Watkins, SVP, Investor Relations and Strategic Finance. Hello, everyone. Welcome to those of you joining us here in Las Vegas at Zenith Live, and to those of you who are joining us online. We really appreciate you making the time to be with us here today. Before we begin, I'd like to remind everyone that today's presentation contains forward-looking statements within the meaning of the safe harbor provisions of the federal securities laws, including statements regarding our future financial performance, business strategy, and market opportunities. These statements are subject to risks and uncertainties that could cause actual results to differ materially from those projected. We take no obligation to update them. For a more complete discussion of the factors that could affect our results, please refer to the risk factors described in our most recent filings with the SEC, including our annual report on Form 10-K and quarterly reports on Form 10-Q. Okay. With that out of the way, we have a great lineup for you today. In a minute, Jay is going to kick us off and take us through the Zscaler platform and also go through some of the new solutions that we announced here today, including those that are securing AI. I know that is an interest for many of you, so we'll be sure to hit on those. Then Dhawal will come up and host a panel with three of our customers that we're really fortunate to have with us here today. They're going to take us through some of their security challenges, their journey with Zscaler, and also take time to answer your questions. Start to think about what you might want to ask. Last, we'll finish up with plenty of time for an executive Q&A so you can make sure to get all your questions answered. Okay, we're ready to get going. With that, it's my great pleasure to introduce our Founder and CEO, Jay Chaudhry. Jay? Thank you. All right. Good afternoon. Great. As Kim said, I'll give you a high-level view of our platforms, on the offerings, what sets us apart from others. As those of you who attended the morning keynote, there may be a little bit duplicate. As we are broadcasting session, I want to make sure the remote attendees also have a big picture view of it. Overall, you think about the opportunity that gets me excited is the massive market opportunity. It has been growing over time, and I'll walk you through how we have over $120 billion serviceable addressable market for us. The need for cyber, the need for the solution we offer, talking about the architecture, what sets us apart, the big picture view of the overall platform, and close with some of the financial strengths. Let's jump into the TAM. I think when we have Investor Day, we'll do bottom up, do some more analysis of it. This is kind of built upon the market sizing we had shared with you before on Zero Trust Everywhere, which is not just the users, it's the cloud and branches. You look at all those things together, it's about a $65 billion SAM, pretty sizable. We lead this area significantly, especially in the user side of it. The cloud is a great opportunity to disrupt the traditional virtual firewalls in the cloud. Branch is an exciting opportunity to eliminate traditional wide area network, traditional way of doing security inside the plants and factories. Data security is an ever-growing market. As more and more data gets created and more and more data sits out there, with AI, the data loss becomes a bigger challenge. We see this as an ever-growing opportunity for us. Agentic ops essentially is largely around SecOps and a couple other areas like IT operations. This market is sizable in the early stages market, but we have a chance to disrupt it. Securing AI is a brand new market segment. We got some serious momentum. We set up AI security as a startup within Zscaler to really build these products. I couldn't be happier with the pace which we are building and developing these products and the traction or the interest we're drawing from our customers. Let's look at the need. You read all this stuff out there every day, so I don't need to walk you through all the stuff. Every day, every week, there's an issue that's happening. Somebody tried to embrace AI. Copilot lost this data. OpenClaw poisons the credentials out there. Some agent deleted some emails, or they deleted some production database. A lot of these things aren't even hacks. They're actually lack of policy, lack of controls, lack of guards. You combine the cyber part of it with some of the guardrails naturally built around it to make sure AI can be used reliably and effectively. It's a huge need. As I talk to so many CIOs and so many CISOs, the number one message comes from them is, we have identified a few pilot programs. We are ready to roll out. We have built some agents. I'm uncomfortable because the governance and controls aren't there. This is an interesting challenge everyone is facing. This is where some of the exchange solutions will come in. Think of the following way. Where were some of these guards and controls and role-based access? Literally as a part of the application. You, as a user, went to the application. Application controlled what you could do. Application parked the data. Now you can bypass the whole application. You go directly to the data. Where is governance? Where is control? Where is all this stuff? An interesting challenge. This is where us being in the middle of it to really do policy governance, that type of stuff will become extremely important. A number of you may have seen this white paper that Anthropic published about a week ago, "Zero Trust for AI Agents." As I read it, I was wondering, huh, did my marketing team write it? It literally felt like what we advocate, what we believed in. The story was very simple. For agents to work successfully, you can't let them roam around on the network. I had done network