Zscaler 2QFY26 Earnings: The Penalty Box and the Pattern
Zscaler's best quarter in two years met a market that's repricing the entire SaaS regime. We've seen this before, and we know how it resolved.
TL;DR
Zscaler delivered its strongest quarter in two years (26% growth, Rule of 62), but shares fell ~10% as investors fixated on organic guide math.
The real story: Z-Flex lock-in and consumption pricing are quietly reshaping the growth algorithm beneath headline deceleration.
At ~7x revenue, the stock reflects a maturing SaaS multiple, not a security infrastructure platform compounding backlog and traffic.
“It’s not clear why the stock is getting hit on the report other than people were ‘hoping for more.’ The results are ‘fundamentally fine’ but likely ‘not good enough.’”
— Vital Knowledge, February 26, 2026
I have been writing positively about Zscaler’s architectural advantages for several quarters now, the “Hotel California” lock-in of Z-Flex, the positioning as the enforcement layer for agentic AI traffic, the RPO backlog building far ahead of recognized revenue. And for several quarters, the market has violently disagreed with me. The stock has walked down a staircase from $337 to $152, a 55% drawdown, while the business improved on nearly every metric that matters.
In public markets, being early is indistinguishable from being wrong. So it is worth asking directly: am I just wrong? To answer that, I need the right framework. And the right framework isn’t another security company.
We’ve Seen This Movie Before
In January 2016, ServiceNow traded at $62, roughly 5x forward revenue, down 40% from its 2014 highs. Revenue growth was decelerating from 50%+ to the low-30s. The narrative was that cloud software was “maturing.” Amazon and Microsoft were bundling competitive features into their own stacks. Investors argued that growth SaaS companies were structurally overvalued and that multiples needed to permanently reset. The sector was in a penalty box.
ServiceNow’s business, meanwhile, was doing something the stock didn’t reflect. Net retention rates were expanding. Enterprise deal sizes were growing. The company was quietly becoming the operating system for IT workflows, not because the product was irreplaceable on day one, but because after three years of embedding into procurement, HR, and security workflows, ripping it out became a multi-quarter, multi-team project nobody would authorize. Switching costs were compounding invisibly while the stock went sideways.
By 2019, ServiceNow traded at $280. It quintupled from its penalty box low. Growth didn’t re-accelerate to 50%, it stabilized in the mid-20s. The multiple re-rated because the market belatedly recognized that durable 25% growth with expanding margins and infrastructure-level switching costs was worth a premium, not a discount. The business hadn’t changed. The market’s framework for evaluating it had.
I bring this up because the parallel to Zscaler today is striking. AI is expanding the enterprise attack surface the same way cloud expanded the enterprise footprint a decade ago. The fear that “AI replaces security” is equivalent to the fear that “cloud replaces enterprise software”, directionally wrong, but correct in the sense that the architecture changes. Zscaler is betting that its inline switchboard architecture is the right one for the AI era, just as it was the right one for the cloud era. The stock is priced as if growth is structurally capped and architectural risk is rising.
There is a real risk embedded in this analogy, and I want to be explicit about it. The structural question, raised by several thoughtful analysts, is whether the enforcement layer migrates away from the cloud proxy and toward the endpoint, browser, or identity layer. If Microsoft Entra and Edge become the enforcement point for most enterprise traffic, Zscaler’s cloud proxy could become redundant middleware rather than essential infrastructure. Zscaler’s SquareX acquisition and Entra partnership are defensive moves against exactly this risk. It is non-zero, and it represents the upper bound on conviction. But to judge whether Zscaler is actually losing that architectural war, or simply suffering through a noisy model transition, we need to look at what they just reported.
Why SaaS Is in the Penalty Box
First, let’s acknowledge what’s actually driving the pain, because most of it has nothing to do with Zscaler.
In 2020–2021, a 25%-growth SaaS company was a rare asset in a zero-rate world. Capital paid 15–20x revenue because there was nowhere else to find durable, high-margin growth. In 2026, that same profile competes for capital against NVIDIA, power infrastructure, AI compute, and data center buildouts, categories with more dramatic near-term revenue acceleration. SaaS isn’t broken. It’s no longer scarce.
