Zscaler Inc FQ4 2026 Earnings Report

EXECUTIVE CALL SUMMARY: Zscaler Inc. (09/03/26)

Zscaler’s fiscal Q4 2026 results support a constructive assessment of operating execution, but not yet a definitive conclusion that the company has entered a sustained growth reacceleration. Organic net new annual recurring revenue, defined here as excluding Red Canary, grew 17%, compared with 14% in Q3 and 10% in H1. Revenue exceeded consensus by 2.4%, adjusted EPS exceeded consensus by 9.2%, and adjusted operating margin reached a record 24.3%. These results demonstrate improving sales execution and broader platform adoption. However, fiscal 2027 guidance implies approximately 4% growth in organic net new ARR at the midpoint, while capital intensity is increasing and free cash flow remains materially less impressive than adjusted operating profitability. The appropriate investment stance is HOLD existing exposure, with material additions contingent on stronger evidence of sustained organic demand and adequate valuation support.

The central investment debate is whether management has established a deliberately conservative fiscal 2027 baseline or whether the outlook more accurately reflects the time required to monetize AI security, complete sales leadership transitions, and improve new-customer acquisition. Both interpretations have supporting evidence. Security for AI bookings increased more than 50% sequentially, the associated pipeline increased 75%, and Zero Trust Everywhere adoption expanded substantially. Conversely, several strategically important products remain in early access or are expected to contribute meaningfully only in H2 fiscal 2027 and fiscal 2028. Management did not quantify the AI contribution embedded in guidance, making it impossible to distinguish a large unmodeled opportunity from a necessary component of achieving the existing forecast.

The most important distinction is between accelerating net new ARR and accelerating total ARR. Q4 organic net new ARR growth improved to 17%, but organic ending ARR growth slowed to 20% from 21% in Q3. Fiscal 2027 guidance implies approximately 17% consolidated ARR growth and approximately 17.6% growth excluding a flat Red Canary base. The business is generating incremental recurring revenue more effectively, but that improvement has not yet translated into a higher growth rate across the entire installed base.

Cash generation is the principal financial qualification. Q4 free cash flow declined 64.7% to $60.8 million, despite record adjusted operating profitability. Fiscal 2026 free cash flow increased only 7.2%, versus 25.4% reported revenue growth, and the free cash flow margin declined to 23.2% from 27.2%. Management attributed the weakness to capital spending and collection timing, but fiscal 2027 guidance explicitly assumes continued elevated investment. The cash flow impact therefore cannot be dismissed as an isolated Q4 procurement event.

The reported 3% premarket share-price decline in the September 4 Bloomberg notice is consistent with this divergence between strong historical execution and less compelling forward growth and cash conversion. The quarter reduced concern about immediate sales disruption, but did not eliminate the need to demonstrate that AI adoption can support durable growth without an enduring increase in capital requirements.

QUARTERLY RESULTS AND THE QUALITY OF THE BEAT

Q4 revenue was $898.2 million, compared with $719.2 million in the prior-year period and $850.5 million in Q3. Growth was 24.9% year over year and 5.6% sequentially. Revenue exceeded Bloomberg consensus of $877.2 million by approximately $21.0 million and exceeded the upper end of management’s prior $875 million to $878 million guidance by $20.2 million. The result represents a clear operating beat rather than merely favorable positioning within an unusually wide guidance range.

Adjusted operating income increased 37.5% to $218.4 million from $158.9 million, exceeding the prior $206 million to $208 million guidance range. Adjusted operating margin increased approximately 220 basis points year over year to 24.3% and improved from approximately 23% in Q3. Approximately 33% of the incremental year-over-year revenue converted into incremental adjusted operating income. This demonstrates meaningful operating leverage while the company continues investing in product development and sales coverage.

Adjusted EPS of $1.19 increased 33.7% from $0.89 and exceeded both consensus and the upper end of prior guidance by $0.10. However, the EPS beat was not entirely attributable to operating performance. The prior forecast assumed approximately $24.5 million of net other income and 168 million diluted shares. Actual adjusted pretax income less adjusted operating income implies approximately $32.4 million of net other income, while actual adjusted diluted shares were approximately 166.5 million. Relative to the prior operating assumptions, approximately $0.054 of EPS upside came from operating income, approximately $0.037 came from higher net other income, and roughly $0.011 came from the lower share count. These approximate contributions explain the stronger EPS surprise relative to the revenue surprise.

Year-over-year EPS growth also benefited from the reduction in the adjusted tax rate to 21% from 23%. At the current quarter’s adjusted pretax income and share count, that tax-rate change contributed approximately $0.03 per share. The improvement in earnings is substantial, but the underlying operating progression is better assessed through revenue, ARR, operating income, and cash generation than through EPS alone.

The precise ending ARR figure was $3.771 billion, rather than the rounded $3.8 billion used during the call. This distinction is important when calculating fiscal 2027 net new ARR. Ending ARR exceeded consensus of $3.740 billion by $31 million and exceeded the prior management range of $3.740 billion to $3.749 billion by $22 million to $31 million. Against the prior midpoint, the approximately $26.5 million ARR beat equated to roughly 12% upside to the implied quarterly net new ARR expectation.

Fiscal 2026 revenue reached $3.353 billion, compared with the May guidance range of $3.3295 billion to $3.3325 billion. Adjusted operating income of $767.1 million exceeded the prior $755 million to $757 million range, and adjusted EPS of $4.21 exceeded the prior $4.10 to $4.11 range. The fiscal year therefore finished above management’s latest revenue, ARR, operating income, and EPS forecasts. Free cash flow margin of 23.2%, however, finished within the reduced 22.8% to 23.3% guidance range rather than reversing the earlier deterioration in cash conversion.

ORGANIC GROWTH, ACQUISITION EFFECTS, AND RECURRING-REVENUE QUALITY

Total Q4 net new ARR was $246 million, up 24%. Excluding Red Canary, net new ARR was $232 million, up 17%. Red Canary’s ARR increased to $141 million from $127 million in Q3, accounting for the remaining $14 million of quarterly additions. Approximately 94% of Q4 net new ARR therefore came from the business excluding Red Canary, supporting the conclusion that the quarter’s improvement was primarily operational rather than acquisition-driven.

The progression from 7% organic net new ARR growth in fiscal 2025 to 10% in H1 fiscal 2026, 14% in Q3, and 17% in Q4 is the strongest quantitative evidence of improving underlying demand and execution. Nevertheless, these are growth rates of incremental ARR, not growth rates of the total recurring-revenue base. A business can accelerate net new ARR while its total ARR growth rate declines, particularly when the installed base is large and the preceding period included stronger historical additions.

Acquisition effects remain material to the reported growth profile. Fiscal 2026 revenue increased 25.4%, but revenue excluding Red Canary increased approximately 20.0% to $3.209 billion. Red Canary contributed approximately $144 million, representing roughly 5.4 percentage points of reported revenue growth. Similarly, consolidated ARR grew approximately 25%, compared with approximately 20% excluding Red Canary. The reported growth rate therefore overstates the growth of the pre-acquisition business, although the ex-Red Canary performance remains healthy.

