Zscaler operates the Zero Trust Exchange — a proprietary global security cloud that inspects user-to-application traffic inline, sold as 100%-recurring subscription at roughly 80% gross margin. It is a genuinely good business. That is not the question this note has to answer. The question is the price, and the price has just been through a violent re-rating: a single guidance print on 26 May 2026 halved the forward growth guide and cut the free-cash-flow margin guide on a capex ramp. The stock fell 31.5% in a day and is down about 54% over twelve months.
What that collapse produced is a genuine contradiction, and the whole report is built to resolve it. On the revenue multiple the market uses for security software, Zscaler at ~5.4x forward sales is the cheapest scaled, higher-quality platform in its peer group — a ~60% discount to a ~14x median, above only SentinelOne at the very bottom. On the cash it actually generates, once you treat stock comp running at a quarter of revenue as the cash cost it is, it is still fully valued, with owner free cash flow near zero. Both lenses are internally honest. Which one the market chooses is the thesis, and it has no near-term catalyst. We rate it Watchlist, medium conviction.
Zscaler is simultaneously the cheapest scaled, higher-quality platform in its peer group and a stock that prices in roughly zero owner free cash flow. The reconciliation is that revenue multiples give every security platform the same stock-comp pass: a ~5.4x sales multiple looks cheap next to CrowdStrike at 18x precisely because the market treats ~20–25%-of-revenue equity compensation as if it were free for all of them. So the "60% discount" is real but relative — it says Zscaler is less expensive than an equally SBC-flattered peer set, not that it is cheap on the cash an owner could take out. The fork: if the market keeps valuing the group on revenue, the derate overshot and ZS re-rates toward $170–220; if it ever prices cash, "cheap versus peers" offers no protection, because the whole complex de-rates together.
1 · Investment thesis summary
Zscaler is the cleanest pure-play expression of the zero-trust shift in enterprise security: a proprietary, globally distributed cloud that inspects user-to-application traffic inline, sold as 100%-recurring subscription at ~80% gross margin. The business quality is real — founder-led, ~35%+ insider-controlled, a genuine switching-cost and infrastructure moat, and annual recurring revenue still compounding at 25%. The problem is not quality. It is that the market spent years pricing this as a permanent-30%-grower and a clean cash-compounder, and in the space of one print both legs cracked: management guided FY2027 ARR growth to 16–17%, roughly half the FY2026 pace, and cut the FY2026 free-cash-flow margin guide from 26.5–27% to 22.8–23.3% as capex ramps into memory, storage and processor inflation.
The multiple has come from heroic to merely high. But the two things that made Zscaler a premium asset — durable 30% growth and asset-light cash conversion — are both now in question, and the GAAP profitability the bull case leans on does not exist once you reverse stock-based compensation running at 25.6% of revenue. Hence Watchlist, not Buy: at ~$134 you pay for roughly zero owner free cash flow and a halved growth rate, on a regime bet with no catalyst. It is also not a short — the 54% derate already removed the egregious premium, the business is net-cash and durable, and a single beat-and-raise can squeeze the stock 20–40%.
What is the business? A multi-tenant security cloud across 160+ data centres that sits inline between users, devices and workloads and the applications they reach — connecting an authenticated user only to the specific application they are entitled to, and inspecting the session on the way through. What is the edge? A purpose-built inline-proxy architecture and an owned global edge that earns the ~80% gross margin and a high switching cost, defended further in government by FedRAMP/IL5 accreditation. Why not now? Because growth has structurally halved, the asset-light cash identity is eroding exactly as capex turns up, and the reported profitability is entirely a stock-comp construct — and none of those is yet in a price that still embeds a bull-tilted outcome.
The downside anchor is the re-adjusted DCF (~$64–68, owner FCF with SBC as a cash cost); the upside is the comp re-rating (~$170–217). The central methodology anchor is the scenario-weighted blend, which embeds the regime question explicitly and lands at ~$117 — about 13% below the price. What we would actually pay for: a pullback into the high-$90s / low-$100s (EV/NTM sales in the mid-3x to ~4x range) without ARR impairment, or evidence the organic engine has re-accelerated (net-new ARR ex-Red Canary up two quarters, with net retention back to ≥114%).
No long position at $134. The view maps to patience: the entry we would pay for is the $90s. For an account willing to engage the volatility, the thesis is consistent with selling cash-secured puts struck in the low-$90s — harvesting the elevated post-collapse implied volatility and being paid to wait for that entry, a buffered way to get long where the re-adjusted base-to-bull case brackets the price. Invalidation, in the same breath: stand aside if organic net-new ARR (ex-Red Canary) re-accelerates above ~20% for two quarters with net retention ≥115% and peers hold 14–22x sales — because then the comp re-rating dominates and owning shares outright beats a capped short put. Any single guidance print can move the stock ±20–40%; size accordingly. This describes how the thesis maps to instruments; it is not advice.
