Zscaler, Inc. — Call Transcript 2025

Welcome, everyone. Apologies for the delay here. I'd like to welcome you to the Innovation Briefing at Zenith Live. Before we get started, please take a moment to look at our Safe Harbor statements. Quickly go over them after this. We'll start off with some comments from Jay, talking about Zscaler's platform expansion. Following Jay, we'll have Adam who will double-click into our SOC strategy. After that, we have a special guest, Brian Beyer, who is the co-founder and CEO of Red Canary. He'll talk about Red Canary's EDR technology. We'll break for lunch and reconvene with a demo on the AI solutions from Phil Tee, who is our EVP Head of AI Innovations. Following Phil, we'll have Dhawal Sharma talking about Zero Trust Cloud. I know that's an area of interest to many of our investors. There are still some lingering questions around that. We'll have a customer talk about their Zero Trust Cloud journey with us. Of course, we'll have Dhawal for the product Q&A session as well, which follows customer Q&A. After the product Q&A, we'll have Mike Rich on stage talk about the go-to-market strategy, key priorities heading into fiscal 2026. Then we'll end with executive Q&A. I know many of you want to get back to CrowdStrike, so we'll try to end it well before two, targeting 1:50. If we get it done by 1:45, it's a win. We'll try to get it done with that. Let me welcome Founder and CEO of Zscaler, Jay Chaudhry, onto the stage, please. All right. Thank you. Thank you, Ashwin. All right. All of you had a chance to listen to our keynotes, right? Did? Hopefully, that answered most of the questions. All right. I'll make a few comments. If you look at our focus area, we are, you've seen our story evolve. Zero Trust started with ZIA to ZPA to ZDX. Then it became Zscaler for Users. Zero Trust Everywhere has become a big story. Data security is one of the fastest growing areas for us, a sizable area. It's a natural extension for us. And Agentic Operation, this is the new area of evolving and growing. Red Canary acquisition is part of that story for us. In addition, we are making sure AI is getting embedded in all areas. The way we do detection today, even in inline, we do data loss prevention. All that is getting changed. Internally, we're embedding more and more AI to do all those things in a much better and faster fashion. Disrupting our own cells is a good thing. The key is the proxy architecture built is our biggest advantage. You're the checkpost. Everything comes to you. You can swap technique A with technique B, but that's the biggest barrier to entry for us. This slide, hopefully, you saw the evolution. This is basically saying, as a Zero Trust Everywhere, any entity to any entity, showing you the key destinations on the top and the key entities that are trying to reach on the bottom. This rounds out the story. It'll be very hard for someone to come from behind and say, "I can do all this." A lot of people who try to say, "Gee, we do what Zscaler does at a third of the cost," are trying to catch up on the user functionality. Workloads have their own nuanced tongue. There's a common thing as an exchange, but identities of workloads, requirements, segmentation, north, south, east, west has. Things are built and evolved. IoT has become a good story, not for just communication, now with AirGap integration. The Zero Trust device segmentation is making it very, very strong. The latest area I covered is the AI agents, their communication, LLM models. We are very excited. The story is becoming very, very clear. To make it happen, we had to evolve our exchange. Its core foundation has been solid. We started with when we said internal access. The exchange had to figure out all the policy checks, all the detection need to be done for private access. It had a different set of functionality and checking involved. B2B collaboration, you heard, is a massive opportunity. Every customer wants to connect with every customer. Maybe it's a user side of it, but site to site side of it. We got customers taken in medicine or hospitals that connect into thousands of other sites, site to site connection. Think of the third-party supplier risk. This kind of stuff takes care of it in a very, very clean Zero Trust fashion. For AI, the LLM proxies and supporting MCP exchange kind of stuff you heard is giving us a wonderful foundation you heard. If I show a little differently, our Zero Trust every is evolving. Users, workloads, IoT, OT. On the AI agent side, there's a lot of work going in this area. You're going to see more and more functionality come in this area and some of the customer engagements as well. That's new. You heard about data protection, data security evolving. The biggest new focus area besides SaaS and endpoint and data center and cloud is LLM and AI applications. Lots of data sitting out there that need to be protected. Bad actors being able to reach those models creates a problem. It is an extension for us. We talked about really expanding from Zero Trust to Agentic Operations. If you think about for the last 15+ years, we had one North Star, be it the switchboard, the policy engine, the exchange for anything to anything. That story has evolved, has grown, it is beautiful. Now being able to take all the important data we create out of that and being able to create value out of that is what you heard us really evolving. The story started about 18 months ago, about a year ago. We acquired Avalor as being the data fabric for us, which is very good. Most companies we see out there do not really have anything like data fabric. They are trying to do the stuff. They put together some little stuff in their Hadoop-based stuff. We had done that stuff too. Once we saw Avalor, we said, move over this homegrown stuff. It is a real product, real technology that is helping us. Combining that with Red Canary is giving us a big, big advantage. I do not need to go through this slide. You saw that the message here is really building a number of agentic technologies, agentic task agents that can do particular tasks, perceiving, reasoning, action being taken. It is getting very exciting. They are all coming together. The one area where you can take advantage of all of that far better is the security operations area. You heard about Red Canary, so I'm not sure I need to go through it again, but I'll highlight the fact that our own data, our own security research expertise combined with Data Fabric and now with Red Canary that's bringing agentic AI technology and their expertise is giving us a signal acceleration to get to the market. I covered a little bit during my keynote that we're not moving away from technology and becoming an MDR company. MDR is important expertise for us to understand and have. Having this technology and expertise combined with Data Fabric gives us a great position to really succeed there. I won't cover it. When Brian is here, Brian can make comments about some of the great technology he and his team have built. This actually is impressive. With that, maybe Adam, you can make some comments. All right. I guess I can. Come in. Don't worry. I can see you sitting back there. All right. Thank you, Jay. Okay. All right. Thank you, everybody. I know many of you saw the presentations from this morning. Some, I think, on the live stream will have not. I'll do a little bit of some recaps and looking forward to conversations also with everyone. I'm going to spend a little bit of time on the AI-powered SOC and sort of the strategy here. I think the biggest aha for me when I joined Zscaler about eight months ago was I didn't fully have an appreciation for the kinds of signals and data that Zscaler actually generated. I've been in cyber for 25 plus years, but I hadn't really seen it. I think part of that surprise was that sometimes Zscaler does not do a good job of sharing that information. We have these interesting vantage points because so much of the traffic is authenticated. We have identities. We understand we are doing decryption. We are seeing all parts of people's networks, on-prem, in cloud, endpoints. Those vantage points really actually built up a tremendous amount of information that we can see as a company. The question is, what do you do with it? Of course, there are the protections. These are some of those elements. I broke them up into three categories because I think they are different. There are detections that are something bad is happening right now. There is an incident. You need to investigate it. A lot of what Zscaler does inline is a detection. Sometimes it is a prevention. It's a flat out, "Hey, we're blocking something bad." That's still an important signal. Other times, what you're getting is a signal that there's something potentially malicious. You need to investigate this or you should look into it more. There is the whole rest of it, which is just the broader context, which when you have it, when you know about a device or the posture or what user is working on that device, when you do need to investigate an incident, that data is super helpful. That's what we've been trying to spend time to do is figure out how do we bring that together and make it very usable for our customers. I framed this up, broke it out a little bit differently in the keynote, but I've been working on this kind of slide and this view probably for the last five or six months to try to think about how do I want to talk about and want a customer to understand and all of you to understand how Zscaler's vision is expanding. You could see and understand that first piece. That's what everyone knows Zscaler for. Inline, in the path of traffic. For the most part, it's real-time, but it's meant to cover all users' applications, all data. Very well known for that. As you see and know, continued tremendous investment in that area. These other two parts of a comprehensive security strategy, though, are what we're calling out and focusing more on. The second part, which is what do you do before the bad event happens? This is sort of the proactive side of security. You have to understand continuously what's my posture, what's my risk, what's my exposure, my vulnerabilities. Also, you get a sense of how am I doing, but there's no specific incident you're responding to there, but you have to continually crank that wheel to try to get as good as you can. There's a whole bunch of prioritization that needs to happen there because there are more signals than you can actually deal with. Which risk or which exposure is more important to deal with than the other? That's what that middle one plays out as. The last part, which is really the newest for us, is when the bad thing's happening right this second, how do you react to that? What do you do? Having spent the last four years in the Siemens SOC space as the CEO of Exabeam, I spent a lot of time in this area. Here, it's all about how quickly can you detect something? Can you understand the scope and context, the blast radius? Is this an incident impacting one user or all of my users or in a particular area or on certain kinds of devices? To know and understand all that and then be able to quickly automate the investigation and the response to that incident. These are sort of the three pieces as I'm laying them out. That's what sort of comes together for Zscaler. We've got that first-party signal and data on the left-hand side of this picture. The right-hand side is what Jay mentioned. This is the acquisition of Avalor to give us the foundation of a place to send all of this data and make sense of it. Because the point of that data fabric, both first-party signals from Zscaler and the third-party signals from 150 different connectors of data that we can pull in, that creates context. It creates relationships between data and information around entities. An entity could be a user, could be a device, it could be a workload, it could be an API. You want to have all the different relationships and understand that because when you then go build security capabilities, you want that context in there for when you build out exposure management and Threat Management capabilities. The piece in the middle too, which I didn't talk about on the big stage, which is very important, is this is bi-directional. The first-party data, Zscaler's got to send data over, but very importantly, that signals and context, we have a current risk score for an asset or for user. Because we are inline in the path of traffic, we can use those signals in our dynamic policies. Sending back those signals back to Zero Trust to say, "Hey, based on what I know right now, this is the risk level for that user. You should use that in your policy constructs." That's something very powerful that we can do because we have both sides of this picture. Jay shared this slide before, but I'll just briefly state it because it shows some of the product names under it. On the left-hand side, continuous threat exposure management. We do have products and capabilities here. This is where Avalor's Unified Vulnerability Management sits. We've had an External Attack Surface Management product so customers could understand their external attack surface. In February, we released our Asset Exposure Management. It's still early, but got tremendous response from customers because it's really meant to be a continuously updated golden record of your assets. Those assets, again, can be broader than just a device and a user. Those are really the entities and the relationships between those. That system is great for just understanding context. It's really valuable for feeding into the Threat Management side. Described in the Threat Management, we had some pieces. We generate some interesting signals with our inline, our deception capability. I mean, it's a high-fidelity detection because when someone trips up and goes to a Deception Decoy, there's no good reason for them to be there. It is a high-fidelity signal that some behavior is happening that you need to look into. We have that capability. We have our Breach Predictor and our ITDR, so focused on identity threats. We had not really brought a lot of that together. Tomorrow in our SecOps keynote, we are going to talk more about how at Zscaler level we can bring that together. This also is the area where we believe the investment through the acquisition of Red Canary is going to help us accelerate in this right-hand side, this Threat Management side. We kind of tie it all together, the three big pieces just to close and wrap up my part here a little bit rapid fire. You can think of three big pillars at a company level: Zero Trust Everywhere, Data Security Everywhere, and Agentic Operations. There are natural relationships between them. They're not all one product. They don't need to be one product, but they all generate context and signals. They all get leveraged and can be consumed, and they feed back into those products to make data security and Zero Trust Everywhere much better. All right. With that, I'm going to hand it over to my new best friend, Brian Beyer. There you go. It's a dangerous position to be in your new best friend spot plus your guest speaker right before lunch. I wanted to start with a picture that I most commonly talk to our customers about and that they use to describe what Red Canary does. It is this flow where we start with a tremendous amount of security data on the left. We're taking in trillions of telemetry records. This is petabytes of security data per day, hundreds of millions of security alerts. We're identifying potential threats. Other products are identifying potential threats. We're performing over a million investigations for our customers every single quarter. Of those million investigations we perform, at the very end of it, you end up with about 15,000 true threats. This is the journey the typical SOC today is going through, except they're getting stuck with the tremendous amount of data, all the investigations they have to perform, and they can't actually identify the signal from the noise. In order to understand how we do that and how do we do that with quality, with efficiency, Red Canary uses this flywheel. Red Canary is this system that brings together our platform, which is purpose-built for security operations, a specific set of processes for how to conduct these investigations, and then a tremendous amount of expertise throughout various functions of the SOC, whether that's Threat Intelligence to understand what adversaries are and how they operate, Threat Research to understand which new vulnerabilities they may create, the actual investigation of these threats, the response, the communication of how do you contain and eradicate threats like this, all through this process that is this flywheel where we bring in tremendous amounts of data, we find potential threats, and then we get to this key step where we are applying prior learnings and data. We're looking to see, have we ever seen this investigation before? If we have, if we've seen something like this, the Red Canary platform automatically reconducts the past investigation. We're able to communicate to a security team, "We've identified this threat. We've already contained or responded, or we're giving you the information you need to respond." That flywheel then results in more data coming through the system. It's only when we see something new and novel and interesting that we have to go and put an actual person or an agent to conduct the investigation itself. It's only a fraction of the time that we have to do that investigation. What's very unique about the Red Canary process is that at every step of this process, we are producing tremendous amounts of labeled data. That labeled data is the key that goes into training Agentic AI Agents, LLMs that are purpose-built for inside the SOC, all so that those agents can do these responsibilities for us. If you compare and contrast that and look at those agents, what you'll typically find is the typical agent in the SOC is this autonomous agent. You tell the agent, "Hey, you're an expert SOC Analyst. Go investigate this threat for me." It's like telling a genius-level, like genius IQ-level toddler, "You're now an Expert SOC Agent. Go figure this out." Every once in a while, it amazes you and it wows you and you read a blog post about it and it's amazing, but most of the time it's highly inconsistent. The quality is highly variable and it tends to lead to very frustrating security experiences. On the other hand, Red Canary's agents are imbued with all of this training data and the specific SOC procedures and all of the expertise we have in Red Canary. Everything we talked about on the previous slides, over a decade's worth of this training data all gets imbued into these agents. When we have an agent that is instructed to perform an investigation, we're saying, "Here are the exact specific procedures of how a great SOC Analyst would investigate this. And here's the exact procedure of how a great incident responder would investigate this. And here is a decade's worth of training data. And also, here is what thousands of great investigations even look like." When all of that is combined together into these agents, you get highly consistent, very high-quality, predictable and proven results inside the SOC. That is what Red Canary is bringing together through our service to customers and now will be as part of the Zscaler product portfolio. With that, Ashwin, I'll turn it back over to you. Thank you. All right. We're still waiting for the acquisition to close, so just be mindful of that. We'll take a break now. Lunch is served outside. We'll meet at 12:30 in 29 minutes. See you back here. All right, welcome back. Hopefully, everybody got a chance to grab some lunch. We were planning to do an AI demo initially, but I just learned that Phil Tee is still stuck doing customer demonstrations, so I thought, you know, it's a better thing to do. Why not let him continue engaging with customers while we continue on with our show? It's my pleasure to invite Dhawal Sharma, EVP Products and Product Strategy, to the stage to talk about Zero Trust Branch and Cloud. Thank you, Ashwin. Good morning. Good afternoon. Yeah, we talked about how we are now extending Zero Trust Everywhere with two new frontiers that we have been tackling in recent time: Zero Trust in the Branch, which also implies campuses, factories, and hospitals, and all the physical sites, and Zero Trust in the Cloud. Zero Trust Branch, basically, we have brought two technologies. One, organically, what we have built as Zero Trust SD-WAN, which eliminates the need for East-West firewalls and SD-WAN devices in the branches by securing all the external communication, anything that leaves the branch or coming from outside in, by embedding our Zero Trust architecture with ZPA and building all the advanced routing functionalities in the same appliance, and the acquisition of AirGap Networks, which secures all the internal communication that happens within your environment. The concept of this Zero Trust Branch, or Cafe-like Branch, is something we have been talking to our customers about for a while, seeing strong validation from analyst firms like Gartner talking about Zero Trust Branch or Zero Trust Networking on the same lines. What we have been doing in the last one year and working really hard is for our customers to have one single unified appliance that can scale from a small branch to a large site or a campus. Going anywhere from 200 megs of egress throughput to 5 gigs of throughput. Instead of deploying two separate appliances like they did in the past, they basically get a single gateway appliance for their WAN and LAN and can build more identity context-driven policies for non-human devices like assets and infrastructure within their environment as well. A lot of customers who started with Zero Trust SD-WAN are now able to bring East-West segmentation or agentless micro-segmentation within their environments with this technology. Cloud is something on which we have been working on for a while. We have had thousands of customers, as I mentioned, securing their egress to the Cloud. Cloud environments are also very dynamic. We have now done petabytes-scale deployments for customers' cloud workloads. We started with a big focus public cloud, like going across multi-region, multi-Cloud, what is running inside customer environments, securing all the traffic flows. A lot of our customers are on their Cloud migration journeys, still have data center footprints or are retiring data centers, and are multi-Cloud, where some application is public cloud x, and then the data store is in other public cloud. We are able to secure all those paths in some of the innovation we have been building. Internet offload becomes the first use case with many large organizations, especially financial organizations who are running multiple virtual infrastructures public cloud, backhauling their traffic over expensive circuits, and then doing security in data center. We can dismantle that entire infrastructure with our Cloud Workload Protection offering. Also, the friction to deploy cloud solutions goes away with this architecture. A lot of our customers are actually building virtual firewall-free enterprise with our technology stack. The second use case, which we started deploying in a lot of these customers now, is doing segmentation or securing workload-to-workload communication within their boundaries, whether they are within public cloud, like going from a VPC X to VPC Y, multi-region, multi-Cloud, and also hybrid environments like data center to Cloud.Customers could have any form of underlay, such as private interconnects or ExpressRoute. We can secure all those channels. To simplify how our customers adopt this technology, because this needed some form of Zscaler VMs to be deployed in their environment, we basically... That will take a few hours of planning and deploying this infrastructure. What we have now introduced is a Zscaler Cloud Gateway. Think about a Zscaler VPC equivalent running across the public cloud, multi-region, multi-Availability Zone. Customers can just achieve the next level of automation by pointing their traffic to us, no need to deploy any virtual infrastructure. Customers can literally deploy this in minutes and do not need to wait for hours or go through architecture reviews for deploying this architecture. This is fascinating. We have a lot of customers who are asking for this. This became generally available as of last week. I want to invite a customer, Yoni Kaplansky, who's here in the room with us. He's VP of Cyber Architecture, Engineering, and Operations at FICO. Last year, CISO at FICO, Ben, was on stage with me talking about this solution. Since then, they have adopted this across the board. Bringing Yoni to answer questions for you. Good afternoon. Yoni Kaplansky, I'm with FICO for the last eight years. I'm running all the architecture, engineering, and operation. We started our journey with Zscaler in 2018. We started with ZIA. That was mainly my first project in FICO, which was a really great success. In 2021, we started our ZPA, Zero Trust project. No one really believed that we can do a full Zero Trust in three months, but we did it. With the help from Zscaler, with the right planning, we were able to completely cut VPN communication to the organization in three months. In 2023, we started to look at Cloud Connectors. I do believe we were one of the first customers with the Zscaler Cloud Connectors. Our approach was, after with our Zero Trust project, after we took care of human-to-machine connectivity, we wanted to take care of machine-to-machine connectivity with the Cloud Connectors. We are probably around 45%–50% implemented right now. We have a very large AWS environment, and we're doing gradually cut over, moving account after account to that. We see the benefit of it immediately. Some of our pain points with that was we had too many egress proxies. We wanted to standardize everything to ZIA. We had limitation of what's called peering, allowing VPC-to-VPC peering in AWS. We solved that with Cloud Connectors. We also had additional costs that were accrued in AWS, which we were able to control with using Zscaler Cloud Connectors. We're probably going to finish the project in the next between six to nine months, and then we'll be fully deployed. We do use ZIA and ZPA with the Cloud Connectors, which allow us to really secure our AWS environment to the level that we didn't see that any other technology can provide us. That's kind of the intro. I will be more than happy to answer any questions that you have. Thank you, Yoni. If anyone has questions, we'll start with Saket and then go to Roger. Excellent. Thanks, Yoni, for presenting. Really, really helpful. I want to dig into the Cloud Connector piece of your implementation more directly. What were you using before for cloud security? There are so many choices out there for cloud security, whether it's a Wiz or a Palo or a CrowdStrike, right? Like maybe some vendors that you work with already. What kind of tipped you over to kind of consolidating yet another piece with Zscaler in a market where there are other alternatives? We were using basically AWS security before. We are using Wiz as our kind of CNAPP solution. From a network security perspective, we were just using the basic AWS, which adds its own limitation. When we started the journey in 2023, we were so... I'm not saying that we were satisfied, but we were just so invested in the technology from Zscaler with the way that we worked with them, with their customer support, with their account management team, with the overall company that when we decided to go to the machine-to-machine Zero Trust, we didn't look anywhere else. It was clear to us that we will continue with Zscaler because they have the leading technology. We just went with them. I want to clarify the position. Your question to Saket is a good question. Cloud security. You can think of it. Your question actually talked about three buckets. One is workload-to-workload, machine-to-machine communication. The only way that's done today is some kind of firewall technology. It could be AWS Firewall, Palo Alto, or other firewalls. It's kind of network security you said. Typically, a rules, ACL, IP addresses, who can talk to. That is one piece. What we did with Zscaler is that communication piece. It is being done with firewalls from either firewall companies or hyperscaler has some of the basic firewall functionality. That is what we are taking out. Our mission is there should be no firewalls in the Cloud. Think of it this way. You know ZIA for users, you know ZPA for users. Think of ZIA for workloads and ZPA for workloads. Same thing. That is what we do. The second part was, why not CrowdStrike? CrowdStrike provides one of these Gartner acronyms. You put an agent on the workload machine, just like our endpoint. It is looking for good or bad stuff on it. That is one area. Gartner used to call it what? CWPP. Yeah, CWPP. Okay. That is second. We do not compete in that space. There is a third bucket. It is posture management. It used to be called CSPM, CI, whatever, and now it's CNAPP. It is API calls. Nothing to do with what we do here. Three buckets. Our bucket is very clear to be in line. One of the hardest things to do is to get in line. There's not much competition in that space. Either you do firewalls or you use Zscaler Zero Trust. One of the things that were our pain point and we solved it is that usually in many organizations, the IT department is not managing the AWS accounts. It's whoever business unit or account owner is managing it. He can change the firewall. He can do whatever he wants. When we use the Cloud connector, the policy is managing it. We're basically enforcing a higher-level policy that account owner cannot change. He can still do whatever he wants in his own bubble, but he cannot influence the overall picture. He cannot risk the overall company. That's what the Cloud Connectors allowed us to do. We'll take from Roger and then Taz. Can you hear me? Yes. Roger Bowe with UBS. Another question on Cloud Connectors. I think you mentioned about 50% deployed. Can you just talk about kind of what that looks like? What's remaining? Kind of has that implementation gone as expected? Some of the new announcements today, it sounded like Zero Trust Gateway potentially streamlined some of that deployment. Does that give you confidence to kind of hitting the timeline you talked about? Yeah. We took a very slow approach because, first of all, we're introducing a change. Every time that you're introducing a change into a company, you need to do it slowly and gradually so everyone will be happy. We move the cheese for a lot of the people. We want them to be happy before that. Second, we wanted to move gradually from really lower environments into kind of our QA and production environments. This is how we basically build our implementation plan. The third is that we wanted to create our own automation and our own assurance that we are deploying it right because all you need is one incident of something not working, and you will be shut down for a long time. Those are kind of the approach that we took to do it. We are in the level that we show the entire organization that we can deploy it. We show that we can automate it. We showed that it cannot impact the actual business. We show that we can create savings to the organization. I feel very comfortable that we will continue as going, and we will meet our timelines. Hi, it's Imtiaz Koujalgi from Roth Capital. I have a question on your Cloud Connector usage. If you speak to a firewall vendor, their pitch is that you have a single pane of glass for managing your cloud security and your on-prem security. You can use firewalls in the cloud, firewalls on-prem for your data center, and then you can manage it from your Panorama or whatever console you have. How do you solve for that given that, I guess, Zscaler is cloud only? Are you guys cloud only? Or do you guys have an on-prem presence also? That is part one. I have another second part of the question. We are on-prem and Cloud. We are using Palo Alto for on-prem firewalls. The thing that was easiest for us is that we came with our requirement for Cloud security. Cybersecurity is the owner of that system, networking, doing the on-prem. It was never kind of who's doing what, and do we really need that one pane of glass for that? The other way to look at it is that with the Cloud Connector, you apply the policy, and that's it. You're not changing the policy. It's not constantly changing on a daily basis like you're changing firewall rules. Really seeing both of them together and having that perspective was not really an important point for us because the Cloud Connector allows you to apply that policy, and you're not changing that policy unless there is a business reason for that, and then you're going through the regular process of approving it. Got it. Second. I heard that just as different any time. In the data center, you know how you manage firewalls, IP addresses, ACLs? There's a lot of pain. In the world of Cloud, the pain becomes exponential. In the data center, you're barely changing applications. How often do you write or add applications in the data center? At a snail's pace. How fast do you build workloads, ephemeral workloads, and all in the Cloud? Much rapid pace. Trying to do the same kind of ACLs and IP address in the Cloud for workloads to have the same single console to do both is a nightmare. It makes no sense. That is the story they have to tell. What else can they tell? The similar story gets told for the branch. Hey, Zscaler is pitching this branch thing. Why do you not have a single console for data center for every branch? The question is, I mean, huh? How many rules do you have in your firewall in the data center? 15,000. Do you have a second product to manage the rules of Palo Alto or Check Point? You know those companies, I am sure you heard of, AlgoSec, and there are three or four companies out there. That is all the businesses. Do you want the same kind of rule set here, same policy in the branch? What are you trying to secure in the branch? How many servers do you have? Zero. What's the branch to secure? Nothing. How many rules should you have? Hardly any. This is a silly notion. They try to say a branch should be like home. Most of the time, larger branches may need some rules. Think of a typical enterprise. We'll say I have 400 branches. You say, must be small, medium, large, like T-shirt sizes. They all agree. You know, typical distribution is 80% are small, 15% are medium, 5% are large. There may be plants or factories, right? 5% of 400. It's a big number, 20 plants. Okay. You say, oh, these small branches. Why do you have a firewall when you don't have a firewall at home? They're no different than home. None of that stuff is needed. It's just a legacy people trying to perpetuate. Just a second part of that question. You mentioned you had ZIA, ZPA. You're also adopting Cloud Connectors. Now, can you compare, I guess, the scale of all those products? When you look at, I don't know, the number of users or spend, how does ZIA compare to ZPA versus Cloud Connectors? Are they all equal? Is ZIA still the biggest piece of your spend versus the other two? Overall, it's kind of equal. FICO is around 4,000 employees. If you look at the total spend, it's kind of divided equally between the three of them. We're not just using those technologies. We're using also the Endpoint DLP. We're using also the CASB. We're really investing in the overall technology stack from Zscaler, which is allowing us to really meet our security maturity that we need with that. Thank you, Yoni. Thank you so much for your time. We'll move on to the product Q&A. I'll invite Jay, Adam, and Dhawal onto the stage, please. We'll start with Ittai and go to Yun. Hi, Jay. Hello. Ittai from Oppenheimer. Great day, by the way. Super interesting announcements. Really appreciate it. I guess my question is around velocity, meaning for years you've tried to have a story against why an SD-WAN box is not needed, and it took you a while, and you got an SD-WAN box, and you're displacing. You're now with Adam's. We have no SD-WAN. Yes. Nonetheless, We may call it Zero Trust. Zero Trust. Okay. That's only done so that marketing searches show up Zscaler. Very good. Show up. Okay. I guess what Adam is working on, you're not going to call that SIEM, okay? You're going to call that something differently. That's fair enough. That's right. Zero Trust for SIEM maybe is something like that. The point I'm trying to make is that it took you years until you finally today got to a point where enterprises are at that level where, as Yoni said, we don't need firewalls in the branches. Only like the last couple of quarters, finally, you started talking about the number of customers that are actually doing this. If I take that evangelism process, how should I think about the vision of Red Canary and Avalor and the data that you clearly have a proprietary, a unique vantage point around data that others don't? How do I think about the timeline and how much evangelism you're going to have to do to get that going? It's a good point. You need evangelism, then you're disrupting things, totally new way of doing it. Okay? I mean, Zscaler, no firewalls, switchboard. It's very different. ZPA has been totally different. Zero Trust Branch has a lot of evangelism, but our customer is getting it. In the security operations area, we're actually, from end user point of view, it'll be a lot easier and simpler. Now, they don't need to build this big data lake and all that kind of stuff. I see far less evangelism needed in the security operations area. Because we are not trying to say, don't do this, do this. The problem they're solving is similar. At the end of the day, we're going to make it simpler. Here's how you think about it. You know, when Palo Alto went from Check Point, that was not a big change. It was simple. In our case, Zero Trust was totally taking on firewalls. It's like Tesla going against all these incumbents. That was the different fight. Customers are already tired of security operations solutions. We are inbound demand. Lots and lots of customers want us to get there. It's going to take some time. We knew a combination of some acquisitions or internal stuff is going to get us there. You should think about when a company moves in a new space, you must have some core competencies. Otherwise, you shouldn't get there. We saw two core competencies we had. Well, maybe call it three. One, all the data logs, 500 trillion a day. Security research team, we've got over 200 plus researchers, security research, serious research. A very large and eager and happy customer base. We needed the Avalor piece to do a better way of a data fabric without going to this big data lake all the time. That was the first piece of architectural stuff. Now Red Canary bringing the application side of agentic technology to us. It is exciting. I expect it to be far less evangelistic here. All right. This is Yun from Loop Capital. Thanks for doing this today. Basically, as you guys are getting into data security and agentic AI security and whatnot, identities are becoming more important. Obviously, you have some foundational technology behind that through the ZIA and whatnot. How much do you need to get into the identity security layer for you to be more effective in data security and agentic AI security? Or do you plan on continuing to partner with those people in those spaces? I'll start, then Dhawal or Adam can go deeper. We've been asked many times to get into adjacent spaces. I've been asked so many times, why don't you buy an EDR vendor? Why don't you buy an identity vendor? We stayed away from it. We have clear ideas where to go to. We integrate with identity vendors. Now, there's next level of adaptive stuff we can do that Dhawal can explain to add more value on top of it. We are working with Microsoft on the agent identity. Microsoft is a natural company to do that. Working with them to leverage it is a good thing. Core identity, we want to work with someone, but we have value to add on top. Yeah. Look, we are a consumer of identity. If the identities are well defined for users, right, we consume it. What Jay talked about is identities are still very static. What we are able to do as a switchboard or policy engine is collect a lot of telemetry around the risk associated with identities and the risk signals. We compute things like risk score, but have a lot of raw risk signals like people connecting to guest Wi-Fi or people, impossible location popping up, hundreds of these attributes. All of these become context to the identity, and we build rich policies around it. We also are building APIs for our customers to take that from us and integrate everywhere in their environment. When you think about non-human identities, like workload identities or identity of OT systems, we are, again, integrating with a wide variety of vendors who generate tags and labels. This is an area where, by virtue of how we get deployed, for example, in branch as a gateway appliance, we are profiling and understanding what these devices are, which become identifiers for them. We integrate with APIs of all the cloud providers and learn their identities. We talked about our micro-segmentation service, which basically builds the process-level identity map. Yes, we have more context and identity to enrich customers' existing identity systems because identity is a core pillar of Zero Trust. We are making it richer and richer. We do have capabilities around ITDR, identity threat detection response, that plugs into the broader security operations use cases as well. Yeah. Just maybe a quick add to both of those. I think, again, consumer of identities, not necessarily the creator of those identities, and for very specific use cases. You'll see a little bit more of this potentially tomorrow if you're here as well. In the security operations world, identities are super important. Identities are also defined very differently across elements of your organization. What looks like A Geller is also Adam Geller is also Adam G or A Geller slash local. Having a data fabric, one of the things we're using is to normalize that as well because that's about understanding context. Those are not different behaviors or different people. We want to understand that as one thing. That's another area where identity will be very important for us. We build on top of identity and deliver