Zscaler, Inc. (NASDAQ: ZS) — The Momentum Left, the Moat Stayed

Independent Equity Research Note Report date: 2026-06-14 · Sector: Cybersecurity (Cloud Security / SSE / Zero Trust) · Fiscal year ends July 31 Price referenced: ~$129.52 (close 2026-06-12). All figures reconciled to SEC filings (CIK 0001713683) and company disclosure unless noted.

⚡ Claude’s Take

This block is the author’s own independent opinion and general information only — not investment advice and not a recommendation to buy or sell any security. The analysis that follows (Sections 1–15) takes no position and carries no price target; it discusses valuation only as embedded expectations. Do your own research.

Verdict: ACCUMULATE-ON-WEAKNESS / show-me HOLD. Medium conviction. The falling-knife phase is essentially over; the bubble has been wrung out, but the discount is now fair, not generous. I’d frame a fair-value zone of roughly $140–185 (≈7–9x FY27 EV/sales, ~22–26x normalized EV/FCF), with an aggressive accumulation zone below ~$120 and a trim zone above ~$200 absent a growth re-acceleration. At ~$130 you are paid to wait but not richly compensated for the central risk.

Here is the tension in one breath: Zscaler is a genuine category-defining franchise — it invented the cloud-native Security Service Edge (SSE) / zero-trust proxy and still runs the largest security cloud by volume — yet its stock fell ~61% from a $336 momentum peak (Nov-2025) to ~$130 even as revenue grew ~25%, ARR reached $3.5B, non-GAAP operating margin hit an all-time-high 23%, and free cash flow approached a ~$1B run-rate. That is a multiple reset, not a fundamental collapse. The market correctly de-bubbled a stock that briefly traded as an AI-momentum lottery ticket; the FactorsToday tape confirms it — ZS now loads negatively on Momentum (−0.22 to −0.42) and negatively on Quality (−0.35 to −0.45), the textbook signature of an abandoned former darling, with relative strength in the bottom decile (RS_12m −57). The crowd that owned it for the chart has left. What’s left is a high-beta cybersecurity compounder at ~6x EV/sales — cheaper than its own history (composite ~39th percentile) and roughly a third of CrowdStrike’s multiple — for an investor who wants the moat, not the momentum.

But the de-rating was not irrational, and that is why this is a HOLD and not a fist-pounding BUY. Management gave an unusually early FY27 growth guide of just 16–17% — a sharp step down from the mid-20s — net retention has structurally fallen to 115% (from ~125%+), organic net-new ARR ex-the-Red-Canary-acquisition grew only ~7–14%, two senior sales leaders just departed, and the FCF-margin guide was cut on capex inflation. The bull catalyst (agentic-AI security, Zero Trust Everywhere, data security) is real and compounding, but management openly defers its P&L impact to FY27+. So you are underwriting a show-me story: is 16% the floor that the new AI pillars re-accelerate off, or the first step down as Microsoft/Palo Alto/Cloudflare commoditize the core proxy? Framing: a quality-compounder-at-a-finally-fair-price / early-contrarian re-rating candidate — no longer a falling knife, not yet a fat pitch. Founder-CEO Jay Chaudhry’s 16.8% stake and the ~$1.8B net-cash balance sheet are the downside ballast; ~25%-of-revenue stock comp with no buyback is the slow leak.

Conviction: Medium. Flips bullish if FY27 organic net-new ARR re-accelerates (NRR back toward 120%, ex-M&A net-new growth >15%) — proof the AI pillars are additive, not just offsetting core erosion. Flips bearish if NRR breaks below ~112% or the new sales-leadership transition produces a guidance miss — evidence that 16% was a ceiling, not a floor. Tag: “The momentum left the building; the moat stayed — now you find out if the franchise can still grow without the hype.”

1. Executive Summary

Zscaler is the purest large-cap expression of the secure-access shift away from the network perimeter. Its Zero Trust Exchange brokers ~half a trillion daily transactions, inspecting traffic in the cloud rather than backhauling it to on-prem firewalls — a model it pioneered and that has since become the industry’s reference architecture for “zero trust.” On the numbers it is a high-quality software franchise: ~77% GAAP / ~80% non-GAAP gross margins, ~$3.5B ARR growing ~25%, ~$0.9–1.0B trailing free cash flow (~30% margin in FY25), ~$1.8B net cash, and a founder-CEO who owns 16.8% of the company.

It is also a stock that has just lived through a violent sentiment cycle. ZS roughly doubled into a $336 closing peak on 2025-11-03 on AI/zero-trust euphoria, then de-rated ~61% to ~$130 by mid-2026. The crash compressed EV/sales from the mid-teens to ~6x — below its own multi-year norm and a fraction of CrowdStrike’s ~22x — without any collapse in the underlying business. This is the heart of the situation: the price action looks like a disaster; the fundamentals look like a deceleration.

The deceleration is real and is the legitimate core of the bear case. FY27 was guided early to just 16–17% growth, dollar-based net retention has fallen to 115% (from ~125%+), and organic net-new ARR — stripping out the ~$127M ARR bought via the Red Canary acquisition — grew only ~7–14%. Free-cash-flow margin guidance was cut (to 22.8–23.3% for FY26) on an AI-component capex spike, two senior sales leaders departed at the end of Q3 FY26, and competition from Microsoft, Palo Alto Networks, and Cloudflare is a persistent overhang. Against that, the bull case rests on a genuine second act: Zero Trust Everywhere (700+ enterprises, 2–3x ARR uplift on conversion), Data Security ARR past $500M (+30%), AI Protect, agentic-security via Red Canary/Symmetry, and metered/usage-based ARR up 100%+ — new pillars that management says will move the P&L in FY27 and beyond.

This memo argues that Zscaler possesses a real but narrowing moat (switching costs + a genuine global-cloud scale/data advantage, partially eroding as the SSE category matures and bundled competitors arrive), is a structurally attractive but increasingly contested industry, generates high-quality cash economics masked by GAAP losses that are entirely stock-comp-driven, and has allocated capital adequately but unimpressively (sensible all-cash tuck-ins, but ~25%-of-revenue SBC with no offsetting buyback). The valuation now embeds modest expectations relative to the franchise — but those expectations are anchored to a 16% growth world that the company itself just endorsed, so the cheapness is conditioned on that floor holding. No recommendation or price target appears below; the analysis frames what the ~$130 price is underwriting and what would prove it right or wrong.

2. Business Overview

What it does. Zscaler operates the Zero Trust Exchange, a globally distributed, cloud-native security platform that sits as an inline proxy between users/devices/workloads and the applications they access. Rather than routing traffic back to a corporate data-center stack of firewalls and VPN concentrators, Zscaler terminates and inspects connections in ~150 data centers worldwide, applies policy (threat prevention, data-loss prevention, access control), and forwards only sanctioned traffic. The architectural claim — “the internet is the new corporate network, so security must live in the cloud” — is the company’s founding thesis and the reason it is treated as the category creator of Security Service Edge (SSE), the security half of the SASE (Secure Access Service Edge) framework.

