Zscaler Q1 Earnings: Analysts Bet On AI While Management Targets Margin Recovery

Zscaler guided fiscal Q1 revenue of $772M–$774M, implying roughly 23% year-over-year growth, and expects gross margins to recover to 80% after a one-time, hardware-heavy government deployment depressed Q4 margins. Management highlighted three strategic growth vectors—AI Security, Zero Trust Everywhere and Data Security Everywhere—that together surpassed $1 billion in combined ARR, and assumes the Red Canary acquisition will contribute about $95M ARR for the fiscal year. Cantor Fitzgerald raised its price target to $365, citing positive market checks and expected SASE/Red Canary synergies, positioning the company for continued top-line expansion ahead of the Nov. 25 earnings release.

Analysis

Market structure: Cybersecurity incumbents that own cloud-native SASE and MDR capabilities stand to gain pricing power and faster net-new ARR wins versus appliance-centric vendors; expect mid-to-large enterprise RFPs to favor integrated SASE+MDR stacks, pressuring legacy firewall refresh ASPs by ~5–10% across cycles. Supply/demand is tightening for cloud security talent and managed detection capacity, which supports premium valuations for vendors that scale automation; credit spreads for high-quality cyber names should compress modestly while equity vols narrow after confidence-building prints.

Risks: Key tail risks are integration failure of bolt-ons, delayed large government rollouts, and tightening data-privacy regulation in EU/UK that could force rework of enterprise contracts — any one could drag revenue recognition by multiple quarters and compress margins by several hundred basis points. In the near term (days–weeks) headline risk centers on the upcoming earnings release and guide cadence; over quarters the realization of cross-sell synergies and retention metrics will determine upside vs. downside.

Trade implications: Tactical long exposure to the best-in-class SASE/MDR compounders is warranted, sized to 1–3% portfolio positions, while hedging event risk with short-dated puts or call spreads; consider relative-value longs vs. appliance-heavy peers to express structural share shift. Rotate 1–2% from legacy networking (hardware OEMs) into cyber ETFs and select names with proven integration playbooks; use 3–6 month option structures to capture directional moves while limiting downside.

Contrarian view: Consensus may underprice execution friction—M&A ARR accretion and cross-sell are noisy and often backloaded; the market could be over-enthusiastic on immediate margin tailwinds, creating opportunities to sell strength into rallies above analyst targets. Watch for partner/channel pushback and potential cannibalization of MSSP revenues as a non-obvious source of churn that could invert the narrative over 6–12 months.

Key Decisions for Investors

• Establish a 2% long position in ZS (Zscaler) using a staggered buy: 1% immediately and 1% on any post-earnings pullback >5% from current levels; place a protective stop-loss at -12% from entry and reassess after next quarterly results (90 days).
• Implement a relative-value pair: long ZS (1.5% notional) and short PANW (Palo Alto Networks) (1.0% notional) to express SASE/MDR share shift risk; rebalance if spread narrows >20% or after two consecutive quarters of integration KPIs miss expectations.
• Use options to hedge event risk: buy 3-month ZS call spreads (buy ITM/ sell 20–30% OTM) sized to 0.5–1% portfolio exposure to capture upside while capping premium; concurrently sell 1–2% notional 30–60 day OTM puts if implied volatility falls >15% post-earnings to harvest yield.
• Rotate 1–2% of portfolio from legacy hardware/networking names (e.g., CSCO, basic exposure to hardware-focused ETFs) into cybersecurity ETFs (e.g., HACK) and top-tier cloud-security names over the next 30 days, locking in gains if names rally >10% within that window.
• Monitor three near-term catalysts before increasing exposure: post-earnings ARR retention/Net Revenue Retention (within 14 days), evidence of cross-sell wins (pipeline +2 quarters), and EU data-transfer guidance changes (watch regulatory notices over next 60 days); raise allocation by +1–2% only after two of three confirm.