2 · Business quality & moat
Zscaler operates the Zero Trust Exchange, a multi-tenant security cloud spread across 160+ data centres that sits inline between users, devices and workloads and the applications they reach. Rather than routing traffic back to a corporate network behind a firewall, it connects an authenticated user only to the specific application they are entitled to, and inspects the session for threats and data loss on the way through. The two foundational products are Zscaler Internet Access (secure web/internet gateway) and Zscaler Private Access (zero-trust application access, the VPN replacement); the platform has since extended into SASE/branch, data security (>$500M ARR, +30%) and an AI-security suite (AI Protect bookings >$100M). Revenue is 100% subscription at ~78% GAAP / ~81% non-GAAP gross margin, sold predominantly through channel partners and increasingly via multi-year "Z-Flex" commitments (~$480M of total contract value in Q3 alone). The customer is the large enterprise and, increasingly, government: 748 customers now exceed $1M ARR, and Zscaler just received Department of War (DoW) Impact Level 5 authorization, a meaningful public-sector credential.
Classify before comparing. Zscaler is a platform in the strict sense — cloud-delivered, multi-tenant, ~80% gross margin, 100% recurring, high switching cost. That classification fixes both the comparable set and the margin ceiling. The right comps are other security platforms: CrowdStrike is the closest pure analogue, with Palo Alto, Fortinet, Cloudflare and SentinelOne around it — not the broad software tape, and not hardware- or services-heavy vendors. The one nuance that separates Zscaler from a textbook public-cloud SaaS is that it runs its own global edge rather than renting all of it from hyperscalers. That proprietary infrastructure is simultaneously the moat and the reason gross margin sits a touch below CrowdStrike's, and the reason the current capex and component-cost shock bites — a software-only peer does not buy memory and processors by the rack. The platform's margin ceiling is therefore ~80% gross; the binding constraint on operating margin is sales intensity (S&M ~47% of revenue) and SBC, not cost of goods.
Proprietary, not general-purpose. The core is proprietary: a purpose-built inline-proxy architecture, a global private cloud with real processing scale, and a threat-intelligence network that improves with traffic volume. That is what earns the ~80% gross margin and the high switching cost, and it is not something a new entrant replicates cheaply. The durability risk is not substitution by a startup; it is platform bundling by general-purpose giants — Microsoft (Entra / Global Secure Access bundled into E5), Cisco, Palo Alto and Cloudflare all pushing into zero-trust and SASE. The proprietary core defends the install base; the adjacencies Zscaler needs for its next leg — branch SASE, data security, AI security — are exactly where general-purpose bundling compresses price. Our working judgment: the edge is proprietary and durable in ZIA/ZPA over a 5–7 year window, but shallower and decaying faster in the newer adjacencies — and the slipping net retention (114% in FY25 versus 116%) plus the halving of forward ARR growth are the first quantitative tells that the market may be pricing a 5–7 year moat as permanent.
Capital intensity — feature turning toward bug. For most of Zscaler's life the proprietary cloud was a feature: a barrier a competitor had to spend years and hundreds of millions to match, while Zscaler itself stayed asset-light (capex mid-single-digits as a percent of revenue, ~30% FCF margins). That is now tilting. Management has guided FY2026 capex to high single digits and FY2027 up another ~200bps, citing memory/storage/processor inflation and a pull-forward of data-centre equipment to lock in prices — and it cut the FY26 FCF-margin guide accordingly. This is the early signature of the depreciation clock: capacity bought now is revenue-supporting later but carries a depreciation tail, and a component super-cycle means the matching cost lands after the spend. The capital-intensity story is moving from unambiguous moat toward a fixed-cost-leverage risk — and it is doing so at the same moment growth decelerates, the worst possible sequencing.
Management and capital allocation. Zscaler is founder-led and founder-aligned. Jay Chaudhry (CEO, Chairman, Founder) and family trusts control roughly 35–38% of the company on a single share class, so control is economic rather than super-voting — the governance arrangement we prefer, and the strongest alignment signal in the file. The alignment is not uniform, and three things temper it. First, capital allocation is unproven on M&A: no dividend, no buyback, historically everything reinvested into R&D (25% of revenue) and S&M (47%), and now a pivot to acquisitions — Red Canary (~$770M cash) and the announced Symmetry Systems — at the moment organic ARR is decelerating and the stock has halved. Red Canary is visibly propping the headline: total ARR grew 25% but only 21% ex-Red Canary, and net-new ARR grew 14% organically (7% in Q2). Second, dilution: SBC ran $626M over nine months (~25% of revenue), shares grew ~2.2% entirely through equity comp with zero buyback offset, and RSUs were granted at a $243 weighted value against a ~$134 stock — setting up either retention risk or future re-grant dilution. Third, execution wobble: two sales leaders departed at the end of Q3, and management took an explicitly "prudent" posture on guidance through the transition.
We will not pretend uniform strength. The moat is deepest in the original ZIA/ZPA franchise — inline inspection, embedded policy, an agent on every endpoint, high switching cost — and in the government vertical, where FedRAMP/IL5 accreditation is a real regulatory barrier. It is thinnest in the newer adjacencies — branch SASE, data security and AI-agent security — where Palo Alto, Cloudflare, Netskope and Microsoft compete directly and where pricing is most exposed to bundling. The single most important business-quality fact for the rest of this report: the durable, high-moat core is the decelerating part, and the growth Zscaler needs is concentrated where the moat is shallowest. Quality is genuine and founder-aligned, but it is a proprietary core ringed by increasingly contested adjacencies — and that is what the valuation work has to price.