security. I have a firewall here and I have a firewall there. It doesn't really work. You really need to treat every agent as untrusted entity. Through some policy controls, you need to make sure they only talk to right areas. That's important. You've also been reading about Mythos. So much has been talked about Mythos, it's unbelievable. We have been part of the Glasswing program from day one, early March timeframe. We have been using it. It's pretty effective. It can find a lot of vulnerabilities. The interesting challenge ends up being, how do you fix them? Enterprises already have a large number of unmitigated, un-remediated vulnerabilities. Mythos, or for that matter, OpenAI's GPT 5.5 or Opus 4.7 or 4.0, they're all pretty sophisticated. They're going to give you 5x more. What do you do about it? The answer is not that you're going to double, triple down on just patching. You'll never get out of doing patching itself. The answer is, if opportunities get discovered, they're not patched, it's natural that there will be more breaches than we see today. The next level of question the CIOs would ask is, what else can I do to minimize breaches? I know patching goes only so far. Number two, if we got breached, how do we minimize the impact of those breaches? That's where we actually fit extremely well. Number one thing our customers are doing to prevent breaches is hiding their applications, eliminating their attack surface. In the firewall world, you're out there, you firewall. You can check VPN, all the stuff out there. You scan, you see all these things out there. The way Zscaler was built, you're a proxy service. You're hidden behind us. Nobody knows where you are. Number one thing we can do, our customers are busy working with us doing that. That's also leading to some of the upsell opportunities for ZPA and some of the deception technologies, because they want every user to be able to do Zero Trust when they access any application. The second part ends up being stopping lateral movement. Otherwise, a single infected machine in one branch can infect everything else out there. Not a good idea. What if that could be contained in the branch itself? We do that extremely well. Those are the two best defenses that our customers want. We are working with the leading model companies. As I mentioned, we're part of Anthropic's Project Glasswing. We're also part of OpenAI's Daybreak. It's good to work with them because they actually are helping to bring the applications to the market. We become an important partner to make sure those applications can be securely used. Okay. The whole notion that these model companies are going to eliminate, or SaaS uplift will happen, or cyber will disappear. If you dig into Mythos a little bit, Mythos will finding more vulnerability. That means there's more need for providers like Zscaler. The notion that these guys will go and do that stuff is really unfounded. The other part is, a provider like Zscaler, we have a global infrastructure around the globe. There's 160 exchanges out there. There's a public, and there are quite a few private exchanges meant for certain customers. Okay. An agent is not going to go and create all of the infrastructure for you, connection, network, traffic routing, all that stuff. It's a fairly complex and sophisticated area. That's why we feel like the need for us will grow, because the more agents you have, the more policy enforcement, more inline inspection you need, which is important because then we can help our customers and it creates a revenue opportunity for us. Okay. The platform is meant for, this seemed like Zscaler's moment. We built this platform for stuff like this. We built, we evangelized this stuff. When COVID came, the market realized that, "Oh, we need something like Zscaler." That was a big moment. We think this moment is almost like COVID because, in fact, it's even bigger from cyber point of view as everything is online, everything is digital. That's the platform we built. Just to refresh your memory on what we built, what we're doing. On the left side is what you see. This is a typical corporate network. Everything connects to everything. Every office connects to every office. Every IoT device, OT device is connected because otherwise you can't communicate. When you do VPN sitting at home, you're all part of the same network. Your network extends to every household. This is primarily the biggest reason of the problems. All these firewalls sitting out there, they become fairly porous. They try to do segmentation with it. When they find, oh, this source IP to this destination IP, well, these three users need this, they need this, then you know what the rule becomes? Any to any. It essentially becomes an open thing. That's why we need to move away from the world of firewalls to the zero trust world, where literally everything is literally an island. They simply connect to the internet. We are the exchange. We are the switchboard, making sure the right party can talk to right party only. That's fundamentally what we're doing. When people talk about this SASE vendor or that SASE vendor, all the SASE vendor is doing spinning up virtual firewalls in the cloud, fundamentally. There's no zero trust in it, okay? If the people think that they don't need zero trust, then the firewalls are fine. Part of the reason why firewall companies will not do real zero trust is because it cannibalizes all the firewalls. When we go in, tons of firewalls are taken out. It's not in their best interest. It's just like telcos were fighting, not eliminating MPLS. They'll go out and tell their customers, say, "Don't do this because there's no quality of service." None of that is there. Guess what? Secular forces are very powerful. Similarly, I believe that the Zero Trust is a secular trend. That's the only approach that's needed. That's what