If you follow AI cybersecurity, you’ll notice something very strange about Zscaler: the earnings were strong, revenue grew 25%, ARR grew 25%, operating margin hit a record high, yet the stock was still sold off by the market.
This isn’t a normal earnings wobble. Wall Street is judging a much bigger question: in the AI era, is cybersecurity a true necessity, or just another overpackaged software story?
If you only look at the stock price, you’d think Zscaler has a problem.
But if you look deeper, you’ll see that the real issue may not be Zscaler at all—it may be that the entire enterprise security rulebook is being rewritten by AI.
In the past, companies protected themselves from hackers by defending against people.
Now they must defend against AI that can write code, find vulnerabilities, fake identities, and even enter systems to execute tasks automatically.
Even more importantly, companies will no longer only have employee accounts—they will also have AI Agent accounts. These agents will access customer data, call internal systems, query databases, send emails, and even trigger business workflows.
That raises the real question: who decides what these AI Agents can and cannot see?
Who stops them from overstepping permissions?
Who prevents employees from dumping confidential data into external models?
And who protects the last line of defense when AI helps hackers scan vulnerabilities at machine speed?
That’s why this Zscaler episode is worth watching.
After this video, you should understand at least three things.
First, why Zscaler reported strong earnings yet fell, and what the market is really worried about.
Second, why zero trust, AI Red Teaming, and Agentic SecOps may become the hardest-hitting new themes in AI software stocks.
Third, whether Zscaler is a slowing software stock or a short-term victim of sentiment that’s actually a core player in AI security.
If you still think AI security is just a small branch of cybersecurity, you may be missing one of the most dangerous—and most profitable—hidden lines in the next AI software cycle.
The stronger AI gets, the less willing companies are to run naked.
And whoever can secure the gateway into enterprise AI systems may become the next real security tollbooth. Before we start, hit like, subscribe, and let’s get into today’s key points.
Let’s start with the earnings themselves.
On the surface, Zscaler’s Q3 report was genuinely beautiful.
Revenue grew 25% year over year.
ARR grew 25% year over year.
Non-GAAP operating margin reached 23%, a record high.
What does that mean?
It means Zscaler is not one of those software companies that only burn cash and tell stories. It has entered a more mature phase: revenue is still growing, margins are improving, customer demand hasn’t disappeared, and the zero-trust thesis is still intact.
But the U.S. stock market has never been a gentle teacher.
It won’t reward you just because you scored 90 points.
If the market expected 95, or even 98 next time, then delivering 90 can still get punished.
That’s the cruelty of high-valuation growth stocks.
The mistake may not be in the present—it may be that the future isn’t exciting enough.
Zscaler got hit not because the business collapsed, but because the market is unsure about what comes next.
The Q4 guidance wasn’t dazzling enough, the sales team adjustment made investors nervous about execution, and the software sector is in a very sensitive phase. Any hint of uncertainty in future growth, and money runs first.
That’s today’s software-stock market.
You can’t just be good. You have to be better.
You can’t just grow. You have to prove growth can continue.
You can’t just say AI creates opportunity. You have to show AI turns into orders, then revenue, then profit, then free cash flow.
So the drop in Zscaler is essentially the market asking one question:
When will your AI security story become real money?
But from another angle, this disagreement is actually interesting.
If a company’s earnings are truly bad and the stock falls, there isn’t much to discuss.
But if the operating data is still decent, the long-term logic is strengthening, and the stock gets hit because of short-term expectations, that’s where market divergence appears.
And real investment opportunities are often hidden in divergence.
What we need to ask next is whether Zscaler’s long-term logic has changed.
The answer is no—and it may actually have become more important.
Why?
Because the AI era is reshaping cybersecurity.
In the past, enterprise security was like defending a city.
The inside was the city, the outside was beyond the walls. Firewalls were the wall, VPNs were the gate. If you defended the border, you felt safe.
But the world has changed.
Cloud apps, SaaS systems, remote work, API interfaces, third-party plugins, and external model calls have punched holes in the old walls.
Company data no longer lives only on internal servers, employees are no longer only in offices, and applications no longer run only on internal networks.
The perimeter is gone.
And with AI Agents, the problem becomes even more complex.
An AI Agent is not just a tool. It may log into systems automatically, access customer data, generate reports, change code, send emails, create tickets, and even trigger workflows.
Sounds great, right?
But from a security perspective, that’s scary.
Because an AI Agent that can execute tasks automatically is basically a digital employee that never sleeps.
It needs permissions.
It needs data access.
It needs app access.
It needs to connect different systems.
Once permission management is loose, once data boundaries are unclear, once prompt attacks steer the model off course, or once hackers abuse an AI Agent, it can turn from an efficiency tool into an internal security hole.
That’s why zero trust becomes a must-have again in the AI era.
