2023-05-01 04:03:42 ET
Summary
- Zscaler's underperformance relative to peers over the last year has left it undervalued compared to other cybersecurity stocks.
- Zscaler also looks undervalued based on fundamentals, although lack of profitability is one concern.
- Zscaler remains a leader in network security, especially when it comes to remote and hybrid work environments.
Thesis
Zscaler ( ZS ) is a high-growth leader in network security, an extremely lucrative industry which has continued to grow rapidly even in the current environment. Zscaler stock has underperformed over the past year, but that underperformance is not justified by fundamentals. That makes Zscaler the best cybersecurity stock to buy today.
Zscaler 101
Although I covered Zscaler extensively while running a Marketplace service last year, I haven't written a public article about it yet. As I often do when initiating coverage of a new company, I'll start by briefly explaining what Zscaler does and why it could be a compelling investment.
Zscaler is a cloud-first cybersecurity company specializing in network security. Their core products (which are often sold together) include:
- Secure Internet Access (ZIA): Secures clients while they browse the internet. Offers automated protection such as phishing detection, as well as user-visible services like zero trust access policies.
- Secure Private Access (ZPA): A cloud-native product similar to a VPN. Allows secure policy-based access to private enterprise apps (e.g. SAP) whether or not the user is on the corporate network.
- Digital Experience (ZDX): A monitoring tool which ensures a smooth remote/hybrid work experience by detecting issues like network degradation (e.g. poor video call quality).
- Other products including cloud workload protection and data protection.
Although leading analyst firm Gartner's product categories don't precisely map to Zscaler's product lines, it's clear that they like Zscaler a lot. The above magic quadrant shows that Zscaler is the only leader in secure web gateways. Gartner also lists Zscaler as a leader in its more recent magic quadrant for security service edge, and Zscaler has been a leader in at least one magic quadrant for 11 consecutive years.
Over the past few years, Zscaler has boasted an industry-leading growth rate, which shows that its offerings are also resonating with customers. Zscaler still has ample room for continued growth, as it only counts 30% of the Global 2000 as its customers. Also, its ttm revenue is $1.35B, which is small relative to "legacy" network security leaders like Fortinet ($4.4B), Palo Alto Networks ($6.1B), and CheckPoint ($2.3B). Zscaler has an ambitious goal of reaching $5B in ARR with 20-22% operating margin.
Relative Valuation
Company | P/S | Rev. Growth | P/S / Growth | Rule of 40 |
ZS | 10 | 52% | 0.19 | 31 |
CRWD | 13 | 48% | 0.27 | 40 |
OKTA | 6 | 33% | 0.18 | -11 |
FTNT | 11 | 33% | 0.33 | 55 |
PANW | 9 | 26% | 0.35 | 26 |
MSFT | 11 | 7% | 1.57 | 48 |
Today, Zscaler's valuation of 10 P/S is similar to that of peers, whose P/S ranges from 9 to 13 (excluding Okta, which has faced a wide range of issues lately). While that may make Zscaler seem reasonably valued, note that its revenue growth rate is nearly double that of most of its peers'.
Although I'd like to use traditional valuation metrics like P/E and PEG, cybersecurity is a fast growing industry where many companies are unprofitable, including Zscaler. Thus, I've provided "PSG" (similar to PEG, but with P/S instead of P/E, so a lower value is better). Zscaler's PSG valuation is by far on the lowest end of the group's range.
I've also provided Rule of 40 scores, where a higher value indicates that the company does well in balancing growth and profitability. Although Zscaler is still unprofitable and that's a valid criticism of the company in this environment, its Rule of 40 score is middle of the pack at a respectable 31, thanks to its high growth rate. Based on this, I'm not too concerned with Zscaler's lack of profitability at this point.
In the past, Zscaler's elevated growth rate and reasonable Rule of 40 score allowed it to command a higher multiple relative to peers. Here's the same chart with values from a year ago:
Company | P/S | Rev. Growth | P/S / Growth | Rule of 40 |
ZS | 20 | 63% | 0.32 | 31 |
CRWD | 23 | 61% | 0.38 | 53 |
OKTA | 9 | 65% | 0.14 | 2 |
FTNT | 12 | 35% | 0.34 | 54 |
PANW | 9 | 29% | 0.31 | 24 |
MSFT | 9 | 12% | 0.75 | 54 |
Back then, Zscaler was valued nearly twice as richly as peers (besides CrowdStrike) and had a similar PSG score as most other cybersecurity leaders.
