Zscaler, Inc. (ZS)

Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with the unaudited condensed consolidated financial statements and related notes included elsewhere in this Quarterly Report on Form 10-Q and with our Management’s Discussion and Analysis of Financial Condition and Results of Operations included in our Annual Report on Form 10-K for the year ended July 31, 2025 (the "Fiscal 2025 Form 10-K"), filed with the SEC on September 11, 2025. As discussed in the section titled "Special Note Regarding Forward-Looking Statements," the following discussion contains forward-looking statements that involve risks and uncertainties. Our actual results could differ materially from those discussed below. Factors that could cause or contribute to such difference include, but are not limited to, those identified below and those discussed in the section titled "Risk Factors" and elsewhere in this Quarterly Report on Form 10-Q. Our fiscal year end is July 31, and our fiscal quarters end on October 31, January 31, April 30 and July 31. Our fiscal year ended July 31, 2025 is referred to as fiscal 2025 and our fiscal year ending July 31, 2026 is referred to as fiscal 2026.

Overview

Zscaler was incorporated in 2007, during the early stages of cloud adoption and mobility, based on a vision that the internet would become the new corporate network as the cloud becomes the new data center. We correctly predicted that with rapid cloud adoption and increasing workforce mobility, traditional perimeter security approaches would prove to be inadequate in protecting users and data, prohibitively expensive and result in poor user experience. Enterprises now rely on external SaaS applications for critical business functions and have or are moving their internally managed applications to the public cloud infrastructure. As a result, users now expect to be able to seamlessly access applications and data, wherever they are hosted, from any device, anywhere in the world. The emergence and rapid adoption of AI is revolutionizing the transformational impact of cloud adoption and mobility. AI is fundamentally changing how organizations operate, creating new cybersecurity threats and IT challenges, but also the opportunity to use AI to counter cybersecurity threats and improve IT operations.

We generate revenue primarily from sales of subscriptions to access our cloud platform, together with related support services. We also generate an immaterial amount of revenue from professional and other services, which consist primarily of fees associated with mapping, implementation, network design and training. Our subscription pricing is calculated on a per-user and metered-usage basis. We recognize subscription and support revenue ratably over the life of customer contracts, which is generally one to three years. As of July 31, 2025, we had expanded our operations to over 9,400 customers across major industries, with users in over 185 countries. Government agencies and some of the largest enterprises in the world rely on us to support their secure digital transformation.

We operate our business as one reportable segment. Our revenue has experienced significant growth in recent periods. For the nine months ended April 30, 2026 and 2025, our revenue was $2,454.3 million and $1,953.9 million, respectively. We have incurred net losses in all annual periods since our inception. For the nine months ended April 30, 2026 and 2025, our net loss was $59.8 million and $23.9 million, respectively. We expect we will continue to incur net losses for the foreseeable future, as we continue to invest in our sales and marketing organization to maximize our market opportunity, to invest in research and development efforts to enhance the functionality of our cloud platform and to address any legal matters and related accruals, as further described in Note 12, Commitments and Contingencies, of the unaudited condensed consolidated financial statements included elsewhere in this Quarterly Report on Form 10-Q.

Impact of Macroeconomic Conditions

Changes in macroeconomic and geopolitical conditions, including but not limited to global conflicts, inflation and responses to inflation, tariffs or retaliatory measures due to tariffs, supply chain disruptions, energy shortages and the emergence of AI, can cause uncertainty in our business. We continue to see customer scrutiny of and elongated approval processes for transactions, particularly larger deals, as customers continue to carefully consider purchasing decisions and are

33

Table of Contents

requiring multiple approvals for large expenditures in response to the uncertain economic environment. Macroeconomic conditions may impact the future demand for subscriptions of our cloud platform.

Certain Factors Affecting Our Performance

Increased Internet Traffic and Adoption of Cloud-Based Software and Security

In a cloud, mobile-first and AI-enabled world where organizations depend on public and third-party infrastructure and technologies to access critical applications that power their businesses, enterprises that continue to rely on outdated network and security architecture built on firewalls and VPNs face serious challenges. The adoption of cloud applications and infrastructure, the explosion of internet traffic volumes, the shift to mobile-first computing generally and the pace at which enterprises adopt the internet as their corporate network in particular, impact our ability to drive market adoption of our cloud platform. In addition, the dependence on the internet, expanding digital transformation and growing AI usage have increased exposure to malicious or compromised websites, and sophisticated hackers are exploiting the gaps left by legacy network security appliances. To securely access the internet, transform their networks and expand their AI adoption, organizations must make fundamental changes in their network and security architectures. We believe that most organizations have yet to fully make these investments. Because our cloud platform enables organizations to securely embrace digital transformation, we believe that the imperative for organizations to securely move to the cloud and safely realize the benefits of AI will increase demand for our cloud platform and broaden our customer base.

