Prospectus Summary
PROSPECTUS SUMMARY This summary highlights selected information that is presented in greater detail elsewhere in this prospectus. This summary does not contain all of the information you should consider before investing in our common stock. You should read this entire prospectus carefully, including the sections titled “Risk Factors,” “Selected Consolidated Financial and Other Data,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and “Business” and our consolidated financial statements and the related notes included elsewhere in this prospectus, before making an investment decision. Unless the context otherwise requires, the terms “Zscaler,” “the company,” “we,” “us” and “our” in this prospectus refer to Zscaler, Inc. and its consolidated subsidiaries. Our fiscal year end is July 31, and our fiscal quarters end on October 31, January 31, April 30 and July 31. Our fiscal years ended July 31, 2015, 2016 and 2017 are referred to herein as fiscal 2015, fiscal 2016 and fiscal 2017, respectively. Our fiscal year ending July 31, 2018 is referred to herein as fiscal 2018.ZSCALER, INC.
Mission Statement
Our mission is to empower organizations to realize the full potential of the cloud and mobility by securely connecting users to applications from any device, anywhere.
Overview
Zscaler was incorporated in 2007, during the early stages of cloud adoption and mobility, based on a vision that the internet would become the new corporate network as the cloud becomes the new data center. We predicted that with rapid cloud adoption and increasing workforce mobility, traditional perimeter security approaches would provide inadequate protection for users and data and an increasingly poor user experience. We pioneered a security cloud that represents a fundamental shift in the architectural design and approach to network security.
Enterprise applications are rapidly moving to the cloud to achieve greater IT agility, a faster pace of innovation and lower costs. Organizations are increasingly relying on internet destinations for a range of business activities, adopting new external SaaS applications for critical business functions and moving their internally managed applications to the public cloud, commonly known as Infrastructure-as-a-Service, or IaaS. Enterprise users now expect to be able to seamlessly access applications and data, wherever they are hosted, from any device, anywhere in the world. We believe these trends are indicative of the broader digital transformation agenda, as businesses increasingly succeed or fail based on their IT outcomes.
We believe that securing the on-premises corporate network to protect users and data is becoming increasingly irrelevant in a cloud and mobile-first world where organizations depend on the internet, a network they do not control and cannot secure, to access critical applications that power their business. We pioneered a new approach to security that connects the right user to the right application, regardless of network. Our cloud platform, which delivers security as a service, eliminates the need for traditional on-premises security appliances that are difficult to maintain and require compromises between security, cost and user experience. Our cloud platform incorporates the security functionality needed to enable users to safely utilize authorized applications and services based on an organization’s policies. Our solution is a purpose-built, multi-tenant, distributed cloud security platform that secures access for users and devices to applications and services, regardless of location.
Our multi-tenant architecture is distributed across more than 100 data centers globally, which allows us to secure users across 185 countries. Each day, we block over 100 million threats and perform over 120,000 unique
Index to Financial Statements
security updates. Our customers benefit from the network effect of our growing cloud because once a new threat is detected, it can be blocked for users across our entire customer base within minutes.
We have over 2,800 customers across all major geographies, and we currently count over 200 of the Forbes Global 2000 as customers. Our customers span every major industry, including airlines and transportation, conglomerates, consumer goods and retail, financial services, healthcare, manufacturing, media and communications, public sector and education, technology and telecommunications services.
Although we have a channel sales model, we use a joint sales approach in which our sales force develops relationships directly with our customers and engages at senior levels within IT organizations. We amplify our sales presence and effectiveness by leveraging our network of global telecommunications service provider, system integrator and value-added reseller partners. Many of these channel partners engage at the C-level to discuss strategic network transformation and cloud migration projects, and we work with these channel partners to deliver security solutions to their most important enterprise customers. Our service provider partners include us as an integral part of broad network transformation projects. Systems integrators bring us into customers as part of their cloud application migration programs. We also work with high-touch value-added resellers to broaden our reach to mid-market customers.
