Following in the footsteps of CrowdStrike and Palo Alto Networks, another major winner has emerged in the AI reasoning era. Zscaler (ZS.US) shares surged more than 11% in after-hours trading on Thursday after the cloud security leader delivered a powerful quarterly earnings report that exceeded market expectations, along with a robust forward outlook. The results underscore that as generative AI transitions from experimental deployment to large-scale AI agent implementation, cybersecurity budgets are shifting from optional spending to a prerequisite for AI infrastructure, with product pipelines now benefiting from order momentum driven by the rapid expansion of the AI inference market.

As AI moves toward massive-scale inference workloads and agentic AI workflows, cybersecurity demand is not simply accelerating alongside frontier AI technology updates — it is likely to experience structural incremental expansion that significantly outpaces traditional IT spending. For the fourth fiscal quarter, Zscaler reported revenue of $898.2 million, up 25% year-over-year and above the $877 million consensus estimate. Adjusted earnings per share came in at $1.19, beating the expected $1.09. Annual recurring revenue (ARR) grew 25% to $3.771 billion. More notably, "Security for AI" bookings surged more than 50% quarter-over-quarter, while the sales pipeline expanded by 75% — the former reflecting confirmed commercial orders and the latter indicating a strong pipeline of future bookings. As AI models increasingly call on data, applications, and tools, the demand for zero-trust access, identity governance, and data loss prevention continues to strengthen.

Management guided first-quarter fiscal 2027 revenue in the range of $935 million to $939 million, above the $927 million consensus, with adjusted EPS of $1.15 to $1.16, exceeding the $1.08 estimate. For the full fiscal year, revenue guidance came in at $3.908 billion to $3.938 billion, slightly above the $3.9 billion consensus, while adjusted EPS of $4.86 to $4.90 significantly surpassed the $4.60 forecast. However, ARR growth is expected to slow to 16.6%–17.4%, a notable deceleration from the 25% growth recorded in fiscal 2026.

Following the earnings release and forward guidance, Zscaler shares initially jumped over 11% in after-hours trading before settling down about 1%. Prior to this move, the stock had fallen roughly 20% year-to-date. This strong rebound essentially reflects the market re-evaluating the company's cybersecurity business expansion in the AI reasoning era and its stronger monetization capabilities — though valuation risks and concerns about sustainable growth have not entirely disappeared.

Peer results in the cybersecurity industry further validate the strength of demand. CrowdStrike reported second fiscal quarter revenue of $1.47 billion, up 26% year-over-year, with ARR growing 25% to $5.84 billion. Net new ARR hit a record $333 million, up 51% year-over-year, and free cash flow reached $377 million. The stock rose approximately 10.4% in after-hours trading following the report. Meanwhile, Palo Alto Networks delivered fourth fiscal quarter revenue of $3.41 billion, up 34% year-over-year and above the $3.35 billion consensus. Adjusted EPS of $1.02 beat the expected $0.98, while next-generation security ARR grew 63% to $9.1 billion. The company's fiscal 2027 revenue guidance of $14.1 billion to $14.2 billion also surpassed the $13.79 billion market expectation.

The underlying logic is clear: AI reasoning — particularly agentic AI-driven fully autonomous workflows — no longer merely generates text. These systems continuously call on models, APIs, databases, and enterprise tools, accessing sensitive data and executing operations at machine speed. This creates new risks including machine identities, privilege escalation, prompt injection, data exfiltration, agent lateral movement, model supply chain contamination, and autonomous attacks. Security architectures must therefore shift from traditional perimeter defense to continuous identity verification, least-privilege access, inline traffic inspection, and runtime governance. While training compute demand may fluctuate on a project-by-project basis, every agent inference, tool call, and data access requires security controls and AI security tools, giving cybersecurity product lines a sustainable growth trajectory tied to expanding AI usage.

In the Q&A session, Palo Alto Networks management highlighted a scenario of $5 trillion in AI capital expenditure over the next five years, while also noting that approximately $1 trillion in global cybersecurity technical debt urgently needs modernization. CEO Nikesh Arora stated during the earnings call that the latest advances in AI are pushing cybersecurity to the top of enterprise CIO priority lists, describing it as a "persistent tailwind." He emphasized that roughly $1 trillion of global cybersecurity infrastructure is not yet prepared for AI-driven threats, creating long-term growth opportunities for the industry.

So who exactly is Zscaler, and how does its core business compare to giants like CrowdStrike and Palo Alto Networks? Zscaler represents a high-purity play on zero trust and AI agent traffic growth — offering greater elasticity but relying more heavily on sales execution and new ARR conversion. CrowdStrike benefits from massive endpoint behavioral telemetry and security operations automation advantages, making it a more direct beneficiary of AI-driven attack detection demand. Palo Alto Networks offers the most complete product portfolio and the strongest cross-selling capabilities, positioning it well to capture the "platform consolidation" trend as enterprises reduce vendor counts.

In essence, Zscaler bets on "eliminating network trust," CrowdStrike bets on "detecting and stopping attacks," and Palo Alto bets on "unifying the entire security stack on one platform."

Zscaler is a cloud-native cybersecurity company centered on zero trust. Its "Zero Trust Exchange" platform sits directly in the enterprise traffic path, connecting users, workloads, branch offices, or AI agents to approved applications without directly accessing the internal network. The company's core business covers Security Service Edge (SSE), Secure Access Service Edge (SASE), internet access security, private application zero-trust access, data loss prevention, cloud workload and branch security, and digital experience monitoring. It is also expanding into AI agent communication, model access control, and Agentic SecOps.

