Hi all,
My notes from ZS conference call. I suspect the big drop was my fault after buying some shares after the first big drop so sorry about that.
It was a good result I thought, but ZS was pretty richly valued, and so needed (I think) to knock it out of the park. Are they selling a great product, that people seem to like, expanding rapidly etc? Seems like it. Are they firing on all cylinders? No, the sales cylinder is not firing as well as it could be.
Summary:
Good:
- good revenue growth,
- analysts pretty happy,
- no pricing pressure, ARR ?,
- PANW comments rubbish
Bad:
- Need to scale sales execution as numbers get bigger and bigger [GD: this was repeatedly mentioned and is IMO the thing to watch]
- Started to see larger deals taking longer to close… [GD: this is a pretty common refrain amongst SaaS heading for the big orgs]
cheers
Greg
Q4 2019
Strong revenue and op profit growth, +ve FCF.
Revenue: +53%
Billings: +32%
against difficult comps
FY Revenue: +59%
FY Billings: +51%
Market opportunity
Mega-shift - customers chosing multi-tenant cloud architecture.
Digital transformation - fundamentally changes network traffic patterns, breaks the traditional perimeter protection model.
ZScaler - built for a world without walls - ZScaler is business policy engine deployed across 150 datacenters.
Gartner - Future of network security is in the cloud
Secure access service edge
…
Zscaler designed from the start for the world Gartner spelled out.
Traditional network security vendors - trying to retrofit legacy appliances into a cloud world.
We believe these hybrid security models are fundamentally flawed
“Their message is: keep on buying my boxes but use my cloud services”
We believe these don’t scale, leave security gaps, poor user experience
Just like you can’t create Netflix by stacking lots of DVD players in the cloud, you can’t create inline high-performance security cloud by spinning up a bunch of virtual machines in a public cloud.
- This is what cloud imitators do
Architecture matters
- Edge cloud for policy enforcement
- Multi-tenancy
- Proxy for SSL/TLS inspection
- Zero-trust network access
[GD: sounds like he’s pissed at PANW]
ZS - seek to reach $1b revenue, need to build a sales machine to drive consistent sales execution. Critical for a top-down transformational sales model which delivers “even if the environment gets tougher”*]:
“Started to see larger deals taking longer to close”
Dale Rajik - President go-to-market and CRO
More customers buying ZIA and ZPA platforms together - enables true transformation with direct access to any service or application from anywhere on any device “without backhauling traffic through the data center”
ZIA for internet and SaaS
ZPA for internal apps - newer platform (2yo).
14% new business. 50% coming from existing ZIA customers.
Anecdotes
Global information services company spun off one of its business units, with legacy infrastructure.
Adopted full-cloud-transform. ZScaler = policy enforcement platform.
Purchased ZIA business bundle + cloud firewall + data loss prevention => 25k employees
- ZPA for 10k mobile users
[GD: Customer doesn’t have to build a new network to secure everything…]
“All users, all locations, any device”
Global SI - key to sale.
F100 multi-national Oil and Gas
bought (previously) ZIA transformation bundle => 65k employees
purchased ZPA for 56k+ users
replaces legacy VPN
provides access to apps in datacenter and public cloud while increasing level of security - 0 trust network access approach.
Total customer spend +67%
G500 Industrial company Europe
Purchased business bundle and sandbox => 120k users
In addition to Office365, SSL traffic inspecting, Cloud sandboxing.
Across 60+ countries for all users.
F100 consumer goods company
Had purchased business bundle several years ago
upgraded to transformation bundle + data loss prevention => 100k employees
After deploying Office365 - overwhelmed by traffic to OneDrive and Sharepoint.
