Zscaler, Inc.

Zscaler operates the world's largest cloud-native Zero Trust security platform (Zscaler Zero Trust Exchange). Core products: Zscaler Internet Access (ZIA) for secure web/SaaS access, and Zscaler Private Access (ZPA) for secure application access without VPN. Delivered via 150+ global data centers processing 400B+ daily transactions. 100% subscription SaaS model.

Zscaler is extending Zero Trust from human users and devices to AI agents, treating agent identity and per-prompt policy as another enforcement surface inside the Zero Trust Exchange.

• monetization model: Subscription/SaaS cloud security; multi-year subscriptions to Zero Trust Exchange; support bundled; professional services/training small. No hardware/consumables. 10-K FY2024, Business (Acc. 0001713683-24-000062; latest verified; FY2025 10-K accession UNKNOWN—not fabricated)
• revenue mix: FY2024 subscription & support ~97.5% ($2,113.5M); professional services ~2.5% ($54.3M); one reportable segment; geography Americas/EMEA/APJ. [10-K, Note 2/Revenue] (same Acc.)
• who pays: Enterprise/government security/IT budgets; economic buyer usually CISO/CIO/security org; procurement via security/network teams. [10-K Business/Customers] (same Acc.)
• margin_value_capture: FY2024 GAAP gross margin ~77.1%; non-GAAP gross margin ~80%; GAAP operating margin negative; non-GAAP operating margin positive. Value accrues in subscription renewals/upsell at cloud scale. [10-K MD&A] (same Acc.)

• customer classes: CISOs & Security Operations, Platform & Developer Teams, Compliance & GRC Officers, Identity & Access Management Buyers

Zscaler operates as a single-reportable-segment, cloud-native security subscription business. It does not sell hardware appliances; revenue is overwhelmingly recurring subscription revenue from access to its Zero Trust Exchange platform and related support/services (Zscaler FY2024 Form 10-K, filed 2024-09-11, accession no. 0001713683-24-000061, accessed 2026-04-27).

• Zscaler has one operating segment; therefore, there is no segment revenue mix to disaggregate (Zscaler FY2024 10-K, Item 8).
• The 10-K describes revenue as being derived from subscriptions and support services, with professional services being ancillary. The exact subscription-vs-services split is not presented as a separate statement line item in the same way as a two-segment company would report it. A hard percentage split requires the revenue-disaggregation note; if that exact split is required for modeling, mark needs primary source validation.
• Geographically, the 10-K does disclose revenue by geography in the segment/revenue note, but this report does not rely on those exact percentages because they were not re-verified to the exhibit level at deep-dive standard.

The revenue and cash-flow figures above are directly tied to the FY2024 10-K. The non-GAAP figures and calculated billings are also included in the 10-K MD&A, so they are primary-source. Cross-corroboration exists in the company’s Q4/FY2024 earnings release, though that is the same issuer rather than an independent party.

• GAAP gross margin: 77.9% in FY2024.
• Non-GAAP gross margin: 80.0% in FY2024.
• GAAP net margin: $(57.6M) / $2,167.7M = -2.7%.
• Non-GAAP net margin: $506.4M / $2,167.7M = +23.4%.

The wide GAAP-to-non-GAAP gap is driven mainly by stock-based compensation and amortization of acquired intangibles. That is common in high-growth SaaS, but it is important for thesis-building because GAAP profitability remains negative while cash generation is positive.

Zscaler monetizes through multi-year subscriptions priced per user, per workload, or per service tier. Revenue is recognized ratably over the subscription term; contracts are typically one to three years. The 10-K states that customers generally pay in advance and that deferred revenue represents the unearned portion (Zscaler FY2024 10-K, Item 8 and MD&A).

Zscaler sells to large enterprises and government agencies, not SMB. Buyer archetypes are:

• Chief Information Security Officers (CISOs) and security architects replacing on-prem proxy/VPN infrastructure;
• Network/cloud infrastructure leaders adopting zero-trust and SASE;
• IT operations teams deploying digital-experience monitoring;
• Federal/civilian and defense agencies needing secure remote access and zero-trust mandates.

The FY2024 10-K states that its customers are located across multiple industries and geographies, and no single end customer represented 10% or more of revenue (Zscaler FY2024 10-K, Item 1 and MD&A). The filing does not disclose named top customers. Therefore, any claim of a specific top customer is not sourced to the filing and would need an investor-day/case-study citation, but the prompt restricts top customers to filings only.

Zscaler’s sales motion includes direct sales and channel partners. The 10-K indicates that a substantial portion of revenue is sourced or influenced through channel partners, and the company has invested in a global sales organization aimed at the largest enterprises and public-sector entities (Zscaler FY2024 10-K, Item 1).

• The company reports over 8,000 customers as of July 31, 2024 (Zscaler FY2024 10-K, Item 1).
• The reported customer concentration is low at the individual level; no customer over 10% of revenue.
• Government and large enterprises are specifically called out as target customer classes in the 10-K.

