Zscaler at Citi’s 2026 Global TMT Conference: growth broadens

Zscaler reported accelerating sales execution, with net new ARR growth rising to 17% in Q4 fiscal 2026 from essentially flat in 2024, while trailing-12-month revenue reached $3.35 billion, up 25%. AI Security bookings exceeded $100 million over the past 12 months and grew 50% sequentially in Q4; Zero Trust Branch customers rose 216% year over year to 950. Management remains conservative on fiscal 2027 guidance, excluding meaningful AI Security and Agentic SecOps upside as enterprises remain in an assessment phase, while Red Canary remains a near-term revenue headwind due to churn in its smaller MDR customer base.

Analysis

ZS is shifting from a seat-based secure-access vendor toward a platform vendor with multiple entry points, which should raise wallet share and reduce dependence on any single IT modernization cycle. The key financial implication is that flexible multi-product contracts can pull forward bookings and lengthen commitments, but may also defer revenue recognition and mask discounting; investors should prioritize remaining performance obligations, billings, and renewal uplift over headline ARR. If cross-sell is real, incremental revenue should carry high contribution margins because the global enforcement fabric is already deployed.

The near-term debate is whether security urgency converts into FY27 budget releases fast enough to validate estimates. Management's product traction claims are not yet equivalent to enterprise-scale production deployments: smaller initial contracts and evaluation-heavy buying create a risk that AI-security bookings remain a low-ACV feature sale rather than a new growth vector. Red Canary integration adds a separate execution risk—legacy MDR churn could dilute growth and margins before enterprise SecOps attach offsets it.

Competitive read-through is nuanced. ZS's decision to consume agent identity from the creator rather than own the identity layer is constructive for MSFT and OKTA, which retain strategic control of identity issuance; it limits the immediate threat to those platforms while positioning ZS as the policy-enforcement layer. Conversely, PANW and CRWD face greater risk if buyers increasingly prefer inline prevention plus telemetry-driven remediation over a stitched-together firewall/endpoint/SIEM stack, though both have entrenched SOC distribution and could neutralize the differentiation through bundling.

Key Decisions for Investors

• Initiate a measured 1-3 month long ZS position only after confirming the next earnings report shows accelerating net-new ARR alongside stable or improving billings/RPO growth; target 15-20% upside on an AI-security guidance raise versus 8-10% downside if FY27 growth guidance is merely reiterated.
• Use a 6-12 month pair: long ZS / short PANW in equal beta-adjusted dollars. The thesis is relative multiple expansion for ZS if multi-product platform attach becomes visible; cover the short if PANW demonstrates comparable AI-security billings acceleration or material SASE share gains.
• Maintain MSFT and OKTA exposure as second-order beneficiaries of agent-identity proliferation; ZS is explicitly complementary to identity issuers rather than attempting to displace them. Reassess if enterprises standardize on a new independent agent-identity architecture, which would favor SAIL/CYBR-type governance vendors instead.
• Set an alert for Red Canary churn, gross-margin deterioration, or a material increase in sales incentives/contract ramps. Any of these would indicate that apparent platform momentum is being purchased through economics rather than reflecting durable demand, invalidating the long-ZS thesis.