2023-09-06 15:26:04 ET
Zscaler, Inc. (ZS)
Goldman Sachs Communacopia & Technology Conference 2023 Call
September 06, 2023, 10:30 AM ET
Company Participants
Jay Chaudhry - Chief Executive Officer and Founder
Remo Canessa - Chief Financial Officer
Conference Call Participants
Gabriela Borges - Goldman Sachs
Presentation
Gabriela Borges
All right. Thank you. Good morning. We'll go ahead and get started if we can close the door at the back. Thank you very much.
Gabriela Borges, I lead the emerging software vertical here at Goldman. I'm delighted to have on stage with me Jay Chaudhry, CEO and Founder of Zscaler; and Remo Canessa, CFO. Thank you for your time this morning.
Remo Canessa
Thank you.
Jay Chaudhry
Thank you.
Question-and-Answer Session
Q - Gabriela Borges
Jay, one of our observations watching Zscaler evolve over the past seven, 10 years, has been your evolution into a multiproduct company, building off of the success you've had with Zscaler Internet Access. When you think about the decisions that you made very early on in the company architecturally, what are the one or two decisions that stand out to you as being really important with the power of hindsight to empowering the product portfolio that you have today?
Jay Chaudhry
Yeah. So, I think the biggest thing we did when I started Zscaler was to say reimagine network, reimagine security for this new world of cloud and mobility. So, what was the reimagine? We said we're not going to be the next or next next-gen firewall of VPN. We want to build a switchboard, a switchboard where you connect and the switchboard based on the policy decides if you will be connected to a given application or service. It's fundamentally opposite of traditional network security. Traditional phase, you're in or you're out. We are a door. We say we're not a door. There's no such thing as you're inside, you're always outside. That's really what started with secure web access, then private access.
But this switchboard doesn't care about if you're a user or a workload. So, we could really adapt the same technology to do Zscaler for workloads. IoT, OT devices want to communicate too. They go through the same switchboard. Your B2B customers and suppliers want to talk as well. Same core technology has been elegantly used in all areas. That's when people say, "Oh, how do you compare with this firewall vendor? I'd say, "Man, we haven't been able to communicate the message."
Gabriela Borges
So, it leads to a question on how to think about greenfield versus brownfield TAM. If I think about the categories that Zscaler has consistently displaced things like Secure Web Gateway, CASB, the number of TAMs that you are able to consolidate now versus five years ago is evolving. So, how do you think about greenfield versus brownfield? And where do you think you are on the brownfield piece of displacement?
Jay Chaudhry
So, I think that the traditional categories of security market segment are fundamentally going through big changes. The market and investors always like to fall back on. This is a known segment. The segments are being disrupted and they should be disrupted because the underlying security model is fundamentally changing.
So, if you really look at what are we doing, we are fundamentally replacing what's known as DMZ in an enterprise. So DMZ, this techie term for demilitarized zone, when you go outside the data center, you go through a check of boxes. When you come in, you go through a check if boxes. It's almost like the castle-and-moat model. When you go into castle, they're going to check your badge, what luggage are you taking with you and all that kind of stuff. When you leave the castle, they're going to check if you're stealing anything going out with you. It's the same kind of concept the network security did inside and outside. So, with Zscaler, ZIA, ZPA, the whole notion of DMZ goes away. And then they used to be DMZ here or there. So that's one big piece. The SSE that Gartner has coined has essentially evolved to become the replacement of DMZ. That's one big piece.
Then the data at rest became a second big piece, consolidating these point products that came onto the CASB is a feature, then SaaS Security Posture management, one more segment became the feature, supply chain of SaaS security, a new area. So there are some older markets, some newer markets. They are all coming together. I don't really look at older versus newer markets. I look at what problem do we need to solve. CASB, about 10, 12 years old problem is being solved. SaaS Security Posture is relatively young problem. Supply chain of SaaS, my sales force is connecting with 10 other SaaS applications. Sales force is trustworthy, but do I trust those other 10 applications of SaaS? I don't.
