Infra Play #147: Zscaler
Scaling the...Zscaler?
In my last article on cloud infrastructure software dynamics, one of the key insights was the transformation of the security market, as AI has quickly become both a significant opportunity to improve existing products and a risk vector. Almost every CISO in the industry will be buying a platform to either monitor or secure AI agents over the next twelve months, which prompts the obvious question: who will benefit the most?
One of the existing incumbents with a strong claim to be able to perform in the new age of AI is Zscaler. I haven’t properly covered them previously, so let’s dig in.
The key takeaway
For tech sales and industry operators: Zscaler clearly has valuable installed distribution, switching costs, enterprise trust, recurring revenue, and a large customer base, which are the raw materials of a good business. But a good business is not automatically a great business if the category is crowded, the buyer can compare several credible platforms, and growth is decelerating despite the claimed demand shock. From an operator’s perspective, the hard question is whether Zscaler is becoming more essential inside the customer’s operating model or merely adding modules to defend its existing account base. The cleanest positive signal would be customers standardizing around Zscaler as the default control plane for user, workload, branch, cloud, data, and agent access. The cleanest negative signal would be AI products staying small while the legacy access business keeps carrying the numbers. If Zscaler can make itself the default map of “who or what can access what,” it becomes much more than remote access; it becomes the security ontology of the enterprise. If it cannot, then AI Protect becomes another module in a bundle, and the company remains exposed to Palo Alto, Netskope, Cato, Cisco, Microsoft, CrowdStrike, and every platform trying to own the same control point. The structural problem for the sales teams is speed: the motion is consultative, GSI-led, and measured in quarters, and the threat is measured in minutes, so whoever shows a customer their own live exposure instead of describing it in a deck wins the part of this the incumbent is built to lose. What happens next is undecided, but the revolving door at the top of the sales org is the canary in the coal mine.
For investors and founders: The company sits at the intersection of three cycles: the cybersecurity consolidation cycle, the AI adoption cycle, and the software multiple cycle. The AI adoption cycle is bullish for security demand because complexity, autonomy, and attack speed all rise. The consolidation cycle is mixed because large vendors can bundle more aggressively, customers want fewer tools, and SASE/security platforms may converge around a small number of winners. The software multiple cycle is unforgiving because investors no longer reward narrative without clean organic growth, especially when sales leadership changes and acquisitions blur the signal. That means Zscaler can be fundamentally important and still be a difficult stock if the timing of demand, execution, and valuation do not align. For founders, the lesson is to build into the pressure points created by the cycle: cost reduction, tool consolidation, AI-risk auditability, machine-identity governance, and board-level evidence. For investors, the alpha is to watch the leading indicators before the income statement: ZPA expansion, AI Protect attach rates, data-security ARR growth, Zero Trust Branch adoption, new-logo recovery, GSI/channel pull, and whether organic net-new ARR stops decelerating. The concerning sign today is that the company’s AI story still sounds like discovery, guardrails, DLP, red-teaming, and reporting: useful, but not obviously revolutionary. They should be aggressively asking: what would the security stack look like if built today for millions of non-human agents, not retrofitted from human access controls? That leads to products like self-updating permission systems, agent sandboxing, exploit-path simulation, autonomous kill switches, and real-time policy generation based on observed behavior. The investable company is the one that turns AI security from a dashboard into a control loop.
Zero trust issues
Jay Chaudhry: We delivered strong Q3 results. ARR grew 25%, and non-GAAP operating margin hit an all-time high at 23%. AI is changing the nature of cybersecurity in real time. Zscaler is the cybersecurity platform for the AI era. This is evident in our results and the reason we are so confident in our long-term potential. We offer the industry's only complete Zero Trust SASE solution, a singular Zero Trust platform across users, across cloud workloads, and across branches. Our architecture is purpose-built to address the limitations of firewall-based SASE solutions and has several key differentiators. First, we hide applications and data behind our Zero Trust Exchange, making them invisible from the internet and eliminating the attack surface. An attacker can't breach what it can't reach. Hence, this architecture provides far superior cybersecurity protection for our customers.
Second, we eliminate lateral movement of attackers with our Zero Trust architecture. We only allow authorized users and workloads to access specific applications. This reduces the blast radius of a potential breach, providing better security to our customers. This stands in stark contrast to competitors with firewall-based SASE architecture that connect users to the corporate network. Once a malicious actor gains a foothold on the network, it can roam freely and systematically attempt to compromise critical applications or steal data. This is how most ransomware attacks happen. Finally, scale matters, and our cloud-native Zero Trust Exchange is the largest distributed inline security platform in the world that spans across 160 public exchanges, processing more than 500 billion transactions per day. This gives us the best quality and quantity of telemetry data. Simply put, no other cybersecurity vendor has access to data sets with comparable fidelity and breadth.
This high-fidelity telemetry fuels our AI-powered security capabilities, continuously improving how we detect, prevent, and stop threats. These differentiators are especially important at a time when organizations are aggressively deploying AI applications and models with growing interest in AI agents at scale. We expect it won't be long before millions of AI agents have access to organizations' mission-critical applications and sensitive data. Today, users are the weakest link in cybersecurity. Soon, AI agents will be the weakest link because they operate at far greater speed and have far less oversight. Even a single compromised agent can move from discovery to data theft in minutes, inflicting catastrophic damage on enterprises. Making it even more challenging, new powerful frontier AI models like Mythos are finding security vulnerabilities in software at machine speed, significantly diminishing the effort, skill, and time needed to breach enterprises.
All enterprises already have thousands of known vulnerabilities that they haven't been able to patch. Frontier models are multiplying these unremediated vulnerabilities by as much as 10x, and even more powerful models that are currently being developed will undoubtedly make it worse. Enterprises don't have the capacity to patch and update existing vulnerabilities, so backlogs are piling up faster than organizations can address them. To tackle this challenge, the market needs to take a different approach. We provide the two most important defenses against these vulnerabilities. One, hiding applications from attackers, and two, eliminating lateral movement at scale. This validates the architecture we pioneered. Zscaler was built for this moment. We started with Zero Trust security for users, so users can safely access applications from anywhere. We expanded our Exchange to provide Zero Trust security to branches, workloads, and connected IoT/OT devices.
Now we are expanding our exchange to secure AI agents. An important element of agentic security is to understand which agents, users, and other identities are communicating with which models, applications, and data sources. On May 21st, we announced our intent to acquire Symmetry Systems, a company that solved this difficult problem. Symmetry provides an access graph that maps how identities, applications, and other data sources connect across the enterprise. We are integrating its access graph technology with our Zero Trust Exchange. We're excited to share more about this at our Zenith Live user conference in Las Vegas next month. We are also partnering with Anthropic on Project Glasswing and with OpenAI as part of its Daybreak program, formerly known as Trusted Access for Cyber, or TAC, which allows us to access frontier models to proactively harden our systems and deliver better security and resilience to our customers.
From my personal point of view, zero trust architecture always made a lot of sense in the context of cybersecurity. The majority of the damage from breaches is related to lateral movement (i.e. one employee gets compromised, then the attacker accesses a sensitive database from their account, for example), and reducing dwell time is arguably the most important risk reduction activity from a technical perspective (leaving attackers fewer opportunities to move across the network). As such, setting up internal blocks and reducing access across applications and endpoints is a logical way to approach the problem.