Interview with Zscaler Founder and CEO Jay Chaudhry

0:04In 2018, oh you got one product Zscaler Internet access. Oh then private access came. Then digital experience came. They all became Zscaler for zero trustee users. Then we built it for cloud workloads, branches, IoT devices, the platform as they're expanding. So we can know lack of market. I don't worry about competition. Our competition is all legacy stuff. My competition is generally inertia.

0:37That was Jay Chaudhry, founder and CEO of the cloud security company Zscaler. I'm Motley Fool producer Matt Greer. Now, Motley Fool CEO Tom Gardner recently talked with Shadri about entrepreneurship, AI, and the business of Zscaler. Tom was joined by a team of fools, including our chief investment officer, our chief technology officer, and our head of cyber security. Enjoy. Well, hello to all of our Motley Fool members. We're so happy to be able to spend this time together talking about a wonderful company in the public markets that's served as well as investors thus far, and that is Zscaler, a cloud security company that protects people and applications without using traditional firewalls or VPNs.

1:20So Zscaler's applications sit between an individual user and the internet or a company's applications that make sure every connection is safe in a zero trust exchange. The company has a market capitalization of about$39 billion today, which is around seven times higher than when it came public about seven years ago. And we know those numbers pretty well because at Motley Fool and Hidden Gems, we first recommended Zscaler back in 2018, around$38 and$35 a share. We've made more than 50 recommendations of Zscaler over those seven years. We have never sold a share, which is not unusual for us at the Motley Fool.

1:54We really like to focus on the long-term business performance and invest accordingly. But those returns since coming public are about 30 % a year, and that's market beating fantastically. So we get the pleasure of spending the next hour with the company's founder and CEO, Jay Chaudhry, who has spent time with fools in the past. And Jay, I wanted to start with a surprise question. What was the first moment in your life when you realized you wanted to start a company? I know that you have started, I believe, five companies. So you can talk about also when you decided to start Zscaler, but the origin of entrepreneurship for you, where did it come from?

2:28Many people plan entrepreneurship. They have a journey, they plan. For me, I may call it, I'm an accidental entrepreneur. Having been born and raised in a tiny village in the foot of the Himalayas in northern India without electricity, without water, so I had no idea what companies and entrepreneurship is, but I was always a hard-working, good student, got into engineering and came to the U.S. to do my master's, so I thought I'll be a software engineer for most of my life. Like most engineers, the first time I got into entrepreneurship was sitting in Atlanta, reading about this company called Netscape that had just gone public around 95, 96 timeframe, and reading about this young chap, Mark Andreessen, and said, wow, this young guy is starting a company that's going to change the world where you could access information using a standard browser, no special software.

3:33That should be very powerful because it's wonderful. But then I said, if that happens, everyone connects the internet, which means someone has to worry about security, cybersecurity. And that may be an opportunity. And then talking to my wife, I was saying, if this young guy could do a startup, why shouldn't I do a startup? Was the first time idea coming out of nowhere. And it just built upon it. And that's all I moved away from being a business leader in a corporate world, corporate America, to be a startup guy. And you started your first company then, but you have a list of successful businesses you started before beginning Zscaler, maybe just a quick walking tour of those.

4:20And then why, when you arrived at Zscaler, did you say, this one, I believe you said, this one is forever? That's right. So the first company was Secure IT. And for that company, I failed to raise VC funding because I had no experience in any startup world. And since I got passionate about it, so my wife and I talked, we put a life saving line to get the company started to make it more exciting. and my wife quit her job. So there's no turning back, burn the bridges behind was the notion. The company took off. We are very focused. We're very good at what we're doing. So the business took off. That company got acquired in less than two years and everything went so well.

5:08And I said, wow, startups are supposed to be hard. This was easy. This must be a fluke. So let's do it again. And also, you know, you want a bigger challenge in life. And then we said, this time we do not need to talk to any VC. In fact, I said we could only put so much money in one startup, so we should do multiple startups. But do them like raising or having kids. You stagger them one or two years apart. So we ended up starting three companies. One e-procurement ASP using Ariba software that has precursor to SaaS. single tenant application software provider, an email security company called Cypher Trust, and a wireless security company called Air Defense.

5:56Good luck, good timing, great teams. They all became successful and eventually got acquired by large companies. That took me to 2007-2008 timeframe. At this stage, I had no interest in doing one more startup and selling it. I want to do something big, something lasting. And that's where I was looking for what could be the long-term opportunity where we could build a business. And that's where the ideas of ZSkiller came in. Sometimes I got told, gee, how did you come up with that idea? It must be some very creative thing. Not really. It was fairly common sense. If you think about 2007, 2008, internet was a big source of information.