Core products. Two flagship services anchor revenue:

• Zscaler Internet Access (ZIA) — secure access to the internet and SaaS; the original secure-web-gateway/proxy business.
• Zscaler Private Access (ZPA) — zero-trust access to internal/private applications, the VPN-replacement product.

Around this core, Zscaler has layered a widening portfolio that is the crux of the forward story: Zscaler Digital Experience (ZDX) (digital-experience monitoring), Data Protection / Data Security (DLP, CASB, DSPM — ARR now >$500M), AI Protect and Mythos (securing enterprise AI usage and frontier-model vulnerabilities), Zero Trust Branch / Zero Trust Cloud (extending the model from users to branches and workloads), Posture Control / CNAPP, and an emerging agentic-security / SecOps stack assembled partly through M&A (Avalor data fabric, Airgap segmentation, Red Canary MDR, SquareX browser security, Symmetry Systems data-access graph).

How it makes money. Zscaler sells multi-year subscriptions (typically 1–4 years, billed often annually upfront), priced historically per-user/per-seat and increasingly via metered/usage-based and bundled “Z-Flex” platform commitments. Revenue is ~entirely subscription-and-support and is recurring and ratable — recognized over the contract term, with cash collected ahead of recognition (hence $2.1B current deferred revenue and $6.5B RPO). Land-and-expand is the model: win a beachhead (often ZIA or a VPN-replacement ZPA deal), then cross-sell additional pillars, driving the historical net-retention engine.

Segmentation. Zscaler does not report product-level revenue segments; it discloses a single subscription revenue line plus geographic splits (Americas ~50%+, EMEA, APJ) and a battery of operating KPIs (ARR, net-new ARR, customers >$100K and >$1M ARR, NRR, RPO). End markets span essentially all verticals and the public sector (FedRAMP-authorized; federal is a current bright spot), skewed toward large enterprises — ~4,500 of a stated ~20,000 target enterprise accounts are customers, with >9,400 total customers, 4,003 above $100K ARR and 748 above $1M ARR.

Operating KPI dashboard (the metrics that actually move the thesis). Zscaler runs on a well-defined KPI suite; the recent trajectory tells the whole story in one table:

The single most important line is net-new ARR ex-Red Canary (+7%/+14%): it is the cleanest read on the organic health of the franchise, and it is decelerating faster than the 25% headline. The single most reassuring line is non-GAAP operating margin at a 23% record — proof the model scales. The tension between those two lines is the investment debate.

Verdict (Business Overview). A focused, high-margin, recurring-revenue platform company executing a deliberate expansion from a two-product proxy into a broad zero-trust/security-platform suite. The revenue model is high-quality (recurring, prepaid, ratable); the strategic question — addressed below — is whether the expansion products can outrun the maturation of the original ZIA/ZPA core, which management now characterizes as only “mid-teens” growth.

3. Industry Dynamics

Structure and profit pools. Cybersecurity is a structurally attractive industry: secular demand growth (threat escalation, cloud migration, regulatory pressure, and now AI-driven attack surfaces), high gross margins, sticky recurring revenue, and a customer base that treats security as non-discretionary. Within it, the SSE/SASE / zero-trust sub-sector is among the faster-growing pools, displacing a large installed base of legacy hardware (on-prem firewalls, VPN concentrators, secure-web-gateway appliances) and proxy point-products. Third-party market sizing puts SSE/SASE in the high-single-digit to low-double-digit $ billions and growing ~20%+ — a multi-year displacement runway that supports Zscaler’s claim to a long TAM (it cites a $70B+ serviceable opportunity across its expanding platform).

Competitive intensity — rising. The category Zscaler created is no longer uncontested. The competitive set spans three overlapping fronts:

1. Pure-play / cloud-native SSE: Netskope (recently public), Cloudflare (NET) — both pressing on price and on developer/edge-native architecture.
2. Platform bundlers: Palo Alto Networks (Prisma SASE, the “second-wave” challenger leveraging its firewall base — SASE ARR ~$1.6B growing ~40% per company disclosure), Cisco, Fortinet (FTNT, converged networking+security), and Check Point. These vendors fold SSE into broader platform deals, pressuring stand-alone SSE pricing.
3. The hyperscaler overhang — Microsoft: Microsoft’s Entra (Global Secure Access / Internet Access / Private Access) bundles zero-trust networking into E5/security SKUs the customer already owns. This is the single most-cited structural threat: not necessarily a better product, but a “good-enough, already-paid-for” bundle that can cap Zscaler’s pricing and slow net-new logos in cost-conscious IT-budget cycles.

Value chain and switching costs. Zscaler sits inline in the traffic path, which is simultaneously its moat and its vulnerability. Inline deployment creates real operational switching costs — ripping out a proxy that every user’s traffic flows through is disruptive and risky — but it also means competitors with an existing inline position (firewall vendors, Microsoft’s identity layer) can contest the seat. Barriers to entry are moderate-to-high: building a global, low-latency, high-availability inspection cloud with the requisite peering, data-center footprint, and threat-intel data loop is genuinely hard and capital-intensive (a Greenwald supply-side/scale advantage). But the barrier protects the category, not necessarily Zscaler’s share of it, now that the best-capitalized software companies on earth have decided SSE is strategic.

Where we are in the capital cycle (Marathon lens). The SSE land-grab drew enormous capital and a flood of entrants during 2020–2022; the 2025 momentum peak marked the sentiment top. We are now in the phase where high returns have attracted competition and growth is mean-reverting — Zscaler’s own deceleration to mid-teens core growth and 115% NRR is the visible symptom. This is a maturing, still-growing pool where the rate of value creation is normalizing and pricing discipline matters more than land-grab velocity.

Verdict (Industry). Structurally good, increasingly contested. The secular tailwind is intact and the displacement runway is long, but the category has matured from “blue-ocean creation” to “share contest with the largest platforms in software.” That shift is precisely what compressed both Zscaler’s growth rate and its multiple. Attractive industry; less attractive competitive trajectory than three years ago.

4. Competitive Position

Name the moat. Zscaler’s advantage is a combination of two genuine mechanisms plus one weakening one:

1. Switching costs (real). As an inline, policy-laden, organization-wide proxy, Zscaler is embedded in daily operations. Migrations are multi-quarter projects; the deeper a customer goes (multiple pillars, DLP policies, ZPA app-segmentation), the higher the rip-out cost. This is the moat that shows up financially as 115% net retention and ~90%+ gross retention.
2. Scale / data advantage (real but narrowing). Operating the largest inline security cloud by traffic volume yields a data flywheel — more traffic inspected → better threat intelligence → better efficacy → more traffic. This is a defensible supply-side scale advantage (Greenwald’s strongest category when paired with customer captivity) and is hard for sub-scale pure-plays to replicate. It is narrowing only because Microsoft and Palo Alto operate at comparable or greater data scale across adjacent telemetry.
3. Brand / category leadership (eroding at the margin). Zscaler = “zero trust” in the enterprise buyer’s mind, repeatedly a Gartner SSE leader. Valuable in RFPs, but brand premium compresses as bundlers offer “good-enough at no incremental cost.”

