---

---

•	our future financial performance, including our expectations regarding our revenue, cost of revenue, gross profit or gross margin, operating expenses (including changes in sales and marketing, research and development and general and administrative expenses), and our ability to achieve, and maintain, future profitability;

•	market acceptance of our cloud platform;

•	the effects of increased competition in our markets and our ability to compete effectively;

•	our ability to maintain the security and availability of our cloud platform;

•	our ability to maintain and expand our customer base, including by attracting new customers;

•	our ability to develop new solutions, or enhancements to our existing solutions, and bring them to market in a timely manner;

•	anticipated trends, growth rates and challenges in our business and in the markets in which we operate;

•	our business plan and our ability to effectively manage our growth and associated investments;

•	beliefs and objectives for future operations;

•	our relationships with third parties, including channel partners;

•	our ability to maintain, protect and enhance our intellectual property rights;

•	our ability to successfully defend litigation brought against us;

•	our ability to successfully expand in our existing markets and into new markets;

•	sufficiency of cash to meet cash needs for at least the next 12 months;

•	our ability to comply with laws and regulations that currently apply or become applicable to our business both in the United States and internationally;

•	the attraction and retention of qualified employees and key personnel; and

•	the future trading prices of our common stock.

---

---

---

•	Cloud Firewall: Our cloud firewall was designed to protect users by inspecting internet traffic on all ports and protocols, and it offers user level policies, application identification with deep packet inspection and intrusion prevention.

•	URL Filtering: Our URL filtering capability enables customers to enforce acceptable usage policies and protects organizations from users visiting unauthorized websites or illegally downloading content that can increase liability and impact their brand.

•	Bandwidth Control: Our bandwidth control and traffic shaping capabilities ensure that business critical applications are prioritized over non-business critical applications, improving productivity and user experience. By enforcing

---

•	DNS Filtering: Our DNS filtering solution provides a local DNS resolver and enforces acceptable use policies.

•

Advanced Threat Protection: Our advanced protection solution delivers real-time protection from malicious internet content like browser exploits, scripts, zero-pixel iFrames, malware and botnet callbacks. Over 120,000 unique security updates are performed every day to the Zscaler cloud to keep users protected. Once we detect a new threat to a user, we block it for all users. We call this the “cloud security effect.”

•

Cloud Sandbox: Our cloud sandbox enables enterprises to block zero-day exploits and advanced persistent threats, or APTs, by analyzing unknown files for malicious behavior, and it can scale to every user regardless of location. Our sandbox was designed and built to be multi-tenant and allows customers to determine which traffic should be sent to the cloud sandbox. As an integrated cloud security platform, customers can set policies by users and destinations to prevent patient-zero scenarios by holding, detonating and analyzing suspicious files in the sandbox before being sent to the user.

•	Anti-Virus: Our anti-virus technology uses a signature database of files and objects on the internet known to be unsafe and runs traffic through multiple anti-virus engines in a single pass.

•	DNS Security: Our DNS security blocks access to known malicious sites, including command and control sites, and routes suspicious traffic to our threat detection engines for content inspection.

•	Data Loss Protection: Our data loss protection enables enterprises to use standard or custom dictionaries using efficient pattern-matching algorithms to easily scale to all users and traffic, including compressed or encrypted traffic, to prevent, monitor or block unauthorized or sensitive data exfiltration.

•

Cloud Application Control: Our cloud application control allows enterprises to discover and granularly control user access to known and unknown cloud applications. By doing SSL interception at scale, we provide malware protection, data loss prevention and similar Cloud Access Security Broker, or CASB, functions that can be performed inline, for specific sanctioned applications. Business policies can be defined with granular access control for specified cloud applications, such as the ability to upload or download files or post comments or videos based on different user or group identity. We partner with specific CASB vendors to extend their policy controls and visibility of out-of-band cloud applications.

•	File Type Controls: Our file type control allows policies to be defined that control which file types are allowed to be downloaded and uploaded based on application, user, location and destination.

---

•	connect users to applications without bringing users on the network;

•	never expose applications to the internet;

•	segment access to applications without relying on traditional approach of network segmentation; and

•	provide remote access over the internet without VPNs.