3 · Revenue model
Zscaler reports as a single operating segment with no product-level P&L, so a literal segment revenue build is not possible from the filings — and inventing one would be the exact error the platform discipline warns against. The honest driver for a 100%-recurring platform is the ARR engine: revenue is recognised off a subscription base driven by net expansion of existing customers and new-logo additions. We model an ARR roll-forward and recognise revenue off the base, with a customers × ARPU decomposition as the historical cross-check. That decomposition is clean and favourable: total customers grew 7,700 → 8,650 → 9,400 (FY23→FY25, ~12%/yr) while ARPU rose from $210K to $284K. Growth has been roughly half "more customers," half "more per customer" — the healthy mix for a platform.
| ($M) | FY25A | FY26E | FY27E | FY28E | FY29E | FY30E |
|---|---|---|---|---|---|---|
| Ending ARR | 3,020 | 3,745 | 4,363 | 4,974 | 5,571 | 6,184 |
| — ARR growth | — | +24% | +16.5% | +14% | +12% | +11% |
| Net dollar retention | 114% | 113% | 111% | 110% | 109% | 108% |
| Revenue | 2,673 | 3,330 | 3,929 | 4,519 | 5,106 | 5,693 |
| — revenue growth | +23% | +24.6% | +18% | +15% | +13% | +11.5% |
The deceleration is not one soft quarter; it is both growth levers compressing at once — net retention grinding from 114% toward ~108% and the new-logo contribution shrinking as a share of an ever-larger base. The base case already embeds the company's own halving of forward growth.
Recurring, with a new kind of volatility. There is essentially no project or services revenue to model — ~100% is recurring subscription, so the classic one-cancellation project cliff does not apply. The volatility has a different shape: the fastest-growing line is now non-seat-based, metered/usage pricing — 30%+ of new annual contract value in Q3, with tied ARR up >100% year-on-year. Usage-based revenue does not churn through a renewal notice; it flexes with how much customers actually run, so it is more macro- and AI-adoption-sensitive in both directions. We model it as the higher-variance component rather than smoothing it into the recurring base.
Concentration sits in the channel, not the customer. No end customer exceeds 10% of revenue, so the catastrophic single-customer case does not apply. The real concentration is in go-to-market: the top five channel partners are 28% of FY2025 revenue (25% FY24, 26% FY23) and can cease reselling "with limited or no notice." That is a genuine but second-order risk — the switching cost is to Zscaler, not the reseller — so a channel disruption is a sales-friction and renewal-timing problem, not a revenue cliff.
A metric quietly removed. Single segment throughout, so no re-cut to interrogate — but the tell is the removal of a metric: calculated billings, the cleanest forward-bookings read, will no longer be reported beginning in FY2026, retired in the same year organic growth halves. We reconstruct it from revenue plus the change in deferred revenue in Section 5 and track it regardless. Meanwhile the mix is migrating up — data security ARR has crossed $500M (+30%) and AI Protect bookings $100M — structurally positive for ARPU, but the higher-value adjacencies are exactly where bundling is most intense. Migration improves the quality of revenue per dollar while increasing its competitive exposure.
With and without Red Canary. Headline ARR grows 24%; ex-Red Canary it is ~21%, and organic net-new ARR grew 14% (just 7% in Q2). Zscaler paid ~$770M cash for ~$137M of ARR (~5.6x ARR), carrying about 3 points of headline ARR growth. The FY27 guide (16–17%) is essentially the organic rate showing through once the acquisition lap fades. Against the FY2027E base (~$4.36B ARR), a ±50bps move in net retention is ~±$19M of ARR and a ±1% move in the new-logo line is ~±$44M — so as growth decelerates, the new-logo line (most macro-sensitive, least contracted) becomes the larger swing factor, just as two sales leaders depart and management goes "prudent."
4 · Income statement & margin analysis
Cost of revenue is the cost of running the owned cloud — hosting and bandwidth, depreciation of the data-centre fleet, support personnel, amortisation of capitalised software, and branch-appliance COGS. Zscaler does not break COGS into quantified sub-buckets, so we forecast it as a percentage of revenue with mild gross compression (COGS 23.5% → 24%) for component-cost inflation. The opex lines we also forecast as a percentage of revenue — S&M continues its demonstrated leverage, R&D stays heavy on AI reinvestment, G&A grinds down on scale.
| ($M / % rev) | FY25A | FY26E | FY27E | FY28E | FY29E | FY30E |
|---|---|---|---|---|---|---|
| Revenue | 2,673 | 3,330 | 3,929 | 4,519 | 5,106 | 5,693 |
| Gross margin | 76.9% | 76.5% | 76.0% | 76.0% | 76.5% | 76.5% |
| S&M % rev | 47.1% | 45.0% | 43.0% | 41.5% | 40.5% | 40.0% |
| R&D % rev | 25.2% | 24.0% | 23.0% | 22.5% | 22.0% | 21.5% |
| G&A % rev | 9.4% | 9.0% | 8.5% | 8.2% | 8.0% | 7.8% |
| GAAP operating margin | −4.8% | −1.5% | +1.5% | +3.8% | +6.0% | +7.2% |
| memo: SBC + payroll % rev | 25.6% | 24.0% | 23.0% | 22.0% | 21.0% | 20.0% |
| Non-GAAP operating margin | ~21% | ~22.5% | ~24.5% | ~25.8% | ~27.0% | ~27.2% |
The central feature of this P&L is the ~24-point wedge between GAAP and non-GAAP operating margin, which is entirely stock-based compensation. On the re-adjusted (keep-SBC) basis, Zscaler is roughly breakeven at the operating line in FY26E and reaches only ~+7% by FY30E — and that path requires SBC to fall from 25.6% to 20% of revenue. If SBC stays sticky at ~25%, GAAP operating profit barely moves regardless of revenue.
