Zscaler (ZS) Q1 Earnings: Taking a Look at Key Metrics Versus Estimates

Zscaler reported Q1 (ended Oct 2025) revenue of $788.11M, up 25.5% YoY, and non-GAAP EPS of $0.96 versus $0.77 a year ago, beating consensus revenue ($773.35M) by 1.91% and EPS ($0.85) by 12.94%. Key operating metrics showed remaining performance obligations of $5.93B (vs. $5.65B est.), dollar-based net retention of 115% (vs. 114.1% est.), strong direct-customer revenue of $122.1M (+75.5% YoY, well above estimates) while channel partner revenue was $666.01M (slightly below est.), underscoring durable subscription demand and revenue visibility despite recent share weakness (-14.1% over the past month) and a Zacks Rank of #3 (Hold).

Analysis

Market structure: Zscaler's beat (revenue $788.1M, RPO $5.93B, DBNRR 115%) reinforces winners — cloud-native security vendors (ZS, CRWD) and hyperscalers hosting SASE — while legacy perimeter vendors (PANW, FTNT) face incremental share loss as enterprises accelerate cloud-first spend. The direct-revenue acceleration (+75% YoY to $122.1M) signals improving pricing power and higher-margin bookings, even as channel revenue slightly lagged, implying a near-term mix shift rather than demand deterioration. Cross-asset: a solid beat supports risk-on flows into growth tech, should modestly tighten high-grade spreads and lift equity vols in ZS; USD/FX sensitivity will be secondary but watch tech flows into EM demand for cloud services.

Risk assessment: Primary tail risks are (1) a large enterprise non-renewal or term renegotiation causing >5% ARR loss, (2) a material security/data breach or regulatory fine >$100M, and (3) macro-driven IT spending cuts that push DBNRR below 100%. Timing: immediate (days) — IV and sentiment swings; short-term (weeks/months) — guidance and partner dynamics; long-term (12–24 months) — ARR durability and margin expansion. Hidden dependencies include concentration in channel partners and potential one-off large direct deals; catalysts to monitor: next-quarter guidance, major partner integrations (MSFT/Azure), and renewal cohort metrics.

Trade implications: Tactical exposure should be sized and conditional. Consider a measured long in ZS sized 2–3% of portfolio with defined-risk option overlays (3-month call spreads 10–15% OTM) to capture re-rate if DBNRR stays >112% and RPO growth remains positive. Pair trades: long ZS vs short PANW (ratio 2:1) for 6–12 months to express cloud-native SASE secular gains; reduce weighting in legacy firewall names by ~50% over the next quarter. Entry/exit rules: add on a further 20% price drop or after one consecutive quarter of DBNRR >112% and RPO YoY growth >10%; cut if DBNRR falls <110% or RPO misses by >5%.

Contrarian angles: The market has likely overreacted to a channel miss — the composition shift toward direct customers (+75% YoY) is underappreciated and is a positive margin lever over 12–18 months, creating asymmetric upside after a ~14% one-month selloff. Historical parallels (early CrowdStrike/CrowdStrike corrections) show cloud-native security firms can experience quick selloffs followed by multi-quarter re-rates when retention and RPO validate. Unintended consequence: aggressive channel pushback could compress near-term recognized revenue but ultimately improve ARR quality; position sizing should reflect that staging risk.

Key Decisions for Investors

• Establish an initial 2–3% long position in ZS (Zscaler) within 10 trading days; scale to 5% if the stock drops a further 20% within 30 days OR after a subsequent quarter that posts DBNRR >=112% and RPO YoY growth >10%.
• Buy a defined-risk 3-month ZS call spread roughly 10–15% OTM sized to 1% of portfolio notional to capture upside from re-rating while capping premium; alternatively sell a 3-month put spread to acquire at a price no more than 20% below current market if comfortable owning shares.
• Implement a pair trade: long ZS (2% weight) vs short PANW (1% weight) for 6–12 months to express migration to cloud-native SASE; rebalance/close if PANW shows sustainable cloud-native revenue gains or ZS DBNRR falls below 110%.
• Reduce exposure to legacy firewall/cisco-equivalent vendors (PANW, FTNT) by ~50% over the next quarter and reallocate proceeds into cloud-security leaders (ZS, CRWD) or a cybersecurity ETF (e.g., HACK) to capture secular share shifts.
• Monitor the next 60 days for three binary catalysts before increasing exposure: (1) ZS guidance and quarterly RPO vs consensus, (2) DBNRR staying >=112%, and (3) any major partner (MSFT/Azure) integration announcements; if any catalyst fails (DBNRR <110% or RPO miss >5%), reduce ZS exposure to zero.