All right, thank you all for being here. I'm Roger Boyd. I cover cybersecurity here at UBS. Very happy to have the team from Zscaler here, Jay Chaudhry, CEO, Chairman, and Co-Founder, and Remo Canessa, Chief Financial Officer. So thank you, gentlemen, both for being here directly after earnings last night.
Thank you.
Thank you.
Maybe just to start on that, pretty good results last night. Maybe we could recap some of the highlights you saw from the quarter. A number of strengths, but if you had to distill it down into a few, what really stood out to you in the first quarter here?
I think to me, at the highest level, beating all metrics for us was a big deal. In today's environment, very few companies are able to do that. Remo, you can talk the specifics.
Yeah. I mean, it was a great quarter for us. If you take a look at the, you know, top-line billing, growth rate was 34% year-over-year. Short-term billing, 33%, revenue growth, 40%. Then you go the next layer down, which is our operating profitability. We've always said is, you know, in a SaaS model with high gross margins, you have a lot of leverage, and we're able to show that leverage with 18%, you know, operating profitability. Free cash flow margin, 45% of revenue, which is a record for us. You know, our expectations for free cash flow going forward, low 20%s, but higher than what it was last year.
But also, we're having a large data center purchase, you know, primarily for AI, AI capabilities, which will add 3%-4%, basically increased cost. The, you know, Federal was very strong for us in the quarter also, 90% growth year-over-year. Record pipeline generation in the quarter. Customer engagements are strong. You know, just all in all, just a very, very strong quarter for us from a, you know, just from running the business perspective. And in addition, I'll let you know, Jay, talk about two additions we hired, or he hired in the quarter.
Yeah. I think before I go there, our focus still is on growth rather than bottom line. Our operating profitability was high, cash flow was high, but then, then I was internally joking and say, "We didn't invest enough. We should invest more." So keep in mind, growth, number one, bottom line, two. Remo and I both work very well to balance the two together, okay? Regarding adding more strength to our leadership, you know, every company go through stages of growth, and you need to make sure you are having the right leaders at the right level, type of stuff. On marketing, we had changed CMO several months ago. We knew someone who take us next level, so there's an active search going on. And generally, I don't believe in hiring someone unless you feel really excited about it.
I would rather have the, this thing open, staring at you than kind of filling the slot. So CMO has come together very, very nicely. On the CRO side, about 8-10 months ago, Dali and I started again, we say, "Let's hire a CRO." That also gives Dali more opportunity to focus on the COO functions, where we need to scale our operational capabilities as your business grows. You know, when you grow like we have grown, going from $1 billion to $2 billion in seven quarters, you put things in place. You fix two things, you break two things. That's what happens in hypergrowth. So a lot of efficiency, streamlining needs to be done.
So having Dali focus on that part has been a part of the process of bringing CRO on board, and we wanted someone who has seen the scale, done it. And as we found Mike, who took ServiceNow, he was there from $80 million- $8.5 billion. He ran Americas for them, which is approximately 70% of the total business. And our sales processes, how we deal with the market, we target large enterprises, how we sell to CXOs, concentrated sales are all aligned with us, so it became a wonderful thing. So we think these two leaders position us to take from $2 billion- $5 billion and beyond. That, we are excited about that.
Very exciting hires. I think one of the footnotes to the reiterated fiscal 2024 guide was that you're expecting some level of disruption on a go-to-market standpoint from Mike coming on board. Remo, can you just talk, or Jay, just talk about how that's layered into the model, and he's obviously going to have a team that he wants to bring on. But if you think about the impacts to the model, is that mostly a fiscal Q2 question, or could we see this kind of impact the latter part of the year?
The first word, disruption.
Okay.
Is too strong of a term. We've—I think we believe we brought in a leader who's aligned with our sales process and all to start with, okay? So he doesn't have a—he's not coming to plan and say, "I'm going to reorganize the whole thing." Okay. None of that. There are no big changes expected, okay? Now, any time you have a new leader come in place, you need to give them some breathing room, some room to... There are always things to adjust and understand. So it was essentially keeping that in mind for new leader to succeed, rather than kind of, "Hey, here, the target's up there." That's really part of the adjustment. This adjustment doesn't indicate any change in competitive landscape or any change in the macro environment per se.