The operating-leverage test — Zscaler passes, with one asterisk. S&M grew +14.7% (FY24) and +14.4% (FY25) against revenue of +34.1% and +23.3% — selling expense grew at well under half the revenue rate, falling from 60% of revenue to 47% over three years. That is genuine operating leverage and the opposite of the high-touch, no-leverage enterprise pattern. We credit it. The asterisk is R&D, which deliberately fails the test — and that is the point: R&D grew +42.5% then +34.5%, faster than revenue, rising from 22% to 25%. The leverage earned on S&M is being spent on R&D, so GAAP operating margin improved only from −14.5% (FY23) to −4.8% (FY25). This is a company choosing reinvestment over margin — defensible, but anyone underwriting near-term margin expansion is betting management stops reinvesting.
A revenue machine, not a margin machine. At the gross line there is no leverage: gross profit grew +34.8% then +21.5%, essentially 1:1 with revenue, and gross margin has been flat-to-down (78.0% → 76.9%). The owned-data-centre model that is the moat is also the gross-margin ceiling, and with component inflation in the cost base the realistic gross-margin path is flat at best. The largest contributor to the modelled +870bps of GAAP margin expansion FY26E→FY30E is S&M leverage (~+500bps); R&D and G&A add ~370bps; gross margin contributes nothing — and every gain is real only if the capex-driven depreciation rise does not eat it first. To the company's credit, the disclosure is clean: the shareholder letter reports non-GAAP gross margin to the decimal (80.7% vs 80.3%) and operating margin as 23.0% — no rounding games. The distortion in this name is not presentation; it is the add-back itself.
5 · Free cash flow & the depreciation clock
Zscaler's reputation rests on cash generation. This section asks the question directly: is that cash structural, borrowed, or an accounting artefact? The answer is mostly the third, and it is the single most important finding in the report. Reported free cash flow looks excellent — $726.7M in FY25 (27.2% margin), guided to ~$766M (23%) in FY26E. But free cash flow adds back nothing for the $685.5M of stock compensation (FY25) — comp that is a real economic cost, settled in shares, diluting owners 2–4% a year with no buyback offset. Net the two and the picture inverts.
| ($M) | FY24A | FY25A | FY26E | FY27E | FY28E | FY29E | FY30E |
|---|---|---|---|---|---|---|---|
| Free cash flow | 585 | 727 | 766 | 825 | 994 | 1,200 | 1,423 |
| less: stock-based comp | (549) | (686) | (799) | (904) | (994) | (1,072) | (1,139) |
| FCF net of SBC (owner cash) | 36 | 41 | (33) | (79) | 0 | 128 | 285 |
On an owner-earnings basis, Zscaler has generated roughly zero free cash flow, and on our base case generates negative owner cash in FY26E–FY27E, turning durably positive only around FY29E once SBC intensity falls below the FCF margin. The "3–4% FCF yield" the bulls cite becomes a ~0% SBC-adjusted yield near-term. This does not mean the business is bad — it means the cash the market is paying ~$21bn of enterprise value for is, today, indistinguishable from the stock it issues to staff. Every valuation downstream discounts re-adjusted owner FCF, treating SBC as the cost it is, not the reported figure.
Structural float versus timing. The deferred-revenue float is largely structural: Zscaler bills annually (often multi-year) in advance, so growth throws off cash ahead of recognition — deferred revenue grew +$418.6M / +$455.3M / +$573.1M in FY23/24/25, funding ~59% of FY25 cash flow from operations. That float is real and ongoing, as long as billings keep growing. As ARR growth halves to 16–17%, the incremental float shrinks, so operating cash flow decelerates faster than revenue. The 9-month FY26 figure is the timing trap: operating cash flow of $850M was not helped by the float — deferred revenue actually fell $65.9M over the nine months (the big billing quarter is the July-ending Q4) — it was flattered by a ~$280M accounts-receivable drawdown, pure collections timing. Anyone annualising the 9-month 29% margin double-counts a seasonal collection; the structural run-rate is the full-year guide (~23%).
The depreciation clock. Including capitalised software, total capex was ~9.2% of revenue in FY25 (~$246M) — already "high single digits," not the "mid-single" implied by quoting PP&E alone — guided to ~9% in FY26 and +200bps in FY27 (~11%). The capex–D&A gap has run $120–200M a year, so today's spend becomes tomorrow's depreciation. If the FY26 capex run-rate (~$300M) repeats at the ~4-year asset life, steady-state depreciation converges toward ~$300M versus ~$185M today — roughly $115M, or ~300–400bps of latent operating-margin drag, building over three years. That is almost exactly the same ~370bps of R&D-plus-G&A leverage credited in the margin bridge, about to be handed back as depreciation: the S&M leverage survives, the rest risks being a wash. The signal to watch is a future useful-life shortening (servers were extended in Aug-2023, a one-off flatter) — an admission that AI compute obsolesces faster would be a red flag.