With ZScaler, wont have to backhaul O365 to 4 datacenters [GD: what does backhaul mean? Think it means routing the O365 traffic via the datacenters to the O365 servers. So much slower]
Instead, implementing SDWAN for 300 locations for ‘local intranet breakouts’ [GD: what does this mean? basically I think it means removing the central organisational gateway (eg: VPN connection) for branches. That is, instead of having to route traffic through your global datacenter where all the security rules get applied, you send it to the ZScaler datacenter (which is theoretically much closer since its deployed on 150 datacenters around the world). Ie, you’ve removed your branch’s dependency on the global datacenter.]
To secure all local breakouts, customer purchased cloud firewall, sandbox, DLP for all users.
We believe we’re the only cloud native multi-tenant platform for network and security transformation.
Cloud security market evolving rapidly - creating more distance from “cloud-imitators”
Competitive environment favourable.
Strengthening Channel/SI partnerships >50% of revenue.
| | |
|:----------|:-------------------------|
| NDRR | 118% |
| Churn | **declined qoq and yoy** |
| Customers | >3900 |
| G2000 | >400 up from >300 yoy |
| F500 | >100 |
Finance
| | | | |
|:----------------|:------------|:----------------------------------------------------------------------------|:---|
| Revenue | $86.1m | +9% qoq 53%yoy. NB: Q4 2018 had $1.4m from large public sector customer | |
| --- US | 51% | | |
| --- EMEA | 41% | | |
| --- APJ | 8% | | |
| FY Revenue | $303m | +59% | |
| ZPA | 14% | +10%yoy fastest growing product in history | |
| Billings | $126m | +32% yoy | |
| Contract terms | 1-3 years | billed 1 year in advance | |
| ARR ZIA | 43% | High-end transformation bundle - next gen firewall and sandbox (vs 35% yoy) | |
| DBNRR | 118% | vs 117% yoy vs 118% qoq | |
| | | Bigger deals up-front - can reduce DBNRR - 118% outstanding' | |
| GM | 81% | +1% yoy -1% qoq. Think 80% good target | |
| Opex | $62.2m | +31% yoy +6% qoq increased S&M + R&D ||
| | 72% revenue | ||
| Headcount | +130 | 1480 employees | |
| S&M | $41m | +33% yoy, +6% qoq - higher compensation and marketing programs | |
| R&D | $13.2m | +28% yoy, +7% qoq - product fns, new producs | |
| G&A | $8m | +3% qoq, +26% yoy IPO, building team. excl. $3m in litigation | |
| OpMargin: | 9% | vs -4% yoy | |
| OpIncome | $9.1m | | |
| EPS | $0.07 | | |
| Cash and equivs | $365m | | |
| FCF | +$7.6m | vs $11.9m yoy. ESPP FCF -$4m vs +$3m Q4 2018 [GD: why? buying shares?] | |
Guidance
Excluded SBC, amortisations, litigation exp, and tax effects
| | | |
|:-----------|:--------------|:------------------------------------------|
| Q1 revenue | $89-90m | 41-42% yoy |
| OpLoss | -$1m-$0 | $6m expenses for 3 major marketing events |
| EPS | $0.00-0.01 | |
| Shares | 139m | |
| FY2020 | $395m - $405m | +30-34% yoy |
| Billings | $490-$500m | +26-28% |
| OpProfit | $13-$18m | |
| EPS | $0.12-0.15 | |
| Shares | 140m | |
Aggressive investment in business - step up S&M, increased tech, cloud infrastructure
Q2 and Q4 strongest quarters. Sequential declines in Q1 and Q3
Typically first half billings: 43-44% of full year billings
But expect 2020: 42-43% due to CRO ramping. NB: Large up front billing in Q2 2019 from large public sector purchase - tough comp.
Excluding that deal, billings guidance implies +29-32% billings growth
FCF - 1 or 2 points lower. Headquarters move. Litigation with Symantec.
Longer term : expecting higher margins than non-GAAP operating margins.
“We believe market is coming to us”. Tailwinds: Office365, SaaS adoption, SDWAN, app migration to public cloud.