real value. All right. Let's go to Adam and Junaid. Thanks. Adam Tindle, Raymond James , thanks for doing this. Jay, I want to continue the conversation on Red Canary and the push into the SOC. As we think about that, most MDR and SOC plays have started with the endpoint and moved into SIEM and then pushed into the SOC, whether that's CrowdStrike buying Humio, Palo Alto, moving to XSIAM, and then having this path into the SOC. You're coming at it from a different angle, from the network and then data and then into the SOC. I just wonder if you could describe maybe the pros and cons to eventually moving into SIEM and endpoint. Sounds like you're not very interested in that, but if you could flesh out that discussion. The second piece of the question would be how to manage the potential channel conflict as you move into this, right? By starting with endpoint SIEM and getting into SOC, I think it got channel a little bit more comfortable with that move. You are going straight into this, and you obviously have a very channel-friendly strategy. I wonder if you could touch on that as well. Thank you. All right. First of all, where do you start? The easiest thing for an EDR vendor to start is from EDR telemetry. That is all they have. An EDR tells you if something got compromised or not. That is all it tells you. If you can really understand that and you have communication channel, you understand a lot more. Before a machine gets compromised, often reconnaissance takes place. We see all of the reconnaissance. It's just that it so happened a few, couple of vendors started from the EDR side of it. Traditional SIEM SOC never started from the EDR side of it. That's why EDR, calling it MDR and XDR, all these are, nothing was useful. Okay? They kept on creating more and more acronyms, hoping that one acronym will be more useful than others. Eventually, also what's happening is, I mean, old SIEMs may have 100 sources of data, 150. Really four or five sources matter in today's world. Who cares about the logs from your router and switch and firewall in the data center somewhere? Most of the world is moving to the cloud. Our communication logs, extremely important. EDR logs, very important. Identity logs, very important. And some of the cloud workload logs, very important. That's really the big universe. Anyone to do it right will need to get all those things. We not only have communication logs with our endpoint agent. We've got tons of telemetry about the endpoint as well. Even though we aren't an identity provider, all authentication and failed authentication attempts go through us. We got all those signals as well. It was the right thing for us to start the right way to say these are the core sources. We'll get some of the data sources, but 80% of the stuff you need is already sitting with Zscaler. That's what kind of gets me excited. In terms of comparative position, it's not a comparative position at all. We got Red Canary for the technology they built. They kind of surprised us with the technology they had and the expertise and the way they were able to run this operation with amazing gross margins. I just couldn't understand how the margin could be so good. We understood it's a technology. They use the technology. Bringing the technology together, very complementary. Competing with others, we are going to remain a technology company. Having MDR expertise in some of the customer base is good for learning. If you don't have any experience in that space, I would say that you can't be a good provider of the solution. We have a small professional services team, but we don't compete with our partners on professional services. In fact, we embed sometimes our professional services with the partners to get them trained on it. Similarly, it's a massive world out there. We'll remain a technology company, drive technology so our partners can use our SOC Ops technology to do managed services out there. Take the last question for this session from Junaid. We have one more Q&A session after this, so we'll come back to Q&As. Thanks, Ashwin. Junaid Siddiqui, Truist Security. Jay, data security has been and continues to be a tremendous growth vector for your Zscaler. One of the things you've talked about in the past is that you've got the best vantage point in terms of delivering data security, sitting in line, being able to inspect all traffic, going into all kinds of applications. Could you just talk about some of the newer modules under your data pillar that address the out-of-band and data-at-rest and how the traction has been in those specific modules? Just overall, how do you envision that whole data security landscape shaping out as there are a lot of vendors that are trying to address that same pain point? Thank you. I'll start then. Adam, you can go deeper into it. Our strategy is to make sure we secure your data no matter where it is because they want one policy. When all traffic is going through us, when it goes through the internet, and knowing that all data leaks through the internet, we are in the best position to really provide holistic data security for us. We had pieces to take care of that we completed in the past few years. Maybe Adam, you can go deeper into it. Sure. Yeah. If you think about the different channels, right, and functionality, you need to be able to discover. You have to be in the right spot to discover data. Inline's a little different because inline is very much you're seeing it. You need to be able to quickly classify and make a decision. Data security goes much more broadly than that. There's all about the discovery. That's what you're doing when data is at rest. That started off in, think of it as in the SaaS world, in collaboration applications, then got very interesting with public cloud storage buckets, unstructured data, and then to structured data elements that are running in cloud and running on-prem. All of those kind of play into having a consistent way to discover, classify, and then sometimes we classify and then something else enforces because there's another technology that we're working with, like a Microsoft, right? When we're in the path, it's much easier for us to use our own classification. Sometimes we classify it, and then that's leveraged by another enforcement point because we're not in the path of that kind of flow, right? All of those pieces play out. The endpoint, actually, over the last several years has become more and more important. It's an important landing point. You see data before it's being transported and moved around. Endpoint DLP was a little bit, I think, not as high of a priority or thought several years ago. The team listened to some very solid feedback from customers and said, "If you're going to help me get on a modern data protection journey, this is a foundational element of a DLP solution in the classic sense, and you need to be able to do it. You need to be living there. You can't just live at the data sources. You have to be on the endpoint too. That's where that got added in. When you think about data security posture management, it's another lens of looking at this where you're taking those different ways you look at data. It's also looking at the configurations of the systems that support data, not just the actual data itself that's sitting underneath it. I think that's an interesting angle. It's why we're representing in that space as well. All right. Thank you so much. Now I'd like to invite Mike Rich, our CRO, President of Global Sales, onto the platform, please. All right. How many people were here last year? Pretty much a little over half the room. Good to see everybody again. Mike Rich, I'm President Global Sales, CRO. I joined the company really November of 2023 and laid out a strategy of what we want to do, kind of the go-to-market. We've been very consistent, the go-to-market vision. Number one, it was about transitioning to more of account-centric. So Zscaler had been really in the transactional mode, which was very good for that time in its growth. But we saw the need to really get deep with customers and make sure we could build out long-term strategic plans with them to consume on the platform and work, meet them kind of where they are. Also, an amplifier from the GSIs. GSIs are so important, especially with the top of the pyramid customers, which is a big chunk of where our revenue comes from. The GSIs can help on that strategic journey, right? We've built out strong GSI partnerships in the last 18 months and then increased focus on specific verticals. The vertical sales, we'll talk more about that, but it's all about getting better relationships at the C level. When you're speaking in the industry language and helping them compete in their industry, they want to have conversations with you. You become more strategic. This is just some examples of how we've grown and how this strategy has helped us. If you just look at the number of customers spending over $5 million with us, that's grown. The customers that are spending over $1 million, that's grown. Validated. We're going to continue to double down on the strategy, and I'm very pleased with where we're at with it. On the GSI side, that's helped us get stronger pipeline, more strategic relationships, and ultimately drive more revenue. That 40% increase year over year is great. I think we can continue on that path. Again, adding that $5 million in bookings is fantastic. It was much smaller scale before. We talked a little bit about the verticals. We've got healthcare, State and local, and federal today. That team has grown significantly. That's validated that strategy. Like I said before, when you get in deep on the vertical side, industry-specific solutions, executives want to have conversations with you. That helps us drive better business, more strategic relationships, and longer-term plans with the customer. This just kind of validates how that's worked for us. Very happy with what we're doing in healthcare. You've probably, let's see, we had Advent Healthcare CISO in here earlier. Is he still here? That's great. He's gone. Yeah. Fantastic relationships there. We're going to see that expand, and we're going to move beyond that too. Even if you look at financial services, huge, huge area for us. The plan is to be organically from bottoms up, hire more people dedicated to that region, get territories that are specific to those industries. Once you get enough density, you add the first-line managers. Once you get enough density on first-line managers, you add second-line managers. It's that bottoms-up approach versus tops-down to make sure we're taking full advantage of the resources and we don't have people flying over each other. That's the least disruptive way to do it, to take advantage of the growth. This is what's most exciting to me. We're still a people business. We've got great technology. You got to have great technology, but you also have to have great people that can help strategically align with your customers. We've got a strong leadership team. I'll show that a little bit later across all geographies. The GSI and national strategic partnerships, again, those have been validated. We've hired people that know how to sell and work with them. It's a bit of a give-and-take relationship when you're building out motions with GSIs. They've got to see a way to build out there and grow their business. They've got aggressive numbers that they have to fulfill. We have to be conscious of that and make sure it's bidirectional. Then again, the platform, more realization, value realization for customers and partners. When you have a larger platform with more products versus just ZIA and ZPA, ZDX, now we've got all these other solutions that you talked about with Zero Trust Everywhere and all the different users that we can actually go in and help secure and protect. It just provides more solutions that we can go sell. You have to have that flexibility in the platform. The other thing that's exciting about that is it helps us get into some of these accounts where we were kind of boxed out before. Now we have solutions that go beyond just ZIA and ZPA that we can sell in to get the new logos. This is just a quick snapshot of the team. You've probably seen or met some of these people. I know Ross was at the analyst event last night. Some of you may have met Ross. He runs AMS for us. Ross, I worked with Ross for years at ServiceNow. Very strong leader. Pete has been here for seven, eight-plus years. A lot of experience. He's fantastic. He's running the federal, state, and local and healthcare business. Brian Marvin runs EMEA for us. Strong background, enterprise sales, gets how to work with GSIs and partners and do strategic deals. Then Andreas Hartl, great background, Microsoft for a long time, knows how to run the APJ business. It's a very complex business, a lot of different countries, a lot of geographies to handle. He's been fantastic. Then Anthony Torciello, who's running our channel business globally. Worked with Anthony for years, actually, at ServiceNow as well. He built out large programs with GSIs, Anvars at ServiceNow. Did anybody go to the breakout, the partner breakout? No? Okay. Jay, I know you went. They enjoyed your Red Canary discussion. Thank you. Focus areas for 2026 and beyond. Increasing enterprise penetration. We've got a lot of customers in enterprise, but we're still very underpenetrated, right? Even in the customers that we've sold to, but the net new logo portion of it, there is a lot to go after there. It's fertile hunting grounds. We've only got the penetration there is low, 20-30% range, right? A lot to go do. Growing new product categories. You've heard a lot about the new products today. I wasn't here for the whole thing, but I know you've seen Adam's presentation, which was fantastic today. It's great to have a robust platform that you can go sell. Customers appreciate that, and it gives us options. We've got a lot of work to do to get penetrated where we should be in these accounts. We're utilizing our specialty sales takeoff. You've heard the term Takeoff Teams, specialty sales. We kind of use those together to focus on going after these solutions. We've got our core teams that are going to partner with the specialty teams to help accelerate these motions. Zero Trust Everywhere, and then also Agentic Operations. These are massive underdeployed areas. The Cost Takeout piece goes across all these motions. That just helps us validate when we're trying to do larger deals with customers, we're building out plans where they can actually fund the deal over time with Cost Takeout. We've always had this as a benefit of Zscaler. What we've really done in the last year has become very prescriptive, very prescriptive with how customers do it. We're helping them along the way, build out, kind of doing their homework for them. That's been good. Of course, the channel coverage we talked about. Just a quick snapshot when we talk about the new logo opportunities. We've got lots of new logos to go after. We've got 4,000 current customers, right? There's another 16,000 to go after, right? Even in those 4,000 that we have, they're underpenetrated. You've got existing customers that are underpenetrated, and then you've got the new logos. What we're doing to help facilitate going after them is making sure we have territories set up the right way. I take territory planning very, very seriously to make sure in by GO, we've got the right people in the right territory focused on the right accounts, right? In the G2Ks, the reason you see 1,700 as a number up there, we've got 700 today. 1,700 is really what we can go after because you have to look at we can't really sell to Chinese companies and Russian-based companies. 1,700 is who we're going after. We've got territories that are focused on just those accounts as well. Even in the G2Ks that we do have, again, the potential is $5 million plus in the vast majority of those, and most of them are under $1 million today. We've got a lot. We can go do a lot more selling. We can do it. It's fertile hunting ground for those accounts that are even customers already. Focus execution for new product growth. You heard Zero Trust Everywhere. It's fantastic. Customers love it. It's a great motion for us. We have dedicated sales plays to go after that. Data Security Everywhere. That part of the portfolio has become more and more robust, and you're seeing a lot of deals we're doing, takeout deals we're doing there. They do not like the incumbents, the legacy providers. They're looking for us to actually come in and help them drive that story, which is fantastic. Agentic Operations. This combined business for us is $1 billion ARR. It could be a heck of a lot more. Our target is to get to $390 million by the end of next year on this Zero Trust Everywhere. That's where they have three or more of our products that qualify as Zero Trust. Lots of potential, and the strategy is working. Again, we talked about the channel leverage and going after the G2Ks really helps you with the top of the pyramid accounts, which are typically G2Ks. There's also the government accounts that are very large. They help you in the government accounts, and they help you with the multinationals, right? Some of those are private, and they're not G2Ks, but regardless, they help you accelerate the big deals, which is fantastic. That motion is going well. Cloud marketplace, this is the Hyperscalers. This motion is still fairly new to us, but we've become much more strategic thanks to Puneet's work. Thank you, Puneet and team. We've got a great motion going there. I expect to see a lot of growth to come out of that. Just again, that's where we're leveraging them to help us sell and go to market, right? AWS, Google, Azure. Increased investments in these strategic regional partners. Traditionally, we've had sort of a transactional relationship with them, but what we've doubled down with them on, that's why I asked if anybody went to the channel breakout. We're rewarding them for building out dedicated practices, right? This is where they're actually going to help deliver value. They're going to help with the implementations. They're going to help with the strategy and make sure what we sold them together gets deployed and that we have a strong strategic roadmap built out with them. I call it the Three-Legged Stool. You got the customer, Zscaler, direct sales, and the partner, the three of us working together very closely versus being just transactional. Part of this is getting all your resources focused at the top of the pyramid, building out on the bottom of the pyramid because we have a lot of customers down below, but it only represents 5%-6%. Got to make sure that we've got partners that can drive that business for us so we can use our valuable resources to sell up market, and that motion is going really, really well. You're going to see more and more of that as well. You've heard Jay talk about the Cost Takeout program. Super important. This is just some examples. You guys have probably heard a lot about it, but customers do appreciate that we're being more prescriptive. It's hard to give up products. People love to hug their hardware. We've got a plan to help them phase these things out. It's going over quite well. It's just a more prescriptive approach, and we're super focused on it. This is just an example of a customer that has 20,000 plus users and the potential savings, right? This is just on average. Z-Flex. We've talked a little bit about that. You've heard a little bit about it. Customers have asked for a more flexible way. When you have a platform of consuming the platform, and when you have a platform with multiproducts, there's no way to predict ahead of time exactly how much of which product do I need to go use, right? This is a great way to help get them to commit to more spend, right, and adopt the platform at their speed and do it in a very easy consume method. They love it too because it's predictable budget, right? There's one thing a CIO hates is when they have an unbudgeted event. They don't like that. They don't like to be nickel and dimed. We're just providing an easy way to consume the platform. It also gives a white glove treatment. We're being selective on who we offer this to. It's not just everybody. It's really our top most strategic customers. That's the important part to look at. This is a case study. This is a customer. Won't say exactly who it is, but this was the benefit once we were able to offer Z-Flex. This is the value that came out of it. It's adoption, greater adoption across the platform, and of course, the uptick in spend. Would have been hard to get this value if we didn't have this offering. Okay? That's it. Did I do a good job for you? Yeah. Was that okay? Yeah. Okay. I know a lot of you had product questions as well. Adam and Dawn are kindly agreed to stay back. I will invite Adam and Dawn on stage. Along with Jay as well, please. Jay? Jay. All right. First question, Gray Powell. And then Andy. Do you have product questions? Yes, you do Z-Flex. Perfect. All right, great. Thanks. Yeah, so Gray Powell, BTIG. Yeah, just a question on Zero Trust Branch. It seems like customer interest there has picked up a lot just in the last few months. Your messaging seems a lot more aggressive today than maybe six months ago. I'm just kind of curious, what's driving the interest or the uptick that you're seeing today? What's different? On average, if a customer adopts Zero Trust Branch, and I know there's probably a wide range here, but just how much does it impact the contract value? How much does it go up? Even if you can talk ballpark or generic terms, it'd be really helpful. On start of the highest level, yeah, we have been evangelizing Zero Trust Branch, the better way of doing it. There is a lot better understanding of it. Our customers understand the value, so there is tons of interest out there. I mean, the interest far exceeded my personal expectations, right? I know all of you analysts look for numbers, okay? I mean, it varies a lot, okay? Some customers are starting with saying, "I got 200 branches. I want to start with 20 branches first or 30 branches," or someone will go with all of them. It varies quite a bit. We see a significant opportunity, simplification, cost reduction as well. Yeah. First in the messaging part, right, what's really clicking with customers is they see Zero Trust for users working, deployed everywhere. What they also appreciate is that we are not building three different Zero Trust solutions. The policy framework and how we have built Zero Trust architecture is when customers do user-to-app segmentation with us, the same segmentation framework extends for cloud as well as the branch. When we make acquisitions like AirGap, which is now part of the unified appliance, as I explained, basically the same framework extends. You basically have Zero Trust Everywhere with the same policy framework. What is also resonating, by the way, is for a very long time, you look at Gartners of the world, they were talking about SSE, SASE only for users. We have seen them started calling it Zero Trust Networking, Zero Trust SASE, or Zero Trust SSE. We are seeing they also picking this up and advising their clients. As Jay mentioned, right, a lot of our existing customers are coming to us and saying, "I want to start by doing this Zero Trust in my factories first." They will do for about a dozen or two dozen factories and then expand it more and more. A lot of our customers have SD-WAN contracts, which are getting up in two years. The new branches, for example, for a banking customer, they are moving that to Zero Trust and not doing SD-WAN anymore. Over a period of time, it will, of course, replace all of that. All right. Let's go to Andy Nowinsky and then come to Keith Bachman. Thanks, Andy Nowinsky, Wells Fargo. There are a lot of vendors that talk about SASE and Zero Trust, but it seems like every vendor has a different architecture. When I think of Zscaler, I think of that one-to-one relationship where you're connecting either one user or one device or one workload to one user and device and workload. That is very different from how a lot of the other firewall vendors think of SASE and Zero Trust. I guess now that you're selling Zero Trust Everywhere, do you think customers actually understand the architectural differences between Zscaler and the other alternatives? I would think it would be harder to sell them on Zero Trust Everywhere if they do not even understand the architectural differences. Maybe your Cost Takeout program would differentiate that as well. Right. On start, this is my favorite topic. I talked to Gartner all day long about it. SASE has nothing to do with Zero Trust. Somehow the words got confused. Zero Trust means Zero Trust. Now, you can kind of talk around and say, "I can make Zero Trust by putting firewalls around," because if I put lots of firewalls, so each entity is its own little cell, then it's Zero Trust. Not practical. SASE is a catch-all, so more vendors could participate in it. Okay. SASE says SD-WANs, SSE, and everything. How many networking vendors are there? They're looking for something to grab on to say, "I am part of this thing." SASE means nothing. SASE means everything. It allows every vendor to take some of the reports and say, "Look, I am SASE too. I'm SASE too." Our customers ask for Zero Trust more. Our investors, our analysts ask more for SASE because they got briefed by vendors all day long. Customers often, when they talk to us, they really buy into Zero Trust. That's really what we're trying to do. As you said, Zero Trust is about not trusting people being on the network. It's a one-to-one connection. Look, you saw a bunch of customers at the conference. They all understand. They love it. It used to be that only early adopters loved Zscaler. Now it has gone fairly mainstream. There probably is a small part of late adopters we still need to work on. That's part of the journey. When customers see Zero Trust and they see tangible cost savings, we win the deals. One thing to add to what Jay said, right? Where we are, how we are practically going with the customers on adopting Zero Trust Everywhere is actually work with Mike's team and the technical resources there, like architects and SEs, to do very detailed workshops with customers to figure out how their networks and their security is built. How is point A talking to point B, and what do they use for network security? We basically come up with the underlying architecture for them to go on a roadmap with us. Customers who are already deployed with ZIA, ZPA, they go to the next frontier like branch or cloud. Those who are starting from scratch, they start with users and then start working on deploying. There's a very detailed technical architecture plus that ties into the Cost Takeout on what we can replace over a period of time. It's a full runbook that we are executing. You know, if I may give you my futuristic statement, okay? Four years ago, you guys are asking ZIA is good, but who is going to buy ZPA? How many? ZDX, right? I would say every user of a customer, they need ZIA, ZPA, ZDX, all three. Because it made natural sense. We are seeing the world by and large do it. In fact, most of the new deals we sell, they start with Zscaler for Users, all three things together. A lot of upgrades we do on upgrading from ZIA to ZPA or ZDX, combination of that stuff. Our customers enjoy and see the benefit of Zscaler for Users. I do believe that almost all of our customers, it's a matter of time, will embrace Zscaler, our Zero Trust Branch, and Zero Trust Cloud. It's a natural journey. Keith and then Andy. Hi. Thank you very much. It's Keith Bachman from Bank of Montreal. I actually had two questions. The first for you is you raised a question that certainly comes up in our discussions with investors. You identified Zscaler as 4,000 enterprise customers, and there's a total TAM of much larger than that. What are those customers using? We as investors think everybody has the necessary architecture to provide some form of protection. Therefore, to win those incremental logos, you have to have a displacement. Help us understand why you think you gain those new logos. Are they using anecdotal architecture? How do you win those new logos? I have a follow-up for Jay, please. You kind of saw on the Cost Takeout slide all the different things that we end up replacing. The real question is, are you replacing, or are there actually greenfields in there too? There's a little bit of greenfield, right? You are over time supplementing, and you are replacing over time. They are retiring spend on different firewall and VPN products. I would say 80% of it is you're replacing, and 20% is you're just adding new capabilities that they just didn't think about or have before. Maybe expand upon it a little bit. Everyone has something. The big part we replaced early on was proxies, Blue Coat of the world. That was a much smaller market. We did not just replace the Blue Coat proxy. We replaced the whole outbound DMZ, so to speak. For ZPA, most people think, "Oh, it is a VPN replacement." VPN is only a piece of it. It replaced the entire inbound stuff. Some people may have firewalls, some have all this stuff. As Mike said, somebody has something or the other. If they want to do Zero Trust, that is not in place in most places out there. Yeah, just to add to that, they're solving the problem right now. They're solving it inefficiently, and they're recognizing where their gap is. They can choose to solve it by either trying to continue to tune what they have, or some of these who look and realize the approach is ripe for a different way to look at the problem. It becomes a broader discussion, and that's where I think we have the most opportunity when those conversations come up. It is sort of a natural transition to my second question. It feels like the messaging has changed quite a bit from Zscaler appropriately. You are now trying to win the heart of the stock, is the way I see it. You are coming up at it, as Adam and others have said, through a different architecture. It sort of begs the question, what are you missing to keep winning share of that stock dollar? The way I think about it is data is critical. You guys have a lot of untapped data that here for you really have not leveraged as much as perhaps you could. You were clear that inline and data, you guys have it. You got it. You are great at that. Maybe the broader capabilities of data when you're correlating all these different threat information, NDR is a part of it, but it's not everything. The broader question is, what else do you need? It lends itself to a SIEM, which has sort of been implied. What do you think you're missing to win that greater share of those existing accounts and to leverage the data set that you already have a lot of visibility to? I think as far as what's needed or missing, the approach to running security operations, I think there's a structure for it, right? Data is certainly an element of it. You don't have to create all that data yourself. Certainly, when you do, you have a strong foundation. As I mentioned, the Avalor acquisition was independent of Zscaler. Their 150 connectors had nothing to do with Zscaler before they joined and joined up with us. All of those signals and contexts, that's a recognition that customers' environments are and will continue to be heterogeneous for a really long time. We have no belief that it's going to be all Zscaler only. It's just not the way the world works. It's also not the way security operations works. Having that data come in, I think, is extremely important for us. When we think about where that world heads, it depends on what happens in the investigation world. There's a huge part that's about automation of the workflows. That was originally, you could say, started with sort of the SOAR and automation technologies. Now it's how AI-driven is it? How agentic is it? I mean, these are phrases to put on it. There's reality behind that. It's still all about if there are 10 steps for an analyst to go through to quickly detect, investigate, and respond to something, how many of those 10 can I automate and intelligently automate before a human being needs to look at it? Because it's not autonomous. The human being is not going to disappear from this. It is inserting them at the right spot and recognizing that the data you need to look at because your environment is changing, you need to be able to keep up with that. I think that is going to be a part for us that will be very important. Cloud, we know, is important. A lot of the cloud teams sit very separately from the SOC teams. Try as you might, the SOC person wants to see all of it. The person who runs the cloud says, "I got that. Do not worry about it." We know we will have to live in these hybrid worlds probably for a very long time based on the way our customers are structured. From a business opportunity point of view, there's real pain. People feel less pain. A firewall is sitting there. Let it sit there. Some management overhead is there. SOC is a daily pain. There's a pain of work. There's a pain of dollars growing. We think the market is ready for disruption. If we can go and have a better solution, less operational overhead, and less cost of the solution because of better architecture, we think our customers are looking forward to it. We have tremendous credibility with our customers. All right. Let's go to Andrew, and then we'll take an online question. Thanks. Andrew DeGasperi from BNP Paribas. The one question I had is this morning, Jay, you joked about the $30 million cost savings slide, and you said that maybe Warren Sales was not charging this customer enough. I waited for Mike Rich to join the panel because I just wanted to maybe ask a follow-up in terms of, are you happy with your pricing and packaging strategy? How is it evolving now that you are adding all these other capabilities on the Agentic Side? Just take it from there. I think we've made great strides. Z-Flex is just another point in the journey where you've got to make it easy to consume. I think historically, we've come out with a lot of innovation, and it's gotten complex. The licensing metrics and models have not been super easy to understand. You've seen it. Gartner's talked about it. We are just making it easier for them to consume the platform. I am very happy with where we're at today. I think we're going to continue to get better. Yeah. We've done three things in this area. One, we developed an architectural workshop to identify what needs to be taken out. Last year, we started a Cost Takeout program that helps quantify the outcome of that, is the slide I showed to you. Z-Flex comes on top of that to really make it flexible, minimize friction with procurement and ongoing negotiations. It's a good story. None of these things happens by magic. We learn, we evolve. Architectural works are important for us. Cost takeout program evolved out a lot of learning over the years. Z-Flex, we used to do some of these things custom. You say, "Let's make a program out of it. All right. We got one question from online, and then we'll go to Ittai. This is from Brian Essex, JP Morgan. Question for Mike. Are there any common themes across the accounts where you might expect to see better traction with Zero Trust platform? Is there any kind of inflection opportunity here? Yeah. I mean, the common theme is just complexity. People are looking to reduce cost and have a more simplified environment. They want happy users. They do not want to get yelled at. When you can simplify and make it less complex and provide a better user experience, those are synergistic, and those help drive the sales, especially in the bigger deals. All right. Thank you. Ittai. Thanks, Ittai from Oppenheimer. Question for you, Mike. When I think about Z-Flex, maybe we shouldn't be called Z-Flex. Maybe we should call ZSemiFlex because it's not fully flexible. When I think of some other vendors in the world that have applied a Flex-like type of purchasing model, think about Datadog in the way they've done it. Think about what CrowdStrike is doing with their very few restrictions at all in the way you first buy the product. From my understanding, Z-Flex, you need to be on a product for a certain while before you can change things in and out. You just said on stage that it's focused on the largest customers. It is still a little bit, well, semi-flex, as I mentioned before, on a certain type of customers with some flexibility, but not full. I guess, is this just a reflection of a point in time? Meaning, you and I talk about this a year from now, everybody can access it with complete flexibility. One day to the next, I can increase, decrease my consumption of certain products. Why limit this? Is this just maturity, or there's something behind this? You've got to have all your systems. You've got to have sales ops lined up. You've got to have your processes behind lined up. It's a crawl, walk, run. I do expect, again, we're early stage. It just came out in Q3, that it will mature and we'll be able to offer it to a broader set of audience when we can make it easier to deploy. Again, early stage, fully expect we're going to have a big part of the population that'll move toward it later on. Let's get it really right for these first few customers. Do you envision this potentially at some point with partners using Flex to be able to go more down market, which I know right here, right now, you're clearly trying to go after the big whales for obvious reasons, but something to facilitate a much better or faster adoption for our partners to go downstream, down market? I don't think it'll be everywhere. I think we'll have, again, probably the top 25%º–30% of customers that we'll get to have that option to move towards Z-Flex in the next year, year and a half. Let me ask you, do you think your CFO will love fully Z-Flex, no string, no time frames attached? Maybe it will, maybe it won't. I know that it's a very, when I talk to customers of Datadog and when I talk to customers of CrowdStrike, it's a point that perhaps they don't necessarily actually do. It's not that every day they increase or decrease their product. The idea to have that flexibility and the idea that that type of flexibility enables them to make sure that they don't waste dollars, that they truly get to conceptually have the ability to try everything at their portfolio at whatever pace they want, and ultimately, at the end of this, come up with a balanced approach for them, I think it's a good selling point. We like flexibility. The best selling point is the customer has no commitment, no skin in the game, other than $10 million you can spend after five years. That'll be any CFO's nightmare. Think about trying to predict numbers and what's going to happen next quarter or next quarter. It's a nightmare. We can give full flexibility for testing the product. The real sales is you've got skin in the game. We've got skin in the game. You can predict some of the stuff. We can predict some of the stuff. Those are the pragmatic philosophy that have gone into what we are doing today. Obviously, we learn and we evolve. Very good. Thank you. There's a topic we can spend a lot of time on. Let's move on. This is Joe Vandrick from Scotiabank. Mike, a lot of good details on the large opportunity ahead for both new logos and increasing customer spend that you called out there. How are you feeling today about sales productivity, and how are you thinking about adding capacity into fiscal 2026? Sales productivity, productivity per head, I'm very pleased with. It's gone up year over year. We expect it to continue to do that. We're adding capacity based on our model of making sure that we can address the right markets with the right number of people. We're being very thoughtful about how we're doing it. Because productivity is going up, that's great. We're also entering the year with more mature ramp sellers. That's a very good sign. I'm very pleased with that. All right. Max. This is Matt from Goldman Sachs. I was wondering, it seems that there's been a rise in interest in software and SaaS architectures, especially for regulated industries and international markets. Are you thinking about enabling localized independent instances of your platform and increases that potentially expand your addressable market? I'll take it. Yeah. There's a lot of interest in sovereign Zero Trust Cloud, not sovereign SaaS, for example. The customers I talk to, they're looking for Zero Trust. Our architecture is designed such that we can do it today. We have the entire technology, all three planes, sitting in Europe, serving Europe. We meet essentially almost all the technological requirements. Now, we still need to do some of the work being operationally able to run out of Europe and the like. We're making progress in that direction. We think we are in a very good position to offer sovereign clouds. Sovereign will have different flavors, the EU part of it. When the Department of Defense of Australia wants a sovereign cloud, they would rather call it air-gapped cloud. We have built the technology that can provide air-gapped cloud to different countries as well. All right. We'll take the last question from online coming from Joshua Tilton, Wolf Research. I believe this is best for Jay. In the past, the strategy has clearly been to show customers how to replace a stack of legacy boxes. I don't believe there are any legacy boxes securing agents. How does go-to-market message need to change to convince customers that Zscaler has the right way to secure AI agents, maybe for Jay and Mike both? If you saw the diagram I showed to you, Zscaler is securing users to have right access to the right application. Number one use case of AI agents is your agent is able to do the same kind of stuff that your people did. I know many call center customers who are using call center agents. There will be other agents like that. That is no different than what we do. We are securing users, similar technology with some of the additions, secures agents as well. Identity of the agent becomes one piece of it. There are some other things related to if agents are reaching out to LLMs and some of the other apps. We have some enhancement being made. We are more natural than anybody else to solve this. All right. That concludes our session. Thank you so much, analysts, investors, everybody who dialed in, and everybody who is in the room here, as well as our executives. Thank you so much for participating in the event. Thank you.

