Initial Report: Zscaler (NASDAQ:ZS), 102% 2-yr Potential Upside (SIM Ru Xue, SC VIP)

SIM Ru Xue presents a "BUY" recommendation based on Zscaler's product leadership, revenue growth outperformance and dirt cheap valuation.

Apr 13, 2025

Introduction

I am initiating coverage on Zscaler, Inc. (NASDAQ: ZS) with a Buy recommendation and a two-year price target of $393, implying a 102% upside from the March 10, 2025, closing price of $194.69 (equivalent to a 41% IRR). Zscaler stands at the forefront of the cybersecurity landscape, leveraging its cloud-native Zero Trust Exchange to redefine secure access in an increasingly distributed digital ecosystem. Despite its consistent outperformance in revenue growth and product leadership within the Secure Access Service Edge (SASE) category, the market has undervalued Zscaler, treating it as a mature, slower-growth player akin to legacy peers. I believe this mispricing presents a compelling opportunity, as Zscaler’s durable growth trajectory and operational efficiencies are poised to drive significant shareholder value through 2026.

Business overview

The cybersecurity industry, a $200 billion-plus market, remains one of the most dynamic and fragmented subsectors within technology, driven by relentless innovation and an ever-evolving threat landscape (Appendix A – Nikesh Arora). Within this ecosystem, the Data & Network Security segment—Zscaler’s core focus—represents the largest total addressable market (TAM) (Appendix B – Sanjay Beri), fuelled by enterprises’ urgent need to secure cloud and hybrid environments. The rise of Secure Access Service Edge (SASE) solutions marks a paradigm shift, blending networking and security into a unified, cloud-delivered architecture that is rapidly displacing traditional hardware-based firewalls and VPNs.

What is Zscaler’s value proposition?

Zscaler’s Zero Trust Exchange, a leading offering in the SASE category, integrates networking and security into a single, cloud-native platform, offering a stark contrast to legacy cybersecurity architectures.

Traditional systems route user traffic from branch offices through VPNs or MPLS to on-premises data centres, where security policies are applied before forwarding data to the internet or cloud applications—a process that reverses for return traffic. This approach is inefficient and vulnerable: it incurs high operational complexity and costs, struggles to contain lateral ransomware movement (even with added east-west firewalls), and creates performance bottlenecks as traffic funnels through centralized infrastructure. (Appendix C)

In contrast, Zscaler’s Zero Trust Exchange enables direct, secure connections between users and applications via its global cloud platform, where all security policies are enforced. This architecture eliminates the need for costly VPN management, reduces attack surfaces by scrutinizing every traffic flow, and delivers faster, more reliable access to internet and cloud resources. By simplifying enterprise security while enhancing performance and resilience, Zscaler addresses the demands of modern, distributed workforces—a value proposition that legacy hardware-dependent solutions cannot replicate. As a result, Zscaler is not just competing in the SASE space; it is defining it.

What about competitors?

The SASE market, fuelled by the “Zero Trust” trend, is attracting intense competition as leading cybersecurity firms race to capitalize on its rapid adoption within the Data & Network Security segment. Palo Alto Networks reported 54% annual SASE revenue growth from FY22 to FY24, while Fortinet’s SASE segment grew 27.9% in FY24, outpacing its total revenue growth of 17.3%. These figures underscore SASE’s momentum as it erodes share from traditional firewalls and VPNs. However, Zscaler’s competitors—many of whom, like Palo Alto Networks and Fortinet, built their foundations on hardware-based solutions—face a structural disadvantage. Legacy products still generate significant revenue for these firms, and their shift to SASE risks cannibalizing these established lines, diluting overall growth. For instance, while Palo Alto Networks’ SASE growth is impressive, its legacy firewall business tempers total revenue expansion (Appendix D – Palo Alto NGS vs Legacy ARR).

Zscaler, by contrast, operates as a pure-play SASE provider, free from legacy baggage. Its Zero Trust Exchange is widely regarded as a best-in-class solution, blending scalability, security, and user experience in a way that hybrid competitors struggle to match. While larger players leverage acquisitions to bolster their SASE offerings, Zscaler’s organic, cloud-native focus provides a cohesive edge, avoiding the integration challenges that can plague “platformized” portfolios. In a market rewarding specialization and execution, Zscaler’s unencumbered model positions it to outpace its rivals and capture a premium share of the SASE opportunity.