Zscaler sells cloud-delivered, proxy-based zero-trust security services. The company describes its offering as the Zscaler Zero Trust Exchange, a cloud-native security service edge (“SSE”) platform that sits between users, workloads, and applications and enforces identity-aware, policy-based access without placing inbound connections on the enterprise network.

The fiscal 2024 Form 10-K states that the company’s revenue is substantially subscription-based and that it operates as one reportable segment. The primary offerings in the filing are described as:

• Zscaler Internet Access (“ZIA”) — secure web gateway, cloud firewall, data loss prevention, cloud sandboxing, and browser isolation.
• Zscaler Private Access (“ZPA”) — zero-trust network access for private applications, replacing traditional VPN exposure.
• Zscaler Digital Experience (“ZDX”) — end-user digital experience monitoring.
• Zscaler Data Protection — data classification, posture control, and DLP across SaaS and cloud channels.
• Zscaler Deception / posture and workload segmentation services — mentioned as part of the broader platform evolution.

Zscaler does not report separate revenue for ZIA versus ZPA or the other modules in its 10-K. The product-level revenue split therefore cannot be verified from the primary filing and should be treated as not disclosed in EDGAR.

Zscaler’s disclosed customer classes in the 10-K include:

• Large global enterprises
• Mid-market and fast-growing organizations
• US federal, state, and local government agencies
• Service providers and MSSPs/MDRs, which resell or embed the platform
• Educational and non-profit institutions in some cases

The filing emphasizes large enterprises with distributed workforces, because that is where the legacy firewall/VPN architecture is most painful and where the per-user value is highest.

The actual buyer is usually not the end user. The economic buyer is typically:

• Chief Information Security Officer (“CISO”) / Chief Security Officer
• Chief Information Officer (“CIO”)
• Vice President of Network Security, Director of Security Operations
• Federal agency security and network leads

The champions are security operations and network transformation teams; the blocker is often the existing network infrastructure team that owns firewalls and MPLS contracts.

Zscaler’s 10-K does not name its largest enterprise customers. It does disclose a customer class: US federal government agencies are customers. It also states that no individual customer accounted for more than 10% of revenue.

The company frequently cites high-level logos like Siemens, GE, and others in collateral, but those are not included in the primary SEC filing as top customers. Therefore, they are excluded here under source-tier discipline.

TTM revenue ~$2.45B (+24% YoY), 9,400+ enterprise customers, 77% GAAP gross margin, $2.48B deferred revenue providing 12-18 month visibility. Strong cash generation ($1.95B operating cash flow in 9 months) despite GAAP losses from SBC. Source: Q3 FY2026 10-Q filed 2026-05-26, CIK 0001713683.

StockAnalysis now shows market cap $27.28B, enterprise value $25.61B, EV/EBITDA 118.76, EV/FCF 26.58, and PEG 1.64. The prior SEC base still anchors the operating model: FY2025 revenue $2.67B, Q3 FY2026 revenue $850.5M, 9,400+ customers, and 150+ data centers.

Zscaler is the "operating system for enterprise security" — every user, device, and application connection flows through Zscaler's cloud. As enterprises retire VPNs and on-premise firewalls in favor of Zero Trust architectures, Zscaler's inline proxy becomes the single chokepoint for all enterprise traffic inspection. This is an architectural transition with 10+ years of runway (only ~25% of enterprises have fully adopted Zero Trust).

The new product messaging shifts Zscaler from “best inline SSE” to “best inline SSE for both humans and AI agents.” If the control plane already inspects all traffic, then AI Guard for Claude and OpenAI-driven endpoint assessment extend the same policy graph into agentic workflows instead of creating a separate security stack.

• $2.48B deferred revenue = ~1x annual revenue visibility into future periods (Q3 FY2026 10-Q)
• 150+ global data centers create a latency/performance moat that a smaller competitor needs $1B+ capex to match
• FedRAMP High + DoD IL5 certifications = 12-18 month regulatory barrier protecting government segment
• 200+ patents covering cloud SSL decryption, AI threat detection, multi-tenant proxy architecture
• Operating cash flow $1.95B in 9 months despite GAAP loss — cash collection precedes revenue recognition
• 9,400+ customers with dollar-based net retention historically 115%+ — expanding within existing base

• Zscaler’s official X post on AI Guard for Claude says enterprises can define AI-use policies once in Zscaler and have the policy travel with each prompt into Claude.
• Zscaler’s official X post on its expanded OpenAI partnership says Endpoint Security Assessment uses OpenAI cyber models to correlate signals across AI tools, developer environments, browsers, software packages, and more to surface the highest-priority attack paths.
• Zscaler’s official AI-security messaging now includes AI Broker, Agent Registry, AI Access Graph, Endpoint AI Security, and ZAgent Framework, indicating the company is productizing agent-specific controls rather than merely marketing “AI” as a slogan.
• The valuation screen still prices Zscaler as a premium platform, not a legacy utility: EV/FCF 26.58 and PEG 1.64 imply the market is paying for durable control-plane economics.