Call Start: 12:20 January 1, 0000 12:51 PM ET
Zscaler, Inc. (NASDAQ:ZS)
Bank of America 2023 Global Technology Conference Call
June 7, 2023 12:20 ET
Company Participants
Jay Chaudhry – Co-Founder, President, Chief Executive Officer & Chairman of the Board
Conference Call Participants
Tal Liani – Bank of America
Tal Liani
Great. So thank you very much for joining us. I’m hosting today, Jay Chaudhry from Zscaler. And I prepared a list of questions and I ask it every session. [Operator Instructions] And Jay, first of all, thanks for joining us.
Jay Chaudhry
Thank you.
Tal Liani
Great to host you here. I want to start from kind of the latest and greatest, you had great results, then you reported on some weakness or warned of some weakness, then you preannounced positively and had great results after. What creates this volatility?
Jay Chaudhry
So you mean, we had lots of strong quarters. Q2 was somewhat lower than our expectations. Q3 was strong again. The macro-environment has been fairly tight. There’s a lot of scrutiny. The cyber is in a much better position than many of the segments. If you can do cost consolidation, you’re in a good shape. In Q2, some of the larger deals we had, we couldn’t get through the business value justification done in the right time. So there was a little weakness in there but the engagement has been strong, pipeline has been strong in Q3. We refined our go-to-market process where we engage with C level sooner. We did more granular, more meaningful ROI cost savings justifications and that led to better results.
So record pipeline, lots of good engagements, literally no change in comparative point of view. We have a very strong technical win and making sure we get ROI piece done was the biggest change. But also, I think that some of the stuff was kind of wrong information spread by some of these funky channel checks, I always said, for years. We’re not a typical box security company sold by last ours. We had our transformation players sold at the C-level, CFO level, CTO level. And it’s a high-touch sale. So the more channel checks you do, the more wrong information you pick up.
Tal Liani
I am going to tell you what I’m telling the investors from the soldier to the general, ignore channel checks. They’re not accurate.
Jay Chaudhry
Yes. And I think you should think about it. If the world is changing, if transformation is happening across the board, don’t you think your process of checking things should change too. I mean I tell my company, if we are driving transformation, shouldn’t we be transforming all the time, and that’s what we do.
Tal Liani
So a few months ago, not long time ago, Gartner put out another magic quadrant, and you actually went down in the magic quadrant. Can you take us through — first of all, your response to it? And second, what is happening on the technical part about your competitiveness and others competitiveness and competition level in general.
Jay Chaudhry
It’s all my fault. I should have engaged with Gartner better in a nicer way. So first of all, see different analyst firms do what they do. To me, the most important check is our customers. Our customer checks are coming from when they are voting with their wallet, buying stuff, growing stuff with us. Gartner does this peer submissions, which is customers actually submit on Gartner’s portal in about 8 or 9 buckets, which vendor do you like for customer satisfaction, technology and whatnot. This is customer survey results. Zscaler is number 1 in 8 categories far more than anyone else out there. That’s number one.
Number two, I do believe I’ve made Gartner unhappy last year by saying that there are more weightage on CASB, DLP, less on cybersecurity. We think cybersecurity is important. It should get much weightage. The other areas, I think that we’re not accounted into is resilience performance, reliability of the cloud, which is fundamental. It’s becoming so critical that customers are actually telling me they’re not looking at some of these younger private companies because they don’t even know if they’ll be around or they can deliver the five 9s of reliability and all that kind of stuff. Those are important factors. And we respect Gartner, we listen to them, but I think we do what we think is best for the customer.
Tal Liani
So elaborate on what you just said. You said that it’s not — the focus is not on CASB, the focus is on cybersecurity. So assume that the audience here is not a security expert. I’ll try — let’s try to explain it in kind of plain English. What does it mean?
Jay Chaudhry
That’s good. So think a security, what Zscaler Pioneer was that notion of a switchboard. A user comes to us. We are like an international airport, we check who are you? Where are you going? We’re checking your boarding pass, your passport, your Visa and your luggage to make sure the right person gets on the right flight with safe luggage. So in that process, we do two things: Cyber, make sure nothing bad comes and infects you. Data protection, make sure nothing leaks out. Everything bad comes from the Internet, everything good leaks to the Internet. That’s what we do.