For fiscal 2015, 2016 and 2017, revenue was $53.7 million, $80.3 million and $125.7 million, respectively. Our net losses were $12.8 million, $27.4 million and $35.5 million in fiscal 2015, 2016 and 2017, respectively. For the six months ended January 31, 2017 and 2018, our revenue increased from $56.2 million to $84.8 million, representing a period-over-period revenue growth of 51%, while our net loss increased from $14.6 million to $17.9 million. We expect we will continue to incur net losses for the foreseeable future.
Industry Background
Traditional security approaches focused on establishing a perimeter around the corporate network
For over 30 years, IT security focused on protecting an organization by establishing a perimeter to secure the corporate network. This approach was based on the premise that all enterprise users, data and applications resided on the corporate network. To meet the requirements of this approach, organizations:
Cloud and mobility offer opportunities while also introducing new challenges for enterprises
Organizations are undergoing a massive shift in their IT strategies. The adoption of cloud applications and infrastructure, explosion of internet traffic volumes and shift to mobile-first computing enhance business agility
Index to Financial Statements
and have become a strategic imperative for CIOs. Organizations are embracing these trends to empower business users, increase speed of deployment, create new customer experiences, reengineer business processes and find new opportunities for growth. At the same time, it is difficult for enterprises to embrace these trends with the traditional “castle-and-moat” security architecture because it introduces several key IT challenges:
These challenges are exacerbated by an increasingly severe cyber threatscape
Today’s sophisticated hackers, motivated by financial, criminal and terrorist objectives, are exploiting the gaps left by existing network security approaches with increasingly sophisticated and evolving threats. The growing dependence on the internet has increased exposure to malicious or compromised websites. According to Mozilla Firefox, over 60% of browser-based internet traffic is encrypted. Encryption has become one of the most effective tactics used by hackers to avoid detection by existing appliances. As a result, organizations are more exposed than ever to today’s cyberattacks.
The traditional perimeter security approach is the principal reason enterprises struggle to realize the true benefits of cloud and mobility When users are mobile, working remotely or in branch offices, and the applications they use are in the cloud, routing traffic back across a “hub-and-spoke” network to the data center for access and security controls provides a poor user experience. To deliver a fast user experience, traffic needs to be routed directly to the internet. Routing traffic directly to the internet, while maintaining access and security controls, may require deployment of hundreds, if not thousands, of internet gateways, which would be prohibitively expensive. Even if organizations made these investments, this would create a false sense of security as traditional appliances were designed to protect the network and are limited in their ability to detect and prevent the increasing number and diversity of sophisticated threats in the cloud.
A new approach to security is needed
The adoption of cloud and mobility requires a new approach to secure users and data regardless of the network. The “castle-and-moat” security approach was effective when users, applications and devices resided on the corporate network, and the organization could be protected by securing the corporate network. However, as
Index to Financial Statements
enterprise applications move to the cloud, users move off the corporate network and new threat types emerge, the stacks of security appliances protecting the corporate network increasingly lose relevance and effectiveness. In a cloud-enabled and mobile-first world, security must be pervasive across the internet and capable of protecting users who directly access the cloud without connecting to a specific corporate network. Similarly, instead of the “castle-and-moat” approach where security is only applied if the user is on the network, security needs to be abstracted from the on-premises corporate network such that policies securely connect the right user to the right application regardless of device, location or network.
Our Solution
Our security cloud, which is distributed across more than 100 data centers around the world, helps organizations accelerate their IT transformation to the cloud. This enables the secure migration of applications from the corporate data center to the cloud and from a legacy “hub-and-spoke” network to a modern direct-to-cloud architecture.
Our approach applies policies set by an organization to securely connect the right user to the right application, regardless of the network. Unlike traditional “hub-and-spoke” architectures, where traffic is backhauled over dedicated Wide Area Networks, or WANs, to centralized gateways, our solution allows traffic to be routed locally and securely to the internet over broadband and cellular connections. We offer two principal cloud services:
Key benefits
Index to Financial Statements
experience. Additionally, our purpose-built network security technology applies numerous techniques to minimize processing overhead, which reduces latency as compared to appliances.