Speaker 11: Welcome, everyone. Apologies for the delay here. I'd like to welcome you to the Innovation Briefing at Zenith Live. Before we get started, please take a moment to look at our Safe Harbor statements. Quickly go over them after this. We'll start off with some comments from Jay, talking about Zscaler's platform expansion. Following Jay, we'll have Adam who will double-click into our SOC strategy. After that, we have a special guest, Brian Beyer, who is the co-founder and CEO of Red Canary. He'll talk about Red Canary's EDR technology. We'll break for lunch and reconvene with a demo on the AI solutions from Phil Tee, who is our EVP Head of AI Innovations. Following Phil, we'll have Dhawal Sharma talking about Zero Trust Cloud. I know that's an area of interest to many of our investors. There are still some lingering questions around that. Welcome, everyone. welcome everyone Apologies for the delay here. apologies for the delay here I'd like to welcome you to the Innovation Briefing at Zenith Live. i'd like to welcome you to the innovation briefing at zenith live Before we get started, please take a moment to look at our Safe Harbor statements. before we get started please take a moment to look at our safe harbor statements Quickly go over them after this. quickly go over them after this We'll start off with some comments from Jay, talking about Zscaler's platform expansion. we'll start off with some comments from jay talking about zscaler's platform expansion Following Jay, we'll have Adam who will double-click into our SOC strategy. following jay we'll have adam who will double-click into our soc strategy After that, we have a special guest, Brian Beyer, who is the co-founder and CEO of Red Canary. after that we have a special guest brian beyer who is the co-founder and ceo of red canary He'll talk about Red Canary's EDR technology. he'll talk about red canary's edr technology We'll break for lunch and reconvene with a demo on the AI solutions from Phil Tee, who is our EVP Head of AI Innovations. we'll break for lunch and reconvene with a demo on the ai solutions from phil tee who is our evp head of ai innovations Following Phil, we'll have Dhawal Sharma talking about Zero Trust Cloud. following phil we'll have dhawal sharma talking about zero trust cloud I know that's an area of interest to many of our investors. i know that's an area of interest to many of our investors There are still some lingering questions around that. there are still some lingering questions around that We'll have a customer talk about their Zero Trust Cloud journey with us. Of course, we'll have Dhawal for the product Q&A session as well, which follows customer Q&A. After the product Q&A, we'll have Mike Rich on stage talk about the go-to-market strategy, key priorities heading into fiscal 2026. Then we'll end with executive Q&A. I know many of you want to get back to CrowdStrike, so we'll try to end it well before two, targeting 1:50. If we get it done by 1:45, it's a win. We'll try to get it done with that. Let me welcome Founder and CEO of Zscaler, Jay Chaudhry, onto the stage, please. We'll have a customer talk about their Zero Trust Cloud journey with us. we'll have a customer talk about their zero trust cloud journey with us Of course, we'll have Dhawal for the product Q&A session as well, which follows customer Q&A. of course we'll have dhawal for the product q&a session as well which follows customer q&a After the product Q&A, we'll have Mike Rich on stage talk about the go-to-market strategy, key priorities heading into fiscal 2026. after the product q&a we'll have mike rich on stage talk about the go-to-market strategy key priorities heading into fiscal 2026 Then we'll end with executive Q&A. then we'll end with executive q&a I know many of you want to get back to CrowdStrike, so we'll try to end it well before two, targeting 1:50. i know many of you want to get back to crowdstrike so we'll try to end it well before two targeting 1:50 If we get it done by 1:45, it's a win. if we get it done by 1:45 it's a win We'll try to get it done with that. we'll try to get it done with that Let me welcome Founder and CEO of Zscaler, Jay Chaudhry, onto the stage, please. let me welcome founder and ceo of zscaler jay chaudhry onto the stage please

Speaker 12: All right. Thank you. Thank you, Ashwin. All right. All of you had a chance to listen to our keynotes, right? Did? Hopefully, that answered most of the questions. All right. All right. all right Thank you. thank you Thank you, Ashwin. thank you ashwin All right. all right All of you had a chance to listen to our keynotes, right? all of you had a chance to listen to our keynotes right Did? did Hopefully, that answered most of the questions. hopefully that answered most of the questions All right. all right I'll make a few comments. If you look at our focus area, we are, you've seen our story evolve. Zero Trust started with ZIA to ZPA to ZDX. Then it became Zscaler for Users. Zero Trust Everywhere has become a big story. Data security is one of the fastest growing areas for us, a sizable area. It's a natural extension for us. And Agentic Operation, this is the new area of evolving and growing. Red Canary acquisition is part of that story for us. In addition, we are making sure AI is getting embedded in all areas. The way we do detection today, even in inline, we do data loss prevention. All that is getting changed. Internally, we're embedding more and more AI to do all those things in a much better and faster fashion. Disrupting our own cells is a good thing. I'll make a few comments. i'll make a few comments If you look at our focus area, we are, you've seen our story evolve. if you look at our focus area we are you've seen our story evolve Zero Trust started with ZIA to ZPA to ZDX. zero trust started with zia to zpa to zdx Then it became Zscaler for Users. then it became zscaler for users Zero Trust Everywhere has become a big story. zero trust everywhere has become a big story Data security is one of the fastest growing areas for us, a sizable area. data security is one of the fastest growing areas for us a sizable area It's a natural extension for us. it's a natural extension for us And Agentic Operation, this is the new area of evolving and growing. and agentic operation this is the new area of evolving and growing Red Canary acquisition is part of that story for us. red canary acquisition is part of that story for us In addition, we are making sure AI is getting embedded in all areas. in addition we are making sure ai is getting embedded in all areas The way we do detection today, even in inline, we do data loss prevention. the way we do detection today even in inline we do data loss prevention All that is getting changed. all that is getting changed Internally, we're embedding more and more AI to do all those things in a much better and faster fashion. internally we're embedding more and more ai to do all those things in a much better and faster fashion Disrupting our own cells is a good thing. disrupting our own cells is a good thing The key is the proxy architecture built is our biggest advantage. You're the checkpost. Everything comes to you. You can swap technique A with technique B, but that's the biggest barrier to entry for us. This slide, hopefully, you saw the evolution. This is basically saying, as a Zero Trust Everywhere, any entity to any entity, showing you the key destinations on the top and the key entities that are trying to reach on the bottom. This rounds out the story. It'll be very hard for someone to come from behind and say, "I can do all this." A lot of people who try to say, "Gee, we do what Zscaler does at a third of the cost," are trying to catch up on the user functionality. Workloads have their own nuanced tongue. The key is the proxy architecture built is our biggest advantage. the key is the proxy architecture built is our biggest advantage You're the checkpost. you're the checkpost Everything comes to you. everything comes to you You can swap technique A with technique B, but that's the biggest barrier to entry for us. you can swap technique a with technique b but that's the biggest barrier to entry for us This slide, hopefully, you saw the evolution. this slide hopefully you saw the evolution This is basically saying, as a Zero Trust Everywhere, any entity to any entity, showing you the key destinations on the top and the key entities that are trying to reach on the bottom. this is basically saying as a zero trust everywhere, any entity to any entity showing you the key destinations on the top and the key entities that are trying to reach on the bottom This rounds out the story. this rounds out the story It'll be very hard for someone to come from behind and say, "I can do all this." A lot of people who try to say, "Gee, we do what Zscaler does at a third of the cost," are trying to catch up on the user functionality. it'll be very hard for someone to come from behind and say "i can do all this." a lot of people who try to say "gee we do what zscaler does at a third of the cost," are trying to catch up on the user functionality Workloads have their own nuanced tongue. workloads have their own nuanced tongue There's a common thing as an exchange, but identities of workloads, requirements, segmentation, north, south, east, west has. Things are built and evolved. IoT has become a good story, not for just communication, now with AirGap integration. The Zero Trust device segmentation is making it very, very strong. The latest area I covered is the AI agents, their communication, LLM models. We are very excited. The story is becoming very, very clear. To make it happen, we had to evolve our exchange. Its core foundation has been solid. We started with when we said internal access. The exchange had to figure out all the policy checks, all the detection need to be done for private access. It had a different set of functionality and checking involved. B2B collaboration, you heard, is a massive opportunity. Every customer wants to connect with every customer. There's a common thing as an exchange, but identities of workloads, requirements, segmentation, north, south, east, west has. there's a common thing as an exchange but identities of workloads requirements segmentation north south east west has Things are built and evolved. things are built and evolved IoT has become a good story, not for just communication, now with AirGap integration. iot has become a good story not for just communication now with airgap integration The Zero Trust device segmentation is making it very, very strong. the zero trust device segmentation is making it very very strong The latest area I covered is the AI agents, their communication, LLM models. the latest area i covered is the ai agents their communication llm models We are very excited. we are very excited The story is becoming very, very clear. the story is becoming very very clear To make it happen, we had to evolve our exchange. to make it happen we had to evolve our exchange Its core foundation has been solid. its core foundation has been solid We started with when we said internal access. we started with when we said internal access The exchange had to figure out all the policy checks, all the detection need to be done for private access. the exchange had to figure out all the policy checks all the detection need to be done for private access It had a different set of functionality and checking involved. it had a different set of functionality and checking involved B2B collaboration, you heard, is a massive opportunity. b2b collaboration you heard is a massive opportunity Every customer wants to connect with every customer. every customer wants to connect with every customer Maybe it's a user side of it, but site to site side of it. We got customers taken in medicine or hospitals that connect into thousands of other sites, site to site connection. Think of the third-party supplier risk. This kind of stuff takes care of it in a very, very clean Zero Trust fashion. For AI, the LLM proxies and supporting MCP exchange kind of stuff you heard is giving us a wonderful foundation you heard. If I show a little differently, our Zero Trust every is evolving. Users, workloads, IoT, OT. On the AI agent side, there's a lot of work going in this area. You're going to see more and more functionality come in this area and some of the customer engagements as well. That's new. You heard about data protection, data security evolving. Maybe it's a user side of it, but site to site side of it. maybe it's a user side of it but site to site side of it We got customers taken in medicine or hospitals that connect into thousands of other sites, site to site connection. we got customers taken in medicine or hospitals that connect into thousands of other sites site to site connection Think of the third-party supplier risk. think of the third-party supplier risk This kind of stuff takes care of it in a very, very clean Zero Trust fashion. this kind of stuff takes care of it in a very very clean zero trust fashion For AI, the LLM proxies and supporting MCP exchange kind of stuff you heard is giving us a wonderful foundation you heard. for ai the llm proxies and supporting mcp exchange kind of stuff you heard is giving us a wonderful foundation you heard If I show a little differently, our Zero Trust every is evolving. if i show a little differently our zero trust every is evolving Users, workloads, IoT, OT. users workloads iot ot On the AI agent side, there's a lot of work going in this area. on the ai agent side there's a lot of work going in this area You're going to see more and more functionality come in this area and some of the customer engagements as well. you're going to see more and more functionality come in this area and some of the customer engagements as well That's new. that's new You heard about data protection, data security evolving. you heard about data protection data security evolving The biggest new focus area besides SaaS and endpoint and data center and cloud is LLM and AI applications. Lots of data sitting out there that need to be protected. Bad actors being able to reach those models creates a problem. It is an extension for us. We talked about really expanding from Zero Trust to Agentic Operations. If you think about for the last 15+ years, we had one North Star, be it the switchboard, the policy engine, the exchange for anything to anything. That story has evolved, has grown, it is beautiful. Now being able to take all the important data we create out of that and being able to create value out of that is what you heard us really evolving. The story started about 18 months ago, about a year ago. The biggest new focus area besides SaaS and endpoint and data center and cloud is LLM and AI applications. the biggest new focus area besides saas and endpoint and data center and cloud is llm and ai applications Lots of data sitting out there that need to be protected. lots of data sitting out there that need to be protected Bad actors being able to reach those models creates a problem. bad actors being able to reach those models creates a problem It is an extension for us. it is an extension for us We talked about really expanding from Zero Trust to Agentic Operations. we talked about really expanding from zero trust to agentic operations If you think about for the last 15+ years, we had one North Star, be it the switchboard, the policy engine, the exchange for anything to anything. if you think about for the last 15+ years we had one north star be it the switchboard the policy engine the exchange for anything to anything That story has evolved, has grown, it is beautiful. that story has evolved has grown it is beautiful Now being able to take all the important data we create out of that and being able to create value out of that is what you heard us really evolving. now being able to take all the important data we create out of that and being able to create value out of that is what you heard us really evolving The story started about 18 months ago, about a year ago. the story started about 18 months ago about a year ago We acquired Avalor as being the data fabric for us, which is very good. Most companies we see out there do not really have anything like data fabric. They are trying to do the stuff. They put together some little stuff in their Hadoop-based stuff. We had done that stuff too. Once we saw Avalor, we said, move over this homegrown stuff. It is a real product, real technology that is helping us. Combining that with Red Canary is giving us a big, big advantage. I do not need to go through this slide. You saw that the message here is really building a number of agentic technologies, agentic task agents that can do particular tasks, perceiving, reasoning, action being taken. It is getting very exciting. They are all coming together. The one area where you can take advantage of all of that far better is the security operations area. We acquired Avalor as being the data fabric for us, which is very good. we acquired avalor as being the data fabric for us which is very good Most companies we see out there do not really have anything like data fabric. They are trying to do the stuff. most companies we see out there do not really have anything like data fabric. they are trying to do the stuff They put together some little stuff in their Hadoop-based stuff. they put together some little stuff in their hadoop-based stuff We had done that stuff too. we had done that stuff too Once we saw Avalor, we said, move over this homegrown stuff. It is a real product, real technology that is helping us. once we saw avalor we said move over this homegrown stuff. it is a real product real technology that is helping us Combining that with Red Canary is giving us a big, big advantage. combining that with red canary is giving us a big big advantage I do not need to go through this slide. i do not need to go through this slide You saw that the message here is really building a number of agentic technologies, agentic task agents that can do particular tasks, perceiving, reasoning, action being taken. It is getting very exciting. you saw that the message here is really building a number of agentic technologies agentic task agents that can do particular tasks perceiving reasoning action being taken. it is getting very exciting They are all coming together. they are all coming together The one area where you can take advantage of all of that far better is the security operations area. the one area where you can take advantage of all of that far better is the security operations area You heard about Red Canary, so I'm not sure I need to go through it again, but I'll highlight the fact that our own data, our own security research expertise combined with Data Fabric and now with Red Canary that's bringing agentic AI technology and their expertise is giving us a signal acceleration to get to the market. I covered a little bit during my keynote that we're not moving away from technology and becoming an MDR company. MDR is important expertise for us to understand and have. Having this technology and expertise combined with Data Fabric gives us a great position to really succeed there. I won't cover it. When Brian is here, Brian can make comments about some of the great technology he and his team have built. This actually is impressive. With that, maybe Adam, you can make some comments. You heard about Red Canary, so I'm not sure I need to go through it again, but I'll highlight the fact that our own data, our own security research expertise combined with Data Fabric and now with Red Canary that's bringing agentic AI technology and their expertise is giving us a signal acceleration to get to the market. you heard about red canary so i'm not sure i need to go through it again but i'll highlight the fact that our own data our own security research expertise combined with data fabric and now with red canary that's bringing agentic ai technology and their expertise is giving us a signal acceleration to get to the market I covered a little bit during my keynote that we're not moving away from technology and becoming an MDR company. i covered a little bit during my keynote that we're not moving away from technology and becoming an mdr company MDR is important expertise for us to understand and have. mdr is important expertise for us to understand and have Having this technology and expertise combined with Data Fabric gives us a great position to really succeed there. having this technology and expertise combined with data fabric gives us a great position to really succeed there I won't cover it. i won't cover it When Brian is here, Brian can make comments about some of the great technology he and his team have built. when brian is here brian can make comments about some of the great technology he and his team have built This actually is impressive. this actually is impressive With that, maybe Adam, you can make some comments. with that maybe adam you can make some comments

Speaker 18: All right. I guess I can. All right. all right I guess I can. i guess i can

Speaker 12: Come in. Don't worry. I can see you sitting back there. Come in. come in Don't worry. don't worry I can see you sitting back there. i can see you sitting back there

Speaker 18: All right. Thank you, Jay. Okay. All right. Thank you, everybody. I know many of you saw the presentations from this morning. Some, I think, on the live stream will have not. I'll do a little bit of some recaps and looking forward to conversations also with everyone. I'm going to spend a little bit of time on the AI-powered SOC and sort of the strategy here. I think the biggest aha for me when I joined Zscaler about eight months ago was I didn't fully have an appreciation for the kinds of signals and data that Zscaler actually generated. I've been in cyber for 25 plus years, but I hadn't really seen it. All right. all right Thank you, Jay. thank you jay Okay. okay All right. all right Thank you, everybody. thank you everybody I know many of you saw the presentations from this morning. i know many of you saw the presentations from this morning Some, I think, on the live stream will have not. some i think on the live stream will have not I'll do a little bit of some recaps and looking forward to conversations also with everyone. i'll do a little bit of some recaps and looking forward to conversations also with everyone I'm going to spend a little bit of time on the AI-powered SOC and sort of the strategy here. i'm going to spend a little bit of time on the ai-powered soc and sort of the strategy here I think the biggest aha for me when I joined Zscaler about eight months ago was I didn't fully have an appreciation for the kinds of signals and data that Zscaler actually generated. i think the biggest aha for me when i joined zscaler about eight months ago was i didn't fully have an appreciation for the kinds of signals and data that zscaler actually generated I've been in cyber for 25 plus years, but I hadn't really seen it. i've been in cyber for 25 plus years but i hadn't really seen it I think part of that surprise was that sometimes Zscaler does not do a good job of sharing that information. We have these interesting vantage points because so much of the traffic is authenticated. We have identities. We understand we are doing decryption. We are seeing all parts of people's networks, on-prem, in cloud, endpoints. Those vantage points really actually built up a tremendous amount of information that we can see as a company. The question is, what do you do with it? Of course, there are the protections. These are some of those elements. I broke them up into three categories because I think they are different. There are detections that are something bad is happening right now. There is an incident. You need to investigate it. A lot of what Zscaler does inline is a detection. Sometimes it is a prevention. I think part of that surprise was that sometimes Zscaler does not do a good job of sharing that information. i think part of that surprise was that sometimes zscaler does not do a good job of sharing that information We have these interesting vantage points because so much of the traffic is authenticated. we have these interesting vantage points because so much of the traffic is authenticated We have identities. we have identities We understand we are doing decryption. We are seeing all parts of people's networks, on-prem, in cloud, endpoints. we understand we are doing decryption. we are seeing all parts of people's networks on-prem in cloud endpoints Those vantage points really actually built up a tremendous amount of information that we can see as a company. those vantage points really actually built up a tremendous amount of information that we can see as a company The question is, what do you do with it? the question is what do you do with it Of course, there are the protections. of course there are the protections These are some of those elements. these are some of those elements I broke them up into three categories because I think they are different. i broke them up into three categories because i think they are different There are detections that are something bad is happening right now. There is an incident. there are detections that are something bad is happening right now. there is an incident You need to investigate it. you need to investigate it A lot of what Zscaler does inline is a detection. a lot of what zscaler does inline is a detection Sometimes it is a prevention. sometimes it is a prevention It's a flat out, "Hey, we're blocking something bad." That's still an important signal. Other times, what you're getting is a signal that there's something potentially malicious. You need to investigate this or you should look into it more. There is the whole rest of it, which is just the broader context, which when you have it, when you know about a device or the posture or what user is working on that device, when you do need to investigate an incident, that data is super helpful. That's what we've been trying to spend time to do is figure out how do we bring that together and make it very usable for our customers. It's a flat out, "Hey, we're blocking something bad." That's still an important signal. it's a flat out "hey we're blocking something bad." that's still an important signal Other times, what you're getting is a signal that there's something potentially malicious. other times what you're getting is a signal that there's something potentially malicious You need to investigate this or you should look into it more. you need to investigate this or you should look into it more There is the whole rest of it, which is just the broader context, which when you have it, when you know about a device or the posture or what user is working on that device, when you do need to investigate an incident, that data is super helpful. there is the whole rest of it which is just the broader context which when you have it when you know about a device or the posture or what user is working on that device when you do need to investigate an incident that data is super helpful That's what we've been trying to spend time to do is figure out how do we bring that together and make it very usable for our customers. that's what we've been trying to spend time to do is figure out how do we bring that together and make it very usable for our customers I framed this up, broke it out a little bit differently in the keynote, but I've been working on this kind of slide and this view probably for the last five or six months to try to think about how do I want to talk about and want a customer to understand and all of you to understand how Zscaler's vision is expanding. You could see and understand that first piece. That's what everyone knows Zscaler for. Inline, in the path of traffic. For the most part, it's real-time, but it's meant to cover all users' applications, all data. Very well known for that. As you see and know, continued tremendous investment in that area. These other two parts of a comprehensive security strategy, though, are what we're calling out and focusing more on. I framed this up, broke it out a little bit differently in the keynote, but I've been working on this kind of slide and this view probably for the last five or six months to try to think about how do I want to talk about and want a customer to understand and all of you to understand how Zscaler's vision is expanding. i framed this up broke it out a little bit differently in the keynote but i've been working on this kind of slide and this view probably for the last five or six months to try to think about how do i want to talk about and want a customer to understand and all of you to understand how zscaler's vision is expanding You could see and understand that first piece. you could see and understand that first piece That's what everyone knows Zscaler for. that's what everyone knows zscaler for Inline, in the path of traffic. inline in the path of traffic For the most part, it's real- time, but it's meant to cover all users' applications, all data. for the most part it's real- time but it's meant to cover all users' applications all data Very well known for that. very well known for that As you see and know, continued tremendous investment in that area. as you see and know continued tremendous investment in that area These other two parts of a comprehensive security strategy, though, are what we're calling out and focusing more on. these other two parts of a comprehensive security strategy though are what we're calling out and focusing more on The second part, which is what do you do before the bad event happens? This is sort of the proactive side of security. You have to understand continuously what's my posture, what's my risk, what's my exposure, my vulnerabilities. Also, you get a sense of how am I doing, but there's no specific incident you're responding to there, but you have to continually crank that wheel to try to get as good as you can. There's a whole bunch of prioritization that needs to happen there because there are more signals than you can actually deal with. Which risk or which exposure is more important to deal with than the other? That's what that middle one plays out as. The last part, which is really the newest for us, is when the bad thing's happening right this second, how do you react to that? The second part, which is what do you do before the bad event happens? the second part which is what do you do before the bad event happens This is sort of the proactive side of security. this is sort of the proactive side of security You have to understand continuously what's my posture, what's my risk, what's my exposure, my vulnerabilities. you have to understand continuously what's my posture what's my risk what's my exposure my vulnerabilities Also, you get a sense of how am I doing, but there's no specific incident you're responding to there, but you have to continually crank that wheel to try to get as good as you can. also you get a sense of how am i doing but there's no specific incident you're responding to there but you have to continually crank that wheel to try to get as good as you can There's a whole bunch of prioritization that needs to happen there because there are more signals than you can actually deal with. there's a whole bunch of prioritization that needs to happen there because there are more signals than you can actually deal with Which risk or which exposure is more important to deal with than the other? which risk or which exposure is more important to deal with than the other That's what that middle one plays out as. that's what that middle one plays out as The last part, which is really the newest for us, is when the bad thing's happening right this second, how do you react to that? the last part which is really the newest for us is when the bad thing's happening right this second how do you react to that What do you do? Having spent the last four years in the Siemens SOC space as the CEO of Exabeam, I spent a lot of time in this area. Here, it's all about how quickly can you detect something? Can you understand the scope and context, the blast radius? Is this an incident impacting one user or all of my users or in a particular area or on certain kinds of devices? To know and understand all that and then be able to quickly automate the investigation and the response to that incident. These are sort of the three pieces as I'm laying them out. That's what sort of comes together for Zscaler. We've got that first-party signal and data on the left-hand side of this picture. The right-hand side is what Jay mentioned. What do you do? what do you do Having spent the last four years in the Siemens SOC space as the CEO of Exabeam, I spent a lot of time in this area. having spent the last four years in the siemens soc space as the ceo of exabeam i spent a lot of time in this area Here, it's all about how quickly can you detect something? here it's all about how quickly can you detect something Can you understand the scope and context, the blast radius? can you understand the scope and context the blast radius Is this an incident impacting one user or all of my users or in a particular area or on certain kinds of devices? is this an incident impacting one user or all of my users or in a particular area or on certain kinds of devices To know and understand all that and then be able to quickly automate the investigation and the response to that incident. to know and understand all that and then be able to quickly automate the investigation and the response to that incident These are sort of the three pieces as I'm laying them out. these are sort of the three pieces as i'm laying them out That's what sort of comes together for Zscaler. that's what sort of comes together for zscaler We've got that first-party signal and data on the left-hand side of this picture. we've got that first-party signal and data on the left-hand side of this picture The right-hand side is what Jay mentioned. the right-hand side is what jay mentioned This is the acquisition of Avalor to give us the foundation of a place to send all of this data and make sense of it. Because the point of that data fabric, both first-party signals from Zscaler and the third-party signals from 150 different connectors of data that we can pull in, that creates context. It creates relationships between data and information around entities. An entity could be a user, could be a device, it could be a workload, it could be an API. You want to have all the different relationships and understand that because when you then go build security capabilities, you want that context in there for when you build out exposure management and Threat Management capabilities. The piece in the middle too, which I didn't talk about on the big stage, which is very important, is this is bi-directional. This is the acquisition of Avalor to give us the foundation of a place to send all of this data and make sense of it. this is the acquisition of avalor to give us the foundation of a place to send all of this data and make sense of it Because the point of that data fabric, both first-party signals from Zscaler and the third-party signals from 150 different connectors of data that we can pull in, that creates context. because the point of that data fabric both first-party signals from zscaler and the third-party signals from 150 different connectors of data that we can pull in that creates context It creates relationships between data and information around entities. it creates relationships between data and information around entities An entity could be a user, could be a device, it could be a workload, it could be an API. an entity could be a user could be a device it could be a workload it could be an api You want to have all the different relationships and understand that because when you then go build security capabilities, you want that context in there for when you build out exposure management and Threat Management capabilities. you want to have all the different relationships and understand that because when you then go build security capabilities you want that context in there for when you build out exposure management and threat management capabilities The piece in the middle too, which I didn't talk about on the big stage, which is very important, is this is bi-directional. the piece in the middle too which i didn't talk about on the big stage which is very important is this is bi-directional The first-party data, Zscaler's got to send data over, but very importantly, that signals and context, we have a current risk score for an asset or for user. Because we are inline in the path of traffic, we can use those signals in our dynamic policies. Sending back those signals back to Zero Trust to say, "Hey, based on what I know right now, this is the risk level for that user. You should use that in your policy constructs." That's something very powerful that we can do because we have both sides of this picture. Jay shared this slide before, but I'll just briefly state it because it shows some of the product names under it. On the left-hand side, continuous threat exposure management. We do have products and capabilities here. This is where Avalor's Unified Vulnerability Management sits. The first-party data, Zscaler's got to send data over, but very importantly, that signals and context, we have a current risk score for an asset or for user. the first-party data zscaler's got to send data over but very importantly that signals and context we have a current risk score for an asset or for user Because we are inline in the path of traffic, we can use those signals in our dynamic policies. because we are inline in the path of traffic we can use those signals in our dynamic policies Sending back those signals back to Zero Trust to say, "Hey, based on what I know right now, this is the risk level for that user. sending back those signals back to zero trust to say "hey based on what i know right now this is the risk level for that user You should use that in your policy constructs." That's something very powerful that we can do because we have both sides of this picture. you should use that in your policy constructs." that's something very powerful that we can do because we have both sides of this picture Jay shared this slide before, but I'll just briefly state it because it shows some of the product names under it. jay shared this slide before but i'll just briefly state it because it shows some of the product names under it On the left-hand side, continuous threat exposure management. on the left-hand side continuous threat exposure management We do have products and capabilities here. we do have products and capabilities here This is where Avalor's Unified Vulnerability Management sits. this is where avalor's unified vulnerability management sits We've had an External Attack Surface Management product so customers could understand their external attack surface. In February, we released our Asset Exposure Management. It's still early, but got tremendous response from customers because it's really meant to be a continuously updated golden record of your assets. Those assets, again, can be broader than just a device and a user. Those are really the entities and the relationships between those. That system is great for just understanding context. It's really valuable for feeding into the Threat Management side. Described in the Threat Management, we had some pieces. We generate some interesting signals with our inline, our deception capability. I mean, it's a high-fidelity detection because when someone trips up and goes to a Deception Decoy, there's no good reason for them to be there. We've had an External Attack Surface Management product so customers could understand their external attack surface. we've had an external attack surface management product so customers could understand their external attack surface In February, we released our Asset Exposure Management. in february we released our asset exposure management It's still early, but got tremendous response from customers because it's really meant to be a continuously updated golden record of your assets. it's still early but got tremendous response from customers because it's really meant to be a continuously updated golden record of your assets Those assets, again, can be broader than just a device and a user. those assets again can be broader than just a device and a user Those are really the entities and the relationships between those. those are really the entities and the relationships between those That system is great for just understanding context. that system is great for just understanding context It's really valuable for feeding into the Threat Management side. it's really valuable for feeding into the threat management side Described in the Threat Management, we had some pieces. described in the threat management we had some pieces We generate some interesting signals with our inline, our deception capability. we generate some interesting signals with our inline our deception capability I mean, it's a high-fidelity detection because when someone trips up and goes to a Deception Decoy, there's no good reason for them to be there. i mean it's a high-fidelity detection because when someone trips up and goes to a deception decoy there's no good reason for them to be there It is a high-fidelity signal that some behavior is happening that you need to look into. We have that capability. We have our Breach Predictor and our ITDR, so focused on identity threats. We had not really brought a lot of that together. Tomorrow in our SecOps keynote, we are going to talk more about how at Zscaler level we can bring that together. This also is the area where we believe the investment through the acquisition of Red Canary is going to help us accelerate in this right-hand side, this Threat Management side. We kind of tie it all together, the three big pieces just to close and wrap up my part here a little bit rapid fire. You can think of three big pillars at a company level: Zero Trust Everywhere, Data Security Everywhere, and Agentic Operations. There are natural relationships between them. It is a high-fidelity signal that some behavior is happening that you need to look into. it is a high-fidelity signal that some behavior is happening that you need to look into We have that capability. we have that capability We have our Breach Predictor and our ITDR, so focused on identity threats. we have our breach predictor and our itdr so focused on identity threats We had not really brought a lot of that together. we had not really brought a lot of that together Tomorrow in our SecOps keynote, we are going to talk more about how at Zscaler level we can bring that together. tomorrow in our secops keynote, we are going to talk more about how at zscaler level we can bring that together This also is the area where we believe the investment through the acquisition of Red Canary is going to help us accelerate in this right-hand side, this Threat Management side. this also is the area where we believe the investment through the acquisition of red canary is going to help us accelerate in this right-hand side this threat management side We kind of tie it all together, the three big pieces just to close and wrap up my part here a little bit rapid fire. we kind of tie it all together the three big pieces just to close and wrap up my part here a little bit rapid fire You can think of three big pillars at a company level: Zero Trust Everywhere, Data Security Everywhere, and Agentic Operations. you can think of three big pillars at a company level zero trust everywhere data security everywhere and agentic operations There are natural relationships between them. there are natural relationships between them They're not all one product. They don't need to be one product, but they all generate context and signals. They all get leveraged and can be consumed, and they feed back into those products to make data security and Zero Trust Everywhere much better. All right. With that, I'm going to hand it over to my new best friend, Brian Beyer. There you go. They're not all one product. they're not all one product They don't need to be one product, but they all generate context and signals. they don't need to be one product but they all generate context and signals They all get leveraged and can be consumed, and they feed back into those products to make data security and Zero Trust Everywhere much better. they all get leveraged and can be consumed and they feed back into those products to make data security and zero trust everywhere much better All right. all right With that, I'm going to hand it over to my new best friend, Brian Beyer. with that i'm going to hand it over to my new best friend brian beyer There you go. there you go