The core logic of zero trust is simple:
Don’t trust any person, device, application, or connection by default.
Every access must be verified.
Every data flow must be checked.
Every user, device, app, and AI Agent must operate under least privilege.
That sounds annoying, but that’s exactly where large enterprises are willing to spend.
Because companies fear not inconvenience, but losing control.
In the past, hackers had to find a door. Now AI can help hackers scan every window in the building.
In the past, companies worried about stolen employee accounts. Now they also worry about AI Agents being tricked into overstepping permissions.
In the past, data leaks might have come from employee mistakes. Now data can be leaked by an automated agent in milliseconds.
So if your company is still using old-school VPNs and traditional firewall thinking, it’s like using a wooden door to stop a tank in the AI era.
That’s where Zscaler’s value lies.
It’s not just selling a security product. It’s integrating enterprise access control, application connectivity, data protection, zero-trust architecture, and AI security capabilities.
That’s also why its partnerships related to OpenAI and Anthropic are so important.
Zscaler’s collaboration with OpenAI is not just “we’ve added AI” in a superficial sense.
It’s about using advanced model capabilities in secure development workflows, vulnerability detection, AI Red Teaming, and Agentic SecOps.
In plain English, that means using AI to help security teams find code flaws faster, identify risks faster, test system weaknesses faster, and respond to incidents faster.
That matters.
Because the security industry may be entering a new stage.
Not human versus human.
But human plus AI versus human plus AI.
Cybersecurity used to be like two chess players.
Now both sides may be playing with supercomputers.
The attacker can use AI to find bugs, write malware, fake emails, simulate identities, and test attack paths quickly.
If the defender still relies on humans to slowly inspect, patch, and respond, it will become harder and harder.
So security companies must use AI too.
Zscaler’s participation in Anthropic’s Project Glasswing carries similar meaning.
If models like Claude can discover software flaws faster and understand code risks faster, that’s obviously good for defenders.
But on the flip side, it also means vulnerability discovery will accelerate.
Security issues in software may be amplified by AI.
In the past, finding a vulnerability could take security researchers days or weeks.
In the future, AI may dramatically speed that up.
That’s an opportunity and a fear for enterprises.
The opportunity is faster remediation.
The fear is that attackers can also exploit vulnerabilities faster.
So the long-term demand for AI security isn’t marketing hype—it’s being pulled forward by technical change.
The stronger AI gets, the stronger the attack.
The stronger the attack, the less defense budgets can be cut.
That’s the hardest part of Zscaler’s long-term logic.
So where exactly is Zscaler’s opportunity?
I think it can be divided into four layers.
Layer one is replacing traditional VPNs and firewalls.
That was Zscaler’s original core logic.
As enterprises become more cloud-based, employees more distributed, apps more numerous, traditional perimeter security gets increasingly strained. Zero-trust architecture is still replacing the old model, and that transition is not over.
Layer two is securing enterprise use of generative AI.
Employees may now use ChatGPT, Claude, Copilot, and various internal AI tools.
What do companies fear most?
They fear employees pasting in customer lists.
They fear financial data going in.
They fear source code going in.
They fear trade secrets being sucked into external models.
So companies need to know who is using AI, which AI they are using, what data is being sent, and whether there is leakage risk.
That’s the need for AI access security and data protection.
Layer three is protecting AI Agents.
This is the bigger story of the future.
Once AI Agents stop just chatting and begin accessing systems, calling APIs, reading data, and executing workflows, enterprises must assign them identities, permissions, boundaries, and audit trails.
Whoever can help companies control AI Agent behavior may capture the next security budget.
Layer four is AI Red Teaming and automated security operations.
Enterprises don’t just need to defend against external attacks—they need to proactively test whether their AI systems have vulnerabilities.
Can the model be tricked by prompt attacks?
Can the AI Agent exceed permissions?
Can internal data be called incorrectly?
Does the application code contain hidden flaws?
Can the security team use AI to fix problems faster?
If Zscaler can combine these capabilities, it becomes more than a traditional cybersecurity company—it could become the enterprise AI security gateway.
That’s where the biggest upside lies.
Companies will no longer ask, “Should we use AI?”
That question is already settled.
The real question is, “How do we use AI securely?”
Whoever can answer that question may win the next budget cycle.
But we also need to be clear about the risks.
Zscaler isn’t risk-free, and the selloff wasn’t without reason.
First, short-term guidance risk.
High-valuation software stocks hate downward revisions to growth expectations. Once the market senses future revenue growth may step down, the stock can get hit hard.
Second, the sales team adjustment.
Cybersecurity software growth depends heavily on sales execution, large-account expansion, cross-selling, and renewals. Any disruption in the sales organization makes the market very sensitive.
Third, competition is fierce.