New Customer Acquisition

We believe that our ability to increase the number of customers, and more significantly large enterprises, on our cloud platform is an indicator of our market penetration and our future business opportunities. As of July 31, 2025 and 2024, we had over 9,400 and over 8,650 customers, respectively, across all major geographies. As of July 31, 2025, we had approximately 40% of the Forbes Global 2000 as customers. Our ability to continue to grow these numbers will increase our future opportunities for renewals and follow-on sales. We believe that we have significant room to capture additional market share and intend to continue to invest significantly in sales and marketing to engage our prospective customers, increase brand awareness, further leverage our channel partnerships and drive adoption of our solution. However, as a result of the challenging and uncertain economic environment, potential new customers are carefully considering purchasing decisions, particularly for large expenditures. We expect customer cautiousness to continue in the near term, elongating our sales cycles and the timing of large deals.

Follow-On Sales

We typically expand our relationship with our customers over time. While most of our new customers route all of their internet-bound web traffic through our cloud platform, some of our customers initially use our services for a specific security functionality. We leverage our land-and-expand model with the goal of generating incremental revenue, often within the term of the initial subscription, by increasing sales to our existing customers in one of three ways:

•expanding deployment of our cloud platform to cover additional users and services;

•upgrading to more advanced capabilities, including AI-enabled features; and

•selling a subscription to a new solution or product, for example selling data security or AI security services to an existing ZIA or ZPA customer.

Investing in Business Growth

Since our founding, we have invested significantly in growing our business. We intend to continue to invest significantly in sales and marketing to grow and train our sales force, broaden our brand awareness and expand and deepen our channel partner relationships. While these planned investments will increase our operating expenses in the short term, we

34

Table of Contents

believe that over the long term these investments will help us to expand our customer base and grow our business. We also are investing in programs to increase recognition of our brand and solutions, including joint marketing activities with our channel partners and strategic partners.

We also intend to continue (i) investing in our research and development organization and our development efforts to offer new solutions on our cloud platform and (ii) dedicating resources to update and upgrade our existing solutions, including upgrades to our cloud platform.

In addition, we expect our general and administrative expenses to increase in absolute dollars in the foreseeable future, as we continue to operate as a public company, and address any legal matters and related accruals. This is further described in Note 12, Commitments and Contingencies, of the unaudited condensed consolidated financial statements included elsewhere in this Quarterly Report on Form 10-Q.

While we expect our operating expenses to increase in absolute dollars in the foreseeable future, as a result of these activities, we intend to balance these investments in future growth with a continued focus on managing our results of operations and investing judiciously. In the long term we anticipate that these investments will positively impact our business and results of operations.

Key Business Metrics and Other Financial Measures

We review a number of operating and financial metrics, including the following key metrics, to measure our performance, identify trends, formulate business plans and make strategic decisions.

Non-GAAP Financial Measures

In addition to our results determined in accordance with GAAP, we believe the following non-GAAP measures are useful in evaluating our operating performance. We use the following non-GAAP financial information to evaluate our ongoing operations and for internal planning and forecasting purposes. We believe that non-GAAP financial information, when taken collectively, may be helpful to investors because it provides consistency and comparability with past financial performance. However, non-GAAP financial information is presented for supplemental informational purposes only, has limitations as an analytical tool and should not be considered in isolation or as a substitute for financial information presented in accordance with GAAP. In particular, free cash flow is not a substitute for cash provided by operating activities. Additionally, the utility of free cash flow as a measure of our liquidity is further limited as it does not represent the total increase or decrease in our cash balance for a given period. In addition, other companies, including companies in our industry, may calculate similarly-titled non-GAAP measures differently or may use other measures to evaluate their performance, all of which could reduce the usefulness of our non-GAAP financial measures as tools for comparison. A reconciliation is provided below for each non-GAAP financial measure to the most directly comparable financial measure stated in accordance with GAAP. Investors are encouraged to review the related GAAP financial measur

[Excerpt truncated for page length; source filing is linked above.]