Three forces are compressing the cybersecurity cohort specifically. First, AI narrative whiplash, every new AI capability (Anthropic’s security tools on February 23, Microsoft Copilot features) triggers a reflexive selloff, conflating “AI changes security architecture” (true) with “AI replaces security spending” (false). Zscaler fell 11% on February 23 alone, three days before earnings, on an announcement that had nothing to do with inline enforcement. Second, capital rotation. These are portfolio rebalancing decisions, not fundamental calls. Third, the “good enough” bundling fear, Microsoft is packaging security into E5 licenses, Palo Alto is pitching SASE consolidation. The narrative, not yet the reality, is that baseline security becomes table stakes, commoditizing the low end of what Zscaler sells.
This is the environment into which Zscaler reported Q2. Every metric beat. Every guide raised. The stock dropped 10%. The penalty box held.
The Quarter: Beats, Raises, and a Red Canary
Here are the numbers, stripped of narrative:
That is a clean beat across every line. Revenue growth re-accelerated from 21% in Q4 FY25 to 26% in both Q1 and Q2, a genuinely rare inflection for a $3B+ ARR company. So why the 10% haircut?
Because Wall Street did the math on the guidance raise and didn’t like what it found.
Management raised full-year FY26 revenue guidance by ~$24 million at the midpoint. Solid. But buried in the commentary, CFO Kevin Rubin noted they were raising the expected revenue contribution from Red Canary, their MDR acquisition, by $35 million, from $90 million to $125 million. If total guidance goes up by $24 million but the acquisition goes up by $35 million, the organic revenue guide arguably contracted. They didn’t even pass through the $17 million Q2 beat to the organic full-year outlook.
Rubin provided air cover, noting that organic net new ARR growth guidance was actually raised from 6.7% to 9.5% for FY26, a real improvement. He also flagged that Red Canary’s post-acquisition churn has been “elevated.” Both statements are true. But by the time this nuance landed, 45 minutes into the call, the stock was already down 8%. The fast-money accounts had done the subtraction, hit sell, and moved on.
This is the credibility paradox of having the most conservative CFO in enterprise software. Rubin has beaten his own revenue guidance for 29 consecutive quarters, averaging ~$20 million above the high end. The beat is structurally priced in before the number hits. All that remains is the guide, and the guide drew a deceleration path: 26% → 23% in Q3 → ~21% implied in Q4. Whether that’s real deceleration or Rubin’s 29th consecutive sandbagged setup is the entire investment debate.
The Variant Perception: Pricing the Wrong Company
Here is what I think the market is getting wrong, stated as clearly as I can:
Consensus sees a decelerating SaaS company growing in the low-20s heading toward high-teens, worth 6–8x revenue. The correct framing is a business mid-transition from per-seat SaaS to consumption-based security infrastructure, with its fastest-growing revenue stream, 100%+ YoY, invisible in every consensus model I’ve reviewed. The implication is that the market is valuing the legacy pricing model while the new model compounds underneath.
Three pieces of evidence from Q2:
The lock-in is reaching critical mass. Z-Flex, Zscaler’s flexible platform licensing program, generated $290 million in total contract value in Q2, up 66% sequentially, roughly 4.5x the level three quarters ago, and now over 30% of all RPO bookings. Average deal: 8-figure TCV. Average term: 4 years. Chaudhry shared that customers on average triple their initial purchase within four years. A Fortune 500 retailer landed as a brand-new customer with 11 modules in a single 5-year commitment. This is the Hotel California at scale, once 16 modules are woven into your security architecture, ripping them out is an 18-month project no CISO will authorize. And it explains the RPO-revenue gap: Z-Flex TCV hits backlog immediately but rolls into recognized ARR over 6–12 months as modules activate. The market watches the speedometer. The engine is building torque.
The business model is shifting underneath the P&L. Non-seat-based, consumption-priced solutions, Zero Trust Branch (per device), Zero Trust Cloud (per traffic volume), AI Security (per token), delivered over 25% of new ACV in Q2, with related ARR growing 100%+. This changes the growth algorithm fundamentally. In a seat-based model, revenue scales with headcount. In a consumption model, revenue scales with traffic. Chaudhry was direct on the call: AI agents don’t have seats, but they generate massive traffic, and every agent-to-application communication routes through the Zero Trust Exchange. They’re processing millions of MCP requests monthly, up from zero two quarters ago. If even a fraction of enterprise agentic traffic routes through the Exchange by default, the consensus revenue models, which assume steady deceleration to ~19% by FY28, are pricing the wrong company.