6:44And I've been using Salesforce and NetSuite since year 2001, when each of them was under$10 million in annual sales. But I had used them, I thought SaaS is the way to go. SaaS should take off. And then AWS had just launched infrastructure as a service, compute as a service, storage as a service, which made so much sense. Because why not do compute as a service? And then Apple had just launched iPhone with a big screen. And I said, if we all become mobile and applications are everywhere, where all are you going to keep on building these modes with firewalls? It'll be a crazy idea. So let's think outside the box.

7:28Let's kind of flip the security thing on its head and not do firewall and build something totally different, like a switchboard, a policy engine, where everyone's untrusted. The network is merely the transport. You don't do network security. Those were some of the ideas we thought of. And that's how Z-Skiller was born. When Johann Rall received the letter on Christmas Day, 1776, he put it away to read later. Maybe he thought it was a season's greeting and wanted to save it for the fireside. But what it actually was, was a warning, delivered to the Hessian colonel, letting him know that General George Washington was crossing the Delaware and would soon attack his forces.

8:12The next day, when Raw lost the Battle of Trenton and died from two Colonial Boxing Day musket balls, the letter was found, unopened, in his vest pocket. As someone with 15 ,000 unread emails in his inbox, I feel like there's a lesson there. Oh well, this is The Constant, a history of getting things wrong. I'm Mark Chrysler. Every episode, we look at the bad ideas, mistakes, and accidents that misshaped our world. Find us at ConstantPodcast.com or wherever you get your podcasts.

8:50For somebody who's not deeply knowledgeable about cybersecurity, can you just explain that shift from firewall? Explain what a firewall is. Explain VPN and why Zscaler's view was unique and innovative. Absolutely. So the firewall-based security is generally called castle and moat security. If you need to protect your castle, what do you do? You build a moat around it so bad guys can come in. And then there's one place to get in, and that's the moat has a special door. And they check you before they let you in. And once you're in, you're supposed to be a trusted good party. Okay, now that model worked fine for the traditional world of computers.

9:34Here's your data center, and here are some devices sitting there, and you have a network connecting them. And you want to make sure that if you connect the internet, the moat is a firewall. It's like a door. It's like a gate keeping the data center safe. and then you had to move to 50 offices. Now you're connecting your data center to 50 offices. It's almost like you had a big castle. Then you have 50 small castles. Then you connect the big castle to 50 small castles to tunnels. But once somebody gets inside the castle, they can reach everywhere. That's the problem of the network security, firewall security model.

10:18You're in, you can cause lots of havoc. Now what firewalls tried to do was, oh, if you're worried about that, why don't I create more walls? I have wall here, wall here, wall here, wall here. I'll sell you lots of firewalls. It creates a big problem, maintenance, all that kind of stuff. That's the model I was familiar with. In my first startup, Secure IT, I was actually designing, architecting, selling, supporting firewalls. And I'd seen all the limitations of it. That's why I wanted to bring disruptive idea. Also, you know, I'm a big fan of reading about technological changes. I've always believed that technology incrementally changes all the time.

11:06But every decade or every two decades, there's a step function change. That's what drives innovation. That's what drives business productivity. I'll give you a couple of examples. There used to be an analog world, which did pretty good. Then we had to shift to digital world, digital technology, much better, much cleaner. In the world of software, we used to have application in our data center from vendors like Siebel Systems and the like. Then came Salesforce. It says, why do you have to keep on worrying about buying servers, deploying all that stuff? Connect to me like a utility service and use it.

11:46So those are step function changes. When I looked at the world of IT, I said applications are changing. But nothing has changed the world of cybersecurity. Same old 30-year-old firewall technology. We need to do things differently. Let's not trust anyone. at the end of the day, users need to access applications. How do they make sure the right person can have access to right applications? So I thought of a simple metaphor, an old school phone switchboard. Years ago, if you want to talk to John, you called the switchboard and said, please connect me to John. You are connected. You had a great conversation.

12:32Then you said, oh, I want to talk to the president of the U.S. The switch word said, sorry, you're not allowed to go away. It's really connecting the right party to right party. Such a simple, elegant architecture. Unlike simplicity and innovations, the way I also thought was the service should be simple. We all used to love DVD players. You recall those DVD players? They were wonderful. And then Netflix came around and say, move over. You simply click on a button. You get what you want. That's the kind of service I envision for Zscaler. Jumping ahead to today's challenges, these days everything is in tech is like 99 % AI.

