In security, a false positive is when your system flags a threat that isn't one. Markets do the same thing. And right now, the ZS selloff is the most expensive false positive I've seen in cybersecurity in years. The stock lost more than 50% from its 2025 highs on two legs: first, a 13% single-day drop after Q1 FY26 earnings when a guidance raise wasn't dramatic enough for a market that had come to expect miracles; then a second wave down in February 2026 as the "SaaSpocalypse" narrative - vibe-coded AI tools reducing enterprise SaaS demand - swept indiscriminately through software. Zscaler got caught in that wave despite having almost nothing to do with it.
Here's what the business actually delivered while the stock was falling. Q2 FY26 revenue reaccelerated to 26% year-on-year - $815.8 million actual versus $798 million consensus. The remaining performance obligation hit $6.1 billion growing 31%. FCF margin reached 52% in Q1 FY26, 700 basis points above the prior year. Z-Flex booked $290 million in a single quarter - more than four times the Q3'25 pace - and generated nearly $650 million in total contract value in its first year, average term four years. AI Security ARR crossed $400 million three full quarters ahead of schedule. Twelve consecutive earnings beats. This is not deterioration. This is acceleration dressed in a falling stock price.
The entry zone of $145–$150 represents roughly 8x EV/Revenue - an all-time low for Zscaler, against a five-year median of 15.3x and three-year median of 13.2x. ZS is cheaper than CrowdStrike, Cloudflare, and Palo Alto Networks on every valuation metric - EV/Sales, P/E, P/FCF - despite the fastest five-year revenue CAGR in the group at 44%. The path to $223–$246 asks for nothing heroic. A partial recovery to 10–11x forward revenue on FY27 estimates. That's it. The AI-Security opportunity - a $100 billion SAM that barely existed eighteen months ago - isn't in any of those numbers. That is the margin of safety.
Key Metrics at a Glance
Let me be direct about what these numbers represent. Revenue growing 26% at $816 million scale isn't a company slowing down. It's a company expanding its lead. When RPO hits $6.1 billion growing faster than recognised revenue, customers are locking into longer, larger contracts before the income even hits the income statement. That's what mission-critical infrastructure looks like - not discretionary tooling that gets cut when IT budgets tighten.
The Rule of 40 is software's standard health check: revenue growth plus profit margin above 40 signals a sustainable, high-quality SaaS business. Zscaler scores 78 - growth of 26% plus Q1 FCF margin of 52% (the seasonal peak; full-year guide is 26–26.5% due to annual contract billing concentration in Q1) - one of the highest readings in the industry. Use non-GAAP operating margin of 22% instead and the score is 48. Still excellent. But the FCF number shows what the business actually earns before reinvestment decisions. And here's what the AI-disruption bears miss entirely: non-seat-based usage already accounts for more than 25% of new Annual Contract Value and is growing over 100% year-on-year. The market is pricing in an AI disruption that Zscaler is, in fact, benefiting from.
The customer quality numbers matter too. 728 customers paying above $1 million ARR - up 18% year-on-year. 3,886 paying above $100,000, also up 18%. Net revenue retention at 115%, meaning existing customers expand their spend by 15% every year without Zscaler needing to add a single new logo. The 52% FCF margin in Q1 FY26, up from 45% two years prior - that's the real signal. Not spending its way to growth. Growing into a cost structure already built for a far larger business.
What Zscaler Actually Is - and Why It's Hard to Displace
The biggest misunderstanding about Zscaler right now is that it's just another security vendor - an expensive point product that Microsoft or CrowdStrike could absorb tomorrow. That framing is wrong. It's also the reason the stock is mispriced.
Traditional enterprise security runs on what the industry calls "castle and moat": route all traffic through a firewall or VPN perimeter, and once someone's past the moat, treat them as trusted. The catastrophic flaw is obvious in hindsight - one compromised credential hands an attacker the whole network. Zscaler eliminates the moat entirely. Every request - from every user, device, application, or AI agent - is treated as an outside request until inspected and verified. No trusted interior. No perimeter to breach.