Management’s disclosure choices tell you where the confidence is. I track what companies introduce, drop, and maintain across earnings reports. In Q2, Rubin volunteered for the first time that core ZIA/ZPA is growing “mid-teens” on its ~$2 billion base, pre-empting a bear concern about core erosion that he knew was suppressing the multiple. He introduced non-seat revenue as a metric because it’s accelerating. But he dropped the specific AI Security ARR number that was $400 million in Q1, restructuring the narrative into two sub-pillars instead. Companies spotlight metrics that are beating expectations and restructure metrics that are merely tracking. AI Security is likely in the $430–460M range: solid, but not accelerating fast enough for a headline. The metric management wants you watching is Z-Flex TCV. They’re right to.
The Three-Year Math
Frameworks are useful. Numbers are better. Here are three scenarios with explicit assumptions:
Probability-weighted expected value: ~$213, or roughly 40% upside from here.
The asymmetry matters. The bear case requires active fundamental deterioration, growth fading to high-teens and multiple compression, not just “more of the same, slower.” The base case requires nothing heroic: consensus execution plus a modest re-rating from 6.4x to 8x as $876 million in FY26 free cash flow becomes undeniable. The bull case needs the consumption model to scale and the market to re-rate Zscaler from “decelerating SaaS” to “security infrastructure.” The upside/downside skew is roughly 2.3x, you risk $27 of downside for ~$61 of expected upside.
One data point for context: comparable 20%+ growers with 25%+ FCF margins, trade at 10–15x NTM revenue. Zscaler at 7x. For that discount to be justified, you need to believe the business is structurally inferior to its peers. Nothing in Q2 supports that conclusion.
What Confirms the Thesis, and What Kills It
Theses are only useful if they’re falsifiable. Here’s what I’m tracking and what would change my mind.
Confirmation signals over the next two quarters:
Z-Flex TCV crossing $350 million in Q3, which would put it at 35–40% of total bookings, the point at which revenue visibility starts resembling infrastructure durability rather than SaaS. Non-seat ACV mix holding at 25% or rising toward 30%, confirming the consumption transition isn’t a one-quarter artifact. The RPO-revenue gap persisting at 5+ points, meaning the backlog is still building ahead of the P&L. Organic net new ARR delivering on the 9.5% full-year guide, or better, beating it, which would confirm Rubin’s conservatism. And large deal counts sustaining the 2x year-over-year pace in the Americas, confirming enterprise consolidation onto the Zscaler platform.
Invalidation signals, what kills the thesis:
Revenue growth drifting below 20% without a clear seasonal explanation. RPO growth decelerating to match revenue, which would mean the backlog is being consumed, not built. Z-Flex penetration stalling at 30% of bookings for two or more consecutive quarters. Non-seat ACV mix falling back below 20%. Gross margins compressing below 79% from hardware cost inflation that management flagged proactively this quarter. Or core ZIA/ZPA growth dropping from mid-teens to single digits, the one signal that would indicate genuine competitive displacement.
I want to be precise about this: if three or more of those invalidation signals trigger simultaneously, the 2016 analogy breaks. That would mean the penalty box isn’t temporary multiple compression, it’s the market correctly pricing a business losing its architectural moat. At that point, 6.4x isn’t cheap. It’s fair.
Early, Not Wrong
In 2016, ServiceNow went sideways for 18 months while the business compounded underneath. The re-rate came not from a single catalyst quarter, but from the market gradually recognizing that switching costs had made the business more durable than the multiple implied. By the time the stock reflected the reality, the easy money had already been made by the investors who bought into the penalty box.
Zscaler’s Z-Flex is building the same compounding lock-in in real time, $650 million in cumulative commitments, customers tripling their spend, consumption pricing expanding the addressable market beyond headcount. The Q2 print didn’t break the company out of the penalty box. No single quarter will. Penalty boxes break on regime shifts, either the company forces the market to re-rate with undeniable acceleration, or capital flows rotate back toward software as the next leg of the AI trade.
The penalty box is real. The pain is real. The timing is unknowable. But the pattern is identifiable: the business has strengthened faster than the stock has appreciated, but not yet fast enough to force a regime change. Q2 moves this closer to “early” than “wrong.”
In 2016, that distinction was worth a 5x return for those with the patience to hold through the discomfort. The price of admission then, as now, was the willingness to own a thesis the market wasn’t ready to validate.
Disclaimer:
The content does not constitute any kind of investment or financial advice. Kindly reach out to your advisor for any investment-related advice. Please refer to the tab “Legal | Disclaimer” to read the complete disclaimer.