CASB was created so that there’s no over sharing on information from applications such as Salesforce, Office 365, Box and alike. you could give permission to share a big file at Box or Microsoft drive to somebody, it can leak out. That’s where CASB came from by making API calls now sitting in line. So CASB is a good feature. 8 years ago, the 100 CASB companies, they’re all gone away or sold or died. Why? Because it’s a feature. Now if they are left out, they’re trying to pivot, to pivot from feature to a platform to take all traffic and handle it is not a trivial task at all.
Now sometimes customer confuse between CASB and DLP. CASB is one feature of DLP. So data is not lost. But data gets lost to the Internet quite often. And someone like Zscaler, who is sitting in line is actually doing DLP. The biggest deployments or DLP in the market in large customers where we do very well is Symantec 1, 2 [ph]. We are replacing that in the past 3, 4 years, we have made our DLP offering extremely strong. DLP is getting bigger and broader. And we have positioned ourselves very well. We’ve done some acquisitions in the space as well. So while — and we have made investments to make our CASB offering strong as well. Did I answer the question?
Tal Liani
Absolutely. [Operator Instructions] The other question I have for you is when you look at ZIA, ZPA, your kind of core products in the market, one of them secures your applications in your data centers. One of them secures someone else’s application in the cloud, but there is a third market which is called CNAPP or it secures your application in the public cloud. Where are you in this market? Your competitor, Palo Alto, is having 2 products, Prisma Access, Prisma Cloud for these 2 markets. Where are you in the journey into securing your applications in someone else’s cloud?
Jay Chaudhry
Yes. So good question. So just rephrasing it. ZIA says when you access Internet or SaaS application, you do it safely, securely without getting compromised, without losing any data. Zscaler private access says, when you access applications, either in your data center or in our AWS wherever, you do them safely without needing VPN, without being on the network. CNAPP in our view, is part of protecting the cloud workloads. When you have workloads, you need 2 types of security. One is communication security, workloads are like users in many ways. They talk to Internet. They talk to other workloads. So we took ZIA and ZPA, which are designed for users and adapted to ZIA for workloads, ZPA for workloads. So all the communication is done safely. This is a very great innovation because the only competition in that communication area is legacy firewalls, nothing else. We are the only disruptive solution.
So this is about communication because that’s how you can get in fact or loose. CNAPP is about really protecting workloads, call it at rest through APIs. When workloads are created, you need to worry about a few things, configurations first. Maybe I’ll give you an analogy. If I go to a massive hotel or conference room, somebody needs to make sure different doors and windows and all that stuff is closed and open based on the use of that big conference hall is. So if you leave them open, that’s a security risk, that’s called misconfiguration for workloads. Workloads need to be configured properly. How do you check them? It’s hard. So you have a piece of software called CSPN to check these misconfigurations.
The second piece to ensure your workloads are secured is permissions. Taking the example of this big conference hall. If there are 5,000 guests going, some guests are allowed to go to a certain floor. Some guests are allowed to go to certain rooms. So you must do that properly for security reasons. Similarly, if you got 3,000 users, some of them are allowed certain permissions, some are allowed more, some are allowed less. There’s another piece called CIEM for permissions and all. So that’s an API based stuff. We did 2 acquisitions, brought them together. We have a CNAPP offering. But while there’s a big barrier to entry to do in-line communication that we do with ZIA, ZPA.
CNAPP is someone like CASB. It’s done by making API calls. There’s not a big barrier to entry with API calls. So we believe that the vendors will do well in CNAPP who get integrated with workload communication. So our highly differentiated workload communication combined with CNAPP offers us a good opportunity. We will not lead with CNAPP, so your channel checks may not show Zscaler competing CNAPP, but we are off selling CNAPP with our workload communication as a solution for protecting workloads.
Tal Liani
Palo Alto made 7 acquisitions in the CNAPP world in order to make their product more complete. Also, the process in CNAPP always starts in the developer community. Yesterday, we had someone the ex-Google that said there are 1,000 Creme de la Creme [ph], best of the best security executives at Google, security professionals at Google, but there are 40,000 developers. So even if you have the best security professionals, the risk is coming from the 40,000 developers who introduce risk to the network through development. So the question is, when you think about what’s called shift left and you think about security that needs to start in the DevOp environment, in the development environment, where is Zscaler in this concept of developer all the way to the cloud?