The financial test of the moat. A moat must show up in numbers that would deteriorate without it. Zscaler’s do: ~80% non-GAAP gross margin, NRR that — even de-rated — remains a healthy 115%, gross retention in the low-90s%, 748 customers paying >$1M, and Zero Trust Everywhere conversions delivering 2–3x ARR uplift as customers standardize on the platform. The Z-Flex platform-commitment construct (>$1B trailing-12-month TCV, ~4-year terms, 8-figure typical deals) is direct evidence of customer captivity — enterprises pre-committing large multi-year budgets to the platform. These are moat signatures, not commodity-vendor metrics.

The counter-evidence (pressure-test). Three facts argue the moat is narrowing:

• NRR fell from ~125%+ to 115%. Expansion is the moat’s cash register; a structural step-down means existing customers are buying less incremental per year — whether from budget scrutiny, competitive substitution at the edges, or simple law-of-large-numbers maturation.
• Organic net-new ARR is soft. Ex-Red Canary, net-new ARR grew only ~7% (Q2) / ~14% (Q3) — the platform is adding new dollars slowly without M&A help, and new-logo acquisition is an area management concedes “we can do better.”
• The core is mid-teens. Management’s own characterization of ZIA+ZPA core ARR as “mid-teens” growth implies the original moat product is maturing; the thesis now depends on new pillars carrying the load.

Direct comparison. Versus CrowdStrike (endpoint/SecOps, the highest-quality comp), Zscaler grows similarly but trades at a third of the multiple and carries weaker GAAP optics. Versus Palo Alto / Fortinet, Zscaler is purer and higher-margin but lacks their GAAP profitability and installed firewall base to cross-sell from. Versus Cloudflare/Netskope, Zscaler is larger, more profitable, and more enterprise-entrenched but less developer/edge-native. Versus Microsoft, Zscaler is the specialist’s best-of-breed answer to a generalist’s good-enough bundle — a durable but perennially pressured position.

Greenwald market-share-stability test. The cleanest test of a moat is whether market shares are stable (incumbents rarely displaced) — instability signals the absence of competitive advantage. Zscaler passes within its installed base (90%+ gross retention, multi-quarter rip-out costs, 2–3x ARR uplift on platform standardization) but is showing strain at the frontier (new-logo weakness, 115% vs. 125%+ NRR, EMEA share softness). Read through Greenwald’s taxonomy, Zscaler has a genuine economies-of-scale advantage tied to customer captivity — the strongest and most durable category — in its core inline cloud, but only a weak/contested position in the newer adjacencies (SecOps, data, browser) where it is the challenger, not the incumbent, and where switching costs are lower. The moat is therefore real where it is deep (the proxy) and thin where it is new (the second act) — which is exactly why the forward growth question is so finely balanced: the company is trying to grow fastest precisely where its moat is shallowest.

Verdict (Competitive Position). A durable but narrowing moat — switching costs plus genuine cloud-scale, partially offset by maturation and the arrival of bundled competition. This is not a crowded-market commodity vendor; it is a category leader whose advantage is real and cash-generative but is being slowly compressed at the edges. The moat justifies a premium to the market; the narrowing justifies why that premium has shrunk.

5. Growth History and Forward Opportunities

History — a decelerating compounder. Zscaler’s revenue trajectory is the story of a hyper-growth company reverting toward maturity:

*FY26 FCF reflects the cut margin guide (22.8–23.3%) on pulled-forward AI-component capex; normalized FCF margin is closer to ~27–30%.

Two things stand out: growth has decelerated every year since FY22 (a normal, mathematically inevitable path for a scaling SaaS business), and FCF margin has expanded through the deceleration — the hallmark of improving unit economics and operating leverage. The forward shock is the FY27 early guide of 16–17%, delivered unusually early (at Q3 FY26) and well below the ~24% the company was still printing.

Quality of recent growth. Mixed and partly inorganic. Headline ARR growth of ~25% is flattered by the Red Canary acquisition (~$127M ARR). Ex-Red Canary, ARR grew ~21% and net-new ARR only ~7–14%. So the underlying organic engine is decelerating faster than the headline suggests — an important quality caveat. Offsetting positives: net-new ARR did re-accelerate modestly off easy comps (1H ex-RC net-new +10% vs +1% prior year), non-seat/metered ARR grew 100%+, and the new pillars are scaling fast off small bases.

Forward opportunities (the second act). The bull case is a portfolio of emerging pillars, each disclosed with momentum:

• Zero Trust Everywhere: 130+ → 550+ (Q2) → 700+ enterprises (Q3) standardizing on the full platform, with 2–3x ARR uplift on conversion — the single most important expansion lever.
• Data Security ARR > $500M, +30%+ — a credible second leg leveraging the inline position for DLP/DSPM.
• AI / Agentic security: AI Protect bookings past $100M T12M; Mythos (frontier-model vulnerability); Red Canary + Symmetry building an agentic-SecOps stack. Management explicitly defers material P&L impact to FY27+.
• Z-Flex platform commitments: >$1B trailing-12-month TCV — pulling forward large multi-year budget commitments.
• Public sector / federal: FedRAMP-authorized; an 8-figure federal upsell in Q3 and cited as net-new strength (a differentiator vs. some peers).
• Zero Trust Branch / Cloud / IoT-OT: extending the model beyond users to branches and workloads; Branch ARR ~tripled YoY.

Verdict (Growth). Decelerating but still-healthy growth of mixed quality. The core is maturing to mid-teens; the headline is M&A-assisted; but the new pillars are genuine and large enough to matter. The investable question is binary and unresolved: do the new pillars re-accelerate total growth above the 16% guide (bull), or merely cushion the core’s decline toward the low-teens (bear)? The next two-to-three quarters of organic net-new ARR and NRR will answer it.

6. Financial Quality

Revenue and margins. Revenue is ~entirely recurring subscription, ~77% GAAP gross margin (~80% non-GAAP), remarkably stable across six years — evidence the cloud platform scales without gross-margin erosion. Operating leverage is now clearly visible: non-GAAP operating margin reached an all-time-high 23% in Q3 FY26 (+140bps YoY), up from low-20s, while GAAP operating margin improved from −30% (FY21/22) to −4.7% (TTM). The trajectory of GAAP losses narrowing toward breakeven while non-GAAP margins expand is the central quality fact.