Speaker 10: It's a dangerous position to be in your new best friend spot plus your guest speaker right before lunch. I wanted to start with a picture that I most commonly talk to our customers about and that they use to describe what Red Canary does. It is this flow where we start with a tremendous amount of security data on the left. We're taking in trillions of telemetry records. This is petabytes of security data per day, hundreds of millions of security alerts. We're identifying potential threats. Other products are identifying potential threats. We're performing over a million investigations for our customers every single quarter. Of those million investigations we perform, at the very end of it, you end up with about 15,000 true threats. It's a dangerous position to be in your new best friend spot plus your guest speaker right before lunch. it's a dangerous position to be in your new best friend spot plus your guest speaker right before lunch I wanted to start with a picture that I most commonly talk to our customers about and that they use to describe what Red Canary does. i wanted to start with a picture that i most commonly talk to our customers about and that they use to describe what red canary does It is this flow where we start with a tremendous amount of security data on the left. it is this flow where we start with a tremendous amount of security data on the left We're taking in trillions of telemetry records. we're taking in trillions of telemetry records This is petabytes of security data per day, hundreds of millions of security alerts. this is petabytes of security data per day hundreds of millions of security alerts We're identifying potential threats. we're identifying potential threats Other products are identifying potential threats. other products are identifying potential threats We're performing over a million investigations for our customers every single quarter. we're performing over a million investigations for our customers every single quarter Of those million investigations we perform, at the very end of it, you end up with about 15,000 true threats. of those million investigations we perform at the very end of it you end up with about 15,000 true threats This is the journey the typical SOC today is going through, except they're getting stuck with the tremendous amount of data, all the investigations they have to perform, and they can't actually identify the signal from the noise. In order to understand how we do that and how do we do that with quality, with efficiency, Red Canary uses this flywheel. This is the journey the typical SOC today is going through, except they're getting stuck with the tremendous amount of data, all the investigations they have to perform, and they can't actually identify the signal from the noise. this is the journey the typical soc today is going through except they're getting stuck with the tremendous amount of data all the investigations they have to perform and they can't actually identify the signal from the noise In order to understand how we do that and how do we do that with quality, with efficiency, Red Canary uses this flywheel. in order to understand how we do that and how do we do that with quality with efficiency red canary uses this flywheel Red Canary is this system that brings together our platform, which is purpose-built for security operations, a specific set of processes for how to conduct these investigations, and then a tremendous amount of expertise throughout various functions of the SOC, whether that's Threat Intelligence to understand what adversaries are and how they operate, Threat Research to understand which new vulnerabilities they may create, the actual investigation of these threats, the response, the communication of how do you contain and eradicate threats like this, all through this process that is this flywheel where we bring in tremendous amounts of data, we find potential threats, and then we get to this key step where we are applying prior learnings and data. We're looking to see, have we ever seen this investigation before? If we have, if we've seen something like this, the Red Canary platform automatically reconducts the past investigation. Red Canary is this system that brings together our platform, which is purpose-built for security operations, a specific set of processes for how to conduct these investigations, and then a tremendous amount of expertise throughout various functions of the SOC, whether that's Threat Intelligence to understand what adversaries are and how they operate, Threat Research to understand which new vulnerabilities they may create, the actual investigation of these threats, the response, the communication of how do you contain and eradicate threats like this, all through this process that is this flywheel where we bring in tremendous amounts of data, we find potential threats, and then we get to this key step where we are applying prior learnings and data. red canary is this system that brings together our platform which is purpose-built for security operations a specific set of processes for how to conduct these investigations and then a tremendous amount of expertise throughout various functions of the soc whether that's threat intelligence to understand what adversaries are and how they operate threat research to understand which new vulnerabilities they may create the actual investigation of these threats the response the communication of how do you contain and eradicate threats like this all through this process that is this flywheel where we bring in tremendous amounts of data we find potential threats and then we get to this key step where we are applying prior learnings and data We're looking to see, have we ever seen this investigation before? we're looking to see have we ever seen this investigation before If we have, if we've seen something like this, the Red Canary platform automatically reconducts the past investigation. if we have if we've seen something like this the red canary platform automatically reconducts the past investigation We're able to communicate to a security team, "We've identified this threat. We've already contained or responded, or we're giving you the information you need to respond." That flywheel then results in more data coming through the system. It's only when we see something new and novel and interesting that we have to go and put an actual person or an agent to conduct the investigation itself. It's only a fraction of the time that we have to do that investigation. What's very unique about the Red Canary process is that at every step of this process, we are producing tremendous amounts of labeled data. That labeled data is the key that goes into training Agentic AI Agents, LLMs that are purpose-built for inside the SOC, all so that those agents can do these responsibilities for us. We're able to communicate to a security team, "We've identified this threat. we're able to communicate to a security team "we've identified this threat We've already contained or responded, or we're giving you the information you need to respond." That flywheel then results in more data coming through the system. we've already contained or responded or we're giving you the information you need to respond." that flywheel then results in more data coming through the system It's only when we see something new and novel and interesting that we have to go and put an actual person or an agent to conduct the investigation itself. it's only when we see something new and novel and interesting that we have to go and put an actual person or an agent to conduct the investigation itself It's only a fraction of the time that we have to do that investigation. it's only a fraction of the time that we have to do that investigation What's very unique about the Red Canary process is that at every step of this process, we are producing tremendous amounts of labeled data. what's very unique about the red canary process is that at every step of this process we are producing tremendous amounts of labeled data That labeled data is the key that goes into training Agentic AI Agents, LLMs that are purpose-built for inside the SOC, all so that those agents can do these responsibilities for us. that labeled data is the key that goes into training agentic ai agents llms that are purpose-built for inside the soc all so that those agents can do these responsibilities for us If you compare and contrast that and look at those agents, what you'll typically find is the typical agent in the SOC is this autonomous agent. You tell the agent, "Hey, you're an expert SOC Analyst. Go investigate this threat for me." It's like telling a genius-level, like genius IQ-level toddler, "You're now an Expert SOC Agent. Go figure this out." Every once in a while, it amazes you and it wows you and you read a blog post about it and it's amazing, but most of the time it's highly inconsistent. The quality is highly variable and it tends to lead to very frustrating security experiences. On the other hand, Red Canary's agents are imbued with all of this training data and the specific SOC procedures and all of the expertise we have in Red Canary. If you compare and contrast that and look at those agents, what you'll typically find is the typical agent in the SOC is this autonomous agent. if you compare and contrast that and look at those agents what you'll typically find is the typical agent in the soc is this autonomous agent You tell the agent, "Hey, you're an expert SOC Analyst. you tell the agent "hey you're an expert soc analyst Go investigate this threat for me." It's like telling a genius-level, like genius IQ-level toddler, "You're now an Expert SOC Agent. go investigate this threat for me." it's like telling a genius-level like genius iq-level toddler "you're now an expert soc agent Go figure this out." Every once in a while, it amazes you and it wows you and you read a blog post about it and it's amazing, but most of the time it's highly inconsistent. go figure this out." every once in a while it amazes you and it wows you and you read a blog post about it and it's amazing but most of the time it's highly inconsistent The quality is highly variable and it tends to lead to very frustrating security experiences. the quality is highly variable and it tends to lead to very frustrating security experiences On the other hand, Red Canary's agents are imbued with all of this training data and the specific SOC procedures and all of the expertise we have in Red Canary. on the other hand red canary's agents are imbued with all of this training data and the specific soc procedures and all of the expertise we have in red canary Everything we talked about on the previous slides, over a decade's worth of this training data all gets imbued into these agents. When we have an agent that is instructed to perform an investigation, we're saying, "Here are the exact specific procedures of how a great SOC Analyst would investigate this. And here's the exact procedure of how a great incident responder would investigate this. And here is a decade's worth of training data. And also, here is what thousands of great investigations even look like." When all of that is combined together into these agents, you get highly consistent, very high-quality, predictable and proven results inside the SOC. That is what Red Canary is bringing together through our service to customers and now will be as part of the Zscaler product portfolio. With that, Ashwin, I'll turn it back over to you. Everything we talked about on the previous slides, over a decade's worth of this training data all gets imbued into these agents. everything we talked about on the previous slides over a decade's worth of this training data all gets imbued into these agents When we have an agent that is instructed to perform an investigation, we're saying, "Here are the exact specific procedures of how a great SOC Analyst would investigate this. when we have an agent that is instructed to perform an investigation we're saying "here are the exact specific procedures of how a great soc analyst would investigate this And here's the exact procedure of how a great incident responder would investigate this. and here's the exact procedure of how a great incident responder would investigate this And here is a decade's worth of training data. and here is a decade's worth of training data And also, here is what thousands of great investigations even look like." When all of that is combined together into these agents, you get highly consistent, very high-quality, predictable and proven results inside the SOC. and also here is what thousands of great investigations even look like." when all of that is combined together into these agents you get highly consistent very high-quality predictable and proven results inside the soc That is what Red Canary is bringing together through our service to customers and now will be as part of the Zscaler product portfolio. that is what red canary is bringing together through our service to customers and now will be as part of the zscaler product portfolio With that, Ashwin, I'll turn it back over to you. with that ashwin i'll turn it back over to you

Speaker 11: Thank you. All right. We're still waiting for the acquisition to close, so just be mindful of that. We'll take a break now. Lunch is served outside. We'll meet at 12:30 in 29 minutes. See you back here. All right, welcome back. Hopefully, everybody got a chance to grab some lunch. We were planning to do an AI demo initially, but I just learned that Phil Tee is still stuck doing customer demonstrations, so I thought, you know, it's a better thing to do. Why not let him continue engaging with customers while we continue on with our show? It's my pleasure to invite Dhawal Sharma, EVP Products and Product Strategy, to the stage to talk about Zero Trust Branch and Cloud. Thank you. thank you All right. all right We're still waiting for the acquisition to close, so just be mindful of that. we're still waiting for the acquisition to close so just be mindful of that We'll take a break now. we'll take a break now Lunch is served outside. lunch is served outside We'll meet at 12:30 in 29 minutes. we'll meet at 12:30 in 29 minutes See you back here. see you back here All right, welcome back. all right welcome back Hopefully, everybody got a chance to grab some lunch. hopefully everybody got a chance to grab some lunch We were planning to do an AI demo initially, but I just learned that Phil Tee is still stuck doing customer demonstrations, so I thought, you know, it's a better thing to do. we were planning to do an ai demo initially but i just learned that phil tee is still stuck doing customer demonstrations so i thought you know it's a better thing to do Why not let him continue engaging with customers while we continue on with our show? why not let him continue engaging with customers while we continue on with our show It's my pleasure to invite Dhawal Sharma, EVP Products and Product Strategy, to the stage to talk about Zero Trust Branch and Cloud. it's my pleasure to invite dhawal sharma evp products and product strategy to the stage to talk about zero trust branch and cloud

Speaker 13: Thank you, Ashwin. Good morning. Good afternoon. Thank you, Ashwin. thank you ashwin Good morning. good morning Good afternoon. good afternoon Yeah, we talked about how we are now extending Zero Trust Everywhere with two new frontiers that we have been tackling in recent time: Zero Trust in the Branch, which also implies campuses, factories, and hospitals, and all the physical sites, and Zero Trust in the Cloud. Zero Trust Branch, basically, we have brought two technologies. One, organically, what we have built as Zero Trust SD-WAN, which eliminates the need for East-West firewalls and SD-WAN devices in the branches by securing all the external communication, anything that leaves the branch or coming from outside in, by embedding our Zero Trust architecture with ZPA and building all the advanced routing functionalities in the same appliance, and the acquisition of AirGap Networks, which secures all the internal communication that happens within your environment. Yeah, we talked about how we are now extending Zero Trust Everywhere with two new frontiers that we have been tackling in recent time: Zero Trust in the Branch, which also implies campuses, factories, and hospitals, and all the physical sites, and Zero Trust in the Cloud. yeah we talked about how we are now extending zero trust everywhere with two new frontiers that we have been tackling in recent time zero trust in the branch which also implies campuses factories and hospitals and all the physical sites and zero trust in the cloud Zero Trust Branch, basically, we have brought two technologies. zero trust branch basically we have brought two technologies One, organically, what we have built as Zero Trust SD-WAN, which eliminates the need for East-West firewalls and SD-WAN devices in the branches by securing all the external communication, anything that leaves the branch or coming from outside in, by embedding our Zero Trust architecture with ZPA and building all the advanced routing functionalities in the same appliance, and the acquisition of AirGap Networks, which secures all the internal communication that happens within your environment. one organically what we have built as zero trust sd-wan which eliminates the need for east-west firewalls and sd-wan devices in the branches by securing all the external communication anything that leaves the branch or coming from outside in by embedding our zero trust architecture with zpa and building all the advanced routing functionalities in the same appliance and the acquisition of airgap networks which secures all the internal communication that happens within your environment The concept of this Zero Trust Branch, or Cafe-like Branch, is something we have been talking to our customers about for a while, seeing strong validation from analyst firms like Gartner talking about Zero Trust Branch or Zero Trust Networking on the same lines. What we have been doing in the last one year and working really hard is for our customers to have one single unified appliance that can scale from a small branch to a large site or a campus. Going anywhere from 200 megs of egress throughput to 5 gigs of throughput. Instead of deploying two separate appliances like they did in the past, they basically get a single gateway appliance for their WAN and LAN and can build more identity context-driven policies for non-human devices like assets and infrastructure within their environment as well. The concept of this Zero Trust Branch, or Cafe-like Branch, is something we have been talking to our customers about for a while, seeing strong validation from analyst firms like Gartner talking about Zero Trust Branch or Zero Trust Networking on the same lines. the concept of this zero trust branch or cafe-like branch is something we have been talking to our customers about for a while seeing strong validation from analyst firms like gartner talking about zero trust branch or zero trust networking on the same lines What we have been doing in the last one year and working really hard is for our customers to have one single unified appliance that can scale from a small branch to a large site or a campus. what we have been doing in the last one year and working really hard is for our customers to have one single unified appliance that can scale from a small branch to a large site or a campus Going anywhere from 200 megs of egress throughput to 5 gigs of throughput. going anywhere from 200 megs of egress throughput to 5 gigs of throughput Instead of deploying two separate appliances like they did in the past, they basically get a single gateway appliance for their WAN and LAN and can build more identity context-driven policies for non-human devices like assets and infrastructure within their environment as well. instead of deploying two separate appliances like they did in the past they basically get a single gateway appliance for their wan and lan and can build more identity context-driven policies for non-human devices like assets and infrastructure within their environment as well A lot of customers who started with Zero Trust SD-WAN are now able to bring East-West segmentation or agentless micro-segmentation within their environments with this technology. Cloud is something on which we have been working on for a while. We have had thousands of customers, as I mentioned, securing their egress to the Cloud. Cloud environments are also very dynamic. We have now done petabytes-scale deployments for customers' cloud workloads. We started with a big focus public cloud, like going across multi-region, multi-Cloud, what is running inside customer environments, securing all the traffic flows. A lot of our customers are on their Cloud migration journeys, still have data center footprints or are retiring data centers, and are multi-Cloud, where some application is public cloud x, and then the data store is in other public cloud. A lot of customers who started with Zero Trust SD-WAN are now able to bring East-West segmentation or agentless micro-segmentation within their environments with this technology. a lot of customers who started with zero trust sd-wan are now able to bring east-west segmentation or agentless micro-segmentation within their environments with this technology Cloud is something on which we have been working on for a while. cloud is something on which we have been working on for a while We have had thousands of customers, as I mentioned, securing their egress to the Cloud. we have had thousands of customers as i mentioned securing their egress to the cloud Cloud environments are also very dynamic. cloud environments are also very dynamic We have now done petabytes-scale deployments for customers' cloud workloads. we have now done petabytes-scale deployments for customers' cloud workloads We started with a big focus public cloud, like going across multi-region, multi-Cloud, what is running inside customer environments, securing all the traffic flows. we started with a big focus public cloud, like going across multi-region multi-cloud, what is running inside customer environments securing all the traffic flows A lot of our customers are on their Cloud migration journeys, still have data center footprints or are retiring data centers, and are multi-Cloud, where some application is public cloud x, and then the data store is in other public cloud. a lot of our customers are on their cloud migration journeys still have data center footprints or are retiring data centers and are multi-cloud where some application is public cloud x and then the data store is in other public cloud We are able to secure all those paths in some of the innovation we have been building. Internet offload becomes the first use case with many large organizations, especially financial organizations who are running multiple virtual infrastructures public cloud, backhauling their traffic over expensive circuits, and then doing security in data center. We can dismantle that entire infrastructure with our Cloud Workload Protection offering. Also, the friction to deploy cloud solutions goes away with this architecture. A lot of our customers are actually building virtual firewall-free enterprise with our technology stack. The second use case, which we started deploying in a lot of these customers now, is doing segmentation or securing workload-to-workload communication within their boundaries, whether they are within public cloud, like going from a VPC X to VPC Y, multi-region, multi-Cloud, and also hybrid environments like data center to Cloud.Customers could have any form of underlay, such as private interconnects or ExpressRoute. We can secure all those channels. To simplify how our customers adopt this technology, because this needed some form of Zscaler VMs to be deployed in their environment, we basically... That will take a few hours of planning and deploying this infrastructure. What we have now introduced is a Zscaler Cloud Gateway. Think about a Zscaler VPC equivalent running across the public cloud, multi-region, multi-Availability Zone. Customers can just achieve the next level of automation by pointing their traffic to us, no need to deploy any virtual infrastructure. Customers can literally deploy this in minutes and do not need to wait for hours or go through architecture reviews for deploying this architecture. This is fascinating. We have a lot of customers who are asking for this. This became generally available as of last week. We are able to secure all those paths in some of the innovation we have been building. we are able to secure all those paths in some of the innovation we have been building Internet offload becomes the first use case with many large organizations, especially financial organizations who are running multiple virtual infrastructures public cloud, backhauling their traffic over expensive circuits, and then doing security in data center. internet offload becomes the first use case with many large organizations especially financial organizations who are running multiple virtual infrastructures public cloud, backhauling their traffic over expensive circuits and then doing security in data center We can dismantle that entire infrastructure with our Cloud Workload Protection offering. we can dismantle that entire infrastructure with our cloud workload protection offering Also, the friction to deploy cloud solutions goes away with this architecture. also the friction to deploy cloud solutions goes away with this architecture A lot of our customers are actually building virtual firewall-free enterprise with our technology stack. a lot of our customers are actually building virtual firewall-free enterprise with our technology stack The second use case, which we started deploying in a lot of these customers now, is doing segmentation or securing workload-to-workload communication within their boundaries, whether they are within public cloud, like going from a VPC X to VPC Y, multi-region, multi-Cloud, and also hybrid environments like data center to Cloud. the second use case which we started deploying in a lot of these customers now is doing segmentation or securing workload-to-workload communication within their boundaries whether they are within public cloud, like going from a vpc x to vpc y multi-region multi-cloud and also hybrid environments like data center to cloud Customers could have any form of underlay, such as private interconnects or ExpressRoute. customers could have any form of underlay such as private interconnects or expressroute We can secure all those channels. we can secure all those channels To simplify how our customers adopt this technology, because this needed some form of Zscaler VMs to be deployed in their environment, we basically... to simplify how our customers adopt this technology because this needed some form of zscaler vms to be deployed in their environment we basically That will take a few hours of planning and deploying this infrastructure. that will take a few hours of planning and deploying this infrastructure What we have now introduced is a Zscaler Cloud Gateway. what we have now introduced is a zscaler cloud gateway Think about a Zscaler VPC equivalent running across the public cloud, multi-region, multi-Availability Zone. think about a zscaler vpc equivalent running across the public cloud multi-region multi-availability zone Customers can just achieve the next level of automation by pointing their traffic to us, no need to deploy any virtual infrastructure. customers can just achieve the next level of automation by pointing their traffic to us no need to deploy any virtual infrastructure Customers can literally deploy this in minutes and do not need to wait for hours or go through architecture reviews for deploying this architecture. customers can literally deploy this in minutes and do not need to wait for hours or go through architecture reviews for deploying this architecture This is fascinating. this is fascinating We have a lot of customers who are asking for this. we have a lot of customers who are asking for this This became generally available as of last week. this became generally available as of last week I want to invite a customer, Yoni Kaplansky, who's here in the room with us. He's VP of Cyber Architecture, Engineering, and Operations at FICO. Last year, CISO at FICO, Ben, was on stage with me talking about this solution. Since then, they have adopted this across the board. Bringing Yoni to answer questions for you. I want to invite a customer, Yoni Kaplansky, who's here in the room with us. i want to invite a customer yoni kaplansky who's here in the room with us He's VP of Cyber Architecture, Engineering, and Operations at FICO. he's vp of cyber architecture engineering and operations at fico Last year, CISO at FICO, Ben, was on stage with me talking about this solution. last year ciso at fico ben was on stage with me talking about this solution Since then, they have adopted this across the board. since then they have adopted this across the board Bringing Yoni to answer questions for you. bringing yoni to answer questions for you

Speaker 15: Good afternoon. Yoni Kaplansky, I'm with FICO for the last eight years. I'm running all the architecture, engineering, and operation. We started our journey with Zscaler in 2018. We started with ZIA. That was mainly my first project in FICO, which was a really great success. In 2021, we started our ZPA, Zero Trust project. No one really believed that we can do a full Zero Trust in three months, but we did it. Good afternoon. good afternoon Yoni Kaplansky, I'm with FICO for the last eight years. yoni kaplansky i'm with fico for the last eight years I'm running all the architecture, engineering, and operation. i'm running all the architecture engineering and operation We started our journey with Zscaler in 2018. we started our journey with zscaler in 2018 We started with ZIA. we started with zia That was mainly my first project in FICO, which was a really great success. that was mainly my first project in fico which was a really great success In 2021, we started our ZPA, Zero Trust project. in 2021 we started our zpa zero trust project No one really believed that we can do a full Zero Trust in three months, but we did it. no one really believed that we can do a full zero trust in three months but we did it With the help from Zscaler, with the right planning, we were able to completely cut VPN communication to the organization in three months. In 2023, we started to look at Cloud Connectors. I do believe we were one of the first customers with the Zscaler Cloud Connectors. Our approach was, after with our Zero Trust project, after we took care of human-to-machine connectivity, we wanted to take care of machine-to-machine connectivity with the Cloud Connectors. We are probably around 45%–50% implemented right now. We have a very large AWS environment, and we're doing gradually cut over, moving account after account to that. We see the benefit of it immediately. Some of our pain points with that was we had too many egress proxies. We wanted to standardize everything to ZIA. We had limitation of what's called peering, allowing VPC-to-VPC peering in AWS. We solved that with Cloud Connectors. With the help from Zscaler, with the right planning, we were able to completely cut VPN communication to the organization in three months. with the help from zscaler with the right planning we were able to completely cut vpn communication to the organization in three months In 2023, we started to look at Cloud Connectors. in 2023 we started to look at cloud connectors I do believe we were one of the first customers with the Zscaler Cloud Connectors. i do believe we were one of the first customers with the zscaler cloud connectors Our approach was, after with our Zero Trust project, after we took care of human-to-machine connectivity, we wanted to take care of machine-to-machine connectivity with the Cloud Connectors. our approach was after with our zero trust project after we took care of human-to-machine connectivity we wanted to take care of machine-to-machine connectivity with the cloud connectors We are probably around 45%–50% implemented right now. we are probably around 45%–50% implemented right now We have a very large AWS environment, and we're doing gradually cut over, moving account after account to that. we have a very large aws environment and we're doing gradually cut over moving account after account to that We see the benefit of it immediately. we see the benefit of it immediately Some of our pain points with that was we had too many egress proxies. some of our pain points with that was we had too many egress proxies We wanted to standardize everything to ZIA. we wanted to standardize everything to zia We had limitation of what's called peering, allowing VPC-to-VPC peering in AWS. we had limitation of what's called peering allowing vpc-to-vpc peering in aws We solved that with Cloud Connectors. we solved that with cloud connectors We also had additional costs that were accrued in AWS, which we were able to control with using Zscaler Cloud Connectors. We're probably going to finish the project in the next between six to nine months, and then we'll be fully deployed. We do use ZIA and ZPA with the Cloud Connectors, which allow us to really secure our AWS environment to the level that we didn't see that any other technology can provide us. That's kind of the intro. I will be more than happy to answer any questions that you have. We also had additional costs that were accrued in AWS, which we were able to control with using Zscaler Cloud Connectors. we also had additional costs that were accrued in aws which we were able to control with using zscaler cloud connectors We're probably going to finish the project in the next between six to nine months, and then we'll be fully deployed. we're probably going to finish the project in the next between six to nine months and then we'll be fully deployed We do use ZIA and ZPA with the Cloud Connectors, which allow us to really secure our AWS environment to the level that we didn't see that any other technology can provide us. we do use zia and zpa with the cloud connectors which allow us to really secure our aws environment to the level that we didn't see that any other technology can provide us That's kind of the intro. that's kind of the intro I will be more than happy to answer any questions that you have. i will be more than happy to answer any questions that you have

Speaker 11: Thank you, Yoni. If anyone has questions, we'll start with Saket and then go to Roger. Thank you, Yoni. thank you yoni If anyone has questions, we'll start with Saket and then go to Roger. if anyone has questions we'll start with saket and then go to roger Excellent. Thanks, Yoni, for presenting. Really, really helpful. I want to dig into the Cloud Connector piece of your implementation more directly. What were you using before for cloud security? Excellent. excellent Thanks, Yoni, for presenting. thanks yoni for presenting Really, really helpful. really really helpful I want to dig into the Cloud Connector piece of your implementation more directly. i want to dig into the cloud connector piece of your implementation more directly What were you using before for cloud security? what were you using before for cloud security There are so many choices out there for cloud security, whether it's a Wiz or a Palo or a CrowdStrike, right? Like maybe some vendors that you work with already. What kind of tipped you over to kind of consolidating yet another piece with Zscaler in a market where there are other alternatives? There are so many choices out there for cloud security, whether it's a Wiz or a Palo or a CrowdStrike, right? there are so many choices out there for cloud security whether it's a wiz or a palo or a crowdstrike right Like maybe some vendors that you work with already. like maybe some vendors that you work with already What kind of tipped you over to kind of consolidating yet another piece with Zscaler in a market where there are other alternatives? what kind of tipped you over to kind of consolidating yet another piece with zscaler in a market where there are other alternatives

