Security

Zscaler hit the Street's $233 target before its new sales chief reported a quarter

An AI-found flaw in PHP, eleven price-target raises and a $270 bull call have carried ZS back to the Street's $233 mean at 47 times forward earnings. Late November brings the first quarter under the sales chief who inherited the machine.

Vincent JiangVincent Jiang · 3 min read
Share
Jay Chaudhry, Zscaler's chairman and chief executive, speaking on stage
1 / 6Slide 1 of 6
Zscaler chief executive Jay Chaudhry called agentic AI "the most significant opportunity in our company's history" at the October 6 Investor Day.

Two holes in a 30-year-old language did the buying

On October 21, PHP, the language behind about 70% of the web, shipped emergency patches for two flaws that let attackers run code on unpatched servers, holes found by AI models at OpenAI$1.18T — OpenAI, private, latest valuation $1.18T, Wiz and the research firm Calif before criminals got there 5. Buyers treated the patch as a revenue event: Zscaler+6.50% — Zscaler, up 6.50 percent today rose 7.4% to $230.38 that day 6, rose again Thursday 2, and by Friday morning traded at $237, past the Street's $233 average price target 17.

Back at the mean, at 47 times earnings

The rally completed a 14% month and an 85% rebound since April, and lifted the forward earnings multiple from 28x in late June to about 47x, still under the four-year average near 64x 12. A $34.98 billion company 3 now sits at the consensus target, a number that has itself climbed from $193 in mid-July 1.

The re-rating prices a handover nobody has reported yet

Chief revenue officer Mike Rich built the sales overhaul that lifted net-new ARR growth to 17% in the July quarter from 7% a year earlier; he left in September, the stock fell 10% in a day, and CFO Kevin Rubin had tied part of the cautious fiscal 2027 guide to the leadership change 1.

The October 6 Investor Day reaffirmed that guide, with CEO Jay Chaudhry calling agentic AI "the most significant opportunity in our company's history" and pointing to a $10 billion ARR target 7. Eleven firms raised targets the next morning, Evercore−1.04% — Evercore, down 1.04 percent today ISI to $195, Baird to $285 1. The Street has repriced as settled the one risk Zscaler's own CFO named, before new chief revenue officer Ross Tackett has reported a single quarter 17.

What November has to hold

Revenue growth has run near 25% for four straight quarters 9, and the fiscal 2027 guide steps it down to 16.6–17.5% 8. July-quarter ARR grew 25%, but $141 million of that came from the Red Canary acquisition 8; the newer growth engines, the ones meant to carry the next leg, grew ARR 60% combined last year 1. Insiders sold $23.4 million of stock over 12 months without a single purchase, twelve of those sales in the past three months 3.

Growth has held near 25% for four quarters; the fiscal 2027 guide steps down to 17%

20%25%30%35%40%Q4 '23Q2 '24Q4 '24Q2 '25Q4 '25Q2 '2624.9%FY2027 guide: 16.6–17.5%
Data
Revenue growth
Q3 '2339.7%
Q4 '2335.4%
Q1 '2432.1%
Q2 '2430.3%
Q3 '2426.4%
Q4 '2423.4%
Q1 '2522.6%
Q2 '2521.3%
Q3 '2525.5%
Q4 '2525.9%
Q1 '2625.4%
Q2 '2624.9%
Reported quarterly revenue, percent change from the same quarter a year earlier, fiscal quarters ending October 2023 through July 2026, from SEC filings. Guide from the October 6, 2026, reaffirmation.8,9

The bull calls sit above a $233 mean the stock has already reached

$0$100$200$300Evercore ISI$195D.A. Davidson (Neutral)$215Street mean, 47 analysts$233Freedom Broker (Buy)$270Baird$285
Data
Value
Evercore ISI$195
D.A. Davidson (Neutral)$215
Street mean, 47 analysts$233
Freedom Broker (Buy)$270
Baird$285
Analyst price targets, dollars per share. Street mean is the 47-analyst consensus as of October 22, 2026; Evercore ISI and Baird bracket the post-Investor-Day raises of October 7, D.A. Davidson initiated October 21, Freedom Broker raised October 22.1,2,6

The wave is real, and it is already in the model

The bull case has substance: every PHP release of the past decade is exposed to at least one of the new flaws 5, and Zscaler's ThreatLabz data shows enterprise AI traffic up 83% in 2025 across roughly 9,000 organizations, with 410 million data-loss violations tied to ChatGPT alone 4. "What's happening in cybersecurity is a COVID-like wave," Dragonfly managing partner Haseeb Qureshi posted 2.