The GAAP-to-cash bridge: stock-based compensation. Zscaler remains GAAP net-loss-making (FY25 net loss −$41.5M; 9-mo FY26 −$59.8M, EPS −$0.37), but this is entirely a stock-comp artifact, not cash burn. SBC was $661M in FY25 (~24.7% of revenue) and $610M in 9-mo FY26 (~24.9%) — larger than the entire GAAP operating loss. The company is robustly FCF-positive ($808M FY25; ~$0.9B TTM). The honest reading cuts both ways:

• Bull: GAAP losses overstate economic reality; on a cash basis this is a ~30%-FCF-margin business.
• Bear: SBC is a real economic cost. At ~25% of revenue with no offsetting buyback, it dilutes shareholders ~3–4%/year (diluted shares 135.7M FY21 → ~168M FY26). FCF that is ~30% of revenue but ~25% of revenue is handed to employees in stock is not the same as 30% margins accruing to owners. The correct lens is FCF after accounting for dilution — materially lower than the headline.

Free cash flow. The standout. FCF grew from $36M (FY20) to $808M (FY25), margin from 8% to 30%, even as growth decelerated — strong evidence economics improve with scale. The FY26 guide cut to 22.8–23.3% FCF margin is a genuine negative but is driven by a transient AI-datacenter component cost spike (memory/storage/processor inflation pulling capex from mid- to high-single-digit % of revenue), not a structural deterioration; normalized FCF margin is ~27–30%.

Balance sheet. Fortress-like. $3.54B cash + short-term investments against $1.70B of 0.00%-coupon convertible notes due 2028 (conversion price ~$439.52, well out of the money; capped-call cap $784.85) — i.e., ~$1.8B net cash and zero cash interest cost on the only funded debt. Current ratio ~2.0x. There is no liquidity or solvency risk; the balance sheet is a clear thesis support and a source of optionality (M&A, eventual buyback).

Returns on capital. Conventional ROE/ROIC are not meaningful (GAAP losses, and reported book equity is distorted by the accumulated deficit). The economically relevant return is on the incremental customer dollar: ~80% gross margin on expansion revenue with low incremental S&M on existing accounts implies very high incremental ROIC on retained/expanded customers — the moat’s financial fingerprint. New-logo acquisition economics are weaker and getting scrutinized.

The six-year margin and dilution ledger. The clearest way to see both the quality and the blemish is the multi-year bridge:

*Non-GAAP op margin approximate/blended from management disclosure. The story: GAAP operating margin has improved ~26 points in five years and non-GAAP margin has roughly tripled — unambiguous operating leverage. But SBC, while falling as a % of revenue (38% → ~25%), is still rising in absolute dollars and remains larger than the GAAP operating loss every year, and the diluted share count has risen ~24% (135.7M → ~168M) over the span. The franchise is becoming more profitable and steadily more diluted at the same time. An owner must net the two: a ~30% FCF margin minus ~25%-of-revenue SBC that is not bought back is a much thinner per-share cash yield than the headline implies.

Quality-of-earnings flags. (1) Non-GAAP excludes ~25%-of-revenue SBC — adjust for it. (2) ARR growth is partly inorganic (Red Canary) — track organic ARR. (3) The shift away from disclosing “calculated billings” toward ARR de-emphasizes a metric that was decelerating — a presentational tell worth noting. (4) Net income includes non-cash convert/capped-call accounting noise. (5) Working capital is a recurring source of cash (prepaid deferred revenue), which flatters OCF in growth years and would reverse if growth stalled — worth monitoring as growth decelerates.

Verdict (Financial Quality). High-quality cash economics wearing a GAAP loss costume, with one real blemish (SBC/dilution). Economics clearly improve with scale (margin expansion through deceleration). The business is genuinely ~30%-FCF-margin on a pre-dilution basis; the owner’s-eye margin is meaningfully lower until SBC is offset. Strong balance sheet removes financial risk from the thesis.

7. Capital Allocation

The scorecard: adequate, unspectacular, founder-disciplined.

M&A — sensible tuck-ins, no empire-building. Zscaler’s deals have been small, technology-and-talent-focused, and all-cash: Avalor (data fabric, 3/24), Airgap (segmentation, 4/24), Red Canary (MDR/agentic SecOps, $651.4M, 8/1/25 — the largest, adding ~$127M ARR), SquareX ($112.8M browser security, 2/26), and Symmetry Systems (data-access graph, announced 5/26, immaterial ARR). The strategy is coherent — buying capabilities for the agentic-security and data-security roadmaps rather than buying revenue at high multiples. The caveat: Red Canary carries elevated post-deal churn (flagged by management) and inorganically inflates the ARR growth rate, and the steady cadence of all-cash deals consumes cash that is not returned to shareholders.

No buyback, no dividend — the central capital-allocation weakness. Across the entire five-year corpus there is no share-repurchase program and no dividend. With SBC running ~25% of revenue and the share count rising ~3–4%/year, the absence of even an anti-dilution buyback means owners absorb the full dilution. A company generating ~$0.9B FCF with ~$1.8B net cash and a halved stock price is, on paper, an obvious candidate to begin offsetting dilution — its continued absence is a legitimate criticism and a potential future catalyst if introduced.

Compensation and incentives. Per the FY25 proxy: annual cash bonus tied to revenue, billings, and non-GAAP operating income; long-term PSUs tied to multi-year ARR growth plus time-vesting RSUs; no relative-TSR metric (a modest governance negative — pay isn’t explicitly linked to outperforming peers). Say-on-pay passed with 93.1% support (no controversy). Pay is heavily equity/SBC-weighted, consistent with the dilution issue above.

Insider behavior — founder is a holder, rank-and-file are sellers. Founder-CEO Jay Chaudhry owns 16.8% (~26.86M shares) and received no new equity in FY25; his selling is a trivial ritual sell-to-cover (~21,236 shares / ~$4.6M over 24 months, <0.08% of his stake) — effectively a holder, a meaningful alignment positive. Other insiders sold ~$133M over 24 months (routine S-code sales, RSU vesting), and — notably — there were zero open-market purchases by anyone during the ~61% drawdown. No insider stepped in to buy the collapse, which is a mild negative signal (or simply reflects that executives are already over-exposed to the stock via comp).

Verdict (Capital Allocation). Adequate and disciplined, but unimpressive for owners. Founder alignment is strong; M&A is sensible; the balance sheet is pristine. The dilution-without-buyback dynamic is the clear demerit — management runs the business well operationally but has not yet acted to convert FCF and a depressed share price into per-share value for shareholders. Intelligent capital allocation, graded on a curve, lands at a B−.

8. Changes and Headwinds — Last Two Years

Strategic / product. A decisive pivot from “ZIA/ZPA proxy company” to “zero-trust + data + AI security platform,” executed via the M&A cadence above and the launch of Zero Trust Everywhere, AI Protect, Mythos, Z-Flex (usage-based pricing), and an agentic-security push (“Project AI-Guardian,” expanded June 2026 with AWS, Google Cloud, and OpenAI). The pricing-model shift toward metered/usage-based (>30% of new ACV) is strategically significant — it can re-accelerate expansion if AI workloads drive consumption, but it also makes revenue less predictable.

Leadership. Material churn. New CFO Kevin Rubin (ex-Alteryx) replaced long-time CFO Remo Canessa (transition through 12/31/2025). CTO Syam Nair departed (7/2025). EVP Corp Strategy / director Raj Judge resigned (eff. 7/31/26). Most importantly, two senior sales leaders departed at the end of Q3 FY26 — the proximate trigger for management’s cautious FY27 framing and a key execution risk during the guidance-reset window.