Speaker 15: We were using basically AWS security before. We are using Wiz as our kind of CNAPP solution. From a network security perspective, we were just using the basic AWS, which adds its own limitation. When we started the journey in 2023, we were so... We were using basically AWS security before. we were using basically aws security before We are using Wiz as our kind of CNAPP solution. we are using wiz as our kind of cnapp solution From a network security perspective, we were just using the basic AWS, which adds its own limitation. from a network security perspective we were just using the basic aws which adds its own limitation When we started the journey in 2023, we were so... when we started the journey in 2023 we were so I'm not saying that we were satisfied, but we were just so invested in the technology from Zscaler with the way that we worked with them, with their customer support, with their account management team, with the overall company that when we decided to go to the machine-to-machine Zero Trust, we didn't look anywhere else. It was clear to us that we will continue with Zscaler because they have the leading technology. We just went with them. I want to clarify the position. Your question to Saket is a good question. Cloud security. You can think of it. Your question actually talked about three buckets. One is workload-to-workload, machine-to-machine communication. The only way that's done today is some kind of firewall technology. It could be AWS Firewall, Palo Alto, or other firewalls. It's kind of network security you said. I'm not saying that we were satisfied, but we were just so invested in the technology from Zscaler with the way that we worked with them, with their customer support, with their account management team, with the overall company that when we decided to go to the machine-to-machine Zero Trust, we didn't look anywhere else. i'm not saying that we were satisfied but we were just so invested in the technology from zscaler with the way that we worked with them with their customer support with their account management team with the overall company that when we decided to go to the machine-to-machine zero trust we didn't look anywhere else It was clear to us that we will continue with Zscaler because they have the leading technology. it was clear to us that we will continue with zscaler because they have the leading technology We just went with them. we just went with them I want to clarify the position. i want to clarify the position Your question to Saket is a good question. your question to saket is a good question Cloud security. cloud security You can think of it. you can think of it Your question actually talked about three buckets. your question actually talked about three buckets One is workload-to-workload, machine-to-machine communication. one is workload-to-workload machine-to-machine communication The only way that's done today is some kind of firewall technology. the only way that's done today is some kind of firewall technology It could be AWS Firewall, Palo Alto, or other firewalls. it could be aws firewall palo alto or other firewalls It's kind of network security you said. it's kind of network security you said Typically, a rules, ACL, IP addresses, who can talk to. That is one piece. What we did with Zscaler is that communication piece. It is being done with firewalls from either firewall companies or hyperscaler has some of the basic firewall functionality. That is what we are taking out. Our mission is there should be no firewalls in the Cloud. Think of it this way. You know ZIA for users, you know ZPA for users. Think of ZIA for workloads and ZPA for workloads. Same thing. That is what we do. The second part was, why not CrowdStrike? CrowdStrike provides one of these Gartner acronyms. You put an agent on the workload machine, just like our endpoint. It is looking for good or bad stuff on it. That is one area. Gartner used to call it what? CWPP. Yeah, CWPP. Okay. That is second. We do not compete in that space. There is a third bucket. It is posture management. Typically, a rules, ACL, IP addresses, who can talk to. That is one piece. typically a rules acl ip addresses who can talk to. that is one piece What we did with Zscaler is that communication piece. It is being done with firewalls from either firewall companies or hyperscaler has some of the basic firewall functionality. That is what we are taking out. what we did with zscaler is that communication piece. it is being done with firewalls from either firewall companies or hyperscaler has some of the basic firewall functionality. that is what we are taking out Our mission is there should be no firewalls in the Cloud. our mission is there should be no firewalls in the cloud Think of it this way. think of it this way You know ZIA for users, you know ZPA for users. you know zia for users you know zpa for users Think of ZIA for workloads and ZPA for workloads. think of zia for workloads and zpa for workloads Same thing. That is what we do. same thing. that is what we do The second part was, why not CrowdStrike? the second part was why not crowdstrike CrowdStrike provides one of these Gartner acronyms. crowdstrike provides one of these gartner acronyms You put an agent on the workload machine, just like our endpoint. It is looking for good or bad stuff on it. That is one area. you put an agent on the workload machine just like our endpoint. it is looking for good or bad stuff on it. that is one area Gartner used to call it what? gartner used to call it what CWPP. cwpp Yeah, CWPP. yeah cwpp Okay. That is second. okay. that is second We do not compete in that space. There is a third bucket. It is posture management. we do not compete in that space. there is a third bucket. it is posture management It used to be called CSPM, CI, whatever, and now it's CNAPP. It is API calls. Nothing to do with what we do here. Three buckets. Our bucket is very clear to be in line. One of the hardest things to do is to get in line. There's not much competition in that space. Either you do firewalls or you use Zscaler Zero Trust. One of the things that were our pain point and we solved it is that usually in many organizations, the IT department is not managing the AWS accounts. It's whoever business unit or account owner is managing it. He can change the firewall. He can do whatever he wants. When we use the Cloud connector, the policy is managing it. We're basically enforcing a higher-level policy that account owner cannot change. It used to be called CSPM, CI, whatever, and now it's CNAPP. it used to be called cspm ci whatever and now it's cnapp It is API calls. it is api calls Nothing to do with what we do here. nothing to do with what we do here Three buckets. three buckets Our bucket is very clear to be in line. our bucket is very clear to be in line One of the hardest things to do is to get in line. one of the hardest things to do is to get in line There's not much competition in that space. there's not much competition in that space Either you do firewalls or you use Zscaler Zero Trust. either you do firewalls or you use zscaler zero trust One of the things that were our pain point and we solved it is that usually in many organizations, the IT department is not managing the AWS accounts. one of the things that were our pain point and we solved it is that usually in many organizations the it department is not managing the aws accounts It's whoever business unit or account owner is managing it. it's whoever business unit or account owner is managing it He can change the firewall. he can change the firewall He can do whatever he wants. he can do whatever he wants When we use the Cloud connector, the policy is managing it. when we use the cloud connector the policy is managing it We're basically enforcing a higher-level policy that account owner cannot change. we're basically enforcing a higher-level policy that account owner cannot change He can still do whatever he wants in his own bubble, but he cannot influence the overall picture. He cannot risk the overall company. That's what the Cloud Connectors allowed us to do. He can still do whatever he wants in his own bubble, but he cannot influence the overall picture. he can still do whatever he wants in his own bubble but he cannot influence the overall picture He cannot risk the overall company. he cannot risk the overall company That's what the Cloud Connectors allowed us to do. that's what the cloud connectors allowed us to do

Speaker 11: We'll take from Roger and then Taz. We'll take from Roger and then Taz. we'll take from roger and then taz

Speaker 2: Can you hear me? Yes. Roger Bowe with UBS. Another question on Cloud Connectors. I think you mentioned about 50% deployed. Can you just talk about kind of what that looks like? What's remaining? Kind of has that implementation gone as expected? Some of the new announcements today, it sounded like Zero Trust Gateway potentially streamlined some of that deployment. Does that give you confidence to kind of hitting the timeline you talked about? Can you hear me? can you hear me Yes. yes Roger Bowe with UBS. roger bowe with ubs Another question on Cloud Connectors. another question on cloud connectors I think you mentioned about 50% deployed. i think you mentioned about 50% deployed Can you just talk about kind of what that looks like? can you just talk about kind of what that looks like What's remaining? what's remaining Kind of has that implementation gone as expected? kind of has that implementation gone as expected Some of the new announcements today, it sounded like Zero Trust Gateway potentially streamlined some of that deployment. some of the new announcements today it sounded like zero trust gateway potentially streamlined some of that deployment Does that give you confidence to kind of hitting the timeline you talked about? does that give you confidence to kind of hitting the timeline you talked about

Speaker 15: Yeah. We took a very slow approach because, first of all, we're introducing a change. Yeah. yeah We took a very slow approach because, first of all, we're introducing a change. we took a very slow approach because first of all we're introducing a change Every time that you're introducing a change into a company, you need to do it slowly and gradually so everyone will be happy. We move the cheese for a lot of the people. We want them to be happy before that. Second, we wanted to move gradually from really lower environments into kind of our QA and production environments. This is how we basically build our implementation plan. The third is that we wanted to create our own automation and our own assurance that we are deploying it right because all you need is one incident of something not working, and you will be shut down for a long time. Those are kind of the approach that we took to do it. We are in the level that we show the entire organization that we can deploy it. We show that we can automate it. Every time that you're introducing a change into a company, you need to do it slowly and gradually so everyone will be happy. every time that you're introducing a change into a company you need to do it slowly and gradually so everyone will be happy We move the cheese for a lot of the people. we move the cheese for a lot of the people We want them to be happy before that. we want them to be happy before that Second, we wanted to move gradually from really lower environments into kind of our QA and production environments. second we wanted to move gradually from really lower environments into kind of our qa and production environments This is how we basically build our implementation plan. this is how we basically build our implementation plan The third is that we wanted to create our own automation and our own assurance that we are deploying it right because all you need is one incident of something not working, and you will be shut down for a long time. the third is that we wanted to create our own automation and our own assurance that we are deploying it right because all you need is one incident of something not working and you will be shut down for a long time Those are kind of the approach that we took to do it. those are kind of the approach that we took to do it We are in the level that we show the entire organization that we can deploy it. we are in the level that we show the entire organization that we can deploy it We show that we can automate it. we show that we can automate it We showed that it cannot impact the actual business. We show that we can create savings to the organization. I feel very comfortable that we will continue as going, and we will meet our timelines. We showed that it cannot impact the actual business. we showed that it cannot impact the actual business We show that we can create savings to the organization. we show that we can create savings to the organization I feel very comfortable that we will continue as going, and we will meet our timelines. i feel very comfortable that we will continue as going and we will meet our timelines

Speaker 9: Hi, it's Imtiaz Koujalgi from Roth Capital. I have a question on your Cloud Connector usage. If you speak to a firewall vendor, their pitch is that you have a single pane of glass for managing your cloud security and your on-prem security. You can use firewalls in the cloud, firewalls on-prem for your data center, and then you can manage it from your Panorama or whatever console you have. How do you solve for that given that, I guess, Zscaler is cloud only? Are you guys cloud only? Or do you guys have an on-prem presence also? That is part one. I have another second part of the question. Hi, it's Imtiaz Koujalgi from Roth Capital. hi it's imtiaz koujalgi from roth capital I have a question on your Cloud Connector usage. i have a question on your cloud connector usage If you speak to a firewall vendor, their pitch is that you have a single pane of glass for managing your cloud security and your on-prem security. if you speak to a firewall vendor their pitch is that you have a single pane of glass for managing your cloud security and your on-prem security You can use firewalls in the cloud, firewalls on-prem for your data center, and then you can manage it from your Panorama or whatever console you have. you can use firewalls in the cloud firewalls on-prem for your data center and then you can manage it from your panorama or whatever console you have How do you solve for that given that, I guess, Zscaler is cloud only? how do you solve for that given that i guess zscaler is cloud only Are you guys cloud only? are you guys cloud only Or do you guys have an on-prem presence also? or do you guys have an on-prem presence also That is part one. that is part one I have another second part of the question. i have another second part of the question

Speaker 15: We are on-prem and Cloud. We are using Palo Alto for on-prem firewalls. The thing that was easiest for us is that we came with our requirement for Cloud security. Cybersecurity is the owner of that system, networking, doing the on-prem. It was never kind of who's doing what, and do we really need that one pane of glass for that? The other way to look at it is that with the Cloud Connector, you apply the policy, and that's it. You're not changing the policy. It's not constantly changing on a daily basis like you're changing firewall rules. We are on-prem and Cloud. we are on-prem and cloud We are using Palo Alto for on-prem firewalls. we are using palo alto for on-prem firewalls The thing that was easiest for us is that we came with our requirement for Cloud security. the thing that was easiest for us is that we came with our requirement for cloud security Cybersecurity is the owner of that system, networking, doing the on-prem. cybersecurity is the owner of that system networking doing the on-prem It was never kind of who's doing what, and do we really need that one pane of glass for that? it was never kind of who's doing what and do we really need that one pane of glass for that The other way to look at it is that with the Cloud Connector, you apply the policy, and that's it. the other way to look at it is that with the cloud connector you apply the policy and that's it You're not changing the policy. you're not changing the policy It's not constantly changing on a daily basis like you're changing firewall rules. it's not constantly changing on a daily basis like you're changing firewall rules Really seeing both of them together and having that perspective was not really an important point for us because the Cloud Connector allows you to apply that policy, and you're not changing that policy unless there is a business reason for that, and then you're going through the regular process of approving it. Really seeing both of them together and having that perspective was not really an important point for us because the Cloud Connector allows you to apply that policy, and you're not changing that policy unless there is a business reason for that, and then you're going through the regular process of approving it. really seeing both of them together and having that perspective was not really an important point for us because the cloud connector allows you to apply that policy and you're not changing that policy unless there is a business reason for that and then you're going through the regular process of approving it

Speaker 9: Got it. Second. Got it. got it Second. second I heard that just as different any time. I heard that just as different any time. i heard that just as different any time

Speaker 15: In the data center, you know how you manage firewalls, IP addresses, ACLs? There's a lot of pain. In the world of Cloud, the pain becomes exponential. In the data center, you're barely changing applications. How often do you write or add applications in the data center? At a snail's pace. How fast do you build workloads, ephemeral workloads, and all in the Cloud? Much rapid pace. In the data center, you know how you manage firewalls, IP addresses, ACLs? in the data center you know how you manage firewalls ip addresses acls There's a lot of pain. there's a lot of pain In the world of Cloud, the pain becomes exponential. in the world of cloud the pain becomes exponential In the data center, you're barely changing applications. in the data center you're barely changing applications How often do you write or add applications in the data center? how often do you write or add applications in the data center At a snail's pace. at a snail's pace How fast do you build workloads, ephemeral workloads, and all in the Cloud? how fast do you build workloads ephemeral workloads and all in the cloud Much rapid pace. much rapid pace Trying to do the same kind of ACLs and IP address in the Cloud for workloads to have the same single console to do both is a nightmare. It makes no sense. That is the story they have to tell. What else can they tell? The similar story gets told for the branch. Hey, Zscaler is pitching this branch thing. Why do you not have a single console for data center for every branch? The question is, I mean, huh? How many rules do you have in your firewall in the data center? 15,000. Do you have a second product to manage the rules of Palo Alto or Check Point? You know those companies, I am sure you heard of, AlgoSec, and there are three or four companies out there. That is all the businesses. Trying to do the same kind of ACLs and IP address in the Cloud for workloads to have the same single console to do both is a nightmare. trying to do the same kind of acls and ip address in the cloud for workloads to have the same single console to do both is a nightmare It makes no sense. it makes no sense That is the story they have to tell. that is the story they have to tell What else can they tell? what else can they tell The similar story gets told for the branch. the similar story gets told for the branch Hey, Zscaler is pitching this branch thing. hey zscaler is pitching this branch thing Why do you not have a single console for data center for every branch? why do you not have a single console for data center for every branch The question is, I mean, huh? the question is i mean huh How many rules do you have in your firewall in the data center? 15,000. how many rules do you have in your firewall in the data center 15,000 Do you have a second product to manage the rules of Palo Alto or Check Point? do you have a second product to manage the rules of palo alto or check point You know those companies, I am sure you heard of, AlgoSec, and there are three or four companies out there. That is all the businesses. you know those companies i am sure you heard of algosec and there are three or four companies out there. that is all the businesses Do you want the same kind of rule set here, same policy in the branch? What are you trying to secure in the branch? How many servers do you have? Zero. What's the branch to secure? Nothing. How many rules should you have? Hardly any. This is a silly notion. They try to say a branch should be like home. Most of the time, larger branches may need some rules. Think of a typical enterprise. We'll say I have 400 branches. You say, must be small, medium, large, like T-shirt sizes. They all agree. You know, typical distribution is 80% are small, 15% are medium, 5% are large. There may be plants or factories, right? 5% of 400. It's a big number, 20 plants. Okay. You say, oh, these small branches. Do you want the same kind of rule set here, same policy in the branch? do you want the same kind of rule set here same policy in the branch What are you trying to secure in the branch? what are you trying to secure in the branch How many servers do you have? how many servers do you have Zero. zero What's the branch to secure? what's the branch to secure Nothing. nothing How many rules should you have? how many rules should you have Hardly any. hardly any This is a silly notion. this is a silly notion They try to say a branch should be like home. they try to say a branch should be like home Most of the time, larger branches may need some rules. most of the time larger branches may need some rules Think of a typical enterprise. think of a typical enterprise We'll say I have 400 branches. we'll say i have 400 branches You say, must be small, medium, large, like T-shirt sizes. you say must be small medium large like t-shirt sizes They all agree. they all agree You know, typical distribution is 80% are small, 15% are medium, 5% are large. you know typical distribution is 80% are small 15% are medium 5% are large There may be plants or factories, right? 5% of 400. there may be plants or factories right 5% of 400 It's a big number, 20 plants. it's a big number 20 plants Okay. okay You say, oh, these small branches. you say oh these small branches Why do you have a firewall when you don't have a firewall at home? They're no different than home. None of that stuff is needed. It's just a legacy people trying to perpetuate. Why do you have a firewall when you don't have a firewall at home? why do you have a firewall when you don't have a firewall at home They're no different than home. they're no different than home None of that stuff is needed. none of that stuff is needed It's just a legacy people trying to perpetuate. it's just a legacy people trying to perpetuate

Speaker 9: Just a second part of that question. You mentioned you had ZIA, ZPA. You're also adopting Cloud Connectors. Now, can you compare, I guess, the scale of all those products? When you look at, I don't know, the number of users or spend, how does ZIA compare to ZPA versus Cloud Connectors? Are they all equal? Is ZIA still the biggest piece of your spend versus the other two? Just a second part of that question. just a second part of that question You mentioned you had ZIA, ZPA. you mentioned you had zia zpa You're also adopting Cloud Connectors. you're also adopting cloud connectors Now, can you compare, I guess, the scale of all those products? now can you compare i guess the scale of all those products When you look at, I don't know, the number of users or spend, how does ZIA compare to ZPA versus Cloud Connectors? when you look at i don't know the number of users or spend how does zia compare to zpa versus cloud connectors Are they all equal? are they all equal Is ZIA still the biggest piece of your spend versus the other two? is zia still the biggest piece of your spend versus the other two

Speaker 15: Overall, it's kind of equal. FICO is around 4,000 employees. If you look at the total spend, it's kind of divided equally between the three of them. We're not just using those technologies. We're using also the Endpoint DLP. We're using also the CASB. Overall, it's kind of equal. overall it's kind of equal FICO is around 4,000 employees. fico is around 4,000 employees If you look at the total spend, it's kind of divided equally between the three of them. if you look at the total spend it's kind of divided equally between the three of them We're not just using those technologies. we're not just using those technologies We're using also the Endpoint DLP. we're using also the endpoint dlp We're using also the CASB. we're using also the casb We're really investing in the overall technology stack from Zscaler, which is allowing us to really meet our security maturity that we need with that. We're really investing in the overall technology stack from Zscaler, which is allowing us to really meet our security maturity that we need with that. we're really investing in the overall technology stack from zscaler which is allowing us to really meet our security maturity that we need with that

Speaker 11: Thank you, Yoni. Thank you so much for your time. We'll move on to the product Q&A. I'll invite Jay, Adam, and Dhawal onto the stage, please. We'll start with Ittai and go to Yun. Thank you, Yoni. thank you yoni Thank you so much for your time. thank you so much for your time We'll move on to the product Q&A. we'll move on to the product q&a I'll invite Jay, Adam, and Dhawal onto the stage, please. i'll invite jay adam and dhawal onto the stage please We'll start with Ittai and go to Yun. we'll start with ittai and go to yun

Speaker 14: Hi, Jay. Hi, Jay. hi jay

Speaker 12: Hello. Hello. hello

Speaker 14: Ittai from Oppenheimer. Great day, by the way. Super interesting announcements. Really appreciate it. I guess my question is around velocity, meaning for years you've tried to have a story against why an SD-WAN box is not needed, and it took you a while, and you got an SD-WAN box, and you're displacing. You're now with Adam's. Ittai from Oppenheimer. ittai from oppenheimer Great day, by the way. great day by the way Super interesting announcements. super interesting announcements Really appreciate it. really appreciate it I guess my question is around velocity, meaning for years you've tried to have a story against why an SD-WAN box is not needed, and it took you a while, and you got an SD-WAN box, and you're displacing. i guess my question is around velocity meaning for years you've tried to have a story against why an sd-wan box is not needed and it took you a while and you got an sd-wan box and you're displacing You're now with Adam's. you're now with adam's

Speaker 12: We have no SD-WAN. We have no SD-WAN. we have no sd-wan

Speaker 14: Yes. Nonetheless, Yes. yes Nonetheless, nonetheless

Speaker 12: We may call it Zero Trust. We may call it Zero Trust. we may call it zero trust

Speaker 14: Zero Trust. Okay. Zero Trust. zero trust Okay. okay

Speaker 12: That's only done so that marketing searches show up Zscaler. That's only done so that marketing searches show up Zscaler. that's only done so that marketing searches show up zscaler

Speaker 14: Very good. Show up. Okay. I guess what Adam is working on, you're not going to call that SIEM, okay? You're going to call that something differently. That's fair enough. That's right. Zero Trust for SIEM maybe is something like that. The point I'm trying to make is that it took you years until you finally today got to a point where enterprises are at that level where, as Yoni said, we don't need firewalls in the branches. Only like the last couple of quarters, finally, you started talking about the number of customers that are actually doing this. If I take that evangelism process, how should I think about the vision of Red Canary and Avalor and the data that you clearly have a proprietary, a unique vantage point around data that others don't? Very good. very good Show up. show up Okay. up okay I guess what Adam is working on, you're not going to call that SIEM, okay? i guess what adam is working on you're not going to call that siem okay You're going to call that something differently. you're going to call that something differently That's fair enough. that's fair enough That's right. that's right Zero Trust for SIEM maybe is something like that. zero trust for siem maybe is something like that The point I'm trying to make is that it took you years until you finally today got to a point where enterprises are at that level where, as Yoni said, we don't need firewalls in the branches. the point i'm trying to make is that it took you years until you finally today got to a point where enterprises are at that level where as yoni said we don't need firewalls in the branches Only like the last couple of quarters, finally, you started talking about the number of customers that are actually doing this. only like the last couple of quarters finally you started talking about the number of customers that are actually doing this If I take that evangelism process, how should I think about the vision of Red Canary and Avalor and the data that you clearly have a proprietary, a unique vantage point around data that others don't? if i take that evangelism process how should i think about the vision of red canary and avalor and the data that you clearly have a proprietary a unique vantage point around data that others don't How do I think about the timeline and how much evangelism you're going to have to do to get that going? How do I think about the timeline and how much evangelism you're going to have to do to get that going? how do i think about the timeline and how much evangelism you're going to have to do to get that going

Speaker 12: It's a good point. You need evangelism, then you're disrupting things, totally new way of doing it. Okay? I mean, Zscaler, no firewalls, switchboard. It's very different. ZPA has been totally different. Zero Trust Branch has a lot of evangelism, but our customer is getting it. In the security operations area, we're actually, from end user point of view, it'll be a lot easier and simpler. Now, they don't need to build this big data lake and all that kind of stuff. I see far less evangelism needed in the security operations area. Because we are not trying to say, don't do this, do this. The problem they're solving is similar. At the end of the day, we're going to make it simpler. It's a good point. it's a good point You need evangelism, then you're disrupting things, totally new way of doing it. you need evangelism then you're disrupting things totally new way of doing it Okay? okay I mean, Zscaler, no firewalls, switchboard. i mean zscaler no firewalls switchboard It's very different. it's very different ZPA has been totally different. zpa has been totally different Zero Trust Branch has a lot of evangelism, but our customer is getting it. zero trust branch has a lot of evangelism but our customer is getting it In the security operations area, we're actually, from end user point of view, it'll be a lot easier and simpler. in the security operations area we're actually from end user point of view it'll be a lot easier and simpler Now, they don't need to build this big data lake and all that kind of stuff. now they don't need to build this big data lake and all that kind of stuff I see far less evangelism needed in the security operations area. i see far less evangelism needed in the security operations area Because we are not trying to say, don't do this, do this. because we are not trying to say don't do this do this The problem they're solving is similar. the problem they're solving is similar At the end of the day, we're going to make it simpler. at the end of the day we're going to make it simpler Here's how you think about it. You know, when Palo Alto went from Check Point, that was not a big change. It was simple. In our case, Zero Trust was totally taking on firewalls. It's like Tesla going against all these incumbents. That was the different fight. Customers are already tired of security operations solutions. We are inbound demand. Lots and lots of customers want us to get there. It's going to take some time. We knew a combination of some acquisitions or internal stuff is going to get us there. You should think about when a company moves in a new space, you must have some core competencies. Otherwise, you shouldn't get there. We saw two core competencies we had. Well, maybe call it three. One, all the data logs, 500 trillion a day. Here's how you think about it. here's how you think about it You know, when Palo Alto went from Check Point, that was not a big change. you know when palo alto went from check point that was not a big change It was simple. it was simple In our case, Zero Trust was totally taking on firewalls. in our case zero trust was totally taking on firewalls It's like Tesla going against all these incumbents. it's like tesla going against all these incumbents That was the different fight. that was the different fight Customers are already tired of security operations solutions. customers are already tired of security operations solutions We are inbound demand. we are inbound demand Lots and lots of customers want us to get there. lots and lots of customers want us to get there It's going to take some time. it's going to take some time We knew a combination of some acquisitions or internal stuff is going to get us there. we knew a combination of some acquisitions or internal stuff is going to get us there You should think about when a company moves in a new space, you must have some core competencies. you should think about when a company moves in a new space you must have some core competencies Otherwise, you shouldn't get there. otherwise you shouldn't get there We saw two core competencies we had. we saw two core competencies we had Well, maybe call it three. well maybe call it three One, all the data logs, 500 trillion a day. one all the data logs 500 trillion a day Security research team, we've got over 200 plus researchers, security research, serious research. A very large and eager and happy customer base. We needed the Avalor piece to do a better way of a data fabric without going to this big data lake all the time. That was the first piece of architectural stuff. Now Red Canary bringing the application side of agentic technology to us. It is exciting. I expect it to be far less evangelistic here. Security research team, we've got over 200 plus researchers, security research, serious research. security research team we've got over 200 plus researchers security research serious research A very large and eager and happy customer base. a very large and eager and happy customer base We needed the Avalor piece to do a better way of a data fabric without going to this big data lake all the time. we needed the avalor piece to do a better way of a data fabric without going to this big data lake all the time That was the first piece of architectural stuff. that was the first piece of architectural stuff Now Red Canary bringing the application side of agentic technology to us. now red canary bringing the application side of agentic technology to us It is exciting. it is exciting I expect it to be far less evangelistic here. i expect it to be far less evangelistic here

Speaker 5: All right. This is Yun from Loop Capital. Thanks for doing this today. Basically, as you guys are getting into data security and agentic AI security and whatnot, identities are becoming more important. Obviously, you have some foundational technology behind that through the ZIA and whatnot. All right. all right This is Yun from Loop Capital. this is yun from loop capital Thanks for doing this today. thanks for doing this today Basically, as you guys are getting into data security and agentic AI security and whatnot, identities are becoming more important. basically as you guys are getting into data security and agentic ai security and whatnot identities are becoming more important Obviously, you have some foundational technology behind that through the ZIA and whatnot. obviously you have some foundational technology behind that through the zia and whatnot How much do you need to get into the identity security layer for you to be more effective in data security and agentic AI security? Or do you plan on continuing to partner with those people in those spaces? How much do you need to get into the identity security layer for you to be more effective in data security and agentic AI security? how much do you need to get into the identity security layer for you to be more effective in data security and agentic ai security Or do you plan on continuing to partner with those people in those spaces? or do you plan on continuing to partner with those people in those spaces

Speaker 12: I'll start, then Dhawal or Adam can go deeper. We've been asked many times to get into adjacent spaces. I've been asked so many times, why don't you buy an EDR vendor? Why don't you buy an identity vendor? We stayed away from it. We have clear ideas where to go to. We integrate with identity vendors. Now, there's next level of adaptive stuff we can do that Dhawal can explain to add more value on top of it. We are working with Microsoft on the agent identity. Microsoft is a natural company to do that. Working with them to leverage it is a good thing. I'll start, then Dhawal or Adam can go deeper. i'll start then dhawal or adam can go deeper We've been asked many times to get into adjacent spaces. we've been asked many times to get into adjacent spaces I've been asked so many times, why don't you buy an EDR vendor? i've been asked so many times why don't you buy an edr vendor Why don't you buy an identity vendor? why don't you buy an identity vendor We stayed away from it. we stayed away from it We have clear ideas where to go to. we have clear ideas where to go to We integrate with identity vendors. we integrate with identity vendors Now, there's next level of adaptive stuff we can do that Dhawal can explain to add more value on top of it. now there's next level of adaptive stuff we can do that dhawal can explain to add more value on top of it We are working with Microsoft on the agent identity. we are working with microsoft on the agent identity Microsoft is a natural company to do that. microsoft is a natural company to do that Working with them to leverage it is a good thing. working with them to leverage it is a good thing Core identity, we want to work with someone, but we have value to add on top. Core identity, we want to work with someone, but we have value to add on top. core identity we want to work with someone but we have value to add on top

Speaker 13: Yeah. Look, we are a consumer of identity. If the identities are well defined for users, right, we consume it. What Jay talked about is identities are still very static. What we are able to do as a switchboard or policy engine is collect a lot of telemetry around the risk associated with identities and the risk signals. We compute things like risk score, but have a lot of raw risk signals like people connecting to guest Wi-Fi or people, impossible location popping up, hundreds of these attributes. All of these become context to the identity, and we build rich policies around it. We also are building APIs for our customers to take that from us and integrate everywhere in their environment. Yeah. yeah Look, we are a consumer of identity. look we are a consumer of identity If the identities are well defined for users, right, we consume it. if the identities are well defined for users right we consume it What Jay talked about is identities are still very static. what jay talked about is identities are still very static What we are able to do as a switchboard or policy engine is collect a lot of telemetry around the risk associated with identities and the risk signals. what we are able to do as a switchboard or policy engine is collect a lot of telemetry around the risk associated with identities and the risk signals We compute things like risk score, but have a lot of raw risk signals like people connecting to guest Wi-Fi or people, impossible location popping up, hundreds of these attributes. we compute things like risk score but have a lot of raw risk signals like people connecting to guest wi-fi or people impossible location popping up hundreds of these attributes All of these become context to the identity, and we build rich policies around it. all of these become context to the identity and we build rich policies around it We also are building APIs for our customers to take that from us and integrate everywhere in their environment. we also are building apis for our customers to take that from us and integrate everywhere in their environment When you think about non-human identities, like workload identities or identity of OT systems, we are, again, integrating with a wide variety of vendors who generate tags and labels. This is an area where, by virtue of how we get deployed, for example, in branch as a gateway appliance, we are profiling and understanding what these devices are, which become identifiers for them. We integrate with APIs of all the cloud providers and learn their identities. We talked about our micro-segmentation service, which basically builds the process-level identity map. Yes, we have more context and identity to enrich customers' existing identity systems because identity is a core pillar of Zero Trust. We are making it richer and richer. We do have capabilities around ITDR, identity threat detection response, that plugs into the broader security operations use cases as well. When you think about non-human identities, like workload identities or identity of OT systems, we are, again, integrating with a wide variety of vendors who generate tags and labels. when you think about non-human identities like workload identities or identity of ot systems we are again integrating with a wide variety of vendors who generate tags and labels This is an area where, by virtue of how we get deployed, for example, in branch as a gateway appliance, we are profiling and understanding what these devices are, which become identifiers for them. this is an area where by virtue of how we get deployed for example in branch as a gateway appliance we are profiling and understanding what these devices are which become identifiers for them We integrate with APIs of all the cloud providers and learn their identities. we integrate with apis of all the cloud providers and learn their identities We talked about our micro-segmentation service, which basically builds the process-level identity map. we talked about our micro-segmentation service which basically builds the process-level identity map Yes, we have more context and identity to enrich customers' existing identity systems because identity is a core pillar of Zero Trust. yes we have more context and identity to enrich customers' existing identity systems because identity is a core pillar of zero trust We are making it richer and richer. we are making it richer and richer We do have capabilities around ITDR, identity threat detection response, that plugs into the broader security operations use cases as well. we do have capabilities around itdr identity threat detection response that plugs into the broader security operations use cases as well

Speaker 12: Yeah. Yeah. yeah Just maybe a quick add to both of those. I think, again, consumer of identities, not necessarily the creator of those identities, and for very specific use cases. You'll see a little bit more of this potentially tomorrow if you're here as well. In the security operations world, identities are super important. Identities are also defined very differently across elements of your organization. What looks like A Geller is also Adam Geller is also Adam G or A Geller slash local. Having a data fabric, one of the things we're using is to normalize that as well because that's about understanding context. Those are not different behaviors or different people. We want to understand that as one thing. That's another area where identity will be very important for us. We build on top of identity and deliver real value. Just maybe a quick add to both of those. just maybe a quick add to both of those I think, again, consumer of identities, not necessarily the creator of those identities, and for very specific use cases. i think again consumer of identities not necessarily the creator of those identities and for very specific use cases You'll see a little bit more of this potentially tomorrow if you're here as well. you'll see a little bit more of this potentially tomorrow if you're here as well In the security operations world, identities are super important. in the security operations world identities are super important Identities are also defined very differently across elements of your organization. identities are also defined very differently across elements of your organization What looks like A Geller is also Adam Geller is also Adam G or A Geller slash local. what looks like a geller is also adam geller is also adam g or a geller slash local Having a data fabric, one of the things we're using is to normalize that as well because that's about understanding context. having a data fabric one of the things we're using is to normalize that as well because that's about understanding context Those are not different behaviors or different people. those are not different behaviors or different people We want to understand that as one thing. we want to understand that as one thing That's another area where identity will be very important for us. that's another area where identity will be very important for us We build on top of identity and deliver real value. we build on top of identity and deliver real value

