By the way, there's still spaces here in the front if you wanna. Steve House, welcome. First of all, I think it's the first time I'm hosting you for one of these sessions, and, Remo, I've hosted you many times. We have a lot of cybersecurity companies today, and maybe before we start, Steve, just before, because it's the first time you're here at our conference, maybe you can present yourself and your position, and then, I'll, I'll start with the questions.
Thanks. All right. Excellent, good morning, everyone. Steve House. I'm the Senior Vice President of Product Management at Zscaler. I've been at Zscaler almost nine years. Prior to Zscaler, I was the VP of Product Management at Blue Coat Systems, was there seven years running all their core appliance product lines. I got there when they acquired a company called Packeteer. I ran the product management team for Packeteer. I was there six years.
Excellent. Thanks. So I wanna start from the last quarter and then go back, basically, and maybe Remo. You outperformed billing significantly last quarter. You grew 30%. We expected 21%, and you... The performance was so much better than expectations that the question is, what is happening in the underlying market? Many worried about newcomers, Cisco and Fortinet, et cetera. On the other hand, your performance was phenomenal. So how do you describe the competitive landscape, what you're hearing from customers about competition, et cetera?
I'll start and then turn it over to Steve. I mean, from our perspective, you know, from a win weight, win rate perspective, you know, we really win rates with Zscaler. I think, you know, we're perfectly, perfectly positioned, you know, in this market with our platform, that we've, you take a look at our, you know, customer base, we have 40% of the Fortune 500 companies, over 30% of the Global 2000. You know, Zero Trust, SASE, we're perfectly positioned for it. From a, you know, outperformance perspective in, in Q3, it was an outstanding quarter. As you mentioned, you know, we beat our, you know, consensus numbers, and we're also going through a transition right now in our go-to-market. We hired, Mike Rich from ServiceNow, back in November. Take a look at our Q3.
Q3 is, you know, he's hired his entire leadership team, and his leadership team is. So the focus basically in Q3 was to really build that leadership, and then once you build the leadership, then you can go out, basically hire your best. The comment that I made on the earnings call is that through May, so the first month of the fourth quarter, we hired comparable, the same amount of outside in Q3. I think going through that transition, showing the strength of Zscaler and our platform, it's a transition quarter, though, and so and we, our attrition in Q3 was higher than our expectation. So the comment we made on the call calls for fiscal 2025, we expect, you know, 2%-3% or a few point headwind, basically, you know, on the billings growth.
The reason for that is, the higher than expected, you know, attrition in Q3, and as you're getting new leadership in, and as those account reps ramp, which takes, you know, our expectation is they ramp in a year, that's gonna cause the headwind. From my perspective, though, the market is huge. You know, if you take a look at what we go after, you know, our we go after, it's the customers with greater than 2,000 employees. There's about 20,000 customers like that, you know, of, of that size on a worldwide basis. Our penetration in that, a huge opportunity to go after new accounts. In addition, you take a look at what we have, the ability to sell to our existing customers.
It's an opportunity to upsell just on the user side, not the workload, not the other, you know, products that we're selling, just on the user side. So and that's what basically the, you know, one of the companies that we emulate is ServiceNow, which they get deeper into the accounts and sell more. So basically going from an opportunity to basically an account sell. So basically that account sell, we get the, you know, the, the change basically in the type of reps who sell deeper in the accounts, and that's basically tall. It's a strong, strong company. Significant need for our type of security that we have. We're going through a transition, which is we're positioned very well going forward, you know, with the changes in the market, and we feel good about things. And Steve, any other further comments?
Yeah, the only thing I'll piggyback on, and we have broadened our platform in a way that it's not just about the Zero Trust for users or Zscaler for users, but as we're selling more to protect workloads. Last quarter, we had our largest deal ever in that. We're also doing more at the branch with our Zero Trust SD-WAN and our new acquisition into the LAN as well as Zero Trust. And architecture really does matter. And when we go in and compete, people like the way we build technology with true Zero Trust, where you don't have to worry about exposed firewalls and exposed VPNs that people have to dial into to get through, which allows you onto the network, and anytime there, well, not a big scramble. In our world, there isn't that concept of a zero-day because you don't have any exposed assets at all.
So Steve, we're gonna tech investors or non-tech people, what does it mean Zero Trust SASE versus the competition? How is your offering different from the others?
