Zscaler delivered a strong Q3 report in late May, but a couple of trends surfaced that give me concern about the durability of their growth going into the next year. Normally, I would let the long term thesis play out, but I also see an increasingly competitive space for Zero Trust/SASE solutions (now called Security Service Edge or SSE). While Zscaler is a leader in that category currently, it's not clear to me that their pace of innovation will maintain their competitive moat over time. This could result in declining sales growth or operating margins, as competitors win some share of deals and bundle SSE services with their broader platform suite. $ZS

Therefore, I decided to close my position in ZS, after slowly reducing my allocation since the Q2 report in February. This is a tough call, as it's difficult to ignore the tailwinds from security in the near term and Zscaler's entrenchment in 30% of the Global 2000. However, the current period represents primetime for security companies and Zscaler could be performing even better. This demand environment is being driven by the unusually high threat landscape and under investment in security by enterprises and government agencies in the past. This has made 2021-2022 a spending catch-up period of sorts for enterprises that have underspent on security. How long this heightened demand will last is hard to predict, but I do think the rate of spending increases will normalize in the next year or two.

Some security companies are expanding into adjacent markets to provide other avenues to grow revenue in the future. Crowdstrike provides a good example with their move into security data analytics (Humio product) and identity monitoring. For Zscaler, beyond their extension into securing cloud workloads (which is largely a repurposing of their ZIA/ZPA products to servers instead of users), I haven't observed much innovation. Their blog is fairly light on product releases over the last year. I like to see companies with an active stream of new product announcements.

Specific to Zscaler's Q1 report, they delivered another quarter of strong annual revenue growth at 63%, but the rate of calculated billings growth is decelerating. Management continues to highlight billings as the primary indicator for future revenue growth. The annual growth rate in billings has been dropping since Q1 of this fiscal year (Oct 2021 end), when it was 71%. In Q2, the growth rate decreased to 59% and then 54% in Q3 (the most recent quarter). From Q2 to Q3, the total value declined sequentially by 6%. For the full year, the calculated billings estimate is for 52.8% growth, which implies the Q4 billings growth rate will drop further.

This is offset somewhat by strong RPO growth of 83% and deferred revenue up 65%, which were both higher than revenue growth. However, these metrics are trending down quarter over quarter as well. The other issue that has surfaced in the last few quarters is a stalling of Zscaler's continued improvement of operating margin and FCF margin. Non-GAAP operating margin was 9% in Q3, which is down from 13% a year ago. FCF margin was 15%, down from 32% a year ago. There are some explanations for this behavior, but the trend generated at least one analyst question on the call. Also, operating expenses grew by 71% year/year this quarter, which was faster than revenue growth at 63%, showing that operating leverage doesn't appear to be continuing. For the prior 9 months, operating expense increased by 65% versus 62% for revenue. They may be investing this year for future growth, but the break in the trend is worth noting.

I think this situation provides a risky set-up for Zscaler coming into their Q4 report (July end), where they will need to provide their preliminary estimate for the next fiscal year (FY 2023), due to their offset between fiscal year and calendar year. Based on the trajectory of billings growth and likely conservatism, the preliminary growth target could be in the high 30% or low 40% range. While other software infrastructure companies are demonstrating some slowdown in spending growth due to the macro backdrop, this could represent a substantial drop at a time when the market is overly sensitive and security spending is at historically high levels.

While these factors could be construed as nit-picks on otherwise strong financials, my larger concern is around emerging competition and Zscaler's pace of product innovation. They enjoy a defensible position in SSE (Zero Trust/SASE networks) for now, but I don't see evidence of other areas for expansion from here. They launched Zscaler Cloud Protection two years ago, and now there are other players in that space. Additionally, they have enjoyed a leading position in Gartner's Magic Quadrant. For several years, they were the only provider in the Leader's quadrant (for Secure Web Gateway). Now, Gartner has redefined Zscaler's category as SSE to more accurately reflect the latest expectations for a network-based Zero Trust solution that includes secure web gateway (SWG), cloud access security broker (CASB) and Zero Trust network access (ZTNA).

With the new definition, published in February 2022, Zscaler now shares the leader's quadrant with Netskope and McAfee. Palo Alto Networks is also close on the Ability to Execute axis. This represents a pretty large shift in the competitive landscape. While Gartner did combine some categories, it highlights the encroachment from competitors. If anything, customers have more options to consider. Zscaler is still winning deals, but it's likely that they have to compete more actively than they did previously.

Looking forward, I am not convinced that Zscaler will innovate faster than other competitors in the space. I compare this with the product development cadence demonstrated by some other companies, most notably Cloudflare, Netskope and Palo Alto. As I cover Cloudflare closely, I have been impressed by their rapid development of a Zero Trust solution. I realize that it doesn't match Zscaler feature for feature now, but it is catching up rapidly (was included as an Honorable Mention in the Gartner report). Plus, Cloudflare's platform offers compute and data storage capabilities that would allow organizations to customize aspects of the security protections if they wish. Zscaler has no developer compute environment. Additionally, Cloudflare has a larger data center footprint (370+ versus 150+), with plans to extend that further to thousands of micro-locations through Cloudflare for Offices.

Combined with a platform of other services, there may be a consolidation argument for some customer companies. Palo Alto offers a broader suite of solutions, not just Zero Trust / SASE. Cloudflare falls into this camp as well - they even provide DDOS protection for Zscaler, which is strange considering Zscaler's claims around network capacity. I also like what other pure-play security vendors are doing in terms of expanding their platform reach beyond just security use cases. Crowdstrike's move into identity monitoring and large data processing (with Humio) are interesting product extensions.

For these reasons, I closed my position in ZS last week. I moved the proceeds into MDB, where I see a more favorable competitive position and potential for durable growth.