we pioneered, that's where we have far meaningful lead. Others can't even try to do it because it's not in their best interest. Here. The other thing, I often get asked the question and say, "Oh, SASE this, SASE this, SASE this." When others talk about SASE, they talk about secure access to users. The area we pioneered when we started with Zero Trust, any user can have access to any application from anywhere without being on the network. We aren't standing there. We moved on to do Zero Trust Branch. Every branch is an island, very important area. Doing Zero Trust inside the branch for every device. An infected IoT device in the plant or in a factory can infect other devices. Very important. Otherwise, imagine if a plant goes down, it's an important area. Zero Trust Cloud is about cloud workloads. Fascinating story. Amount of workloads in the cloud will keep on growing, and AI will further accelerate the development of these workloads out there. How is this cyber done? East-West firewalls, North-South firewall, these are virtual firewalls. This source IP address can talk to this destination IP address. Not very exciting, not very manageable. This is where we come in and say goodbye to all these virtual firewalls, and we can do true Zero Trust in the cloud. Very exciting area and growing very well for us. The most exciting announcement for us this week is Zero Trust for AI Agents. This is fantastic. As I said during my keynote, literally about probably about 70% of the pieces we need to Zero Trust for agents were already there. Think of it. Agents are like people. They're digital workers. We already have technology to do that. Agents are like code. We've done it for workloads. We got all the pieces, the policy engine, the logging, reporting and all. It's all there. I'll come back to cover that a little bit more. All this Zero Trust Everywhere is done to really achieve four key areas. Security of AI, how do we secure all the AI application infrastructure, data security, cyber protection, and Agentic SecOps. Let me dig a little bit deeper into each of these. Security of AI. This is what every customer is, wants, looking for to start with. Every customer wants to know what AI assets do I have? Where are they? Do I have the endpoint? Am I using externally, for example, public AI applications? How are my private AI models, private Bedrock, whatever the case may be, or what's on my endpoint? We brought together all of this as one dashboard, being able to give you a full view of all assets for AI, no matter where they are, and along with the risk they pose. It's important. Every company talks of having AI asset management. An EDR vendor, when they talk about it, they're going to tell what's on the endpoint because that's what they said. They have no idea of what communication is happening where. They can't tell you the public AI. They can't tell you the traffic. We're sitting in line for cloud or internet. We're sitting on the endpoint. We're able to give you a full view of it. Second area, secure AI access. This is for your employees. Which employees should be able to access which AI applications? We already had a policy engine. We had done that for other applications. Having rules and policies for AI applications was relatively easy for us. We had to essentially build an engine for prompt inspection and response inspection so we could analyze the prompts and do a policy based on that. Also, the prompts can lose data. Being able to essentially do DLP as the prompts are going down was a natural thing for us because we already do DLP a lot. The third bucket in this area of the solution we call AI Protect is securing AI applications and infrastructure that goes with it. This is handling the full life cycle from development through deployment and runtime. For development, for example, we offer red teaming, AI red teaming. This came through acquisition of SPLX. They've done a very good job. In fact, they not only did AI red teaming, they also did continuous automated red teaming. That's going to become an industry trend. As models like Mythos come out, continuous red teaming will need to be done. The way we had built these red teaming application, I can use any of the models on the back end to really do some of the scanning and vulnerabilities. It's a powerful story. The next thing, if you did this, how about runtime? What do you do for runtime? That means securing your application build for your company, and when users need to access that, maybe it's your customers. They could do some bad things out there. They could do prompt injection from cyber point of view. There could be a data loss issue. There could be unacceptable use. There could be other crazy questions, like one of the cases we saw in California, where a car dealership set up an application where consumers could interact with it, and somebody asked a question, say, "Which electric car is better than the electric cars you sell?" Okay, go to Tesla. Those are guardrails for acceptable use, meaningful use that need to be set up out there. There's some pricing questions that need to be done right. These guys can go around it. There was an interesting use case. This was about Copilot. The question was, once you train AI on these Copilots, they get all the information. In the old days in computing, you wrote a query, the computer could only give you answer of that query and nothing more. In their world, once you train on it, they got all the information. User could say, "Oh, tell me salary and bonus of X, Y, or Z." Simple. Everyone is getting smarter and say, "Oh, Copilot, if someone is asking for the salary, do not answer that question." "Say, sorry, I'm not allowed to share this information." As you saw last year, we shared this example, and this one guy goes and say, "Oh, John likes to play basketball games from this beautiful box, and