Jay Chaudhry
Yes. It’s a fairly complicated area to handle, okay? Where we come in, security typically has come in on the operational side to make sure things don’t get compromised. Yes, we have to worry more and more on the development side, but it’s very hard to see a company that selling to operational people, to sell improved developer people. We are moving left slowly. But I do think that it will be a challenge for any company to say, “I’m going to become a developer company”. They’re companies that start on the developer side. They have the core competency. They understand it. They work with them. And I think they’ll do well in the long run. They are trying to move right. Companies like us are trying to move left. I think there will be a right balance somewhere. CNAPP we offer is used by developers in certain stages, but doing some of the container level development security there is far more complicated than doing an acquisition of a company and say, I got the answer.
One has to worry about, do you spread yourself too thin like some of these private companies do, they copy Zscaler and going to say, we’ve got everything Zscaler has, okay? Or you need to say, I need to expand my platform, but to a degree, we’re wide enough, what I’m deep enough. We believe in being wide and deep. I’d rather not spread all the way across and have 3% market share in each area. I would have 6 things to offer with 25% market share than 12 things to offer at 5% market share. So we are moving shift left. We are taking advantage of it, but I can tell you that the market opportunity we have with the current customer base, without even succeeding in shift left is 6x of the ARR we have today. So we will — so there are certain bets you may, you expand, but that’s not my mission-critical area.
Similarly, when people talk about, are you going to expand down market, how big on, right? The dialogue I had with David Schneider, who was a CRO of ServiceNow about 6 years ago. I said, David. You’ve done this journey. You are a good role model for us. I want to learn from you. And one other thing I said, “Hey, I only have — at that time, 2,500 customers. And some of these firewall and low-end companies like Barracuda, they talk about 150,000, 200,000. And how do you get to that big number that’s so massive? He said, do you care about a number of customers? Or do you care about ARR? I said both. He said, “No, pick one. I said ARR, okay?
So we are focused on ARR growth. We have plenty of opportunity in the key adjacent markets we have and we are executing pretty well.
Tal Liani
Got it. Great. I’m going to take a pause for a second with technology discussion, talk about the environment and then go back to technology because I want to ease your expertise. How is the environment, meaning we are getting mixed views from companies. On one hand, SentinelOne is — forget the accounting, but they’re talking about the weakening environment. On the other hand, Palo Alto and yourself, you had good quarters. Where are we in the journey of deploying SaaS in the journey of deploying the other products when it comes to actual trends right now in the market or as of the last reported quarter.
Jay Chaudhry
Yes. So first of all, you are seeing us selling bigger and bigger bundles. So you’re seeing us doing consolidation. Consolidation is happening, it’s real. Zscaler for users is the bundle we introduced some 12 to 18 months ago, which actually has ZIA, ZPA, ZDX all 3 key areas for users and that bundle has exceeded our internal expectations, which is kind of says is what it is. It also tells you what I used to say years ago that we believe every user will be using from a given customer, ZIA, ZPA, ZDX. We’re seeing that stuff happening. Consolidation is happening out there. That’s point number one.
Point number two, there is scrutiny in the market. Scrutiny is not going away. If I could do business value justification, a year ago, where I did in year 1, year 2, year 3, that’s no longer sufficient. The CFO wants to say Q1, Q2, Q3, Q4? And what products are you replacing and how much money am I saving? So it’s there. And cyber remains an important part of it. But also if you engage at the C level, you have a better chance of getting your project approved and done or if you’re selling at a lower level because the lower-level stuff may not even make it to the CIO. The challenge we face is, generally, we are engaged the CIO level to make sure CFO gets approved. So I think we feel good about the market. I mean, as we are setting out there, we have a record pipeline. We had to become probably more thorough in engaging with the customer, better job. Let’s put it this way. We have to work harder and smarter in today’s environment to do — given our ACV than we did a year ago. okay? But the competition has become better in some ways. A lot of riff-raff has gone away.
15 months ago, one new start-up, I got this little shiny toy. That stuff is going away. And for the private companies are struggling to, the customers have asked me mission criticality of applications. It’s interesting. One CIO talked to me several months ago, he said, “Jay, congratulations. You are now selected as one of the 5 strategic vendors, partners for us”. And then he said I have to work hard for it. I said, what you mean? He said in a large company like ours, our spend has to be $50 million per year to be a strategic vendor and you guys are way below that. Then he smiled, and he said, I’m not sure you feel good about it, or bad about it. but it tells you how strategic we are.