Guidance and the de-rating. The defining event is sentiment, not operations: ZS peaked at $336 (Nov-2025) and fell ~61% as (a) the AI-momentum bubble deflated across high-multiple software, (b) management delivered a 16–17% FY27 early guide, © NRR de-rated to 115%, (d) the FCF-margin guide was cut, and (e) competition fears (Microsoft/Palo Alto/Cloudflare) intensified. Crucially, there was no breach disclosure, no accounting restatement, and no guidance miss — Zscaler has continued to beat-and-raise its near-term numbers. The crash is a re-rating of expectations and multiple, not a response to a fundamental break.

Headwinds entering FY27. (1) Sales-leadership transition risk. (2) Decelerating organic net-new ARR / 115% NRR. (3) EMEA softness (Q3 EMEA +16% vs Americas +31%). (4) New-logo weakness. (5) Capex/component-cost inflation pressuring near-term FCF. (6) AI upside is deferred to FY27+ while the deceleration is present-tense.

Tailwinds. (1) Federal/public-sector strength. (2) Data Security and AI pillars scaling. (3) Zero Trust Everywhere conversions. (4) All-time-high operating margins. (5) A balance sheet and depressed price that enable buyback/M&A optionality.

Verdict (Changes). On balance, thesis-neutral-to-slightly-negative near term, with a credible positive optionality tail. The leadership churn and growth reset weaken the near-term picture; the product/AI pivot and margin expansion strengthen the multi-year picture. The net is a business in transition — which is exactly why the stock is cheap and the outcome uncertain.

9. Risk Analysis (Risk Matrix)

Catastrophic-loss assessment. Risk of permanent capital impairment from here is low-to-moderate: net-cash balance sheet, ~$0.9B FCF, sticky recurring revenue, and a real moat make a zero-equity outcome implausible absent a trust-destroying breach. The realistic downside is opportunity cost / further de-rating (a value trap if growth keeps decelerating and the multiple compresses toward FTNT-like low-teens on lower growth), not a wipeout.

Verdict (Risk). The dominant risks are competitive (Microsoft/PANW) and growth-trajectory risks — both Medium-likelihood/High-impact and both already partly in the price. The tail risk (own-cloud breach) is low-probability/severe and unhedgeable. Financial-distress risk is negligible.

10. Valuation Discussion (Embedded Expectations)

No price target or recommendation. This section frames what ~$130 implies.

Where the multiple sits. At ~$129.52, market cap is ~$20.6B; net cash ~$1.8B; EV ~$18.8B. Against ~$3.17B TTM revenue and ~$3.33B FY26 guide, that is ~6.0x EV/TTM sales / ~5.6x FY26 EV/sales, and ~$0.9B TTM FCF / ~$765M cut-guide FY26 FCF implies ~20–25x EV/FCF. On the company’s own multi-year valuation history, the composite multiple sits around the 39th percentile (P/B 31st, P/S 46th, P/E n/a on GAAP losses) — cheaper than ~60% of its own history, but not a generational trough. This matters: ZS was always expensive (FY21 peak ~47x EV/sales), so 6x is cheap for ZS without being cheap in absolute SaaS terms.

Peer context (as-of dates noted; multiples move).

The read: ZS is the cheapest FCF-generative SSE/cloud-security leader on EV/sales except sub-scale SentinelOne — roughly a third of CrowdStrike’s and Cloudflare’s multiples, and below the slower-growing, GAAP-profitable PANW/FTNT. The discount is partly deserved (slower forward growth, GAAP losses, no buyback) and partly sentiment (it’s the abandoned momentum name). A skeptic notes the GAAP-profitable peers (PANW/FTNT) arguably deserve their premium on earnings quality; a bull notes ZS’s growth and FCF margin still exceed FTNT’s at half the multiple.

Embedded-expectations / reverse-DCF intuition. At ~$18.8B EV with ~$0.9B normalized FCF, the market is paying ~21x FCF for a business the company itself guides to ~16–17% near-term growth and ~30% normalized FCF margins. A simple scenario frame:

• Bear (multiple + growth both disappoint): growth fades to low-teens, NRR drifts toward 110%, multiple compresses to FTNT-like ~12–14x EV/FCF on ~$1B FCF → EV ~$13–15B → equity ~$15–17B → ~$95–105/share (a ~20–25% drawdown — the value-trap path).
• Base (16–17% growth holds, margins compound, multiple stable): FCF compounds to ~$1.1–1.2B over 2 years at ~20–22x → EV ~$23–26B + net cash → ~$150–175/share.
• Bull (AI/data pillars re-accelerate growth to 20%+, NRR recovers, buyback initiated): re-rating to ~28–32x FCF on ~$1.3B FCF → EV ~$37–42B → ~$235–270/share (toward the old highs; this is also roughly where sell-side $180–225 targets cluster, with upside).

The asymmetry is moderately favorable — the base/bull span is wider than the bear downside — but it is conditioned on the 16% floor holding. The single most important swing variable is organic net-new ARR / NRR: if it stabilizes, the base/bull cases dominate; if it keeps sliding, the bear case is the gravity.

A cleaner reverse-DCF walk. Strip it to fundamentals. Normalized FCF is ~$0.9–1.0B today on ~$3.3B revenue (~28–30% normalized margin). If revenue grows 16% in FY27 then fades ~1pt/year to ~10% by year five, and FCF margin expands ~100bps/year toward ~33% (operating leverage continuing), FCF reaches roughly ~$1.9–2.1B in five years. Discounting that stream at ~10% and applying a terminal ~20x FCF multiple (reasonable for a ~10–12% grower with 80% gross margins) yields an EV broadly in the $28–34B range — ~50–80% above today’s ~$18.8B EV. That is the base-case math behind the “de-rating overshot” view. The bear adjustment is mechanical and severe: hold growth at low-double-digits and compress the terminal multiple to ~14x (the FTNT/mature-software level), and the EV falls back toward ~$17–20B — i.e., roughly today’s price. The entire valuation gap between bull and bear is driven by two inputs — the durable growth rate and the terminal multiple — and both hinge on the same unknown: whether the AI/data second act re-accelerates the franchise or merely cushions a decelerating core. The reverse-DCF doesn’t resolve the debate; it localizes it. Note this analysis deliberately understates dilution — netting ~3%/yr share growth against the per-share outcome trims ~15% off the equity-value-per-share in every scenario, which is the quantified cost of the no-buyback policy.

What the market is pricing correctly vs. incorrectly. Correctly: the deceleration is real, SBC dilution is real, competition is real — the stock should not trade at 15x sales. Possibly incorrectly: extrapolating 16% as a permanent ceiling may under-weight the optionality of the new pillars and the federal/data/AI ramps; and the multiple may have overshot to the downside given the franchise’s FCF quality and balance sheet (the negative-momentum factor signature suggests forced/sentiment-driven selling, not fundamental repricing alone).