Q&A
Q: “Congrats on a fantastic year”. Great to see sustained growth +50% after adjustments, large deals taking longer to close. Macro deterioration? Change in competitive dynamic?
A: Pipeline growing, larger deals took longer. Macro vs competition, top 50 deals - competitive position strong. Nothing on macro. Not worried about competitive pressures, no clear indications on macro. Excited about new CRO.
Q: CRO - long-term deferred, duration shrinking? Why? Whats baked into guidance for FY?
A: Guidance: What we’ve seen through entire year. Deferred revenue: +53%, Short-term: +57%. Public sector deal moving to short-term from long-term. Nothing different from duration perspective in 2020 guidance.
Q: Portion of RPO recognised over 12 months?
A: CRPO → $305m over 12 months.
Q: Sales execution - channel enablement - training of partners?
A: Our sale not typical security appliance sale.
We enable cloud transformation - so C’level discussion (top-down). BEst channel partners are SIs and Service providers. But we still have to do ‘fair amount’ of heavy lifting, disrupting the old world = high touch. SI partners doing great job.
Re: Deployment. ZScaler - relatively easy to deploy. Train channel partners, have our own deployment teams that work with channel partners. Customers very happy.
[GD: From PANW cc:
“We displaced Symantec and Zscaler at a Fortune 50 U.S. retailer to secure their data center and network of more than 2000 retail outlets.”
“We displaced Zscaler and beat Fortinet at a major European national healthcare provider in their digital transformation project.”
I didn’t read much in those comments - they said “I – so I think the competition is Zscaler.” which seems a pretty good endorsement to me]
Q: Competitors [GD: PANW CC here said “in the long-run, proxies not right solution”?
A: I think if you asked ay expert, what security inspection tech gives you best inspection capability, 99% smart people agree - proxy tech wins. Those statements makes zero sense. Big bank anecdote.
Akamai’s of the world have proxies. Without proxy, little or no control.
In the SSL/TLS world, firewalls not designed for this. Proxy needed for SSL.
“These statements are meaningless, mislead customers and do a disservice to the security industry”
Q: Anything planning on doing to address slower sales growth because of environment you noted?
A: Been without CRO for year and half. Didn’t want to hire wrong person. Made several other hires (sales related). More confidence to invest more in S&M [GD: like this. Hiring the wrong people is death]
Very few situations where we don’t win.
Q: Will take longer to get to margin targets?
A: No. 20-22% op margin at $800m-$1b. One change re: guidance, is 1st half 42-43% vs 43-44% historic. Will take some time CRO ramping, so lower billing guidance.
Q: Congrats on nice quarter. Office365 - significant tailwind. Whats left of tailwind in F2020? What are top growth drivers in F2020.
A: O365 - Has been a big driver. Requires local breakout because amount of traffic far bigger than all other SaaS combined. 20% G2000 are ZScaler customers (80% aren’t).
Most G2000 bought O365, ZScaler helps here, so tailwind continues. Needed for deployment of O365, so big opportunity still exists.
SDWAN - second biggest driver. Local breakout deployments - ZScaler ‘often’ the choice to secure SDWAN.
SSL traffic at much larger scale.
Q: Competition - Broadcom/Symantec acquistion. Change in conversation since announcement?
A: Large enterprises - if theres one solution thats deployed alongside ZScaler, its Symantec BlueCoat. Customers have much more urgency. We believe we’ll be the beneficiary of the uncertainty in the space.
Q: Billings guide for 2020. Some large deals took longer… what have you assumed in FY2020 guidance.
A: Pretty similar to fiscal 2019.
Q: Hiring plans in F2020. US/international?
A: Net hires 430 in FY2019 - planning to hire more, 1. S&M, 2. R&D, 3. Cloud ops and support.
At the moment, 1/3 San Jose, 1/3 India, 1/3 ROW.
Expect percentages similar, maybe a little more in India.
Q: Large deals in pipeline. Competitive dynamics changes?
