Zscaler, Inc. (NASDAQ:ZS) Deutsche Bank Technology Conference 2021 September 10, 2021 2:45 PM ET

Company Participants

Jay Chaudhry - Chairman and CEO

Remo Canessa - CFO

Conference Call Participants

Patrick Colville - Deutsche Bank

Patrick Colville

I appreciate you joining us today. I’m Patrick Colville, a Senior Analyst at DB covering the cybersecurity software space. The format of the session will be a fireside chats with a listener Q&A. There's a chat box where you can ask questions. Any questions are anonymous. So we'll not mention your name or your company affiliation.

Let's kick it off with introductions. We’ve got Jay Chaudhry, the CEO and Co-Founder of Zscaler with us, one of Co-Founder, the Founder and Remo Canessa, the CFO of Zscaler with us today. Thank you guys, for joining us.

Jay Chaudhry

Thank you, Patrick.

Patrick Colville

I'm sure the audience know this, but Zscaler is a Cloud security pioneer and a leader in SASE. I think I'll just jump straight into questions. So Jay, I mean from a technology perspective, can you just talk to us about what differentiates Zscaler ZIA and then Zscaler ZPA versus peer group?

Jay Chaudhry

Of course, I turn on use couple of slides to set the stage. And visually, it's easy. On the left side, you see what's known as network security. You get on the company network, either by being in the office, or remotely doing a VPN, you're on the network. As a user, you can access any application, that's wonderful. But a malicious person can also access anything and bring everything down.

That's why is Zero Trust was invented. Zero Trust is the opposite of network security. You do network security with a castle-and-moat architecture with firewalls and VPNs, you do not do Zero Trust exchange with firewalls or VPN. Zero Trust means Trust no one. In this model, your applications are merely destinations, your users are all untrusted, and user to access applications. They go through a Zero Trust exchange, which is like a switchboard. Just like an Intel switchboard, a user comes to us, we validate who you are, we check policy, and we connect you to a particular application and that application only period.

The [technical difficulty] no network. So fundamentally a very different architecture. Now there are two kinds of applications out there at a broad level, external applications like Internet and SaaS that every user needs to go to, they go through our ZIA service, we want to make sure we block the bad, we protect the good from leaking out, that's ZIA. For internal applications, you're less worried about getting infected, because you went to SAP in your data center, you're worried about who can get there.

So for that, we built Zscaler Private Access, where you can access applications without being on the network, without doing any VPN and the like. If you have been reading news, all these big attacks including Colonial Pipeline, they all happened because people got on the network, through VPN, or otherwise. And then last comment I'll make here is when you go through your transformation, you don't see much of a network in this diagram because Internet becomes, excuse me. Internet becomes your corporate network.

On any network, you come through Zscaler Exchange, we connect you to the provider, Cloud provider, SaaS provider, or your data center applications. We complement identity vendors, we work closely with endpoint vendors, we can take traffic from any SD-WAN. And we can feed logs to security operations. We allow customers to consolidate around point products, but you essentially get away from doing traditional network and traditional security.

With that, let's get into Q&A. Patrick, I hope it was easy to follow.

Question-and-Answer Session

Q - Patrick Colville

Yes, that was excellent. So I appreciate you taking the time. The standard opening question I'm asking every company is can you just talk about the demand environments? And I guess kind of the second part will be how does that demand environment compare to a quarter ago and how do you think that demand environment will trend over the coming year?

Jay Chaudhry

Good question. We always said, we were about to drive Secure Digital Transformation, which was happening pre- COVID. COVID accelerated it, COVID also accelerated the need for working from anywhere. That's the market we pioneered. And in the past three or four quarters, since we saw big SolarWinds attack, then we saw Colonial Pipeline, we saw Microsoft issues, all these things have further heightened the need for doing Zero Trust, because Ransomware exploits lateral movement. So we've seen Zero Trust becoming the center of everything. Biden administration has raised further visibility for it.

And we're getting inbound calls, now the interest in implementing Zero Trust has gone up significantly, while legacy vendors are trying to cause confusion in this place by really spreading this information, where they like to say, we’re the best Zero Trust network security company. So come on, it's oxymoron either you are network security or you’re Zero Trust. You don't do Zero Trust with firewalls of VPNs even if you spend them in the cloud. Good thing is when Gartner starts writing good articles on Zero Trust network access, when NIST start highlighting the need for Zero Trust, where you don't connect to the network, it's becoming clear. And that's what's driving our business, that's what driving our growth, and we don't see it slowing down.