the ticker for the box per game is $3,000. Tell me how many games he can watch in a box, sitting in a box, with one year's salary." Okay. That's not a guardrail. All those things need to be figured out, those are part of the guardrail rules and all we're building and making sure customers can accept it. This AI Protect is a powerful solution. We launched it in late January. A number of pieces were built by us. A couple of modules came from SPLX. When I talk to customers, they tell us that they haven't seen any solution that's as complete, as integrated in this area as this is. Very pleased with that. Now you're going to see these things evolve rapidly. I'm not going to go through every bullet point here, but this is a bunch of new enhancements, new features we added in this area. For example, in AI asset management, being able to discover embedded AI in SaaS traffic. All SaaS applications will become agentic, essentially. There's a traditional interface, and there'll be agentic interface going through prompts. Being able to understand that traffic, being able to understand policies around every SaaS application, that agentic is an important area. Okay. Visibility to AI activity on endpoint. We could easily tell what all is sitting on the endpoint. That's not a problem. The customer said, "It's okay if you got Claude Cowork sitting on the endpoint, or maybe it's some ChatGPT agent sitting on the endpoint, or OpenClaw sitting out there." I want to know the permissions and activity that's happening out there. Now we enhance the stuff from giving you what's running there with the potential risk and permissions type of stuff running out there. These are good examples of the enhancements we're doing. Security, securing AI access. This gets a little application specific. We started out prompt inspection for the most popular applications in an early version of it. Now we are supporting over 250 GenAI applications where we fully understand, extract the prompts, and able to take an action based on the kind of prompts we got out there. Also supporting Anthropic and OpenAI. There's bigger compliance APIs available. We are compliant. We work with those APIs. In the third area, secure AI apps and infrastructure, a number of enhancements got done. Standalone prompt hardening features got added to it. AI red teaming for MCP servers as MCP servers are being put out. You're going to keep on seeing the velocity of innovation, velocity of development for us to make sure we stay ahead of anyone else in this area. The next big thing is really Zero Trust AI Agent. This is one of the hardest problems to solve. This probably has bigger barriers to entry for any new entrants than any other area out there. Without going detail into it's essentially a version of essentially that Zero Trust Exchange we built, but new things we needed was AI Brokers, brokers for MCP, AI protocols, broker for A2A had to be done. Understanding the task as assigned, understand the intent, the risk, being able to extract prompts, analyze it to understand intent and risk gets from there. Ability to do those things become important. Essentially allow or deny policy. It is the only real way to be able to handle it. Our view is that as agents get deployed, there'll be so much things. It's not even the agent level, it's an invocation level that need to be figured out. That means scale, that means granularity needs to be handled. We already do about 750 billion transactions a day. We think in this new world that we'll have to add a couple of zeros to it in terms of how much volume needs to be handled. We feel pretty good about it. Having the architecture, having the scale, having the experience to be able to handle it. Inline is not a trivial thing. Anything you do inline, it better work, because otherwise people can't do their job. Anything you're reporting and on, if it doesn't work, you don't get the right answer, people don't even know most of the time. That's why being able to have great response time, great scale, is fundamentally important to us, and this is where we are very well positioned, far better than anybody else out there. The next problem, this is a fascinating problem. This is an example of a solution our customers weren't clamoring for on day one. Okay. We like to do that. We like to think what will be needed in a year or 18 months. I want to work on it today. I want to cook it. I want to refine. I want to get better than anybody else. What is this? This is AI Access Graph. Now, Access Graph is not just needed for AI, it's needed for other entities, too. Symmetry Systems, the company we recently acquired, solved this problem. It's a very hard problem. Many other things, if you ask me, asset management and all, is that a rocket science to do? Not really. You give a couple of quarters and three quarters, you can just build it. Solving the problem of taking all this metadata from all the application to understand in your enterprise, in your corporate network, which identity, which entity is reaching which data source, which MCP server, which application, is a nightmare. Because they just get on the network, they are here or you're here. You literally have information sitting in each application about what access happened. Symmetry pulled all that metadata, pulled it out. This is billions and billions of data points. Now that the magic of AI to figure out these entities are accessing this, the data source, the data lineage, they call the graph, because this is important. Now, why is it important? Number one reason, the customers were looking at Symmetry, and the large customers are looking at Symmetry Systems, is to understand the lineage, and from there then to understand data governance. Even the issue of SOC compliance. How do you do SOC compliance? You have to prove that you got all these controls in place. Those controls