13:18Some of the stuff that a CTO keeps me up is one article specific regarding Anthropic, where they had an AI orchestrated cyber attack that they thwarted. right? So the new innovative techniques, AI is amazing for innovation. It's helped the Motley Fool tremendously, helps so many companies that we're looking at, but it also creates brand new threats that did not exist a year ago. How does that play into some of the things the Zscale is doing these days? So I have often said AI is wonderful, AI is powerful, AI is dangerous. It's almost like any new technology. A knife in the kitchen is a wonderful tool, unless it's abused.

13:57So here are some of the bad things AI can do that makes it very hard for companies to protect themselves. When an attacker attacks, they find a target. It's like a bank robber has to find which of the five branches do I want to break in so they can break in without getting caught. In the cyber world, they find our public IP, My firewall, my VPN, my application portal. It used to take weeks for hackers to find some of those cyber targets for your company. Now you can submit the query to ChatGPT and it can give you a beautiful tabular format of all the firewalls with vulnerabilities in them. Makes it so much easier.

14:45And then often people will do phishing emails. And those emails sometimes could be typos, missing spellings, coming from Nigeria or wherever. Now, ChatGPT can do beautiful phishing email with the writing style of your CFO and coming from your CFO. That's hard. Makes it hard. Three, once the bad guys get on your corporate network using stolen credential with VPN or something like that, now you can use automation of AI. And AI automation can allow you to find mission-critical applications, encrypt them, or do whatever needs to be done and ask for ransom. The entropic attack you talked about, it's essentially hijacking an agent.

15:37Agents are somewhat like people. People have been the weakest link. I believe in future agents will be much weaker link. Because the code can be changed, things can be hijacked. And no, an agent on your network has access to all kind of applications. They can try to do bad things. And the Zero Trust architecture we pioneered at Zscaler actually plays an important role. The Zero Trust architecture, as I described, the switchboard says, everything is an island, everything is untrusted. You come to a check post, you get connected to the right party. If enterprises embrace Zero Trust architecture, these hijacked agents or users whose credentials have been stolen, they won't be able to get past maybe a given application beyond that.

16:30So it's fundamentally very powerful architecture to safely embrace AI security. And there are other aspects of it. But starting with zero trust where agents are only trusted for a given amount of time to do certain tasks and no more is the right way to do these things. I think I'm going to turn philosophical here, but perhaps also because of your remarkable life story, not even dreaming that you would be a software engineer in your earliest childhood years, or maybe even having access to that technology if you'd have electricity and running water in the early years of your life. I guess I'm going to ask a philosophical question about what you think will happen with employment.

17:12We don't have a crystal ball, but almost reaching outside of Zscaler's business for a moment and just thinking, what does the next generation do for jobs? Or what does a mid-career employee who isn't advancing their skills with AI tooling rapidly enough, what does that future look like for you? Yeah. If you think about the past, we learned from the past. every time new technology came, there are people who felt like lots of jobs will go away. When spreadsheets came around, people thought that, man, all these accounting people will have no future. Okay, it was all wrong. I do believe AI is going to create lots and lots of new jobs, but every time technology has come, it needed better skills for people to do a better job or to have a better job.

18:00So my advice to people will be embrace AI, learn skill set, because it's going to create a whole range of new jobs. While everyone is fascinated by AI technology, it's still non-deterministic. It's probabilistic. There are many, many jobs where non-deterministic is not good enough for many areas. So somebody needs to validate all this stuff has to be done. So I am always an optimist. I think technology has always created newer opportunities. I think AI will create new opportunities. But people who are really learning better, doing a better job, will do better. So I encourage people to say, embrace AI, learn about it.

18:48And that's going to create a better future for them.

18:59Then I have something for you. 60 GB 5G in the Vodafone network for just 9 ,99€ a month. With a 50€ change bonus, you serve yourself for 5 months free. Green Flag Alarm. Now finish with your old phone number and get your new new deal on Spasim.de.

19:22A bit of a lighthearted question and a question about the business that you're running. My lighthearted question, well it's quite serious for many people. What recommendations would you have, given your expertise in this domain, for the average person with regard to their own security in the era of rising new technologies? What should somebody be doing in their home that they're not yet doing? So number one risk a consumer at home has is phishing. With phishing, they steal your credentials. So they can go and steal your money from your bank. That's probably the biggest risk for an average consumer.

19:57So one should be mindful of what they're clicking in and whatnot, though it's hard on the mobile phone. It's hard to even see the URL. So good to have some level of software protection for phishing and a number of these software available to make sure your endpoint is safe. That's the number one thing you do. Number two, I think being a little bit savvy to look for some of the things that look silly out there and not fall for them. Just using a little common sense goes a long way. But it's a lot easier than some of the stuff we deal with at enterprise. At enterprises, things are highly targeted.