•

Secure Application Access: Our ZPA solution delivers seamless connectivity to internally managed applications and assets whether they are in the cloud, enterprise data center, or both. Administrators can set global policies from a single console, enabling policy-driven access that is agnostic to the network the users are on. By creating seamless access to applications regardless of a user’s network, our ZPA solution subsumes the need for traditional remote access VPNs, SSL VPNs, reverse proxies and other similar products.

•

Application Segmentation: This fundamentally new architecture provides capabilities that enable user and application level segmentation, a vast improvement over traditional network segmentation. As each user-to-application connection is segmented with microtunnels, each of which is a temporary session between a specific user and a specific application, lateral movement across the network is prevented which significantly reduces security risk. Similar to CASB application discovery reports for internet applications, our ZPA solution provides granular discovery of internally managed applications to aid the creation of segmentation policies. Because our ZPA solution sits on the application layer and is name or domain-based, organizations can quickly and easily identify the internally-managed applications that are running and then easily provision appropriate policies. Microtunnels subsume the need for internal firewalls, which are required for protecting against lateral malware propagation from machine to machine, and traditional network access control functionality since users are granted access only to applications for which they have permission and are not granted full access to the network.

•

Application Protection: Our ZPA solution initiates and connects together outbound-only links between authenticated users and internally managed applications using microtunnels. Access is provided to users without bringing them onto the corporate network and without exposing applications to the internet. Internally managed applications are not discoverable or identifiable. With no inbound connections and no public IP addresses, there is no inbound attack surface and therefore no threat of DDoS attacks. With our innovative approach, we subsume the need for a next-generation firewall. Similarly, by completely removing the need for an exposed IP address or DNS to the internet, we subsume the functionality of DDoS mitigation systems.

---

•	VPN replacement;

•	providing non-employees with secure access to internal applications;

•	direct-to-cloud access to internally managed applications hosted in public cloud environments, such as Microsoft Azure, Amazon Web Services and Google Cloud Platform; and

•	access to applications following a merger or acquisition by providing named users with access to named applications, without the need to merge networks.

•	Zscaler Central Authority: The Zscaler Central Authority monitors our entire security cloud and provides a central location for software and database updates, policy and configuration settings and threat intelligence. The collection of Zscaler Central Authority instances together act like the brain of the cloud, and they are geographically distributed for redundancy and performance.

•

Zscaler Enforcement Nodes: Customer traffic gets directed to the nearest Zscaler Enforcement Node, where security, management and compliance policies served by the Zscaler Central Authority are enforced. The Zscaler Enforcement Node also incorporates our differentiated authentication and policy distribution mechanism that enables any user to connect to any Zscaler Enforcement Node at any time to ensure full policy enforcement. The Zscaler Enforcement Node utilizes a full proxy architecture and is built to ensure data is not written to disk to maintain the highest level of data security. Data is scanned in RAM only and then erased. Logs are continuously created in memory and forwarded to our logging module.

•

Zscaler Nanolog Servers: Our Nanolog technology is built into the Zscaler Enforcement Node to perform lossless compression of logs, enabling our platform to collect over 30 terabytes of unique raw log data every day. Logs are transmitted to our Nanolog Servers over secure connections and multicast to multiple servers for redundancy. Our dashboards provide visibility into our customer’s traffic to enable troubleshooting, policy changes and other administrative actions. Our analytics capabilities allow customers to interactively mine billions of transaction logs to generate reports that provide insight on network utilization and traffic. We do not rely on batch reporting; we continuously update our dashboards and reporting and can stream logs to a third-party Security Information and Event Management, or SIEM, service as they arrive. Regardless of where users are located, customers can choose to have logs stored in the United States, the European Union or Switzerland.

---

•	Continue to win new customers. We believe that we have a significant opportunity to expand our customer base, both in the United States and internationally. We have invested significantly in our sales and marketing organization to execute against this opportunity.

•	Expand in existing customers. We plan to leverage a land-and-expand approach with our existing customers to sell subscriptions to additional users, additional suites that contain more functionality and a la carte services.

•	Leverage channel partners to participate in cloud transformation initiatives. We have invested in establishing long-standing relationships with global telecommunications service providers and are expanding our network of global system integrators and regional telecommunications service providers.