A Fragmented Cybersecurity Industry

The cybersecurity sector remains one of the most fragmented subsegments within technology, a byproduct of rapid innovation driven by an unrelenting pace of new threats. This fragmentation manifests in specialized point solutions, with each subsegment—such as endpoint security, identity management, or network protection—dominated by two to three best-in-class providers. Large enterprises often stitch together 15-20 independent vendors to address their full spectrum of needs, creating complexity and inefficiency. However, the industry is now shifting toward “platformization,” as described by Palo Alto Networks CEO Nikesh Arora, where larger players consolidate these point solutions through acquisitions. This trend enables comprehensive, unified offerings, allowing customers to streamline vendor relationships and reduce operational friction (Appendix E – Mad Money).

In this consolidating landscape, scale is a critical differentiator. Companies with robust balance sheets can sustain heavy investment in R&D and strategic M&A, ensuring their portfolios remain cutting-edge and relevant. As the industry rewards scale and cohesion, Zscaler’s position as a nimble, cloud-native leader enhances its ability to thrive amid fragmentation and consolidation alike.

Financial Performance & Stock Price Movement

Zscaler has demonstrated resilient financial performance, even amidst shifting macroeconomic conditions. During and post-pandemic, the company posted exceptional revenue growth of 40-60% year-over-year, fuelled by surging demand for its cloud-native cybersecurity solutions. However, tighter enterprise budgets since mid-2022 have moderated this pace, though Zscaler continues to rank in the top decile of growth among cybersecurity peers, alongside high-flyers like CrowdStrike and Cloudflare.

Despite this operational strength, Zscaler’s stock has underperformed its peers over the past five years, delivering a 97% return from March 2020 to March 10, 2025, compared to CrowdStrike’s 243%—the next lowest among top-tier cybersecurity names. This divergence stems from a multiple compression in 2022, when market sentiment soured on high-growth tech amid rising interest rates and IT spending caution. Since then, Zscaler’s price-to-sales (P/S) multiple has stabilized alongside mature peers like Palo Alto Networks and Fortinet, trading at 10.8x as of March 10, 2025—below the security industry average of 12.9x—while faster-growing names like CrowdStrike and Cloudflare command premium multiples. I view this as a market anomaly: Zscaler’s growth profile and SASE leadership warrant a rerating, particularly as economic recovery and enterprise cloud adoption accelerate into 2026.

Investment Thesis

An expansive market opportunity, being on the right side of change

The Secure Access Service Edge (SASE) market represents a significant growth opportunity within network security. Palo Alto Networks’ CEO, Nikesh Arora, has estimated that ~80% of enterprises have yet to adopt SASE solutions (Appendix F), signalling a vast untapped market. Zscaler, a SASE pioneer, pegs its TAM at $96 billion, dwarfing its current annual recurring revenue (ARR) of $2.7 billion (as of its latest reported quarter, likely Q2 FY2025 ending January 31, 2025). This implies a market penetration of just ~2.8%, underscoring significant runway for growth.

Comparatively:

Zscaler serves ~45% of Fortune 500 and ~35% of Global 2000 companies.
Fortinet, a legacy firewall leader, claims a higher penetration at 72% of Global 2000 companies, but its reliance on traditional hardware leaves it vulnerable to SASE disruption.

As enterprises shift from on-premises firewalls to cloud-centric security, Zscaler is well-positioned to capture share from both competitors and greenfield SASE adopters.

Increased sales efficiency from optimized customer base – “land and expand”

Zscaler’s “land and expand” model is yielding results. In its most recent quarter, ~66% of revenue growth came from upselling existing customers, which requires less sales effort than acquiring new logos. As Zscaler’s customer base grows—now exceeding 8,650 customers per Q2 FY2025—this upsell opportunity expands, boosting sales efficiency (Appendix G). Historically, sales and marketing (S&M) expenses consumed 60-70% of revenue, but recent trends show this converging toward industry norms (e.g., 40-50% for peers like CrowdStrike).

