Zscaler: A Generational Opportunity To 'Buy' AI Tailwinds At A Discount

ZS is down nearly 40% YTD amid broad software weakness and AI disruption fears. The analyst reiterates a "Buy" rating, cites no fundamental red flags, and frames the selloff as a dollar-cost-averaging opportunity. While noting AI startups could pose competitive risk, the analyst expects AI to be a net tailwind as Zscaler's AI-driven workloads grow.

Analysis

Zscaler's secular exposure to cloud-native traffic inspection creates a two-way pull: rising AI-driven model‑serving will materially increase encrypted, high‑bandwidth egress that favors cloud‑delivered SASE vendors, while hyperscalers' native security features remain the single largest strategic threat. Expect a structural bifurcation over 12–36 months where vendors that own the edge proxies/inspection layer capture recurring revenue, and those reliant on on‑prem hardware lose incremental wallet share.

Near‑term catalysts that will reprice risk include quarter‑over‑quarter ARR acceleration, net retention moving back above 110% (or falling below 100%), and any public hyperscaler partnership or OEM deal — each can swing consensus multiples within weeks. Tail risks that could erase most upside over a multi‑year horizon are low switching costs combined with aggressive bundling from MSFT/AWS/GCP or a large-scale security breach that undermines trust; those outcomes are binary and likely to play out over 6–24 months.

The consensus overlooks the downstream network economics: every 10–20% increase in AI inference traffic translates into outsized incremental inspection CPU/GPU cycles and cloud egress fees, which favors software‑native inspection architectures and drives stickier per‑customer spend. That dynamic suggests the current sentiment discount is at least partly overdone for firms that can demonstrate differentiated throughput economics and carrier/cloud partnerships; conversely, legacy appliance vendors and firms without a clear cloud proxy path are the most vulnerable over the next 18 months.

Key Decisions for Investors

• Long ZS stock via staged buys: tranche 33% exposure now, 33% on a further 15–20% pullback, 34% on any confirmation of ARR acceleration or improved net retention. Target +40% upside in 12 months if ARR >25% YoY and retention >110%; downside risk ~-35% if major hyperscaler bundling emerges within 12–24 months.
• Buy 12–18 month ZS LEAPS call (approx. 20% OTM) sized to 30–50% of the intended equity notional to get asymmetric upside while limiting cash at risk. Hedge by selling nearer‑dated calls (calendar) if implied vol spikes; break‑even requires ~25–35% share move higher within 12–18 months.
• Pair trade: long ZS / short PANW or FTNT (equal notionals) for a 6–12 month horizon to express cloud‑native vs legacy firewall divergence — target 20–30% relative outperformance for ZS. Close if relative performance reverses by 10% over a month or if PANW reports materially stronger cloud unit economics.
• Protective hedge: buy 3–6 month 10–15% OTM ZS puts equal to 25–40% of position size to limit downside from a sudden hyperscaler bundling announcement or security incident; acceptable cost as insurance vs binary negative outcomes.