Zscaler (ZS): The Biggest Beneficiary of the Cybersecurity War in the Age of AI Agents
Zscaler is down 38% YTD in 2026 as the market misreads AI as a replacement for cybersecurity. Five layers of moat, AI Security ARR hit ahead of schedule, and a full Four-Layer Defensive Screen assessment. Includes an update on the April 2026 Claude Mythos event.
STOCK RESEARCH #ZS
Ticker: ZS | Exchange: Nasdaq | Sector: Cloud Security / Zero Trust
📅 Published 2026/03/26 · 🔄 Updated 2026/04/07 · ⏱ 15 min read · 📊 Q2 FY2026
Zscaler is down 38% YTD in 2026, as the market misread the narrative that "AI will replace cybersecurity." The correct logic is the opposite: the mass adoption of agentic AI will create billions of "non-human user" authentication demands, becoming ZS's single largest growth catalyst to date. Its moat runs deep (five layers of defense), it's a pure SaaS business with high margins (80%), and AI Security ARR crossed $400 million a full year ahead of schedule. The technical picture has not yet confirmed a bottom — discipline dictates waiting for an entry signal.
Anthropic released a Claude Mythos preview, confirming that its next-generation AI model can automatically discover and exploit zero-day vulnerabilities across all major operating systems. In tandem, it launched Project Glasswing, partnering with 40+ enterprises including AWS, Apple, Microsoft, CrowdStrike, and Palo Alto to strengthen defenses. Cybersecurity stocks fell another 5-11% in the short term, but the medium-term effect reinforces the rigid demand for Zero Trust infrastructure.
Data as of Q2 FY2026
| Filter | Metric | Data | Result |
|---|---|---|---|
| 1: Sponsorship | A/D Rating | D+ | ❌ Fail |
| RS Rating | 18 | ❌ Fail | |
| 2: Moat | ROE | NM (GAAP) | ⚠️ Caution |
| EPS Growth (Non-GAAP) | +12.94% | ✅ Pass | |
| SMR Rating | B | ✅ Pass | |
| 3: Volatility | IV Rank (52wk) | Elevated | ✅ Favorable |
| 4: Technicals | Price vs. 50MA | Well Below | ❌ Fail |
| Support Range | $120-130 | Reference |
INTRODUCTIONIntroduction: A Story the Market Got Backwards
In early 2026, a technical paper from an AI company sent shockwaves through the cybersecurity sector — the market read it as "AI will replace parts of cybersecurity," and Zscaler's stock fell sharply in response, extending its YTD decline to -38%.
This is a mistake the market made that can actually be quantified.
The correct reading is the exact opposite: the mass adoption of agentic AI is Zscaler's single largest growth catalyst to date — not a threat. Every AI agent deployed by an enterprise is a "non-human user" that must be authenticated, monitored, and authorized. Zscaler's Zero Trust Exchange is the world's largest — and only — platform capable of processing this kind of traffic at millisecond latency: the "sky sentinel" of this new era.
CHAPTER 01Industry Map: A Game Permanently Reshaped by AI
1.1 The Global Cybersecurity Market: From an Option to Infrastructure
The global cybersecurity market is expected to grow from roughly $274 billion in 2025 to $479 billion by 2030, a CAGR of 11.7%. Three trends are converging:
Trend One: The exponential expansion of the attack surface. Cloud adoption, remote work, and IoT have turned the security perimeter from a "wall" into a "borderless space."
Trend Two: Regulation is making demand structurally rigid. EO 14028 mandates Zero Trust; the EU's NIS2; the SEC's 4-day disclosure rule.
Trend Three: A qualitative shift in AI-driven attacks. Per ThreatLabz's 2026 report: enterprise AI/ML application usage has quadrupled to 3,400+, and sensitive data transfer volume has surged 93%. Machine-speed attacks now achieve automated breaches within 16 minutes. If attacks are powered by AI, defense must be too.
1.2 Core Battleground: SSE / SASE
The SASE market was $15.5 billion in 2025, growing at a 23.6% CAGR to reach $44.7 billion by 2030.