Zscaler built, from scratch, the world's largest security cloud. Its Zero Trust Exchange processes more than 500 billion daily transactions across 50 million users - and every novel threat discovered anywhere on that network instantly becomes a defence for everyone else. No enterprise can replicate this internally. The scale of threat intelligence is itself the product. It took fifteen years and billions in infrastructure capital to build. The moat isn't intellectual property a competitor can patent around - it's the network and the data flywheel it generates. Every transaction Zscaler inspects trains its AI to catch the next attack faster. More data, smarter models, better product, more customers, more data. That loop doesn't benefit a late-arriving competitor. At all.
Geographic diversification matters here. Americas is roughly 57% of revenue, EMEA 28%, APJ 15% - and all three are growing. So this isn't a US-only story exposed to a single regulatory or macro shock. As enterprises everywhere accelerate cloud migration, demand for cloud-native security architecture follows. Zscaler built that architecture at the only scale that actually matters.
"In the large enterprise space - about 20,000 employees - if anything, I would say the competition has become less. These large enterprise customers are CIOs, CISOs, they all know us. The biggest focus is: one, I want to remain safe, give me Zero Trust and help me secure my AI initiatives. Two, can you do it with greater ROI and remove some of the cost? A firewall company won't do that, even though they try to talk about platform - because the biggest spend in security is still firewalls. They have to cannibalize it. We like to cannibalize it."
- Jay Chaudhry, CEO, Zscaler - Morgan Stanley TMT Conference, March 2, 2026The platform now spans four solution pillars: Zero Trust Everywhere (users, branches, cloud workloads), Data Security Everywhere (DSPM, DLP for GenAI SaaS), Security for AI Applications (AI asset discovery, red teaming, AI Guardrails), and Agentic Operations (AI-powered IT and security ops). Each pillar has its own ARR stream. Zscaler isn't a one-dimensional product company anymore. It's becoming the security operating system for the AI enterprise - and most investors are still looking at the old model.
Twelve Consecutive Quarters of EPS Beats - Every Single One
There's one data point the current bear narrative can't get around: Zscaler has beaten consensus EPS estimates in every single quarter since FQ3 2022. Not most quarters. Not a strong track record with one or two misses. Every. Single. Quarter. FQ2'26 delivered $1.01 adjusted EPS against a $0.96 consensus - a beat on top of an already-elevated bar. Companies with structural deterioration don't do that. They miss.
Q1 FY26 is a useful template for how this team operates. Revenue guidance was $772M–$774M. They delivered $788M - a $15 million beat on a $773 million midpoint. EPS of $0.96 came in 11% above the guided range of $0.85–$0.86 and 25% above the prior year. Then they raised FY26 guidance from ~$3.14–$3.16 billion to $3.282–$3.301 billion. That's the machine. Every single quarter, for three years.
To invest well in Zscaler you also need to hold the uncomfortable parts of the thesis honestly. Stock-based compensation runs at roughly 24.6% of revenue - high by any standard. The company reported a GAAP net loss of $11.6 million in Q1 FY26 despite $788 million in revenue, driven almost entirely by SBC. Annual dilution from SBC and convertible debt conversion runs 3–4%. There are no share buybacks. These are real costs to current shareholders and they matter. The non-GAAP EPS beat tells you how the business operates. The GAAP numbers tell you how much management is being compensated through equity. The investor's job is to weight both - and to decide whether the operating quality of the business justifies the dilution drag. At 8x EV/Revenue, and with a Rule of 78 on FCF, I believe the answer is yes by a wide margin.
The beat-and-raise pattern isn't accidental. It reflects extraordinary forward visibility into contracted revenue through RPO, a cost structure that's predictable and subscription-driven, and a sales motion - Z-Flex - that's actively reducing the friction of closing large multi-year deals. But the market, in its current fear state about SaaS broadly, is confusing Zscaler with a seat-based productivity tool that AI might displace. Wrong category entirely. And that category error is exactly what patient investors get paid to recognise.
The Booking Machine - Z-Flex and RPO Tell the Real Story
EPS is the rearview mirror. RPO and bookings data are the windshield. Both are pointing in the same direction right now - and it isn't down.
