ZS · Zscaler, Inc. · Stock research

Current Thesis

The leg being bought is a post-reset re-rating: a zero-trust platform still compounding ARR at 25% that was repriced as a decelerating asset on one guidance line. On 2026-05-26 Zscaler reported Q3 FY26 revenue of $850.5M (+25% YoY) and ARR of $3,525M (+25% YoY), with non-GAAP operating margin at an all-time-high 23% — and then framed FY27 revenue growth at 16–17% against a street looking for roughly 19–20%. Shares fell about 31.5% on 2026-05-27, one of the worst single sessions in the company's history.

The last completed daily close is $168.68 (2026-08-07), 49.8% below the 52-week high of $336.27. What an investor is underwriting now is that the May framing was a conservative reset by a CFO managing through sales-leadership turnover, and that the 2026-09-03 Q4 print — the fiscal-year-end quarter, carrying the first formal FY27 guidance — lands at or above that bar. That print is the binary. Nothing between now and then resolves it.

Bullish and bearish views on Zscaler, Inc.

The model's bull view on Zscaler, Inc. (ZS), in brief: ARR compounding held through the reset. ARR $3,525M, +25% YoY, with $166M net new ARR in Q3 FY26 (release 2026-05-26). The multiple, rather than the growth print, did the damage. Margin structure improved into the sell-off. Non-GAAP operating margin reached an all-time high of… The bear view: FY27 is the first sub-20% growth frame in the company's public life. Both cases follow in full.

Bull Case

• ARR compounding held through the reset. ARR $3,525M, +25% YoY, with $166M net new ARR in Q3 FY26 (release 2026-05-26). The multiple, rather than the growth print, did the damage.
• Margin structure improved into the sell-off. Non-GAAP operating margin reached an all-time high of 23% in Q3 FY26, and FY26 guidance was set at revenue $3.3295–3.3325B (+24.6–24.7%) with non-GAAP EPS of $4.10–4.11 (+25%).
• The bear premise got contradicted from outside the company. On 2026-07-14 IBM stated publicly that enterprise AI spending is not crowding out cybersecurity budgets; cybersecurity ETFs rallied that session even as IBM itself had its worst day ever. That is the single argument that broke ZS in May, addressed by a third party six weeks later.
• The street re-engaged after the crash. KeyBanc maintained Overweight and raised its target to $185 on 2026-07-16 — a raise, from a reduced base, into the recovery.
• A regulatory demand channel opened in Europe. On 2026-07-28 Zscaler announced a partnership with Schwarz Digits addressing European digital sovereignty and compliance under NIS2, DORA and the EU AI Act — demand driven by statute rather than by discretionary security budget.
• Consensus targets sit above spot. Investing.com's 45-analyst consensus shows an average 12-month target of $193.05 against a $145–$250 range (retrieved 2026-08-08), i.e. the average analyst models recovery from the 2026-08-07 close of $168.68.

Bear Case

• FY27 is the first sub-20% growth frame in the company's public life. 16–17% versus the 19–20% expected (2026-05-26 guidance). Deceleration of that size usually re-bases the multiple permanently rather than temporarily.
• Cash generation was cut alongside it. The FY26 free-cash-flow margin outlook came down to 22.8–23.3% from 26.5–27%, with capex guided to high-single-digit percent of revenue — roughly four points of FCF margin surrendered to infrastructure build.
• Headline ARR growth is partly bought. Excluding the Red Canary acquisition, which contributed $127M of ARR, Q3 FY26 ARR grew 21% to $3,398M and net new ARR grew 14% — against the 25%/reported figures. Organic net new ARR in the teens describes a materially different business from what the headline suggests.
• Execution risk is named by management. Zscaler disclosed the loss of two sales leaders during the quarter; CFO Kevin Rubin described guidance as taking a "prudent approach" amid the transitions (2026-05-26/27). Sales-leadership gaps show up in bookings one to two quarters later, i.e. in the September and December prints.
• The recovery has already run into the street's new ceiling. The 2026-08-07 close of $168.68 sits below, but within reach of, KeyBanc's 2026-07-16 target of $185 — the most recent post-crash target revision. Buyers at this level are paying for an upgrade that already happened.

Setup & Price Structure

Measured: close $168.68 on 2026-08-07; 52-week high $336.27; drawdown from that high 49.8%; three-month return +10.9%; RSI(14) 67.8.