So, there are a bunch of new areas evolving. I think the TAM of cybersecurity is underappreciated. It will be a lot bigger. I mean, take ZPA. We started on ZPA, customers said, "Oh, it's VPN replacement." Nothing is farther from the truth. That's a small piece. If you do ZPA right, this whole inside security in the data center here, they will eventually go away, the segmentation piece gets done with ZPA technology right because it says, I connect Party A to Party B. So, we are excited to keep on expanding this platform.
In terms of numbers and all, we don't even try to look at external numbers. When we did market sizing, we started with number of users. What are we getting paid for, for product A, B, C, that we did roll up, and that's when we came out with about $72 billion TAM, which is what we covered during our last Analyst Day a couple of years ago.
Gabriela Borges
We see this dynamic across security, across technology where you have an industry pioneer and then you have fast followers. As the TAM becomes more validated and the TAM evolves, how do you think about the risk of commoditization at the low end and the mid-market? You're continuing to push the envelope with your R&D roadmap. How do you balance the risk of commoditization at the low end with continuing to drive the industry forward and the concept -- the architectural concepts forward at the high end?
Jay Chaudhry
That's a very good question. And we give a lot of thought to it. I think the point you made, commoditization, fast follow, innovative, it depends upon the market segment, the problem you're solving. Take basic networking stuff. Networking's job is to get traffic from point A to point B, easily at a fast speed and lively. That thing once gets done, there's not a new innovation happening every year, every six months, every 12 months. Cyber is one of the unique areas, where cyber, your job is never done, it's a race with bad guys. Sometimes what frustrates me is that hackers move faster than our large company CISOs and their teams. They are slow. They need to move faster to catch up with the technologies we are building.
I think cyber with so much focus, so much at risk. Our customers are telling us, especially large enterprises. A small business, they barely understand cyber. They'll do whatever they need to do to move with it. But the largest customers, they won't compromise for cyber. They won't say, good enough is good enough. When it comes to probably a SaaS application, good enough is good enough. So here, you need the best security.
Now, you would think best security will be probably best-of-breed point products, not true. If you go back to 9/11, CIA had lots of information, probably FBI has a bunch of information and others. If they could correlate the so many telltale signs, so with the platform approach, when you consolidate point products and are able to correlate pieces of information you're getting, your security is far better than point product security. So, we -- that's why we are driving towards the platform, but a meaningful platform. The word platform has been abused today. Somebody goes and buys an endpoint company and say, we are a platform between firewall and endpoints, come on. What's common between the two, not a whole lot. That's not platform.
So, we believe that the whole issue of lots and lots of security vendors is going to go away, but that doesn't mean the start-up scene will go away. There will be lots of security start-ups. But there won't be room for them to be an independent company for too long. They'll get picked up. If the technology is good, they'll get consolidated into the platform. But I don't see a single, call it, god security platform that does everything. I think a platform in certain areas -- just like you're never going to see a single SaaS company. What do you mean single SaaS company for all applications? It'll be hard, but I think you'll find four, five pockets of security where consolidation will happen, and we are confident that we'll be one of those platforms.
Gabriela Borges
Where do you think Microsoft fits within the four or five pockets? You made some interesting comments last night on the technical barrier at the high end and the enterprise, the potential for an impact at the low end. Would love to elaborate a little bit?
Jay Chaudhry
Yeah. Look, Microsoft is a company we respect, we have worked with closely. They have expanded the security platform, but we all hear about $20 billion number of Microsoft. If you start dissecting it, from a real stand-alone products point of view, it's natural for them to do endpoint security. They own Windows platform. It's natural for them to do identity. They own active directory for years and years, okay. It's natural for them to do the data lake stuff at Sentinel, because hyperscalers are good about data lake. So, we have integrated with them in all these areas.
The new announcement they made about Entra and SSE. Entra piece has to do a lot more expanding identity part, which is natural for them. And what made some waves was their entry into SSE. That's a brand-new area for them, being in line, inspecting traffic at high speed, any kind of traffic is not where Microsoft traditionally comes from. And also, the traffic is going to Microsoft, Azure, AWS. It's going to a thousand SaaS applications and a million other websites that have nothing to do with Microsoft. Customers will rather have a company like Zscaler as a [indiscernible], that's really making sure we have secure and fast access to all those areas and locations.