It's just being the right and prudent thing to do. We feel good about the business. The pipeline is strong. All, all things are strong. It's our job. The primary job is to make sure we move from this stage to next stage to get us ready for the longer term without really having any negative impact. And that's our job as a management team to maneuver through it.
We have a world-class sales organization, you know, that is in place, number one. All we're trying to do is create prudence, you know, related to our guidance. Just because when you do have sales changes, you know, there could be, you know, some changes or disruption along the way. As Jay mentioned, we're not expecting that at all, but it could happen. So that's the reason for our prudence with our guidance.
Very, very helpful clarification. Maybe to zoom out, Jay, the threat environment continues to evolve. We've seen ransomware evolve into double extortion ransomware, and now ransomware where they'll file SEC reports or SEC complaints for you. I think all of it's kind of highlighting the shortcomings of overly flat networks.
Yes.
I guess the question is: How does this show up in your pipeline demand for your products? Frankly, you called out a hospitality win this quarter, where it sounds like a breach-specific breach environment very clearly helped accelerate deal timing.
Yes. So if you listen to our earnings call for the last year or so, I've been talking about two big drivers that are driving our pipeline in spite of the tougher conditions. Cyber has been one, drive for cost savings has been two. Because of these MGM and Caesars kind of stuff, and combined with SEC reporting requirements, then on top of that, SEC suing SolarWinds and the CISO personally, it has kind of turbocharged the cyber need. The demand is certainly being boosted by that significantly. I'll give you an example. After the casino things happened, we had so many inbound calls coming from CIOs, CISOs, largely our customers, they're friends. We have very good, tight relationship with the CISO and CIO communities. They're coming in. In fact, I ended up doing a special briefing, ransomware briefing, to our customers.
One of the fascinating things was I sent personally about 400 emails for doing three sessions, one for Americas, one for MEA, and one for APJ. I never expected that, about 250 people signed up out of 400. Wow! About 200 of them attended those three sessions. It's just an indication of the degree of interest. It is, it's fueling interest. It's also showing the fact that all of these customers are basically seeing, "I'm putting so much money in these firewalls and VPNs." They're all finally beginning to understand that once you're on the network, you can go wherever you want to go. That's how ransomware attacks happen, and which is what we fix. We don't put you on the network like firewalls and VPNs. They're like a switchboard.
It is helping grow our pipeline, and then we have to do still work hard to close business. Now, business closing require two things. One, C-level engagement is important. Now, we are doing it sooner than we used to do. We have more C-level engagement than we used to do 18 months ago. And then having Business Value Assessment. Our CFO- ready studies that are important. We do both of them. Those two help us close deals, and the previous two help us build pipeline.
Makes sense. Last night you noted that the demand environment is starting to stabilize. I think part of it is everything that's going on in the threat environment. Probably a little bit nuanced to get after. From a budget environment standpoint, what are you seeing in terms of sales cycles, budget scrutiny? Do you feel like we've hit a trough there, and a s the threat environment continues to remain difficult, or are we gonna see some improvement going forward?
So I haven't met a CIO or CISO who said, "I'm reducing my cyber budget." Okay? None whatsoever. Budgets are going up. One of the change I'm seeing now is, a year ago, CISO cared about cyber very much. CIO had interest in cyber. Okay, now CIO is equally interested in cyber as CISO was. And with SEC reporting and SEC lawsuit, every board member is actually very interested in cyber, far more than they used to be. So budget availability is not an issue. Now, they're all trying to figure out: Where do you spend money? There are thousands of cyber vendors. I think since we are instrumental in eliminating lateral threat movement, knowing that there'll be some compromise because of social engineering and whatnot, people will click on something.
There'll be a beautiful phishing email, which will look like an email coming from your CFO or CEO. You're going to open it, and you're going to get infected. That's bound to happen somewhere. Once that infected machine is on network, things move laterally. Since we play an important role in that area, we end up being at, getting a seat on the table to, to really engage. That's helping us. But still, the scrutiny is there. Deal scrutiny hasn't gone away. They want to make sure they're getting proper money, for the investment. Proper, sorry, value for the investment they're making. But it's a, it's a good environment. It's, it's a similar environment from macro point of view, but if we execute right the way we have, then it works.