are actually through applications. When applications get moved aside, you go directly to data. How do you prove SOC compliance? That would be impossible. This kind of solution can help you prove what's talking to what's going on. That's how Symmetry was positioned to sell it. As we saw this technology, we said, "Wow, this is great." In the agentic world, the data will go 10X, 100X. It'll be impossible to do something without something like this. First we understand the graph, we use this information to apply policies for Zero Trust Exchange to be able to see with this group of agents, and have this group of applications or this group of data sources. That's what's exciting about it. It just also shows the DNA of Zscaler is to be innovative, to do things far ahead of others, and set the pace out there. This is our overall platform story. I won't go in detail out there, but the list of innovations in SASE is long. Every year, we do probably about 200+ features in the ZIA, ZPA space out there. Browser extension, enterprise browser availability. It's a specific use case. We needed some of the extension area. We did a tuck-in acquisition of SquareX. It did very well. B2B Exchange is an exciting area. Supply chain is a big risk. The only competition we have in that space is 30-year-old site-to-site VPN connection. That's a problem. AI-powered segmentation or application. This group of users can do this group of application. We further made it simpler. We have been doing for some time. Z-Agent framework. We created an overall framework, where our agents can be for each product, each area, they work on the same framework. I think we are going to cover some of that tomorrow in Adam's session. As far as agent for ZDX, for example, which can do all the stuff that people are trying to do. It's all automated. You're going to see all products of Zscaler having the agent interface to be able to engage with our products across the board. Agentic SecOps, it's a new, exciting area for us. We have been building the technology internally. We got Red Canary technology, as a result of that, we are going to really announce we have two product areas. Threat management, this is traditional security operations, exposure management brings together all the exposure area, your attack surface, your asset risk management, and so on and so forth, type of stuff. This is built on some pretty solid technologies where we can take data from all kind of sources, including Zscaler sources, we got a bunch of techniques and behavior-based analysis and all the mapping are done, context graph we create here to identify real threats. This is an exciting area. This is also being launched this week, you're going to see it grow every month as we move through the fast pace. Wrapping up the last couple of points, a number of questions have been asked for pricing, user-based versus non-user-based pricing. We started out very early on with seat-based pricing, as we evolved, things have grown. For example, Zero Trust Branch, it's based on number of devices and the traffic that's from the devices. Zero Trust Cloud workloads, the number of workloads and the traffic from those things. Data Security had eight module. Only some of them are linked to a number of people. Others are based on the amount of data they are scanning, the data they are classifying. As you'll see, Agentic Exchange, all of that stuff will be based on agents, amount of traffic, which essentially leads to the token consumption, essentially consumption-based model. We're seeing our new business ACV coming from non-seat nicely growing over time. About a quarter ago, we disclosed about 25% of the new ACV came from non-seat, last quarter in Q3, that number moved up to 30%. We don't think we have as many meaningful exposure based on seats because our model is expanding, our platform is growing pretty rapidly. Lastly, our scale. You know the numbers, but to summarize, just to let you know, we crossed $3.5 billion in ARR. We got plenty of runway. Out of some 20,000 enterprises we target, about 4,500 are customers. That means remaining are prospect for us to pursue. There's good opportunity for new logo. Also in the big areas, AI Protect that we just launched in January. We crossed $100 million over the last 12 months. There are a couple of modules that were there, like GenAI Security is part of it, but a lot of stuff new. Most of the stuff is picking up very nicely. Data security is growing very well, is going to keep on growing very well. We have half a billion dollar crossed in ARR and over 30% year-over-year growth. Zero Trust Everywhere is what sets us apart from others, will set us apart for a long, long time. We started sharing with you the number of customers in Zero Trust Everywhere. About a quarter ago, that was 550, and now we crossed over 500 enterprises who do Zero Trust Everywhere. That means they got Zero Trust users, Zero Trust Branch, and Zero Trust Cloud. With that, we're going to start the next session, this is our customer panel that Dhawal Sharma is going to moderate. Okay. Good. Great. Thank you. Dhawal. Great. One second. All right. We will take about 20 minutes for a discussion between us, the speakers that are here with me, our customers, we'll then open it up for you to ask questions as well. Since we have three very esteemed customers who have joined us here, why don't we start with you, Wayne, go around get an introduction about you, your roles, how long you've been using Zscaler, what problems we are solving for you. Wonderful. Thank you. Good morning, everyone. Thank you for having me. Wayne Fajerski, with Edward Jones. Been there 25 years. Deputy CISO responsible for enabling the firm securely. I'm responsible for all the enterprise security architecture products and solutions. Been working with Zscaler now since 2010, really grown up with Zscaler. Use