ZS › analyze
ZS · Analyze
A portfolio-specific passage was removed from the public build.
Snapshot
| Item | Value |
|---|---|
| Price (2026-07-22 close) | $143.37 (−4.4% on the day) |
| Prior analysis (2026-07-14) | $151.86 → down ~5.6% since |
| 52-wk context | FY25 fiscal-year-end price ~$285; stock de-rated ~50% over past year |
| Shares out / diluted | 158.3M / ~168M (FY26 guide) |
| Market cap (basic / diluted) | ~$22.7B / ~$24.1B |
| Net cash | ~$1.78B ($3.57B cash+STI − $1.80B convert debt) |
| Enterprise value | ~$20.9B |
| EV / FY26E revenue ($3.33B) | ~6.3x |
| EV / ARR ($3.74B FY26E) | ~5.6x |
| Fwd P/E (FY26E non-GAAP EPS $4.10) | ~35x |
| Sector / folder | Cybersecurity (zero-trust SASE/SSE) |
| Fiscal year | Ends July 31; latest full year FY2025, latest quarter Q3 FY2026 (reported 2026-05-26) |
Fundamentals
| Metric | FY2024 | FY2025 | Read |
|---|---|---|---|
| Revenue | $2,168M | $2,673M (+23.3%) | Decelerating but strong |
| ARR (exit) | ~$2.9B | ~$3.0B → $3.5B by Q3 FY26 (+25% YoY) | Primary growth metric |
| GAAP operating income | −$121M | −$127M | Still GAAP-unprofitable |
| GAAP net income / EPS | −$58M / −$0.39 | −$41M / −$0.27 | Interest income cushions |
| Non-GAAP op margin | ~21% | ~22% → 23% Q3 FY26 (record) | Real operating leverage |
| Gross margin (GAAP / non-GAAP) | 78.0% / 80.3% | 76.9% / 80.7% | Slight GAAP compression (hardware) |
| Operating cash flow | $780M | $972M | Healthy |
| CapEx | $145M | $164M | Rising |
| FCF | $635M | $808M (30.2% margin) | Headline looks great |
| SBC | $528M (24.3% rev) | $661M (24.7% rev) | The problem |
| SBC-adjusted FCF | $107M (4.9%) | $147M (5.5%) | The real number |
| Diluted shares | 149.6M | 154.4M (+3.2% dilution) | ~3–4%/yr, persistent |
| Net cash | $281M | $1,776M | Fortress balance sheet |
| Current ratio | 1.09 | 2.01 | Improved |
Prose. Headline FCF ($808M, 30% margin) is real cash, but ~$661M of it is funded by stock-based compensation. On the user's SBC-adjusted framework, true owner FCF is only ~$147M (5.5% margin) — the crux of the bear case. Dilution runs ~3–4%/yr. Revenue/share rose $14.49→$17.31 (+19.5%), below the 23.3% top-line because of share creep.
CAGRs (FY21–FY25, pre-FY24 estimated): revenue ~$673M→$2,673M ≈ 41% 4yr CAGR; FCF ~$126M→$808M ≈ 59% 4yr CAGR — both decelerating as base scales.
Two fresh negatives from Q3 FY26: 1. FY26 FCF-margin guide cut 26.5–27% → 22.8–23.3% — a memory/processor price spike (AI-datacenter shortage) forces CapEx to high-single-digit % of revenue, +200bps more in FY27. On ~$3.33B revenue → FY26 FCF ~$760M vs SBC ~$750–780M ⇒ SBC-adjusted FCF roughly breakeven in FY26. Single most important datapoint this cycle. 2. FY27 growth guide of only 16–17% — real deceleration from ~25%, unusually early.
Data gaps: pre-FY2024 statements estimated; FY26 SBC estimated from run-rate.