Another CIO told me you are more strategic than Microsoft Office 365 because that is only one area, you are more strategic. So really for someone to come from a private company to build a platform because people are buying platform for consolidation and deliver resilience five 9s of reliability and be a viable bend [ph] in the long run is not a trivial task.
Tal Liani
Yesterday, we had here same seat. We had the CEO of SentinelOne. And when I asked him about the environment, he had some color for words to describe the environment, which I’m not going to repeat. I’ll only say in a nice way that we said that the environment is tough and pricing competition is getting tougher even. Is it only for endpoints? Or do you see it also in your own market that competitors are becoming maybe desperate or maybe more aggressive and pricing is coming down.
Jay Chaudhry
So this is what we’re seeing. We are getting technology win based on architecture and we get a clear win because our architecture is very good. And then there’s a pressure on pricing from us from procurement, okay? But generally, we don’t have a pressure directly coming from competitive products. I have seen many situations where the customer said, this vendor was here to offer 1/3 of the cost or half the cost, but this is a mission-critical application for me. I’m not trying to save a few dollars to take a risk. So we feel — don’t really feel a whole lot of competitive pricing pressure, though they do get used from time to time. But we do feel pressure from procurement to negotiate. So what that’s leading us is deals are getting more back-end loaded. They know when the quarter end is. So that part is happening out there, and that’s resulting in some time doing more ramp deals because we want to fit in the budget. At the same time, we want to charge for value because we do deliver a lot of value. And sometimes it changes payment terms. There’s pressure, but I think we’re doing pretty good.
Tal Liani
Got it. Great. I want to touch on another concept that is driving the industry and get your take on it, the concept of Zero Trust. What does it mean for those who don’t understand the concept, if you can, we can start with what does it mean practically? When someone says I want to adhere to Zero Trust. I want to be part of Zero Trust when a customer says it, what does it mean? And then what does it mean for Zscaler? How do you help customers to be part of Zero Trust?
Jay Chaudhry
It’s unfortunate that Zero Trust, such a great concept has been hijacked and really, it has lost its meaning. Though I’m not surprised because when a new technology comes and it disrupting incumbents, their bound to raise respond to do whatever they can do so they don’t get disrupted. I was in Washington, D.C. yesterday attend — I met with the Defense Department executive. And he said, you know this crazy zero-trust thing, we understand Zscaler actually is the real trust, but some of the legacies being mixed around all the time and we are getting delayed to roll out Zero Trust. Okay. It is interesting us to see the frustration on this IT leader, okay? Because even he feels it.
So what is Zero Trust? It starts with trust no one by default. Give minimum access to what people need to know. Here’s the best simple example. If I come to see you at your headquarters as a visitor, they’re going to stop me at the reception, check my ID, gave me a badge. There are 2 options. Option 1. Jay, go to 7 floor, room 23, that’s were meeting is. And I can go and wander around any hallway any open rooms and snoop around and not even go to meeting room and leave. That’s how network security works. Once you get on the network by being in the office or by doing a remote access VPN, you can see all kinds of stuff out there and do lots of damage, do lateral threat movement, that’s were most ransomware attacks happen. That’s what a firewall and VPN enables.
So how can you make them Zero Trust? You can’t. What is Zero Trust in my mataphor, they stop me at the reception, they check my ID, they gave me a badge and they said, “Yes, stop. You’ll be escorted to the meeting room and meeting room only. You don’t even need to know where the meeting room is. Your meeting happens, you get walked, escorted out, 1:1. So if you think of Zero Trust as a switchboard.”
A user comes to us; we validate identity as the starting point of Zero Trust, who are you? We can do device check, posture check the second piece of Zero Trust, and that’s where endpoint comes in. And then the policy engine that actually makes the one-to-one connection, that’s what we do. So that’s the core part of Zero Trust. Can you really make a firewall VPN Zero Trust. Absolutely not. Okay. Can you claim and try to spread misinformation? Obviously, because that’s part of our job. It’s unfortunate. The reason we are winning the biggest, the big deals because those people understand it, they are less misguided by it.