a lot of their key core products, ZIA, ZPA, ZDX, CASB, Browser, even touching now into the AI products. Jason. Jason Koler. Been with Eaton for 10 years. I'm the Deputy CISO there. I've been a Zscaler customer since 2019, 2020, where we utilized them to help secure our workforce during COVID. It was a great investment that we made there to be able to secure our workforce in a very short timeframe. I am responsible for incident response, threat intelligence, and security engineering. Really the services that help keep Eaton safe. Thank you. Mustapha Kebbeh, I'm the Chief Security Officer over at UKG. I've been there about four years now. Zscaler has been one of the strategic partners that I've always leveraged, and I've used it not only this company, but the prior company where I spent about eight years at Ring. I've been a customer for Zscaler for over a decade now. I think 2015 is when we started using Zscaler. It's been a good time. I'll start with you, Mustapha. You heard some of the innovations we have been talking about, and you guys have been a great sounding board for us. We build all the products in deep partnership with you guys. Going around again, what are some of the most interesting innovations that you see that announced today, and which is your favorite part? Absolutely. I think it's been always interesting to see the innovation that Zscaler is looking at, either through acquisition or just organic growth or building internally. The SPLX, I think, is a very important piece because I was also a customer of SPLX prior to acquisition. Seeing that blend in and why we actually went that route and making sure that we're able to test our products because Zscaler being a customer that provides AI software and software to customers, being able to test those and validate those is really key for us in terms of how we really look at it. I'm super interested about the AI piece because I think it changes the game, combining data, the AI graph, and the access. I think that visibility, it's a gap in the market that I think it's huge. Jason? Algorithm. I think the AI piece is the big area with the way companies are pushing AI to use it, to make it work in your environment. The expansion of how they have visibility into what not only your employees are doing with AI, what your third parties are doing with AI, and even what you're developing. I think that's a potential game changer there to get visibility across all those environments. Yeah, I sound like beating a dead horse here, AI is everything for us right now, right? I think the AI observability, when we're talking about managing risk, right, we talk about shadow IT. It's really shadow AI. I can't secure, I can't put a control, I cannot govern, I cannot enforce policy if I don't know what's going on. Super important to me. The AI, I will just say the maturity is so fast, right? Like we talked about 18 months ago and some of the things that we were doing compared to what the solutions that are being offered today by Zscaler. As I said earlier, we stepped into this and are running through the implementations as we speak on some of these prompt things and things that are going on. It's a game changer. We have to have visibility to manage risk. Talking about specific scenarios, Wayne, I'll start with you. As you said, you've been a long-term customer of Zscaler. I remember working with you 14 years ago, talking about the benefits of local breakout. This has nothing to do with Zero Trust Branch, but MPLS backhaul from your thousands of retail stores. You adopted ZIA with the primary benefit of not doing backhaul of traffic and doing local breakout. Exactly. That architecture has been evolving now to the point where there are appliances that give you Zero Trust within the branch as well. How have you seen that evolution in 15 years, and how has Zscaler technology evolved per your expectation in that time? Yeah, it's amazing. 2010, already 2026. I feel like we've kind of grown up with Zscaler. You think about when we started with Zscaler in 2010, what problem were we solving? Backhaul traffic, right? How did we do that? We didn't want to spend more money, do all that. We have 16,000 plus branch offices across North America, it's a lot of traffic being passed around. We really sat down with Zscaler and it started off as really, you think about it's a point solution where Zscaler is not anywhere near it is today, right? The size and scale. I feel like we've really taken that same journey and growth with Zscaler. You talk about the original internet, the URL, the protection inspection to really what turned into cloud, right? When you jump into the cloud area and we talk about when we remember working early on with CASB, DLP, what's going on and how we've matured into that next generation of what I call technology into the cloud from a simple internet world that we lived in. I've seen that growth as we've gone with Zscaler. What I think is always important is what was a single solution is what I would call a strategic partner today for us at Edward Jones with Zscaler. I think fundamentally what you see is they're either one step ahead of us or we're pushing them to develop the next technology. I think what you can see is to be a strategic partner, we needed to create that ecosystem with them and moved along quickly with them. I think the number one thing I talk about all the time is does our vendor understand what business I'm in? I'm in a financial service business. It's about availability. I got to trust, right? I need to understand. I got to answer to regulators. All of those technologies and solutions as we partner with them and they delivered the solutions to us, Edward Jones, it's really transformational as you look at it, and it talks about reducing complexity. I think that's one of the biggest things we get from Zscaler is really