Source Report

Customer Base Scale and Enterprise Penetration

Zscaler secures over 9,400 enterprise customers as of Q4 FY2025 (ended July 31, 2025), with executives noting only 4,400 customers out of a 20,000+ target enterprise pool in Q2 FY2026 earnings, implying modest total growth to around 10,000 by early 2026; this base generates $3.36 billion in ARR as of Q2 FY2026 (up 25% YoY), driven by a "land-and-expand" model where initial deployments for users (ZIA/ZPA) hook customers into the Zero Trust Exchange platform, enabling rapid module additions like data protection or branch security that triple spending within 4 years via Z-Flex flexible licensing.[1][2][3]
- 728 customers >$1M ARR (up 18% YoY in Q2 FY2026); 3,886 >$100K ARR (up 18% YoY), representing the high-value cohort driving 85%+ of ARR.[4][5]
- Penetration: >45% Fortune 500, nearly 40% Global 2000 as of Q4 FY2025 (up from 35-40% prior year), reflecting preference for cloud-native SASE over legacy VPN/firewalls in digital transformation.[6][7]
For competitors entering cybersecurity, Zscaler's data moat from 500B+ daily transactions enables AI-powered threat detection that legacy players can't match without years of cloud-native rebuilds; focus on mid-market land to build volume before enterprise upsell.

Key Industry Verticals

Zscaler's customer diversity spans tech (25% revenue est.), financial services (20%), healthcare (15%), and manufacturing (12%), with government via FedRAMP/DoD IL5 authorization enabling federal wins; the Zero Trust Exchange inspects all traffic inline (users, workloads, branches), preventing breaches that perimeter tools miss, as seen in ransomware-targeted sectors like healthcare where it unifies DLP across SaaS/cloud.[8][9]
- Financial: BDO Unibank (Philippines' largest bank) cut ops overhead with zero trust SaaS access; Global 2000 banks upsell data modules for 100K+ users.[10]
- Healthcare: Main Line Health protects PHI/medical devices; Med Center Health speeds imaging access; deployments for 140K-400K users in 7-figure ACV deals.[10][11]
- Government: National Regulator retires hardware for device-agnostic access; 10/15 U.S. Cabinet agencies, 120+ federal customers with $46M 5-year deal.[10]
- Manufacturing: Micron simplifies SSL inspection/threat prevention; Siemens, Johnson Controls, Coats secure factories/OT with Zero Trust SD-WAN.[12][13][10]
New entrants must prioritize vertical-specific compliance (e.g., HIPAA for healthcare, FedRAMP for gov) and prove ROI via hardware retirement savings (~50% support ticket reduction).

Notable Public Case Studies

Public stories highlight quick ROI from replacing VPNs with proxy-less zero trust: Siemens (manufacturing) empowered global factories by ditching legacy security for flexible access; United Airlines (transport) blocks threats scalably; ManpowerGroup (services) modernized remote access in 18 days for ecosystem-wide security.[12][14][15]
- Quantifiable wins: Baker & Baker (food mfg) boosted security 90%, cut ransomware attempts; Baker & Baker 93% faster onboarding, 50% fewer support requests; Jefferson Health (healthcare) auto-remediates cloud risks Day 1.[16][10]
- Expansion examples: Existing Fortune 500 tech firm upsold 40% ARR to $19M via Z-Flex; Global 2000 financial quintupled ARR with data upsell.[17]
Competitors should publish similar stories early; Zscaler's NPS >80 (vs. SaaS avg 30) stems from proven 2-week deployments vs. months for rivals.

Average Contract Values (Estimated)

No official ACV disclosed; rough calc: ~$357K ARR/customer ($3.36B ARR / ~9,400 customers as of mid-FY2026), but skewed by long-tail mid-market; $1M+ cohort (728 customers) averages >$1M, implying ~$500K avg for $100K+ tier (3,886 customers); new logos often 7-8 figure TCV on 4-year Z-Flex terms, with non-seat AI/token pricing now 25%+ of new ACV for consumption growth.[18][19][2]
- Enterprise Security benchmark: $100K-$300K median ACV; Zscaler's land small (ZIA users), expand to platform yields 3x in 4 years.[20]
To compete, price entry low (~$50K ACV) but bundle upsell paths; Zscaler's 98% subscription mix locks in via auto-renewals.

Customer Expansion Dynamics

Customers land with core ZIA/ZPA (internet/private access, mid-teens ARR growth on $2B base), then expand via Z-Flex (>$290M Q2 FY2026 TCV, 65% QoQ growth; avg 4-year terms, 30%+ of RPO); 45% Zero Trust Branch buyers are new logos starting small for upsell, leading to "Zero Trust Everywhere" (550+ enterprises, up from 130 YoY) across users/branch/cloud/OT—non-seat usage (AI tokens, traffic) now 25%+ new ACV, growing 100%+ YoY as AI agents surge traffic without seats.[7][19][5]
- Trends: 66% revenue growth from upsell/cross-sell; record $1M+ ACV deals; RPO $6.1B (31% YoY Q2 FY2026).[4]
NRR stable ~114-115% TTM (Q3 FY2025), down from 121% peaks due to front-loaded multi-pillar bundles/fast upsell (within 1 year), masking true stickiness—high 90% gross retention, >80 NPS.[21][22]
Entrants must engineer "module momentum" like Z-Flex for retention >110%; without traffic-scale data/AI, expansion stalls at point solutions. Confidence high on trends (web-verified Q4 FY2025-Q2 FY2026), medium on total count est. (IR snapshots).