1.3 AI Agents: The Industry's "Second Curve"
Jay Chaudhry: in the future, every employee will correspond to 50-100 AI agents. SAM is set to expand explosively from 335 million human users to 150 million workloads, 1.5 billion IoT/OT devices, and billions of AI agents.
Claude Mythos Preview and Project Glasswing
Anthropic released a Claude Mythos preview that can automatically identify and exploit zero-day vulnerabilities across all major operating systems and browsers, discovering thousands of critical vulnerabilities within weeks (the oldest of which had existed in OpenBSD for 27 years). In tandem, it launched Project Glasswing, offering defensive access to 40+ enterprises with a committed $100 million usage credit.
Why Is the Market Bearish? A "Layer Confusion"
Cybersecurity stocks fell 5-11%. The market's logic conflates two different layers:
| Mythos | Zscaler | |
|---|---|---|
| Function | Vulnerability Discovery (Detection) | Real-Time Interception, Verification (Enforcement) |
| Analogy | X-ray Machine | Emergency Room |
| Relationship | Complementary, Upstream/Downstream — Not a Substitute | |
Is ZS Being Absent From the Glasswing List a Negative?
No Need for Excessive Concern
CRWD (EDR) and PANW (firewalls) have functional overlap with Mythos's vulnerability discovery. ZS performs Zero Trust traffic verification — a lower-level piece of infrastructure whose architecture doesn't depend on a vulnerability database.
The Real Risk
It's not "AI replacing ZS" — it's "competitors gaining an asymmetric advantage through AI alliances."
Three Reasons the Risk Is Manageable
⏸️ Mythos Doesn't Change the Verdict, But It Changes the Risk List
The core thesis is reinforced. New item to monitor: whether CRWD/PANW gain an accelerated advantage in SASE via Glasswing. Watch management's commentary at the Q3 earnings call.
CHAPTER 02Anatomy of the Business Model: A Well-Engineered Revenue Compounding Machine
2.1 Revenue Structure: Pure SaaS, Highly Predictable
Nearly 100% subscription revenue. RPO reached $6.1 billion (up 31% YoY), giving roughly two years of revenue visibility. There are 728 customers with $1M+ ARR. Customer journey: Year One Land ($150K-300K) → Expand ($500K-800K) → Platform ($1M+).
2.2 Pricing Mechanism: Usage-Based Billing
Z Flex flexible pricing is billed based on AI traffic volume — an upgrade from linear per-seat billing to exponential traffic-based billing.
2.3 Gross Margin Structure: 80%
Non-GAAP gross margin has held steady at 80%, reflecting a pure software delivery model, above Palo Alto's 75-78%.
2.4 AI Security: Ahead of Schedule
AI Security ARR has surpassed $400 million, a full year ahead of target. The AI Security Suite is aligned with both NIST and the EU AI Act.
CHAPTER 03Moat Deep Dive: Five Layers of Defense
Layer One: The Data Flywheel
500 billion transactions processed daily across 160+ data centers, a flywheel that has been spinning for nearly 20 years. The AI era is only accelerating and deepening this moat.
Layer Two: Network Effects — A Double Helix
The threat-intelligence loop: more customers → more threat samples → sharper AI → better protection → more customers.
The ecosystem lock-in loop: ZS becomes the security hub → surrounding tools integrate around it → switching costs become equivalent to a full rebuild.
Layer Three: Switching Costs
Deployment becomes a core "mandatory conduit." Switching away means rebuilding network topology, security policy, and retraining staff. Retention rate: 95%.
Layer Four: Regulatory Mandate
EO 14028, NIS2, and SEC disclosure rules form a "regulatory floor." The EU AI Act takes effect in August 2026, and ZS is fully aligned with it.
Layer Five: Founder-Led
Jay Chaudhry holds a 19% stake and serves as Chairman and CEO — 20 years of long-horizon platform building.
CHAPTER 04Financial Resilience Analysis
4.1 Balance Sheet
Roughly $3.5 billion in cash, with zero long-term debt. In Q2, the company completed three acquisitions for $692 million and still retains ample cash.