The term organic also requires qualification. Management specifically excluded Red Canary, rather than providing a complete acquisition-adjusted bridge for every acquired technology. Symmetry’s contribution was described as immaterial, making the distinction unlikely to change the financial conclusion materially, but the disclosed measure remains an ex-Red Canary proxy rather than a fully audited acquisition-neutral growth measure.

Net revenue retention was 115% in every quarter of fiscal 2026. Kevin Rubin stated, “NRR, although it’s not a metric that we provide each and every quarter, it was consistent each quarter this year at 115%.” This is encouraging evidence of stable expansion within the installed base, but it does not show accelerating retention despite the broader product portfolio, Z-Flex adoption, and increased AI interest. The expansion engine is functioning, but the aggregate customer metric has not yet moved higher.

The reported nearly 30% average ARR uplift for Z-Flex customers should not be interpreted as equivalent to 130% companywide retention. Z-Flex customers are a selected cohort entering broader contractual relationships, while companywide retention includes customers with weaker expansion, contraction, and churn. The difference reinforces the importance of measuring how widely Z-Flex’s expansion benefits extend across the installed base.

Enterprise penetration continued to improve. Customers generating more than $1 million in ARR increased 18% to 785, while customers generating more than $100,000 increased 20% to 4,182. Customers exceeding $10 million in ARR nearly doubled. These figures demonstrate increasing strategic relevance, although the growth in very large accounts also raises the importance of renewal concentration, implementation quality, and dependence on a relatively small number of substantial transactions.

Fortune 500 penetration increased from 45% to 50%. On a constant constituent base, that represents approximately 25 additional companies, although the call did not provide enough detail to treat that figure as an exact Q4 new-logo count. Management also identified approximately 4,600 customers within a targeted universe of 20,000 companies. This suggests substantial remaining account coverage opportunity, but does not establish an independently validated addressable revenue pool or uniform commercial accessibility across those prospects.

FISCAL 2027 GUIDANCE AND THE PRIOR-GUIDANCE COMPARISON

Fiscal 2027 revenue guidance is $3.908 billion to $3.938 billion, implying 16.6% to 17.5% growth. ARR guidance is $4.396 billion to $4.426 billion, implying 16.6% to 17.4% growth. These forecasts modestly improve upon the preliminary May framework of 16% to 17% growth in both measures. The revision is positive, but incremental rather than transformational: the new midpoints are approximately 17%, compared with 16.5% under the earlier framework.

The dollar improvement also reflects the higher fiscal 2026 exit base. Applying the earlier growth framework to the earlier fiscal 2026 guidance produces a lower fiscal 2027 dollar expectation than applying it to the actual year-end results. Consequently, part of the increase in implied fiscal 2027 revenue and ARR comes from the Q4 beat carrying forward, rather than a major change in expected growth during fiscal 2027.

Against the consensus figures in the Bloomberg notice, annual revenue guidance is only modestly favorable. The $3.923 billion midpoint is approximately 0.3% above the $3.91 billion estimate. The $4.411 billion ARR midpoint is approximately 0.9% above the $4.37 billion estimate. Adjusted EPS guidance of $4.86 to $4.90 is more meaningfully above the $4.61 estimate, with the midpoint approximately 5.9% higher. The forward surprise is therefore predominantly earnings-related rather than evidence of a major revenue or ARR upgrade.

The critical calculation is the implied net new ARR. Subtracting the actual $3.771 billion opening base from fiscal 2027 guidance produces $625 million to $655 million of net new ARR, with a midpoint of $640 million. Fiscal 2026 ending ARR excluding Red Canary was $3.630 billion, compared with $3.015 billion at the end of fiscal 2025, implying $615 million of annual additions excluding Red Canary. With management expecting no standalone Red Canary net new ARR contribution in fiscal 2027, the new forecast implies approximately 1.6% to 6.5% growth in the comparable additions, or 4.1% at the midpoint.

This calculation validates the substance of Ittai Kidron’s question regarding approximately 4% implied growth. It also explains the apparent tension between bullish commentary about 17% growth and cautious commentary about deceleration. Approximately 17% growth in the total ARR balance is not equivalent to 17% growth in organic net new ARR. The fiscal 2027 forecast assumes a meaningful slowdown in the latter relative to Q4.

Maintaining Q4’s 17% organic net new ARR growth rate across the full fiscal year would produce approximately $720 million of additions and ending ARR of approximately $4.49 billion, assuming no separate Red Canary growth. That would exceed the guidance midpoint by approximately $80 million, or 1.8%. Restoring consolidated ARR growth to 20% would require approximately $754 million of additions, equivalent to roughly 23% growth over fiscal 2026’s organic additions. The hurdle for a genuine return to 20% growth is therefore appreciably higher than merely sustaining the Q4 trajectory.

Management’s explanation for the conservative forecast was specific but not fully quantified. Rubin cited the duration of the sales leadership transition, the adoption pace of the integrated SecOps offering, continued 115% retention, and opportunities to improve new-logo acquisition. When asked whether AI security was materially embedded in guidance, he responded, “We haven’t specifically called out the contributions from Security for AI in the guidance.” This leaves an important modeling gap. AI should not be assumed to be entirely excluded from the forecast or automatically treated as incremental upside.

SEASONALITY AND THE TIMING OF EXECUTION RISK

Management expects 37% of fiscal 2027 net new ARR in H1, including 15% in Q1. At the annual midpoint, those proportions imply approximately $96 million in Q1, $141 million in Q2, and $403 million in H2. These are mechanical implications of the annual forecast and disclosed seasonality, not separate quarterly guidance ranges.

The H2 weighting is operationally important, but it is not materially more back-end-loaded than the comparable organic pattern in fiscal 2026. Fiscal 2026 organic net new ARR was approximately $615 million, including $153 million in Q3 and $232 million in Q4. This implies approximately $230 million in H1, or 37.4% of annual additions. The fiscal 2027 H1 assumption of 37% is therefore broadly consistent with the preceding year’s organic seasonality.

This distinction qualifies the more cautious sell-side characterization of an increasingly H2-dependent setup. The principal concern is not an unusually large shift in the numerical seasonal distribution. It is the concentration of several operational dependencies within the same period: sales leadership stabilization, productivity from new account executives, adoption of Agentic SecOps, and scaling of the new agent and endpoint AI products.

Q1 revenue guidance of $935 million to $939 million implies approximately 19% year-over-year growth and approximately 4.3% sequential growth at the midpoint. Adjusted operating income guidance of $215 million to $217 million implies approximately 23% margin, below Q4’s 24.3%. Adjusted EPS guidance of $1.15 to $1.16 is also below Q4’s $1.19 despite higher expected revenue. This sequential moderation is consistent with investment timing and seasonality, but demonstrates that Q4’s record profitability should not be annualized without adjustment.

For the full year, adjusted operating income guidance of $924 million to $932 million implies approximately 21% growth and approximately 23.7% margin. At the midpoints, the remaining Q2 through Q4 periods require an aggregate operating margin of approximately 23.8%, following Q1’s approximately 23%. The profitability forecast does not require an extreme margin ramp. The more consequential uncertainty lies in the recurring-revenue trajectory and capital spending required to support it.