•	Expansion and innovation of services. We continue to invest in research and development to add new and differentiated solutions to our existing product portfolio and improve the overall reliability, availability and scalability of our cloud security platform.

•	Expansion into additional market segments. We are targeting the expansion of our immediate addressable market, emphasizing U.S. federal government agencies in the near- to medium-term as well as additional international markets such as Japan and the Asia Pacific region.

•	Extend our platform to third-party developers. We intend to open our cloud security platform to third-party developers and vendors to offer new functionality and solutions that may target specific use cases, verticals and niche requirements.

---

---

•	independent IT security vendors, such as Check Point Software Technologies Ltd., Fortinet, Inc., Palo Alto Networks, Inc. and Symantec Corporation, which offer a broad mix of network and endpoint security products;

•	large networking vendors, such as Cisco Systems, Inc. and Juniper Networks, Inc., which offer security appliances and incorporate security capabilities in their networking products;

•	companies such as FireEye, Inc., Forcepoint Inc. (previously, Websense, Inc.), F5 Networks, Inc. and Pulse Secure, LLC with point solutions that compete with some of the features of our cloud platform, such as proxy, firewall, sandboxing and advanced threat protection, data loss prevention, encryption, load balancing and VPN; and

•	other providers of IT security services that offer, or may leverage related technologies to introduce, products that compete with or are alternatives to our cloud platform.

•	delivering security from the cloud regardless of location of the user;

•	platform features, effectiveness and extensibility;

•	platform reliability, availability and scalability;

•	rapid development and delivery of new capabilities and services;

•	ability to integrate with other participants in the security and networking ecosystem;

•	price, total cost of ownership and network cost savings;

•	brand awareness, reputation and trust in the provider’s services;

•	strength of sales, marketing and channel partner relationships; and

•	quality of customer support.

---

---

---

---

---

•	independent IT security vendors, such as Check Point Software Technologies Ltd., Fortinet, Inc., Palo Alto Networks, Inc. and Symantec Corporation, which offer a broad mix of network and endpoint security products;

•	large networking vendors, such as Cisco Systems, Inc. and Juniper Networks, Inc., which offer security appliances and incorporate security capabilities in their networking products;

•	companies such as FireEye, Inc., Forcepoint Inc. (previously, Websense, Inc.), F5 Networks, Inc. and Pulse Secure, LLC with point solutions that compete with some of the features of our cloud platform, such as proxy, firewall, sandboxing and advanced threat protection, data loss prevention, encryption, load balancing and virtual private network vendors; and

•	other providers of IT security services that offer, or may leverage related technologies to introduce, products that compete with or are alternatives to our cloud platform.

•	greater name recognition, longer operating histories and larger customer bases;

•	larger sales and marketing budgets and resources;

•	broader distribution and established relationships with channel partners and customers;

•	greater customer support resources;

•	greater resources to make acquisitions and enter into strategic partnerships;

•	lower labor and research and development costs;

•	larger and more mature intellectual property rights portfolios; and

•	substantially greater financial, technical and other resources.

---

•	effectively attracting, training and integrating a large number of new employees, particularly members of our sales and management teams;

•	further improving our key business applications, processes and IT infrastructure, including our data centers, to support our business needs;

---

•	enhancing our information and communication systems to ensure that our employees and offices around the world are well coordinated and can effectively communicate with each other and our growing base of channel partners, customers and users; and

•	appropriately documenting and testing our IT systems and business processes.

•	broad market acceptance and the level of demand for our cloud platform;

•	our ability to attract new customers, particularly large enterprises;

•	our ability to retain customers and expand their usage of our platform, particularly our largest customers;

•	our ability to successfully expand internationally and penetrate key markets;

•	the effectiveness of our sales and marketing programs;

---

•	the length of our sales cycle, including the timing of renewals;

•	technological changes and the timing and success of new service introductions by us or our competitors or any other change in the competitive landscape of our market;

•	increases in and timing of operating expenses that we may incur to grow and expand our operations and to remain competitive;

•	pricing pressure as a result of competition or otherwise;

•	seasonal buying patterns for IT spending;

•	the quality and level of our execution of our business strategy and operating plan;

•	adverse litigation judgments, settlements or other litigation-related costs;

•	changes in the legislative or regulatory environment;

•	the impact and costs related to the acquisition of businesses, talent, technologies or intellectual property rights; and

•	general economic conditions in either domestic or international markets, including geopolitical uncertainty and instability.