Z-Flex is Zscaler's consumption-based flexible contract model, and the growth rate deserves more attention than the stock price currently implies. Q3'25: $65 million booked. Q4'25: $100 million. Q1'26: $175 million. Q2'26: $290 million plus - over 65% quarter-on-quarter growth. Three quarters ago this was an interesting experiment. Now it's the company's most powerful sales motion.
The reason it works is simple. Z-Flex eliminates the single biggest friction point in enterprise security procurement: the upfront commitment to a full Zero Trust transformation. Every CISO knows they need to move off legacy firewall architecture. But the CFO isn't signing a $20 million five-year platform contract before seeing ROI. Z-Flex threads that needle - multi-year commitment with the flexibility to activate or swap modules without going back through procurement. Start where the budget allows. See the value. Expand. Average contract runs four years. In under twelve months, the program has generated nearly $650 million in total contract value. That's not a slow ramp.
The deal quality backs this up. An eight-figure, five-year Z-Flex contract with an insurance company that expanded module adoption from eleven to sixteen - including AI Security products. A Fortune 500 services firm that doubled its entire ARR through Z-Flex. These aren't pilots. They're enterprise-scale multi-year commitments, signed at exactly the moment when the market is pricing Zscaler as though it's losing customers. And the direct sales channel - bypassing resellers - grew from 11% to 15% of revenue year-on-year. More direct relationships, better margins, faster expansion. The machine is tightening, not loosening.
RPO tells the same story. From $3.8 billion in Q3'24 to $6.1 billion in Q2'26 - 31% year-on-year growth, with the rate itself accelerating (35% in Q1'26, settling to 31% in Q2'26 as comparables got tougher). This is contracted, committed future revenue. When RPO grows faster than recognised revenue, the bookings pipeline is expanding ahead of what hits the income statement. Zscaler is building a revenue buffer that will support reported growth well into FY27 and FY28 - regardless of what the macro environment does in the next six months.
The AI-Security Frontier - The Opportunity the Market Hasn't Priced In
Here's the central irony of the bear case: the very thing markets fear - artificial intelligence - is actually the strongest tailwind Zscaler has ever had. Every AI model deployment, every AI agent touching internal systems, every GenAI SaaS tool employees are running introduces attack surfaces that legacy security architectures are completely blind to. Zscaler built the framework to secure that new landscape. The disruption narrative has the direction exactly backwards.
The AI-Security ARR figure - $400 million and growing toward $500 million by FY26 end - represents products that barely existed eighteen months ago, and the pace at which they are growing should reframe the entire bear narrative. CEO Jay Chaudhry said on the Q1 FY26 earnings call: "I'm particularly pleased with our AI Security pillar, which grew over 80% year-over-year and has already exceeded our FY '26 target of $400 million ARR, three quarters earlier than expected. With the strong demand, I expect AI Security ARR to exceed $0.5 billion by the end of this fiscal year." A target reached three quarters early is not a company struggling with AI disruption. It is a company that turned the threat narrative into a revenue stream.
Two acquisitions in H2 2025 underpin the momentum. Red Canary, acquired in August for $675 million, is a Managed Detection and Response provider - advanced security tooling combined with human threat hunters. By Q1 FY26 it was already running ahead of schedule: the CFO confirmed Red Canary exceeded its internal $3 million quarterly ARR growth target in its first quarter inside Zscaler. SPLX, acquired in November, brought AI Red Teaming - automated and continuous testing of AI applications for hallucination, bias, behaviour drift, and adversarial attack resistance. Early customers include a Fortune 150 transportation company and a Fortune 100 service provider.
And the threat isn't theoretical. Chaudhry disclosed this on the earnings call: "One of the largest AI companies recently reported that a bad actor hijacked its AI coding assistant to autonomously perform a large-scale cyberattack against multiple organisations." AI agents access sensitive data, touch internal systems, execute code, communicate with external services. Every one of those actions is an attack surface the legacy castle-and-moat model can't see. Zscaler AI Guard is licensed on a token basis, not a seat basis - so as AI agents proliferate (Citi estimates they'll eventually outnumber human workers), Zscaler's addressable revenue expands without needing to on-board a single additional human user. The SaaSpocalypse narrative gets the direction exactly backwards for Zscaler.