So, I believe in the large enterprise space, we'll keep on doing very well the way we have done it. I mean you've seen CrowdStrike do quite well on the high end on the other side as well. It will take some time for anyone to enter in the space and the space that has to be the full platform, the capabilities we've built over the past dozen plus years. So, I think on the lower end, they probably will do fine just because the lower end bundling works. Even today, when I see low end of the market, I see Cisco bundle with network and security happening from time to time. On the high end, I think we are feeling comfortable. We'll keep on innovating and driving. And we've seen other markets too out there.
Gabriela Borges
I think there's a natural evolution between some of what you're doing on the network side and some of what you're now doing on the cloud side. I would love to hear a little more about your strategy of expanding into cloud security with Zscaler for workloads. And as a customer, we've had this decision process before where I can choose to work with someone like a Palo Alto and the network in Palo Alto in the cloud, or I could choose to work with Zscaler for the network and Zscaler for the cloud. So, help us think through how customers are making that decision.
Jay Chaudhry
Yeah. So, cloud, securing the cloud is what you're talking about, securing workloads. So, there's no one single market natural for cloud, securing a cloud. So, customers look at what problem do I need to solve? Do I have a meaningful platform provider that can solve all of my problems or some of my problems? That's what a customer look at it. So, let's talk about that securing the cloud workload market in a couple of buckets.
One, the pretty well understood market is my workloads need to talk to other workloads, my workload need to talk to Internet. How have they done it the old way in the data center? With firewalls and the like. So, there's a bunch of lift and shift that has been happening where let me shift my firewalls and buy them as virtual firewalls in the cloud. That's a market we are disrupting with Zscaler, ZIA for workloads and ZPA for workloads.
This is -- this business is taking off very nicely. The deal sizes are still small in that space, but it's moving up very well. The only competition we have there is legacy firewalls. We think we are well-positioned in that part of the securing of cloud workload communication.
The other part, which is not about communication, but about checking the posture and the early posture related stuff. And you can even put that in two buckets. One is almost taking EDR, your technology from workload from endpoint to running that thing on cloud workloads. CrowdStrike has been doing it fairly well with AWS. In Azure, Microsoft wants to run its own Windows Defender or whatever they're calling it for workloads defender. So that's the second area.
The third is where you hear a lot of noise because there have been 100-plus companies in the past two years. This is where [indiscernible] have been making a lot of noise. This is about CSPM, CIEM, security posture, entitlement alike. I think this market has been evolving. But I look at this CSPM [indiscernible] CNAPP, Gartner keeps on changing the meaning and definition of all these things based on where the market goes. It's kind of fascinating. They kind of coin then they see the market and they change to make it fit. But either way, I think the CNAPP will become like CASB itself. It's not a market on its own. It is an important feature set that needs to be part of cloud security, workload security. Our strategy is we come from workload communication with zero trust side, where we are differentiated. Our customers understand the stuff, and essentially combine it with CNAPP and sell it as a bundled stuff. That's how we're going to market. We're getting good reception. We're closing good deals. I mentioned about some of those deals during the earnings call. That's how I see the market evolving.
Gabriela Borges
The one other market that appears to be going through a little bit of an inflection in TAM is data loss protection. And your DLP products, you've had DLP products from or very early on in the company. Last night, the scope of DLP and the types of DLP functionality that you're consolidating seem like they're going through an inflection. Would love for you to comment a little bit on what you're seeing in that market and how the TAM is evolving.
Jay Chaudhry
So DLP is an important part of cyber. At the end of the day, the bad guys want to come in, steal your data and ask for either ransomware or steal it for IP and the like. We started out a secure web gateway with big focus on cyber protection. So, every customer of Zscaler ZIA has pretty strong cyber protection. DLP has been a market which has been hard to deploy with false positive.
Many CISOs I talked to would tell me, "I don't want to touch my Symantec [indiscernible]. It took me three years to deploy it." Okay. And I'm okay with it. And three years of Zscaler, your functionality is good, but not good enough for me to replace my Symantec. So -- but we have been gradually growing it about three, four years ago, when we decided to enter into CASB market. And then we said, "We're going to make sure every function that Symantec has is done and done in a better way in the cloud with workflow automation and all those things." That's what we built over the past three, four years to the degree now, we have been replacing Symantec's DLP product in some of the largest companies, which are very complex.
