Financebotresearch desk研究台

ZS › analyze

ZS · Analyze

WATCH Cybersecurity

A portfolio-specific passage was removed from the public build.

Snapshot

Item Value
Price (2026-09-10) $163.48 (post-print recovery from the −4 to −5% Sept 3-4 drop)
52-week range $114.62 – $336.99 → −51.5% off high, +42.6% off low
Prior analysis (2026-07-23) $143.37 → +14.0% since, despite a worse FY27 guide print in between
Shares out / diluted 163.05M / 160.22M (FY26 avg)
Market cap / EV $26.66B / $25.05B
Liquidity totalCash (cash + ST investments) $3.47B vs totalDebt $1.87B → net cash ~$1.61B, still fortress
Fwd P/E (street consensus EPS $5.59) 29.2x · on management's own FY27 guide midpoint ($4.88) → ~33.5x
EV/Revenue (TTM $3.35B) 7.5x · EV/ARR ($3.77B)
Analyst coverage Buy-rated 1.6/5 avg, mean target $207, median $210 (range $155–250) — broadly raised post-print
Sector / folder Cybersecurity (zero-trust SASE/SSE)
Fiscal year Ended 2026-07-31 (FY26 now closed); reported 2026-09-03

Fundamentals

Metric FY2025 FY2026 (closed) Read
Revenue $2,673M $3,353M (+25.4%) Beat; record pace held all year
ARR (exit) ~$3.0B $3,771M (+25%) Q4 ARR — durable land-and-expand
Non-GAAP op margin ~22% 24% (record) Real leverage, +2pt YoY
GAAP op margin −4.8% −1.0% (still negative) Narrowing but not closed
GAAP net income / EPS −$41M / −$0.27 −$63M / −$0.39 Wider loss YoY — tax + M&A drag
Non-GAAP EPS $3.28 $4.21 (+28%) Real bottom-line growth
OCF $972M $1,130M Healthy
Capex (full, incl. capitalized items) $246M $351M (+43%) AI-datacenter/GPU buildout — Q4 alone $218.5M vs $78.7M PY (+177%)
FCF — headline (OCF − reported capex) ~$891M (33%) ~$1,057–1,075M (31–32%) The number vendors quote
FCF — strict (OCF − full capex line) $727M (27%) $779M (23.3%) fin.py's stricter definition; capex line includes capitalized software/finance leases
SBC $661M (24.7% of rev) $822M (24.5% of rev) Flat for the 3rd straight year — not declining
SBC-adjusted FCF (headline basis) ~$230M (8.6%) ~$235M (7.0%) Thin, roughly flat YoY
SBC-adjusted FCF (strict basis) $65M (2.4%) −$43M (−1.3%) Negative on the stricter, more conservative capex definition
SBC / FCF ratio 74–91% (basis-dependent) 77–106% (basis-dependent) Same disqualifier the March 2026 software screens already flagged for this name
Diluted shares 154.4M 160.2M (+3.8%) Persistent ~3–4%/yr dilution, unchanged pattern
Acquisitions (cash) $0.8M $918.1M Step-change — Red Canary + SPLXAI ($692M, Q1), SquareX ($112.8M), Symmetry Systems; goodwill $418M→$1.22B
Debt/Assets — 23.6% Manageable; convertible notes, not operating leverage

Prose. The headline story is a clean beat: 25%+ revenue growth held through the entire fiscal year, non-GAAP margins hit a record 24%, and non-GAAP EPS grew 28%. But the SBC-adjusted FCF question this repo has been tracking on this name since July is now answered with a closed year, not an estimate — and it did not resolve favorably. SBC ran 24.5% of revenue, statistically flat against 24.7% (FY25) and 24.3% (FY24): three straight years with zero improvement in the one ratio the March 2026 software screens (Knowledge/Themes/software-saas.md) already used to reject this name ("GAAP-unprofitable at 34x P/FCF... SBC-versus-FCF was the single most common disqualifier"). Depending on which capex line is used, SBC-adjusted FCF for FY26 is either a thin +$235M (7.0% margin, headline capex) or actually negative at −$43M (strict capex) — both far below the ~30% headline FCF margin the market prices off of. The gap is entirely a currency question (equity vs cash comp), not a growth question, but it is real: dilution continues at 3–4%/yr with no sign of abating.