Patrick Colville

Appreciate it and Remo, kind of key question, I guess, do you have any thoughts to add on that question around the kind of demand environment and how it compares to quarter-ago and how it might trend?

Remo Canessa

Yes, I mean, Jay pretty much said it. I mean the world changed with COVID back two years ago, and really put the spotlight with the problems with today's networks. Since then with the attacks that have been occurring, it just has created more and more of an awareness. That in addition to our broader platform, the introduction of new products in particular emerging products, which did very well, this past year in the high single digits of new and upsell of ZDX and ZCP.

I mean, the platform play for Zscaler is really resonating with customers. We saw that with the -- a record seven figure deals in the quarter, every metric that we saw in Q4 was very, very strong, short term billings is 71%, CRPO growth rate at 80%, RPO bookings growth rate get 113%, just across the board, every metric that we looked at was strong. That appears to be carrying over, I'm not going to say it’s the same level as we had in Q4, but things are looking very good for Zscaler.

Patrick Colville

I mean, probably good to understand, congratulations on very impressive results. Someone who have been following Zscaler for a long time, it was very impressive to see so.

Remo Canessa

Great, thank you.

Patrick Colville

Jay, can I talk about something on the technology, so Palo Alto Networks was fairly dismissive of the proxy architecture, delivered as a service, they have now reversed their course and now support a proxy architecture in Prisma Access 2.0, could you just help me understand why that hasn't made the environment more competitive for Zscaler?

Jay Chaudhry

Changing your views to say, we want we need to do proxy versus building a proxy are two different things. Creating PowerPoint is a lot easier than building products, especially building a proxy. Think of this way, how many proxy vendors have tried to come out and build a sizable scalable proxy out there.

The one I think of was Blue Coat, that's why they're 85% market share at one-time, they had the best on prem proxy, they just could not pivot to make a multi-tenant to do what we did in the cloud. They're the best shot at winning this business. These guys don't have a proxy, Cisco, McAfee, Websense, they all try to build proxies, they couldn’t scale proxies hard, you terminate, you inspect, you send it back without introducing any latency. It's the opposite of firewall, a firewall is a pass through architecture.

It tried to scan whatever it can scan while the traffic is flowing. So it's a hard architecture. We don't expect any meaningful enterprise class proxy from any of these competitors in the next year or two.

Patrick Colville

A conclusive answer, okay. So I appreciate it. I guess in terms of new logo acquisition, I mean, that was definitely something that fiscal '21 has been pretty impressive. You've talked increasingly about focusing efforts in the mid-markets, so you adding more sales reps, more marketing programs, more kind of channel partners, just help us understand why is now the time to go off that mid-market opportunity, and then how is that mid-market opportunity evolving?

Jay Chaudhry

Yes, I'll start. Remo and then you can add.

Remo Canessa

Okay.

Jay Chaudhry

In quite mid-market, we call it the lower-end of the enterprise market and we define it as 2000 to 6000 users. It's a natural thing for us to expand and come down. We aren't really pushing on the SMB market which will be maybe a few hundred users or less than a hundred users. So our sales process hasn't changed a whole lot. It's expanding. It is simpler. Its fewer stakeholders. Channel can actually play a bigger role in 2000 to 6000 user range. Then they play in a 50000 person range. In 50000 company, we actually need to get involved no matter what happens. That's what happens with everyone. In this end, channel is helping or summit program is helping. This is our fastest growing market segment. We are very happy about it. Remo?

Remo Canessa

Yes. Our customer count went up over 5600 at the end of this fiscal year compared to 4500. So real strong growth. And also we saw an acceleration of new customer growth in Q4. Just as a reminder, a major is companies that have 40000 employees or greater, large enterprise is 6000 to 40000 enterprise because the two to 6000 and commercial is under 2000 employees.

Our focus up to this year has been in the majors and large enterprise. So we put in place a summit programs at the end of last year or about a year ago. And we're seeing the contribution from VARs increasing. So they - we're seeing increasingly embrace cloud and cloud transformation. And so she does the message for the large enterprises and the majors that we had is starting to resonate also with smaller companies and it's going downstream.

