Zscaler (NASDAQ:ZS) reported what management described as “strong” fiscal second-quarter 2026 results, led by 25% annual recurring revenue (ARR) growth and a raised outlook for the remainder of the year. On the company’s earnings call, CEO Jay Chaudhry emphasized accelerating customer demand tied to AI adoption and security, while CFO Kevin Rubin pointed to large-deal momentum, improving sales productivity, and continued expansion beyond the company’s core user security offerings.
Quarterly performance and key metrics
Rubin said Zscaler delivered 26% year-over-year revenue growth in Q2 to $816 million, exceeding the high end of guidance. Total ARR reached $3.4 billion, up 25% year-over-year, with net new ARR of $156 million, up 19%. Excluding the contribution from the company’s Red Canary acquisition, net new ARR was $139 million, up 7%, and total ARR was up 21%.
By region, the Americas accounted for 57% of revenue (up about 31% year-over-year), EMEA was 28% (up about 18%), and APJ was 15% (up about 23%). Remaining performance obligations (RPO) totaled $6.1 billion, up about 31%, with about 47% classified as current RPO.
AI security and the “agentic” theme
Chaudhry framed AI as a major driver of both security risk and platform opportunity, arguing that enterprises will need “inline policy enforcement at massive scale” as AI agents proliferate. He said Zscaler’s Zero Trust Exchange is designed to enable direct one-to-one communication among users, applications, and AI agents, limiting lateral movement and shrinking the attack surface.
Chaudhry cited operational scale, including 15+ years of running Zscaler’s cloud across 160+ data centers with 99.999% reliability. He also said Zscaler processed nearly 1 trillion AI transactions in calendar 2025 and is now processing millions of MCP requests monthly, “up from literally nothing a couple of quarters ago.”
In product terms, he highlighted two AI security areas:
- AI Protect: A recently introduced solution to discover and manage AI assets (including shadow AI), enforce access policies, and inspect prompts and responses to prevent data leaks and attacks such as prompt injection. Chaudhry said Zscaler integrated AI red teaming and guardrail products to deliver “closed loop security.”
- Agentic operations: Including Agentic SecOps and Agentic ITOps. Chaudhry said Zscaler is integrating Red Canary’s agent framework with security insights from the Zero Trust Exchange, which he said processes more than 500 billion transactions per day.
Chaudhry provided examples of customer activity, including an $8-figure new logo win with a Fortune 500 semiconductor manufacturer that adopted AI Protect and data security modules, and a seven-figure upsell with a Global 2000 construction company adding AI Protect for data leakage prevention and acceptable-use controls for GenAI apps.
Platform expansion: Zero Trust Everywhere and Data Security Everywhere
Chaudhry said the quarter reflected demand across three growth pillars: AI security, Zero Trust Everywhere, and Data Security Everywhere. On Zero Trust Everywhere—defined as customers buying Zero Trust users, Zero Trust Branch, and Zero Trust Cloud—he said the number of enterprises using the full bundle grew to over 550 from over 130 a year ago.
He highlighted momentum in both branch and cloud use cases, describing Zero Trust Branch as disrupting branch firewalls, SD-WAN, and MPLS networks, and Zero Trust Cloud as replacing virtual firewalls in cloud and data center environments. As an example, Chaudhry cited a seven-figure upsell at a subsidiary of a Fortune 500 retailer expanding Zero Trust Branch to more than 1,000 sites. He also noted that in Q2, 45% of customers buying Zero Trust Branch were new logos.
For Zero Trust Cloud, Chaudhry described a seven-figure deal with a Global 2000 financial services customer that increased the customer’s ARR to more than $5 million, up over 40%, aimed at eliminating numerous virtual firewalls across multiple cloud environments.
On Data Security Everywhere, Chaudhry said customers are consolidating point products onto Zscaler’s platform, particularly as AI adoption increases data protection needs. He described an $8-figure upsell at a Global 2000 financial services customer purchasing additional data security modules, which increased the customer’s ARR nearly 5x.
Business model shifts, Z-Flex momentum, and acquisitions
Rubin said non-seat-based metered usage solutions contributed just over a quarter of new ACV in Q2, and ARR tied to those offerings grew more than 100% year-over-year. In the Q&A, Chaudhry linked this trend to growth in Zero Trust Branch and Cloud (metered pricing) and to AI security solutions that are “token-based,” adding that management expects metered usage to grow over time as AI agents drive more traffic.
Zscaler also discussed continued traction in its Z-Flex program, which allows customers with multi-year commitments to activate or swap modules without a new procurement cycle. Rubin said Z-Flex generated more than $290 million in total contract value (TCV) in Q2, up over 65% quarter-over-quarter, and approximately $650 million in TCV since launch about a year ago, at an average four-year term. Rubin described the average Z-Flex deal as typically an eight-figure TCV commitment.
On acquisitions, Rubin said Zscaler closed its acquisition of SquareX on February 5, describing it as extending Zero Trust into any browser through an approach intended to secure access on unmanaged devices without requiring a separate enterprise browser or virtual desktop infrastructure. Chaudhry said Zscaler preferred SquareX’s browser extension approach over acquiring a full “enterprise browser,” citing customer concerns about deploying another endpoint agent and potential browser vulnerabilities.
Rubin also updated investors on Red Canary, noting that it was “primarily a technology and talent acquisition” and that churn for managed detection and response (MDR) businesses is higher than Zscaler’s core business. He said Red Canary’s churn has been elevated post-acquisition and that the company will provide Red Canary ARR in Q3 and Q4.
Margins, cash flow, and raised guidance
On profitability, Rubin reported non-GAAP gross margin of 80.2% and non-GAAP operating income of $181 million, up 29% year-over-year, with operating margin of 22.2% (up 50 basis points). The company ended the quarter with $3.5 billion in cash, cash equivalents, and short-term investments, and $1.7 billion of debt.
Operating cash flow was $204 million, up 14%, while free cash flow margin was 20.7%, down from 22.1% a year ago due to timing of cash collections. Rubin also noted recent increases in memory, storage, and processor prices and availability, saying Zscaler had not seen a meaningful operational impact so far but would monitor and adjust pricing if needed.
Zscaler raised guidance “across the board.” For Q3, management guided for revenue of $834 million to $836 million (about 23% year-over-year growth), operating margin of 22.4% to 22.6%, and EPS of $1.00 to $1.01. For full-year fiscal 2026, Zscaler guided to ARR of $3.730 billion to $3.745 billion (about 24% growth) and revenue of $3.309 billion to $3.322 billion (23.8% to 24.3% growth), with operating profit of $742 million to $748 million and EPS of $3.99 to $4.02.
Rubin also increased expectations for Red Canary in fiscal 2026, calling for about $130 million in ARR (up from prior guidance of $95 million) and about $125 million in revenue (up from $90 million), while reiterating confidence in the underlying business and typical seasonality that favors the second half of the year.
About Zscaler (NASDAQ:ZS)
Zscaler is a cloud security company that delivers a cloud-native platform to protect users, applications and data as organizations move away from traditional, network-centric security architectures. The company focuses on a zero trust approach that assumes no implicit trust for users or devices, providing secure access to the internet, SaaS applications and private applications regardless of where users are located. Zscaler positions its services as an alternative to legacy appliances and site-centric VPNs, aiming to simplify security while enabling modern, distributed workforces.
Key offerings are built around the Zscaler Zero Trust Exchange, a multi-tenant cloud platform that enforces security and access policies in-line.