Data Security Everywhere ARR is already tracking around $450 million - a fully separate stream from the Zero Trust core - and growing faster than total ARR. 450+ Zero Trust Everywhere enterprises, three quarters ahead of schedule. ZDX Copilot, Risk360, Business Insights, Identity Threat Detection, Unified Vulnerability Management, Cyber Asset Attack Surface Management: products that didn't exist at meaningful scale when ZS was at $337. They exist now, they're generating ARR, and they address a TAM the company puts at $19 billion for Agentic Operations alone. None of this is priced into 8x EV/Revenue.
Margins, Free Cash Flow & Guidance - The Financial Architecture
The three-year margin progression is worth walking through. Gross profit went from $401 million in Q1'24 to $630 million in Q1'26 - 57% growth, margins holding steady at 80%. Operating profit nearly doubled: $90 million at 18% margin to $172 million at 22%. Free cash flow went from $225 million to $413 million - an 84% increase - with margin expanding from 45% to 52%. That's not a company spending its way to revenue. That's a company where scale is compounding exactly the way high-margin SaaS theory says it should. Every incremental dollar of revenue generates more free cash than the one before it.
Simple version: the business is getting more profitable as it gets bigger. That doesn't describe many companies right now.
FY26 guidance - raised after each of the first two quarters - stands at $3.282–$3.301 billion in revenue, $3.698–$3.718 billion in ARR, adjusted EPS of $3.78–$3.82, and a FCF margin guide of 26.0–26.5% for the full year. The FCF guide sits slightly below FY25's 27.2% - management has been transparent about why: AI Security and Data Security products are being deployed on public clouds at higher near-term infrastructure cost to accelerate go-to-market speed rather than optimise margins immediately. A deliberate short-term trade for long-term payoff as those products scale. And the broader trend is unambiguous: non-GAAP operating margins have expanded 6.8 percentage points since FY23. SaaS economics mean further leverage is nearly automatic as revenue grows.
The balance sheet deserves a mention. $3.3 billion in cash and short-term investments at quarter-end. $1.7 billion in convertible notes at 0% coupon maturing 2028. Current ratio of 1.75. Net cash position approximately $1.6 billion. The company has already shown appetite for strategic AI acquisitions - Red Canary, SPLX - and has the capacity to keep deploying into the fastest-growing parts of the market. No existential financing risk. No debt-service pressure. A balance sheet that looks like a fortress, which is appropriate for a company that sells them.
The $100 Billion Opportunity - Revenue That's Still Ahead
Zscaler generates roughly $3.3 billion in annual recurring revenue. Its serviceable addressable market is $100 billion - $65 billion from Zero Trust Everywhere, $20 billion from Data Protection, $19 billion from Agentic Operations. Even with generous market-share assumptions, the company has captured less than 4% of its own SAM. The runway isn't measured in quarters. It's measured in years of compounding from a base that barely scratches the surface.
What makes this credible rather than slide-deck aspiration is that each SAM segment is being addressed with products already generating meaningful ARR. Zero Trust Everywhere underpins the $3.2 billion ARR base. Data Security is approaching $450 million. Agentic Operations and AI-Security together are tracking toward $500 million by year-end. Zscaler isn't pitching a market it might eventually address. It's already inside it, compounding.
One dynamic that doesn't get enough attention: 53.8% of revenue now comes from expanding existing customers, not new logos. That's a structural tell - the platform has genuine land-and-expand economics. Customers aren't churning. They're deepening. The 8-figure insurance company from the Q1 call (11 modules in, now at 16) isn't a one-off anecdote. It's the pattern. And Z-Flex makes that pattern easier to replicate at scale by removing the upfront commitment barrier that used to slow enterprise adoption.