Speaker 11: All right. Let's go to Adam and Junaid. All right. all right Let's go to Adam and Junaid. let's go to adam and junaid

Speaker 20: Thanks. Adam Tindle, Raymond James , thanks for doing this. Jay, I want to continue the conversation on Red Canary and the push into the SOC. As we think about that, most MDR and SOC plays have started with the endpoint and moved into SIEM and then pushed into the SOC, whether that's CrowdStrike buying Humio, Palo Alto, moving to XSIAM, and then having this path into the SOC. You're coming at it from a different angle, from the network and then data and then into the SOC. I just wonder if you could describe maybe the pros and cons to eventually moving into SIEM and endpoint. Sounds like you're not very interested in that, but if you could flesh out that discussion. Thanks. thanks Adam Tindle, Raymond James , thanks for doing this. adam tindle, raymond james , thanks for doing this Jay, I want to continue the conversation on Red Canary and the push into the SOC. jay i want to continue the conversation on red canary and the push into the soc As we think about that, most MDR and SOC plays have started with the endpoint and moved into SIEM and then pushed into the SOC, whether that's CrowdStrike buying Humio, Palo Alto, moving to XSIAM, and then having this path into the SOC. as we think about that most mdr and soc plays have started with the endpoint and moved into siem and then pushed into the soc whether that's crowdstrike buying humio palo alto moving to xsiam and then having this path into the soc You're coming at it from a different angle, from the network and then data and then into the SOC. you're coming at it from a different angle from the network and then data and then into the soc I just wonder if you could describe maybe the pros and cons to eventually moving into SIEM and endpoint. i just wonder if you could describe maybe the pros and cons to eventually moving into siem and endpoint Sounds like you're not very interested in that, but if you could flesh out that discussion. sounds like you're not very interested in that but if you could flesh out that discussion The second piece of the question would be how to manage the potential channel conflict as you move into this, right? By starting with endpoint SIEM and getting into SOC, I think it got channel a little bit more comfortable with that move. You are going straight into this, and you obviously have a very channel-friendly strategy. I wonder if you could touch on that as well. The second piece of the question would be how to manage the potential channel conflict as you move into this, right? the second piece of the question would be how to manage the potential channel conflict as you move into this right By starting with endpoint SIEM and getting into SOC, I think it got channel a little bit more comfortable with that move. You are going straight into this, and you obviously have a very channel-friendly strategy. by starting with endpoint siem and getting into soc i think it got channel a little bit more comfortable with that move. you are going straight into this and you obviously have a very channel-friendly strategy I wonder if you could touch on that as well. i wonder if you could touch on that as well

Speaker 12: Thank you. All right. First of all, where do you start? The easiest thing for an EDR vendor to start is from EDR telemetry. That is all they have. An EDR tells you if something got compromised or not. That is all it tells you. If you can really understand that and you have communication channel, you understand a lot more. Before a machine gets compromised, often reconnaissance takes place. We see all of the reconnaissance. Thank you. thank you All right. all right First of all, where do you start? first of all where do you start The easiest thing for an EDR vendor to start is from EDR telemetry. That is all they have. the easiest thing for an edr vendor to start is from edr telemetry. that is all they have An EDR tells you if something got compromised or not. That is all it tells you. an edr tells you if something got compromised or not. that is all it tells you If you can really understand that and you have communication channel, you understand a lot more. if you can really understand that and you have communication channel you understand a lot more Before a machine gets compromised, often reconnaissance takes place. before a machine gets compromised often reconnaissance takes place We see all of the reconnaissance. we see all of the reconnaissance It's just that it so happened a few, couple of vendors started from the EDR side of it. Traditional SIEM SOC never started from the EDR side of it. That's why EDR, calling it MDR and XDR, all these are, nothing was useful. Okay? They kept on creating more and more acronyms, hoping that one acronym will be more useful than others. Eventually, also what's happening is, I mean, old SIEMs may have 100 sources of data, 150. Really four or five sources matter in today's world. Who cares about the logs from your router and switch and firewall in the data center somewhere? Most of the world is moving to the cloud. Our communication logs, extremely important. EDR logs, very important. Identity logs, very important. And some of the cloud workload logs, very important. That's really the big universe. It's just that it so happened a few, couple of vendors started from the EDR side of it. it's just that it so happened a few couple of vendors started from the edr side of it Traditional SIEM SOC never started from the EDR side of it. traditional siem soc never started from the edr side of it That's why EDR, calling it MDR and XDR, all these are, nothing was useful. that's why edr calling it mdr and xdr all these are nothing was useful Okay? okay They kept on creating more and more acronyms, hoping that one acronym will be more useful than others. they kept on creating more and more acronyms hoping that one acronym will be more useful than others Eventually, also what's happening is, I mean, old SIEMs may have 100 sources of data, 150. eventually also what's happening is i mean old siems may have 100 sources of data 150 Really four or five sources matter in today's world. really four or five sources matter in today's world Who cares about the logs from your router and switch and firewall in the data center somewhere? who cares about the logs from your router and switch and firewall in the data center somewhere Most of the world is moving to the cloud. most of the world is moving to the cloud Our communication logs, extremely important. our communication logs extremely important EDR logs, very important. edr logs very important Identity logs, very important. identity logs very important And some of the cloud workload logs, very important. and some of the cloud workload logs very important That's really the big universe. that's really the big universe Anyone to do it right will need to get all those things. We not only have communication logs with our endpoint agent. We've got tons of telemetry about the endpoint as well. Even though we aren't an identity provider, all authentication and failed authentication attempts go through us. We got all those signals as well. It was the right thing for us to start the right way to say these are the core sources. We'll get some of the data sources, but 80% of the stuff you need is already sitting with Zscaler. That's what kind of gets me excited. In terms of comparative position, it's not a comparative position at all. We got Red Canary for the technology they built. Anyone to do it right will need to get all those things. anyone to do it right will need to get all those things We not only have communication logs with our endpoint agent. we not only have communication logs with our endpoint agent We've got tons of telemetry about the endpoint as well. we've got tons of telemetry about the endpoint as well Even though we aren't an identity provider, all authentication and failed authentication attempts go through us. even though we aren't an identity provider all authentication and failed authentication attempts go through us We got all those signals as well. we got all those signals as well It was the right thing for us to start the right way to say these are the core sources. it was the right thing for us to start the right way to say these are the core sources We'll get some of the data sources, but 80% of the stuff you need is already sitting with Zscaler. we'll get some of the data sources but 80% of the stuff you need is already sitting with zscaler That's what kind of gets me excited. that's what kind of gets me excited In terms of comparative position, it's not a comparative position at all. in terms of comparative position it's not a comparative position at all We got Red Canary for the technology they built. we got red canary for the technology they built They kind of surprised us with the technology they had and the expertise and the way they were able to run this operation with amazing gross margins. I just couldn't understand how the margin could be so good. We understood it's a technology. They use the technology. Bringing the technology together, very complementary. Competing with others, we are going to remain a technology company. Having MDR expertise in some of the customer base is good for learning. If you don't have any experience in that space, I would say that you can't be a good provider of the solution. We have a small professional services team, but we don't compete with our partners on professional services. In fact, we embed sometimes our professional services with the partners to get them trained on it. Similarly, it's a massive world out there. They kind of surprised us with the technology they had and the expertise and the way they were able to run this operation with amazing gross margins. they kind of surprised us with the technology they had and the expertise and the way they were able to run this operation with amazing gross margins I just couldn't understand how the margin could be so good. i just couldn't understand how the margin could be so good We understood it's a technology. we understood it's a technology They use the technology. they use the technology Bringing the technology together, very complementary. bringing the technology together very complementary Competing with others, we are going to remain a technology company. competing with others we are going to remain a technology company Having MDR expertise in some of the customer base is good for learning. having mdr expertise in some of the customer base is good for learning If you don't have any experience in that space, I would say that you can't be a good provider of the solution. if you don't have any experience in that space i would say that you can't be a good provider of the solution We have a small professional services team, but we don't compete with our partners on professional services. we have a small professional services team but we don't compete with our partners on professional services In fact, we embed sometimes our professional services with the partners to get them trained on it. in fact we embed sometimes our professional services with the partners to get them trained on it Similarly, it's a massive world out there. similarly it's a massive world out there We'll remain a technology company, drive technology so our partners can use our SOC Ops technology to do managed services out there. We'll remain a technology company, drive technology so our partners can use our SOC Ops technology to do managed services out there. we'll remain a technology company drive technology so our partners can use our soc ops technology to do managed services out there Take the last question for this session from Junaid. We have one more Q&A session after this, so we'll come back to Q&As. Take the last question for this session from Junaid. take the last question for this session from junaid We have one more Q&A session after this, so we'll come back to Q&As. we have one more q&a session after this so we'll come back to q&as

Speaker 16: Thanks, Ashwin. Junaid Siddiqui, Truist Security. Jay, data security has been and continues to be a tremendous growth vector for your Zscaler. One of the things you've talked about in the past is that you've got the best vantage point in terms of delivering data security, sitting in line, being able to inspect all traffic, going into all kinds of applications. Could you just talk about some of the newer modules under your data pillar that address the out-of-band and data-at-rest and how the traction has been in those specific modules? Thanks, Ashwin. thanks ashwin Junaid Siddiqui, Truist Security. junaid siddiqui truist security Jay, data security has been and continues to be a tremendous growth vector for your Zscaler. jay data security has been and continues to be a tremendous growth vector for your zscaler One of the things you've talked about in the past is that you've got the best vantage point in terms of delivering data security, sitting in line, being able to inspect all traffic, going into all kinds of applications. one of the things you've talked about in the past is that you've got the best vantage point in terms of delivering data security sitting in line being able to inspect all traffic going into all kinds of applications Could you just talk about some of the newer modules under your data pillar that address the out-of-band and data- at- rest and how the traction has been in those specific modules? could you just talk about some of the newer modules under your data pillar that address the out-of-band and data- at- rest and how the traction has been in those specific modules Just overall, how do you envision that whole data security landscape shaping out as there are a lot of vendors that are trying to address that same pain point? Thank you. Just overall, how do you envision that whole data security landscape shaping out as there are a lot of vendors that are trying to address that same pain point? just overall how do you envision that whole data security landscape shaping out as there are a lot of vendors that are trying to address that same pain point Thank you. thank you

Speaker 12: I'll start then. Adam, you can go deeper into it. Our strategy is to make sure we secure your data no matter where it is because they want one policy. When all traffic is going through us, when it goes through the internet, and knowing that all data leaks through the internet, we are in the best position to really provide holistic data security for us. We had pieces to take care of that we completed in the past few years. Maybe Adam, you can go deeper into it. I'll start then. i'll start then Adam, you can go deeper into it. adam you can go deeper into it Our strategy is to make sure we secure your data no matter where it is because they want one policy. our strategy is to make sure we secure your data no matter where it is because they want one policy When all traffic is going through us, when it goes through the internet, and knowing that all data leaks through the internet, we are in the best position to really provide holistic data security for us. when all traffic is going through us when it goes through the internet and knowing that all data leaks through the internet we are in the best position to really provide holistic data security for us We had pieces to take care of that we completed in the past few years. we had pieces to take care of that we completed in the past few years Maybe Adam, you can go deeper into it. maybe adam you can go deeper into it

Speaker 18: Sure. Yeah. If you think about the different channels, right, and functionality, you need to be able to discover. Sure. sure Yeah. yeah If you think about the different channels, right, and functionality, you need to be able to discover. if you think about the different channels right and functionality you need to be able to discover You have to be in the right spot to discover data. Inline's a little different because inline is very much you're seeing it. You need to be able to quickly classify and make a decision. Data security goes much more broadly than that. There's all about the discovery. That's what you're doing when data is at rest. That started off in, think of it as in the SaaS world, in collaboration applications, then got very interesting with public cloud storage buckets, unstructured data, and then to structured data elements that are running in cloud and running on-prem. All of those kind of play into having a consistent way to discover, classify, and then sometimes we classify and then something else enforces because there's another technology that we're working with, like a Microsoft, right? You have to be in the right spot to discover data. you have to be in the right spot to discover data Inline's a little different because inline is very much you're seeing it. inline's a little different because inline is very much you're seeing it You need to be able to quickly classify and make a decision. you need to be able to quickly classify and make a decision Data security goes much more broadly than that. data security goes much more broadly than that There's all about the discovery. there's all about the discovery That's what you're doing when data is at rest. that's what you're doing when data is at rest That started off in, think of it as in the SaaS world, in collaboration applications, then got very interesting with public cloud storage buckets, unstructured data, and then to structured data elements that are running in cloud and running on-prem. that started off in think of it as in the saas world in collaboration applications then got very interesting with public cloud storage buckets unstructured data and then to structured data elements that are running in cloud and running on-prem All of those kind of play into having a consistent way to discover, classify, and then sometimes we classify and then something else enforces because there's another technology that we're working with, like a Microsoft, right? all of those kind of play into having a consistent way to discover classify and then sometimes we classify and then something else enforces because there's another technology that we're working with like a microsoft right When we're in the path, it's much easier for us to use our own classification. Sometimes we classify it, and then that's leveraged by another enforcement point because we're not in the path of that kind of flow, right? All of those pieces play out. The endpoint, actually, over the last several years has become more and more important. It's an important landing point. You see data before it's being transported and moved around. Endpoint DLP was a little bit, I think, not as high of a priority or thought several years ago. The team listened to some very solid feedback from customers and said, "If you're going to help me get on a modern data protection journey, this is a foundational element of a DLP solution in the classic sense, and you need to be able to do it. When we're in the path, it's much easier for us to use our own classification. when we're in the path it's much easier for us to use our own classification Sometimes we classify it, and then that's leveraged by another enforcement point because we're not in the path of that kind of flow, right? sometimes we classify it and then that's leveraged by another enforcement point because we're not in the path of that kind of flow right All of those pieces play out. all of those pieces play out The endpoint, actually, over the last several years has become more and more important. the endpoint actually over the last several years has become more and more important It's an important landing point. it's an important landing point You see data before it's being transported and moved around. you see data before it's being transported and moved around Endpoint DLP was a little bit, I think, not as high of a priority or thought several years ago. endpoint dlp was a little bit i think not as high of a priority or thought several years ago The team listened to some very solid feedback from customers and said, "If you're going to help me get on a modern data protection journey, this is a foundational element of a DLP solution in the classic sense, and you need to be able to do it. the team listened to some very solid feedback from customers and said "if you're going to help me get on a modern data protection journey this is a foundational element of a dlp solution in the classic sense and you need to be able to do it You need to be living there. You can't just live at the data sources. You have to be on the endpoint too. That's where that got added in. When you think about data security posture management, it's another lens of looking at this where you're taking those different ways you look at data. It's also looking at the configurations of the systems that support data, not just the actual data itself that's sitting underneath it. I think that's an interesting angle. It's why we're representing in that space as well. You need to be living there. you need to be living there You can't just live at the data sources. you can't just live at the data sources You have to be on the endpoint too. you have to be on the endpoint too That's where that got added in. that's where that got added in When you think about data security posture management, it's another lens of looking at this where you're taking those different ways you look at data. when you think about data security posture management it's another lens of looking at this where you're taking those different ways you look at data It's also looking at the configurations of the systems that support data, not just the actual data itself that's sitting underneath it. it's also looking at the configurations of the systems that support data not just the actual data itself that's sitting underneath it I think that's an interesting angle. i think that's an interesting angle It's why we're representing in that space as well. it's why we're representing in that space as well

Speaker 11: All right. Thank you so much. Now I'd like to invite Mike Rich, our CRO, President of Global Sales, onto the platform, please. All right. all right Thank you so much. thank you so much Now I'd like to invite Mike Rich, our CRO, President of Global Sales, onto the platform, please. now i'd like to invite mike rich our cro president of global sales onto the platform please

Speaker 8: All right. How many people were here last year? Pretty much a little over half the room. Good to see everybody again. Mike Rich, I'm President Global Sales, CRO. All right. all right How many people were here last year? how many people were here last year Pretty much a little over half the room. pretty much a little over half the room Good to see everybody again. good to see everybody again Mike Rich, I'm President Global Sales, CRO. mike rich i'm president global sales cro I joined the company really November of 2023 and laid out a strategy of what we want to do, kind of the go-to-market. We've been very consistent, the go-to-market vision. Number one, it was about transitioning to more of account-centric. So Zscaler had been really in the transactional mode, which was very good for that time in its growth. But we saw the need to really get deep with customers and make sure we could build out long-term strategic plans with them to consume on the platform and work, meet them kind of where they are. Also, an amplifier from the GSIs. GSIs are so important, especially with the top of the pyramid customers, which is a big chunk of where our revenue comes from. The GSIs can help on that strategic journey, right? I joined the company really November of 2023 and laid out a strategy of what we want to do, kind of the go-to-market. i joined the company really november of 2023 and laid out a strategy of what we want to do kind of the go-to-market We've been very consistent, the go-to-market vision. we've been very consistent the go-to-market vision Number one, it was about transitioning to more of account-centric. number one it was about transitioning to more of account-centric So Zscaler had been really in the transactional mode, which was very good for that time in its growth. so zscaler had been really in the transactional mode which was very good for that time in its growth But we saw the need to really get deep with customers and make sure we could build out long-term strategic plans with them to consume on the platform and work, meet them kind of where they are. but we saw the need to really get deep with customers and make sure we could build out long-term strategic plans with them to consume on the platform and work meet them kind of where they are Also, an amplifier from the GSIs. also an amplifier from the gsis GSIs are so important, especially with the top of the pyramid customers, which is a big chunk of where our revenue comes from. gsis are so important especially with the top of the pyramid customers which is a big chunk of where our revenue comes from The GSIs can help on that strategic journey, right? the gsis can help on that strategic journey right We've built out strong GSI partnerships in the last 18 months and then increased focus on specific verticals. The vertical sales, we'll talk more about that, but it's all about getting better relationships at the C level. When you're speaking in the industry language and helping them compete in their industry, they want to have conversations with you. You become more strategic. This is just some examples of how we've grown and how this strategy has helped us. If you just look at the number of customers spending over $5 million with us, that's grown. The customers that are spending over $1 million, that's grown. Validated. We're going to continue to double down on the strategy, and I'm very pleased with where we're at with it. We've built out strong GSI partnerships in the last 18 months and then increased focus on specific verticals. we've built out strong gsi partnerships in the last 18 months and then increased focus on specific verticals The vertical sales, we'll talk more about that, but it's all about getting better relationships at the C level. the vertical sales we'll talk more about that but it's all about getting better relationships at the c level When you're speaking in the industry language and helping them compete in their industry, they want to have conversations with you. when you're speaking in the industry language and helping them compete in their industry they want to have conversations with you You become more strategic. you become more strategic This is just some examples of how we've grown and how this strategy has helped us. this is just some examples of how we've grown and how this strategy has helped us If you just look at the number of customers spending over $5 million with us, that's grown. if you just look at the number of customers spending over $5 million with us that's grown The customers that are spending over $1 million, that's grown. the customers that are spending over $1 million that's grown Validated. validated We're going to continue to double down on the strategy, and I'm very pleased with where we're at with it. we're going to continue to double down on the strategy and i'm very pleased with where we're at with it On the GSI side, that's helped us get stronger pipeline, more strategic relationships, and ultimately drive more revenue. That 40% increase year over year is great. I think we can continue on that path. Again, adding that $5 million in bookings is fantastic. It was much smaller scale before. We talked a little bit about the verticals. We've got healthcare, State and local, and federal today. That team has grown significantly. That's validated that strategy. Like I said before, when you get in deep on the vertical side, industry-specific solutions, executives want to have conversations with you. That helps us drive better business, more strategic relationships, and longer-term plans with the customer. This just kind of validates how that's worked for us. Very happy with what we're doing in healthcare. On the GSI side, that's helped us get stronger pipeline, more strategic relationships, and ultimately drive more revenue. on the gsi side that's helped us get stronger pipeline more strategic relationships and ultimately drive more revenue That 40% increase year over year is great. that 40% increase year over year is great I think we can continue on that path. i think we can continue on that path Again, adding that $5 million in bookings is fantastic. again adding that $5 million in bookings is fantastic It was much smaller scale before. it was much smaller scale before We talked a little bit about the verticals. we talked a little bit about the verticals We've got healthcare, State and local, and federal today. we've got healthcare state and local and federal today That team has grown significantly. that team has grown significantly That's validated that strategy. that's validated that strategy Like I said before, when you get in deep on the vertical side, industry-specific solutions, executives want to have conversations with you. like i said before when you get in deep on the vertical side industry-specific solutions executives want to have conversations with you That helps us drive better business, more strategic relationships, and longer-term plans with the customer. that helps us drive better business more strategic relationships and longer-term plans with the customer This just kind of validates how that's worked for us. this just kind of validates how that's worked for us Very happy with what we're doing in healthcare. very happy with what we're doing in healthcare You've probably, let's see, we had Advent Healthcare CISO in here earlier. Is he still here? That's great. He's gone. Yeah. Fantastic relationships there. We're going to see that expand, and we're going to move beyond that too. Even if you look at financial services, huge, huge area for us. The plan is to be organically from bottoms up, hire more people dedicated to that region, get territories that are specific to those industries. Once you get enough density, you add the first-line managers. Once you get enough density on first-line managers, you add second-line managers. It's that bottoms-up approach versus tops-down to make sure we're taking full advantage of the resources and we don't have people flying over each other. That's the least disruptive way to do it, to take advantage of the growth. This is what's most exciting to me. You've probably, let's see, we had Advent Healthcare CISO in here earlier. you've probably let's see we had advent healthcare ciso in here earlier Is he still here? is he still here That's great. that's great He's gone. he's gone Yeah. yeah Fantastic relationships there. fantastic relationships there We're going to see that expand, and we're going to move beyond that too. we're going to see that expand and we're going to move beyond that too Even if you look at financial services, huge, huge area for us. even if you look at financial services huge huge area for us The plan is to be organically from bottoms up, hire more people dedicated to that region, get territories that are specific to those industries. the plan is to be organically from bottoms up hire more people dedicated to that region get territories that are specific to those industries Once you get enough density, you add the first-line managers. once you get enough density you add the first-line managers Once you get enough density on first-line managers, you add second-line managers. once you get enough density on first-line managers you add second-line managers It's that bottoms-up approach versus tops-down to make sure we're taking full advantage of the resources and we don't have people flying over each other. it's that bottoms-up approach versus tops-down to make sure we're taking full advantage of the resources and we don't have people flying over each other That's the least disruptive way to do it, to take advantage of the growth. that's the least disruptive way to do it to take advantage of the growth This is what's most exciting to me. this is what's most exciting to me We're still a people business. We've got great technology. You got to have great technology, but you also have to have great people that can help strategically align with your customers. We've got a strong leadership team. I'll show that a little bit later across all geographies. The GSI and national strategic partnerships, again, those have been validated. We've hired people that know how to sell and work with them. It's a bit of a give-and-take relationship when you're building out motions with GSIs. They've got to see a way to build out there and grow their business. They've got aggressive numbers that they have to fulfill. We have to be conscious of that and make sure it's bidirectional. Then again, the platform, more realization, value realization for customers and partners. We're still a people business. we're still a people business We've got great technology. we've got great technology You got to have great technology, but you also have to have great people that can help strategically align with your customers. you got to have great technology but you also have to have great people that can help strategically align with your customers We've got a strong leadership team. we've got a strong leadership team I'll show that a little bit later across all geographies. i'll show that a little bit later across all geographies The GSI and national strategic partnerships, again, those have been validated. the gsi and national strategic partnerships again those have been validated We've hired people that know how to sell and work with them. we've hired people that know how to sell and work with them It's a bit of a give-and-take relationship when you're building out motions with GSIs. it's a bit of a give-and-take relationship when you're building out motions with gsis They've got to see a way to build out there and grow their business. they've got to see a way to build out there and grow their business They've got aggressive numbers that they have to fulfill. they've got aggressive numbers that they have to fulfill We have to be conscious of that and make sure it's bidirectional. we have to be conscious of that and make sure it's bidirectional Then again, the platform, more realization, value realization for customers and partners. then again the platform more realization value realization for customers and partners When you have a larger platform with more products versus just ZIA and ZPA, ZDX, now we've got all these other solutions that you talked about with Zero Trust Everywhere and all the different users that we can actually go in and help secure and protect. It just provides more solutions that we can go sell. You have to have that flexibility in the platform. The other thing that's exciting about that is it helps us get into some of these accounts where we were kind of boxed out before. Now we have solutions that go beyond just ZIA and ZPA that we can sell in to get the new logos. This is just a quick snapshot of the team. You've probably seen or met some of these people. I know Ross was at the analyst event last night. Some of you may have met Ross. When you have a larger platform with more products versus just ZIA and ZPA, ZDX, now we've got all these other solutions that you talked about with Zero Trust Everywhere and all the different users that we can actually go in and help secure and protect. when you have a larger platform with more products versus just zia and zpa zdx now we've got all these other solutions that you talked about with zero trust everywhere and all the different users that we can actually go in and help secure and protect It just provides more solutions that we can go sell. it just provides more solutions that we can go sell You have to have that flexibility in the platform. you have to have that flexibility in the platform The other thing that's exciting about that is it helps us get into some of these accounts where we were kind of boxed out before. the other thing that's exciting about that is it helps us get into some of these accounts where we were kind of boxed out before Now we have solutions that go beyond just ZIA and ZPA that we can sell in to get the new logos. now we have solutions that go beyond just zia and zpa that we can sell in to get the new logos This is just a quick snapshot of the team. this is just a quick snapshot of the team You've probably seen or met some of these people. you've probably seen or met some of these people I know Ross was at the analyst event last night. i know ross was at the analyst event last night Some of you may have met Ross. some of you may have met ross He runs AMS for us. Ross, I worked with Ross for years at ServiceNow. Very strong leader. Pete has been here for seven, eight-plus years. A lot of experience. He's fantastic. He's running the federal, state, and local and healthcare business. Brian Marvin runs EMEA for us. Strong background, enterprise sales, gets how to work with GSIs and partners and do strategic deals. Then Andreas Hartl, great background, Microsoft for a long time, knows how to run the APJ business. It's a very complex business, a lot of different countries, a lot of geographies to handle. He's been fantastic. Then Anthony Torciello, who's running our channel business globally. Worked with Anthony for years, actually, at ServiceNow as well. He built out large programs with GSIs, Anvars at ServiceNow. Did anybody go to the breakout, the partner breakout? No? Okay. Jay, I know you went. He runs AMS for us. he runs ams for us Ross, I worked with Ross for years at ServiceNow. ross i worked with ross for years at servicenow Very strong leader. very strong leader Pete has been here for seven, eight-plus years. pete has been here for seven eight-plus years A lot of experience. a lot of experience He's fantastic. he's fantastic He's running the federal, state, and local and healthcare business. he's running the federal state and local and healthcare business Brian Marvin runs EMEA for us. brian marvin runs emea for us Strong background, enterprise sales, gets how to work with GSIs and partners and do strategic deals. strong background enterprise sales gets how to work with gsis and partners and do strategic deals Then Andreas Hartl, great background, Microsoft for a long time, knows how to run the APJ business. then andreas hartl great background microsoft for a long time knows how to run the apj business It's a very complex business, a lot of different countries, a lot of geographies to handle. it's a very complex business a lot of different countries a lot of geographies to handle He's been fantastic. he's been fantastic Then Anthony Torciello, who's running our channel business globally. then anthony torciello who's running our channel business globally Worked with Anthony for years, actually, at ServiceNow as well. worked with anthony for years actually at servicenow as well He built out large programs with GSIs, Anvars at ServiceNow. he built out large programs with gsis anvars at servicenow Did anybody go to the breakout, the partner breakout? did anybody go to the breakout the partner breakout No? no Okay. okay Jay, I know you went. jay i know you went They enjoyed your Red Canary discussion. Thank you. Focus areas for 2026 and beyond. Increasing enterprise penetration. We've got a lot of customers in enterprise, but we're still very underpenetrated, right? Even in the customers that we've sold to, but the net new logo portion of it, there is a lot to go after there. It's fertile hunting grounds. We've only got the penetration there is low, 20-30% range, right? A lot to go do. Growing new product categories. You've heard a lot about the new products today. I wasn't here for the whole thing, but I know you've seen Adam's presentation, which was fantastic today. It's great to have a robust platform that you can go sell. Customers appreciate that, and it gives us options. We've got a lot of work to do to get penetrated where we should be in these accounts. They enjoyed your Red Canary discussion. they enjoyed your red canary discussion Thank you. thank you Focus areas for 2026 and beyond. focus areas for 2026 and beyond Increasing enterprise penetration. increasing enterprise penetration We've got a lot of customers in enterprise, but we're still very underpenetrated, right? we've got a lot of customers in enterprise but we're still very underpenetrated right Even in the customers that we've sold to, but the net new logo portion of it, there is a lot to go after there. even in the customers that we've sold to but the net new logo portion of it there is a lot to go after there It's fertile hunting grounds. it's fertile hunting grounds We've only got the penetration there is low, 20-30% range, right? we've only got the penetration there is low 20-30% range right A lot to go do. a lot to go do Growing new product categories. growing new product categories You've heard a lot about the new products today. you've heard a lot about the new products today I wasn't here for the whole thing, but I know you've seen Adam's presentation, which was fantastic today. i wasn't here for the whole thing but i know you've seen adam's presentation which was fantastic today It's great to have a robust platform that you can go sell. it's great to have a robust platform that you can go sell Customers appreciate that, and it gives us options. customers appreciate that and it gives us options We've got a lot of work to do to get penetrated where we should be in these accounts. we've got a lot of work to do to get penetrated where we should be in these accounts We're utilizing our specialty sales takeoff. You've heard the term Takeoff Teams, specialty sales. We kind of use those together to focus on going after these solutions. We've got our core teams that are going to partner with the specialty teams to help accelerate these motions. Zero Trust Everywhere, and then also Agentic Operations. These are massive underdeployed areas. The Cost Takeout piece goes across all these motions. That just helps us validate when we're trying to do larger deals with customers, we're building out plans where they can actually fund the deal over time with Cost Takeout. We've always had this as a benefit of Zscaler. What we've really done in the last year has become very prescriptive, very prescriptive with how customers do it. We're helping them along the way, build out, kind of doing their homework for them. That's been good. We're utilizing our specialty sales takeoff. we're utilizing our specialty sales takeoff You've heard the term Takeoff Teams, specialty sales. you've heard the term takeoff teams specialty sales We kind of use those together to focus on going after these solutions. we kind of use those together to focus on going after these solutions We've got our core teams that are going to partner with the specialty teams to help accelerate these motions. we've got our core teams that are going to partner with the specialty teams to help accelerate these motions Zero Trust Everywhere, and then also Agentic Operations. zero trust everywhere and then also agentic operations These are massive underdeployed areas. these are massive underdeployed areas The Cost Takeout piece goes across all these motions. the cost takeout piece goes across all these motions That just helps us validate when we're trying to do larger deals with customers, we're building out plans where they can actually fund the deal over time with Cost Takeout. that just helps us validate when we're trying to do larger deals with customers we're building out plans where they can actually fund the deal over time with cost takeout We've always had this as a benefit of Zscaler. we've always had this as a benefit of zscaler What we've really done in the last year has become very prescriptive, very prescriptive with how customers do it. what we've really done in the last year has become very prescriptive very prescriptive with how customers do it We're helping them along the way, build out, kind of doing their homework for them. we're helping them along the way build out kind of doing their homework for them That's been good. that's been good Of course, the channel coverage we talked about. Just a quick snapshot when we talk about the new logo opportunities. We've got lots of new logos to go after. We've got 4,000 current customers, right? There's another 16,000 to go after, right? Even in those 4,000 that we have, they're underpenetrated. You've got existing customers that are underpenetrated, and then you've got the new logos. What we're doing to help facilitate going after them is making sure we have territories set up the right way. I take territory planning very, very seriously to make sure in by GO, we've got the right people in the right territory focused on the right accounts, right? In the G2Ks, the reason you see 1,700 as a number up there, we've got 700 today. Of course, the channel coverage we talked about. of course the channel coverage we talked about Just a quick snapshot when we talk about the new logo opportunities. just a quick snapshot when we talk about the new logo opportunities We've got lots of new logos to go after. we've got lots of new logos to go after We've got 4,000 current customers, right? we've got 4,000 current customers right There's another 16,000 to go after, right? there's another 16,000 to go after right Even in those 4,000 that we have, they're underpenetrated. even in those 4,000 that we have they're underpenetrated You've got existing customers that are underpenetrated, and then you've got the new logos. you've got existing customers that are underpenetrated and then you've got the new logos What we're doing to help facilitate going after them is making sure we have territories set up the right way. what we're doing to help facilitate going after them is making sure we have territories set up the right way I take territory planning very, very seriously to make sure in by GO, we've got the right people in the right territory focused on the right accounts, right? i take territory planning very very seriously to make sure in by go we've got the right people in the right territory focused on the right accounts right In the G2Ks, the reason you see 1,700 as a number up there, we've got 700 today. in the g2ks the reason you see 1,700 as a number up there we've got 700 today 1,700 is really what we can go after because you have to look at we can't really sell to Chinese companies and Russian-based companies. 1,700 is who we're going after. We've got territories that are focused on just those accounts as well. Even in the G2Ks that we do have, again, the potential is $5 million plus in the vast majority of those, and most of them are under $1 million today. We've got a lot. We can go do a lot more selling. We can do it. It's fertile hunting ground for those accounts that are even customers already. Focus execution for new product growth. You heard Zero Trust Everywhere. It's fantastic. Customers love it. It's a great motion for us. We have dedicated sales plays to go after that. Data Security Everywhere. 1,700 is really what we can go after because you have to look at we can't really sell to Chinese companies and Russian-based companies. 1,700 is who we're going after. 1,700 is really what we can go after because you have to look at we can't really sell to chinese companies and russian-based companies 1,700 is who we're going after We've got territories that are focused on just those accounts as well. we've got territories that are focused on just those accounts as well Even in the G2Ks that we do have, again, the potential is $5 million plus in the vast majority of those, and most of them are under $1 million today. even in the g2ks that we do have again the potential is $5 million plus in the vast majority of those and most of them are under $1 million today We've got a lot. we've got a lot We can go do a lot more selling. we can go do a lot more selling We can do it. we can do it It's fertile hunting ground for those accounts that are even customers already. it's fertile hunting ground for those accounts that are even customers already Focus execution for new product growth. focus execution for new product growth You heard Zero Trust Everywhere. you heard zero trust everywhere It's fantastic. it's fantastic Customers love it. customers love it It's a great motion for us. it's a great motion for us We have dedicated sales plays to go after that. we have dedicated sales plays to go after that Data Security Everywhere. data security everywhere That part of the portfolio has become more and more robust, and you're seeing a lot of deals we're doing, takeout deals we're doing there. They do not like the incumbents, the legacy providers. They're looking for us to actually come in and help them drive that story, which is fantastic. Agentic Operations. This combined business for us is $1 billion ARR. It could be a heck of a lot more. Our target is to get to $390 million by the end of next year on this Zero Trust Everywhere. That's where they have three or more of our products that qualify as Zero Trust. Lots of potential, and the strategy is working. Again, we talked about the channel leverage and going after the G2Ks really helps you with the top of the pyramid accounts, which are typically G2Ks. That part of the portfolio has become more and more robust, and you're seeing a lot of deals we're doing, takeout deals we're doing there. that part of the portfolio has become more and more robust and you're seeing a lot of deals we're doing takeout deals we're doing there They do not like the incumbents, the legacy providers. they do not like the incumbents the legacy providers They're looking for us to actually come in and help them drive that story, which is fantastic. they're looking for us to actually come in and help them drive that story which is fantastic Agentic Operations. agentic operations This combined business for us is $1 billion ARR. this combined business for us is $1 billion arr It could be a heck of a lot more. it could be a heck of a lot more Our target is to get to $390 million by the end of next year on this Zero Trust Everywhere. our target is to get to $390 million by the end of next year on this zero trust everywhere That's where they have three or more of our products that qualify as Zero Trust. that's where they have three or more of our products that qualify as zero trust Lots of potential, and the strategy is working. lots of potential and the strategy is working Again, we talked about the channel leverage and going after the G2Ks really helps you with the top of the pyramid accounts, which are typically G2Ks. again we talked about the channel leverage and going after the g2ks really helps you with the top of the pyramid accounts which are typically g2ks There's also the government accounts that are very large. They help you in the government accounts, and they help you with the multinationals, right? Some of those are private, and they're not G2Ks, but regardless, they help you accelerate the big deals, which is fantastic. That motion is going well. Cloud marketplace, this is the Hyperscalers. This motion is still fairly new to us, but we've become much more strategic thanks to Puneet's work. Thank you, Puneet and team. We've got a great motion going there. I expect to see a lot of growth to come out of that. Just again, that's where we're leveraging them to help us sell and go to market, right? AWS, Google, Azure. Increased investments in these strategic regional partners. There's also the government accounts that are very large. there's also the government accounts that are very large They help you in the government accounts, and they help you with the multinationals, right? they help you in the government accounts and they help you with the multinationals right Some of those are private, and they're not G2Ks, but regardless, they help you accelerate the big deals, which is fantastic. some of those are private and they're not g2ks but regardless they help you accelerate the big deals which is fantastic That motion is going well. that motion is going well Cloud marketplace, this is the Hyperscalers. cloud marketplace this is the hyperscalers This motion is still fairly new to us, but we've become much more strategic thanks to Puneet's work. this motion is still fairly new to us but we've become much more strategic thanks to puneet's work Thank you, Puneet and team. thank you puneet and team We've got a great motion going there. we've got a great motion going there I expect to see a lot of growth to come out of that. i expect to see a lot of growth to come out of that Just again, that's where we're leveraging them to help us sell and go to market, right? just again that's where we're leveraging them to help us sell and go to market right AWS, Google, Azure. aws google azure Increased investments in these strategic regional partners. increased investments in these strategic regional partners Traditionally, we've had sort of a transactional relationship with them, but what we've doubled down with them on, that's why I asked if anybody went to the channel breakout. We're rewarding them for building out dedicated practices, right? This is where they're actually going to help deliver value. They're going to help with the implementations. They're going to help with the strategy and make sure what we sold them together gets deployed and that we have a strong strategic roadmap built out with them. I call it the Three-Legged Stool. You got the customer, Zscaler, direct sales, and the partner, the three of us working together very closely versus being just transactional. Traditionally, we've had sort of a transactional relationship with them, but what we've doubled down with them on, that's why I asked if anybody went to the channel breakout. traditionally we've had sort of a transactional relationship with them but what we've doubled down with them on that's why i asked if anybody went to the channel breakout We're rewarding them for building out dedicated practices, right? we're rewarding them for building out dedicated practices right This is where they're actually going to help deliver value. this is where they're actually going to help deliver value They're going to help with the implementations. they're going to help with the implementations They're going to help with the strategy and make sure what we sold them together gets deployed and that we have a strong strategic roadmap built out with them. they're going to help with the strategy and make sure what we sold them together gets deployed and that we have a strong strategic roadmap built out with them I call it the Three-Legged Stool. i call it the three-legged stool You got the customer, Zscaler, direct sales, and the partner, the three of us working together very closely versus being just transactional. you got the customer zscaler direct sales and the partner the three of us working together very closely versus being just transactional Part of this is getting all your resources focused at the top of the pyramid, building out on the bottom of the pyramid because we have a lot of customers down below, but it only represents 5%-6%. Got to make sure that we've got partners that can drive that business for us so we can use our valuable resources to sell up market, and that motion is going really, really well. You're going to see more and more of that as well. You've heard Jay talk about the Cost Takeout program. Super important. This is just some examples. You guys have probably heard a lot about it, but customers do appreciate that we're being more prescriptive. It's hard to give up products. People love to hug their hardware. We've got a plan to help them phase these things out. Part of this is getting all your resources focused at the top of the pyramid, building out on the bottom of the pyramid because we have a lot of customers down below, but it only represents 5%-6%. part of this is getting all your resources focused at the top of the pyramid building out on the bottom of the pyramid because we have a lot of customers down below but it only represents 5%-6% Got to make sure that we've got partners that can drive that business for us so we can use our valuable resources to sell up market, and that motion is going really, really well. got to make sure that we've got partners that can drive that business for us so we can use our valuable resources to sell up market and that motion is going really really well You're going to see more and more of that as well. you're going to see more and more of that as well You've heard Jay talk about the Cost Takeout program. you've heard jay talk about the cost takeout program Super important. super important This is just some examples. this is just some examples You guys have probably heard a lot about it, but customers do appreciate that we're being more prescriptive. you guys have probably heard a lot about it but customers do appreciate that we're being more prescriptive It's hard to give up products. it's hard to give up products People love to hug their hardware. people love to hug their hardware We've got a plan to help them phase these things out. we've got a plan to help them phase these things out It's going over quite well. It's just a more prescriptive approach, and we're super focused on it. This is just an example of a customer that has 20,000 plus users and the potential savings, right? This is just on average. Z-Flex. We've talked a little bit about that. You've heard a little bit about it. Customers have asked for a more flexible way. When you have a platform of consuming the platform, and when you have a platform with multiproducts, there's no way to predict ahead of time exactly how much of which product do I need to go use, right? This is a great way to help get them to commit to more spend, right, and adopt the platform at their speed and do it in a very easy consume method. They love it too because it's predictable budget, right? It's going over quite well. it's going over quite well It's just a more prescriptive approach, and we're super focused on it. it's just a more prescriptive approach and we're super focused on it This is just an example of a customer that has 20,000 plus users and the potential savings, right? this is just an example of a customer that has 20,000 plus users and the potential savings right This is just on average. this is just on average Z-Flex. z-flex We've talked a little bit about that. we've talked a little bit about that You've heard a little bit about it. you've heard a little bit about it Customers have asked for a more flexible way. customers have asked for a more flexible way When you have a platform of consuming the platform, and when you have a platform with multiproducts, there's no way to predict ahead of time exactly how much of which product do I need to go use, right? when you have a platform of consuming the platform and when you have a platform with multiproducts there's no way to predict ahead of time exactly how much of which product do i need to go use right This is a great way to help get them to commit to more spend, right, and adopt the platform at their speed and do it in a very easy consume method. this is a great way to help get them to commit to more spend right and adopt the platform at their speed and do it in a very easy consume method They love it too because it's predictable budget, right? they love it too because it's predictable budget right There's one thing a CIO hates is when they have an unbudgeted event. They don't like that. They don't like to be nickel and dimed. We're just providing an easy way to consume the platform. It also gives a white glove treatment. We're being selective on who we offer this to. It's not just everybody. It's really our top most strategic customers. That's the important part to look at. This is a case study. This is a customer. Won't say exactly who it is, but this was the benefit once we were able to offer Z-Flex. This is the value that came out of it. It's adoption, greater adoption across the platform, and of course, the uptick in spend. Would have been hard to get this value if we didn't have this offering. Okay? That's it. There's one thing a CIO hates is when they have an unbudgeted event. there's one thing a cio hates is when they have an unbudgeted event They don't like that. they don't like that They don't like to be nickel and dimed. they don't like to be nickel and dimed We're just providing an easy way to consume the platform. we're just providing an easy way to consume the platform It also gives a white glove treatment. it also gives a white glove treatment We're being selective on who we offer this to. we're being selective on who we offer this to It's not just everybody. it's not just everybody It's really our top most strategic customers. it's really our top most strategic customers That's the important part to look at. that's the important part to look at This is a case study. this is a case study This is a customer. this is a customer Won't say exactly who it is, but this was the benefit once we were able to offer Z-Flex. won't say exactly who it is but this was the benefit once we were able to offer z-flex This is the value that came out of it. this is the value that came out of it It's adoption, greater adoption across the platform, and of course, the uptick in spend. it's adoption greater adoption across the platform and of course the uptick in spend Would have been hard to get this value if we didn't have this offering. would have been hard to get this value if we didn't have this offering Okay? okay That's it. that's it Did I do a good job for you? Did I do a good job for you? did i do a good job for you Yeah. Was that okay? Yeah. yeah Was that okay? was that okay Yeah. Yeah. yeah Okay. Okay. okay