Two structural changes since July, both cost-side: (1) Capex tripled in Q4 ($218.5M vs $78.7M) on AI-datacenter/GPU buildout — the memory/processor shortage flagged in Q3 is now showing up in the cash-flow statement, and FY27 guidance assumes it partially normalizes (FCF margin guided back up to 23.0–23.5%, from Q4's 7% print); (2) $918M of cash M&A, a ~1,100x step-up from FY25's token spend, funding an AI-security/MDR stack (Red Canary, SPLXAI, Symmetry, SquareX). This is real strategic building, not empire-building for its own sake — but it is also masking organic deceleration: management disclosed net-new ARR ex-Red Canary grew only 17% YoY, which is the real, unblended growth rate and matches the FY27 guide almost exactly. The FY27 guide is not sandbagged — it is already showing up in the ex-M&A number today.

Balance sheet note: the narrow "Cash" line fell from $2.39B to $928M, which looks alarming in isolation, but Yahoo's totalCash (cash + short-term investments) is $3.47B against $1.87B debt — net cash ~$1.61B, still a fortress. The apparent cash drop is money rotated into short-term investments, capex, and the M&A spend above, not depletion.

Restructuring, 2026-09-01 (two days before earnings): a 3% workforce cut (~261 employees, $30–33M charge, mostly H1 FY27), explicitly reallocating spend toward specialized/vertical/SMB account executives. Headcount had doubled over the prior 18 months — this reads as correcting an over-hired, under-productive sales org, which lines up with the two sales-leader departures flagged under CRO Mike Rich back in Q3. A tacit admission of a real execution problem, not just conservative guidance.

Moat

Quant base (largely unchanged from July, not fully restated this session): non-GAAP gross margin ~80%, GAAP gross margin flat ~76.7–76.9% for two straight years (slight hardware-cost drag, not compounding). NRR ~115% as of the last disclosed figure. $1M+ and $100K+ ARR customer counts continuing to grow at high-teens.

What's new: AI Security bookings rose >50% sequentially in Q4 — the clearest evidence yet that the "Zero Trust for the AI era" pitch is converting to real revenue, not just a narrative. Management is launching Agentic SecOps (Red Canary's MDR expertise fused with Zscaler's inline telemetry) — a genuine platform-consolidation move, and customers on the earnings call explicitly said they want integrated security, not more point products, which favors the platform players over point vendors.

Adversarial stress-test, updated. The core answer from July stands: no startup cheaply replicates 160+ datacenters of inline Zero Trust Exchange infrastructure and 500B+ daily transactions of telemetry. The threat remains Microsoft (Entra Global Secure Access bundled free in E5) in the cost-sensitive mid-market, and firewall-vendor SASE bolt-ons pushing into the base. The September restructuring is itself evidence this pressure is real and unresolved — management is redeploying sales spend specifically toward smaller-enterprise and vertical coverage, i.e. toward the exact segment where the moat was already flagged as weakest in July. This is a defensive correction, not a new threat, but it confirms the July diagnosis rather than disproving it.

Disruption forecast (5–10yr). Unchanged core thesis: inline-proxy architecture is durable at the high end; AI-agent security is a credible TAM extension now showing early real revenue. Main vector remains commoditization/bundling of the "secure users" layer pushing ZS up-market into branch/cloud/agent security, where the M&A spend is aimed.

Evergreen rating: 6.5/10 (down from 7.0 in July). Best-in-class architecture and genuine switching costs are intact. The downgrade reflects organic (ex-M&A) net-new ARR growth confirmed at 17% — not a guidance number to be skeptical of, but a disclosed actual — plus a sales-org restructuring that is a direct, dated admission the mid-market motion needed fixing.

Valuation

Model Input Output Weight
Graham √(22.5×EPS×BVPS) GAAP EPS −$0.39, BVPS $15.94 N/A (negative EPS) none
EV/Revenue vs peers EV $25.05B / TTM rev $3.35B 7.5x med
EV/ARR $25.05B / $3.77B 6.6x med
Fwd P/E — street consensus $163.48 / $5.59 29.2x low (street EPS runs ~15% above mgmt guide)
Fwd P/E — management's own guide $163.48 / $4.88 (FY27 midpoint) 33.5x high — more reliable, less optimistic base
EV/FCF (headline) $25.05B / ~$1.06B ~24x low (SBC-blind)
EV/FCF (SBC-adjusted, strict) $25.05B / ~−$43M n.m. (negative) high
Analyst consensus 44 analysts, avg 1.6/5 (Buy) mean $207 / median $210 (range $155–250) context — broadly raised post-print

Reverse-DCF, updated. The bet described in July is unchanged in shape and one year further along without resolving: the market needs SBC to fall from ~24.5% toward ~12–15% of revenue for true owner-earnings to catch up to the ~30% headline FCF margin already priced in. That decline has now failed to materialize for three consecutive closed fiscal years. Absent it, fair value should be anchored to management's own EPS guide, not the street's more optimistic number.