6 · Quality of earnings & adjustment reversal
This module rebuilds the numbers the company adjusted away, so everything downstream runs on a re-adjusted base. We do not take the adjusted numbers at face value.
| FY2025A | FY2026E | |
|---|---|---|
| Reported non-GAAP operating income | 574 | 749 |
| (−) Reverse SBC + payroll taxes | (686) | (799) |
| (−) Reverse acquired-intangible amortisation | (17) | — |
| = Re-adjusted operating income (≈ GAAP) | (129) | (50) |
| Distortion reversed | 703 | 799 |
This is a company whose entire reported profitability is the act of not counting the stock it pays. Working through the reversals: Zscaler runs no buyback and issued 3.4M net shares in nine months entirely through RSU vesting, ESPP and options — no cash is spent to neutralise the dilution, so SBC is a real, recurring transfer of ~25% of revenue from owners to employees, and we reverse it in full. Stripping the deferred-revenue float takes FY25 operating cash flow from $972M to $399M — it survives, but is ~59% smaller. The 9-month FY26 benefit was the opposite distortion, a ~$280M AR-collection timing release, normalised out. On the reversed basis, gross margin is 76.9% (not ~80%) and operating margin is −4.8% (not +21.5%); "adjusted EBITDA" is, line for line, GAAP operating loss plus the SBC add-back. After the reversals, ex-float operating cash flow grew +23.1% (FY24→FY25) against revenue of +23.3% — almost exactly 1:1. Zscaler is a revenue machine, not a cash machine.
On the disclosure diff: calculated billings was discontinued in FY26, the total customer count is no longer refreshed quarterly (still 9,400 from July 2025), and net retention is now disclosed only annually. Against that, two clean items: PP&E useful lives were not shortened, and the segment definition is unchanged.
Low because the reported profit is entirely SBC, owner FCF is roughly zero, ~59% of operating cash flow is growth-funded float, and forward visibility was reduced; medium-not-worse because the revenue is genuinely recurring and cash-collected, the float is real, and there is no aggressive revenue recognition. This is a quality-of-disclosure problem on a real business, not a float-Ponzi. The binding re-adjusted base for everything downstream: leverage measured on GAAP EBITDA; the DCF treats SBC as a cash cost; comps run on the re-adjusted base with the peer asymmetry made explicit.
7 · Capital structure & balance sheet
After the unsparing quality-of-earnings section, this is where we credit Zscaler honestly: the balance sheet is genuinely strong and, on the dimensions a sceptical read hunts hardest — hidden leverage, off-balance-sheet vehicles, circular financing — it is clean. Zscaler carries a single debt instrument: $1,725M of 0.0%-coupon convertible senior notes due 15 July 2028 (carrying $1,699.6M). Against ~$3.54B of cash and short-term investments, the company sits on net cash of ~$1.84B, and it just demonstrated the willingness to retire converts in cash — the prior $1.15B 2025 notes were repaid in full in cash on 1 July 2025.
Gross debt is 1.9x adjusted EBITDA but 13.0x re-adjusted (GAAP) EBITDA — but the contrast is academic, because the company holds net cash: net debt/EBITDA is −13.8x, and the 0% coupon plus ~$34M/quarter of interest income means coverage does not bind. This is the one place the re-adjusted lens does not change the conclusion: leverage is not the risk at Zscaler.
The real structural item is the 2028 convert. The notes were struck at a $439.52 conversion price (cap $784.85) when the stock was near $300. At ~$134 they are deeply out of the money, so they will be repaid in cash in July 2028, not converted, and the capped calls are now economically worthless. The $1.725B repayment is well covered (liquidity ~2.0x) but consumes roughly half the cash cushion, funded from the existing pile rather than generated cash (owner FCF is roughly zero through FY27). Not a solvency risk — a real claim the equity story quietly depends on.
| Item | Value | Note |
|---|---|---|
| Gross debt | $1,725M | 0.0% converts due Jul-2028 (carrying $1,699.6M) |
| Cash & ST investments | ~$3,540M | — |
| Net cash | +$1,839.5M | repaid $1.15B 2025 notes in cash, Jul-2025 |
| Conversion price | $439.52 | deeply out-of-the-money at ~$134 → cash repayment |
| Dividend | — | none |
| Buyback | — | none; shares 158.3M → 161.7M in 9 months |
| Share dilution | ~3%/yr | entirely equity comp, zero offset |
Capital allocation, by revealed preference: organic reinvestment (R&D 25% + S&M 47%) > debt repayment > a new pivot to M&A (Red Canary ~$770M, Symmetry announced) > rising capex — and nothing to shareholders. Per-share value is diluted ~3% a year, the "negative buyback discipline" case. The M&A pivot has to earn its keep, and Red Canary is currently propping headline ARR rather than proven accretion. The two real structural items are the 2028 convert repayment (well covered) and the unmitigated ~3%/year SBC dilution; off-balance-sheet, the file is clean.