Patrick Colville

Great. I appreciate that. Thank you so much. I mean, as a reminder to the audience, there is a chat box we can ask questions. Any questions are going to be anonymous, so we're not going to mention your name. I've actually got a question over email. Remo, can you just talk about the quota carrying sales reps, and how many were added in fiscal '21, how you thinking about quota carrying sales reps in fiscal '22?

Remo Canessa

Yes. So let me make a few comments on that. So we increased our field quota sales reps since fiscal '20 over 68%. We talked about for fiscal '21 was that we didn't increase their quota carrying sales reps on a number basis in which we did total head count. For the comment we made for fiscal '22 is that we're going to increase the number also from fiscal '21.

Now, just to give you some perspective, when we came into the year in fiscal '21, we did the plan. We expected productivity the lower. Actually sales productivity was higher in fiscal '21 versus fiscal '20. The reason for that is we really beat our plans on the top line very, very strongly. Going into fiscal '22, the comment we're making is that growth is really important. It's the most important thing for Zscaler, and we'll balance growth with operating profitability. And you heard the comments made on the call yesterday.

Having said that, we're going into our plan. Our plan for fiscal '22 is that we're going to have sales productivity be flattish, slightly down. So we are going to be increasing our sales reps, hopefully that gives you some sense of what we're seeing. The market is really good. As I mentioned, things are going very well and we're going to take advantage of it.

Patrick Colville

Sure. Can we just switch gear to I guess upsell? I like to understand like a fender - bender and upsell opportunity and I guess the reason I ask is trailing 12-month net retention rate metric that you disclosed yesterday it was very impressive, 128%. I know on the call, you're kind of walking us away from putting an undue focus on that. So let's maybe not focus on the number quite so much, but just talk about the upsell opportunity from here from existing customers, you know, is that higher bundles, is that cross selling, any way to quantify that would be great?

Remo Canessa

False start today and then you can contribute. Our new and upsell mix for fiscal '21 was 45% new and 55% upsell. We're also seeing our transformation battle increase. So at the end of last fiscal year for CIA, AAR, transformation was 49%. For fiscal '21, it was 55%. So we're saying is that customers are moving to higher transformation, and also we're seeing the breadth of our platform. We're selling a lot more.

As I mentioned, ZDX and ZCP, high single-digit of our new and upsells. ZPA being 27%. But when you look at that 27%, you got to include that higher single-digit per ZDX and ZCP. If you looked at just ZIA and ZPA compared that the prior year, because it's basically no contribution from the emerging products. ZPA contribution on an apples-to-apples basis is closer to 30%.

So browser isolation, CASB out-of-band, we've reduced a lot of new products in applications and features, which have really contributed to that upsell opportunity. We also mentioned on our analyst day, that if you take a look at our installed base of customers just for ZIA and ZPA, not including ZDX or ZCP, there's a 6X opportunity for us to upsell more into our installed base, which is very, very significant.

Going forward, when you think about new and upsells, think about upsell being more in the 50% to 60% range on a quarterly basis. It just the opportunity is really big, and with the breadth of platform that we're introducing, we see a lot of opportunity in our existing installed base. And Jay?

Jay Chaudhry

Yes, I think the product innovation is accelerating. Three years ago, I would be working on three new streams. Now I'm working on six new streams and we should, because we are a larger company, we have more capacity, more cycles. So we don't plan to slow down innovation side.

I think what's exciting that I am becoming more and more convinced is that security market will keep on accelerating and changing massively. All of us think about security. We put them in a couple of buckets. Here is a firewall VPN. Here is endpoint. Here is identity. And then the whole range of other things out there, but try to compare the change in security to what happened when cloud started, when AWS started to sell, what did they sell? Compute storage and connectivity. No. Do you really go there for cloud computing story? Yes. Yes. It's kind of basic, it's table stakes.

You go there because there's so many new products being offered that make it easier to develop product, even building network as a part of the cloud. Did you ever think that routers won't be all part of the cloud? They are, because they're making it easy. Did you think load balances should be part of that cloud offered by AWS? Well, they are, they're being offered. So you're seeing innovation.

We think the same kind of innovation is going in the security space and we are leading it. And the biggest disruptor of this is zero trust, which is upending, the traditional firewall, which was the Linchpin of Netflix secure. We are basically saying if we are on the switchboard, we should be doing everything.