AI SECURITY: STRONG COMMERCIAL SIGNALS, INCOMPLETE FINANCIAL DISCLOSURE

Jay Chaudhry’s statement that “AI is quickly becoming the largest tailwind we have ever seen” was the call’s central strategic assertion. The commercial evidence is directionally supportive: Security for AI bookings increased more than 50% sequentially, the pipeline expanded 75% sequentially, and 70% of Security for AI transactions included Data Security. However, the absence of absolute quarterly bookings, ARR, recognized revenue, and conversion data prevents a reliable estimate of the immediate financial contribution.

The AI opportunity consists of distinct mechanisms that should not be conflated. AI-enhanced attacks can increase demand for existing Zero Trust protections. Enterprise adoption of AI applications and agents can create demand for new access controls, data protection, inspection, and governance products. Separately, AI can automate security operations through Agentic SecOps. The 1st mechanism primarily supports the existing platform; the 2nd creates additional products and consumption meters; the 3rd extends Zscaler into a broader security operations market.

This distinction matters because not all AI-related demand represents a new revenue pool. Some spending may accelerate replacement of legacy infrastructure, some may expand existing contracts, and some may be reallocated among modules inside Z-Flex. The bookings narrative therefore needs to be reconciled with incremental ARR and retention, rather than treated as wholly additive to existing growth assumptions.

The transportation customer example provides evidence of commercial relevance. A 7-figure Z-Flex upsell incorporating Security for AI increased the customer’s ARR to nearly $10 million after a competitive evaluation involving 2 platform vendors. The semiconductor customer’s 7-figure expansion to secure a companywide Claude Cowork deployment suggests demand across endpoints, agent communication, and private and public model environments. These examples are more informative than generic expressions of interest because they involve contractual expansion and competitive selection.

Nevertheless, the examples are selected wins rather than a representative sample of the pipeline. The call did not disclose aggregate win rates, discounting, average contract duration, product-level profitability, or whether AI deployments consistently expand total customer spending after allowing for displaced modules. The evidence supports product-market traction, but not yet a fully established category-level financial model.

The 70% Data Security attachment rate is strategically meaningful. AI deployments expose weaknesses in data classification, access governance, and exfiltration controls, making existing data security products a plausible monetization channel even before agent-specific products scale. However, the attachment percentage does not reveal whether Data Security was newly purchased, already deployed, or bundled at incremental discounts. It establishes commercial adjacency more clearly than incremental revenue magnitude.

The Zero Trust Exchange for agents and Endpoint AI Security remain in early access and are expected to scale in H2 fiscal 2027. This timing limits their contribution to near-term reported revenue. It also means that some of the most strategically differentiated elements of the AI thesis remain dependent on product readiness, enterprise deployment, and customer adoption rather than established recurring revenue.

ARCHITECTURAL ADVANTAGES AND THE LIMITS OF MANAGEMENT’S SECURITY CLAIMS

Zscaler’s architecture is well aligned with the need to govern interactions among users, workloads, applications, and agents. An inline policy-enforcement layer can restrict access before an entity reaches an application and can inspect permitted interactions for sensitive data or prohibited behavior. This extends the company’s relevance beyond employee access and creates a credible pathway to monetizing machine-to-machine activity.

Management’s distinction between identity and enforcement is important. Chaudhry stated, “While identity solutions answer who is requesting access, our in-line exchange determines what that user or agent should be allowed to do and enforces that policy in real time.” Identity verification alone does not establish whether a specific action is authorized or safe. Zscaler’s opportunity is complementary to identity platforms, not necessarily a wholesale replacement for them.

The associated limitations are equally important. A valid identity with excessive permissions can still perform damaging actions. An authorized interaction can contain malicious instructions or sensitive data. Traffic outside the controlled path, incorrect policy configuration, application vulnerabilities, compromised endpoints, and privileged administrative access remain relevant risks. Zscaler’s architecture can reduce exposure and constrain lateral movement without eliminating the need for patching, endpoint protection, application security, or rigorous identity governance.

The statement “You cannot win a patching race against AI” captures the potential mismatch between vulnerability discovery and enterprise remediation capacity. It does not establish that patching becomes unnecessary or that network isolation can compensate for every application-level vulnerability. Similarly, the claim that an attacker “cannot breach what it cannot reach” should be interpreted as an architectural principle rather than a guarantee of comprehensive protection.

Management’s risk assessments found exposed AI assets at more than 90% of assessed organizations and known exploitable vulnerabilities at more than 33%. These findings support urgency within the assessed population, but the sample was drawn from enterprises engaging with Zscaler. It should not be treated as a statistically representative estimate of all enterprise environments. The cited autonomous-agent incidents also remain management-provided examples rather than independently established evidence of the frequency or economic severity of such attacks.

The platform’s more than 750 billion daily transactions provide potentially valuable telemetry, but transaction volume alone does not prove superior detection quality. Security outcomes depend on signal quality, contextual enrichment, coverage, false-positive rates, latency, and the effectiveness of remediation. The scale advantage is plausible, but its economic value ultimately depends on demonstrably better outcomes at acceptable infrastructure and inference costs.

AGENTIC SECOPS, RED CANARY, AND INTEGRATION ECONOMICS

Agentic SecOps is the most significant strategic extension discussed on the call. Management’s proposition combines existing Zscaler telemetry, Red Canary’s detection and response expertise, AI-driven investigation, and remediation through the Zero Trust Exchange. If effective, this could reduce the time between detection and enforcement and expand Zscaler’s role from access and data protection into security operations.

Chaudhry identified the opportunity as “closed-loop remediation” and argued that existing telemetry and inline control could allow responses within minutes. The relevant differentiation is not merely the use of AI agents, which competitors can also claim. It is the ability to connect detection, investigation, and policy enforcement using data and controls already embedded in the customer’s environment.

The commercial opportunity remains dependent on execution. Security operations teams require evidence of reliable investigation, low false-positive rates, broad telemetry integration, auditable decisions, and safe automated actions. An agent-native architecture can reduce labor requirements, but excessive remediation autonomy can also create operational risk. The call did not provide production benchmarks, pricing, customer counts, or unit economics sufficient to validate the magnitude of the claimed advantage.

Management was explicit about timing: “In the first-half of the year, it’s going to take some time to take-off, but it should start contributing in second-half and then fiscal ’28.” The product therefore represents more substantial medium-term optionality than a demonstrated near-term earnings driver. Its anticipated contribution also overlaps with the period when other new AI products are expected to scale, creating correlated execution risk.

Red Canary’s standalone financial profile is less compelling than the strategic integration narrative. The acquired business ended fiscal 2026 with $141 million of ARR and contributed $144 million of revenue, but management acknowledged elevated churn relative to Zscaler’s core business. Rubin stated, “We’re not expecting any net new ARR contribution. All of that will show up in the integrated solution going forward.”

This is not equivalent to saying that churn has ended. Management expects the more traditional churn characteristics of the managed detection and response business to continue. A flat standalone ARR assumption can therefore require replacement sales and expansion merely to offset customer losses. Maintaining the acquired base should be distinguished from generating new economic value through the integrated product.

The initial conservative recognition of acquired ARR also complicates historical comparisons. Management stated that it had not initially known how much of the acquired book would prove durable. Subsequent increases in included ARR can therefore reflect validation of contracts and renewals as well as commercial growth. Red Canary’s sequential ARR increase should not automatically be interpreted as a clean standalone organic growth rate.