Overview

We empower our customers with the cybersecurity solutions necessary to protect their enterprises, drive growth and outpace competitors where success depends on securely adopting the technologies required to operate and compete effectively in an AI world. We were founded in 2007, based on a vision that, with the broad adoption of SaaS applications, the internet would become the new corporate network, the cloud would become the new data center and perimeter-based security would fail to protect users, applications and data. As AI redefines how businesses operate and powerful AI-enabled cyberthreats proliferate, enterprises must now adopt a zero trust approach to security. We deliver a comprehensive, cloud-native zero trust platform that minimizes the attack surface of an enterprise and eliminates lateral threat movement, delivering security at the scale and speed of AI.

We generate revenue primarily from sales of subscriptions to access our cloud platform, together with related support services. We also generate an immaterial amount of revenue from professional and other services, which consist primarily of fees associated with mapping, implementation, network design and training. Our subscription pricing is primarily calculated on a per-user and metered-usage basis. We recognize subscription and support revenue ratably over the life of customer contracts, which is generally one to five years. As of July 31, 2026, we had expanded our operations to approximately 11,000 customers across major industries, with users in over 185 countries. Many of the world's largest enterprises and government agencies rely on our cloud platform to enable secure digital transformation.

We operate our business as one reportable segment. Our revenue has experienced significant growth in recent periods. For fiscal 2026, fiscal 2025 and fiscal 2024, our revenue was $3,352.5 million, $2,673.1 million and $2,167.8 million, respectively. We have incurred net losses in all annual periods since our inception. For fiscal 2026, fiscal 2025 and fiscal 2024, our net loss was $63.2 million, $41.5 million and $57.7 million, respectively.

Certain Factors Affecting Our Performance

Adoption of the Cloud, Mobility and AI

Cloud adoption, workforce mobility and the rapid emergence of AI have fundamentally altered enterprise IT architectures and security requirements.

As enterprise applications have migrated out of data centers and workforces have become increasingly distributed, conventional perimeter-based security, including firewalls and VPNs, are inadequate to address modern threats. These legacy tools can be expensive to maintain, may degrade user experience and were not designed to secure a borderless enterprise. AI adds further complexity as frontier models are accelerating the sophistication of cyberattacks and compressing the time

64

Table of Contents

between vulnerability discovery and exploitation, while AI-driven agentic workflows introduce data governance and access control demands that traditional architectures were not built to meet.

We believe our cloud platform is well-positioned to address these dynamics. By performing inline inspection at scale, hiding applications from the internet and eliminating lateral threat movement our platform is designed to reduce the attack surface that legacy architectures expose. We connect users, devices, workloads, and AI agents to applications based on identity and context rather than network location, an approach we believe is increasingly aligned with how enterprises need to operate in the rapidly evolving AI and digital world.

We believe the imperative for organizations to securely move to the cloud and safely realize the benefits of AI will increase demand for our cloud platform and broaden our customer base.

New Customer Acquisition

Our future success also depends on our ability to acquire new customers. We believe that our ability to increase the number of customers, and more significantly large enterprises, on our cloud platform is an indicator of our market penetration and our future business opportunities. As of July 31, 2026, 2025 and 2024, we had approximately 11,000, 9,400 and 8,650 customers, respectively, across all major geographies and industries. As of July 31, 2026, we had over 40% of the Forbes Global 2000 as customers. Our ability to continue to grow these numbers will increase our future opportunities for renewals and follow-on sales. We believe that we have significant room to capture additional market share and intend to continue to invest significantly in sales and marketing to engage our prospective customers, increase brand awareness, further leverage our channel partnerships and drive adoption of our solution.

Follow-On Sales

We typically expand our relationship with our customers over time. We leverage our organic account expansion strategies to drive incremental revenue, often within the term of the initial subscription, by increasing sales to existing customers in the following ways:

•expanding deployment of our cloud platform to cover additional users and services;

•upgrading to more advanced capabilities; including AI-enabled features; and

•selling a new solution or product, such as selling Data security or Security for AI solutions to an existing ZIA or ZPA customer, or selling ZIA or ZPA to an existing Zero Trust Branch customer.