We could be doing the most exciting part of our new offering besides ZDX which is very good is under ZCP product line cloud protection is really how do workloads communicate with each other? Just like we did ZIA for users, ZPA for users. No, we have available what we call ZIA for workloads and ZPA for workloads. And we kind of bundled it under the name, we announced in December call workload communications.

Who else is talking about that? Nobody, you know why? Because for workload communication, they're basically extending their current corporate network to every availability zone. If you've got 16 zones, you create a mesh network in 16 zones, almost like a branch network. And you put lots of virtual firewalls around it. That's the only way the world knows how to do it.

We are the pioneers who are taking Zero Trust for workloads, the market. So that's in early stage. We recently launched a product and we think there will be a big opportunity. So these are the kind of innovations that will further disrupt the market. We don't think the market will remain almost status quo. The way firewalls have had it on since starting one. In early '90s, 30 years, VPNs, for 25 years, all that is changing and we are well positioned to really take advantage of the new model.

Patrick Colville

And I mean, Zscaler, three years ago, IPO was an easy company to understand because you had ZIA and ZPA. Now there's a lot more products. Just help us conceptualize, which of those products you think are most excited about? Which are the ones we should really focused on and spend the time speaking to your customers and partners about, because these are the products like really exciting?

Jay Chaudhry

Yes. Sometimes we wonder how to communicate this message because ZIA and ZPA of IPO times are very different than ZIA and ZPA today, in terms of the number of modules in each have expanded quite a bit. For example, out-of-band CASB, it's subsumed. I think band CASB is part of it. DLP has fully born is become very big. The whole market for data protection that vendors like Symantec want to date for traditional line, it's all part of it. So I think it is increasing our TAM. It's making it easier for customers to say, oh, I can turn this thing on and this thing starts working. So ZIA and ZPA are growing. They will keep on growing it. It won't going to stop, for example, browser isolation. I didn't think that it will be needed for both. It is now part of ZPA for data protection. It's part of ZIA for cyber protection.

And so those two are obviously big pillars, but ZDX is exciting. It's a fairly well-defined specialty product. We priced it at actually pretty attractive price off. We get about 25 bucks per user. That's what we shared at the Analyst Day, but that pricing makes it easy for customer to buy ZDX for every user, okay. We think it's a matter of time, but every customer will have a ZIA, ZPA and ZDX for all users. So that's one, that's all about users.

Then you look at all about workloads. And that's what already talked about ZIA and ZPA for workloads. I think that will be our biggest force. It will be highly - it is highly differentiated different architecture, and that will be supplemented by two more areas. Workload micro-segmentation, which is more advanced segmentation at the process level, we entered in that market through the acquisition of Edgewise Networks.

And the other piece which all of us read about because it's written so much, it is the cloud security posture, cloud entitlement. You – I think about that almost like API-based CASB, okay. We make API calls to the database of logs. We see is it configured, right, is it not configured right. Nobody will have a highly differentiated long-term advantage in that market because the barriers to entry are small. But I think if you - we are there because we need to round out and offer the whole portfolio. But I think overall ZCP market is a massive opportunity. It will keep you grow, but it is not early stage. And we are investing heavily in that market.

Patrick Colville

And actually - and I want to talk to you about Zscaler Cloud connector. And I guess the reason why is because we spoke to a partner of yours, who got phenomenally excited about the Zscaler Cloud connector. And so, it's always interesting kind of to hear that where partners are like, you guys got to check this out. So just help us to understand that product and the use case.

Jay Chaudhry

Yes. It is interesting how our partners describing it because some of my engineers and PM talk about cloud connector. So cloud connector is a mechanism to send traffic from a workload, auto VPC to either ZIA cloud or ZPA cloud. So when I said, we now have ZIA for workloads and ZPA for workloads, it's the same engine, but the way we can all get traffic to it through cloud connector. Now you could think about a cloud connector is actually similar to client connector, which we deploy on a laptop, so traffic comes to us. So cloud connector is fairly simple, okay. But without this workload communication module, which is actually ZIA and ZPA workloads, it won't work. So it is the enabling piece for us to sell ZIA and ZPA for workloads. Make sense?

Patrick Colville

Yes, that does make sense. I appreciate that.