So with that, about 18 months ago, I put a take-off team in place for DLP; your job is, go and really sell DLP and that we sold actually in Zscaler installed base, okay? And that's really what the results you're seeing is a result of a focused natural effort. Also, DLP is becoming a bigger and bigger issue out there. We wanted to take advantage of that. And that's really what we've done. It's a big opportunity.
We still need to learn how to get more money out of our sales than we do. When I talk to a Fortune 500 company CISO, I mean they are still spending about $6 million, $7 million to $10 million per year on maintenance of Symantec stuff. It's like, "Wow, that's a big opportunity." So, I think you will not see another vendor coming in Zscaler installed base they got ZIA and say, "I want a different security DLP vendor." It just doesn't make sense. When traffic is going through you, you're inspecting [indiscernible] and the like, you need to be the natural DLP provider, and that's what we are taking advantage of.
Gabriela Borges
I appreciate your comment on a take-off team within the sales force. I know you just had your sales kick-off late in August. What are some of the incremental changes that you're making to the sales force, whether it's take-off teams, whether it's incentives on product market bundling? I would love to hear how you're thinking about priorities for sales force for fiscal '24.
Jay Chaudhry
I can start. Remo, if you want to...
Remo Canessa
Yeah.
Jay Chaudhry
There are no significant changes being made to go to market overall. One big thing is we have a lot more focus on channel we are -- remember, five years ago, I was saying we are getting very little lift from channels because channel love their boxes, okay? It is changing. We are getting more and more lift every year, but still a lot more lift needs to be done. So, we hired Karl, our new channel chief, about -- he came on three or four months ago. He's taking more refinement, taking channel in relation to the next level. We had just shy of 200 channel partners who attended our sales kick-off, which is supposed to be an internal event for the company. There's a big push on a number of new products.
So I kind of look at our offerings like the pharma company looks at its products, right? There's a [indiscernible] product that's selling. There's a new one that just came out of the testing that's ready to go to market. And the new in R&D being done. That's really how we look at our product offering. And we do a few take-off teams whose focus is to make sure the new area happens well because you can't leave it at a big sales team without focus out there. So, we don't do lots and lots of take-off teams, but data protection is one of the areas, cloud workload security is another area.
Remo Canessa
From an overall company perspective, our focus is growth. The market that we have, as Jay mentioned, is a $72 billion-plus market. This is very early stage. What I can say also the momentum that we have going into fiscal '24 is strong. Our pipeline is very strong. Our execution was also strong in Q4. The capacity -- sales capacity that we have going into fiscal '24 is stronger than the sales capacity that we had going into fiscal '23.
So what we're seeing is we're seeing momentum currently related to basically the acceptance of a zero trust market. And so, it was a great sales kick-off from an incentive perspective, as Jay mentioned. No real and significant or any increased incentives for the sales organization, but for the take-off team and also PM to drive these new emerging products, there are incentives that we have.
Gabriela Borges
Remo, your comment that the sales capacity is stronger into fiscal '24 than it was into fiscal '23, is that simply a function of the company being bigger and having more boots on the ground?
Remo Canessa
No, it's our focus basically. From my perspective, when we went into fiscal '23, our sales capacity, we felt was in good position for fiscal '23. As we've gone through fiscal '24, and we're looking at the market, we felt that basically increasing that sales capacity, and we plan to keep on doing that as we go forward. Again, the key focus for Zscaler is driving growth.
If you take a look at our operating profitability that we had in the fourth quarter, it was 18.8%. I mean from my perspective, that's too high. I mean when we're a growth company, basically 18.8% at this stage, we need to focus more on growth. So, the focus basically in the second half of fiscal '23, we went through restructuring in midyear, but we took out basically areas that we thought weren't efficient. But our focus still was basically to add sales capacity and really try to drive the growth of the company.
As I mentioned, I think we're in great position to go forward. And again, from my perspective, what I've talked about, when you take a look at the SaaS model and you have high gross margins at 80%, it just even though your growth for new ACV growth percent decreases because you are getting bigger, that's a hockey stick type impact that you have basically on the growth of the company related to your ARR. We're at that point. We're at that curve where that -- we're seeing that hockey stick starting to increase.