As the offering becomes integrated, reported product growth will need to distinguish genuinely incremental customer spending from migration of existing Red Canary contracts or reclassification of revenue within the platform. Without that bridge, rapid growth in an Agentic SecOps category could overstate the incremental contribution to consolidated ARR.

NON-SEAT MONETIZATION AND PLATFORM EXPANSION

Approximately 30% of Q4 and fiscal 2026 new and upsell ACV came from non-seat-based offerings, and ARR associated with those offerings increased more than 100%. This is strategically important because it reduces dependence on enterprise employee growth and creates monetization opportunities tied to workloads, branches, devices, data volumes, queries, and AI consumption.

The denominator is critical. The 30% figure refers to new and upsell ACV, not total company revenue, total ARR, or all renewal activity. The more than 100% ARR growth figure also lacks an absolute base and detailed acquisition perimeter. These metrics demonstrate a changing growth mix, but do not establish that the entire company has become predominantly consumption-based.

Non-seat monetization can improve long-term resilience if enterprise automation reduces employee counts while increasing machine activity. However, it introduces different economic sensitivities. Customers can optimize workloads, reduce inspection volumes, compress token consumption, or negotiate committed-use discounts. Infrastructure and inference costs can also scale with usage. The long-term benefit depends on maintaining attractive gross profit per unit of activity rather than simply increasing transaction volumes.

Zero Trust Everywhere enterprises increased to more than 950 from more than 700 in Q3 and more than 350 at the end of fiscal 2025. Using the disclosed thresholds, this represents substantial sequential and annual expansion in customers purchasing the user, branch, and cloud offerings together. The metric is strong evidence of broader platform adoption, although purchase does not necessarily establish complete deployment or realized customer usage.

The branch and cloud examples demonstrate new entry points into accounts. The healthcare equipment manufacturer began with production-site and OT protection rather than employee access, while the aerospace customer expanded cloud security during a divestiture. These use cases broaden the addressable buying centers and reduce reliance on a single product-led sales motion.

The Google Cloud managed-service extension can reduce deployment friction and improve multicloud coverage. However, management’s claim that configuration can occur in less than 10 minutes should not be equated with full enterprise implementation. Application mapping, policy design, testing, change management, and production rollout remain separate activities.

Z-FLEX, BACKLOG, AND CONTRACT QUALITY

Z-Flex generated more than $770 million of Q4 total contract value, compared with approximately $480 million in Q3, and more than $1.7 billion for fiscal 2026. The program’s flexibility can reduce procurement friction, support broader commitments, and allow customers to adopt products as requirements evolve. Management’s explanation was direct: “Z-Flex is not about mandating Z-Flex is about providing flexibility.”

The investment significance lies in the ability to convert product breadth into larger and longer customer relationships. Customers can add or exchange modules without repeating the full procurement process, potentially increasing platform adoption and reducing competitive opportunities at individual product renewals. Premium deployment assistance can also improve implementation success.

However, total contract value is not annual recurring revenue. The examples included 3-year and 5-year commitments, making duration an important contributor to bookings growth. The $770 million quarterly figure should not be annualized into a revenue run rate or treated as comparable to quarterly net new ARR. Likewise, the $1.7 billion annual total does not independently quantify incremental recurring revenue after renewals, contract extensions, and product substitutions.

The flexibility to swap products is commercially attractive but creates an analytical challenge. Adoption of a new AI module may represent additional spending, substitution for an existing module, or activation under a previously committed agreement. Product-level adoption and consolidated expansion therefore need separate measurement. The nearly 30% average ARR uplift provides evidence of economic expansion within the Z-Flex cohort, but does not disclose discounting or the timing of deployment.

RPO increased approximately 27% to $7.4 billion, with approximately 45%, or $3.33 billion, classified as current. That current balance is approximately 85% of fiscal 2027 revenue guidance at the midpoint, indicating meaningful contracted visibility. It is not a guaranteed revenue floor, because recognition timing, contract conditions, renewal assumptions, and the composition of shorter-duration arrangements still matter.

Deferred revenue increased approximately 19% to $2.93 billion, slower than revenue and RPO. The divergence is consistent with differences in contract duration and invoicing schedules and does not by itself establish demand deterioration. Nevertheless, it reinforces the need to distinguish contract value, billing, collections, ARR, and recognized revenue. Longer commitments can improve visibility without producing proportionate near-term cash receipts.

The company defines ARR as the next 12 months of subscription revenue under contracts, assuming expiring contracts renew on existing terms. This is not identical to currently deployed usage annualized at a single point in time. Contract ramps, renewal assumptions, and implementation schedules are therefore relevant to interpreting the relationship between reported ARR and actual platform consumption.

SALES EXECUTION, RESTRUCTURING, AND GEOGRAPHIC PERFORMANCE

Record Q4 sales productivity and the highest annual productivity since 2022 suggest that the transition from opportunity-led selling to account-focused selling is producing benefits. Broader account planning can improve cross-selling and reduce fragmented product discussions, particularly as the platform expands.

However, management did not provide the productivity denominator, quota attainment distribution, salesforce attrition, ramped representative count, or new-hire productivity. Record productivity can coexist with uneven geographic execution or insufficient coverage. The evidence reduces concern about a broad sales breakdown, but does not establish that every part of the organization has stabilized.

The 2 leadership departures remain relevant. The vertical role was filled internally, and a candidate accepted the geographic leadership position. Rubin stated, “We expect that the leadership transition will play-out in the first half of this fiscal and that is reflected in our guidance.” The company has addressed the vacancies, but onboarding and territory execution remain part of the fiscal 2027 forecast risk.

The approximately 3% workforce restructuring, with expected charges of $30 million to $33 million, was framed as resource reallocation toward AI and growth priorities. Simultaneously adding specialists, enterprise account executives, and channel resources is consistent with shifting investment rather than a broad retreat from growth. However, management did not specify the affected functions or the net employee-count effect, despite being asked. The extent to which the restructuring funds new investments versus contributes incremental savings therefore remains unclear.

Cash acquisition costs also warrant attention. Q4 deferred contract acquisition costs consumed approximately $127.5 million of operating cash, compared with $90.5 million a year earlier. Full-year cash spending on these costs increased approximately 35% to $312.2 million, faster than revenue. Longer contracts and larger transactions can increase upfront commissions, so this is not direct evidence of worsening customer acquisition economics. It does demonstrate that improving reported productivity does not automatically translate into proportionate near-term cash efficiency.

Regional growth was positive but uneven. The Americas represented 57% of quarterly revenue and grew approximately 30%, EMEA represented 27% and grew approximately 17%, and APJ represented 16% and grew approximately 23%. EMEA remained the slowest-growing major region. Because acquisition effects were not reconciled geographically, the stronger Americas performance cannot be assumed to represent entirely superior organic demand.

Federal business contributed a high-single-digit percentage of new ACV in fiscal 2026, similar to fiscal 2025, with similar expectations for fiscal 2027. The federal outlook therefore appears stable rather than a major incremental accelerator. It also does not justify assuming a substantial recovery-driven contribution beyond the existing guidance.