Competitive Strengths
Our competitive strengths include:
Market Opportunity
As applications are moving to the cloud, the corporate network is transforming from a “hub-and-spoke” to a direct-to-cloud architecture. This in turn is driving security transformation from a 30-year-old “castle-and-moat”
Index to Financial Statements
approach to a strategy that securely connects the right users to the right application regardless of the network. This creates a large opportunity to deliver cloud security services that replace traditional on-premises network security appliances and software. Our solution provides functionality that obviates the need for outbound and inbound internet gateways. The outbound internet gateway often includes URL filtering, anti-virus, content filtering, branch firewalls, advanced threat protection with sandboxing, and data loss prevention appliances. Inbound gateways typically include global load balancers, distributed denial of service, or DDoS, prevention, external firewalls, VPN concentrators and internal firewalls appliances. Based on our analysis using IDC data, $17.7 billion annually is spent on disparate security appliances to perform the functions we offer in our platform.
In addition to providing better security and user experience, we offer our customers the opportunity to reduce their overall networking complexity and cost. As organizations rearchitect their traditional “hub-and-spoke” corporate networks to adopt our direct-to-cloud architecture, the reduced need for supporting networking infrastructure and bandwidth such as Multiprotocol Label Switching, or MPLS, edge routers, ATM switches, ethernet edge routers and WAN optimization increases the return on investment of our solution.
Growth Strategies
Our goal is to empower organizations worldwide to realize the full potential of cloud and mobility. Key elements of our strategy include:
Risks Associated with Our Business and Investments in Our Common Stock
Our business is subject to numerous risks and uncertainties, including those highlighted in the section titled “Risk Factors” immediately following this prospectus summary. These risks include, but are not limited to, the following:
Index to Financial Statements
Corporate Information
We were incorporated in Delaware in September 2007 as SafeChannel, Inc., and in August 2008 we changed our name to Zscaler, Inc. Our principal executive offices are located at 110 Rose Orchard Way, San Jose, California 95134, and our telephone number is (408) 533-0288. Our website address is www.zscaler.com. Information contained on, or that can be accessed through, our website does not constitute part of this prospectus and inclusions of our website address in this prospectus are inactive textual references only.
The Zscaler design logo, “Zscaler” and our other registered or common law trademarks, service marks or trade names appearing in this prospectus are the property of Zscaler, Inc. Other trademarks and trade names referred to in this prospectus are the property of their respective owners.
Implications of Being an Emerging Growth Company
We are an “emerging growth company” as defined in the Jumpstart Our Business Startups Act of 2012, or the JOBS Act. An emerging growth company may take advantage of specified reduced reporting requirements that are otherwise applicable generally to public companies. These reduced reporting requirements include:
Index to Financial Statements
We will remain an emerging growth company until the earliest to occur of: (i) the first fiscal year following the fifth anniversary of our initial public offering; (ii) the first fiscal year after our annual gross revenue is $1.07 billion or more; (iii) the date on which we have, during the previous three-year period, issued more than $1.0 billion in non-convertible debt securities; or (iv) as of the end of any fiscal year in which the market value of our common stock held by non-affiliates exceeded $700.0 million as of the end of the second quarter of that fiscal year.
We may choose to take advantage of some, but not all, of the available benefits under the JOBS Act. We are choosing to irrevocably “opt out” of the extended transition periods available under the JOBS Act for complying with new or revised accounting standards, but we intend to take advantage of the other exemptions discussed above. Accordingly, the information contained herein may be different than the information you receive from other public companies in which you hold stock.
See the section titled “Risk Factors—Risks Related to the Offering and Ownership of Our Common Stock—We are an ‘emerging growth company’ and we cannot be certain if the reduced disclosure requirements applicable to emerging growth companies will make our common stock less attractive to investors for certain risks related to our status as an emerging growth company.”
Index to Financial Statements
The Offering
Index to Financial Statements
Certain entities associated with Charles Giancarlo, Lane Bess, Scott Darling and Karen Blasing, each a member of our board of directors, have indicated an interest in purchasing up to an aggregate of approximately $5.0 million of shares of our common stock in this offering (or an aggregate of shares based on the midpoint of the estimated offering price range set forth on the cover page of this prospectus) at the initial public offering price. Because these indications of interest are not binding agreements or commitments to purchase, the underwriters could determine to sell more, less or no shares to any of these potential investors and any of these potential investors could determine to purchase more, less or no shares in this offering. The underwriters will receive the same discount from any shares sold to these existing stockholders as they will from any other shares sold to the public in this offering. Any shares purchased by such stockholders will be subject to lock-up restrictions described in the section entitled “Shares Eligible for Future Sale.”