Right. So, if you come from VPN world, what you do is you put a perimeter around your environment, and then as people try to get in, you challenge them and say, "Is that allowed?" Try to put a bunch of gates of what they can get to on the other side. With Zero Trust done right, which Zscaler does, a few others do as well, but not the legacy firewall folks, you'd know the access, and that gets authorized in the cloud first, and only if you're authorized is a single connection made, and for us, it's two outbound connections that get stitched together in the cloud user onto the network. They don't get a real IP address. They don't know where they are. They don't know if they're in Azure, AWS, or a data center. It's completely obscured from their knowledge.
And for us, that's true Zero, anything to the internet. So you don't have to worry about DDoS or a zero-day vulnerability, someone breaking into your firewall or your VPN concentrator, which has happened a lot. There's nothing exposed out on the internet in a true Zero Trust world.
Mm-hmm. And when you look at the competitive solutions, for example, Microsoft has announced they don't have a firewall, so is SASE-based, you only refer to Fortinet, Cisco, maybe even Palo Alto, or you also refer to Microsoft?
I mean, they've made some announcements. The product wasn't even GA, and it's gonna be just for users, very Microsoft-centric. And I think eventually you'll see them at the people who just wanna check a box, but at the large enterprise we sell to, we haven't seen them r ight at all.
So what do you say to a customer, Fortinet, for me, that tells you, you charge, I'm making up a number, you charge $300 a license. If I put it on top of my Fortinet, I'm gonna pay only $100 a license. They offer—they offer significant price advantage over Zscaler. What, how do you position yourself versus this kind of price difference?
All right. So, to Fortinet, much, they're a firewall vendor. When we talk about that, they have been talking about SD-WAN for a little while, and now Zero Trust SASE. But, architecturally, at the large enterprise, that isn't what they're looking for. It's not the, you know, not the true Zero Trust that I was talking about, a few of them seriously considered at any of our customers. They are occasionally as the SD-WAN piece, but never as the SSE piece.
Right.
So when you SSE plus SD-WAN, we do occasionally see them as the SD-WAN, and we interoperate with them just like we do with everyone else. But when we've SD-WAN, that competes on that side for the full Zero Trust SASE, architecturally, it's different. They're about easily connecting the network in a cloud-managed way that makes your perform easy, but that's also easy for the adversaries. So if they get into the network, they can also move around. It's not Zero Trust at the branch. It's just connecting the branch, and when that branch tries to reach out to the internet, not when that branch tries to move laterally to your high-value assets.
Got it. The fact, s o historically, you offered SSE. What, what's your journey on SD-WAN? How important is it to have SD-WAN as part of the solution?
I think long-term, people do what Gartner calls a single vendor SASE, so they do want that to come together. So that's, you know, in my mind, long-term, very, very important. We're approaching it in a way that, you know, we've looked at everybody's messaging, everybody's products. They still think of SD-WAN as connectivity and SSE as security, but to us, the connectivity should into a Zero Trust Branch office, which means if anything gets infected, whether it's a user or a printer or an OT manufacturing line, it can't move laterally and infect other things. And Zero Trust, they've been doing it with us, with our ZPA offering for years, many of them, for their users, and now they want that everywhere. They want it in the branch workloads. They want everything to be authorization first before connectivity.
So the traction we're seeing is pretty strong. People are starting to kick the tires, make their first purchase. SD-WAN refresh comes up. Let's move to a single vendor way to do it, and we're the only one that does that in a Zero Trust way.
Mm-hmm. Got it. Look at the competition, and by the way, I know people are standing in the back. There are seats here if you wanna sit down. When I look at the competition, not competition, other cybersecurity started from endpoint, and then they expanded into many, many other areas. Take me through the same journey from the eyes of Zscaler, meaning you started with the company evolve over the next three years in a way that expands the TAM.
Yep. So yeah, going back in time, we started as a secure web gateway in the cloud, replacing your appliances to work or Forcepoint, all those legacy vendors, expanded it out to private access, which again, people originally thought of it a way to do that differently and more securely. But now that has moved to how do we do that when a user's on-prem as well as remote? We added in ZDX, our DLP growing tremendously the last three, four years from just inline DLP to cover all the different channels, the CASB, the endpoint, the email, or that same data security in the cloud. And then that was all Zscaler for Users. And then that growth has been into workloads.
