In security, a false positive is when your system flags a threat that isn't one. Markets do the same thing. And right now, the ZS selloff is the most expensive false positive I've seen in cybersecurity in years. The stock lost more than 50% from its 2025 highs on two legs: first, a 13% single-day drop after Q1 FY26 earnings when a guidance raise wasn't dramatic enough for a market that had come to expect miracles; then a second wave down in February 2026 as the "SaaSpocalypse" narrative - vibe-coded AI tools reducing enterprise SaaS demand - swept indiscriminately through software. Zscaler got caught in that wave despite having almost nothing to do with it.
Here's what the business actually delivered while the stock was falling. Q2 FY26 revenue reaccelerated to 26% year-on-year - $815.8 million actual versus $798 million consensus. The remaining performance obligation hit $6.1 billion growing 31%. FCF margin reached 52% in Q1 FY26, 700 basis points above the prior year. Z-Flex booked $290 million in a single quarter - more than four times the Q3'25 pace - and generated nearly $650 million in total contract value in its first year, average term four years. AI Security ARR crossed $400 million three full quarters ahead of schedule. Twelve consecutive earnings beats. This is not deterioration. This is acceleration dressed in a falling stock price.
The entry zone of $XXX–$XXX represents roughly 8x EV/Revenue - an all-time low for Zscaler, against a five-year median of 15.3x and three-year median of 13.2x. ZS is cheaper than CrowdStrike, Cloudflare, and Palo Alto Networks on every valuation metric - EV/Sales, P/E, P/FCF - despite the fastest five-year revenue CAGR in the group at 44%. The path to $XXX–$XXX asks for nothing heroic. A partial recovery to 10–11x forward revenue on FY27 estimates. That's it. The AI-Security opportunity - a $100 billion SAM that barely existed eighteen months ago - isn't in any of those numbers. That is the margin of safety.
Key Metrics at a Glance
Let me be direct about what these numbers represent. Revenue growing 26% at $816 million scale isn't a company slowing down. It's a company expanding its lead. When RPO hits $6.1 billion growing faster than recognised revenue, customers are locking into longer, larger contracts before the income even hits the income statement. That's what mission-critical infrastructure looks like - not discretionary tooling that gets cut when IT budgets tighten.
The Rule of 40 is software's standard health check: revenue growth plus profit margin above 40 signals a sustainable, high-quality SaaS business. Zscaler scores 78 - growth of 26% plus Q1 FCF margin of 52% (the seasonal peak; full-year guide is 26–26.5% due to annual contract billing concentration in Q1) - one of the highest readings in the industry. Use non-GAAP operating margin of 22% instead and the score is 48. Still excellent. But the FCF number shows what the business actually earns before reinvestment decisions. And here's what the AI-disruption bears miss entirely: non-seat-based usage already accounts for more than 25% of new Annual Contract Value and is growing over 100% year-on-year. The market is pricing in an AI disruption that Zscaler is, in fact, benefiting from.
The customer quality numbers matter too. 728 customers paying above $1 million ARR - up 18% year-on-year. 3,886 paying above $100,000, also up 18%. Net revenue retention at 115%, meaning existing customers expand their spend by 15% every year without Zscaler needing to add a single new logo. The 52% FCF margin in Q1 FY26, up from 45% two years prior - that's the real signal. Not spending its way to growth. Growing into a cost structure already built for a far larger business.
What Zscaler Actually Is - and Why It's Hard to Displace
The biggest misunderstanding about Zscaler right now is that it's just another security vendor - an expensive point product that Microsoft or CrowdStrike could absorb tomorrow. That framing is wrong. It's also the reason the stock is mispriced.
Traditional enterprise security runs on what the industry calls "castle and moat": route all traffic through a firewall or VPN perimeter, and once someone's past the moat, treat them as trusted. The catastrophic flaw is obvious in hindsight - one compromised credential hands an attacker the whole network. Zscaler eliminates the moat entirely. Every request - from every user, device, application, or AI agent - is treated as an outside request until inspected and verified. No trusted interior. No perimeter to breach.
Zscaler built, from scratch, the world's largest security cloud. Its Zero Trust Exchange processes more than 500 billion daily transactions across 50 million users - and every novel threat discovered anywhere on that network instantly becomes a defence for everyone else. No enterprise can replicate this internally. The scale of threat intelligence is itself the product. It took fifteen years and billions in infrastructure capital to build. The moat isn't intellectual property a competitor can patent around - it's the network and the data flywheel it generates. Every transaction Zscaler inspects trains its AI to catch the next attack faster. More data, smarter models, better product, more customers, more data. That loop doesn't benefit a late-arriving competitor. At all.
