Zscaler, Inc.ZS

Zscaler has been invited by the National Cybersecurity Center of Excellence to implement a new Zero Trust Architecture project, a public vote of confidence that arrives while the company’s own financials read like a cautionary tale of high-growth marketing versus hard-nosed cash flows. (source: NCCoE Selects Zscaler to Implement Zero Trust Architecture, https://www.zscaler.com/blogs/company-news/national-cybersecurity-center-excellence-nccoe-selects-zscaler-technology)

At its core, Zscaler sells a unified, AI-branded security platform that bundles data-loss prevention, cloud-access security brokering, data-security posture management, and zero-trust networking into a single subscription sold to large enterprises and government agencies. The pitch is straightforward: move all traffic through the Zscaler Zero Trust Exchange™ and you no longer need to trust your own network. The problem is that the 10-Q for the nine months ending 30 April 2026 shows subscription and support revenue made up 98% of total revenue, which means the company’s “unified platform” is effectively a single subscription product sold thousands of times, not a portfolio of modular services that customers bolt on as needed. (source: ZS SEC EDGAR 10-Q (2026-05-26), https://www.sec.gov/Archives/edgar/data/1713683/000171368326000096/zs-20260430.htm)

What the books actually collected tells a different story. For the nine months to 30 April 2026, Zscaler reported revenue of $850.5 million, a net loss of $13.9 million, and operating cash generation of $850.4 million, almost a one-for-one conversion of revenue to cash-a rare trick for high-growth software names. The company spent $232.3 million on research and development and $77.5 million on property, plant, and equipment, which is the cost of keeping the demo environment running and the deception technology spinning decoy servers. Cash and equivalents stood at $982.1 million, liabilities at $4.73 billion, and shareholders’ equity at $2.37 billion, giving each of the 160.7 million diluted shares about $14.73 of net asset backing-while the earnings per share landed at negative nine cents. (source: ZS SEC EDGAR 10-Q (2026-05-26), https://www.sec.gov/Archives/edgar/data/1713683/000171368326000096/zs-20260430.htm)

The SEC filings do not provide segment-level revenue splits, customer concentration, or forward guidance, so investors are left guessing which mix of industries and contract sizes is driving the top line and how durable that revenue really is. The only concrete customer fact is that no single customer supplied 10% or more of revenue in the periods presented, which is either healthy diversification or a polite way of saying the company has not yet cracked the Fortune 50. ARR, or annual recurring revenue, is defined in the filing as the next 12 months of revenue from subscription contracts as of the measurement date, but the disclosure does not quantify the figure, so the market is trading on narrative rather than disclosed metrics. (source: ZS SEC EDGAR 10-Q (2026-05-26), https://www.sec.gov/Archives/edgar/data/1713683/000171368326000096/zs-20260430.htm)

On the product front, Zscaler continues to expand its feature set: the Unified Platform now wraps DLP, CASB, DSPM, and zero-trust under an AI-powered wrapper, while the “advanced deception technology” page promises decoy servers that detect and neutralise attackers before they do damage. These are real product modules, but none of the SEC filings provide quantitative adoption or revenue contribution, so the investor is left to trust the marketing pages rather than the balance sheet when judging whether the next feature will move the needle. (source: Advanced Deception Technology Solutions | Zscaler Cybersecurity, https://www.zscaler.com/products-and-solutions/deception-technology)

For context on liquidity and sentiment, the SEC submissions JSON lists routine Form 4 insider trades and Form 144 sales, which are normal governance disclosures but do little to dispel the optics that executives are taking chips off the table while the platform story gains altitude. The absence of a share-buyback programme in the filings also means the company is still choosing to conserve cash rather than return it, which is prudent for a business still building out cloud capacity but frustrating for shareholders hoping for a capital-return signal. (source: ZS SEC submissions JSON, https://data.sec.gov/submissions/CIK0001713683.json)

The company’s Business Insights product promises to help customers “make informed decisions about technology, offices, and people,” yet the 10-Q does not quantify how many customers are using it, what it contributes to revenue, or whether it is profitable. The filing is silent on churn, gross retention, or net revenue retention-three metrics that usually matter when a software company pivots from selling security to selling analytics. Until those numbers appear, the unified platform is still a promise wrapped in an ARR definition and an AI sticker. (source: Drive Digital Transformation with Zscaler Business Insights, https://www.zscaler.com/products-and-solutions/business-insights)