20:38Nation states are coming after you. Consumers aren't really targeting those big things, but they are a target of phishing so they can go and get you money. And phishing is the most common thing for that. One of the things that I, when talking to investors and our members, of the Motley Fool, try to have members see, I'll express it two ways. One, that I believe mathematically the truth is that if the average investor doubled their average holding period, they would get better returns, even if they'll have some losers in their portfolio. But simply by the act of doubling their holding period, it aligned them more with the business.

21:12Obviously, it's more tax advantaged and there are many other reasons to do so. But when I look at what you've created at Zscaler, and obviously the company came public in 2018, and I mentioned it's up seven times in the seven years. When I run my numbers on the business, and I know you can't comment on this, I believe Zscaler could deliver 15 % a year for the next 10 years. I think it'd be one of those defining companies for this era. And I'm wondering how you think about time horizon. You know, there are institutions coming and talking to you on quarterly reports about your operating margins.

21:41There's, you know, the pressure to be ready to report every 90 days. You obviously mastered that in seven years. But I think many investors would be interested to hear what is the time horizon of the CEO and how do you think stakeholders of the company, whether they're employees, customers, shareholders, how should they think about their partnership with Zscaler to align them to the interests and the activities and the decision-making process of the CEO? So first of all, I look at the opportunity starting with, is there, how big is the market and how serious the demand? Is this product needed?

22:15Is it vitamins or is it a painkiller? It's pretty obvious that cyber is needed badly. There's no such thing as, hmm, I can live without it. So that's number one thing for a market segment. Number two, is the market big enough or is the market small? The market has been growing at a pretty rapid pace. It's being disrupted. You can't even look at the segments you looked at five years ago. So when the market is massive and growing, there's a great opportunity. Then the third thing you look at is, does the company offer a compelling solution which has barrier to entry? With our global cloud bigger with 55 some billion users, over 45 % of Fortune firing companies as our customers, we have proven track record.

23:07One of the things I'm very proud of outside typical financial numbers is our NPS. Net Promoter Score has been sitting between 75 and 85 most of the time. That's remarkable. And NPS of a typical SaaS company generally sits in 30-35 range. So that's being happy, smart customers. I'll give you a beautiful stat. About nine months ago, one weekend, I was sitting at home looking at some of my travels, and I said, I met this CISO and he told me he's bought Zscaler the third time at his third company. And I got curious. I looked at my data and looked at large companies who I generally meet with. 285 of the CXOs had bought Zscaler two times, company A, then they went to company B.

23:5984 had bought it three times. 45 had bought it four times. And they keep on coming. They like us. So having a large customer base with the first-mover advantage that we did is good for us. And then you look at and say the evolving products that we have evolved. And investors used to say in 2018, oh, you got one product, Zscaler Internet Access. Oh, then private access came. Then digital experience came. They all became Zscaler for zero trusted users. Then we built it for cloud workloads, branches, IoT devices, the platform has been expanding. So we get no lack of market. I don't worry about competition.

24:45Our competition is all legacy stuff. My competition is generally inertia. We are changing the world. So we start with people who are progressive thought leaders, then others are coming along. So I think we have plenty of potential opportunities to grow. So my role model has been ServiceNow. I've been working with ServiceNow. One of the board members of Service at ZSkiller was the president of global sales, David Schneider. He has been a mentor and board member. Just like they have done a great job, we have a very big platform and it's growing. So I think we have plenty of opportunities for the long run to keep on growing this business.

25:29and to me personally, Zscaler is not just a business. It's a mission. I mean, when you think about some of the biggest, the big companies depend upon Zscaler so they can keep on doing the business. Wow, the feeling of satisfaction, the feeling of accomplishment is fantastic. And then people say, Jay, when are you retiring? So what do you mean retiring, man? I'm having so much fun. We are in the early stage. We have a lot to achieve and let's go. Thank you for sharing your story and your thoughts and your solutions and your view to the future. We enjoyed it so much and we look forward to talking again in the future.

26:09Tom and Tim, thank you so much. I really enjoyed our conversation. Thanks so much, Tim. As always, people on the program may have interest in the stocks they talk about and the Motley Fool may have formal recommendations for or against. So don't buy or sell stocks based solely on what you hear. All personal finance content follows Motley Fool editorial standards and is not approved by advertisers. Advertisements are sponsored content and provided for informational purposes only. To see our full advertising disclosure, please check out our show notes. For the Motley Fool Money team, I'm Mac Greer.

26:42Thanks for listening, and we will see you tomorrow.