Fair-value range: $135–185 (base ~$155). Method: 25–33x on FY27 management guide EPS ($4.88 midpoint) spans $122–161; a bull case where ZS beats-and-raises to actual EPS ~$5.20–5.30 (its historical pattern) at a 35x multiple reaches ~$182–186; a bear case of continued deceleration and multiple compression to ~20x lands near $95–100. Centering on the guide-based (not street-based) multiple gives the $135–185 band. At $163.48 the stock sits in the upper-middle of fair value — fuller than the July $143 entry, not cheaper, even though nothing in the fundamental picture improved in between. The stock re-rated up 14% into a worse-confirmed print, which is itself a data point: the sell-side chose to trust the beat-and-raise history over the guide-down, and every major bank that covers it raised its price target this week regardless.

Sentiment

  • Q4 FY26 (2026-09-03): Clean beat — revenue $898.2M (+25%), non-GAAP EPS $1.19 (+34% YoY), non-GAAP op margin 24% (record), ARR $3.77B (+25%). Stock still fell ~4-5% on the FY27 guide of 16.6–17.5% revenue/ARR growth — a ~700-800bps deceleration from FY26's pace — because guidance, not the quarter, set the tone.
  • Company-specific vs sector-wide — tested as asked. Evidence points to mostly company-specific, with a sector-repricing overlay: Palo Alto (PANW) reported +34.5% revenue and +63% next-gen ARR two days earlier and held steady after an initial dip; CrowdStrike (CRWD) slipped modestly "in sympathy" with no company-specific catalyst that day. The cleanest read: PANW's own fundamentals are not decelerating, so the market treated ZS's guide as ZS's problem (sales-org overbuild, mid-market softness, organic ARR already at 17%) — CRWD's small sympathy move is standard multiple-compression bleed-through across a richly-priced group, not evidence of sector-wide demand deterioration. Wedbush's framing (PT cut to $220 from $300, citing the guide miss and growth deceleration specifically) supports the company-specific read.
  • Sell-side reaction is unusually split from the price action: almost every major bank raised its price target this week despite the stock falling on the print — Citi 175→205, Needham 180→215, KeyBanc 185→210, Mizuho 185→210, BMO 178→200, RBC 200→210, Macquarie 172→200, Stifel 175→200, Wells 210→215, Barclays 192→200, Stephens 200→225. Only Morgan Stanley (Equal-Weight, still raised 145→165) and Piper Sandler/BTIG (Neutral) stayed cautious. The sell-side is pricing this as a conservative guide, not a broken growth story — worth weighing against the fundamentals team's more skeptical SBC read.
  • Restructuring, 2026-09-01: 3% workforce cut, $30-33M charge, redeploying toward specialized/vertical/SMB sales coverage — a dated, explicit admission that the prior 18-month headcount doubling over-built the wrong sales motion.
  • Insider activity: Routine, small, scheduled sales by CFO Rubin, CEO Chaudhry, and other officers throughout FY26 (mostly 10b5-1 pattern, few hundred to few thousand shares each, at prices from $122 to $230+) — no unusual size or clustering, no insider buying observed. Neutral, not a flag either way.
  • AI narrative: Security-for-AI bookings +50% QoQ; Agentic SecOps (Red Canary MDR + Zscaler telemetry) launched Sept 9. Customers on the call said they want integration, not more point products — favors platform incumbents.