Yeah. Remo, on your side, it sounds like no change to what's embedded in the guidance as it relates to the macro environment.
That's correct. No change.
Okay. The last two years have been remarkably strong for the firewall market. It seems like that's slowing down a little bit now, and some of those vendors are leaning into the security edge, the SASE space.
Everyone's becoming SASE overnight.
Right. Right.
Right.
I feel like we've been talking about the decline and the relevancy of the firewall since basically the IPO. Do you think that past these two years of high demand for firewall, do things start to look a little slower from here on out? And how do you think that impacts budgets, interest levels, projects, base demand?
Yeah. You know, inertia is a powerful thing. It keeps on running things till certain things happen. We are seeing a meaningful shift in the firewall area. I'll tell you where and why and how. These are my views on what I see with customers and whatnot out there. When you have Zscaler customers, they do local breakout, stuff happens, and there's less traffic going to data centers. And some of these guys have been removing firewalls at branch, others have still kept firewalls because they don't know quite what else to do. They have been pushing us to say, "Give me some kind of solution at the branch." We offer them a piece of software they can deploy and eliminate firewalls and all that stuff.
But they kind of said, "You know, this software I deploy, manage, monitor, I need something better and easier." So we launched a plug-and-play appliance, which takes a small piece of software we call Branch Connector, which eliminates the need for firewall, all that stuff. It's a way to send traffic to a cloud. That's the solution we launched a few months ago. There's tons of demand for it. All of our customers are saying, "I will actually go to your advocacy of my branch becomes just like Starbucks, like a coffee cafe." I think it's a matter of time when almost all branches will go away from firewall. It's a very clear signal. Our customers are certainly headed in that direction. That's accelerating, will accelerate with the launch of our plug-and-play appliance. The second part, the big part of revenue is not coming from branch.
The big part of firewall revenue is coming from data centers. It is funny how things play out, inertia. I have a typical conversation these days with almost every CIO. It's part of my talk track. "What percent of your applications have you moved to the cloud?" "40%, 50%, 60%, that's the number." I say, "Oh, 60% moved. You only have 40% application at data center." They say, "Yes, we've done a good job." I said, "That means you probably aren't buying or upgrading any routers, switches, firewalls, load balancers in your data center, right?" Typical answer, "I wish that was true." "So you're still upgrading. Why?" "Well, because traffic is still flowing through my data center to public cloud." Why? Because that's the natural, traditional way of doing it. Now, what's Zscaler way?
Every user, every branch, directly over the Internet, talks to cloud applications. And then they say, "Oh, oh, that can be done." All that stuff is moving. As long as traffic flew through the data center, you needed devices to process that traffic. We see not only impact of this thing on the firewall, we see it impacting load balancers, routers, switches market as well. Because once you go direct to the cloud, they're not going to... That market is very different. The market of data center firewall does not directly translate into market in the cloud. Market for routers in data center doesn't directly translate into market for Cisco in the cloud. In the cloud, you end up getting your software-defined routers, you end up getting cheaper firewalls, Azure, and all the stuff out there.
So I do think firewalls will be there for a while, but they'll become like mainframes. And we, as we push for the market, we will make a dent. Now, we have become fairly significant. Five to seven years ago, 100% growth didn't matter. Going from $100 million- $200 million, well, it was tiny thing. Now, as we go from $2 billion-$4 billion and $5 billion, I think it's making a dent.
Maybe keeping on the competitive environment for a second. All these new entrants to the market or, or not new entrants, but greater emphasis, a lot has been made of Microsoft entering into the market. Looking past architecture, how do you think about the competitive environment, specifically as it relates to the trust that you've built up with enterprise customers and the amount of effort and time it takes to run a solution like yourselves at scale? 'Cause when you talk to enterprise customers, reliability, Five Nines availability, that's what truly matters. And it, it's... How do you assess the competitive environment of these new entrants to-
Yep.
to reach that credibility?