Seeing the fruits of improved customer mix – Net Retention Rate reversal

Zscaler’s net dollar retention (NDR) rate improved to 115% in the latest quarter (up from 114%), reversing prior declines. This uptick reflects:

Strong upselling, with $1M+ ARR customers growing faster than $100K+ ARR customers.
Product superiority weathering macro headwinds (e.g., tight IT budgets in 2023-2024).

Competitors like Fortinet and Palo Alto Networks have issued cautious guidance, citing elongated sales cycles, while Zscaler’s execution stands out. An easing of IT budget constraints could further accelerate growth in H2 FY2025 and beyond.

Sales performance in management’s focus

Zscaler’s S&M expense has historically outpaced peers (65% vs. CrowdStrike’s 35-40%), reflecting its land-grab strategy. However, management is addressing this inefficiency. The 2023 hiring of Mike Rich (ex-ServiceNow) as Chief Revenue Officer signals a shift toward disciplined growth. S&M as a percentage of revenue is declining—likely approaching 45-50% in FY2025—while revenue growth remains robust at 23% YoY.

2026 catalyst - time to hunt

Fortinet, a firewall heavyweight, expects ~25% of its installed base to reach end-of-life in 2026. This creates a $5-7 billion opportunity (assuming Fortinet’s $20-25 billion firewall base) for Zscaler to convert legacy customers to its SASE platform. Management anticipates revenue acceleration in H2 FY2025, but 2026 could mark an inflection point as sales reps target these renewals.

The CEO’s alignment with shareholders

CEO Jay Chaudhary, a five-time cybersecurity founder, owns 17.5% of Zscaler—far exceeding Fortinet’s Ken Xie (7.9%) and Palo Alto’s Nikesh Arora (<0.2%). This skin-in-the-game aligns his interests with shareholders, enhancing Zscaler’s resilience against competitive and macro pressures. High insider ownership reduces agency risk and supports bold strategic moves (e.g., R&D investment, sales optimization). Chaudhary’s track record—selling two prior ventures to Cisco and McAfee—adds credibility to Zscaler’s staying power.

Trading below peers despite industry leading growth

Despite 23% YoY growth—outpacing Fortinet and Palo Alto—Zscaler trades at a Price/Sales multiple of ~13x, in line with slower-growing peers. With an 8-10% growth premium, Zscaler merits a premium valuation.

Why Does This Investment Opportunity Exist?

I believe the market has mispriced Zscaler, erroneously categorizing it as a mature, slow-growth entity within the cybersecurity sector. This misperception has created an attractive entry point, as I anticipate a rerating of the stock driven by Zscaler’s sustained growth momentum through 2026.

Assumptions and Valuation

My revenue projections are anchored in Zscaler’s historical growth drivers—namely, increasing spend per customer and steady customer acquisition—augmented by a modest uptick in 2026 tied to broader market tailwinds, including competitive displacement opportunities. Specifically, I model revenue growth of 22% in FY25E, aligning with management guidance and consensus estimates, accelerating to 32% in FY26E as the company capitalizes on a Fortinet refresh cycle, before moderating to 24% in FY27E as the growth trajectory normalizes. These assumptions reflect Zscaler’s ability to deepen wallet share within its existing customer base while expanding its footprint among large enterprises.

A large driver of profitability and free cash flow generation comes from improved sales and marketing expense. In Q2’25, S&M expenses represented 48% of revenue—a testament to disciplined compensation structures and improving sales productivity. However, I anticipate management will strategically increase sales investments into 2026 to capture market share, modelling S&M at 49% of revenue for FY25E.

For valuation, I rely on Price-to-Free Cash Flow (P/FCF) as the most relevant metric, given its strong historical correlation with Zscaler’s stock price performance and its focus on tangible cash generation—a key consideration for growth-oriented investors. I assign a 45x multiple to current FCF, justified by Zscaler’s superior growth profile and margin expansion potential relative to peers. Looking forward, I apply a 35x multiple to FY27E FCF, a slight premium to the 30-33x range at which Palo Alto Networks has historically traded, reflecting Zscaler’s longer growth runway and leadership in the Zero Trust segment. This methodology yields a target price of $393 until FY26E, implying a 2-year upside of 102% from the last traded price of $194.69 (March 10, 2025).

Check out my simple model for Zscaler