8 · Cost of capital (WACC)
The discount rate matters more than usual: Zscaler's value sits in far-out cash flows (owner FCF is roughly zero until ~FY29E), so the rate does most of the work.
| Input | Value | Source / basis |
|---|---|---|
| Risk-free rate (10Y UST) | 4.49% | FRED / Fed H.15, 2026-06-04 |
| Equity risk premium (implied) | 4.23% | Damodaran implied, start-2026 |
| Beta — raw (5Y monthly) | 0.96 | measured over the steady-compounder years |
| Beta — selected | 1.15 | forward: post-derate vol + peer set |
| Company-specific premium | +0.75% | reporting risk + single-print magnitude |
| Cost of equity | 10.1% | Rf + β·ERP + CSP |
| After-tax cost of debt | 4.3% | ~5.4% pre-tax synthetic IG |
| Equity / debt weights | 92.7% / 7.3% | market value |
| WACC (carried in DCF) | ~10% | 9.7% gross-debt; ≈10.1% net-cash |
The beta is the judgment of consequence. The five-year regression beta of 0.96 is deceptively low, measured over the steady-compounder years; the forward business risk is higher — growth halved, the metered line unproven, a 31% single-print move. We select 1.15 and carry the rest of the idiosyncratic risk in an explicit company-specific premium. That premium is earned by hard evidence: going into the Q3 print the options market priced a ~13% move (above the ~8.25% prior-four-quarter average); the stock delivered −31.5%, roughly 2.4x the implied move. The market underpriced the magnitude of single-quarter risk.
The macro regime makes the rate a genuine constraint, not a formality. The ERP at 4.23% is roughly its long-run average — not compressed toward zero — and the risk-free rate at 4.49% is materially positive. This is not a passive-flow, valuation-agnostic melt-up; it is a name already repriced 54% whose value depends on cash flows a decade out, and at ~10% those far-future flows are heavily penalised. That is precisely why a business that supported a premium multiple at a 3% risk-free rate cannot support it at 4.5%.
9 · DCF valuation
This is where the build converges. Per the quality-of-earnings work, we discount re-adjusted owner free cash flow — FCF with stock comp treated as the cash cost it is — not the reported figure. That single choice is the difference between a fair value near the current price and one roughly half of it. Discount rate ~10%, terminal growth 3.5%.
Lead with the reverse DCF. At ~$134 (EV ~$19.8B), the market is paying for a terminal owner-FCF margin of ~35% of revenue. To reach 35%, Zscaler must run a ~28% reported FCF margin and shrink stock comp from ~25% of revenue to essentially nothing — cash efficiency that exceeds where mature mega-cap software sits, in perpetuity. Our base assumes a generous normalisation to 16% (SBC easing to ~11%, not zero). The price embeds an outcome in which stock comp simply does not count. That is the gap, and it is the thesis.
| Method | Fair value | vs ~$134 |
|---|---|---|
| Perpetuity growth (g 3.5%, WACC 10%, term margin 16%) | $68 | −49% |
| Exit multiple (18x re-adjusted EBITDA) | $64 | −53% |
On re-adjusted cash flows the stock is worth ~$64–68, roughly half the current price.
At $134 you are not buying $134 of discounted cash flow. You are buying about $68 of re-adjusted cash flow plus about $66 of faith — that stock-based compensation melts to near zero and growth stays above GDP forever. Roughly half the price is that faith.
Brighthedge — Equity researchIf you believe SBC is genuinely non-cash and should be ignored, you discount reported FCF (~$766M FY26E, growing) and the DCF lands near $115–130 — roughly fair at today's price. The ~$66 gap between our $68 and the market's $134 is, almost dollar-for-dollar, the capitalised value of stock-based compensation. Our stance is that comp settled in shares, diluting owners ~3% a year with no buyback, is a real cost — so we anchor on ~$68. But the reader should see the gap for what it is: not a dispute about growth or margins, but about whether ~25%-of-revenue equity comp is a cost.
| Term. margin \ WACC | 9.0% | 10.0% | 10.75% |
|---|---|---|---|
| 12% | $64 | $54 | $49 |
| 16% (base) | $82 | $68 | $61 |
| 20% | $99 | $82 | $73 |
| 25% | $120 | $99 | $88 |
| Marker | Value |
|---|---|
| Bear | ~$40 |
| Base — re-adjusted DCF | $64–68 |
| Bull — DCF-only (owner cash) | $107 |
| Current price | ~$134 |
| Sell-side 1-yr target (consensus)* | ~$195 |
| Bull — revenue-multiple regime (Section 11) | $205 |
| 52-week high | ~$310 |
10 · Comparables & the reconciliation
This is the strongest leg of the bull case, and intellectual honesty requires full weight: on the multiple the market actually uses, Zscaler is cheap. The comp set is matched to security platforms.
| Company | EV/NTM sales | NTM growth | FCF margin | EV/S ÷ growth |
|---|---|---|---|---|
| Cloudflare (NET) | ~22x | 28% | 12% | 0.79 |
| CrowdStrike (CRWD) | ~18x | 22% | 30% | 0.82 |
| Palo Alto (PANW) | ~14x | 14% | 30% | 1.00 |
| Fortinet (FTNT) | ~9x | 11% | 30% | 0.82 |
| SentinelOne (S) | ~5x | 30% | 5% | 0.17 |
| Peer median | ~14x | 22% | 30% | — |
| Zscaler (ZS) | ~5.4x | ~19% | 23% | 0.28 |
Applying EV/Sales to ~$3.7B NTM revenue (net cash $1.84B, 161.7M shares): the current ~5.4x ≈ $134; a growth-justified ~9x (Fortinet level) implies ~$217, and a PANW-level 12x implies ~$286. Precedent M&A spans mature profitable security assets at ~7x revenue (Cisco/Splunk) up past 25x (CyberArk/Palo Alto) with the Wiz outlier far above — so at ~5.4x sales Zscaler is a cheap strategic asset, but a ~$22–28B takeout would be among the largest ever, making M&A optionality rather than a base case (floor ~7–10x sales ≈ $170–240).