Now, the Zero Trust has evolved to the micro-segmentation world, where how can we bring that same Zero Trust concept to the LAN? So just two things on the same local area net, they're authorized. Airgap gives everyone a network of one. They're on their own network, and to get off of that network, they have to have authorization. And now with most recently, the Avalor's foundational data security fabric, where we can build applications on that, giving insights to companies. Other areas, I'm taking that 400 billion transactions going through our cloud every day and better find threats, better give business insights around. We wanna monetize that in different markets that aren't traditional SSE, SASE, things like vulnerability management or Risk360.
So we've been providing more and more solutions that take budget from other areas, you know, not just the SSE and the traditional things, even things like VDI. We started to have an alternative way to do VDI that's more cost-effective with better and better security all wrapped in one, that can be done sometimes at a quarter of the price of, say, a Citrix VDI solution.
Yeah. So, what is the risk that the market will be bifurcated into customers that understand Zero Trust and customer trust? What I'm asking is, when I look at your competition, none of them is offering the same vision. You're differentiated in your vision, and this differentiation is both a risk and an opportunity. Like, how many people are gonna adopt? What kind of discussions do you have with customers? Where do you see reception for the Zero Trust offering? Is it a certain vertical, big companies, small companies?
So some of what Remo was saying before, with Mike Rich and the large account selling model, we wanna get very deep into the large enterprise, and that's the which understands the value of Zero Trust and is willing to invest in the right technologies to make sure their security is top-notch. Harder and harder to have those individual conversations, and the customers are generally less sophisticated, which is why our go-to-market model for the smaller ones would be through partners and internet. But we are having those discussions with the large enterprise to make sure they not only understand it at the website level, because everybody says Zero Trust everywhere, but we get down into the details.
So while the account reps or account executives themselves are coming from the enterprise software, SEs and the solutions architects and the CXOs we hire out of customers, all of those get brought in and talk to the different groups inside, understood throughout the organization. Not just one champion, but all the different parts of the organization understands what it really means to be Zero Trust and why you need to do it right.
I'm not talking about data center firewall. That will probably never change. So I'm talking about branch firewall, campus firewall, but not data centers. So what if a customer tells, "I have, I've been around for many years. I'm a big organization. Politically, I can't change it or whatever." What do you offer to those that still wanna keep their firewall in the branch, the advantages that you have, and how can you compete, and then compete with a firewall company?
Yeah, still telling me you don't need a firewall in a branch. Actually, it will come out, but, to be honest, most of the large enterprises didn't have firewalls in every branch because they were backhauling everything out through a core set of appliances. So, direct to internet with SD-WAN and SASE, most have chosen not to put a firewall in every branch, right? There are some, we, we say, "You definitely don't need it. That's money that's, that you're wasting by doing that." But most people are saying, "If I'm gonna go direct, I still need security.
" That's where SSE, combined with whatever the SA, and for those who want it in their data centers, like you said, the core east-west is gonna take a long time to disrupt, but even the firewall between your data center out to the-- They're not gonna just remove that firewall, but, it'll get smaller and smaller as, you know, you take traffic direct, you no longer have that thousand app. You can shrink the size of the firewall. People already weren't doing SSO inspection on the firewalls. They weren't sized for that. It's not an easy thing to do, and in today's world, all the threats are encrypted. It becomes a mandate for any truly security-conscious organization to be inspecting not only for threats, but also for data leakage. Same thing.
All right.
You have to be able to-
So we spoke about data, and that takes me to the next question, which is about, I asked you about it, but I'm gonna ask it more direct: Then what are the-- Where are the opportunity to grow, upsell additional modules to existing customers? So what are the markets you're going after? And you mentioned data. There was mentioning of cloud before, et cetera.
Yeah, and ours are a tricky one because we wanna sell bigger and bigger bundles up front, which gives less opportunity to upsell. But even when we're selling those bigger bundles, they tend to be the Zscaler for ZIA, ZPA and ZDX, and in that case, we still have the opportunity to expand to workloads, to expand to the Zero Trust SD-WAN Air Gap pieces for the LAN. And now with Risk360 Business Insights and UVM, which came through the Avalor acquisition, we've got more of different parts of the security budget, and in some cases, even to the CIO or CFO or head of head of facilities, you know, where their footprint is in their offices, where what times people work, et cetera.
So there's a lot of opportunities to continue to sell, even the ones who come in at the Zscaler for Users, high end of the bundle, too much to sell to the users because they have ZIA, ZPA, ZDX, even data protection in those high-level bundles.