---

•	the development and maintenance of the infrastructure of the internet;

•	the performance and availability of third-party telecommunications services with the necessary speed, data capacity and security for providing reliable internet access and services;

•

decisions by the owners and operators of the data centers where our cloud infrastructure is deployed or by global telecommunications service provider partners who provide us with network bandwidth to terminate our contracts, discontinue services to us, shut down operations or facilities, increase prices, change service levels, limit bandwidth, declare bankruptcy or prioritize the traffic of other parties;

•	the occurrence of earthquakes, floods, fires, power loss, system failures, physical or electronic break-ins, acts of war or terrorism, human error or interference (including by disgruntled employees, former employees or contractors) and other catastrophic events;

•	cyberattacks, including denial of service attacks, targeted at us, our data centers, our global telecommunications service provider partners or the infrastructure of the internet;

•	failure by us to maintain and update our cloud infrastructure to meet our traffic capacity requirements;

•	errors, defects or performance problems in our software, including third-party software incorporated in our software, which we use to operate our cloud platform;

•	improper classification of websites by our vendors who provide us with lists of malicious websites;

•	improper deployment or configuration of our services;

•	the failure of our redundancy systems, in the event of a service disruption at one of our data centers, to provide failover to other data centers in our data center network; and

•	the failure of our disaster recovery and business continuity arrangements.

---

•	a loss of existing or potential customers or channel partners;

•	delayed or lost sales and harm to our financial condition and results of operations;

•	a delay in attaining, or the failure to attain, market acceptance;

•	the expenditure of significant financial resources in efforts to analyze, correct, eliminate, remediate or work around errors or defects, to address and eliminate vulnerabilities and to address any applicable legal or contractual obligations relating to any actual or perceived security breach;

•	negative publicity and damage to our reputation and brand; and

•	legal claims and demands (including for stolen assets or information, repair of system damages, and compensation

---

---

---

•	competition from companies that traditionally target larger enterprises and that may have pre-existing relationships or purchase commitments from such customers;

•	increased purchasing power and leverage held by larger customers in negotiating contractual arrangements with us;

•	more stringent requirements in our support obligations; and

•	longer sales cycles and the associated risk that substantial time and resources may be spent on a potential customer that elects not to purchase our solutions.

---

---

---

---

•	resulting in time-consuming and costly litigation;

•	diverting management’s time and attention from developing our business;

•	requiring us to pay monetary damages or enter into royalty and licensing agreements that we would not normally find acceptable;

•	causing delays in the deployment of our platform or service offerings to our customers;

•	requiring us to stop offering certain services on or features of our platform;

•	requiring us to redesign certain components of our platform using alternative non-infringing or non-open source

---

•	requiring us to disclose our software source code and the detailed program commands for our software; and

•	requiring us to satisfy indemnification obligations to our customers.

---

---

---

•	selling to government agencies can be highly competitive, expensive and time-consuming, often requiring significant upfront time and expense without any assurance that such efforts will generate a sale;

•	U.S. or other government certification requirements applicable to our cloud platform, including the Federal Risk and Authorization Management Program, are often difficult and costly to obtain and maintain and failure to do so will restrict our ability to sell to government customers;

•	government demand and payment for our services may be impacted by public sector budgetary cycles and funding authorizations; and

•	governments routinely investigate and audit government contractors’ administrative processes and any unfavorable audit could result in fines, civil or criminal liability, further investigations, damage to our reputation and debarment from further government business.

•	investigations, enforcement actions and sanctions;

•	mandatory changes to our cloud platform;

•	disgorgement of profits, fines and damages;

•	civil and criminal penalties or injunctions;

•	claims for damages by our customers or channel partners;

---

•	termination of contracts;

•	loss of intellectual property rights; and

•	temporary or permanent debarment from sales to government organizations.