On EV/Sales, Zscaler is cheap (~$170–217 on a modest re-rating). On re-adjusted owner FCF, it is expensive (~$68). Both are correct, because EV/Sales gives every name the same stock-comp pass. CrowdStrike at 18x and Palo Alto at 14x carry those multiples precisely because the market treats ~20–25%-of-revenue equity comp as non-cash. So Zscaler's "60% discount" means it is less expensive than an equally SBC-flattered peer set — a relative statement, not absolute value. The fork: if the market keeps valuing security platforms on revenue, the derate overshot and ZS re-rates toward $170–220; if it ever prices cash — as our DCF does — then "cheap versus peers" offers little protection, because the entire group de-rates together and Zscaler falls with CrowdStrike and Cloudflare. The call hinges not on ZS versus peers, but on whether the security-software complex as a whole is priced for cash or for revenue.
11 · Scenarios & probability weighting
The scenarios vary both the operational path and the SBC/multiple regime together, because in this name they are not separable. Each fair value is anchored on the DCF and the comps. These are regime-level outcomes: the $205 bull below is the revenue-multiple-regime bull (the market keeps valuing the group on sales and ZS re-rates), which is a different question from the DCF-only (owner-cash) bull of ~$107 in Section 9. They do not contradict each other — one prices revenue, the other prices cash.
| Parameter | Bear | Base | Bull |
|---|---|---|---|
| Revenue CAGR FY26E–30E | 10% | 14% | 18% |
| Terminal owner-FCF margin | 10% | 16% | 22% |
| Terminal growth | 3.0% | 3.5% | 4.0% |
| SBC / multiple regime | priced as cash; group de-rates | revenue multiple persists (~6x) | peer re-rating ~8–9x sales |
| Growth / net retention | NRR <110%; metered cyclical | as guided; NRR ~111–113% | 20%+ durable; NRR ≥115% |
| Fair value / share | $55 | $115 | $205 |
| Probability (ours) | 35% | 40% | 25% |
Holding the base at 40% and solving for the bull probability the $134 price embeds, the market is pricing roughly a 37% probability of the bull case, against our 25%. By the rule — if the market-implied bull probability exceeds our assessed probability, the stock is overvalued — Zscaler is overvalued, but only modestly. The 54% derate already wrung out the egregious premium; what remains is a ~13% overvaluation resting on a regime bet, not a 50%-downside short. The reverse DCF agrees independently: $134 implies a ~35% terminal owner-FCF margin, an outcome only the bull approaches.
The $55 bear is the compounding of organic ARR decelerating through the 16% FY27 guide into the low teens; net retention breaking below 110%; the metered/AI-usage line proving cyclical; the capex-driven depreciation ramp eating the S&M leverage; SBC staying sticky at ~25%; and — the trigger — the market pricing cash and de-rating the entire security complex, with a possible Red Canary / Symmetry goodwill impairment on top. The bear is not "Zscaler grows a bit slower"; it is "the things the quality-of-earnings work reversed are what the market eventually counts." And the reporting-risk asymmetry is live: a clean beat-and-raise is +20–30% toward base/bull, while another guide cut or a net-retention print below 110% is −20–40% toward bear. A single quarter can relocate the thesis.
12 · The sceptic's pass
We have argued Zscaler is modestly overvalued because its reported profitability and cash are a stock-comp artefact and its growth has structurally halved. Now we argue the other side at full strength, concede what lands, and let it re-point the thesis. The sceptic wins more than expected.
Where in the cycle. Zscaler is not an AI-infrastructure seller booking super-cycle revenue ahead of its costs; it is a buyer of the super-cycle, absorbing memory/processor inflation in rising capex. The genuine risk is the capex pull-forward into a decelerating-demand window — and we built it in, via the depreciation clock. But at ~9–11% of revenue, capex is a margin headwind, not an infrastructure-bust risk: there is no $10B of GPU capacity to impair.
Where in the value chain. This cuts hard against our caution. Zscaler sits at the enterprise-software layer, close to the end-customer, selling multi-year, contracted, non-discretionary security. A 10% wobble in IT spend does not become a 50% order collapse; ~11 months of deferred backlog dampens the swing. We concede: the downside is structurally gentler than a cyclical bear implies. The exception is the metered line — but it is a minority of the base.
Demand durability. The core ZIA/ZPA franchise is durable and rationally priced — non-discretionary security spend. The soft part is the AI-security narrative that justifies the growth premium. We concede the core is durable; the bear is narrower — the AI-security growth the multiple is paying for is the speculative slice. A re-pointing, not a refutation.
The accounting-scandal prior. Here the sceptical lens defuses the dramatic bear. When the tide goes out, Zscaler is not swimming naked; it is swimming in a heavy stock-comp coat. The repricing trigger is mundane, not fraud: the slow realisation that owner FCF is roughly zero and growth has halved, surfaced first in the annual net-retention print toward or below 110%, SBC still ~25% with no buyback, a Red Canary impairment, or decelerating deferred-revenue growth. A grind-lower risk, not a gap-down-on-revelation risk.