The number of shares of our common stock that will be outstanding after this offering is based on 157,998,166 shares of our common stock (including shares of our convertible preferred stock on an as-converted basis) outstanding as of January 31, 2018, and excludes:
Our 2018 Plan and our ESPP each provide for annual automatic increases in the number of shares reserved thereunder, and our 2018 Plan also provides for increases to the number of shares of common stock that may be granted thereunder based on shares underlying any awards under our 2007 Stock Plan, or the 2007 Plan, that expire, are forfeited or are otherwise terminated, as more fully described in the section titled “Executive Compensation—Employee Benefit and Stock Plans.”
Except as otherwise indicated, all information in this prospectus assumes:
Index to Financial Statements
Summary Consolidated Financial and Other Data
The following table summarizes our consolidated financial and other data. The summary consolidated statements of operations data presented below for fiscal 2015, 2016 and 2017 (except for the pro forma share and pro forma net loss per share information) is derived from our audited consolidated financial statements that are included elsewhere in this prospectus. The summary consolidated statements of operations data presented below for the six months ended January 31, 2017 and 2018 and the consolidated balance sheet data as of January 31, 2018 are derived from our unaudited interim consolidated financial statements that are included elsewhere in this prospectus. In management’s opinion, the unaudited interim consolidated financial statements include all adjustments necessary to state fairly our financial position as of January 31, 2018 and the results of operations and cash flows for the six months ended January 31, 2017 and 2018. Our historical results are not necessarily indicative of the results that may be expected in the future and our results for the six months ended January 31, 2018 are not necessarily indicative of the results that may be expected for the full fiscal year ending July 31, 2018 or any other period.
Index to Financial Statements
You should read this data together with our consolidated financial statements and related notes included elsewhere in this prospectus and the sections titled “Selected Consolidated Financial and Other Data” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations.”
Index to Financial Statements
Index to Financial Statements
Non-GAAP Financial Measures and Key Business Metrics
Refer to the section titled “Selected Consolidated Financial and Other Data—Non-GAAP Financial Measures” for additional information and a reconciliation of our non-GAAP financial measures to the most directly comparable financial measures stated in accordance with U.S. GAAP.
Non-GAAP Financial Measures
In addition to our results determined in accordance with U.S. GAAP, we believe the following non-GAAP measures are useful in evaluating our operating performance. We use the following non-GAAP financial information to evaluate our ongoing operations and for internal planning and forecasting purposes. We believe that non-GAAP financial information, when taken collectively, may be helpful to investors because it provides consistency and comparability with past financial performance. However, non-GAAP financial information is presented for supplemental informational purposes only, has limitations as an analytical tool and should not be considered in isolation or as a substitute for financial information presented in accordance with U.S. GAAP. In particular, free cash flow is not a substitute for cash used in operating activities. Additionally, the utility of free cash flow as a measure of our liquidity is further limited as it does not represent the total increase or decrease in our cash balance for a given period. In addition, other companies, including companies in our industry, may calculate similarly-titled non-GAAP measures differently or may use other measures to evaluate their performance, all of which could reduce the usefulness of our non-GAAP financial measures as tools for comparison. A reconciliation is provided in “Selected Consolidated Financial and Other Data—Non-GAAP Financial Measures” for each non-GAAP financial measure to the most directly comparable financial measure stated in accordance with U.S. GAAP. Investors are encouraged to review the related GAAP financial measures and the reconciliation of these non-GAAP financial measures to their most directly comparable GAAP financial measures, and not to rely on any single financial measure to evaluate our business.
Index to Financial Statements
Non-GAAP Gross Profit and Non-GAAP Gross Margin
We define non-GAAP gross profit and non-GAAP gross margin as GAAP gross profit and GAAP gross margin, respectively, excluding stock-based compensation expense.