---

---

•	political, economic and social uncertainty;

•	unexpected costs for the localization of our services, including translation into foreign languages and adaptation for local practices and regulatory requirements;

•	greater difficulty in enforcing contracts and accounts receivable collection, and longer collection periods;

---

•	reduced or uncertain protection for intellectual property rights in some countries;

•	greater risk of unexpected changes in regulatory practices, trade barriers (such as tariffs, quotas, duties or other trade restrictions) and tax laws and treaties; for example, the recent tariffs imposed by the United States on goods imported from various countries, and corresponding tariffs from other countries in response, may increase the costs of providing our services;

•	greater risk of a failure of foreign employees, partners, distributors and resellers to comply with both U.S. and foreign laws, including antitrust regulations, anti-bribery laws, export and import control laws, and any applicable trade regulations ensuring fair trade practices;

•	requirements to comply with foreign privacy, data protection and information security laws and regulations and the risks and costs of noncompliance;

•	increased expenses incurred in establishing and maintaining office space and equipment for our international operations;

•	greater difficulty in identifying, attracting and retaining local qualified personnel, and the costs and expenses associated with such activities;

•	differing employment practices and labor relations issues;

•	difficulties in managing and staffing international offices and increased travel, infrastructure and legal compliance costs associated with multiple international locations; and

•	fluctuations in exchange rates between the U.S. dollar and foreign currencies in markets where we do business, including the British Pound, Indian Rupee and Euro, and related impact on sales cycles.

---

---

---

---

•	issue additional equity securities that would dilute our stockholders;

•	use cash that we may need in the future to operate our business;

•	incur debt on terms unfavorable to us or that we are unable to repay;

•	incur large charges or substantial liabilities;

•	encounter difficulties integrating diverse business cultures; and

•	become subject to adverse tax consequences, substantial depreciation or deferred compensation charges.

---

•	a classified board of directors with three-year staggered terms, which could delay the ability of stockholders to change the membership of a majority of our board of directors;

•	the ability of our board of directors to issue shares of preferred stock and to determine the price and other terms of those shares, including preferences and voting rights, without stockholder approval, which could be used to significantly dilute the ownership of a hostile acquirer;

•	the exclusive right of our board of directors to elect a director to fill a vacancy created by the expansion of our board of directors or the resignation, death or removal of a director, which prevents stockholders from being able to fill vacancies on our board of directors;

•	a prohibition on stockholder action by written consent, which forces stockholder action to be taken at an annual or special meeting of our stockholders;

•	the requirement that a special meeting of stockholders may be called only by the chairperson of our board of

---

•

the requirement for the affirmative vote of holders of at least 66 2⁄3% of the voting power of all of the then outstanding shares of the voting stock, voting together as a single class, to amend the provisions of our amended and restated certificate of incorporation relating to the issuance of preferred stock and management of our business or our amended and restated bylaws, which may inhibit the ability of an acquirer to affect such amendments to facilitate an unsolicited takeover attempt;

•	the ability of our board of directors, by majority vote, to amend our amended and restated bylaws, which may allow our board of directors to take additional actions to prevent an unsolicited takeover and inhibit the ability of an acquirer to amend our amended and restated bylaws to facilitate an unsolicited takeover attempt; and

•	advance notice procedures with which stockholders must comply to nominate candidates to our board of directors or to propose matters to be acted upon at a stockholders’ meeting, which may discourage or deter a potential acquirer from conducting a solicitation of proxies to elect the acquirer’s own slate of directors or otherwise attempting to obtain control of us.

•	actual or anticipated changes or fluctuations in our operating results;

•	the financial projections we may provide to the public, any changes in these projections or our failure to meet these projections;

•	announcements by us or our competitors of new products or new or terminated significant contracts, commercial relationships or capital commitments;

•	industry or financial analyst or investor reaction to our press releases, other public announcements and filings with the SEC;

•	rumors and market speculation involving us or other companies in our industry;

•	price and volume fluctuations in the overall stock market from time to time;

•	volume fluctuations in the trading of our common stock from time to time;

•	changes in operating performance and stock market valuations of other technology companies generally, or those in our industry in particular;

•	the expiration of market stand-off or contractual lock-up agreements and sales of shares of our common stock by us or our stockholders;