To better demonstrate what's changed over the past year, here's another version of the chart showing the change between the above two charts.
Company | ? P/S | ? Growth | ? P/S/G | ? Rule of 40 |
ZS | -50% | -17% | -41% | 0% |
CRWD | -43% | -21% | -29% | -25% |
OKTA | -33% | -49% | 29% | N/A |
FTNT | -8% | -6% | -3% | 2% |
PANW | 0% | -10% | 13% | 8% |
MSFT | 22% | -42% | 109% | -11% |
From this chart, we can see that the past year hasn't been kind to Zscaler, as it's seen the harshest multiple contraction of the group. That's despite the change in the company's growth rate and Rule of 40 score being middle of the pack relative to peers.
There's nothing I can point to that indicates this multiple contraction relative to peers is justified. Zscaler retains best-in-class growth rates, which should justify an elevated valuation. That's unlikely to change over the next year, as the industry's forward guidance and billings indicate that growth will continue to slow, but Zscaler's growth isn't expected to slow more rapidly than peers':
Company | Next Year Rev. Growth Guidance | ? Growth (Expected) |
ZS | 43% | -17% |
CRWD | 34% | -29% |
OKTA | 17% | -48% |
FTNT | 22% | -37% |
PANW | 26% | -10% |
MSFT | NA | NA |
Lack of profitability also isn't an immediate concern considering Zscaler's respectable Rule of 40 score. Zscaler has $1.2B more current assets than current liabilities (mostly cash), and lost $0.13B on operations in the last six months. At that (continuously improving) run rate it's unlikely that Zscaler will need to raise more capital in the next couple years.
Based on the above data, I'm confident that Zscaler's recent selloff is overdone relative to peers. Zscaler remains a fast-growing industry leader which is efficiently balancing growth with profitability, and that elevated growth should justify an elevated multiple relative to slower growing peers.
Absolute Valuation
It's fair to argue that comparing to industry peers is a bad idea if the entire industry is overvalued. I don't believe that cybersecurity stocks as a whole are overvalued. Regardless, a more traditional approach to valuation also makes Zscaler look appealing.
Assuming that Zscaler meets its long term targets of $5B in ARR and 22% operating margin, its current market cap of $13.56B would produce a P/E of just 12. That's quite low for a SaaS business with defensive recurring revenue. Although choosing a terminal multiple for a valuation model is more of an art than a science, mature defensive software companies like Microsoft, Fortinet, and Adobe currently command P/E multiples between 30 and 60. This is a similar range as what's available in other defensive industries like healthcare and consumer staples.
If Zscaler also commands a similar multiple when it reaches its long term targets, ZS stock could appreciate 3-4x. Even if that happens in 10 years rather than 5, Zscaler would still likely outperform the S&P 500.
Based on Zscaler's targets as well as my own assumptions about dilution and multiples, my current price target for Zscaler is $160, which implies 77% upside. Over a 10 year time horizon, my targets would make Zscaler about the size that larger peers Palo Alto Networks and Fortinet are today, which seems very attainable considering that the overall industry is also growing rapidly.
Risks
The biggest risk is that my thesis that Zscaler is undervalued relative to peers is correct, but that the overall cybersecurity industry continues to underperform amid slowing growth. In this case, Zscaler could outperform peers, but still underperform the market.
It's also worth noting that cybersecurity is a competitive and rapidly evolving industry, so an unexpected change in market dynamics (such as increased competition, reduced pricing power, or reduced overall demand) could mean that Zscaler doesn't reach my targets and ultimately underperforms. Considering that Zscaler is a founder-led company with a decade-long track record of success, I don't view this risk as elevated for Zscaler relative to other stocks in my coverage.
A final risk is that Zscaler's negative margins don't improve, even as growth continues to slow. In this case, investors could be diluted more than expected, or Zscaler could even have trouble raising cash. Based on the numbers I shared earlier, I don't view this as a major risk in the next couple years.
Conclusion
Zscaler's current valuation relative to peers doesn't make sense. It remains one of the fastest growing cybersecurity stocks, one which is widely considered a well-run market leader. As long as Zscaler grows faster than peers, it should command an elevated multiple, even if that growth comes at the expense of short term profits. Until Zscaler's multiple once again rises above its slower growing peers, I'll consider it the strongest buy in the cybersecurity industry.
For further details see:
Zscaler: Multiple Compression Creates A Rare Strong Buy Opportunity