Valuation vs. Peers - The Discount Is Real
The bear case often lands on "still expensive." The data says otherwise. At current prices, Zscaler is the cheapest name in its peer group on every single metric - and the only one with a five-year revenue CAGR above 40%. Cheapest. Fastest-growing. That combination isn't supposed to exist.
| Company | EV / Sales | P / E (fwd) | P / FCF | 5Y Rev CAGR |
|---|---|---|---|---|
| ZS (Zscaler) | 8.2× | 41× | 30× | 44% |
| CRWD (CrowdStrike) | 21.5× | 88× | 88× | 41% |
| NET (Cloudflare) | 31.3× | 174× | 262× | 38% |
| PANW (Palo Alto) | 13.2× | 45× | 38× | 22% |
Sources: FactSet / YCharts consensus estimates, March 2026. Forward P/E based on non-GAAP EPS.
The competitive question I keep coming back to: can anyone actually build this? Microsoft has Defender and Entra. CrowdStrike has Falcon. Palo Alto has Prisma. Each competes with Zscaler at the edges. None has built a cloud-native, globally distributed proxy architecture with Zscaler's inspection depth and breadth. Not even close.
Palo Alto deserves specific attention because their playbook is the sharpest in the market. The tactic: offer free bundled services for the duration of a competitor's contract to force migration conversations. Chaudhry addresses this directly - Zscaler wins those evaluations on technical merits because the inspection architecture isn't something Prisma Access can replicate at the data layer. "Platformization" is a compelling sales narrative. It's less compelling when the platform lacks the actual proxy infrastructure to deliver on it. And the data backs this: customers who run competitive evaluations against PANW still choose ZS in large-enterprise deals where security depth matters more than price incentives.
Building at Zscaler's platform level requires capital-intensive, infrastructure-first construction that takes a decade or more. The window for meaningful disruption was ten years ago. It's closed.
What the Bears Get Wrong - Attack Vectors vs. Fundamental Reality
In security parlance, an attack vector is the path an adversary uses to gain access to a system. The bear case on Zscaler relies on six attack vectors. Most can be neutralised by the data. One deserves an honest partial concession.
"Growth is decelerating - 22–23% guide is slower than 26% actuals. The best is behind us."
Guidance is intentionally conservative - the company has beaten it by 2–4 percentage points every quarter for three years. The FY26 guide of ~23% will almost certainly print closer to 26–28% on actuals. More importantly, RPO is growing at 31–35% - ahead of recognised revenue - which means the pipeline of future revenue is expanding, not contracting. Z-Flex bookings at $290M in a single quarter represent a new growth engine that wasn't factored into consensus estimates six months ago.
"AI will commoditize network security. Microsoft and CrowdStrike will roll up everything Zscaler does."
This confuses endpoint security (CrowdStrike's domain) and identity management (Microsoft's Entra) with network security and data access control (Zscaler's domain). They are different layers of the security stack and enterprises need all of them. More critically, AI is creating a massive new attack surface that none of those incumbents are positioned to secure at the network level - but Zscaler is. AI Security ARR is already at $400M and growing. The company isn't a casualty of AI. It's a beneficiary.
"The valuation is still too expensive for a growth slowdown environment. Even after falling 50%, it's not cheap."
At $145–$150, Zscaler trades at approximately 6.5–7x forward (FY26) revenue. In 2019, when the business was a fraction of its current size with far lower profitability and no FCF to speak of, it traded at similar multiples. The company now generates a 52% FCF margin, has $6.1B in contracted backlog, and is growing AI-Security revenue from zero. A premium to 2019 multiples is justified. Even a recovery to 10–11x FY27 revenue gets to $223–$246 without requiring any multiple expansion beyond historical norms.
"Enterprise IT budgets are under pressure - large deals will get pushed or cancelled."
Cybersecurity is the last line item that enterprises cut. Data breaches average $4.5M per incident and regulatory exposure in financial services, healthcare and critical infrastructure is rising - not falling. The Z-Flex model was specifically designed to address budget timing concerns by allowing companies to start small and consume more as they see value. That's why Z-Flex bookings accelerated 65%+ Q/Q in Q2'26 even in a cautious spending environment. The demand is there. The product matches the buying behaviour of cautious IT departments.
"Stock-based compensation is out of control - 24.6% of revenue in SBC means GAAP earnings are a fiction and shareholders are being silently diluted."
