ZS - Zscaler: Less Reward More Risk

2023-09-26 09:34:09 ET

Summary

• Zscaler is a cybersecurity company with a unique approach to the market.
• The company's business model is not impressive and its valuations are questionable.
• Recent acquisition announcements by Cisco could generate interest in Zscaler from potential suitors.

Summary

Zscaler (ZS) differentiates itself as a new take on the cybersecurity market. We find the company's business model to be an old wine (net neutrality) in a new bottle (cybersecurity) and hence are neither impressed with the business growth nor with the valuations. What stops us from becoming outright bearish on the Zscaler stock is the recent Cisco announcement to acquire Splunk and the likely interest security companies such as Zscaler could invite from potential suitors.

Business

Zscaler operates in the cybersecurity market and differentiates itself as a vendor that has an architecturally different approach versus the market.

Zscaler believes that the traditional approach of securing the path of communication is fraught with challenges as communication endpoints increasingly depend on the internet.

We predicted that with rapid cloud adoption and increasing workforce mobility, traditional perimeter security approaches would prove to be inadequate in protecting users and data and result in poor user experience.

We believe that securing the corporate network is becoming increasingly irrelevant in a cloud and mobile-first world where organizations depend on the internet, a network they do not control and cannot secure, to access critical applications that power their businesses.

Source: 10-K - 2023

The company believes that its 'switchboard' strategy is superior to the traditional approach.

we are designed as a switchboard for all communication between different parties. A firewall, it's not a switchboard. Firewall is a door. It's a gate. It says you are inside, your outside.

Source: Zscaler, Inc. ( ZS ) Q4 2023 Earnings Call Transcript on Seeking Alpha

We want to build a switchboard, a switchboard where you connect and the switchboard based on the policy decides if you will be connected to a given application or service. It's fundamentally opposite of traditional network security. Traditional phase, you're in or you're out. We are a door. We say we're not a door. There's no such thing as you're inside, you're always outside. That's really what started with secure web access, then private access.

Source: Zscaler, Inc. ( ZS ) Goldman Sachs Communacopia & Technology Conference 2023 on Seeking Alpha

All these network performance-monitoring products are useless. They're only designed to figure out performance between the branch office and the headquarters of the data center, that's it.

Source: Zscaler, Inc. ( ZS ) Piper Sandler Growth Frontiers Conference on Seeking Alpha

Zscaler wants the user or applications to connect to its network where a rulebook defines how and what connections can be established. Zscaler's approach has led to the daily transaction count on its network to reach 320 billion, which the company expects to double every 18 months. Put another way, the number of transactions is growing at an annualized rate of nearly 48%!

Thinking about Zscaler's business model a bit more, it wants to really emerge as an alternative to the broader internet.

The free communication poses risks which traditional security vendors try to mitigate using firewalls etc. Zscaler's preferred approach is to have all traffic come to its network, where a policy-based switchboard will determine how interactions would proceed.

The obvious benefit to Zscaler is access to large number of transaction data and the consequent analytics that can be built on top of it to build and train its artificial intelligence (or AI) and machine learning (or ML) tools, which can be further resold to the same and new customers.

The company's business has found significant traction, as evident in its financials and long-term expectations.

Furthermore, Zscaler has been beating expectations with a remarkable consistency with the latest one in Q4 2023 / F2023.

With the business model out of the way, we move to our thesis on Zscaler.

Investment thesis

Platform neutrality

We have to connect to applications that are on Microsoft and AWS and GCP and a thousand SaaS applications out there. So customers like the positioning of a provider like Zscaler that's not tied to applications itself

Source: Zscaler, Inc. ( ZS ) Q4 2023 Earnings Call Transcript on Seeking Alpha

One of the USP that the company feels its differentiated business model of sitting between communications is its independence while connecting users across clouds and environments.

It is worth mentioning that the global private cloud market is expected to grow at a CAGR of 26.7% during 2023-2027 to reach $276 billion, as against the global public cloud market which should growth at a CAGR of 17.3% during 2023-2027 to reach $988 billion.

Some of the drivers of private cloud growth are need for enhanced data security and control over data backup and recovery. Since private clouds are walled gardens, it obliterates the fundamental premise of Zscaler's offering.

Arguably, the public cloud is expected to be almost 3-4x larger and hence can be a sponsor for a much bigger TAM (or total addressable market) for Zscaler. However, Zscaler's approach impacts the concept of net neutrality.