Inferred: the three-month window contains the 2026-05-27 gap. A positive +10.9% three-month return across that date means the post-print decline has not merely stabilised — it has been fully retraced and exceeded relative to where the stock traded before the event. RSI(14) at 67.8 puts the name at the upper end of its own range without being formally overbought, and it arrives there 26 days ahead of the print that produced the gap.

Life-cycle: MATURING. Well known, still working, flow moderating. Dating it: the narrative's fresh headlines in the window are sector-level rather than name-level (2026-07-14 IBM/cyber-ETF rotation; 2026-08-05 $130M Coldcard hack putting cybersecurity ETFs back on screens), the name-level news is a partnership rather than a financial inflection (2026-07-28 Schwarz Digits), and the analyst re-rating is modest in absolute terms — $185 on 2026-07-16, against pre-crash targets that ran to $345. Zero trust and SSE are a decade-old category with 45–62 covering analysts. Attention is returning to a familiar name; it is not being discovered.

Crowding and positioning observables (stated, not judged): RSI(14) 67.8 as of 2026-08-07 after a positive three-month return spanning a −31.5% gap day; an earnings date 26 days out on 2026-09-03; price approaching the most recent post-crash street target of $185; consensus target dispersion of $145–$250 (Investing.com, retrieved 2026-08-08) implying no analyst agreement on the FY27 growth rate; retail-facing cybersecurity ETF coverage clustering on 2026-07-14 and 2026-08-05. The filing feed reviewed for this note shows no insider transactions in the trailing 30 days.

Catalyst Calendar (next 30 days)

• 2026-09-03 — Q4 FY26 results, after the close, conference call 1:30 p.m. Pacific / 4:30 p.m. Eastern (confirmed by company release 2026-08-06). Fiscal year ends 31 July, so this is the full-year close and carries the first formal FY27 revenue and billings guidance.
• 2026-09-03 — FY27 free-cash-flow margin and capex framing on the same call. The FY26 cut to 22.8–23.3% from 26.5–27% was a distinct source of the May de-rating; whether capex stays high-single-digit percent of revenue into FY27 is a separate resolving variable from the revenue guide.
• No other dated company event falls inside the window.

What Would Change Our Mind

The structure that matters is the recovery leg built since 2026-05-27, and it is the thing that can be given back fastest. A weekly close below $150 — a level beneath the 2026-08-07 close of $168.68 and beneath the zone the July rally established — would say the market has stopped treating the May guide as conservative and has begun pricing 16–17% as the run-rate.

The fundamental break sits on 2026-09-03. FY27 revenue growth guided at or below the 16–17% framed in May, or organic ARR growth (ex-Red Canary) printing below the 21% recorded in Q3 FY26, would confirm that the May reset was a floor being lowered rather than a floor being set. Net new ARR below the $166M of Q3 FY26 in a fiscal-Q4 — seasonally the strongest quarter — would attach a number to the sales-leadership turnover management flagged.

On the other side: an FY27 revenue guide above 17% with the FCF margin guided back toward the pre-cut 26.5–27% range would restore the compounder frame and make the $185–$193 target zone the floor of the discussion rather than its ceiling.

Correlation Notes

• Security-software complex. The 2026-05-27 decline dragged peers with it, which is how the market reads a Zscaler guide — as a sector datapoint on enterprise security budgets. PANW, CRWD, NET, FTNT and OKTA prints and guidance move ZS ahead of ZS's own numbers.
• Cybersecurity ETF flow. BUG/HACK/CIBR-type vehicles saw attention on 2026-07-14 (IBM's AI-versus-security-budget comment) and again on 2026-08-05 (the $130M Coldcard hack). Breach headlines have been reliably additive to sector attention and are exogenous to Zscaler's execution.
• The AI-capex-crowd-out debate. ZS sits on the exposed side of that argument: it sells software into budgets that hyperscaler and enterprise AI infrastructure spend competes with. Commentary from large-cap enterprise IT vendors on budget allocation moves the name independent of its own bookings.
• High-multiple SaaS beta. At 49.8% below its 52-week high with FY27 growth guided at 16–17%, ZS trades with the long-duration software cohort on rate and risk-appetite swings, and its idiosyncratic dispersion is now concentrated almost entirely into one dated event.