Moat
| Quant base | FY2024 | FY2025 | Note |
|---|---|---|---|
| Gross margin (non-GAAP) | 80.3% | 80.7% | Elite; slight hardware pressure ahead |
| GAAP ROIC / ROA | neg / −1.4% | neg / −0.7% | Economics only visible non-GAAP |
| Net revenue retention | ~115% | ~115% | Healthy land-and-expand |
| $1M+ ARR customers | ~600 | 748 (+18% YoY) | Enterprise entrenchment |
| $100k+ ARR customers | ~3,300 | 4,003 (+19%) | Broad base |
| Zero Trust Everywhere accts | — | 700+ (from 550 in Q2) | Multi-pillar adoption accelerating |
Moat sources: (1) Architectural switching costs — Zero Trust Exchange sits inline across 160 datacenters, 500B+ transactions/day; ripping it out means re-architecting all access. (2) Data-network effect — largest inline telemetry set feeds AI detection. (3) Platform consolidation — data-security ARR >$500M (+30%), Zero Trust Branch ARR ~tripled, AI Protect bookings >$100M/12mo; Z-Flex did >$1B TCV.
Adversarial stress-test. No startup replicates this cheaply. The real threat is Microsoft (Entra Global Secure Access / SSE bundled in E5 — "good-enough for free" for cost-driven mid-market) and firewall incumbents (Palo Alto Prisma / Fortinet / Cato) pushing SASE into the base. Chaudhry's rebuttal is architecturally correct — firewall-based SASE re-creates a trusted network permitting lateral movement — a genuine high-end differentiator. But the moat is weakest exactly in the 2,000–10,000-seat mid-market where MSFT bundling and VAR firewall upsells bite, and where ZS just flagged tempered new-logo expectations.
Disruption forecast (5–10yr). Core inline-proxy model durable; AI-agent security expansion (Symmetry Access Graph acquisition, agentic exchange) is a credible TAM extension — management booked no meaningful FY-Q4 impact, expects it FY27. Main vector: bundling/commoditization of the "secure users" layer, pushing ZS up-market into branch/cloud/agent.
Evergreen rating: Strong-but-contested (7/10). Best-in-class architecture + switching costs, but live MSFT pricing/bundling threat and slowing new-logo motion keep it from "wide/uncontested."
Valuation
| Model | Input | Output | Weight |
|---|---|---|---|
| Graham √(22.5×EPS×BVPS) | GAAP EPS neg, BVPS −$7.70 | N/A | none |
| EV/Revenue vs peers | EV ~$20.9B; FY26E rev $3.33B | 6.3x — below CRWD/PANW premium | med |
| EV/ARR | $20.9B / $3.74B | 5.6x | med |
| Fwd P/E (non-GAAP) | $143.37 / $4.10 | 35x FY26; ~30x FY27 | med |
| EV/FCF (headline) | $20.9B / ~$760M | ~27x | low (SBC-blind) |
| EV/FCF (SBC-adjusted) | $20.9B / ~$147M → ~breakeven FY26 | n.m. | high |
| Analyst consensus | 38 Buy / 9 Hold / 0 Sell | median PT $193–195 (range $145–250) | context |
Reverse-DCF. At ~$20.9B EV, to justify price on true (SBC-adjusted) owner earnings the market must underwrite revenue ~doubling to ~$6B over 5yrs (achievable at 16–17%→low-teens) and SBC falling ~25%→~12% of revenue, lifting true FCF margin to ~30% (~$1.8B), discounting to ~12x — reasonable if both happen. The bet is squarely on SBC normalization, which has been slow (still 24.7% in FY25).
Fair-value range: $130–170 (base ~$150). FY27 deceleration + CapEx/SBC drag cap upside; fortress balance sheet, 23% non-GAAP op margin, and Rule-of-55 profile support the floor. At $143 the stock sits low-middle of fair value — no longer expensive after the ~50% de-rating, not a screaming bargain on SBC-adjusted cash.
Sentiment
- Consensus: Bullish — 38 Buy / 9 Hold / 0 Sell; median PT ~$194 (~35% above spot). KeyBanc → $185 (7/16); Bernstein → Outperform $228. Counter: Morgan Stanley → Equal-Weight (valuation/growth).