PROFITABILITY, STOCK COMPENSATION, AND SHAREHOLDER ECONOMICS

Adjusted gross margin increased to 80.2% from 79.3% in Q4, but the comparison benefited from the prior-year government private-cloud deployment, which included lower-margin hardware. Full-year adjusted gross margin increased only approximately 20 basis points to 80.3%. The smaller annual improvement is a better indication of the underlying gross-margin progression than the quarterly comparison alone.

Fiscal 2027 gross margin guidance of approximately 80% implies modest pressure relative to fiscal 2026. Operating margin is nevertheless expected to rise to approximately 23.7% from 22.9%, requiring further leverage in operating expenses. At the guidance midpoints, approximately 28% of incremental annual revenue converts into incremental adjusted operating profit. This is credible operating leverage, but not evidence that increasing infrastructure costs are economically irrelevant.

GAAP profitability remains materially weaker. Q4 GAAP operating loss narrowed to $15.5 million from $32.2 million, while the full-year GAAP operating loss increased to $133.3 million from $128.5 million despite an improved margin. Fiscal 2026 GAAP net loss increased to $63.2 million from $41.5 million, with a higher tax provision contributing to the deterioration. Record adjusted profitability should therefore not be interpreted as established GAAP earnings profitability.

Fiscal 2026 stock-based compensation was approximately $821.9 million, or 24.5% of revenue. Including related employer payroll taxes, the adjustment was approximately $841.6 million. Stock-based compensation alone exceeded reported free cash flow of $779.1 million. Subtracting the accounting expense from free cash flow is not a precise measure of shareholder cash earnings, but the comparison demonstrates that equity compensation remains economically significant.

Dilution also affects the forward earnings bridge. Fiscal 2027 guidance assumes approximately 173 million diluted shares, compared with approximately 167.1 million in fiscal 2026, an increase of approximately 3.5%. As a result, adjusted EPS growth at the midpoint is approximately 15.9%, below the approximately 21% operating income growth rate. Per-share value creation will depend on both operating improvement and control of dilution.

Net other income of approximately $141 million represents roughly 13% of guided adjusted pretax income. The cash balance is a genuine financial asset, but changes in interest rates, acquisition spending, or capital deployment can affect EPS independently of the underlying security business. Valuation should distinguish operating earnings from income generated by financial assets.

CAPITAL INTENSITY AND FREE CASH FLOW

Q4 operating cash flow increased 11.4% to $279.3 million, but cash purchases of property, equipment, and other assets increased to $199.8 million from $60.0 million. Capitalized internal-use software was approximately $18.7 million in both periods. Free cash flow consequently declined to $60.8 million from $171.9 million, and the margin fell to approximately 6.8% from 23.9%.

The full-year reconciliation is similarly important. Operating cash flow increased to approximately $1.130 billion from $972.5 million. Capital expenditure increased to $277.3 million from $164.3 million, while capitalized internal-use software declined to $73.2 million from $81.5 million. After both deductions, free cash flow increased only $52.5 million to $779.1 million.

The quoted 8% fiscal 2026 capital expenditure ratio excludes internal-use software. Including that expenditure, the combined investment burden was approximately $350.5 million, or 10.5% of revenue. This distinction matters when assessing the economic capital intensity of the platform and comparing cash conversion with software companies that have different infrastructure requirements or capitalization policies.

Management had already reduced fiscal 2026 free cash flow margin guidance in May from 26.5% to 27% to 22.8% to 23.3%, citing higher infrastructure spending. The eventual 23.2% result met the reduced expectation, not the original cash-generation target. Similarly, the earlier fiscal 2027 capital-spending framework contemplated an increase of up to approximately 200 basis points from fiscal 2026 levels, while the new outlook specifies a low-teens percentage of revenue. Although the language is not sufficiently precise to calculate an exact revision, it indicates a higher spending burden than an approximately 10% interpretation of the previous framework.

At an illustrative 12% of fiscal 2027 midpoint revenue, capital spending excluding internal-use software would be approximately $471 million, around 70% above fiscal 2026. This is an analytical illustration rather than a company-provided point estimate. It demonstrates the magnitude of the potential cash requirement.

Fiscal 2027 free cash flow guidance of 23% to 23.5% implies approximately $899 million to $925 million, with a midpoint near $912 million. Maintaining this margin while capital spending increases substantially requires stronger operating cash generation. If capital expenditure were 12% of revenue and internal-use software remained near the fiscal 2026 dollar level, operating cash flow would need to reach approximately $1.46 billion. That would be roughly 29% growth, materially faster than guided revenue growth.

This does not make the forecast unattainable. Better collections, stronger operating earnings, and the timing of contractual payments can improve cash generation. It does mean that the free cash flow forecast embeds meaningful assumptions about cash conversion beyond merely maintaining the existing operating model.

The balance sheet provides capacity to fund the investment. Cash, cash equivalents, and short-term investments totaled approximately $3.47 billion, against approximately $1.7 billion of debt. The primary risk is therefore not near-term financing stress, but the return generated on additional infrastructure and product investment.

Management’s approximately 49% Rule of 40 result also requires context. Fiscal 2026 reported revenue growth of approximately 25.4% plus a 23.2% free cash flow margin produces approximately 48.7%. Using revenue growth excluding Red Canary produces approximately 43%. Fiscal 2027 midpoint revenue growth plus midpoint free cash flow margin produces approximately 40.3%. The company remains within a respectable growth-and-cash-generation profile, but the forward efficiency cushion is much narrower than the historical headline suggests.

INVESTMENT IMPLICATIONS, SCENARIOS, AND RISK PARAMETERS

The bullish interpretation rests on a credible mechanism: broader platform adoption, stable retention, improving sales productivity, and expanding non-seat monetization could generate stronger additions than the fiscal 2027 forecast assumes. The guidance only requires approximately 4% growth in organic net new ARR, leaving room for upside if the Q4 trajectory persists. The integrated platform also provides multiple ways to monetize AI adoption without requiring every new product to become independently large.

The bearish interpretation is that management’s conservatism reflects genuine constraints rather than unusually easy guidance. Retention remains unchanged, new-logo execution still requires additional investment, several products have limited production history, and infrastructure costs are rising. AI enthusiasm could improve customer engagement without producing a sufficiently large increase in recurring revenue or free cash flow to justify a premium valuation.

An illustrative base case, assigned a 55% probability, assumes fiscal 2027 ending ARR of approximately $4.40 billion to $4.46 billion, revenue of approximately $3.91 billion to $3.96 billion, and free cash flow margin of approximately 23% to 23.5%. Sales execution stabilizes, AI products contribute progressively, and performance remains close to or modestly above guidance. This outcome supports continued ownership at an appropriate valuation, but does not independently justify a major multiple expansion.

An illustrative bull case, assigned a 25% probability, assumes ending ARR of approximately $4.50 billion to $4.60 billion, revenue of approximately $3.98 billion to $4.08 billion, and free cash flow margin of approximately 24% to 25%. This requires sustained improvement in organic additions, effective new-logo hiring, measurable AI and SecOps monetization, and better cash conversion despite infrastructure spending. The investment benefit would come from both higher estimates and increased confidence that growth can remain near or above 20%.