---

•	failure of industry or financial analysts to maintain coverage of us, changes in financial estimates by any analysts who follow our company, or our failure to meet these estimates or the expectations of investors;

•	actual or anticipated developments in our business or our competitors’ businesses or the competitive landscape generally;

•	litigation involving us, our industry or both, or investigations by regulators into our operations or those of our competitors;

•	developments or disputes concerning our intellectual property rights or our solutions, or third-party proprietary rights;

•	announced or completed acquisitions of businesses or technologies by us or our competitors;

•	new laws or regulations or new interpretations of existing laws or regulations applicable to our business;

•	any major changes in our management or our board of directors, particularly with respect to Mr. Chaudhry;

•	general economic conditions and slow or negative growth of our markets; and

•	other events or factors, including those resulting from war, incidents of terrorism or responses to these events.

---

•	any derivative action or proceeding brought on our behalf;

•	any action asserting a breach of fiduciary duty;

•	any action asserting a claim against us arising under the Delaware General Corporation Law, our amended and restated certificate of incorporation or our amended and restated bylaws;

•	any action to interpret, apply, enforce or determine the validity of our amended and restated certificate of incorporation or our amended and restated bylaws; and

•	any action asserting a claim against us that is governed by the internal-affairs doctrine.

---

---

---

---

---

---

---

---

---

---

---

•	expanding deployment of our cloud platform to cover additional users;

•	upgrading to a more advanced Business, Transformation or Secure Transformation suite; and

•	selling a ZPA subscription to a ZIA customer, a ZIA subscription to a ZPA customer, or other features on an a la carte basis.

---

•

Denominator: To calculate our dollar-based net retention rate as of the end of a reporting period, we first establish the ARR, from all active subscriptions as of the last day of the same reporting period in the prior fiscal year. This effectively represents recurring dollars that we expect in the next 12-month period from the cohort of customers that existed on the last day of the same reporting period in the prior fiscal year.

•	Numerator: We measure the ARR for that same cohort of customers representing all subscriptions based on confirmed customer orders booked by us as of the end of the reporting period.

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

•

Fair Value of Common Stock. Prior to our IPO, the fair value of the common stock underlying our stock options was determined by our board of directors, after considering contemporaneous third-party valuations and input from management. Our board of directors considered this independent valuations and other factors, including, but not limited to, expected operating and financial performance, our stage of development, current business conditions and projections, history and the timing of the introduction of new services, our financial condition and market performance of comparable publicly traded companies to establish the fair value of our common stock at the time of grant of the option. The valuations of our common stock were determined in accordance with the guidelines outlined in the American Institute of Certified Public Accountants Practice Aid, Valuation of Privately-Held-Company Equity Securities Issued as Compensation. After the IPO, we used the publicly quoted price as reported on The Nasdaq Global Select Market as the fair value of our common stock.

•	Expected Term. The expected term represents the period that our stock-based awards are expected to be outstanding. The expected term assumptions were determined based on the vesting terms, exercise terms and contractual lives of the options. The expected term was estimated using the simplified method allowed under SEC guidance.

•	Volatility. Since we do not have sufficient trading history of our common stock, the expected volatility is determined primarily based on the historical stock volatilities of our comparable publicly-traded companies. Comparable companies consist of public companies in our industry, which are similar in size, stage of life cycle and financial leverage.

---

•	Risk-Free Interest Rate. We base the risk-free interest rate used in the Black-Scholes option pricing model on the implied yield available on U.S. Treasury zero-coupon issues with a remaining term equivalent to that of the options for each expected term.

•	Dividend Yield. The expected dividend assumption is based on our current expectations about our anticipated dividend policy. As we have no history of paying any dividends, we used an expected dividend yield of zero.

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

•	Level I - Observable inputs are unadjusted quoted prices in active markets for identical assets or liabilities;

•	Level II - Observable inputs are quoted prices for similar assets and liabilities in active markets or inputs other than quoted prices that are observable for the assets or liabilities, either directly or indirectly through market corroboration, for substantially the full term of the financial instruments; and

•	Level III - Unobservable inputs that are supported by little or no market activity and that are significant to the fair value of the assets or liabilities. These inputs are based on our own assumptions used to measure assets and liabilities at fair value and require significant management judgment or estimation.

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---