This one deserves an honest answer rather than dismissal. SBC at 24.6% of revenue is high, and the ~3–4% annual dilution is real. Zscaler's GAAP net loss in Q1 FY26 was -$11.6M - the profitability story depends entirely on non-GAAP adjustments. The counter: SBC as a percentage of revenue has been declining year over year as the revenue base scales, the company is generating $1.7B+ in real FCF annually, and the $3.3B cash balance with $1.7B in 0% convertible notes gives it optionality without needing to issue equity. High SBC is a feature of every major software-infrastructure company in the growth phase. The question is whether it normalises - and the trend says it is. Management's FY26 FCF guide of 26.3% (temporarily lower due to public cloud infrastructure deployment costs) still implies ~$1.1B in cash generation this fiscal year.
"Palo Alto is giving away security for free to knock out Zscaler. They'll bundle Prisma Access at zero marginal cost and starve ZS of new logos."
The "platformization" playbook is real and Palo Alto is executing it aggressively - offering to match a competitor's product for free for the duration of their existing contract to accelerate migration conversations. In mid-market and SMB, this is a genuine threat. In large enterprise, it isn't. The reason is architectural: Prisma Access is built on a VPN-backbone model with added cloud functionality. Zscaler is built from the ground up as a cloud-native proxy that sits between the user and the internet, inspecting traffic at the packet level. You cannot replicate that with bundling. When Fortune 500 IT security teams run bake-offs - which they do - Zscaler wins the technical evaluation at the data protection and inspection layer. PANW wins on price sensitivity and existing firewall relationships. Zscaler's 728 customers above $1M ARR and accelerating NRR at 115% suggest those technical wins are holding.
Three Scenarios - Conservative, Base & Bull
Each scenario uses FY27 estimates and an EV/revenue multiple calibrated to the growth and margin profile. FY27 starts August 2026. The 12-month holding period from entry is designed to capture the moment the FY27 revenue story becomes visible to the market - which is when re-ratings happen.
Probability-weight these three scenarios and the expected value lands comfortably above $200, against an entry of $145–$150. The risk/reward is strongly asymmetric. The conservative scenario - which requires both meaningful macro deterioration AND Zscaler underperforming its own conservative guidance - still results in a gain from entry. That's how strong the valuation floor is at 8x EV/Revenue with 52% FCF margins. The base and bull cases, anchored on conservative assumptions for a company with this track record, imply 50–65% upside. Setups like this don't come around often in large-cap tech.
Catalyst Roadmap - What Moves the Stock
No single binary catalyst is needed here. The thesis plays out across compounding datapoints over twelve months - each one narrowing the gap between what the stock is saying and what the business is doing.
Reading the Damage - Technicals Confirm an Extreme
I rarely build a thesis on technical analysis alone - the fundamentals need to lead. But in this case, the chart is a useful validator. It confirms that the ZS selloff has been severe enough to reach the kind of extreme readings that historically precede significant reversals in high-quality large-cap technology stocks.
The weekly chart is ugly and worth being honest about. The 50-day SMA sits at approximately $252 - more than 40% above the current price. The 200-day, the institutional benchmark for trend direction, is at approximately $189. ZS is well below both. A structural downtrend that accelerated straight through the $200 and $175 support zones. The stock peaked at $337 in late 2025 and has retraced more than 50% from that high. That's the damage. Own it.
The chart identifies the key structural levels. A double-top pattern around $268–$317 in mid-to-late 2025 triggered the breakdown and accelerated the current downtrend. Immediate resistance on any bounce is at $174 (+14.8% from the entry midpoint), then $214 (+41.2%), $268 (+76.8%), and the prior high cluster near $316 (+108.4%). The $145–$150 entry zone sits near documented support from the 2023–2024 base-building range - the same consolidation zone the stock used before its run to $337. History doesn't repeat, but it rhymes.
Most important: RSI at time of writing is in the 19–20 range. Deeply oversold by any standard measure. But what's notable is that even as price has continued making new lows, RSI has started showing positive divergence - selling momentum is exhausting itself. In large-cap technology, RSI readings this extreme have historically provided high-conviction entry points for investors willing to look past the fear. Not a guarantee. But a meaningful signal when combined with the fundamentals we've already covered.