An illustrative bear case, assigned a 20% probability, assumes ending ARR of approximately $4.25 billion to $4.35 billion, revenue of approximately $3.78 billion to $3.88 billion, and free cash flow margin of approximately 20% to 22%. The principal mechanisms would be delayed product adoption, weaker expansion, continued sales disruption, or capital spending that rises faster than monetization. These are analytical scenarios rather than management forecasts, and the probabilities are judgmental rather than statistically estimated.

The immediate post-call catalysts identified by management were the September 9 Agentic SecOps launch and the October 6 Investor Day. Their importance was the opportunity to clarify product readiness, commercial terms, addressable use cases, and medium-term financial assumptions. The more decisive operating tests extend through H1 fiscal 2027, when the sales transition is expected to conclude, and H2 fiscal 2027, covering February through July 2027, when the new agent, endpoint, and SecOps products are expected to contribute more materially.

The most useful positive confirmation would be sustained double-digit organic net new ARR growth, retention remaining at or improving from 115%, identifiable incremental AI revenue rather than only bookings growth, and delivery of approximately 23% or better free cash flow margins despite elevated capital expenditure. Conversely, deterioration in retention, downward ARR revisions, persistent sales-transition issues beyond H1, or further increases in capital intensity without improved monetization would weaken the thesis.

For an incremental position, an illustrative initial exposure should remain limited to approximately 0.5% to 1.0% of portfolio NAV until those operating tests are met. A 15% price-risk threshold on a 1.0% position would represent approximately 15 basis points of portfolio NAV before gaps, slippage, or correlated losses. Fundamental exit criteria should take precedence over a mechanical stop if recurring-revenue quality deteriorates or the free cash flow outlook is structurally impaired.

The portfolio exposure is primarily to enterprise security spending, AI infrastructure adoption, growth-equity valuation, and long-duration cash flows. It should not be treated as a diversifier against an existing concentration in cybersecurity or AI-sensitive software. The movement toward consumption-based revenue may reduce dependence on employee-seat growth, but it does not eliminate correlation with enterprise technology budgets.

An absolute entry price or defensible target return cannot be established from the call alone without a verified contemporaneous market valuation. The supplied analyst targets ranging from $155 to $214 demonstrate substantial disagreement, but are not a substitute for an independent valuation. The evidence supports holding a differentiated security platform with improving execution while withholding a stronger purchase recommendation until growth durability, cash conversion, and valuation align.

SOURCE BASIS

The financial comparisons reflect the September 3, 2026 earnings call and company earnings release, the May 26, 2026 earnings release and prior-call disclosures, the September 2, 2025 earnings release, and the supplied September 4 Bloomberg earnings notice. Consensus comparisons use the estimates in that notice. Forward-looking assessments are anchored to the information available around the Q4 call and do not assume subsequent product-launch or Investor Day outcomes.

COMPANY EMPLOYEES ON THE CALL

• Jay Chaudhry, Chief Executive Officer, Chairman and Founder. • Kevin Rubin, Chief Financial Officer. • Kim Watkins, Senior Vice President, Investor Relations and Strategic Finance.

RESEARCH ANALYSTS ON THE CALL

• Saket Kalia, Barclays. • Fatima Boolani, Citi. • Roger Boyd, UBS. • Richard Poland, Wells Fargo. • Joseph Gallo, Jefferies. • John DiFucci, Guggenheim Securities. • Brian Essex, JP Morgan. • Meta Marshall, Morgan Stanley. • Shrenik Kothari, Baird. Called by the operator, but no question or remarks were recorded. • Ittai Kidron, Oppenheimer and Company. • Gregg Moskowitz, Mizuho.

KEY READ-THROUGHS FROM ZSCALER’S Q4 FISCAL 2026 EARNINGS CALL

Zscaler’s results point to a redistribution of technology spending and economic returns rather than an indiscriminate benefit from AI adoption. The strongest cross-sector signals are broader memory-pricing pressure, increasing cash requirements for infrastructure-intensive software, resilient demand for integrated cybersecurity platforms, and continued substitution away from appliance-centric security and traditional private-network architectures. Importantly, Zscaler’s cautious fiscal 2027 growth outlook should not be generalized into a cybersecurity demand warning: the call showed improving organic bookings, while management identified company-specific sales transitions and product-commercialization timing. The highest-conviction implications concern identifiable pricing, procurement, and competitive mechanisms. None establishes an undisclosed supplier award, a named competitive displacement, or an automatic peer earnings revision. Country labels below refer to corporate domicile.

SEMICONDUCTORS AND MEMORY

MEMORY PRICING POWER IS EXTENDING BEYOND AI ACCELERATOR SYSTEMS INTO SECURITY INFRASTRUCTURE (READ-THROUGH 1)

Affected companies: Micron Technology (MU: United States) and SK hynix (000660: South Korea). Direction: positive. Magnitude: moderate incremental confirmation of industry pricing power, with potentially material earnings implications if the purchasing conditions described by Zscaler are representative. Zscaler’s individual procurement is not itself material to these suppliers.

The strongest evidence is Kevin Rubin’s statement: “We are seeing higher prices and tighter availability for memory, storage and processors.” More specifically, management expects capital expenditure to remain elevated in fiscal 2027 “due to higher component pricing, especially memory.” Zscaler spent approximately $200 million on capital equipment in Q4, representing approximately 72% of its full-year expenditure, and purchased available equipment opportunistically. Fiscal 2027 capital spending is expected to reach a low-teens percentage of revenue, excluding internal-use software, versus approximately 8% in fiscal 2026.

The transmission mechanism is broader than demand for high-bandwidth memory attached to AI accelerators. Zscaler identified requirements for its security-cloud infrastructure and Zero Trust Branch appliances, indicating that component scarcity and pricing pressure are affecting infrastructure supporting ordinary enterprise security workloads as well. This expands the evidence for memory pricing power beyond the most visible AI training clusters. Higher selling prices can increase memory-manufacturer gross profit without requiring equivalent growth in shipped bits, provided manufacturing costs and product mix do not offset the benefit.

The particularly useful observation is that Zscaler brought purchases forward but still expects elevated expenditure in the following fiscal year. That combination is inconsistent with assuming that the entire cash-flow impact disappears after a temporary Q4 purchasing spike. It supports greater durability of input-cost pressure, although it does not distinguish precisely among higher prices, expanding capacity requirements, and precautionary purchasing.

SK hynix had already reported substantial DRAM and NAND price increases in its July results. Zscaler therefore provides corroborating evidence from a downstream purchaser, not a new discovery that memory supply is tight. The near-term trading relevance lies in subsequent memory-pricing commentary and customer procurement behavior during the late-2026 earnings cycle. The longer-duration implication is a broader customer base absorbing higher memory costs, potentially extending favorable supplier economics into 2027.

The important limitations are supplier allocation and product specificity. Zscaler did not identify Micron or SK hynix as direct suppliers, disclose memory content per deployment, or separate DRAM from NAND procurement. The call also does not establish incremental GPU orders. The defensible conclusion is positive industry pricing evidence, not a company-specific shipment forecast. Pull-forward purchasing remains a risk to subsequent unit growth even if pricing stays firm.