Zscaler is not fighting alone.
Palo Alto Networks, CrowdStrike, Okta, Cloudflare, Microsoft, and Wiz are all competing for enterprise security budgets.
Everyone is talking about AI security, and everyone wants to build a platform.
Customers’ budgets are limited; whoever can truly prove results will win more spend.
Fourth, the AI security story still needs revenue conversion.
AI Red Teaming, Agentic SecOps, and AI Access Security sound impressive, but the market ultimately wants to see if customers are paying, whether contracts are getting larger, renewals are rising, and revenue is being contributed.
If it’s only hot conceptually and there’s no real conversion in the earnings, valuation expansion will be hard to sustain.
Fifth, valuation and rates.
Software stocks are always sensitive to interest rates and risk appetite.
No matter how good the business is, if the valuation is too rich, any shift in market conditions can compress it.
So Zscaler doesn’t lack a story—it’s that the story is so big the market is now asking when it becomes money.
That’s my core take.
Zscaler is not a stock to buy with your eyes closed.
But it is absolutely a core name worth putting on an AI security watchlist.
How does it compare with other AI security stocks?
Here’s the simple version.
Zscaler’s keywords are zero trust, SASE, cloud access, data security, and AI access control.
CrowdStrike’s keywords are endpoint security, threat detection, cloud security, and AI security operations.
Okta’s keywords are identity management, AI Agent identity, and access permissions.
Palo Alto Networks’ keywords are platform security, firewalls, cloud security, and security operations.
Cloudflare’s keywords are network edge, application security, Zero Trust, and developer/edge networking.
So you can’t lump all security stocks together.
AI security will benefit the whole sector, but each company captures a different slice of budget.
If companies worry about AI Agent permission abuse, Okta’s logic is more direct.
If they worry about endpoint threats and attack detection, CrowdStrike is more direct.
If they worry about cloud access, data flow, VPN replacement, and zero trust, Zscaler is more direct.
If they want a comprehensive platform security stack, Palo Alto has the edge.
That’s why cybersecurity stocks will keep diverging.
Not all security stocks are the same.
What matters is where each one sits in the enterprise AI security stack.
What should ordinary investors watch next?
I think there are a few key indicators for Zscaler.
First, can ARR growth stay at a high level?
That tells us whether long-term contracts and subscription demand remain strong.
Second, can large customer counts and million-dollar customer growth keep rising?
Security software is most valuable with large customers, especially multinationals and large institutions.
Third, can non-GAAP operating margin and free cash flow keep improving?
That shows the company is moving beyond burn-to-grow and toward a more mature business model.
Fourth, can new products like AI Security, AI Red Teaming, and Agentic SecOps start contributing meaningful revenue?
That determines whether the AI story stays in press releases only.
Fifth, can the sales execution problem be fixed?
If the sales team adjustment continues to hurt, the stock may stay under pressure.
Sixth, can next fiscal year guidance win back market confidence?
Growth stocks are judged on the future, not the past.
The real opportunity is not how much the stock has already fallen, or how nice the earnings headline looks.
The real opportunity is that if the market sold it off on short-term guidance, but medium- and long-term AI security demand continues to rise, then this divergence could turn into an investment opportunity.
So let’s go back to the original question.
Is this Zscaler drop a risk signal or an opportunity window?
My answer is both.
In the short term, it does reveal problems with growth expectations, sales execution, and the market’s high bar.
In the long term, it sits right at the intersection of zero trust and AI security, which is a very important position.
In the AI era, security is not a side character—it’s the entry ticket.
If enterprises want to use AI, they have to solve access control, data protection, identity management, model security, vulnerability detection, and zero-trust architecture.
If those problems aren’t solved, companies won’t dare put AI into core systems.
So AI security is not optional; it’s part of the infrastructure for AI adoption.
That’s the biggest takeaway from Zscaler’s earnings.
The market may punish its guidance in the short term, but the long-term AI security theme has not disappeared.
In fact, the more widespread AI becomes, the more worth watching this theme is.
If AI Agents enter enterprises at scale in the future, the real winners won’t only be model companies or GPU companies.
Security companies may become one of the hardest pieces of the next AI budget cycle.
To sum up:
The key point in Zscaler’s earnings is not just that the report was strong, or that the stock fell. It’s that it pushed one of the most easily underestimated lines in AI software stocks into the spotlight.
Zscaler’s opportunity is that zero trust is evolving from a cloud-security architecture into the enterprise access-control foundation of the AI era.
Zscaler’s risk is that short-term guidance, sales execution, competition, and valuation swings still need to be reassessed by the market.
So it’s not a blind-buy stock. It’s a core AI security name worth tracking closely.
If this episode helped you see Zscaler and AI security more clearly, remember to like, save, and subscribe.
See you next time.