Speaker 12: I know a lot of you had product questions as well. Adam and Dawn are kindly agreed to stay back. I will invite Adam and Dawn on stage. I know a lot of you had product questions as well. i know a lot of you had product questions as well Adam and Dawn are kindly agreed to stay back. adam and dawn are kindly agreed to stay back I will invite Adam and Dawn on stage. i will invite adam and dawn on stage

Speaker 18: Along with Jay as well, please. Jay? Along with Jay as well, please. along with jay as well please Jay? jay Jay. Jay. jay

Speaker 11: All right. All right. all right First question, Gray Powell. And then Andy. First question, Gray Powell. first question gray powell And then Andy. and then andy

Speaker 12: Do you have product questions? Do you have product questions? do you have product questions

Speaker 10: Yes, you do Z-Flex. Perfect. Yes, you do Z-Flex. yes you do z-flex Perfect. perfect

Speaker 1: All right, great. Thanks. Yeah, so Gray Powell, BTIG. Yeah, just a question on Zero Trust Branch. It seems like customer interest there has picked up a lot just in the last few months. Your messaging seems a lot more aggressive today than maybe six months ago. I'm just kind of curious, what's driving the interest or the uptick that you're seeing today? What's different? On average, if a customer adopts Zero Trust Branch, and I know there's probably a wide range here, but just how much does it impact the contract value? How much does it go up? Even if you can talk ballpark or generic terms, it'd be really helpful. All right, great. all right great Thanks. thanks Yeah, so Gray Powell, BTIG. yeah so gray powell btig Yeah, just a question on Zero Trust Branch. yeah just a question on zero trust branch It seems like customer interest there has picked up a lot just in the last few months. it seems like customer interest there has picked up a lot just in the last few months Your messaging seems a lot more aggressive today than maybe six months ago. your messaging seems a lot more aggressive today than maybe six months ago I'm just kind of curious, what's driving the interest or the uptick that you're seeing today? i'm just kind of curious what's driving the interest or the uptick that you're seeing today What's different? what's different On average, if a customer adopts Zero Trust Branch, and I know there's probably a wide range here, but just how much does it impact the contract value? on average if a customer adopts zero trust branch and i know there's probably a wide range here but just how much does it impact the contract value How much does it go up? how much does it go up Even if you can talk ballpark or generic terms, it'd be really helpful. even if you can talk ballpark or generic terms it'd be really helpful

Speaker 12: On start of the highest level, yeah, we have been evangelizing Zero Trust Branch, the better way of doing it. There is a lot better understanding of it. Our customers understand the value, so there is tons of interest out there. I mean, the interest far exceeded my personal expectations, right? I know all of you analysts look for numbers, okay? I mean, it varies a lot, okay? Some customers are starting with saying, "I got 200 branches. I want to start with 20 branches first or 30 branches," or someone will go with all of them. It varies quite a bit. We see a significant opportunity, simplification, cost reduction as well. On start of the highest level, yeah, we have been evangelizing Zero Trust Branch, the better way of doing it. on start of the highest level yeah we have been evangelizing zero trust branch the better way of doing it There is a lot better understanding of it. there is a lot better understanding of it Our customers understand the value, so there is tons of interest out there. our customers understand the value so there is tons of interest out there I mean, the interest far exceeded my personal expectations, right? i mean the interest far exceeded my personal expectations right I know all of you analysts look for numbers, okay? i know all of you analysts look for numbers okay I mean, it varies a lot, okay? i mean it varies a lot okay Some customers are starting with saying, "I got 200 branches. some customers are starting with saying "i got 200 branches I want to start with 20 branches first or 30 branches," or someone will go with all of them. i want to start with 20 branches first or 30 branches," or someone will go with all of them It varies quite a bit. it varies quite a bit We see a significant opportunity, simplification, cost reduction as well. we see a significant opportunity simplification cost reduction as well

Speaker 18: Yeah. First in the messaging part, right, what's really clicking with customers is they see Zero Trust for users working, deployed everywhere. What they also appreciate is that we are not building three different Zero Trust solutions. The policy framework and how we have built Zero Trust architecture is when customers do user-to-app segmentation with us, the same segmentation framework extends for cloud as well as the branch. When we make acquisitions like AirGap, which is now part of the unified appliance, as I explained, basically the same framework extends. You basically have Zero Trust Everywhere with the same policy framework. What is also resonating, by the way, is for a very long time, you look at Gartners of the world, they were talking about SSE, SASE only for users. We have seen them started calling it Zero Trust Networking, Zero Trust SASE, or Zero Trust SSE. Yeah. yeah First in the messaging part, right, what's really clicking with customers is they see Zero Trust for users working, deployed everywhere. first in the messaging part right what's really clicking with customers is they see zero trust for users working deployed everywhere What they also appreciate is that we are not building three different Zero Trust solutions. what they also appreciate is that we are not building three different zero trust solutions The policy framework and how we have built Zero Trust architecture is when customers do user-to-app segmentation with us, the same segmentation framework extends for cloud as well as the branch. the policy framework and how we have built zero trust architecture is when customers do user-to-app segmentation with us the same segmentation framework extends for cloud as well as the branch When we make acquisitions like AirGap, which is now part of the unified appliance, as I explained, basically the same framework extends. when we make acquisitions like airgap which is now part of the unified appliance as i explained basically the same framework extends You basically have Zero Trust Everywhere with the same policy framework. you basically have zero trust everywhere with the same policy framework What is also resonating, by the way, is for a very long time, you look at Gartners of the world, they were talking about SSE, SASE only for users. what is also resonating by the way is for a very long time you look at gartners of the world they were talking about sse sase only for users We have seen them started calling it Zero Trust Networking, Zero Trust SASE, or Zero Trust SSE. we have seen them started calling it zero trust networking zero trust sase or zero trust sse We are seeing they also picking this up and advising their clients. As Jay mentioned, right, a lot of our existing customers are coming to us and saying, "I want to start by doing this Zero Trust in my factories first." They will do for about a dozen or two dozen factories and then expand it more and more. A lot of our customers have SD-WAN contracts, which are getting up in two years. The new branches, for example, for a banking customer, they are moving that to Zero Trust and not doing SD-WAN anymore. Over a period of time, it will, of course, replace all of that. All right. Let's go to Andy Nowinsky and then come to Keith Bachman. We are seeing they also picking this up and advising their clients. we are seeing they also picking this up and advising their clients As Jay mentioned, right, a lot of our existing customers are coming to us and saying, "I want to start by doing this Zero Trust in my factories first." They will do for about a dozen or two dozen factories and then expand it more and more. as jay mentioned right a lot of our existing customers are coming to us and saying "i want to start by doing this zero trust in my factories first." they will do for about a dozen or two dozen factories and then expand it more and more A lot of our customers have SD-WAN contracts, which are getting up in two years. a lot of our customers have sd-wan contracts which are getting up in two years The new branches, for example, for a banking customer, they are moving that to Zero Trust and not doing SD-WAN anymore. the new branches for example for a banking customer they are moving that to zero trust and not doing sd-wan anymore Over a period of time, it will, of course, replace all of that. over a period of time it will of course replace all of that All right. all right Let's go to Andy Nowinsky and then come to Keith Bachman. let's go to andy nowinsky and then come to keith bachman

Speaker 17: Thanks, Andy Nowinsky, Wells Fargo. There are a lot of vendors that talk about SASE and Zero Trust, but it seems like every vendor has a different architecture. When I think of Zscaler, I think of that one-to-one relationship where you're connecting either one user or one device or one workload to one user and device and workload. That is very different from how a lot of the other firewall vendors think of SASE and Zero Trust. I guess now that you're selling Zero Trust Everywhere, do you think customers actually understand the architectural differences between Zscaler and the other alternatives? I would think it would be harder to sell them on Zero Trust Everywhere if they do not even understand the architectural differences. Maybe your Cost Takeout program would differentiate that as well. Thanks, Andy Nowinsky, Wells Fargo. thanks andy nowinsky wells fargo There are a lot of vendors that talk about SASE and Zero Trust, but it seems like every vendor has a different architecture. there are a lot of vendors that talk about sase and zero trust but it seems like every vendor has a different architecture When I think of Zscaler, I think of that one-to-one relationship where you're connecting either one user or one device or one workload to one user and device and workload. when i think of zscaler i think of that one-to-one relationship where you're connecting either one user or one device or one workload to one user and device and workload That is very different from how a lot of the other firewall vendors think of SASE and Zero Trust. that is very different from how a lot of the other firewall vendors think of sase and zero trust I guess now that you're selling Zero Trust Everywhere, do you think customers actually understand the architectural differences between Zscaler and the other alternatives? i guess now that you're selling zero trust everywhere do you think customers actually understand the architectural differences between zscaler and the other alternatives I would think it would be harder to sell them on Zero Trust Everywhere if they do not even understand the architectural differences. i would think it would be harder to sell them on zero trust everywhere if they do not even understand the architectural differences Maybe your Cost Takeout program would differentiate that as well. maybe your cost takeout program would differentiate that as well

Speaker 12: Right. On start, this is my favorite topic. I talked to Gartner all day long about it. SASE has nothing to do with Zero Trust. Somehow the words got confused. Zero Trust means Zero Trust. Now, you can kind of talk around and say, "I can make Zero Trust by putting firewalls around," because if I put lots of firewalls, so each entity is its own little cell, then it's Zero Trust. Not practical. SASE is a catch-all, so more vendors could participate in it. Okay. SASE says SD-WANs, SSE, and everything. How many networking vendors are there? They're looking for something to grab on to say, "I am part of this thing." SASE means nothing. SASE means everything. It allows every vendor to take some of the reports and say, "Look, I am SASE too. I'm SASE too." Our customers ask for Zero Trust more. Right. right On start, this is my favorite topic. on start this is my favorite topic I talked to Gartner all day long about it. i talked to gartner all day long about it SASE has nothing to do with Zero Trust. sase has nothing to do with zero trust Somehow the words got confused. somehow the words got confused Zero Trust means Zero Trust. zero trust means zero trust Now, you can kind of talk around and say, "I can make Zero Trust by putting firewalls around," because if I put lots of firewalls, so each entity is its own little cell, then it's Zero Trust. now you can kind of talk around and say "i can make zero trust by putting firewalls around," because if i put lots of firewalls so each entity is its own little cell then it's zero trust Not practical. not practical SASE is a catch-all, so more vendors could participate in it. sase is a catch-all so more vendors could participate in it Okay. okay SASE says SD-WANs, SSE, and everything. sase says sd-wans sse and everything How many networking vendors are there? how many networking vendors are there They're looking for something to grab on to say, "I am part of this thing." SASE means nothing. they're looking for something to grab on to say "i am part of this thing." sase means nothing SASE means everything. sase means everything It allows every vendor to take some of the reports and say, "Look, I am SASE too. it allows every vendor to take some of the reports and say "look i am sase too I'm SASE too." Our customers ask for Zero Trust more. i'm sase too." our customers ask for zero trust more Our investors, our analysts ask more for SASE because they got briefed by vendors all day long. Customers often, when they talk to us, they really buy into Zero Trust. That's really what we're trying to do. As you said, Zero Trust is about not trusting people being on the network. It's a one-to-one connection. Look, you saw a bunch of customers at the conference. They all understand. They love it. It used to be that only early adopters loved Zscaler. Now it has gone fairly mainstream. There probably is a small part of late adopters we still need to work on. That's part of the journey. When customers see Zero Trust and they see tangible cost savings, we win the deals. Our investors, our analysts ask more for SASE because they got briefed by vendors all day long. our investors our analysts ask more for sase because they got briefed by vendors all day long Customers often, when they talk to us, they really buy into Zero Trust. customers often when they talk to us they really buy into zero trust That's really what we're trying to do. that's really what we're trying to do As you said, Zero Trust is about not trusting people being on the network. as you said zero trust is about not trusting people being on the network It's a one-to-one connection. it's a one-to-one connection Look, you saw a bunch of customers at the conference. look you saw a bunch of customers at the conference They all understand. they all understand They love it. they love it It used to be that only early adopters loved Zscaler. it used to be that only early adopters loved zscaler Now it has gone fairly mainstream. now it has gone fairly mainstream There probably is a small part of late adopters we still need to work on. there probably is a small part of late adopters we still need to work on That's part of the journey. that's part of the journey When customers see Zero Trust and they see tangible cost savings, we win the deals. when customers see zero trust and they see tangible cost savings we win the deals

Speaker 18: One thing to add to what Jay said, right? Where we are, how we are practically going with the customers on adopting Zero Trust Everywhere is actually work with Mike's team and the technical resources there, like architects and SEs, to do very detailed workshops with customers to figure out how their networks and their security is built. How is point A talking to point B, and what do they use for network security? We basically come up with the underlying architecture for them to go on a roadmap with us. Customers who are already deployed with ZIA, ZPA, they go to the next frontier like branch or cloud. Those who are starting from scratch, they start with users and then start working on deploying. One thing to add to what Jay said, right? one thing to add to what jay said right Where we are, how we are practically going with the customers on adopting Zero Trust Everywhere is actually work with Mike's team and the technical resources there, like architects and SEs, to do very detailed workshops with customers to figure out how their networks and their security is built. where we are how we are practically going with the customers on adopting zero trust everywhere is actually work with mike's team and the technical resources there like architects and ses to do very detailed workshops with customers to figure out how their networks and their security is built How is point A talking to point B, and what do they use for network security? how is point a talking to point b and what do they use for network security We basically come up with the underlying architecture for them to go on a roadmap with us. we basically come up with the underlying architecture for them to go on a roadmap with us Customers who are already deployed with ZIA, ZPA, they go to the next frontier like branch or cloud. customers who are already deployed with zia zpa they go to the next frontier like branch or cloud Those who are starting from scratch, they start with users and then start working on deploying. those who are starting from scratch they start with users and then start working on deploying There's a very detailed technical architecture plus that ties into the Cost Takeout on what we can replace over a period of time. It's a full runbook that we are executing. There's a very detailed technical architecture plus that ties into the Cost Takeout on what we can replace over a period of time. there's a very detailed technical architecture plus that ties into the cost takeout on what we can replace over a period of time It's a full runbook that we are executing. it's a full runbook that we are executing

Speaker 12: You know, if I may give you my futuristic statement, okay? Four years ago, you guys are asking ZIA is good, but who is going to buy ZPA? How many? ZDX, right? I would say every user of a customer, they need ZIA, ZPA, ZDX, all three. Because it made natural sense. We are seeing the world by and large do it. In fact, most of the new deals we sell, they start with Zscaler for Users, all three things together. A lot of upgrades we do on upgrading from ZIA to ZPA or ZDX, combination of that stuff. Our customers enjoy and see the benefit of Zscaler for Users. I do believe that almost all of our customers, it's a matter of time, will embrace Zscaler, our Zero Trust Branch, and Zero Trust Cloud. It's a natural journey. You know, if I may give you my futuristic statement, okay? you know if i may give you my futuristic statement okay Four years ago, you guys are asking ZIA is good, but who is going to buy ZPA? four years ago you guys are asking zia is good but who is going to buy zpa How many? how many ZDX, right? zdx right I would say every user of a customer, they need ZIA, ZPA, ZDX, all three. i would say every user of a customer they need zia zpa zdx all three Because it made natural sense. because it made natural sense We are seeing the world by and large do it. we are seeing the world by and large do it In fact, most of the new deals we sell, they start with Zscaler for Users, all three things together. in fact most of the new deals we sell they start with zscaler for users all three things together A lot of upgrades we do on upgrading from ZIA to ZPA or ZDX, combination of that stuff. a lot of upgrades we do on upgrading from zia to zpa or zdx combination of that stuff Our customers enjoy and see the benefit of Zscaler for Users. our customers enjoy and see the benefit of zscaler for users I do believe that almost all of our customers, it's a matter of time, will embrace Zscaler, our Zero Trust Branch, and Zero Trust Cloud. i do believe that almost all of our customers it's a matter of time will embrace zscaler our zero trust branch and zero trust cloud It's a natural journey. it's a natural journey

Speaker 11: Keith and then Andy. Keith and then Andy. keith and then andy

Speaker 3: Hi. Thank you very much. It's Keith Bachman from Bank of Montreal. I actually had two questions. The first for you is you raised a question that certainly comes up in our discussions with investors. You identified Zscaler as 4,000 enterprise customers, and there's a total TAM of much larger than that. What are those customers using? We as investors think everybody has the necessary architecture to provide some form of protection. Therefore, to win those incremental logos, you have to have a displacement. Help us understand why you think you gain those new logos. Are they using anecdotal architecture? How do you win those new logos? I have a follow-up for Jay, please. You kind of saw on the Cost Takeout slide all the different things that we end up replacing. Hi. hi Thank you very much. thank you very much It's Keith Bachman from Bank of Montreal. it's keith bachman from bank of montreal I actually had two questions. i actually had two questions The first for you is you raised a question that certainly comes up in our discussions with investors. the first for you is you raised a question that certainly comes up in our discussions with investors You identified Zscaler as 4,000 enterprise customers, and there's a total TAM of much larger than that. you identified zscaler as 4,000 enterprise customers and there's a total tam of much larger than that What are those customers using? what are those customers using We as investors think everybody has the necessary architecture to provide some form of protection. we as investors think everybody has the necessary architecture to provide some form of protection Therefore, to win those incremental logos, you have to have a displacement. therefore to win those incremental logos you have to have a displacement Help us understand why you think you gain those new logos. help us understand why you think you gain those new logos Are they using anecdotal architecture? are they using anecdotal architecture How do you win those new logos? how do you win those new logos I have a follow-up for Jay, please. i have a follow-up for jay please You kind of saw on the Cost Takeout slide all the different things that we end up replacing. you kind of saw on the cost takeout slide all the different things that we end up replacing The real question is, are you replacing, or are there actually greenfields in there too? The real question is, are you replacing, or are there actually greenfields in there too? the real question is are you replacing or are there actually greenfields in there too