CLOUD INFRASTRUCTURE AND NETWORK SOFTWARE

INFRASTRUCTURE-INTENSIVE SOFTWARE FACES CASH-FLOW PRESSURE BEFORE THE FULL COST APPEARS IN OPERATING MARGINS (READ-THROUGH 2)

Affected company: Cloudflare (NET: United States). Direction: negative for infrastructure-cost and free-cash-flow assumptions. Magnitude: moderate sensitivity at the company level, but insufficient evidence for a direct reduction to Cloudflare’s guidance.

Zscaler’s Q4 adjusted operating margin reached 24.3%, yet free cash flow fell approximately 65% to $60.8 million. Full-year free cash flow margin declined to approximately 23%, and fiscal 2027 guidance assumes a low-teens capital expenditure ratio before internal-use software. This is an important counterexample to the proposition that strong software revenue growth and expanding adjusted operating margins necessarily produce proportionate shareholder cash generation.

Cloudflare is a relevant comparator because its services depend on a distributed physical network and server infrastructure, rather than solely on software hosted on third-party capacity. Higher memory, storage, and processor prices can increase the cash cost of adding traffic-processing capacity and refreshing equipment. If customer pricing or utilization improvements do not compensate, cash investment rises faster than the revenue supported by that investment.

The accounting sequence matters. Equipment purchases consume cash immediately, while much of the expense enters the income statement through depreciation over time. Consequently, an infrastructure-intensive software company can report stable gross margins and improving adjusted operating profitability while its cash economics deteriorate. This creates a risk that valuation frameworks emphasizing revenue growth and adjusted earnings understate changes in capital intensity.

The sensitivity is economically meaningful. At Cloudflare’s then-guided annual revenue of approximately $2.87 billion, a hypothetical 100-basis-point increase in cash capital spending would absorb approximately $29 million of annual free cash flow before offsets. This is a mechanical sensitivity, not a forecast that Cloudflare will experience Zscaler’s spending increase.

Counterevidence prevents a stronger bearish conclusion. Cloudflare’s already-reported Q2 free cash flow margin improved to approximately 8% from 6%, demonstrating that Zscaler’s deterioration was not automatically occurring across comparable platforms. Differences in procurement contracts, equipment-refresh schedules, architecture, spare capacity, and utilization can produce materially different outcomes. Higher traffic volumes can also improve infrastructure utilization and reduce cost per transaction.

The near-term catalyst is Cloudflare’s next spending and cash-conversion outlook, particularly whether procurement inflation changes equipment budgets or offsets operating leverage. The longer-duration issue extends through 2027 as higher-cost equipment is installed and depreciated. The cross-portfolio implication is that memory producers and infrastructure-intensive software vendors can sit on opposite sides of the same pricing development, even when both are classified as AI beneficiaries.

CYBERSECURITY PLATFORMS

AI SECURITY SPENDING SUPPORTS INTEGRATED PLATFORMS; ZSCALER’S GUIDANCE IS NOT A SECTOR DEMAND WARNING (READ-THROUGH 3)

Affected companies: Palo Alto Networks (PANW: United States) and CrowdStrike Holdings (CRWD: United States). Direction: positive for security demand and platform-expansion opportunities. Magnitude: moderate fundamental corroboration, but limited incremental near-term estimate impact because both companies had already reported strong results before Zscaler’s call.

The supporting evidence is unusually concrete. Security for AI bookings increased more than 50% sequentially, its pipeline increased 75%, and 70% of Security for AI transactions included Data Security. Z-Flex generated more than $770 million of quarterly total contract value, while participating customers experienced nearly 30% average ARR uplift during fiscal 2026. Chaudhry also stated that customers “don’t want one more or three more AI security products” and instead seek integrated solutions that work with the rest of their security environment.

The transmission mechanism is expansion within existing strategic security relationships. Enterprise AI adoption creates additional requirements around data access, workload protection, agent activity, investigation, and policy enforcement. Vendors with established distribution, telemetry, and deployment footprints can attach additional capabilities to existing contracts rather than compete exclusively through standalone product procurement. Palo Alto Networks’ platform strategy and CrowdStrike’s Falcon Flex model are directly exposed to this purchasing behavior.

The implication is stronger than a generic claim that cybersecurity spending rises with AI. The call indicates that buyers are consolidating new AI requirements into broader security purchases. This can increase customer lifetime value, improve distribution efficiency, and allow established platforms to monetize new capabilities without incurring the full acquisition cost of a separate vendor relationship. It also favors vendors able to demonstrate integration and operational simplification, rather than merely offering a larger product catalog.

The contemporaneous peer evidence reinforces the conclusion. CrowdStrike’s August 26 release reported $333 million of net new ARR, up 51%, and more than $2.29 billion of ARR from customers adopting Falcon Flex. Palo Alto Networks’ September 1 release reported strong demand across its platforms and a 38.4% fiscal-year adjusted free cash flow margin. These results were already known when Zscaler reported. Zscaler’s call corroborates resilient spending and platform purchasing rather than forecasting those completed quarters.

This distinction is important for interpreting Zscaler’s fiscal 2027 outlook. Its approximately 4% implied growth in organic net new ARR is not persuasive evidence of an industrywide demand slowdown when its own Q4 organic additions accelerated and management identified sales transitions and product timing as constraints. Using Zscaler’s cautious guidance to reduce peer estimates indiscriminately would conflate company execution with market demand.

The near-term catalyst is subsequent peer disclosure on expansion, platform commitments, and AI-related conversion during the late-2026 reporting cycle. The longer-duration benefit extends over 12 to 24 months as AI deployments move from pilots into production. However, contractual flexibility can also require discounts, deployment support, and multiyear commitments. Z-Flex total contract value is not equivalent to annual revenue, and selected-cohort expansion should not be transferred mechanically to peer retention assumptions.

NETWORK SECURITY AND BRANCH INFRASTRUCTURE

ZERO TRUST EXPANSION THREATENS THE APPLIANCE-PLUS-SUBSCRIPTION MODEL AT THE BRANCH (READ-THROUGH 4)

Affected companies: Fortinet (FTNT: United States) and Cisco Systems (CSCO: United States). Direction: negative for exposed branch-security and appliance-centric networking businesses. Magnitude: moderate structural competitive pressure for Fortinet’s relevant franchise; lower consolidated impact for Cisco because of its broader portfolio. The call does not support a near-term earnings-miss forecast for either company.

The call contained evidence of commercial displacement rather than only architectural marketing. A Global 2000 healthcare equipment manufacturer selected Zero Trust Branch for production sites and OT protection, replacing a long-standing vendor. A Fortune 500 life sciences company selected Zscaler across 75,000 users while replacing a firewall-based SASE platform. Zero Trust Everywhere enterprises increased to more than 950 from more than 350 at the end of fiscal 2025.

Chaudhry described the economic proposition explicitly: “Zero Trust Branch simplifies customers’ branch deployments by eliminating traditional branch firewalls, SD-WAN and MPLS networks, reducing operational complexity.” These are management’s claims about supported deployment architectures, not evidence that every branch can eliminate all existing infrastructure.