I mean, last quarter, and then maybe in Q2, we announced a large banking deal, one of the largest firewall customer. When it came to user protection, the bank said, “I love your firewalls for my data center servers”. But when it comes to protecting users, you need a proxy architecture, a multi-tenant architecture and with lots of traffic, so you can see what’s out there. 300 billion transactions a day, we are seeing all kind of threats out there with such a large volume. So once we see one issue with one customer. We protect that customer and apply that same protection for all of our customers.
Those are the type of things that really set us apart and Zero Trust won’t be built overnight. I had one vendor say, “Oh, yes, we’re going to build proxy. It’s not a piece of cake, you put in the oven and pick it up in a few hours. Okay. It takes years and years to figure out not to do a proxy architecture where you terminate connection, you inspect the stuff and you reinitiate the connection without introducing latency that’s why, if you look in the market so far, there are only 2 proxy architecture that work very well.
Bluecoat was the best on-prem single-tenant proxy. At one time, they have 85% of Fortune 500 companies. And we built proxy over the past dozen plus years that works well.
Tal Liani
Got it. We only have a few minutes late, and I want to go back to something you said. So I hosted yesterday a panel on data security. And one of the panelist was from a company, small company, very small company that is doing SaaS and he said, I’ll just repeat what he said and I want your comment on it. He said the existing players such as Palo Alto and Zscaler are doing more than networking piece of SaaS, meaning they’re replacing VPN, they’re replacing MPLS lines. However, we, him, we’re doing more data protection. So we are enabling. We are not only enabling the connection, but we’re also enabling that the right data is getting to the right place. You touched on DLP. Can you talk about SaaS in the context of data protection. How important it is? And what are you doing in this space?
Jay Chaudhry
So I think that statement is untrue, okay? So first of all, yes, we are the switchboard. We connect party to party without caring about the network. Network is simply the transfer and plumbing, so we end up disrupting the network. But there’s also we do data at rest as well. So data at rest gets done by technologies such as CASB for SaaS application, the CNAPP part is really data at rest because we are making sure workloads are not misconfigured. About a quarter ago, we announced our endpoint DLP with data sitting on the end point get secured. So our customers are saying, “I need 1 DLP policy, if they [indiscernible]. And I need to apply that policy for data in motion or data at rest, whether it’s in factory or in data center or sitting in an endpoint. That’s holistically what we do and we’ve done a couple of acquisitions, endpoint was a small acquisition that gave us acceleration. Customers aren’t looking for buying small point products. I think what you’re going to see security will keep on having a bunch of startups. But by and large, almost all of them will be bought because they aren’t in a place to create a platform.
Tal Liani
Got it. One last topic before we let you go. Fortinet yesterday also addressed the area of SaaS. They come from a different area. And what they said, they said you cannot do SaaS only in a virtual way. You have to have, in certain cases, you have to have an appliance. It’s not just about the client, but in an appliance because some deployments need an appliance. And that’s how they define their advantage over Zscaler. What’s your response to that?
Jay Chaudhry
I think it’s partially right. So look, we listen, we learn, we adapt. We don’t do things that are wrong. For example, we haven’t done SD-WAN that’s route table and all because that enables lateral type movement. My big [indiscernible] Gartner is when they say SaaS means SD-WAN and SSE. I say SD-WAN is anti-Zero Trust. So that’s a good point. I think SD-WAN is a transitional technology. It will go away. If we are going to be sitting here in 2, 3 years and say, Jay, you are right because you need every branch to become like Starbucks.
I have been wrong a few times. I was wrong when I said I don’t want any software sitting on the endpoint because I wanted software free stuff. So we ended up bringing a client connector to make it easy to handle traffic. We got 45 million of those client connectors sitting on endpoints. Yes, to send traffic from the branch. We have talked about a software piece of VM that sends the traffic. Our customers are asking us to say, can you provide me something that drop ship can do Zero Trust SD-WAN. I think we are looking at. Yes, I may be wrong there too and say, we’ll shift course and we’ll help and do what customers want. But our focus is delivering value in a new, better way and not do the old way because some of these old technologies create security risk.
Tal Liani
Great. So with that, thank you very much. We’re running out of time. Always a pleasure to host you.
Jay Chaudhry
Well, thank you.