Verdict (Valuation). ~$130 embeds low-to-moderate expectations for a category leader — a fair price that requires the 16% growth floor to hold and offers genuine upside if the second act re-accelerates the franchise. It is priced as a “show-me” compounder, not as a broken business and not as a bargain.

11. Variant Perception

Consensus belief. Zscaler is a high-quality but decelerating SSE leader whose hyper-growth era is over; sell-side remains constructive (targets ~$180–225, i.e., 40–73% above spot) on the view that mid-teens growth + margin expansion + a cheap-vs-history multiple is an attractive risk/reward, while acknowledging competition and the growth reset. The market has voted with its feet (−61%), pricing a more pessimistic “growth keeps fading” view than the sell-side models.

Strongest bull case. The de-rating overshot. You can now buy the category-defining zero-trust franchise — ~80% gross margins, ~$1B FCF, ~$1.8B net cash, founder owning 16.8% — at ~6x sales / ~21x FCF, with a genuine second act (Zero Trust Everywhere 2–3x uplift, Data Security >$500M, AI/agentic security, metered pricing +100%) that management says inflects the P&L in FY27. The negative-momentum, negative-quality factor signature is the fingerprint of forced sentiment selling, not fundamental impairment — classic conditions for a contrarian re-rating once organic growth stabilizes. A buyback initiation would be the spark.

Strongest bear case. This is a maturing platform facing the two most dangerous words in software — Microsoft bundle — at the exact moment its own growth engine is sputtering: NRR down to 115%, organic net-new ARR +7–14%, core “mid-teens,” new logos weak, two sales leaders gone, FCF margin cut. The 16% FY27 guide is the first step down, not a floor; the AI “second act” is small, deferred, and unproven, while SBC bleeds owners ~3–4%/year with no buyback. At ~6x sales ZS is cheap-vs-its-own-bubble but still richer than slower peers that are GAAP-profitable; it can keep de-rating toward low-teens EV/FCF — a value trap.

The 3–5 assumptions that matter most:

1. Is 16% the floor or the first step down? (Organic net-new ARR trajectory.)
2. Does NRR stabilize at ~115% or break below ~112%? (The moat’s cash register.)
3. Does Microsoft/PANW bundling materially take share, or merely cap pricing at the edges?
4. Do the new pillars (AI/data/agentic) become additive growth, or just offset core erosion?
5. Will management finally offset SBC with a buyback given the cash and depressed price?

Falsification tests. Bull falsified if: NRR prints <112% and/or organic net-new ARR turns negative YoY over the next 2–3 quarters. Bear falsified if: organic net-new ARR re-accelerates >15% and NRR recovers toward 120%, proving the AI/data pillars are additive — or a buyback is announced.

The factor-positioning read (FactorsToday). ZS now loads as a high-beta cybersecurity-industry play (Industry: Cybersecurity 1.85, BetaFactor 1.75, Market 1.23) with negative Momentum (−0.22 to −0.42) and negative Quality (−0.35 to −0.45) loadings and bottom-decile relative strength (RS_6m −47, RS_12m −57; negative Sharpe at every horizon). This is the empirical signature of an abandoned former momentum darling — the trade is no longer crowded long; the systematic/momentum money has exited. For a contrarian, that is the setup for a re-rating if fundamentals stabilize; it is also a warning that there is no momentum bid to catch a falling knife if they don’t. The tape says “capitulation underway, not yet reversed.”

Verdict (Variant Perception). The most defensible variant view is that consensus (and the tape) is correctly skeptical but may be over-extrapolating the deceleration, given the franchise’s FCF quality, balance sheet, and credible (if unproven) second act. The edge, if any, is in correctly judging assumption #1 — and that judgment is genuinely uncertain today, which is why this is a medium-conviction, evidence-gated situation rather than a high-conviction call.

12. Fact vs. Interpretation Table

13. Open Questions

1. What is the organic (ex-M&A) net-new ARR trajectory into FY27 — stabilizing or still sliding? The single most important unknown.
2. Why exactly did the two senior sales leaders depart, and is GTM disruption a one-quarter reset or a multi-quarter drag?
3. How much of the 115% NRR erosion is competitive substitution vs. budget scrutiny vs. simple maturation? Each implies a different forward path.
4. What share is Microsoft Entra actually taking in net-new SSE deals, beyond anecdote?
5. Will management initiate a buyback to offset SBC, given ~$1.8B net cash and a halved stock?
6. Can metered/usage-based pricing re-accelerate expansion, or does it merely add revenue volatility?
7. What is the real post-acquisition churn on Red Canary, and does the agentic-security M&A stack integrate into a coherent second product engine?
8. Is 16–17% a conservative sandbag (Zscaler has a beat-and-raise habit) or a genuine read of demand?

14. What Must Be True

For the bull case (the de-rating overshot; this re-rates):

• Organic net-new ARR stabilizes and re-accelerates (toward/above 15%) as AI/data/Zero-Trust-Everywhere pillars become additive.
• NRR holds ~115% and recovers toward 120%; gross retention stays low-90s%.
• Margin expansion continues (non-GAAP op margin into the mid-20s%; FCF margin normalizes to ~28–30% post-capex-spike).
• Competition caps pricing at the edges but does not take core share; new logos recover.
• Optionally, a buyback begins to convert FCF into per-share value.
• Falsification test: NRR prints <112%, or organic net-new ARR turns negative YoY, over the next 2–3 quarters. Either kills the bull thesis.

For the bear case (value trap; keeps de-rating):

• Growth breaks below the 16% floor toward low-teens as core matures and Microsoft/PANW take share.
• NRR slides below 112%; new-logo weakness persists; sales transition produces a miss.
• AI “second act” stays small and deferred, offsetting rather than adding to growth.
• SBC dilution continues with no buyback; the multiple compresses toward GAAP-profitable peers’ low-teens EV/FCF on lower growth.
• Falsification test: Organic net-new ARR re-accelerates >15% and NRR recovers toward 120% (or a buyback is announced). Either kills the bear thesis.

The two falsification tests are mirror images and both resolve on the same observable: the next two-to-three quarters of organic net-new ARR and NRR. This is a situation that will be settled by data, not by narrative — which is the honest reason for a medium-conviction, accumulate-on-weakness posture rather than a table-pounding call in either direction.

15. Source Appendix

See ZS_source_appendix.md (Appendix B in the combined report) for the full source list with URLs and access dates.

The body of this note (Sections 1–15) takes no investment position and contains no price target; the sole exception is the clearly-labeled “Claude’s Take” block at the top, which is the author’s own independent opinion and general information only — not investment advice.

APPENDIX A — Standard Diligence Questionnaire

Zscaler, Inc. (NASDAQ: ZS) — supplemental diligence. Fact (F) / Interpretation (I) / Assumption (A) labeled where it matters.