Yet consensus already carries revenue from $3.35 billion to $5.33 billion by fiscal 2029 2. D.A. Davidson initiated at Neutral, $215, on October 21, calling the stock close to fairly valued at roughly 33 times calendar-2027 free cash flow 36; Freedom Broker went to $270 the next morning 2. The wave has to push budgets past what is modeled to move the stock from here.

Five weeks to the first Tackett quarter

Fiscal Q1 lands in late November, guided to $935–939 million, up about 19% 8. Watch net-new ARR and the 60% engines: the May report cost 31.5% in a day 1, and a stock at its mean target gives a first-time sales chief no cushion. The Investor Day guide and the insider sale notices are mapped in earlier reporting.

What happens next

ZS

Do net-new ARR and the 60% growth engines hold under the new sales chief, or does the stock reprice as it did in May?

The case for

Enterprise AI traffic up 83% in 2025 and every PHP release of the past decade exposed to the new flaws: the demand wave is real

The case against

47 times forward earnings with fiscal 2027 growth guided down to 16.6–17.5%

  1. Late November 2026Zscaler fiscal Q1 2027 earnings, first under CRO Ross Tackett.

Get our follow-up when these land

Free. We'll email you when we publish on Zscaler, and send our free weekday newsletter. Unfollow in one click.

Loading ZS…

Reader comments

0 comments

    More in Security

    All in this topic →

    Security

    Tenable gave PHP's 9.2 flaws its highest rating, then patched PHP out of its own scanners

    The Nessus maker gave the PHP2Shell flaws its highest concern rating, then spent October 22 patching PHP out of its own appliances. Its next bet is selling exposure data to AI agents; one launch partner already runs an autonomous security center on top of it.

    Security

    CrowdStrike says four hacking groups now run AI agents on their own; its AIDR line grew 79-fold

    CrowdStrike's threat-intelligence unit has documented four hacking groups running AI agents as autonomous operators. The same firm sells the detector, and the early-December fiscal Q3 print is the first dollar test of whether documented fear becomes disclosed revenue.

    Security

    A stolen SSN pinned a $1,000 scam on the wrong woman; Block settled Cash App fraud claims for $12 million

    A Pennsylvania woman faces six years over a scam account opened with her stolen SSN, and Block has agreed to a $12 million settlement over Cash App's fraud controls, all in the same week its analysts see a rerating ahead.

    Security

    AI found the flaw under most of the web; Fastly is selling a wall it has not finished

    PHP shipped emergency patches on October 21 for two flaws found by AI audits, with attacks already visible on Fastly's network. The company selling the filtering launched its network-layer shield a week earlier with the automated engine unfinished and no price published.

    Security

    Palo Alto Networks has no PAN-OS fix for PHP2Shell, calls it 9.2 and sells a paid virtual patch

    Every version of Palo Alto's PAN-OS firewall software is on the PHP2Shell affected list with no fix shipped. The company scored its own products a notch below the emergency number its blog uses to sell virtual patching.

    Security

    Fortinet's customers must patch blind: fixes shipped October 22, flaws named November 10, earnings October 28

    Fortinet shipped fixes for five product lines on October 22 and will not name the flaws until November 10, thirteen days after its earnings report. Its own chief information security officer says AI can turn a released patch into a working exploit within hours or days, and that makes the wait itself the exposure.

    Get the newsletter

    The day's AI and market news, in your inbox every weekday.