Geographic diversification matters here. Americas is roughly 57% of revenue, EMEA 28%, APJ 15% - and all three are growing. So this isn't a US-only story exposed to a single regulatory or macro shock. As enterprises everywhere accelerate cloud migration, demand for cloud-native security architecture follows. Zscaler built that architecture at the only scale that actually matters.
"In the large enterprise space - about 20,000 employees - if anything, I would say the competition has become less. These large enterprise customers are CIOs, CISOs, they all know us. The biggest focus is: one, I want to remain safe, give me Zero Trust and help me secure my AI initiatives. Two, can you do it with greater ROI and remove some of the cost? A firewall company won't do that, even though they try to talk about platform - because the biggest spend in security is still firewalls. They have to cannibalize it. We like to cannibalize it."
- Jay Chaudhry, CEO, Zscaler - Morgan Stanley TMT Conference, March 2, 2026The platform now spans four solution pillars: Zero Trust Everywhere (users, branches, cloud workloads), Data Security Everywhere (DSPM, DLP for GenAI SaaS), Security for AI Applications (AI asset discovery, red teaming, AI Guardrails), and Agentic Operations (AI-powered IT and security ops). Each pillar has its own ARR stream. Zscaler isn't a one-dimensional product company anymore. It's becoming the security operating system for the AI enterprise - and most investors are still looking at the old model.
Twelve Consecutive Quarters of EPS Beats - Every Single One
There's one data point the current bear narrative can't get around: Zscaler has beaten consensus EPS estimates in every single quarter since FQ3 2022. Not most quarters. Not a strong track record with one or two misses. Every. Single. Quarter. FQ2'26 delivered $1.01 adjusted EPS against a $0.96 consensus - a beat on top of an already-elevated bar. Companies with structural deterioration don't do that. They miss.
Q1 FY26 is a useful template for how this team operates. Revenue guidance was $772M–$774M. They delivered $788M - a $15 million beat on a $773 million midpoint. EPS of $0.96 came in 11% above the guided range of $0.85–$0.86 and 25% above the prior year. Then they raised FY26 guidance from ~$3.14–$3.16 billion to $3.282–$3.301 billion. That's the machine. Every single quarter, for three years.
To invest well in Zscaler you also need to hold the uncomfortable parts of the thesis honestly. Stock-based compensation runs at roughly 24.6% of revenue - high by any standard. The company reported a GAAP net loss of $11.6 million in Q1 FY26 despite $788 million in revenue, driven almost entirely by SBC. Annual dilution from SBC and convertible debt conversion runs 3–4%. There are no share buybacks. These are real costs to current shareholders and they matter. The non-GAAP EPS beat tells you how the business operates. The GAAP numbers tell you how much management is being compensated through equity. The investor's job is to weight both - and to decide whether the operating quality of the business justifies the dilution drag. At 8x EV/Revenue, and with a Rule of 78 on FCF, I believe the answer is yes by a wide margin.
The beat-and-raise pattern isn't accidental. It reflects extraordinary forward visibility into contracted revenue through RPO, a cost structure that's predictable and subscription-driven, and a sales motion - Z-Flex - that's actively reducing the friction of closing large multi-year deals. But the market, in its current fear state about SaaS broadly, is confusing Zscaler with a seat-based productivity tool that AI might displace. Wrong category entirely. And that category error is exactly what patient investors get paid to recognise.
Important Disclaimer
This content is for informational and educational purposes only and does not constitute financial advice, investment recommendations, or solicitation to buy or sell any securities. Past performance does not guarantee future results. All investments carry risk, including the possible loss of principal. Zscaler, Inc. (NASDAQ: ZS) is a high-growth technology company subject to significant risks including: competitive pressure from Microsoft, CrowdStrike, Palo Alto Networks, and other cybersecurity vendors; dependence on continued enterprise adoption of Zero Trust architecture; macroeconomic sensitivity as a long-duration growth asset; concentration risk in enterprise IT spending; and potential for valuation compression if growth rates normalise toward 15% or below. The technical analysis presented reflects historical price and volume data and is not a guarantee of future price movements. RSI and moving average signals are lagging indicators with well-documented limitations. The scenario analysis and price targets are based on publicly available information, independent modelling, and analyst consensus data as of March 2026; actual results may differ materially. Always conduct your own due diligence and consult a qualified financial advisor before making any investment decision. Position sizing guidelines are general in nature and do not account for individual circumstances, tax situations, or risk tolerance.