Yeah, you know, I'll, I'll mention it, two things. Number one, to sit in line like a switchboard, inspect everything without slowing things down, and catch all the bad stuff, make sure good stuff doesn't leak out, is not a trivial task. It's a proxy architecture. Unless done right, it slows things down. That's what we have built. But running a cloud of scale with 360 billion transactions a day, just a data point, Google searches add up to only 10 billion a day in the searches. Dealing with 36x as much traffic as Google searches to handle all the stuff, running, managing cloud is much, much bigger task than even I expected when I started the company. There are lots of scars over the years, learned about how do you run the cloud, because it's mission-critical, so it takes time.
The second point, the criticality of application. There's a funny dialogue with a CIO last year. He said, “Jay, congratulations, you have been selected. Zscaler has been really selected as one of our five strategic vendors, and I had to fight hard to get you in there.” I said, “Why?” He said, “The threshold to be a strategic vendor in our company is about $50 million, and we spend only a few million dollars per year with you.”... And so I don't know if you need to feel good or bad about it, but that's how it is. The point is, in most of my large customers, we get viewed as a very strategic vendor in the top three, top four, top five. As one CIO said, “I am more dependent upon you than Microsoft. If Microsoft is down, Office or Azure is impacted.”
If you are down, nothing works." Okay? It just highlights the importance of this service being so mission-critical. So some of the customers I talked to recently, one guy said, "Yes, there's a private company trying to tout everything you do at a third of the price." So my worry is, huh, would they be here for buying what we sell? They don't want the cheapest stuff. They need something that works, they're reliable and whatnot, and that's really what we bring to the table. And the credibility, the brand we have established, the reputation we've built is very good. It's taken time for us. I think I'm less worried about competition. I'm more focused on how do I keep on innovating and using our solution to solve customers' problems, where these customers save money and they deliver better user experience. And we're doing good job.
You've seen the expansion of the platform. Also, one of the things we do is we don't try to force-fit solution. Firewall, try to spin it as Zero Trust. We built our core architecture for users. Now, we have taken it to workload. It's the same thing. ZIA for users, now there's ZPA for users. ZPA for users, there's a—Sorry, ZPA for workloads. Workloads, IoT, OT, BoT, this expansive, expansive market opportunity for us. And our focus will remain, keep on building it and make sure go-to-market execution happens very well. That's why you're seeing some of the additional leadership team we brought in.
Makes sense. You evolved your own strategy this year with the introduction of the hardware Branch Connector, and our initial conversation with customers suggests that it's being very positively received. And even relative to the software Branch Connector you launched a year ago,
That was so, so. They said, "Hey, I had to work hard to make it work.
Yeah.
Make it... Yeah.
Well, no, I think that's exactly it. It's that it truly creates plug-and-play branch connectivity.
Yeah.
So I'd love to get your perspective on any other anecdotes you can share about the reception of that and really, like, who you see that being sold to, relative to the whole SD-WAN cycle?
Yeah. So with Branch Connector, you do not need any SD-WAN, okay? SD-WAN has been helpful to reduce cost, it has been helpful to reduce the operational overhead, but SD-WAN enables lateral threat movement. That's the number one thing that ransomware guys exploit. So there's a need for it. Also, SD-WAN still has to do route table management, all this stuff. Branch, our branch solution requires nothing on that. It's literally branches like your home, it's Starbucks. So tremendous interest, but every new product, it takes some quarters before it really starts getting through the kinks, adoption, all that stuff. So I think in fiscal 2024, we're going to land and do reasonable business. Fiscal 2025, we think we'll see some big adoption in there. But every customer I have talked to, they feel like, "This is my dream solution." There's zero pushback.
Now, there may be some pushback from some networking guys who say, "I've been Cisco certified for 30 years." But overall, it's very, very exciting.
Yeah. And Remo, just on your side, Zscaler is not a hardware company. How should we expect the Branch Connector to show up in the financial model?
Yeah. It, it'll be a subscription-based, you know, basically, sell for us. It'll be based on, you know, traffic volume, y ou know, by location. So anything outside a user, you know, like printers, cameras, and things like that, will go through our Branch Connector.