---

Recent Findings Supplement (March 2026)

Q2 FY2026 Customer Metrics Update (Ended Jan 31, 2026)

Zscaler's Q2 FY2026 earnings (Feb 26, 2026) revealed sustained growth in high-value customers amid AI-driven platform adoption: both $100K+ ARR and $1M+ ARR cohorts expanded 18% YoY to 3,886 and 728 respectively, reflecting land-and-expand mechanics where initial ZIA/ZPA deployments (mid-teens ARR growth on $2B base) evolve into full Zero Trust Everywhere bundles, often tripling spend over 4 years via Z-Flex licensing.[1][2]
- Record Q2 $1M+ new ACV deals; Americas closed 2x prior-year volume.[2]
- Zero Trust Everywhere enterprises hit 550+ (from 130 YoY), driving 2-3x ARR uplift per customer via Users+Cloud+Branch modules.[1]
- Z-Flex generated $290M TCV (up 65% QoQ, ~30% of RPO bookings), with 8-figure deals averaging 4-year terms and enabling module swaps/activation for rapid upsell.[2]
For competitors, this tiered expansion signals Zscaler's moat: only 4,400 of 20,000 target enterprises (1,500+ employees) are customers, limiting new-logo reliance as upsells dominate growth (e.g., 70% of FY26 net new ARR organic).[3]

Fortune 500/Global 2000 Penetration Steady at Record Highs

IR site confirms >45% Fortune 500 and ~40% Global 2000 penetration (as of July 31, 2025, reaffirmed Q2 FY26), up from 40%/35% in Q4 FY25 per prior reports—nowhere near saturation with >55% Fortune 500 headroom.[3][4]
- Total customers: >9,400 (IR homepage, steady post-Q4 FY25's 9,400).[3]
This data moat—processing 500B+ daily transactions—fuels AI security wins, where token/usage pricing accelerates initial adoption before platform lock-in. New entrants lack this telemetry, capping their underwriting speed for expansions.

Key Verticals: Financial Services and Manufacturing Lead Q2 Wins

Financial services and manufacturing drove outsized Q2 deals, with AI/Zero Trust modules replacing legacy tools: Global 2000 financial upsold Zero Trust Cloud (ARR to $5M+, up 40%) and data security (ARR nearly 5x via 8-figure deal); Fortune 500 semiconductor new-logo 8-figure AI Protect win.[1][2]
- Healthcare: 7-figure upsells with leading health system/medical provider (GSI-led Zero Trust swaps).[1]
- Others: Global 2000 construction (7-figure AI Protect upsell); Fortune 500 retailer (1,000+ site Branch expansion, M&A enablement).[2]
Public case studies (post-Sep 2025): Siemens (manufacturing, Zero Trust for 320K users/120 factories); BS2/Inter (financial, M&A acceleration); NJ Transit (government).[5] Verticals like finance (23% AI traffic) show highest adoption, per ThreatLabz 2026 AI Report (nearly 1T transactions analyzed).[6] Rivals must build similar vertical telemetry, a multi-year hurdle.

Expansion Dynamics: Z-Flex and Non-Seat Pricing Fuel Upsell

Customers start narrow (e.g., ZIA/ZPA) then expand via Z-Flex (25%+ of new ACV non-seat metered, ARR +100% YoY), tripling initial spend in 4 years: finance/insurance firm tripled ARR (11+5 modules, all Zero Trust); retailer new-logo took 11 modules upfront.[1]
- Net new ARR: $156M Q2 (+19% YoY; organic $139M +7% vs. tough comp), 1H organic +10% (from 1%).[1]
NRR remains elite at 115% (Barclays/analyst note, stable post-Q1 FY26), driven by 2-5x upsells replacing point products.[7] This implies ~70% growth from expansions; competitors with lower NRR (e.g., Cloudflare) face slower scaling.

ACV Trends and Contract Economics

No average ACV disclosed, but Q2 set records for $1M+ new ACV deals (non-seat >25% mix); Z-Flex averages 8-figure TCV/4-year term (~$2M+ annual).[2] Eight-/seven-figure wins standard in financial/manufacturing/healthcare. Entrants undervalue this: Zscaler's proxy data enables instant risk pricing, yielding lower defaults than banks.

Competitive Implications: Massive Runway for Platform Challengers

Zscaler's 21% organic ARR growth (to $3.4B) despite scale underscores data moat superiority—rivals like Palo Alto lag in pure-cloud SSE without equivalent AI telemetry. With 45% F500 penetration and Z-Flex locking 550+ enterprises, focus on non-seat AI (25% new ACV) positions ZS for 24% FY26 ARR; new entrants need years to match expansion velocity.[3] Confidence high (recent data); deeper NRR/vertical ACV research could refine.