- Q3 FY26 (2026-05-26): Beat — revenue $850.5M (+25%), non-GAAP EPS $1.08 vs ~$1.04 est; ARR $3.5B (+25%); RPO $6.5B (+30%); record 23% non-GAAP op margin; Rule of 55 YTD. Sold off on FY27 16–17% guide + FCF-margin cut.
- Management tone: Confident/AI-forward ("cybersecurity platform for the AI era"). Chaudhry cites unprecedented inbound from the "Mythos" frontier-model threat but is deliberately not booking it into FY26. Rubin stresses a "prudent approach" — the tell that guidance is conservative and uncertain.
- Yellow flag — sales leadership: Two sales leaders under CRO Mike Rich departed end of Q3; one replaced internally, one pending. Management cited this for cautious FY27 guidance — combined with new-logo softness, the key execution risk.
- Competitive/MSFT: No new bombshell; E5-bundled MSFT SSE threat persists; firewall vendors push SASE into base. Architectural counter credible at high end; mid-market coverage gap is the exposure.
- Capital allocation: No dividend/buyback; ~3–4%/yr dilution. Tuck-in M&A (Red Canary ~$127M ARR, Symmetry, SquareX). Cash pulled into datacenter hardware to lock prices ahead of the memory crunch.
- Insider/institutional: Not retrievable this session (data gap); founder Chaudhry retains large stake.
Tensions / Debate
- Fundamentals vs Moat. "Cash is an SBC mirage — true FCF ~breakeven FY26" vs "GAAP irrelevant mid-land-grab; 23% non-GAAP margins + Rule-of-55 + 115% NRR prove the model prints cash as it matures." Both right on different clocks — weight Fundamentals on valuation, Moat on survival/quality.
- Sentiment vs Valuation. Analysts ~$194; SBC-adjusted math says only reasonable. The ~50% de-rating already priced out the froth — debate is now "fair" vs "slightly cheap," not "bubble."
- Growth narrative vs guide. Huge AI-threat TAM story vs a 16–17% FY27 number + sales attrition. Management is sandbagging and genuinely uncertain — truth likely low-20s if the AI tailwind converts, high-teens if not.
Verdict — Hold / Watch · Conviction [6.5]/10 (unchanged)
ZS remains the category-defining zero-trust SASE platform: elite gross margins, fortress net-cash balance sheet, 25% ARR growth, differentiated architecture that the AI-threat cycle plays into. The ~50% one-year de-rating to $143 removed the valuation excess — at 6.3x EV/rev and ~35x forward it is now reasonable. Two things keep it WATCH not BUY, and both are slightly worse: (1) SBC (~25% of revenue) still consumes nearly all cash — SBC-adjusted FCF ~breakeven FY26 after the CapEx/memory hit; (2) growth decelerating to 16–17% with fresh sales-leadership turnover and admitted new-logo softness.
Key risks: (1) SBC never normalizes — the whole valuation rests on it falling toward ~12%; barely budged. (2) MSFT E5 bundling + firewall-SASE commoditize the "secure users" layer in the under-covered mid-market. (3) Sales-execution disruption from two leader departures dragging FY27 net-new ARR. (4) Margin give-back from AI-driven memory/processor cost spike (CapEx +200bps FY27). (5) Multiple compression if growth slips below mid-teens.
Entry / trim zones: - Accumulate: < $140 (starter), compelling < $125 (~5.0x EV/ARR, floor of fair value). - Fair value: $130–170 (base ~$150) — $143 is a low-middle entry, adequate for a starter, not a table-pounder. - Trim / avoid adding: > $185–195.
Thesis-break (downgrade <6): ARR growth <~15%; NRR <110%; SBC failing to decline as % of revenue another full year; further sales-org attrition / CRO-level departure; marquee displacement loss to MSFT/PANW. Thesis-upgrade (toward 7.5): AI-agent/Mythos demand converting to net-new-ARR re-acceleration in FY27; SBC toward ~18% with SBC-adjusted FCF margin clearing ~10%.
A portfolio-specific passage was removed from the public build.