Cross-asset / regime consistency — the crux, and the weakest link in our caution. Our caution rests on the market eventually pricing cash — the security-software revenue-multiple regime cracking. That regime has persisted for a decade and buried shorts repeatedly. CrowdStrike at ~18x and Cloudflare at ~22x are the regime, today. If it holds, Zscaler at ~5.4x is simply cheap. We concede this is the soft centre of the caution: we have a valuation, not a catalyst. The partial defence is that the regime is already cracking at the margin — positive real rates, and Zscaler's own 54% derate as the laggard repriced first; the open question is whether it spreads to the leaders.
The sceptic lands four blows: low bullwhip (gentler downside), no accounting blow-up (grind not gap), a durable core, and — decisively — a regime bet with no catalyst. What survives: owner FCF is roughly zero, growth has structurally halved, the depreciation clock offsets the margin leverage, and even the DCF-only (owner-cash) bull case (~$107) sits below the price. The thesis re-points from "Avoid" to "Watchlist." The edge is not "sell Zscaler" — the easy short money left with the derate. The edge is patience: do not pay $134 for roughly zero owner cash and a halved growth rate when the same regime that makes it screen cheap could de-rate the entire group.
13 · Entry triggers, catalysts & risks
Because the thesis re-points to Watchlist, the operative question is what would make us a buyer, and what would tell us we are wrong first.
Entry triggers — none requiring the regime question to resolve. First, a pullback into the high-$90s / low-$100s (EV/NTM sales in the mid-3x to ~4x range) without ARR impairment — multiple compression that puts a margin of safety under the re-adjusted DCF, where base-to-bull ($68–107) then brackets the price. Second, organic re-acceleration — net-new ARR ex-Red Canary rising two quarters with net retention ≥114%. Third, an SBC inflection — stock comp below ~20% of revenue, or a buyback to offset dilution. Fourth, FCF-quality recovery — the FY27 capex ramp proving transitory so owner FCF turns durably positive.
Post-entry catalysts. An AI-agent-security inflection (the metered line crossing >15–20% of ARR); a buyback initiation against $1.84B net cash; the federal ramp on the DoW IL5 authorisation; GAAP operating profit turning positive (~FY27E); and a broad sector revenue-multiple re-rating, in which Zscaler has the most torque given its discount.
| Risk | Severity | Earliest warning to monitor |
|---|---|---|
| 1 · Market prices cash and de-rates the whole complex — "cheap vs peers" offers no protection when the group falls together. | High | Peer forward multiples; real yields; cyber-ETF de-rate |
| 2 · Growth below the FY27 guide with net retention under 110% — both levers compressing together. | High | Annual NRR print; organic net-new ARR ex-Red Canary |
| 3 · Competitive bundling in the adjacencies — Microsoft / Cisco / Palo Alto / Cloudflare compressing SASE/data-security pricing. | Med-High | Adjacency ARR growth; win-rates; pricing commentary |
| 4 · Capex / depreciation drag eating the S&M leverage. | Med-High | Capex % of revenue; capex–D&A gap; useful-life changes |
| 5 · Go-to-market disruption from the sales-leader exits. | Med | New-logo ARR; bookings; further departures |
| 6 · M&A misallocation — Red Canary / Symmetry goodwill impairment. | Med | Goodwill tests; ex-acquisition organic ARR |
| 7 · 2028 convert repayment consuming half the cash cushion. | Lower | Liquidity coverage; refinancing commentary |
| 8 · Single-quarter volatility — ±20–40% on a print. | Lower | Implied-move vs realised into prints |
Existential risk to the business is essentially nil: net cash, a durable non-discretionary core, no solvency exposure, no accounting-fraud profile. Every risk here is a valuation risk, not a viability risk — risks 1 and 2 collapse the gap from the ~$205 bull to the ~$55 bear, but the company keeps growing and self-funding. The equity can halve without the business breaking. That is precisely why the stance is Watchlist and the expression is structured to harvest volatility rather than bet on impairment. We rate Zscaler at Watchlist, medium conviction, and would turn constructive on a move into the $90s without ARR impairment, or on organic re-acceleration with net retention back to ≥114%.
14 · Consistency review
The lenses reconcile rather than contradict. The reverse DCF shows $134 implies a ~35% terminal owner-FCF margin — an outcome only the bull approaches; the scenario reverse shows the price embeds a ~37% bull probability versus our 25%. Both agree the market prices a bull-tilted outcome we assign materially lower odds. The DCF base ($68) and the scenario base ($115) are deliberately different, not inconsistent: the DCF base is the intrinsic value of owner cash flow with SBC as a cash cost (regime-independent), while the scenario base layers in the regime assumption that the market keeps valuing on revenue at a compressed multiple — the ~$47 difference is the capitalised value of the stock-comp/regime question, the same wedge that runs through the whole report. Shared inputs tie across sections on a single market-data base: ~$134 price; 161.7M shares; net cash $1,839.5M; market cap ~$21.7bn; EV ~$19.8bn; EV/NTM sales ~5.4x; WACC ~10%; FY26E revenue $3,330M; FY26E re-adjusted operating income ≈ −$50M (the −1.5% GAAP margin); SBC FY26E $799M. The probability-weighted fair value (~$117) sits below the price (~$134), consistent with the Watchlist conclusion. The DCF, comps and scenario lenses reconcile conceptually — read against the figures above — and their divergence is itself the thesis (cash versus revenue regime), not an error.