Jay Chaudhry

And it's free, by the way, we don't charge for cloud connector, just like we don't charge for client connector. It's a way of sending traffic. For users, we charge by number of users. For workloads, we charge by number of workloads and the mechanism and software do send traffic to us is always free.

Patrick Colville

Okay. And I guess, I mean, switching to kind of ZPA, when we do our checks speaking to customers, it typically the ZIA product is scaled to 100% of users almost from the get-go when - at the point of license, go to 100%. What we found that ZPA is typically scaled to subset of users and then kind of gradually expands. Is that - I mean, do you think that dynamic will remain? It's probably - it's like - or do you think there's a point where ZPA gets to 100% of users.

Jay Chaudhry

Even before COVID I said that it is a matter of time when every customer - every user will have ZIA and ZPA and actually I've been saying ZDX to now. Pre-COVID customers will start somewhere in that 30%, 40%, 50% of the total. ZAI users will do ZPA. COVID certainly changed that because everyone needed to go and access those applications. I know with Zero Trust customers want to make sure whether users are at home or back in the office. They really need to go through Zero Trust switchboard for Zscaler.

So we are seeing more and more and more deals. Most of our deals are actually ZAI equal to ZPA though it's not the same in most cases, but think off even a couple of years down the road as most of the applications are setting in public cloud. Data center has a minimal role to play. You may be sitting in the office. You need to go through Zscaler ZPA to access those applications. That's the only right abroad. So I'm pretty convinced that it's a matter of time when the number of users for ZIA, ZPA and ZDX will be pretty close to each other.

Patrick Colville

And how does this translate to numbers? You know, Remo, you said that ZPA was 27% of new and up-sell to give - I actually don't know where that's trended from. So like it - has that declined over time, as a proportion of new and up-sell has that increased over time. And I guess help us understand how we should conceptualize going forward that kind of mix?

Remo Canessa

Yes. I mean - and again, when you compare apples to apples, because the last - the year before this past year, we did not have really any substantial ZDX or ZCP business. And if you just compare purely to ZIA and ZPA on a year-over-year basis, ZPA has increased as a percentage. It's close to 30%. If you take a look at our entire platform, ZPA was 27% in fiscal 2021. So slightly down from where it was in fiscal 2020. But again, we're selling our broader platform with the emerging products, which represented the higher single - represented high single digits of our new and up-sell.

Going forward, as Jay mentioned, our view is that all - all companies will buy for 100% for users, 100% for ZPA and 100% for ZDX. How that happens and what timeframe? And that's hard to say. What I can say also is that basically there's a lot of opportunity for us to up-sell the ZPA. 44% of our G2K customers have both ZIA and ZPA. So there's an opportunity still to up-sell. So, our view like Jay said, one for one for one, ZIA, ZPA and ZDX, but it's going to take time

Patrick Colville

And what's the catalyst, I mean, Jay highlighted the catalyst for ZPA adoption was coronavirus. Do you need another global pandemic to catalyze ZDX and ZCP adoption?

Jay Chaudhry

So, ZDX so first of all, yes, ZPA became pandemic because everyone had to work from home, but then all these Ransomware related attacks, which happened because people get on the network and move laterally. For now, the bigger catalyst for ZPA is Zero Trust, don't put people on the network. Now, ZDX catalyst became working from anywhere when users are working somewhere, IT doesn't know how to troubleshoot when users complaint. So as we know, the world is not going to go back to the same old thing. It always be a hybrid environment and that essentially will keep on driving the need for ZDX and ZPA front.

Patrick Colville

Right, well, thank you so much. I mean, I think for me the key pick from the call is the demand environment remains really healthy, the COVID tailwinds still there, but now increasingly the demand driver, Zero Trust adoption channel playing an increasingly important role, especially in the mid-market segment, which is now the fastest growing segment at Zscaler and Zscaler is increasing quota carrying sales rep on an absolute basis, more in fiscal 2022 than happened in fiscal 2021. Really, fascinating conversation. Jay, Remo thank you so much for your time. It's been great.

Jay Chaudhry

Great, thank you Patrick.

Remo Canessa

Patrick, thank you.

Jay Chaudhry

See you later, bye.

Patrick Colville

Stay healthy. Bye-bye.

Remo Canessa

Good bye.

Jay Chaudhry

You too.