Tensions / Debate

  • Fundamentals vs Sell-side. Fundamentals: SBC-adjusted FCF is confirmed negative-to-thin after three flat years — the exact pattern the KB already used to reject this name from the investable software universe in March. Sell-side: broad price-target raises despite the guide miss, betting on beat-and-raise history repeating. Resolution: weight Fundamentals for entry/exit pricing (this is a cash-quality problem, not a sentiment problem), weight Sell-side as evidence the market's patience for this story is not exhausted — hence WATCH, not AVOID.
  • Moat vs Growth-quality. The architecture and AI-security tailwind are real and durable; the organic (ex-M&A) 17% net-new ARR number says the deceleration is not just conservative sandbagging. Both true — a good business decelerating on schedule is not the same finding as a good business mispriced by fear.
  • Balance-sheet optics vs reality. The narrow cash line dropping from $2.39B to $928M looks alarming; the fuller totalCash-vs-debt picture ($1.61B net cash) says otherwise. Resolved by using the fuller figure, but flagging that headline balance-sheet cash swings this large deserve a second look each quarter.

Cyber-sleeve swap analysis

Per the concentration rule (Watchlist.md: "4 held = deep. New entries are swaps, not adds."), ZS competes for a slot against the held cyber names. Weakest held name by conviction is CRWD (verdict TRIM, conviction 6.0) — already flagged as overvalued (rich multiple on a business that's fine, not impaired). ZS's own conviction this pass is 6.0 (WATCH) — a tie, not an upgrade. A swap only makes sense if ZS is clearly better risk-adjusted than the name it would replace; on this evidence it is not:

  • CRWD's problem is valuation (priced for perfection) on a business with a cleaner FCF picture (SBC ~22.5% of revenue, slightly better than ZS's 24.5%).
  • ZS's problem is cash-flow quality (the disqualifier pattern) layered under a decelerating organic growth rate — a different and arguably harder problem to underwrite than "just expensive."

Recommendation: do not swap. Keep the cyber sleeve as-is. Revisit ZS for a swap only if either (a) SBC/revenue finally breaks meaningfully below ~20% with FCF-margin proof over two consecutive quarters, or (b) price retraces back under ~$135–140, restoring the margin of safety that existed in July before the print confirmed the SBC problem rather than resolving it.

Verdict — Watch () · Conviction [6.0]/10 (down from 6.5)

Zscaler remains a category-defining zero-trust platform with a real architectural moat, elite gross margins, a genuine (if now-second-wave) AI tailwind, and a fortress net-cash balance sheet. None of that is in question. What moved the conviction down half a point since July is that the central uncertainty flagged then — whether SBC-adjusted FCF would prove to be roughly breakeven or something worse — is no longer an estimate. FY26 closed with SBC flat at 24.5% of revenue for the third straight year, SBC-adjusted FCF negative-to-thin depending on capex definition, organic (ex-M&A) net-new ARR already at 17%, and a sales-org restructuring that is a dated admission the mid-market motion needs fixing. The stock also re-rated up 14% since July into this confirmed, not-improved picture — the entry got fuller, not cheaper, even as the underlying question resolved unfavorably.

Key risks: (1) SBC never normalizes — three years of flat ~24-25% now the base case, not the exception; (2) Microsoft E5 bundling continues to erode the mid-market, the exact segment the September restructuring targets; (3) net-new ARR ex-M&A (17%) is the real growth rate, and further deceleration below it would break the thesis outright; (4) integration risk from the $918M FY26 M&A step-up (Red Canary, SPLXAI, Symmetry, SquareX) landing all at once; (5) capex (AI-datacenter, memory/processor costs) continuing to run above the FY27 guide's assumed normalization.

Entry / trim zones: - Accumulate: $125–140 (starter), compelling <$120 (near 52-week-low territory, ~20x management's FY27 guide EPS). - Fair value: $135–185 (base ~$155) — $163.48 sits upper-middle, full, not cheap. - Trim / avoid adding: 35x fwd (street-consensus EPS) — re-set as a multiple per the valuation-analyst rule so the dollar trigger tracks earnings, not a stale price.

Thesis-break (downgrade <5.5): SBC/revenue still flat or rising a 4th straight year; organic net-new ARR falls below mid-teens; a second CRO-level departure; a marquee mid-market displacement loss to Microsoft. Thesis-upgrade (toward 7): SBC/revenue breaks below ~20% with SBC-adjusted FCF turning durably positive (not a comp-mix swap — verify total compensation cost, not just the SBC line, per the equity-for-cash-swap pattern in the KB); Agentic SecOps/AI-security bookings converting to a re-acceleration in organic net-new ARR.

A portfolio-specific passage was removed from the public build.

Sources