But, but also, if you look at it, sitting over $2 billion in ARR, this thing is starting from zero. The amount of stuff, the margin implication, I think, will be negligible.
Makes sense. Jay, you've talked about the 6x upsell opportunity you have in the install base, I think just on the user solution side. Do you feel that investors are fully appreciating that runway? And as you think about unlocking that, you have a new CRO, the new CMO coming on board, is there anything that you think you need to do fundamentally different to help your existing install base expand even further?
Yeah. I think one of the big thing we will do, we have been focused on upselling, but ServiceNow has done something remarkably well on top accounts. Their top accounts process and programs to really upsell have been very amazing. We've done a number of those, but I want to take it at scale to top X hundred customers. Imagine if I could take ARR of my large customer from $3 million- $6 million or $9 million kind of numbers. Those are real opportunities for us to take advantage of. There is no lack of products for us to sell. It's, it-- What makes it hard is, the harder, the bigger the platform, it makes it a little bit harder for salespeople because they need to understand, position it all the way. So we are essentially evolving where we have people... We have told you, we have CXOs.
These are former CIO, CISO type, who are part of the team to help position via architects. We also have some people in the, what we call the takeoff team, who are specialists in certain product areas. These are natural evolution that have to take place, and that's the process that we are doing. Our pre-sales process is not simple. Here's an SC, here's a sales rep, let's go and do it. But we are—we have shown success. If you asked me when we went for IPO, we had ZIA, with ZPA was just coming out. ZIA was largely even the business bundle. We've shown how we can embrace, evolve the platform and sell it successfully. About half of our new logos, I think it was new logo this quarter, came from what we call Zscaler for Users bundle.
Zscaler for Users bundle combines ZIA, ZPA, ZDX, all three things together. We have felt that every customers we have, every user should have those. We are getting there. That's the platform expansion. The data protection on top of that is a massive opportunity for us. We think we are clicking into data protections. If you ask me, where are the big product areas for growth? Zscaler for Users, which takes everything. I have a large install base that's still only ZIA. ZPA is sitting somewhere in the 60% penetration large customers. But then ZDX, Zscaler for Users, is an upsell opportunity for not new- for existing customers and then new logo for others. That's one. Data protection is sizable. I think we, we said it was approaching $250 million. That was end of Q4. I haven't looked at the math after end of Q1.
It may have exceeded, has it? Okay, Bill, Bill said the number, it has exceeded $250 million. That's good. The third is emerging products. Emerging products, the workload communication side of it, the new products coming, the Risk360 side of it. I think it's a good opportunity. Then we haven't even talked about AI/ML products. I briefly touched during the earnings call. AI/ML, we are adding. AI/ML is not, you shouldn't think of a market and product by itself. AI/ML has to be embedded in everything. It's like if somebody said, "I'm an Internet company," 20 years ago. What do you mean Internet company? Every company is Internet. Everything will have AI/ML. So we're bundling some of the feature enhancements, our current bundles. We are creating bundles called we had Zscaler Advanced, now we call it Advanced Plus.
The Plus includes functionality that's empowered, that's powered by AI/ML. So it can give us about 20% more. That's one area. Risk360 is fully powered by AI/ML, and we got new products we're working on. We hired some very, very powerful people who come from AI/ML background, and they recently come on board in the past month or two. We are making some significant investments in, in our data cloud, taking all the logs we have. Every company will tell you about AI/ML. Every company has to, because without that, there's no future. But number one thing for AI/ML is data. If you don't have good data, you can't do AI/ML because it's all about training. Now, ChatGPT was able to train on world's open data. Any data that's out there, they're training on it.
The most thing for them was the amount of GPUs needed to train on world data is so expensive, so massive. That's why only Microsoft and some of these folks could do it. But for us, I don't care about public data. That's a piece of it. I care about the private data of logs, of communication, of all employees, workloads, talking to each other. That's the most important log data to train AI/ML, large language models, and the like. We have that. Now we are building our infrastructure to be able to take full advantage of it for training and the like. So I'm very bullish about what we will be bringing to the market in terms of AI/ML.
Got it. I think that's, that's about it for us. Thank you, gentlemen, both for being here. Great session, and thank you all for joining this morning, and-
Thank you.