Zscaler's Moat Under Fire: AI Adds $100M of Revenue, but Also Exposes the Business

AI is changing where Zscaler's moat has to work

AI is no longer a side project in enterprise IT. Zscaler says AI/ML activity became a persistent operating layer in 2025, and spending is starting to follow the data. The clearest commercial signal is AI Protect bookings crossing $100 million in the last twelve months. That does not prove a lasting category win on its own, but it does show that buyers are allocating real budget to secure AI-enabled workflows rather than only traditional network access.

Why bulls and bears are both focused on AI

Bulls see a fresh control point inside the workflow. Crossing $100 million in bookings suggests AI Protect is moving beyond experimentation and into real purchasing decisions.

Bears are right to note that one product line is not the whole thesis. Even so, the urgency data is hard to dismiss. Enterprise AI usage grew 200% in key sectors, data transferred to AI/ML applications rose 93% to more than 18,000 terabytes, and Zscaler found that most enterprise AI systems could be compromised in just 16 minutes. For organizations that still lack basic inventories of AI models and embedded AI features, that compresses the window to act.

If AI is becoming both a productivity engine and a faster attack path, security budgets should keep shifting toward the places where sensitive data actually moves. Zscaler's early AI monetization suggests it may be one of those places.

Zscaler's moat still rests on insertion point and expansion

The central question is no longer whether Zscaler has a moat. The evidence still supports one. The more important question is whether that moat can widen as security responsibility expands beyond zero trust access.

Why switching costs still matter

Zscaler's core advantage is structural: once customers route users, devices, apps, and traffic through its cloud-native Zero Trust Exchange, replacement becomes increasingly difficult. The company sits in the flow of access rather than hanging off it as an after-the-fact point tool, which helps explain why $3.53B in annual recurring revenue is a useful measure of the business.

Recent operating results reinforce that picture. Zscaler reported $815.8M of revenue, up 26% year over year, and ARR of $3,359M, up 25%. Management has also described an installed base of more than 9,400 customers. When growth comes from a base like that, the moat is not only defensive; it also creates room to sell more of the platform into existing customers.

That expansion dynamic matters because the moat is not just about locking customers in. It is about earning the right to own more of their security spend over time.

AI pushes the battleground beyond access control

Zscaler describes AI and machine learning as a persistent operating layer for how work gets done, with sensitive data moving through more AI-enabled apps and often with less visibility and fewer guardrails. That moves the debate beyond clean "best-of-breed zero trust" framing and toward broader workflow security: protecting the full path from user request, through model interaction, to data return.

Management is explicitly framing the company around that wider job, saying the platform is built to secure the speed and scale of AI and agentic workflows. It is also positioning AI Security, Zero Trust Everywhere, and Data Security as its three growth pillars. That is a broader battleground than classic secure access. If Zscaler wins more of that workflow layer, the moat likely deepens. If it is viewed mainly as an access gateway while rivals capture adjacent controls, defending the premium becomes harder.

Where competition could matter more

That is where competition matters. Palo Alto Networks may not be a pure-play zero trust vendor, but it is at the forefront of the cybersecurity space and covers next-generation firewalls, cloud security, and AI-driven threat detection. The strategic tension is clear: platform breadth versus deep workflow control.

Key signals to watch: - whether expansion remains driven by existing customers, not just new logos - whether the platform keeps converting access traffic into broader security consumption - whether workflow-security categories become standard budget lines or remain fragmented purchases

What would validate or pressure the premium story

The next few quarters matter less for proving that Zscaler has a moat than for testing whether that moat can continue supporting a premium valuation.

Signals that strengthen the case

• Watch whether AI Protect bookings crossing $100 million keep building.
• Watch whether growth remains around the 25% year-over-year rate seen in ARR.
• Watch whether the customer base continues to expand from a base of more than 9,400 customers.

If those signals hold, it would suggest AI demand is feeding the broader platform rather than sitting off to one side.

Signals that could pressure the thesis

• If AI Protect grows but remains a small share of overall wallet share, the market may treat it as early adoption rather than durable monetization.
• If expansion slows inside the installed base, the case that Zscaler owns more of the customer workflow over time weakens.
• If suite competition gains ground, the valuation premium could get pickier before the revenue mix fully catches up.

For now, the investment question is about durable control-layer ownership, not headline growth alone. If Zscaler keeps expanding from its existing base and shows that AI security increases share of wallet, the premium has a real business-case foundation. If AI demand stays more optional than essential, investors may need to wait longer for clearer monetization proof.