General

What thoughtful questions have other investors asked about this company? The central debate is whether Zscaler’s growth deceleration (to a 16–17% FY27 guide) is cyclical/transitional or structural/competitive. Sharp investor questions cluster around: (1) the gap between headline ARR growth (~25%) and organic net-new ARR (+7–14% ex-Red Canary) — how much growth is bought vs. earned (F); (2) the NRR step-down to 115% and whether it stabilizes (F); (3) Microsoft Entra’s real (not anecdotal) share gains in net-new SSE deals (I); (4) whether usage/metered pricing re-accelerates expansion or just adds volatility; (5) why SBC stays ~25% of revenue with no buyback; and (6) whether the AI/agentic-security pivot is a genuine second growth engine or a narrative bridge over a maturing core.

Cyclicality & Earnings Nature

Are earnings at a cyclical high or low? Neither, cleanly. Revenue/ARR growth is decelerating from a high (mid-20s → mid-teens guide), while margins are at a structural high (non-GAAP op margin 23%, an all-time record, +140bps YoY) (F). So the growth rate is normalizing downward while profitability ramps upward — not a classic cyclical peak or trough.

Driven by the external environment or internal actions? Predominantly internal/secular, not macro-cyclical (I). Demand is secular (zero-trust adoption, cloud migration, AI security); the deceleration reflects law-of-large-numbers maturation + competition + a 115% NRR, not a recession. Some external sensitivity exists in large-deal timing and EMEA softness (F).

How stable are revenues? Very stable. ~100% recurring subscription, ratably recognized, prepaid (deferred revenue $2.1B current; RPO $6.5B, 46% current) (F). ~90%+ gross retention. Revenue visibility is among the highest-quality attributes of the business.

Outlook for products/services? Core ZIA/ZPA: “mid-teens” growth, maturing (F). Newer pillars (Data Security >$500M +30%, AI Protect >$100M bookings, Zero Trust Everywhere 700+ enterprises at 2–3x uplift, Z-Flex >$1B TTM TCV): high-growth off smaller bases, with P&L impact management defers to FY27+ (F/A).

How big will this market be? SSE/SASE/zero-trust is a multi-year displacement of legacy firewall/VPN/proxy spend, growing ~20%+; Zscaler cites a ~$70B+ serviceable opportunity across its expanding platform (F, company-sourced — treat as directional). Growing, global, multi-vertical incl. public sector.

Business Quality & Competitive Moat

Is the industry getting more or less competitive? More. The category Zscaler created now draws Microsoft (Entra bundles into E5), Palo Alto (Prisma SASE, +40% growth), Cloudflare, Netskope, Cisco, Fortinet (I/F). Maturing capital cycle — high returns attracted capital and growth is mean-reverting (Marathon lens).

How profitable is the business (ROIC, ROE)? GAAP ROE/ROIC not meaningful (GAAP losses; distorted book equity) (F). Economically, incremental ROIC on retained/expanded customers is very high (~80% gross margin on expansion with low incremental S&M) (I); new-logo economics are weaker. ~30% FCF margin (pre-dilution) is the cleanest profitability read.

How profitable is the industry — barriers to entry? High-margin industry; moderate-to-high barriers for the category (building a global inline inspection cloud is hard and capital-intensive — a supply-side scale advantage), but lower barriers to share now that hyperscalers/platform vendors contest it (I). Several well-capitalized competitors.

Can the business be easily understood? Yes, at the franchise level (cloud proxy replacing perimeter security; subscription economics) — though the product portfolio has grown complex and the KPI suite (ARR/net-new ARR/NRR/RPO, with M&A overlays) requires care to parse organic from inorganic (I).

Can it be undermined by foreign low-cost labor? No — it is IP/cloud-infrastructure, not labor-arbitrage-exposed. Competitive threat is from better-capitalized software rivals, not low-cost labor.

Do brands matter? Moderately. “Zscaler = zero trust” carries weight in enterprise RFPs and Gartner leadership, but the brand premium erodes as bundlers offer “good-enough at no incremental cost” (I).

What is the nature of competition? Best-of-breed specialist (Zscaler) vs. platform bundlers (PANW/Fortinet/Cisco) vs. good-enough incumbents (Microsoft) vs. cloud-native pure-plays (Cloudflare/Netskope). Competition on architecture, efficacy/data scale, platform breadth, and increasingly bundled price (F/I).

Customers’ switching costs? Real and high for the inline proxy — organization-wide traffic flows through it; rip-out is a multi-quarter, risky project. Deeper multi-pillar adoption (DLP policies, ZPA segmentation) raises costs further. This is the moat’s financial fingerprint (115% NRR, 90%+ gross retention) (F/I).

Financial Condition & Balance Sheet

Assets not fully recognized on the balance sheet? The data/threat-intelligence flywheel, brand, FedRAMP authorization, and customer relationships are valuable intangibles not on the balance sheet (I). RPO ($6.5B) is a contracted-but-unrecognized revenue asset disclosed in notes (F).

Off-balance-sheet liabilities? None material flagged. Standard operating-lease/data-center commitments; convertible-note/capped-call structures are on/disclosed. No pension, no material litigation reserve found (F).

How conservative is the accounting? Revenue recognition is standard ratable-subscription (conservative — cash leads revenue). The aggressive element is non-GAAP presentation that adds back ~25%-of-revenue SBC; investors must adjust (I). The shift away from disclosing “calculated billings” toward ARR de-emphasized a decelerating metric — a presentational tell (I).

How CapEx-hungry? Historically light (capex ~2–5% of revenue), but rising — FY26 capex pulled forward to high-single-digit % of revenue on AI-datacenter component inflation, cutting FY26 FCF-margin guide to 22.8–23.3% and adding up to 200bps in FY27 (F). Still far less capex-intensive than hardware peers.

Capital Allocation & Management

How much FCF, and how is it used? ~$808M FY25 (~30% margin), ~$0.9B TTM (F). Uses: all-cash M&A tuck-ins (Avalor, Airgap, Red Canary $651M, SquareX $113M, Symmetry) and balance-sheet accumulation. No dividend, no buyback — the central capital-allocation criticism (F).

Significant acquisitions recently? Yes — Red Canary ($651.4M, 8/2025, ~$127M ARR, MDR/agentic SecOps, elevated post-deal churn flagged); SquareX ($112.8M, 2/2026, browser security); Symmetry Systems (5/2026, data-access graph, immaterial ARR) (F). Strategy: buy capabilities for the agentic/data-security roadmap, not revenue.

Buying back shares? No (F). This is notable given ~$1.8B net cash, ~$0.9B FCF, and a halved stock — an obvious anti-dilution opportunity left unused.

Issuing large amounts of stock to insiders? Effectively yes via SBC — ~25% of revenue, diluting ~3–4%/yr (135.7M FD shares FY21 → ~168M FY26) (F). Founder Chaudhry, however, got no new equity in FY25 (F).

Compensation policy? Cash bonus on revenue/billings/non-GAAP operating income; PSUs on multi-year ARR growth + RSUs; no relative-TSR metric; heavily equity-weighted; say-on-pay 93.1% FOR (F). Mild governance negative (no TSR linkage), no controversy.