Mm-hmm. The things you spoke about was cloud. What do you offer for cloud protection?
Yeah. We have a variety of solutions in there to do both the cloud workloads trying to talk out to the internet, which is very common. Maybe it's integrated in with ServiceNow or Salesforce and has API connectivity, but it shouldn't be going in Russia or China. So you want to do internet access protection and data protection on it. But more importantly, workloads that communicate to other workloads, maybe in the same account AWS, we do that in a zero trust way. We call those things workload communications. We also have the cloud workload protection. We just announced DSPM, Data Security Posture Management, which leverages the same sensitive data definitions you did for inline DLP and for CASB now on those workloads themselves.
So you know, there's not only sensitive data, but it's configured in a way that it's exposed to, you know, which are escalated too high of some of the users. So we put all of that together into an overall data security platform, which touches the workloads as well.
Right.
So that's another piece.
How are you positioned? I ask it because some of the big startups like Wiz, et cetera, started earlier. Palo Alto Prisma Cloud started earlier, but we or entrant to the market. So where are you positioned from a technology readiness point of view?
Yeah. Yeah, good question. So the, all the traditional is, they are strong in kind of the, the DevOps side through to runtime, and they put DSPM as part, you know, that cycle. Zscaler is approaching it a little bit differently, as DSPM is just another channel that you can lose data on, like your users out to the internet stick. This is the data that's there. Is it leaking or exposed or, you know, externally or internally to too many people? And we've tied that SASE framework and the SSE framework, where you define your data protection once, and you secure all of your channels. And for us, that's kind of moved a little bit further away from the DevOps because you want to protect your sensitive data that's out there.
For us, it's just gonna be another channel we sell with our platform and not try to go in and set against the CNAPP side, if it's led from a DevOps part, which a lot of their business is.
Got it. Okay, now it's time to ask some financial questions. The quarter was great, but still, if you look at street consensus growth for next year, it went to 20% revenue growth. And the question is, it—when I spoke to your team, it was about street didn't model properly the, fundamentally, the question is, how do you see next year playing out? How do you see pricing environment? How do you see growth environment? What is-
Yeah, so, broadly speaking, and not speaking specifically for fiscal 2025-
Yeah
You know, based on how we're positioned as a company and based on what we're seeing with run rates and the price, I don't really see much changes basically in fiscal 2025. Still, you know, we're in an environment of high scrutiny. I don't see that changing either. So, you know, from my perspective, what it really comes back to is that what company has a solution which addresses really the needs of today? And when you take a look at Zscaler, you know, we're built in the cloud, for the cloud. And when I met with Jay Chaudhry about 7.5 years ago, it was a very simple concept, and the concept was, and again, I came from NetScreen, which is a firewall VPN company, you know, so Juniper, and then also Infoblox, which is a core DHCP, IPAM.
When I met with Jay Chaudhry, you know, basically, you know, I knew that the ship had sailed related to applications going in the cloud seven, eight years. Whether that was going to happen or not, that clearly has happened. The. My feeling was that security had to stay on-prem, and the reason for it is because I got to control it. I've got to basically get, and Jay's comment to me was, you know, it was after a 3-hour meeting, he said, "You know, if applications are moving to the cloud, and users remote everything back into your data center, and the answer is you don't." So when you take a look at the legacy companies, and you look at their fundamental architecture, which is the architecture which was obviously came about in the mid-1990s, that architecture is still fundamental to basically their platform.
Zscaler basically threw that out upside down. But we're basically a cloud, we're an exchange, it's invisible, and we connect the right user to the application, the right workload, the right IoT device. So, when I first started, we're still very early innings in this market. I think architecture and platform matter. I think I felt that when I spoke to Jay. I'm more convinced of that now. The breadth of our platform, which continues to grow, our ability to do acquisitions and to integrate those acquisitions, I think is very, very, from my perspective, you know, from a fiscal 2025 perspective, you know, we talked about the headwind with, you know, the, the higher attrition will have an impact on us. But we're a much stronger company now with basically the changes that we've made.
Also basically, three years ago, four years ago, five years ago, you had to convince people. Everybody's Zero Trust now. Everybody's SASE. Zscaler has been doing this for from the very beginning. So I, I think overall, still expect win rates to be up. I expect basically the sales organization to mature. I expect it to get stronger, to sell deeper into the accounts, to make us stronger.
Ran out of time. Thank you very much.
Thank you.
Appreciate it. Thank you.