No chart pattern guarantees a recovery. That's worth stating plainly. But when extreme oversold conditions coincide with accelerating fundamentals and all-time-low valuation, the probability of an asymmetric outcome tilts hard to the upside. The $145–$150 zone is where the fundamental thesis and the technical exhaustion signal converge at the same time. That's the kind of entry I look for.
The Trade - Execution Protocol
The following scenarios reflect the author’s personal analysis and are not investment recommendations. See our full disclaimer.
Zscaler at $145–$150 is a rare alignment: deeply discounted valuation, extreme technical oversold condition, and a business that is accelerating - not deteriorating. The setup is asymmetric. What it asks from investors is straightforward - size it right, execute systematically, and stay focused on the twelve-month window during which the catalysts above get the time to play out. The hard part isn't the analysis. It's holding through the noise while the market catches up to the fundamentals.
- ENTRY > Build in two tranches. Tranche 1 (60%) at $145–$150 immediately on confirmation of entry zone. Tranche 2 (40%) on any additional weakness toward $135–$140, or on the first technical bounce confirmation (close above $165 on rising volume) to average in with momentum.
- SIZE > 3–5% of a diversified equity portfolio is appropriate given moderate-to-high risk classification. Technology-focused investors may size toward the upper end given portfolio context. This is a growth stock with elevated sensitivity to interest rate expectations and macro sentiment - size accordingly.
- TP1 > Take 25–30% off the position at $185–$200. This zone represents near-term technical resistance and protects profit in the event the recovery stalls. Reduces cost basis materially while keeping core position in play.
- TP2 > Take a further 35–40% off at $215–$225. This is the base-case midpoint and the range where institutional demand from re-rating should create natural supply pressure. Locks in the majority of the base-case gain.
- TP3 > Hold the final 30–35% with a trailing stop below the prior quarterly low. In the bull scenario, let this portion run toward $246+. The AI-Security narrative has the potential to drive a re-rating that extends beyond the 12-month initial target.
- STOP > Hard stop on a sustained weekly close below $128. This would indicate either a fundamental deterioration - a dramatic guidance miss or major competitive loss - or a broad market de-risking severe enough to question all growth valuations. Below this level the thesis no longer holds.
- MONITOR > Track quarterly: RPO growth rate (deceleration below 25% would be a yellow flag), Z-Flex bookings trajectory, AI Security ARR vs. $500M target, and FY27 guide set in August 2026. Monthly: RSI and price relative to the $174 and $189 (SMA200) resistance levels.
Core Thesis - Three Sentences
- Zscaler is the dominant Zero Trust cloud security platform, generating $3.2B in ARR with 80% gross margins and a 52% FCF margin, trading at the cheapest valuation in its post-IPO history.
- The selloff is driven by sentiment, sector rotation, and macro fears - not by any fundamental deterioration in the business, which has beaten EPS estimates in twelve consecutive quarters and accelerated its bookings growth rate through the correction.
- The AI-Security opportunity - a $400M+ ARR stream growing from zero eighteen months ago - is not priced into the stock at $145–$150, and represents the single largest underappreciated source of multiple expansion over the next two to three years.
Important Disclaimer
This content is for informational and educational purposes only and does not constitute financial advice, investment recommendations, or solicitation to buy or sell any securities. Past performance does not guarantee future results. All investments carry risk, including the possible loss of principal. Zscaler, Inc. (NASDAQ: ZS) is a high-growth technology company subject to significant risks including: competitive pressure from Microsoft, CrowdStrike, Palo Alto Networks, and other cybersecurity vendors; dependence on continued enterprise adoption of Zero Trust architecture; macroeconomic sensitivity as a long-duration growth asset; concentration risk in enterprise IT spending; and potential for valuation compression if growth rates normalise toward 15% or below. The technical analysis presented reflects historical price and volume data and is not a guarantee of future price movements. RSI and moving average signals are lagging indicators with well-documented limitations. The scenario analysis and price targets are based on publicly available information, independent modelling, and analyst consensus data as of March 2026; actual results may differ materially. Always conduct your own due diligence and consult a qualified financial advisor before making any investment decision. Position sizing guidelines are general in nature and do not account for individual circumstances, tax situations, or risk tolerance.