Zscaler's 25% Growth Says AI Expands Its Moat - but the Market Still Has Doubts

AI demand is clear, but investor confidence is still catching up

Zscaler's problem is no longer demand. It is confidence. The company just posted revenue of $850.5 million and ARR of $3,525 million, both up 25% year over year. That is not the profile of a niche vendor living on a temporary AI tailwind.

Investors are still stuck on an older question: is AI security real spend, or just another vendor-led buzz cycle? The urgency data points to the former. Zscaler's own research found enterprise AI systems could be compromised in just 16 minutes, with critical flaws uncovered in 100% of systems analyzed. AI/ML usage rose 200% in key sectors, while data transfers to AI/ML applications totaled more than 18,000 terabytes.

That is why waiting for "proof" feels increasingly backward-looking. The market is acting as if customers still need to be convinced AI security matters. The evidence suggests boards already see the exposure.

Why this matters now: - Growth is already visible: revenue of $850.5 million, up 25% year over year. - The threat window is measured in minutes, not budget cycles: 16 minutes to compromise. - The behavior change is large: 200% AI usage growth in key sectors and more than 18,000 terabytes transferred to AI/ML applications.

Bulls see Zscaler as infrastructure for that shift. Bears argue excitement can outrun durability. For now, the market still leans skeptical, and that lagging confidence is what could allow a rerating if execution stays clean.

Why AI looks more like a moat extender than a short-lived tailwind

The moat is the platform position, not a single AI feature

The first question was whether AI security is real demand. The next question is whether that demand makes Zscaler harder to remove. On the evidence, it does. Interest may open the door, but the moat comes from visibility, control, and the increasing pain of displacement.

One trillion AI transactions shows where the leverage point is

Earlier this year, Zscaler said enterprises generated nearly one trillion AI transactions in 2025 across its cloud. That matters because moats in security are rarely built by selling a feature. They are built by becoming the place where risk is measured and policy is enforced.

As AI usage scales, security teams care less about a standalone "AI product" and more about a platform that can see AI connections, govern data leaving the enterprise, and respond to automated attacks at scale. Zscaler's own messaging centers on exactly that: securing AI while countering AI-powered attacks at enterprise scale. Once a company has routed AI traffic through one control plane, switching means rebuilding visibility and controls from scratch.

Agentic AI widens the battleground

This is where Zscaler's strategy matters more than the buzzword cycle. The company has extended its platform into agentic AI, targeting how autonomous agents access data, interact with systems, and move across the enterprise. Zscaler says traditional security was built around known human identities and predictable access patterns, while AI agents create ephemeral identities, sub-agents, and machine-speed behavior that legacy tools struggle to track.

If agents become a major way work gets done, the valuable layer is less likely to be another point tool. It is more likely to be the zero-trust fabric that can inspect identity, context, and data flow for both humans and machines. Each new agent, app, or AI service raises the cost of fragmentation, which can further strengthen a consolidated platform.

Retention and large-customer expansion matter more than the narrative

The stronger evidence is customer behavior, not the pitch deck. Zscaler reports 114% dollar-based net retention and 748 customers above $1M ARR. Those figures suggest the company is not just adding AI as a checkbox. It is deepening its presence inside large environments that already depend on the platform.

That is why management's view that AI security ARR could exceed $500 million by end of fiscal 2026 should be read as a scale signal rather than a guaranteed outcome. Even as a directional target, it implies AI security is moving from growth story toward a more meaningful revenue pillar.

What to watch: - Whether AI traffic keeps being governed through one platform rather than bolted on as a side product. - Whether retention and large-customer expansion keep improving as the clearest sign that switching is getting harder. - Whether agentic AI becomes another reason for customers to keep Zscaler at the center of security architecture.

The moat looks stronger on paper than it does in procurement

With ARR of $3,525 million, Zscaler is no longer being judged as a speculative AI-security concept. It now looks more like the kind of category leader that competitors try to compress into a cheaper line item. The bull case is that its position in the stack makes it harder to displace. The bear case is that purchasing power is shifting toward whoever can offer the simplest vendor math.

Bundling and channel economics are the main pressure points

Bundling is the first threat. Zscaler faces Microsoft and Palo Alto Networks competition, both of which can point to broader portfolios already sitting inside enterprise security budgets. In hesitant markets, that framing matters. Buyers can convince themselves they do not need a best-of-breed control plane when a larger suite promises fewer vendors and simpler renewals.

Why the stock can still reprice in either direction

This is where investor psychology can distort both outcomes. Bears may let the old point-product-versus-suite argument drown out a business that still grew 25% year over year. Bulls may assume the moat defends itself simply because the AI-security problem is urgent.

The real issue is simpler: can Zscaler keep owning the core purchasing decision as AI adoption and agent-based workflows expand? If the answer is yes, the current skepticism may look misplaced. If purchasing power continues shifting toward bundles, the story will have to work harder to justify the premium.