4.2 Core Financial Data
| Metric | Data | Note |
|---|---|---|
| Revenue | $815.8M | +26% YoY |
| ARR | ~$3.36B | +24% YoY |
| RPO | $6.1B | +31% YoY |
| Non-GAAP Gross Margin | 80% | Stable |
| Non-GAAP EPS | $1.01 | Beat by 12.94% |
| Operating Margin | ~22% | Continuing to improve |
| $1M+ Customers | 728 | — |
| AI Security ARR | >$400M | Ahead of schedule |
| SBC as % of Revenue | 26.5% | Gradually declining |
4.3 The SBC Issue
SBC accounts for 26.5% of revenue and is the primary driver of the GAAP loss. Non-GAAP operating margin has improved from 12% in FY2022 to 22%, but a full transition to GAAP profitability is still expected to take 2-3 years.
CHAPTER 05Operating Performance Tracker
5.1 Q2 FY2026
Highlights:
Concerns:
5.2 In the CEO's Words
"Billions of AI agents will be able to access mission-critical applications and sensitive data."— Jay Chaudhry, Q2 FY2026 Earnings Call
"You need a globally distributed infrastructure like Zscaler's, and 100% reliability. That's something AI cannot replace."— Jay Chaudhry, RSA Conference
CHAPTER 06Long-Term Growth Potential
6.1 Three Axes of TAM
Axis One: SAM exceeds $100 billion, with penetration of only 3%. Fortune 500 coverage stands at 45%.
Axis Two: AI agents. Under a conservative assumption of 25 agents per employee, that implies 7.5 billion agents globally, with a TAM of $150-225 billion.
Axis Three: Geographic expansion. Asia-Pacific CAGR exceeds 30%.
6.2 Five-Year Scenarios
| Scenario | FY2030 ARR | Market Cap | vs. Current |
|---|---|---|---|
| 🐂 Bull | $10B+ | $120-150B | +160-220% |
| 📊 Base | $7.5-8.5B | $85B | +70-85% |
| 🐻 Bear | $5.5-6.0B | $45-50B | Flat |
CHAPTER 07The Four-Layer Defensive Screen Assessment
Filter One: Sponsorship — ❌ Fail
A/D of D+, RS of 18. Institutional selling continues; not a valid entry.
Filter Two: Moat — ✅ Pass
EPS growth of 12.94% YoY, SMR of B. GAAP ROE remains negative but the trend is clear.
Filter Three: Volatility — ✅ Favorable
IV Rank is elevated, giving a Bull Put Spread ample margin of safety.
Filter Four: Technicals — ❌ Fail
Well below the 50MA, with support at $120-130 and no bottoming signal yet.
📋 Final Verdict: ⏸️ Actively Watching
The fundamental moat is deep, and the AI-era growth thesis is complete. The technical picture has not yet confirmed a bottom, and institutional selling pressure has not let up.
Near term: wait for A/D ≥ B, RS ≥ 70, and the stock to reclaim its 50MA.
Once confirmed: a Bull Put Spread, with the short put set at $120-130.
Long term: a margin of safety is gradually building below $160 — small, staged positions with a stop-loss in place may be considered.
"The market belongs to those who survive the longest."
Discipline comes before conviction — even the best story still has to wait for the right entry point.
| Date | Event | Verdict | Follow-Up |
|---|---|---|---|
| 2026/03/26 | Initial publication, Q2 FY2026 data | ⏸️ Actively Watching | — |
| 2026/04/07 | Anthropic releases Claude Mythos preview + Project Glasswing | ⏸️ Maintained | Cybersecurity stocks fell 5-11%, reinforcing the AI-defense thesis and adding a new competitive risk item. |
▸ Next update: After Q3 FY2026 earnings (May-June 2026)
▸ Conditions for an earlier update:
① Breaks below $120 ② A/D returns to B or above ③ A major AI Security event ④ A change in Chaudhry's stake ⑤ Further fallout from Glasswing