The transmission mechanism has multiple revenue effects. A customer moving enforcement into a cloud-delivered architecture may avoid a future appliance purchase, reduce associated support and security subscriptions, and consolidate management software. The loss can therefore extend beyond hardware revenue into recurring services attached to the installed device. For an incumbent, the relevant risk is reduced lifetime revenue per branch, not merely a missed replacement shipment.

Factories, warehouses, and OT environments make this more consequential. These locations have historically supported demand for local security equipment because of operational continuity, segmentation, and performance requirements. Zscaler’s ability to land a new account through a non-user environment challenges the assumption that cloud-delivered security remains concentrated in employee access. Broader non-user adoption potentially expands the contested revenue pool.

Google Cloud’s managed Zero Trust Cloud integration adds another competitive dimension by reducing the need for customers to deploy and maintain separate security virtual machines. The confirmed integration supports the direction of architectural simplification, although it does not establish that a particular incumbent’s virtual-firewall revenue has been displaced.

Strong counterevidence rules out a broad hardware-collapse conclusion. Fortinet’s July results showed 52% product revenue growth and 33% billings growth, while Cisco reported 40% growth in networking product orders in its fiscal Q4. Fortinet also offers its own integrated firewall, SD-WAN, and SASE architecture, allowing it to retain customers migrating toward hybrid delivery. Zscaler’s unnamed competitive wins cannot be attributed specifically to Fortinet or Cisco.

The near-term trading catalyst is evidence in subsequent results that branch competition changes bookings, renewal economics, or discounting. The more important fundamental transmission occurs over 18 to 36 months as customers renew subscriptions and replace equipment. The actionable distinction is between challenging long-term branch revenue assumptions and incorrectly shorting current hardware demand, especially demand associated with data centers and AI infrastructure.

SECURITY OPERATIONS AND ANALYTICS

INLINE ENFORCEMENT PLATFORMS ARE MOVING INTO SECURITY OPERATIONS, INCREASING PRESSURE ON SEPARATELY MONETIZED ANALYTICS (READ-THROUGH 5)

Affected companies: Cisco Systems (CSCO: United States), principally through Splunk; Palo Alto Networks (PANW: United States), through Cortex XSIAM; and CrowdStrike Holdings (CRWD: United States), through Next-Gen SIEM. Direction: negative incremental competitive pressure within security operations. Magnitude: moderate strategic exposure for the relevant products, but low near-term consolidated earnings impact. For Palo Alto Networks and CrowdStrike, this pressure coexists with the positive platform-demand read-through above.

Zscaler’s proposed Agentic SecOps offering combines more than 750 billion daily transactions, Red Canary’s managed detection and response expertise, automated investigation, and enforcement through the Zero Trust Exchange. Chaudhry explained the customer rationale: “You got the data right there. Why can’t you give us more meaningful information that’s needed for SecOps?” He also emphasized “closed-loop remediation” rather than detection without an immediate enforcement mechanism.

The economic transmission is competition for analytics and response budgets from vendors already collecting and controlling security-relevant traffic. If customers can investigate an event and enforce a response within an existing platform, they may reduce the amount of data processing, integration, or investigation work purchased separately. The pressure can appear through lower incremental log-ingestion spending, more demanding renewal negotiations, bundled analytics, or consolidation of overlapping tools.

This is not equivalent to predicting that independent SIEM disappears. Enterprises still require heterogeneous data collection, auditability, long-term retention, cross-vendor visibility, and integration with systems outside Zscaler’s control. Transaction volume is also not the same as comprehensive telemetry or superior detection. The high-conviction conclusion is that the competitive boundary is expanding, not that Zscaler has already demonstrated product superiority.

Splunk is directly exposed to customers reassessing the economics of collecting and analyzing large volumes of security data. However, Cisco owns substantial network telemetry and enforcement capabilities of its own, giving it resources to respond. Palo Alto Networks and CrowdStrike also combine telemetry, analytics, and remediation, making them more than passive data-processing incumbents. Their existing distribution and operational credibility are significant defenses.

Timing materially limits the near-term financial interpretation. Management said Agentic SecOps would take time to gain traction in H1 fiscal 2027, with contribution expected in H2 and fiscal 2028. The September 9 launch was therefore an initial product and positioning catalyst, not evidence of immediate revenue displacement. Moreover, some integrated-offering revenue could reflect migration of Red Canary customers rather than new customer spending.

The decisive fundamental tests are production adoption, demonstrable remediation performance, commercial pricing, and customer decisions to retire or reduce spending on competing tools. These are principally fiscal H2 2027 and fiscal 2028 developments. The call supports closer scrutiny of security-analytics pricing power and product overlap, but not an immediate reduction to incumbent recurring revenue.

ENTERPRISE TELECOMMUNICATIONS

CLOUD SECURITY CAN PRESSURE MPLS ECONOMICS WITHOUT UNDERMINING THE PHYSICAL-FIBER INVESTMENT CASE (READ-THROUGH 6)

Affected company: Lumen Technologies (LUMN: United States). Direction: negative for exposed enterprise MPLS and traditional managed-network economics, with substantial offsets possible from dedicated internet access, cloud connectivity, and fiber services. Magnitude: moderate at the affected product level; insufficient evidence for a consolidated earnings downgrade.

The supporting commentary is Zscaler’s explicit proposition that Zero Trust Branch can remove traditional MPLS networks from certain deployments, reinforced by the production-site win and the expansion in Zero Trust Everywhere customers. This extends the security discussion into the connectivity budget: customers can reconsider how traffic is transported when access controls no longer depend on placing users and applications inside a traditional private network.

The precise mechanism is substitution of security architecture and transport economics. A customer may replace premium private-network services with internet access plus cloud-delivered security. Even when the carrier retains the physical circuit, the revenue mix can change because connectivity is purchased without the same private-network service features or managed overlay. If revenue declines faster than the associated operating cost can be removed, cash contribution falls.

The most important qualification is that MPLS and SASE can coexist. Lumen explicitly markets hybrid architectures combining private transport with cloud-delivered security. Customers with stringent latency, reliability, or operational requirements may continue using private connectivity. Zscaler’s statement therefore supports competitive pressure in suitable deployments, not universal or immediate MPLS retirement.

The distinction between service economics and physical infrastructure is critical. Removing a particular private-network architecture does not remove the need for fiber, access circuits, cloud interconnection, or resilient backbone capacity. Lumen can lose revenue from an existing service configuration while gaining dedicated internet access, high-capacity connectivity, or cloud-networking business. Its Alkira acquisition and digital-network strategy are relevant responses to this transition rather than unrelated growth initiatives.

Lumen had already described its shift away from legacy services before Zscaler’s call. The incremental information is that a major security vendor is broadening its commercial proposition into production sites and other non-user environments that can influence enterprise network design. This reinforces the structural direction without establishing a newly canceled Lumen contract or a change to its existing revenue guidance.

There is no identifiable immediate trading catalyst from the Zscaler disclosure alone. The near-term evidence would come from Lumen’s subsequent product-mix, renewal, and connectivity-sales disclosures. The longer-duration effect unfolds over 18 to 36 months as customers redesign networks and renew contracts. Across portfolios, the correct distinction is to remain cautious on legacy enterprise networking economics without treating that caution as a blanket negative view on fiber infrastructure or AI-related connectivity demand.