So from my perspective, invest in growth, manage the bottom-line, manage our free cash flow. Our stated long-term range for operating profitability is 20%, 22%. And as I mentioned, we did 18.8% in Q4. Stated range for free cash flow is several points above operating profitability. We do have a headwind with free cash flow in fiscal '24. We're significantly going to invest in our cloud infrastructure. The reason for that is for the demand that we're seeing, and we like to be ahead.
In the last few years, our CapEx has been running at around 6% of revenue. We expect it to be in the high single digit in fiscal '24. I don't see that's being the case in fiscal '25. I see this as pretty much a one-time blip that we're going to see in our CapEx. The headwind we're seeing in our CapEx in fiscal '24 was 3% to 4% based on the increased investments that we're making in our cloud infrastructure.
Gabriela Borges
Well, let me ask you this, at any given time in Zscaler's history, you'll have had emerging products that are ramping. And so, why -- what is different about this year that is driving an uptick in CapEx versus other years where you've had cloud infrastructure products ramping?
Remo Canessa
Yeah. We just took -- again, we're in good shape than prior years. We felt that basically with the increased AI capabilities, we felt that to get in front of it in fiscal '24 is the right thing to do. And that's really the reason also to build for the increased demand that we're seeing.
Gabriela Borges
What is an example of AI capabilities that are driving...
Jay Chaudhry
We got zillions and zillions of logs out there. Data is the new currency when it comes to AIML. Being able to leverage them, AIML gives us a lot of capabilities to do so, okay? Those are the kind of factors we are putting in. And also from cloud growth point of view, I tell my cloud infrastructure team, there should never be any capacity issues in my data center, go and invest whatever we need to invest. So that's why even if you look at, Remo has always said, our CapEx will be in the high-single digits, but it has never been high-single digits, okay? So we are planning conservatively. We may be somewhat higher up, but don't really think that it ends -- it could end up being way high than you would think.
Remo Canessa
I'd rather say prudent than conservative.
Jay Chaudhry
Okay.
Remo Canessa
So -- but no, I mean, if you take a look at our history, basically in guiding, we try to be very prudent with our guidance. I made a comment on the call that we expect our free cash flow to be above 20% in fiscal '24. I expect it to be above what it was in fiscal '23. And again, I feel that's prudent guidance, not using the word conservative, it's just prudent guidance, but we are well-positioned to go forward, and certainly to meet our operating profitability, free cash flow goals.
And really, when you take a look at the leverage, where is the leverage in the model? If you take a look at R&D, we're going to run it in the 14%, 15% range. The reason we're able to do it at that level because a significant portion, the majority of our R&D staff is in India, much lower cost. If you take a look at G&A, we're running about 6%. Not many companies our size running 6%. How do we do that? Well, I can say, from the finance perspective, 80% of our staff is in India. So, we run finance at 2.3%, which is probably the lowest in the industry. That's why we're able to keep.
So, where does the leverage come? As long as you keep your gross margin at that 80% range. And if you take a look at Zscaler, 320 billion transactions. When I started six years ago or six-and-a-half years ago, how is it going to scale? Is it going to hit basically a roadblock? Is there going to be pressure on the gross margin? I can tell you there's not. We've constantly been running our gross margin at that 80% range, stated range, 78% to 82%.
When the emerging products, because we focus getting the emerging products into the market and focusing on features, basically, that's in public cloud, which carries lower gross margin. We can move those products onto our cloud. We can do software optimization, but that focuses R&D efforts in an area that we feel not necessary, get the product out, build the features and build our market share. If we see our gross margin starting to decline at all, and we monitor our gross margins or review on a monthly basis, we'll adjust.
So again, stated range, 78% to 82%. As long as we stay in that range, we're good. And again, the scale of the cloud at 320 billion transactions, 10x of where it was when I started. 10x of where it was when I started. And still, we're not seeing the effect. That is basically the value of the technology and the platform that we created that we feel nobody in the world has.
