Zscaler, Inc. Common Stock Citi’s 2026 Global TMT Conference

First of all, our platform expanded significantly. Zero Trust Everywhere is a big differentiator because you do not want just for users. The branches, devices, workloads, and our agents. Our portfolio for data security is as comprehensive anything gets. Security for AI, actually, a year ago, we had one product. That was GenAI Security. Now we have got six very good products fully integrated that has exceeded my expectation, the pace at which happened. We expected it. We set up a security AI startup within Zscaler. It has actually delivered solutions very rapidly. Then the launch of Agentic SecOps, that happened today. Great platform on the product side. I think we have better portfolio platform than anyone out there. On the sales side, we got some great momentum. We started the journey of transformation about 2 and a half years ago when Mike Rich came on board.

In that time, we changed the sales team's process quite a bit to be enterprise account-focused. That thing is delivering results. To give you tangible data, you may think that overall ARR growth percentage is here. The real number to look at the growth where we have made changes in net new ARR. In 2024, we basically had very little net new ARR growth. 2025, we took it to 7%, fiscal 2026 first half was 10%, Q4 was 17%. It is tracking very well. So good momentum on the sales side, good on customer side. Customer success is very good. Our NPS, Net Promoter Score, has been sitting in the 80 to 85 range. Very proud of it. That is reflected in the amount of upsell we are doing. So very pleased and looking forward to further doing better job in AD 27.

First of all, it is not just the CISOs. Now CIOs worry about it. The board worries about it. In fact, after Mythos, most large enterprises had a cyber task force whose job was to do some of these things and then report to the board on a frequent basis. Here is what is setting us apart in some of these areas. Think of what the customers are worried about from cyber frontier models. One, even if you do not plan to embrace AI, frontier models still cause a risk because anything that is exposed to the internet, could be a firewall, VPN, application A, application B. They can be discovered, and if they are discovered, frontier models are likely to find some vulnerabilities that creates a problem. In the Zscaler world, we are unique that with zero trust, we can hide those application behind.

We are very busy working with customers, hiding their applications, customer after customer. There have been cases, a customer had 500 exposed domains, sub-domains, applications, and once we go in, we are able to bring that number down to probably 200 in a matter of a few weeks. Then it takes more time to go further down. That is number one. Number two, they are worried about embracing AI agents. They are powerful, they are excited. Every CEO is putting pressure on them. Do it. Then they say, "Wait a second." Then they read about Hugging Face, then they read about next week, Anthropic saying, "Hey, my agent went rogue." Then Meta comes. "Yes, mine went rogue, too." Then last week, what did OpenAI say? "Oh, one of my agents hacked a German site 3 months ago." Oops. All this is happening, so enterprises are worried about it.

For that, they are looking for essentially a solution that can make sure right agent can talk to right agents. There is nobody better suited to solve that problem than Zscaler, because we pioneered zero trust, where a user could only connect with certain application, not to the network. Firewall vendors connect to the network. We advanced it to zero trust for branches, for devices, for cloud workloads. Doing agent was the natural thing for us to do. Those are the two things. I will give you one example. Yesterday, I was in D.C., met a few customers. Two of them were large federal agencies that you would expect in D.C. That is natural part of it. Both conversations tell me, Mythos, they are both using Zscaler, ZIA, ZPA stuff, and now they are looking for help. Now the conversation happens. I talk to the CIO how we can do this stuff.

They're a large agency, thousands of one day and the CIO said, "I have 900,000 internet access points." "How long will it take for you to give me an assessment and the risk factor of it?" I told her that it'll be faster than how long it takes you to go through your paperwork for procurement.

It's a good pitch. She said, "How about 4 to 6 weeks?" I said, "Done." I said, "Let's get started.