getting in the middle, providing that Zero Trust, and being able to get in the middle and be able to do what we need to do, govern, put policies in place, enable the business securely. I think when you look at where we've come and now we're into what I think is the next generation, not last generation, maybe for me, we'll see. What we really talk about is this last one is AI. So you've seen how we've gone from internet to SaaS world to now AI, we're talking about what are the security controls are going in. It was just natural for us. We could have looked at a third party, and we did. We always do. Can you meet the requirements? Are we already implemented in that space? Can I reduce complexity? Do I really want to bring in another third party into the conversation with me? Do I really want to support another operational system? The answer is no, I don't, but I do need to make sure that they meet our requirements. If they meet the requirements and exceed and help us create a better performance financially, economically, and to meet the regulators, it's been a great solution, a great partnership with Zscaler. For 15 years, I believe we've built that journey and what today is truly a strategic partnership. Fascinating. Loved working with you over the years. Jason, moving to you. As you said, you started your journey with us during COVID, securing your users. As we started building our Zero Trust Branch solution, right, one question that everyone asks us when they start their journey is: how is it different from my SD-WAN, right? With you, we started working on this concept of Zero Trust factories. You have multiple factories deployed with Zero Trust appliances now for segmentation inside and with Zero Trust Everywhere. We are also replicating the same framework in Zero Trust bank branches, Zero Trust hospitals now. How did you internally build the justification for Zero Trust Branch or factories compared to SD-WAN, which is easier to deploy sometimes, or things that networking people understand well? How did you build that internal mind share? I will tell you this. It was really based on making sure that the sites were secure. As a manufacturing company, we can't have downtime, similar to what Wayne was talking about, but even more. Our production and our plants need to keep running on the SD-WAN, it provided us with the security that we needed all the way down to the device. We are really looking as we deploy this and put it I think we're probably about 100 or so factories in, to really make sure not only are we securing it at the network level, but at the device level and making sure that everybody has the right access in the environment. I think we're on this two-year journey now with Zscaler. They have been a really great strategic partner throughout this entire process. We've been learning together, we've been able to really make great headway when it comes to securing our plants to where we feel very much comfortable with if something does happen, we're able to isolate it and secure it moving forward. Right. Mustapha, I have discussed similar ideas with you. As you said, you're a returning customer. Your previous company had the same side of assets, which we discussed about securing with this Zero Trust Branch architecture. Shifting gears into your current company, you actually have been using a couple of our acquisitions, as you mentioned. Both SPLX, you were a customer, Symmetry Systems, you were a customer with them as well. You have provided your input feedback as we were doing validation and diligence in these companies on why you like these companies. One thing I remember, you sent an email to Jay and I saying, "You guys are on the right path with some of the acquisitions you're making and connecting the dots." I would love for you to tell us how you articulated that story that you shared with us. Absolutely. No, thank you. When I see some of the things that were happening, I think as a customer of one SPLX, I'll give you an example of we're building software, we're testing the AI agents. We want to give it to 80,000 customers of UKG. What we wanted to be able to do is have a fully automated testing capability that tests some of our AI agents. This is not just pen testing. This is we want to do different types of tests. We want to do sentiment tests. We want to do validation tests. We want to do the security tests. That's a key component in terms of how do you support for that. The second thing is what are we actually protecting? We're protecting data, and we want to make sure that we understand identity. This is where Symmetry came into play in terms of when we bought Symmetry and UKG's, how do we make sure we connect those together? Having access to the data. Who has access to the data? What are they doing, and what actions are they taking? Combining those things give me that visibility. The third thing was if you tie that to what Zscaler does in where it sits, the visibility, combining those three, now you just have the full visibility of an end-to-end product stack. That's why I said you guys are on the right track by connecting these things together. Not only you have an agent that sees traffic going from the endpoint to the internet, you also have the visibility at the browser level. You have the DLP that talks about policies that changes, hey, who can do this and who could not do this? What data can they touch? Can they touch my payroll information? Do they have the rights to touch that information? If you combine all those things together, you've just created a whole different game. I'm super excited about the developer side because I think that's a whole different game. If somebody's writing code in Claude Code or you're using GPT or whatever Codex, that policy, the single policy agent is just powerful. I don't have to go look for another product, and I think that's