Zscaler operates as the "traffic and access control layer," replacing traditional VPNs, network boundaries, and certain security appliances with a cloud-based inline proxy. CrowdStrike, by contrast, serves as the "endpoint telemetry and detection response layer," built on the Falcon platform and endpoint agents, focusing on EDR, XDR, cloud workload protection, identity protection, threat intelligence, and Next-Gen SIEM — specializing in identifying "what attacks are happening" on devices and workloads and rapidly stopping them. Palo Alto Networks represents the most comprehensive "full-stack security platform," having started with next-generation firewalls (NGFW) and now spanning network security and SASE, Prisma Cloud security, Cortex security operations, and identity security — combining hardware, software subscriptions, and cloud platforms.

As AI reasoning drives escalating cybersecurity risks and urgent demand for security tools, this zero-trust-focused cloud security company delivered results and guidance that beat Wall Street consensus expectations — which is why Zscaler shares surged in after-hours trading on Thursday.

The company reported fourth fiscal quarter revenue of $898.2 million, up 25% year-over-year and above the $877 million consensus. Adjusted EPS came in at $1.19, surpassing the $1.09 estimate. Zscaler reported a GAAP net loss of $3.4 million, or $0.02 per share on a GAAP basis, compared to a net loss of $17.6 million, or $0.11 per share, a year earlier.

For the full fiscal 2026 year, revenue reached $3.353 billion, up 25%, or $3.209 billion excluding Red Canary, up 20%. Non-GAAP operating profit grew to $767.1 million, with operating margin expanding from approximately 21.7% to 22.9%. Non-GAAP EPS increased from $3.28 to $4.21. Full-year operating cash flow reached $1.130 billion, up from $972.5 million the prior year. Free cash flow grew to $779.1 million, though the free cash flow margin declined from 27% to 23%. Fourth-quarter free cash flow fell to $60.8 million from $171.9 million in the same period last year, primarily due to capital expenditures and internal-use software investments rising from $78.7 million to $218.5 million — meaning earnings quality and capital intensity remain variables for valuation scrutiny.

During the earnings call, management disclosed net new ARR of $246 million, up 24% year-over-year, or $232 million excluding Red Canary, up 17%. Remaining performance obligations (RPO) grew 27% to $7.365 billion. Z-Flex contract value exceeded $770 million in the fourth quarter, up over 60% quarter-over-quarter, and surpassed $1.7 billion for the full year. Management noted that 70% of AI security transactions also included data security products. Zero Trust Everywhere enterprise customers increased from over 700 in the prior quarter to over 950, while non-seat-based products now contribute approximately 30% of new and upsell ACV.

For the first quarter, the company expects revenue in the range of $935 million to $939 million with adjusted EPS of $1.15 to $1.16, both above the $927 million revenue consensus and the $1.08 adjusted EPS estimate. Additionally, the company plans to restructure approximately 3% of its workforce, incurring $30 million to $33 million in charges. Management projects fiscal 2027 revenue of $3.908 billion to $3.938 billion, above consensus, with ARR expected at $4.396 billion to $4.426 billion — growth slowing to approximately 17% from fiscal 2026's pace. Whether the stock can sustain its re-rating will depend on whether the AI security pipeline converts into new ARR and offsets the impact of sales organization changes and higher Red Canary churn.

Whether closed-source or open-source models ultimately dominate, cybersecurity represents one of the most "model-route-neutral" beneficiary layers: closed-source models require addressing third-party interface, data boundary, and vendor concentration risks, while open-source and open-weight models introduce risks around model provenance, dependency components, self-hosted environments, and patch fragmentation. In other words, the more inferences performed and the greater agent autonomy, the more identities, endpoints, APIs, cloud workloads, data, and runtime environments enterprises must protect.

The "approximately $1 trillion global cybersecurity debt" emphasized by Palo Alto Networks CEO Nikesh Arora during this week's earnings call essentially represents the massive upgrade cycle required as pre-AI-era architectures must be modernized.

Zscaler CEO Jay Chaudhry emphasized that the company's zero-trust cloud security architecture adoption and innovative technologies were the primary drivers behind the quarterly outperformance. In an interview with a major business news network following the earnings call, he said he is "very bullish" on the company's recently launched next-generation zero-trust product designed for AI agents. The product is showing early initial momentum and is expected to accelerate rapidly in fiscal 2028 and 2029. "It's a longer-term opportunity, but I think it's a very attractive one with significant barriers to entry," Chaudhry said.

Annual recurring revenue grew 25% year-over-year to $3.77 billion, slightly exceeding the approximately $3.75 billion consensus. As increasingly sophisticated cyberattack models and agent-driven attacks force enterprises to adopt new security tools, cybersecurity stocks have surged significantly this year. While competitors have hit new highs with year-to-date gains exceeding 80%, Zscaler shares had fallen 20%. In the previous quarter, after two sales executives departed, management adopted a "prudent approach" to guidance, triggering the stock's worst-ever single-day performance.

But Chaudhry said the market has missed the key point of Zscaler's differentiated strategy. "The core capability we bring is quite unique; as AI agents become more prevalent, the market will increasingly recognize that Zscaler is a critical participant," he said. Like other cybersecurity industry executives, Chaudhry views AI security as one of the most significant opportunities. Over the past year, that business has accumulated $100 million in bookings and grew more than 50% quarter-over-quarter in the latest period.