That's the essence of net neutrality: the idea that those who provide access to the internet shouldn't discriminate between the requests of users or the people and companies that create websites or services.

On the side of net neutrality was a coalition of people and organizations who believed that the internet's historical openness should be codified by law; on the other side were powerful interests that saw profit in gatekeeping.

Source: The fight for net neutrality is forever

Zscaler's attempt at sidestepping net neutrality by wrapping the debate in the garb of secure access is likely to be met with the challenge of the private cloud market's 10% higher expected growth rate versus the public market. Notably, private cloud adopters are typically larger enterprises whose need for security is steering them away from the public cloud.

Post the test phase, customers get better visibility of requirements and could easily move from a public cloud to a private cloud (in a public cloud the entire management of hosting is outsourced, which changes in case of a private cloud where the customer owns the responsibility of managing and hosting). Since on a longer-term basis, renting is always more expensive than owning an asset, private clouds make more sense for larger, stable businesses looking to expand margins from cost efficiencies rather than primarily relying on revenue growth.

Source: Masters Of Cloud, Part 2: The Evolving Landscape

While Zscaler wants to be a platform independent player, its business model is built on violating the principle of net neutrality. The company's growth thesis gets further weakened by the growing focus on the private cloud.

The impact of Cisco's proposed deal to acquire Splunk

The cybersecurity and networking market has seen possibly one of its largest deals in Cisco's ( CSCO ) $28 billion offer for Splunk ( SPLK ). While the market is divided on the potential of the deal, the underlying thesis of a better positioning in the observability and threat detection markets is clear.

Zscaler was talking about consolidation in this market, just a few days ago.

There will be lots of security start-ups. But there won't be room for them to be an independent company for too long. They'll get picked up. If the technology is good, they'll get consolidated into the platform. But I don't see a single, call it, god security platform that does everything. I think a platform in certain areas -- just like you're never going to see a single SaaS company. What do you mean single SaaS company for all applications? It'll be hard, but I think you'll find four, five pockets of security where consolidation will happen, and we are confident that we'll be one of those platforms.

Source: Zscaler, Inc. ( ZS ) Goldman Sachs Communacopia & Technology Conference 2023 on Seeking Alpha

We think the Splunk acquisition could be a precursor to Zscaler becoming a potential target for the following reasons:

• The security market has been abuzz with Microsoft's entry in the SSE space and with the Cisco deal, Zscaler's expectation of consolidation could be beginning to materialize with Palo Alto (PANW), CrowdStrike (CRWD), etc. wanting to own a piece of the action.
• The vendor neutrality argument of Zscaler's business model is similar to the platform neutrality argument that Red Hat ((RHT)) had for hybrid cloud environments. While IBM ( IBM ) at the time of acquiring VMware was somewhat of a cloud player, increasingly IBM has shed that façade and now become a pureplay integrator. We think companies wanting to own traffic could potentially look at Zscaler.
• Lastly, we must touch upon the founder's credentials. The founder and CEO, Jay Chaudhry, is a serial entrepreneur who has sold four of his past companies.

-SecureIT was sold to Verisign in 1998

-Usi bought CoreHarbor in 2003

- CipherTrust was bought by Secure Computing in 2006

-AirDefence was acquired by Motorola in 2008

The exception is Zscaler, which Jay has been running for the last 16 years.

Outlook and valuation

While purely from a valuation standpoint, we do not see any merit in holding the stock. However, the Cisco deal could lead to a re-rating in the sector / near term demand for the stock.

We think most hyperscalers would steer clear of Zscaler. Instead, we think the company's business model could be of interest to a category that has lost out on the application layer boom - the telcos. With 5G as a software first stack, Zscaler's traffic aggregation could blend in very well with the overall 5G thesis giving the acquiring telco a seat on the internet / data table with tech companies.

Going by the Splunk deal at a 30% premium to the stock price, a deal for Zscaler could also potentially come in at $28-29 billion or $190-200 per share. Unless the deal is structured to be paid-off in the acquirer's stock, only a handful of companies would be able to come up with that kind of cash plus the wherewithal to integrate Zscaler into their broader technology stack.

Considering the speculative nature of this possibility, at this point we would not be a buyer or seller of the stock. Instead, we would want to see the dynamics in the market play out and if there is no offer for Zscaler in the next couple of quarters, we would not want to hold the stock due to business model and valuation concerns.

For further details see: