If you follow AI cybersecurity, you'll notice something very strange about Zscaler

If you follow AI cybersecurity, you'll find that Zscaler has one very strange setup: the earnings report was strong, revenue grew 25%, ARR grew 25%, operating margin hit an all-time high, yet the stock was still sold off by the market.

This is not a normal post-earnings move. It is Wall Street judging a much bigger question: in the AI era, cybersecurity—is it truly a must-have, or just another overhyped software story?

If you only look at the stock price, you might think Zscaler is in trouble.

But if you look deeper, the real issue may not be Zscaler at all. It may be that the rules of enterprise security are being rewritten by AI.

In the past, companies defended themselves against hackers by defending against people.

Now they have to defend against AI that can write code, find vulnerabilities, fake identities, and even enter systems on its own to complete tasks.

Even scarier, companies will soon have not only employee accounts, but also AI Agent accounts. These agents will access customer data, call internal systems, read databases, send emails, and even trigger business workflows.

So the real questions are:

• Who decides what these AI agents can and cannot see?

• Who stops them from overstepping access rights?

• Who prevents employees from dumping confidential data into external models?

• And who protects the last line of defense when AI helps hackers scan vulnerabilities at machine speed?

That is why this Zscaler episode is worth watching.

By the end, you should understand at least three things:

1. First, why Zscaler’s strong earnings still led to a selloff, and what the market is really worried about.

2. Second, why zero trust, AI Red Teaming, and Agentic SecOps could become the hardest-hitting new themes in AI software stocks.

3. Third, whether Zscaler is just a slowing software name—or a core AI security player unfairly punished by short-term sentiment.

If you still think AI security is just a small niche inside cybersecurity, you may be missing one of the most dangerous—and most profitable—subthemes in the next AI software wave.

The stronger AI gets, the more enterprises refuse to run naked.

And whoever can guard the entry point into enterprise systems may become the next real toll booth of the security industry. Before we start, please like and subscribe, and let's dive straight into today's focus.

Let's start with the earnings itself.

On the surface, Zscaler's Q3 report looked very strong.

Revenue grew 25% YoY.

ARR grew 25% YoY.

Non-GAAP operating margin reached 23%, an all-time high.

What does that tell us?

It tells us Zscaler is no longer just a money-burning software story. It has entered a more mature phase: revenue is still growing, margins are improving, customer demand has not disappeared, and the zero-trust thesis is still intact.

But the U.S. market is never a gentle teacher.

It won't reward you just because you scored 90.

If the market expected 95, or even 98 next time, then a 90 is still enough to get hit.

That is the cruelty of high-valuation growth stocks.

The mistake is not necessarily in the present—it is in a future that is not exciting enough.

Zscaler got sold off not because the business collapsed, but because the market has doubts about the future.

Q4 guidance was not dazzling enough, sales-team changes made investors nervous about execution, and software stocks as a group are in a very sensitive phase. Once future growth shows even a little uncertainty, capital runs first and asks questions later.

That is the current software-stock market.

You can't just be good; you have to be better.

You can't just grow; you have to prove growth can continue.

You can't just say AI will create opportunity; you must prove AI will turn into orders, revenue, profit, and free cash flow.

So the real question the market is asking Zscaler is: when does your AI security story become real money?

But from another angle, this divergence is actually interesting.

If a company's earnings are already bad and the stock falls, there's not much to discuss.

But if the operating data is still solid, the long-term logic is strengthening, and the stock is still hit by short-term expectations, that is where market disagreement appears.

And true investment opportunities are often hidden in disagreement.

Next we need to see whether Zscaler's long-term logic has changed.

The answer is no—it may actually be becoming more important.

Why?

Because the AI era is reshaping cybersecurity.

In the past, enterprise security was like defending a city.

Inside the company was the city, outside was beyond the walls. Firewalls were the walls, VPNs were the gates. As long as you held the boundary, you felt safe.

But the world has changed.

Cloud apps, SaaS, remote work, APIs, third-party plugins, and external model calls have punched holes through the walls.

Company data is no longer only on internal servers, employees are no longer only in the office, and applications are no longer only running on internal networks.

The perimeter is gone.

And once AI agents appear, the problem becomes even more complex.

An AI agent is not a normal tool.

It may log in automatically, call customer data, generate reports, modify code, send emails, create tickets, and even trigger workflows.

That sounds great, right?

But from a security perspective, it is terrifying.

Because an AI agent that can execute tasks is, in essence, a digital employee that never sleeps.

• It needs permissions.

• It needs access to data.

• It needs to call applications.

• It needs to connect different systems.

If access control is weak, data boundaries are unclear, the model is derailed by prompt attacks, or the AI agent is abused by hackers, it can turn from a productivity tool into an internal security hole.

That is why zero trust becomes a must-have again in the AI era.

Zero trust is simple at its core.

Never trust any person, any device, any app, or any connection by default.

• Every access must be verified.

• Every data flow must be inspected.

• Every user, every device, every application, and every AI agent must run with least privilege.

That sounds cumbersome, but that is exactly where large enterprises are willing to spend money.

Because what companies fear most is not inconvenience—it is losing control.

In the past, hackers had to find a door. Now AI can help them scan every window in the building.

In the past, companies worried about stolen employee accounts. Now they also have to worry about AI agents being manipulated into overstepping access rights.

In the past, data leaks were often caused by employee mistakes. Now a leak may come from an automated agent sending information out in milliseconds.

So if your company is still using old VPNs and old firewall thinking, that's like using a wooden door to stop a tank in the AI era.

That is where Zscaler's value lies.

Its job is not just to sell a security product, but to integrate enterprise access control, application connectivity, data protection, zero-trust architecture, and AI security capabilities.

That is also why its partnerships with OpenAI and Anthropic are worth watching.

Zscaler's work with OpenAI is not just “we also integrated AI.”

It focuses on using advanced model capabilities for secure development workflows, vulnerability detection, AI Red Teaming, and Agentic SecOps.

In plain English, that means letting AI help security teams find code flaws faster, identify risk faster, test system weaknesses faster, and handle incidents faster.

That is important.

Because the security industry may soon enter a new phase.

Not human vs. human.

But human plus AI versus human plus AI.

Cybersecurity used to feel like two chess players facing off.

Now both sides may be playing with supercomputers.

Attackers can use AI to find vulnerabilities, write malware, forge emails, fake identities, and test attack paths quickly.

If defenders still rely on manual review, manual patching, and slow response, they will keep getting outpaced.

So security vendors must use AI too.

Zscaler's participation in Anthropic's Project Glasswing means something similar.

If models like Claude can find software flaws faster and understand code risk faster, that is obviously good for defenders.

But it also means vulnerability discovery will get much faster in the future.

Security problems in software may be magnified by AI.

In the past, a vulnerability might take a researcher days or weeks to uncover.

In the future, AI may dramatically speed that up.

That is both opportunity and fear for enterprises.

The opportunity is faster remediation.

The fear is that attackers may exploit issues faster too.

So long-term demand for AI security is not a marketing invention—it is a natural outcome of technological change.

The stronger AI gets, the stronger the attack.

The stronger the attack, the less defense spending can be cut.

That is the hardest part of Zscaler's long-term story.

So where exactly is Zscaler's opportunity?

I think it can be split into four layers.

1. First layer: replacing traditional VPNs and firewalls.
   This has always been Zscaler's core logic.
   As enterprises become more cloud-based, employees more distributed, and applications more fragmented, traditional perimeter security is under increasing pressure. The shift to zero trust is not over.

2. Second layer: securing enterprise use of generative AI.
   Employees may now use ChatGPT, Claude, Copilot, or various internal AI tools.
   What do enterprises fear most?
   That employees paste in customer lists.
   That financial data gets pasted in.
   That source code gets pasted in.
   That trade secrets get sucked into external models.
   So companies need to know who is using AI, which AI they used, what data was sent, and whether there is leakage risk.
   That is the demand for AI access security and data protection.

3. Third layer: securing AI agents.
   This is the bigger future story.
   Once AI agents are no longer just chatting but start accessing systems, calling APIs, reading data, and executing workflows, enterprises must assign identity, permissions, boundaries, and audit trails.
   Whoever can control AI agent behavior may capture new security budgets.

4. Fourth layer: AI Red Teaming and automated security operations.
   Companies must not only defend against outside attacks, but also proactively test whether their own AI systems have weaknesses.
   Can the model be prompt-attacked?
   Can the AI agent overreach?
   Can internal data be called incorrectly?
   Does the application code hide defects?
   Can the security team use AI to fix issues faster?

If Zscaler can combine these capabilities, it is no longer just a traditional cybersecurity company—it could become the enterprise AI security gateway.

That is the most imaginative part of the story.

In the future, enterprises will not ask, “Should I use AI?”

That question is already settled.

The real question is: how do I use AI safely?

Whoever can answer that may win the next budget cycle.

But having said that, we must also be clear about the risks.

Zscaler is not risk-free, and the market's selloff was not entirely unreasonable.

1. First risk: short-term guidance.
   High-valuation software stocks hate downward revisions to growth expectations. Once the market thinks future revenue growth may step down, the stock often gets hit hard.

2. Second risk: sales-team changes.
   Cybersecurity software growth depends heavily on sales execution, large-account expansion, cross-sell, and renewals. If the sales organization is disrupted, the market becomes very sensitive.

3. Third risk: intense competition.
   Zscaler is not fighting alone.
   Palo Alto Networks, CrowdStrike, Okta, Cloudflare, Microsoft, and Wiz are all competing for enterprise security budgets.
   Every company talks about AI security. Every company wants to be a platform.
   But customer budgets are limited, and only those that can prove real impact will win more share.

4. Fourth risk: the AI security story still needs revenue conversion.
   AI Red Teaming, Agentic SecOps, and AI Access Security sound impressive, but the market ultimately wants to see customers paying, contracts getting bigger, renewal rates improving, and revenue contribution showing up.
   If it's just a hot concept and there is no real conversion in the financials, valuation expansion will be hard to sustain.

5. Fifth risk: valuation and rates.
   Software stocks are very sensitive to interest rates and risk appetite.
   Even a great company can get compressed if the valuation is too rich and the macro backdrop changes.

So Zscaler's problem is not that it has no story—it is that the story is so big the market is now asking when it turns into money.

That is my core view on the name.

Zscaler is not a stock to buy blindly.

But it is absolutely a key name to keep on an AI security watchlist.

How does it compare with other AI security stocks?

We can break it down simply.

• Zscaler's keywords are zero trust, SASE, cloud access, data security, and AI access control.

• CrowdStrike's keywords are endpoint security, threat detection, cloud security, and AI security operations.

• Okta's keywords are identity management, AI agent identity, and access permissions.

• Palo Alto Networks's keywords are platform security, firewalls, cloud security, and security operations.

• Cloudflare's keywords are network edge, application security, Zero Trust, and developer/edge networking.

So you cannot lump all security stocks together.

AI security will benefit the whole sector, but each company captures a different budget pool.

• If a company worries about AI agents overstepping access, Okta's logic is more direct.

• If it worries about endpoint threats and attack detection, CrowdStrike is more direct.

• If it worries about cloud access, data flow, VPN replacement, and zero trust, Zscaler is more direct.

• If it wants a broad, platform-style security stack, Palo Alto has the edge.

That is why cybersecurity stocks will keep diverging.

Not all security stocks are the same.

What matters is where each company sits in the enterprise AI security stack.

What should ordinary investors watch next?

I think Zscaler has several key indicators to watch.

1. First, can ARR growth stay at a high level?
   That will show whether long-term contracts and subscription demand remain strong.

2. Second, can large-customer growth and million-dollar customer growth continue?
   The most valuable security software customers are large enterprises, especially multinational companies and major institutions.

3. Third, can non-GAAP operating margin and free cash flow keep improving?
   That means the company is moving away from burn-and-grow and toward a more mature business model.

4. Fourth, can new products like AI Security, AI Red Teaming, and Agentic SecOps start producing clear revenue contribution?
   That decides whether the AI story stays in press releases.

5. Fifth, can sales-execution problems be fixed?
   If the sales-team adjustment keeps hurting execution, the stock may stay under pressure in the short term.

6. Sixth, can next fiscal year's guidance win back market confidence?
   Growth stocks are ultimately about the future, not the past.

The real opportunity is not how much the stock fell, and not how good the headline earnings were.

The real opportunity is that if the market sold it off on short-term guidance, but long-term AI security demand keeps rising, then that divergence may become an investment opportunity.

Let's go back to the original question.

Is this Zscaler move a risk signal, or an opportunity window?

My answer is: both.

In the short term, it clearly exposed problems with growth expectations, sales execution, and high market expectations.

In the long term, it sits right at the intersection of zero trust and AI security, and that position matters a lot.

In the AI era, security is not a side character—it is the passport.

If enterprises want to use AI, they must solve access control, data protection, identity management, model security, vulnerability detection, and zero-trust architecture.

If these problems can't be solved, enterprises won't dare put AI into core systems.

So AI security is not optional—it is part of the infrastructure needed for AI adoption.

That is the biggest lesson from this Zscaler report.

The market may punish the guidance in the short term, but the long-term AI security thesis is still alive.

You could even say the more AI spreads, the more this theme deserves attention.

If AI agents enter enterprises at scale in the future, the real winners will not only be model companies or GPU companies.

Security companies may become one of the hardest-hitting parts of the next AI budget cycle.

Final takeaway.

The key point in Zscaler's earnings was not just the strong report or the stock drop—it was that it pushed one of the most underestimated lines in AI software into the spotlight.

Zscaler's opportunity is that zero trust is evolving from a cloud-security architecture into the access-control base layer of the AI era.

Zscaler's risk is that short-term guidance, sales execution, competition, and valuation swings still need to be re-rated by the market.

So this is not a stock to buy with your eyes closed. It is a core AI security name worth tracking continuously.