at the same pace it’s growing revenue as a rule. With a headcount rise, stock-based compensation has actually increased at an even faster clip, although the slope appears to have moderated into this past year.

Headcount has doubled in the past 18 months, and the company is now reducing its workforce by 3%. This hasn’t stopped hiring, however. Management discussed on the earnings call effectively cutting back in some areas while continuing to invest heavily in R&D and selling capabilities, with the expectation headcount would be higher by year-end.

For the full year, the company is projecting revenue growth of 43% with a mix of 60% upsell and 40% new customers and a 350 bps operating margin improvement to a non-GAAP 13.7%. Similar to other cloud earnings calls, management discussed more hesitance in spending and lengthening of deal timelines. However, as the macro improves, cybersecurity is not something companies will typically pinch pennies on.

However, something that caused me to raise my eyebrows a little was the “long-term” operating margin target of 20-22%. The company never talks in GAAP terms, so I have to assume they mean non-GAAP. It’s not clear what will change, but stock-based compensation sits at 32% of revenues today. That would mean the long-term operating margin target would still be a negative real operating margin.

However, the good news is cloud software companies tend to improve margins over time as a matter of course. The infrastructure to run the operation becomes cheaper per revenue dollar as more companies sign on, leading to gross margin expansion and thus operating margin expansion.

Looking at valuation and across the cloud landscape operating metrics, Zscaler is cheaper than average on a growth-adjusted basis. Looking just below and to the right of the curve, ZS is in the company of companies like Monday.com and Bill Holdings. Zscaler is cheaper on a growth-adjusted basis than peer CrowdStrike (CRWD), a notable leader in cybersecurity.

Breaking down some other operating metrics, the company is currently trading at 7.3X next twelve months’ revenue compared to the high growth median of 6X, which seems appropriate given Zscaler’s market position. Margins are relatively in-line with peers, with operating margin of -23% not ideal but expected given the breakneck pace of revenue growth. The company’s rule of 40 sits at 52% on a next twelve months basis, which is good to see. Surprisingly, Zscaler actually spends less as a percentage of revenues on R&D than the median at 23%, but more on sales and marketing at 65% of revenues. Finally, stock-based compensation of 32% is rough, but I’d expect to see that moderate over time as the company achieves scale.

In all, Zscaler is becoming a market leader in a lucrative industry. The company is very obviously shunning profitability in favor of growth and market share, while spending heavily on stock-based compensation provides the company with free cash flow to continue operating. With $1.9B in cash on the balance sheet, there are no liquidity concerns. As growth slows, which it inevitably will, I’d like to see some more clarity in management’s long-term operating margin targets and for stock-based compensation to come down as a percentage of revenues over time. However, for now, I’m happy with the solid revenue growth and the promise of future profitability. Management has plenty of levers to pull if needed to bring expenses in line. Zscaler is a buy for growth portfolios on a long-term time horizon.