Investing in Business Growth

Since our founding, we have invested significantly in growing our business. We intend to continue to invest significantly in sales and marketing to grow and train our sales force, broaden our brand awareness and expand and deepen our channel partner relationships, including with global systems integrators and public cloud marketplaces. While these planned investments will increase our operating expenses in the short term, we believe that over the long term these investments will help us to expand our customer base and grow our business. We also are investing in programs to increase recognition of our brand and solutions, including joint marketing activities with our channel partners and strategic partners.

We also intend to continue investing in our research and development organization and our development efforts to offer new solutions on our cloud platform and dedicating resources to update and upgrade our existing solutions.

In addition, we expect our general and administrative expenses to increase in absolute dollars for the foreseeable future, as we continue to operate as a public company and scale to support the needs of the business.

65

Table of Contents

While we expect our operating expenses to increase in absolute dollars in the foreseeable future, as a result of these activities, we intend to balance these investments in future growth with a continued focus on managing our results of operations and investing judiciously. In the long term we anticipate that these investments will positively impact our business and results of operations.

Impact of Macroeconomic Conditions

Changes in macroeconomic and geopolitical conditions, including but not limited to global conflicts, inflation and responses to inflation, tariffs or retaliatory measures due to tariffs, supply chain disruptions, energy shortages and the emergence of AI, can cause uncertainty in our business. In response to uncertain economic conditions, we see customer scrutiny of, and complex approval processes for, transactions, particularly larger deals, as customers carefully consider purchasing decisions and require multiple approvals for large expenditures. As a result, macroeconomic conditions may impact the future demand for subscriptions of our cloud platform.

Key Business Metrics and Other Financial Measures

We review a number of operating and financial metrics, including the following key metrics, to measure our performance, identify trends, formulate business plans and make strategic decisions.

Annual Recurring Revenue ("ARR")

ARR is a key business metric that we use to measure our periodic performance. ARR refers to the next 12 months of revenue from subscription contracts as of the measurement date. To establish ARR for a customer, we assume that any contract expiring during the next 12 months will be renewed under the existing terms. ARR as of July 31, 2026 and 2025 was $3,771 million and $3,015 million, respectively.

Non-GAAP Financial Measures

In addition to our results determined in accordance with GAAP, we believe the following non-GAAP measures are useful in evaluating our operating performance. We use the following non-GAAP financial information to evaluate our ongoing operations and for internal planning and forecasting purposes. We believe that non-GAAP financial information, when taken collectively, may be helpful to investors because it provides consistency and comparability with past financial performance. However, non-GAAP financial information is presented for supplemental informational purposes only, has limitations as an analytical tool and should not be considered in isolation or as a substitute for financial information presented in accordance with GAAP. In particular, free cash flow is not a substitute for cash provided by operating activities. Additionally, the utility of free cash flow as a measure of our liquidity is further limited as it does not represent the total increase or decrease in our cash balance for a given period. In addition, other companies, including companies in our industry, may calculate similarly-titled non-GAAP measures differently or may use other measures to evaluate their performance, all of which could reduce the usefulness of our non-GAAP financial measures as tools for comparison. A reconciliation is provided below for each non-GAAP financial measure to the most directly comparable financial measure stated in accordance with GAAP. Investors are encouraged to review the related GAAP financial measures and the reconciliation of these non-GAAP financial measures to their most directly comparable GAAP financial measures, and not to rely on any single financial measure to evaluate our business.

66

Table of Contents

Non-GAAP Gross Profit and Non-GAAP Gross Margin

We define non-GAAP gross profit as GAAP gross profit excluding stock-based compensation expense and related payroll taxes, amortization expense of acquired intangible assets and restructuring and other charges. We define non-GAAP gross margin as non-GAAP gross profit as a percentage of revenue.

(1) Includes acquisition-related stock-based compensation expense and related payroll taxes of $0.1 million, $0.2 million and nil for fiscal 2026, fiscal 2025 and fiscal 2024, respectively. Acquisition-related stock-based compensation includes deferred merger consideration subject to post-combination service vesting conditions, performance stock awards, and acquisition replacement awards.

Non-GAAP Income from Operations and Non-GAAP Operating Margin

We define non-GAAP income from operations as GAAP loss from operations, excluding stock-based compensation expense and related payroll taxes, amortization expense of acquired intangible assets, restructuring and other charges and acqu

[Excerpt truncated for page length; the complete text is on the linked full-MD&A page.]