Gabriela Borges
I want to stay on this idea of conservatism and thoughtfulness in the guide. You have this slide in your earnings presentation showing the macro and then what you've done to navigate the macro, things like CFO-ready business use cases. And so, if I look back at your track record over the past year and even as a public company, you've been very consistent in outperforming, even in a year where macro has been volatile. And so, as we think through where you set the bar for fiscal '24, is there any reason why you wouldn't be able to outperform to the same degree as you have in the past, given that you've already worked to put in place processes to navigate a more challenging macro?
Remo Canessa
The numbers are getting bigger. So, when you get numbers bigger...
Gabriela Borges
Yeah.
Remo Canessa
Yeah, I mean just scale. We're $2 billion revenue company, it's our projections for fiscal '24. Never say never, right? But again, our view is we want to be prudent with our guidance. We go through a very thorough review how we do our guidance on a quarterly, annual basis. Gabriela, let's just see where the market takes us. Let's see where it goes.
What I can say also one of the areas that we -- I don't think we talked about on the earnings call, but federal could be a very large market for us. We're in 12 of the 15 cabinet agencies currently. It is very early stage. Not only federal, but also just government, whether it's [Fed] (ph) or international. Our certifications -- there's a handful of companies that have the type of certifications that we have, not security companies, just technology companies. So, we're well, well-positioned.
Let's let things play through. I wouldn't expect large beats,, because the numbers are getting bigger. But as I mentioned, we're well-positioned going into fiscal '24. A backdrop, a cautionary backdrop, is the global macro environment. Who knows, things can change. It changed last year in our first quarter, our October quarter, January quarter, it changed for all technology companies. Everybody saw it. So that's the one wildcard that -- we can only can control what we can control. And what we can control is basically our execution, our development and basically driving value for our shareholders.
How things play through with the global macro, those are going to be swing that may happen, we can't call it. That's the only cautionary. Pipeline strong. Execution is strong. We're well-positioned. We have more capacity going into fiscal '24, but we'll see how things play through. We feel in a good position.
Jay Chaudhry
Yeah. One comment I'll make here is the following. When we have internal discussions, okay, my mindset is I look at the results and "Hey man, wonderful, we went from $1 billion ARR to $2 billion in seven quarters. Why can't we double it again in the next seven quarters?" And [indiscernible] go-to-marketing, hold on, these are bigger numbers, okay? But the market is there, we can execute. So, we are focused on growth, foundational fundamentals are good. So, we're pretty bullish about it.
Regarding economy, I mean, none of us have a crystal ball, but with hundreds and hundreds of calls I have with CXOs, I am clearly sensing slightly reduced focus on their scrutiny for deals, okay? It's getting -- I'm not ready to declare it good, but it's feeling directionally better. That there's a fair amount of optimism that we see. And maybe it's from our customers, because our customers want cyber, our customers on cost savings. And we've shown that, we are one of the very few cyber companies that actually save money. We take out a number of products. That's really what gives us a lot of confidence. And we will keep on executing with focus. The market is growing, expanding.
The other thing that surprised me is the brand has gotten so strong in the past, especially in the past two, three years. I saw a big change when we went public. And then, it's getting better, but now it's amazing where I go to some of these conferences, three, four years ago, I would seek out people. And now they just want to seek out and talk to us, whether it's customers or whatever the case may be. And I think it has also to do with the customer satisfaction is so good.
I went through some numbers. I found that there are about 200 CXOs who actually gone from job A to job B and recommended Zscaler. The number, it's impressive. These are large company. I'm not talking about a small company. Then I said, let's look at how many of them have taken us to three companies, okay? That number sat around in the high 80s. This was my own connection things. I know, and this data may not be complete, and look at how many have taken us to more than four companies. The number was about 40 of them, okay? It tells you that customers like our stuff. It is good. That's why our churn is so small. Happy, great customers, great platform, opportunity to do upsell is there. And when they go to new places, they call us. This is what makes me feel good.
Gabriela Borges
Fantastic. Thank you both for your time. We'll leave it here.
Remo Canessa
Thank you.
Jay Chaudhry
Gabriela, thank you. Appreciate the opportunity.
For further details see:
Zscaler, Inc. (ZS) Goldman Sachs Communacopia & Technology Conference 2023 (Transcript)