Speaker 12: There's a little bit of greenfield, right? You are over time supplementing, and you are replacing over time. They are retiring spend on different firewall and VPN products. I would say 80% of it is you're replacing, and 20% is you're just adding new capabilities that they just didn't think about or have before. There's a little bit of greenfield, right? there's a little bit of greenfield right You are over time supplementing, and you are replacing over time. you are over time supplementing and you are replacing over time They are retiring spend on different firewall and VPN products. they are retiring spend on different firewall and vpn products I would say 80% of it is you're replacing, and 20% is you're just adding new capabilities that they just didn't think about or have before. i would say 80% of it is you're replacing and 20% is you're just adding new capabilities that they just didn't think about or have before Maybe expand upon it a little bit. Everyone has something. The big part we replaced early on was proxies, Blue Coat of the world. That was a much smaller market. We did not just replace the Blue Coat proxy. We replaced the whole outbound DMZ, so to speak. For ZPA, most people think, "Oh, it is a VPN replacement." VPN is only a piece of it. It replaced the entire inbound stuff. Some people may have firewalls, some have all this stuff. As Mike said, somebody has something or the other. If they want to do Zero Trust, that is not in place in most places out there. Maybe expand upon it a little bit. maybe expand upon it a little bit Everyone has something. everyone has something The big part we replaced early on was proxies, Blue Coat of the world. the big part we replaced early on was proxies blue coat of the world That was a much smaller market. that was a much smaller market We did not just replace the Blue Coat proxy. we did not just replace the blue coat proxy We replaced the whole outbound DMZ, so to speak. we replaced the whole outbound dmz so to speak For ZPA, most people think, "Oh, it is a VPN replacement." VPN is only a piece of it. for zpa most people think "oh, it is a vpn replacement." vpn is only a piece of it It replaced the entire inbound stuff. it replaced the entire inbound stuff Some people may have firewalls, some have all this stuff. some people may have firewalls some have all this stuff As Mike said, somebody has something or the other. as mike said somebody has something or the other If they want to do Zero Trust, that is not in place in most places out there. if they want to do zero trust, that is not in place in most places out there

Speaker 18: Yeah, just to add to that, they're solving the problem right now. They're solving it inefficiently, and they're recognizing where their gap is. They can choose to solve it by either trying to continue to tune what they have, or some of these who look and realize the approach is ripe for a different way to look at the problem. It becomes a broader discussion, and that's where I think we have the most opportunity when those conversations come up. Yeah, just to add to that, they're solving the problem right now. yeah just to add to that they're solving the problem right now They're solving it inefficiently, and they're recognizing where their gap is. they're solving it inefficiently and they're recognizing where their gap is They can choose to solve it by either trying to continue to tune what they have, or some of these who look and realize the approach is ripe for a different way to look at the problem. they can choose to solve it by either trying to continue to tune what they have or some of these who look and realize the approach is ripe for a different way to look at the problem It becomes a broader discussion, and that's where I think we have the most opportunity when those conversations come up. it becomes a broader discussion and that's where i think we have the most opportunity when those conversations come up

Speaker 3: It is sort of a natural transition to my second question. It feels like the messaging has changed quite a bit from Zscaler appropriately. You are now trying to win the heart of the stock, is the way I see it. You are coming up at it, as Adam and others have said, through a different architecture. It sort of begs the question, what are you missing to keep winning share of that stock dollar? The way I think about it is data is critical. You guys have a lot of untapped data that here for you really have not leveraged as much as perhaps you could. You were clear that inline and data, you guys have it. You got it. You are great at that. It is sort of a natural transition to my second question. it is sort of a natural transition to my second question It feels like the messaging has changed quite a bit from Zscaler appropriately. it feels like the messaging has changed quite a bit from zscaler appropriately You are now trying to win the heart of the stock, is the way I see it. you are now trying to win the heart of the stock is the way i see it You are coming up at it, as Adam and others have said, through a different architecture. you are coming up at it as adam and others have said through a different architecture It sort of begs the question, what are you missing to keep winning share of that stock dollar? it sort of begs the question what are you missing to keep winning share of that stock dollar The way I think about it is data is critical. the way i think about it is data is critical You guys have a lot of untapped data that here for you really have not leveraged as much as perhaps you could. you guys have a lot of untapped data that here for you really have not leveraged as much as perhaps you could You were clear that inline and data, you guys have it. you were clear that inline and data you guys have it You got it. You are great at that. you got it. you are great at that Maybe the broader capabilities of data when you're correlating all these different threat information, NDR is a part of it, but it's not everything. The broader question is, what else do you need? It lends itself to a SIEM, which has sort of been implied. What do you think you're missing to win that greater share of those existing accounts and to leverage the data set that you already have a lot of visibility to? Maybe the broader capabilities of data when you're correlating all these different threat information, NDR is a part of it, but it's not everything. maybe the broader capabilities of data when you're correlating all these different threat information ndr is a part of it but it's not everything The broader question is, what else do you need? the broader question is what else do you need It lends itself to a SIEM, which has sort of been implied. it lends itself to a siem which has sort of been implied What do you think you're missing to win that greater share of those existing accounts and to leverage the data set that you already have a lot of visibility to? what do you think you're missing to win that greater share of those existing accounts and to leverage the data set that you already have a lot of visibility to

Speaker 18: I think as far as what's needed or missing, the approach to running security operations, I think there's a structure for it, right? Data is certainly an element of it. You don't have to create all that data yourself. Certainly, when you do, you have a strong foundation. As I mentioned, the Avalor acquisition was independent of Zscaler. Their 150 connectors had nothing to do with Zscaler before they joined and joined up with us. All of those signals and contexts, that's a recognition that customers' environments are and will continue to be heterogeneous for a really long time. We have no belief that it's going to be all Zscaler only. It's just not the way the world works. It's also not the way security operations works. Having that data come in, I think, is extremely important for us. I think as far as what's needed or missing, the approach to running security operations, I think there's a structure for it, right? i think as far as what's needed or missing the approach to running security operations i think there's a structure for it right Data is certainly an element of it. data is certainly an element of it You don't have to create all that data yourself. you don't have to create all that data yourself Certainly, when you do, you have a strong foundation. certainly when you do you have a strong foundation As I mentioned, the Avalor acquisition was independent of Zscaler. as i mentioned the avalor acquisition was independent of zscaler Their 150 connectors had nothing to do with Zscaler before they joined and joined up with us. their 150 connectors had nothing to do with zscaler before they joined and joined up with us All of those signals and contexts, that's a recognition that customers' environments are and will continue to be heterogeneous for a really long time. all of those signals and contexts that's a recognition that customers' environments are and will continue to be heterogeneous for a really long time We have no belief that it's going to be all Zscaler only. we have no belief that it's going to be all zscaler only It's just not the way the world works. it's just not the way the world works It's also not the way security operations works. it's also not the way security operations works Having that data come in, I think, is extremely important for us. having that data come in i think is extremely important for us When we think about where that world heads, it depends on what happens in the investigation world. There's a huge part that's about automation of the workflows. That was originally, you could say, started with sort of the SOAR and automation technologies. Now it's how AI-driven is it? How agentic is it? I mean, these are phrases to put on it. There's reality behind that. It's still all about if there are 10 steps for an analyst to go through to quickly detect, investigate, and respond to something, how many of those 10 can I automate and intelligently automate before a human being needs to look at it? Because it's not autonomous. The human being is not going to disappear from this. When we think about where that world heads, it depends on what happens in the investigation world. when we think about where that world heads it depends on what happens in the investigation world There's a huge part that's about automation of the workflows. there's a huge part that's about automation of the workflows That was originally, you could say, started with sort of the SOAR and automation technologies. that was originally you could say started with sort of the soar and automation technologies Now it's how AI-driven is it? now it's how ai-driven is it How agentic is it? how agentic is it I mean, these are phrases to put on it. i mean these are phrases to put on it There's reality behind that. there's reality behind that It's still all about if there are 10 steps for an analyst to go through to quickly detect, investigate, and respond to something, how many of those 10 can I automate and intelligently automate before a human being needs to look at it? it's still all about if there are 10 steps for an analyst to go through to quickly detect investigate and respond to something how many of those 10 can i automate and intelligently automate before a human being needs to look at it Because it's not autonomous. because it's not autonomous The human being is not going to disappear from this. the human being is not going to disappear from this It is inserting them at the right spot and recognizing that the data you need to look at because your environment is changing, you need to be able to keep up with that. I think that is going to be a part for us that will be very important. Cloud, we know, is important. A lot of the cloud teams sit very separately from the SOC teams. Try as you might, the SOC person wants to see all of it. The person who runs the cloud says, "I got that. Do not worry about it." We know we will have to live in these hybrid worlds probably for a very long time based on the way our customers are structured. It is inserting them at the right spot and recognizing that the data you need to look at because your environment is changing, you need to be able to keep up with that. it is inserting them at the right spot and recognizing that the data you need to look at because your environment is changing you need to be able to keep up with that I think that is going to be a part for us that will be very important. i think that is going to be a part for us that will be very important Cloud, we know, is important. cloud we know is important A lot of the cloud teams sit very separately from the SOC teams. a lot of the cloud teams sit very separately from the soc teams Try as you might, the SOC person wants to see all of it. try as you might the soc person wants to see all of it The person who runs the cloud says, "I got that. Do not worry about it." We know we will have to live in these hybrid worlds probably for a very long time based on the way our customers are structured. the person who runs the cloud says "i got that. do not worry about it." we know we will have to live in these hybrid worlds probably for a very long time based on the way our customers are structured

Speaker 12: From a business opportunity point of view, there's real pain. People feel less pain. A firewall is sitting there. Let it sit there. Some management overhead is there. SOC is a daily pain. There's a pain of work. There's a pain of dollars growing. We think the market is ready for disruption. If we can go and have a better solution, less operational overhead, and less cost of the solution because of better architecture, we think our customers are looking forward to it. We have tremendous credibility with our customers. From a business opportunity point of view, there's real pain. from a business opportunity point of view there's real pain People feel less pain. people feel less pain A firewall is sitting there. a firewall is sitting there Let it sit there. let it sit there Some management overhead is there. some management overhead is there SOC is a daily pain. soc is a daily pain There's a pain of work. there's a pain of work There's a pain of dollars growing. there's a pain of dollars growing We think the market is ready for disruption. we think the market is ready for disruption If we can go and have a better solution, less operational overhead, and less cost of the solution because of better architecture, we think our customers are looking forward to it. if we can go and have a better solution less operational overhead and less cost of the solution because of better architecture we think our customers are looking forward to it We have tremendous credibility with our customers. we have tremendous credibility with our customers

Speaker 11: All right. Let's go to Andrew, and then we'll take an online question. All right. all right Let's go to Andrew, and then we'll take an online question. let's go to andrew and then we'll take an online question

Speaker 4: Thanks. Andrew DeGasperi from BNP Paribas. The one question I had is this morning, Jay, you joked about the $30 million cost savings slide, and you said that maybe Warren Sales was not charging this customer enough. I waited for Mike Rich to join the panel because I just wanted to maybe ask a follow-up in terms of, are you happy with your pricing and packaging strategy? How is it evolving now that you are adding all these other capabilities on the Agentic Side? Just take it from there. Thanks. thanks Andrew De Gasperi from BNP Paribas. andrew de gasperi from bnp paribas The one question I had is this morning, Jay, you joked about the $30 million cost savings slide, and you said that maybe Warren Sales was not charging this customer enough. the one question i had is this morning jay you joked about the $30 million cost savings slide and you said that maybe warren sales was not charging this customer enough I waited for Mike Rich to join the panel because I just wanted to maybe ask a follow-up in terms of, are you happy with your pricing and packaging strategy? i waited for mike rich to join the panel because i just wanted to maybe ask a follow-up in terms of are you happy with your pricing and packaging strategy How is it evolving now that you are adding all these other capabilities on the Agentic Side? how is it evolving now that you are adding all these other capabilities on the agentic side Just take it from there. just take it from there

Speaker 12: I think we've made great strides. Z-Flex is just another point in the journey where you've got to make it easy to consume. I think historically, we've come out with a lot of innovation, and it's gotten complex. The licensing metrics and models have not been super easy to understand. You've seen it. Gartner's talked about it. We are just making it easier for them to consume the platform. I am very happy with where we're at today. I think we're going to continue to get better. I think we've made great strides. i think we've made great strides Z-Flex is just another point in the journey where you've got to make it easy to consume. z-flex is just another point in the journey where you've got to make it easy to consume I think historically, we've come out with a lot of innovation, and it's gotten complex. i think historically we've come out with a lot of innovation and it's gotten complex The licensing metrics and models have not been super easy to understand. the licensing metrics and models have not been super easy to understand You've seen it. you've seen it Gartner's talked about it. gartner's talked about it We are just making it easier for them to consume the platform. we are just making it easier for them to consume the platform I am very happy with where we're at today. i am very happy with where we're at today I think we're going to continue to get better. i think we're going to continue to get better

Speaker 18: Yeah. We've done three things in this area. One, we developed an architectural workshop to identify what needs to be taken out. Last year, we started a Cost Takeout program that helps quantify the outcome of that, is the slide I showed to you. Z-Flex comes on top of that to really make it flexible, minimize friction with procurement and ongoing negotiations. It's a good story. None of these things happens by magic. We learn, we evolve. Architectural works are important for us. Cost takeout program evolved out a lot of learning over the years. Z-Flex, we used to do some of these things custom. You say, "Let's make a program out of it. Yeah. yeah We've done three things in this area. we've done three things in this area One, we developed an architectural workshop to identify what needs to be taken out. one we developed an architectural workshop to identify what needs to be taken out Last year, we started a Cost Takeout program that helps quantify the outcome of that, is the slide I showed to you. last year we started a cost takeout program that helps quantify the outcome of that is the slide i showed to you Z-Flex comes on top of that to really make it flexible, minimize friction with procurement and ongoing negotiations. z-flex comes on top of that to really make it flexible minimize friction with procurement and ongoing negotiations It's a good story. it's a good story None of these things happens by magic. none of these things happens by magic We learn, we evolve. we learn we evolve Architectural works are important for us. architectural works are important for us Cost takeout program evolved out a lot of learning over the years. cost takeout program evolved out a lot of learning over the years Z-Flex, we used to do some of these things custom. z-flex we used to do some of these things custom You say, "Let's make a program out of it. you say "let's make a program out of it

Speaker 11: All right. We got one question from online, and then we'll go to Ittai. This is from Brian Essex, JP Morgan. Question for Mike. Are there any common themes across the accounts where you might expect to see better traction with Zero Trust platform? Is there any kind of inflection opportunity here? All right. all right We got one question from online, and then we'll go to Ittai. we got one question from online and then we'll go to ittai This is from Brian Essex, JP Morgan. this is from brian essex jp morgan Question for Mike. question for mike Are there any common themes across the accounts where you might expect to see better traction with Zero Trust platform? are there any common themes across the accounts where you might expect to see better traction with zero trust platform Is there any kind of inflection opportunity here? is there any kind of inflection opportunity here

Speaker 8: Yeah. I mean, the common theme is just complexity. People are looking to reduce cost and have a more simplified environment. They want happy users. They do not want to get yelled at. When you can simplify and make it less complex and provide a better user experience, those are synergistic, and those help drive the sales, especially in the bigger deals. Yeah. yeah I mean, the common theme is just complexity. i mean the common theme is just complexity People are looking to reduce cost and have a more simplified environment. people are looking to reduce cost and have a more simplified environment They want happy users. they want happy users They do not want to get yelled at. they do not want to get yelled at When you can simplify and make it less complex and provide a better user experience, those are synergistic, and those help drive the sales, especially in the bigger deals. when you can simplify and make it less complex and provide a better user experience those are synergistic and those help drive the sales especially in the bigger deals

Speaker 11: All right. Thank you. Ittai. All right. all right Thank you. thank you Ittai. ittai

Speaker 14: Thanks, Ittai from Oppenheimer. Question for you, Mike. When I think about Z-Flex, maybe we shouldn't be called Z-Flex. Maybe we should call ZSemiFlex because it's not fully flexible. When I think of some other vendors in the world that have applied a Flex-like type of purchasing model, think about Datadog in the way they've done it. Think about what CrowdStrike is doing with their very few restrictions at all in the way you first buy the product. From my understanding, Z-Flex, you need to be on a product for a certain while before you can change things in and out. You just said on stage that it's focused on the largest customers. It is still a little bit, well, semi-flex, as I mentioned before, on a certain type of customers with some flexibility, but not full. Thanks, Ittai from Oppenheimer. thanks ittai from oppenheimer Question for you, Mike. question for you mike When I think about Z-Flex, maybe we shouldn't be called Z-Flex. when i think about z-flex maybe we shouldn't be called z-flex Maybe we should call ZSemiFlex because it's not fully flexible. maybe we should call zsemiflex because it's not fully flexible When I think of some other vendors in the world that have applied a Flex-like type of purchasing model, think about Datadog in the way they've done it. when i think of some other vendors in the world that have applied a flex-like type of purchasing model think about datadog in the way they've done it Think about what CrowdStrike is doing with their very few restrictions at all in the way you first buy the product. think about what crowdstrike is doing with their very few restrictions at all in the way you first buy the product From my understanding, Z-Flex, you need to be on a product for a certain while before you can change things in and out. from my understanding z-flex you need to be on a product for a certain while before you can change things in and out You just said on stage that it's focused on the largest customers. you just said on stage that it's focused on the largest customers It is still a little bit, well, semi-flex, as I mentioned before, on a certain type of customers with some flexibility, but not full. it is still a little bit well semi-flex as i mentioned before on a certain type of customers with some flexibility but not full I guess, is this just a reflection of a point in time? Meaning, you and I talk about this a year from now, everybody can access it with complete flexibility. One day to the next, I can increase, decrease my consumption of certain products. Why limit this? Is this just maturity, or there's something behind this? I guess, is this just a reflection of a point in time? i guess is this just a reflection of a point in time Meaning, you and I talk about this a year from now, everybody can access it with complete flexibility. meaning you and i talk about this a year from now everybody can access it with complete flexibility One day to the next, I can increase, decrease my consumption of certain products. one day to the next i can increase decrease my consumption of certain products Why limit this? why limit this Is this just maturity, or there's something behind this? is this just maturity or there's something behind this

Speaker 8: You've got to have all your systems. You've got to have sales ops lined up. You've got to have your processes behind lined up. It's a crawl, walk, run. I do expect, again, we're early stage. It just came out in Q3, that it will mature and we'll be able to offer it to a broader set of audience when we can make it easier to deploy. Again, early stage, fully expect we're going to have a big part of the population that'll move toward it later on. Let's get it really right for these first few customers. You've got to have all your systems. you've got to have all your systems You've got to have sales ops lined up. you've got to have sales ops lined up You've got to have your processes behind lined up. you've got to have your processes behind lined up It's a crawl, walk, run. it's a crawl walk run I do expect, again, we're early stage. i do expect again we're early stage It just came out in Q3, that it will mature and we'll be able to offer it to a broader set of audience when we can make it easier to deploy. it just came out in q3 that it will mature and we'll be able to offer it to a broader set of audience when we can make it easier to deploy Again, early stage, fully expect we're going to have a big part of the population that'll move toward it later on. again early stage fully expect we're going to have a big part of the population that'll move toward it later on Let's get it really right for these first few customers. let's get it really right for these first few customers

Speaker 14: Do you envision this potentially at some point with partners using Flex to be able to go more down market, which I know right here, right now, you're clearly trying to go after the big whales for obvious reasons, but something to facilitate a much better or faster adoption for our partners to go downstream, down market? Do you envision this potentially at some point with partners using Flex to be able to go more down market, which I know right here, right now, you're clearly trying to go after the big whales for obvious reasons, but something to facilitate a much better or faster adoption for our partners to go downstream, down market? do you envision this potentially at some point with partners using flex to be able to go more down market which i know right here right now you're clearly trying to go after the big whales for obvious reasons but something to facilitate a much better or faster adoption for our partners to go downstream down market

Speaker 8: I don't think it'll be everywhere. I think we'll have, again, probably the top 25%º–30% of customers that we'll get to have that option to move towards Z-Flex in the next year, year and a half. I don't think it'll be everywhere. i don't think it'll be everywhere I think we'll have, again, probably the top 25%º–30% of customers that we'll get to have that option to move towards Z-Flex in the next year, year and a half. i think we'll have again probably the top 25%º–30% of customers that we'll get to have that option to move towards z-flex in the next year year and a half

Speaker 14: Let me ask you, do you think your CFO will love fully Z-Flex, no string, no time frames attached? Let me ask you, do you think your CFO will love fully Z-Flex, no string, no time frames attached? let me ask you do you think your cfo will love fully z-flex no string no time frames attached

Speaker 8: Maybe it will, maybe it won't. I know that it's a very, when I talk to customers of Datadog and when I talk to customers of CrowdStrike, it's a point that perhaps they don't necessarily actually do. It's not that every day they increase or decrease their product. The idea to have that flexibility and the idea that that type of flexibility enables them to make sure that they don't waste dollars, that they truly get to conceptually have the ability to try everything at their portfolio at whatever pace they want, and ultimately, at the end of this, come up with a balanced approach for them, I think it's a good selling point. Maybe it will, maybe it won't. maybe it will maybe it won't I know that it's a very, when I talk to customers of Datadog and when I talk to customers of CrowdStrike, it's a point that perhaps they don't necessarily actually do. i know that it's a very when i talk to customers of datadog and when i talk to customers of crowdstrike it's a point that perhaps they don't necessarily actually do It's not that every day they increase or decrease their product. it's not that every day they increase or decrease their product The idea to have that flexibility and the idea that that type of flexibility enables them to make sure that they don't waste dollars, that they truly get to conceptually have the ability to try everything at their portfolio at whatever pace they want, and ultimately, at the end of this, come up with a balanced approach for them, I think it's a good selling point. the idea to have that flexibility and the idea that that type of flexibility enables them to make sure that they don't waste dollars that they truly get to conceptually have the ability to try everything at their portfolio at whatever pace they want and ultimately at the end of this come up with a balanced approach for them i think it's a good selling point

Speaker 12: We like flexibility. The best selling point is the customer has no commitment, no skin in the game, other than $10 million you can spend after five years. That'll be any CFO's nightmare. Think about trying to predict numbers and what's going to happen next quarter or next quarter. It's a nightmare. We can give full flexibility for testing the product. The real sales is you've got skin in the game. We've got skin in the game. You can predict some of the stuff. We can predict some of the stuff. Those are the pragmatic philosophy that have gone into what we are doing today. Obviously, we learn and we evolve. We like flexibility. we like flexibility The best selling point is the customer has no commitment, no skin in the game, other than $10 million you can spend after five years. the best selling point is the customer has no commitment no skin in the game other than $10 million you can spend after five years That'll be any CFO's nightmare. that'll be any cfo's nightmare Think about trying to predict numbers and what's going to happen next quarter or next quarter. think about trying to predict numbers and what's going to happen next quarter or next quarter It's a nightmare. it's a nightmare We can give full flexibility for testing the product. we can give full flexibility for testing the product The real sales is you've got skin in the game. the real sales is you've got skin in the game We've got skin in the game. we've got skin in the game You can predict some of the stuff. you can predict some of the stuff We can predict some of the stuff. we can predict some of the stuff Those are the pragmatic philosophy that have gone into what we are doing today. those are the pragmatic philosophy that have gone into what we are doing today Obviously, we learn and we evolve. obviously we learn and we evolve

Speaker 11: Very good. Thank you. There's a topic we can spend a lot of time on. Let's move on. Very good. very good Thank you. thank you There's a topic we can spend a lot of time on. there's a topic we can spend a lot of time on Let's move on. let's move on

Speaker 7: This is Joe Vandrick from Scotiabank. Mike, a lot of good details on the large opportunity ahead for both new logos and increasing customer spend that you called out there. How are you feeling today about sales productivity, and how are you thinking about adding capacity into fiscal 2026? This is Joe Vandrick from Scotiabank. this is joe vandrick from scotiabank Mike, a lot of good details on the large opportunity ahead for both new logos and increasing customer spend that you called out there. mike a lot of good details on the large opportunity ahead for both new logos and increasing customer spend that you called out there How are you feeling today about sales productivity, and how are you thinking about adding capacity into fiscal 2026? how are you feeling today about sales productivity and how are you thinking about adding capacity into fiscal 2026

Speaker 8: Sales productivity, productivity per head, I'm very pleased with. It's gone up year over year. We expect it to continue to do that. We're adding capacity based on our model of making sure that we can address the right markets with the right number of people. We're being very thoughtful about how we're doing it. Because productivity is going up, that's great. We're also entering the year with more mature ramp sellers. That's a very good sign. I'm very pleased with that. Sales productivity, productivity per head, I'm very pleased with. sales productivity productivity per head i'm very pleased with It's gone up year over year. it's gone up year over year We expect it to continue to do that. we expect it to continue to do that We're adding capacity based on our model of making sure that we can address the right markets with the right number of people. we're adding capacity based on our model of making sure that we can address the right markets with the right number of people We're being very thoughtful about how we're doing it. we're being very thoughtful about how we're doing it Because productivity is going up, that's great. because productivity is going up that's great We're also entering the year with more mature ramp sellers. we're also entering the year with more mature ramp sellers That's a very good sign. that's a very good sign I'm very pleased with that. i'm very pleased with that

Speaker 11: All right. Max. All right. all right Max. max This is Matt from Goldman Sachs. I was wondering, it seems that there's been a rise in interest in software and SaaS architectures, especially for regulated industries and international markets. Are you thinking about enabling localized independent instances of your platform and increases that potentially expand your addressable market? This is Matt from Goldman Sachs. this is matt from goldman sachs I was wondering, it seems that there's been a rise in interest in software and SaaS architectures, especially for regulated industries and international markets. i was wondering it seems that there's been a rise in interest in software and saas architectures especially for regulated industries and international markets Are you thinking about enabling localized independent instances of your platform and increases that potentially expand your addressable market? are you thinking about enabling localized independent instances of your platform and increases that potentially expand your addressable market

Speaker 12: I'll take it. Yeah. There's a lot of interest in sovereign Zero Trust Cloud, not sovereign SaaS, for example. The customers I talk to, they're looking for Zero Trust. Our architecture is designed such that we can do it today. We have the entire technology, all three planes, sitting in Europe, serving Europe. We meet essentially almost all the technological requirements. Now, we still need to do some of the work being operationally able to run out of Europe and the like. We're making progress in that direction. We think we are in a very good position to offer sovereign clouds. Sovereign will have different flavors, the EU part of it. When the Department of Defense of Australia wants a sovereign cloud, they would rather call it air-gapped cloud. We have built the technology that can provide air-gapped cloud to different countries as well. I'll take it. i'll take it Yeah. yeah There's a lot of interest in sovereign Zero Trust Cloud, not sovereign SaaS, for example. there's a lot of interest in sovereign zero trust cloud not sovereign saas for example The customers I talk to, they're looking for Zero Trust. the customers i talk to they're looking for zero trust Our architecture is designed such that we can do it today. our architecture is designed such that we can do it today We have the entire technology, all three planes, sitting in Europe, serving Europe. we have the entire technology all three planes sitting in europe serving europe We meet essentially almost all the technological requirements. we meet essentially almost all the technological requirements Now, we still need to do some of the work being operationally able to run out of Europe and the like. now we still need to do some of the work being operationally able to run out of europe and the like We're making progress in that direction. we're making progress in that direction We think we are in a very good position to offer sovereign clouds. we think we are in a very good position to offer sovereign clouds Sovereign will have different flavors, the EU part of it. sovereign will have different flavors the eu part of it When the Department of Defense of Australia wants a sovereign cloud, they would rather call it air-gapped cloud. when the department of defense of australia wants a sovereign cloud they would rather call it air-gapped cloud We have built the technology that can provide air-gapped cloud to different countries as well. we have built the technology that can provide air-gapped cloud to different countries as well

Speaker 11: All right. We'll take the last question from online coming from Joshua Tilton, Wolf Research. I believe this is best for Jay. In the past, the strategy has clearly been to show customers how to replace a stack of legacy boxes. I don't believe there are any legacy boxes securing agents. How does go-to-market message need to change to convince customers that Zscaler has the right way to secure AI agents, maybe for Jay and Mike both? All right. all right We'll take the last question from online coming from Joshua Tilton, Wolf Research. we'll take the last question from online coming from joshua tilton wolf research I believe this is best for Jay. i believe this is best for jay In the past, the strategy has clearly been to show customers how to replace a stack of legacy boxes. in the past the strategy has clearly been to show customers how to replace a stack of legacy boxes I don't believe there are any legacy boxes securing agents. i don't believe there are any legacy boxes securing agents How does go-to-market message need to change to convince customers that Zscaler has the right way to secure AI agents, maybe for Jay and Mike both? how does go-to-market message need to change to convince customers that zscaler has the right way to secure ai agents maybe for jay and mike both

Speaker 12: If you saw the diagram I showed to you, Zscaler is securing users to have right access to the right application. Number one use case of AI agents is your agent is able to do the same kind of stuff that your people did. I know many call center customers who are using call center agents. There will be other agents like that. That is no different than what we do. We are securing users, similar technology with some of the additions, secures agents as well. Identity of the agent becomes one piece of it. There are some other things related to if agents are reaching out to LLMs and some of the other apps. We have some enhancement being made. We are more natural than anybody else to solve this. If you saw the diagram I showed to you, Zscaler is securing users to have right access to the right application. if you saw the diagram i showed to you zscaler is securing users to have right access to the right application Number one use case of AI agents is your agent is able to do the same kind of stuff that your people did. number one use case of ai agents is your agent is able to do the same kind of stuff that your people did I know many call center customers who are using call center agents. There will be other agents like that. That is no different than what we do. i know many call center customers who are using call center agents. there will be other agents like that. that is no different than what we do We are securing users, similar technology with some of the additions, secures agents as well. we are securing users similar technology with some of the additions secures agents as well Identity of the agent becomes one piece of it. identity of the agent becomes one piece of it There are some other things related to if agents are reaching out to LLMs and some of the other apps. there are some other things related to if agents are reaching out to llms and some of the other apps We have some enhancement being made. we have some enhancement being made We are more natural than anybody else to solve this. we are more natural than anybody else to solve this

Speaker 11: All right. That concludes our session. Thank you so much, analysts, investors, everybody who dialed in, and everybody who is in the room here, as well as our executives. Thank you so much for participating in the event. Thank you. All right. all right That concludes our session. that concludes our session Thank you so much, analysts, investors, everybody who dialed in, and everybody who is in the room here, as well as our executives. thank you so much analysts investors everybody who dialed in and everybody who is in the room here as well as our executives Thank you so much for participating in the event. thank you so much for participating in the event thank you Thank you. thank you