Motivations of management? Founder-CEO Jay Chaudhry owns 16.8% (~26.86M shares) and is effectively a holder (trivial sell-to-cover only) — strong alignment with long-term value (F/I). Rank-and-file insiders are routine sellers; no insider bought the ~61% drawdown — a mild negative signal (F).

Valuation & Market Data

ADR, MLP, or K-1 issuer? No — U.S. C-corp common stock, NASDAQ-listed, standard 1099 treatment. No K-1.

Dividend policy? None; no dividend paid or announced (F).

How profitable is the business? GAAP unprofitable (net loss); non-GAAP and cash-flow profitable (~30% FCF margin pre-dilution; 23% non-GAAP op margin) (F). The GAAP/cash divergence is the QoE story.

Is net income diverging from cash from operations? Massively, and favorably — net loss −$41.5M (FY25) vs. operating cash flow +$972M, a ~$1B gap bridged almost entirely by ~$661M SBC + D&A + working-capital inflows from prepaid deferred revenue (F). This is positive divergence (cash >> earnings), the opposite of a red flag — but it is driven by non-cash SBC that is a real economic cost.

Risks & Downside

What factors would cause the stock to decline? Growth below the 16% floor; NRR <112%; Microsoft/PANW share gains; sales-transition miss; continued multiple de-rating (high-beta, negative-momentum factor profile); AI second-act failing to monetize; persistent SBC dilution with no buyback (F/I).

Risk of catastrophic loss? Low-to-moderate. Tail risk is a breach of Zscaler’s own inline cloud (low probability, severe trust/impact) (I). Otherwise net-cash balance sheet + ~$0.9B FCF + sticky recurring revenue make a wipeout implausible.

Chance of a total loss? Very low (A). No solvency risk ($1.8B net cash, 0% converts far OTM); the realistic downside is opportunity cost / further de-rating (a value trap), not permanent zero.

Recent News & Events

Has the business environment changed recently? Yes — the defining change is the ~61% de-rating from the Nov-2025 momentum peak, plus an early FY27 guide-down to 16–17%, NRR to 115%, an FCF-margin cut, and senior sales-leadership departures (F). Recent news flow is positive: Project AI-Guardian expanded with AWS/Google Cloud/OpenAI (6/2026), new Zero Trust Exchange security solutions, and uniformly reiterated bullish sell-side targets ($180–225) (F).

Significant acquisitions / accounting changes / new markets? M&A as above (Red Canary/SquareX/Symmetry); no accounting restatement; pivot to usage/metered pricing (Z-Flex) and agentic-AI security as new growth vectors; deepening federal/public-sector and GSI-partner go-to-market (F).

APPENDIX B — Source Appendix

Zscaler, Inc. (NASDAQ: ZS) — sources, with access dates. Primary sources prioritized. All accessed 2026-06-13/14 unless noted.

Primary — SEC filings (EDGAR, CIK 0001713683; 5-year corpus mirrored locally)

• Form 10-Q, Q3 FY2026 (period ended 2026-04-30, filed 2026-05-26) — revenue, GAAP loss, SBC, RPO/cRPO, deferred revenue, ARR, customer metrics, convertible-note detail, capital structure. https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001713683&type=10-Q
• Form 10-K, FY2025 (period ended 2025-07-31, filed 2025-09-11) — full-year financials, risk factors, business description, segment/geography, MD&A.
• Forms 10-K FY2021–FY2024 — multi-year revenue, margin, SBC, cash-flow, balance-sheet trends.
• Forms 10-Q FY2021–FY2026 (16 filings) — quarterly KPI and financial detail.
• Forms 8-K (last 24 months, ~37 filings) — earnings releases (Item 2.02); CFO appointment (Kevin Rubin, 2025-05-26); Canessa transition (2025-06-09); CTO Syam Nair departure (2025-06-23); $1,725M 0.00% convertible notes due 2028 + capped calls (2025-06-30/07-03); EVP/director Raj Judge resignation (2026-04-15).
• DEF 14A proxy statements FY2021–FY2025 — executive compensation metrics (revenue/billings/non-GAAP operating income; PSUs on multi-year ARR growth; no relative-TSR), say-on-pay (93.1% FOR), Chaudhry ownership (16.8%).
• Forms 3/4/5 (insider, ~256 Form 4 + 7 Form 3 + Form 144 corpus; 87 Form 4s parsed for trailing 24 months) — zero open-market purchases; ~$133M routine insider sales over 24 months; Chaudhry effectively a holder (~$4.6M sell-to-cover, <0.08% of stake).

Primary — earnings call transcripts

• Q3 FY2026 earnings call (2026-05-26) — FY27 early guide (16–17%), NRR, net-new ARR, Zero Trust Everywhere, Data Security/AI ARR, FCF-margin guide cut, sales-leadership departures, M&A (Symmetry). Available via Zscaler IR and public transcript providers.
• Q2 FY2026 earnings call (2026-02-27) — Q2 revenue/ARR/RPO, Red Canary contribution, Z-Flex TCV, metered-pricing mix, guidance raises.

Quantitative data

• SEC EDGAR / XBRL — revenue, gross profit, operating income, net loss, stock-based compensation, operating cash flow, deferred revenue, convertible notes, and equity for ZS (FY2020–FY2025 + TTM/Q3 FY26), independently reconciled to the filings.
• Enterprise value, valuation multiples, and per-share/ratio data for ZS and peers (CRWD, NET, FTNT, PANW, S) derived from public market prices and the companies’ filings.

Market / price / factor data

• Public market price history (accessed 2026-06-14) — split/dividend-adjusted OHLCV; price path incl. peak close $336.27 (2025-11-03), current $129.52 (2026-06-12), all-time-high $368.78 (2021-11-19).
• Own-history valuation context — ZS’s current composite valuation sits around the 39th percentile of its own multi-year range (cheaper than ~60% of its history; P/E not meaningful on GAAP losses).
• Sell-side targets (2026-06-10) — reiterated price targets clustering $180–225 (RBC, Wedbush, Guggenheim, Cantor, Needham).
• FactorsToday (factorstoday.com, accessed 2026-06-13/14) — factor loadings (Industry: Cybersecurity 1.85, BetaFactor 1.75, Market 1.23, Momentum −0.22/−0.42, Quality −0.35/−0.45); leaderboard (y1 return −57%, m6 −45% (−71% ann.), 5y max drawdown −76%); relative strength (RS_6m −47, RS_12m −57); factor-similar peers (cybersecurity ETFs, CRWD, NET, RBRK, VRNS).

Peer / industry cross-reference

• Public filings and disclosures of Palo Alto Networks (PANW), CrowdStrike (CRWD), Cloudflare (NET), Fortinet (FTNT), and SentinelOne (S) for SASE/SSE competitive framing and peer valuation multiples.

All non-obvious facts trace to the primary sources above. Management commentary (transcripts, investor relations) is treated as a hypothesis and validated against filings, financials, and external data.