A: Large enterprise - do look for multiple providers (obviously). Exciting - When a large enterprise goes to RFP with 5 service providers, quite often get bid by all 5 providers, sometimes 4. Most of the time the other 1 or 2 providers use proxy vendors because large enterprises expect them.
We win hands down - aren’t worried about competition. Hear lot of noise about firewalls. [GD: PANW]. Makes no sense.
We didn’t lose any F100 - no firewall dealers. [PANW] claims about displacing Zscaler at a Fortune 50 U.S. retailer - personally know all our F100 customers. Didn’t lose any.
Analysed top 50 deals, rarely see “this vendor” in there.
Need to scale sales execution as numbers get bigger and bigger.
Q: Trying to understand - how is pricing developing? Improving?
A: Average deal size - ARR - >3000 users - gone up every quarter, up in Q4. Pricing pressure- discounting QoQ/YoY => lower. So no not seeing pricing pressure.
Q: EMEA slowdown - macro.
A: Brexit - wonder about it. Haven’t seen tangible effect on business. See customers talking about it, watching.
Probably have more work in scaling business. New leader in Sales in EMEA. We’re unusually large in EMEA. 50% of business international, about 40% from EMEA.
Q: Looking at guidance, revenue growth in absolute dollars: FY19 $110m new revenue. Guide for F2020 - implies you’ll add a little less $100m. Why going down absolute dollar growth YOY?
A: “We like to be prudent with our guidance and our guidance we feel is prudent”.
Q: Improvements in cloud firewall? potential to displace branch office firewalls?
A: We’ve done “tons and tons and tons” of displacements. If talking about cloud firewalls lacking functionality, may be getting mixe up with datacenter firewalls.
Firewall people say: “you should same policy in branch firewall as data center firewall”.
Makes no sense because the datacenter is complex. Whats the difference between
Q: What are you trying to protect in branch office? A: Employees.
Q: Whats the difference between sitting in a branch office and sitting in a cafe, airport? A: Nothing
Silly to put 6000 datacenter rules in branch office. Most of the rules are not needed.
Our firewall is very rich. Never have a situation where someone says your branch firewall is not rich enough. Focus on zero-trust - where you don’t bring people on the network.
We’re trying to do things the new way, where you don’t control the network, you don’t worry about network security. You securely connect a user to an application, simply a switchboard in the middle.
Big announcements next week at Zenith Live.
Q: More customers adopting both ZPA and ZIA… outsized impact on sales cycle?
A: Yes, bigger deal, typically longer cycle. Top-down transform journey complex, need to get support from top-down. Need to grow sales team, architects.
Q: Continue to expand platform, address more componets on the security stack over time, how do you weigh layering in that functionality into a bundle, or treating it as a separate product?
A: Those are the things you take to market and see. Change bundling over time. Think there will be more changes over time. Think you’ll be pleased with evolution of technology.
Q: Next fiscal year, new CRO. Broader product/vision. How to think about the degree of change in the salesforce in this year. Significant restructuring from the get go?
A: We’ve been discussing. Don’t expect significant change in sales team. Expect significant change in methodology/framework to be able to deliver consistent message. Overall have good sales team, need to make sure enablement and training is there.
As you go to $1b target, need these changes and refinements.
All those factors built in guidance 2020.
Q: Still have 80% of largest enterprises to penetrate, evangelical sale - requires architectural change. Why wouldn’t you need to lean on a much more significant sales force in order to keep revenue and penetration growing, and less on the SI community who are more focussed on fulfillment.
A: Yes - channel partners help, but we do tons of heavy lifting. Investing heavily in S&M. Haven’t bought down S&M as percentage of revenue yoy. We are driving sales with our own sales organisation, channel is helping. When transformation happens, channel can only do so much. Once its commoditised (tech) channel can do more.
But investing prudently. Theres only so much you can invest, total headcount increase is significant.
Q: CRPO growth rate.
A: 45% yoy.