the key. I want simplicity, but a platform, less platform, one or two that I can build my security around. Got it. This is very insightful. Couple questions. I know we have five or six minutes left before we pass it on to the audience. Wayne, you are in financial services. Frontier AI labs came up with the models that are finding vulnerabilities at lightning speed. They are looking at how new attack chains are created, finding a lot of things that were exposed out there, but now saying how badly they are exposed and how they can be exploited. We believe Zero Trust is the right way to stop those exposures from being visible. How has your security approach changed in light of these frontier models doing what they're doing in recent time? It's crazy how fast things are moving out there. I couldn't agree more. It starts with trying to hide the attack surface, number one, right? Let's not look at that. The reality is we're all trying to patch, we're all trying to do vulnerability management at crazy amounts of it. I think what you're finding out really quick from all of these new models that are coming out exposing these vulnerabilities is two things. Where you used to be able to just focus on criticals and highs, it's not only creating new, it's taking what we would call medium and lows, and it's starting to patch these things together and move very, very fast. I think the reality for us is, everybody, in the words of patching, is we're going to have to automate more, right? It's just inevitable, right? You're going to have to have machine learning versus machine learning, AI versus AI. It can't be human versus AI anymore. We're not going to be able to keep up, right? It's just not possible. When we look at in the financial services industry, I can't express enough that with all the different regulators that are coming in, they're challenging us. They're already asking these questions. If, look, any one of these, NIST, SOX, take your pick from out there in the world, we're being challenged constantly is, how are you handling this? Of course, they know about all this, so they're asking the tough questions, right? They've increased the number of questions in a compliance space around AI. How are you controlling and how's it exposed? More specifically, the focus is changing from a regulator perspective. Without these type of models and things that we're getting and really trying to, say, block the attack surface, understand what the visibility is, we need to prioritize, right? We need to find out what that is. We need to be able to fix it. Not all can be fixed, There's the mitigating controls. It's fast-paced. We're going to have to do what we can do to protect and prioritize. Mustapha, from your side? When you think about the scale of remediation that's going to happen, Even today with the existing things that are happening, you need to buy time. I call it being able to have segmentations and using the zero trust model to really isolate what's critical, Then focus on the most important thing in giving you that time. I think that's super key in every organization. Anyone can't fix all of the problems you're going to have, You need to be able to prioritize. I think with Zscaler, that gives you that capability to actually isolate your network, segment the critical areas, and segment areas that are just users out there, so that you can maintain and have a better understanding. We've been talking about this in UKG, like how do we think about the camera system? How do we think about the office, the conference room devices that are in our network? This is huge, If you need to patch all of that in a day, what are you going to do? Yeah. Those are the components of taking stock to really reduce the attack surface. All right. My last question, I will start with you, Jason, is on how you are thinking about the AI security spending. Is this coming from your existing budget, or you are reallocating budget for securing AI as new use cases emerge? How are you building this justification and the security budgeting inside? Yeah, I think it's a combination of the growth of AI. In a company like ours. You have to put budget in to secure it as well. We're also getting the incremental spend in cyber as well because the company overall understands the importance of this and be able to deliver on a secure AI environment. Wayne? I would agree. Right now, it's not cutting anything. It's an addition to the budget at this point in time. We know cybersecurity AI is something new and that we're adding to the budget at this point. I think it's a combination of both. It's a reallocation and then finding the right investment for additional security. These are great insights, and actually on the Zscaler side, what we are seeing is while we work with the cyber practitioners like yourself, we are also engaging more and more with Chief Technology Officers, organizations who are building apps, and they are saying, for example, "I want to embed AI red teaming more in on the shift left where developers are building apps." We are working with this new emerging role of Chief AI Officer, which sometimes is in data world, sometime in AI specific role, where they are looking at the whole lens of how they are enabling AI and new budgets are created. As you create more budget for AI, you need to secure that AI as well. For example, SPLX access inside our product. Okay. Different from the enterprise. Yes, it's a mix of both, and sometimes you have to do that. Great insights. Thanks for sharing your journey and your insights with us. We have about 16 minutes left, I'll open it for the audience here to take questions. We'll start with you. I'll randomly pick. I'll go across the room, let's go. Thank you. This was all really good. I actually have three questions. I'm going to ask the one on the last thing you just said. I think all of, well, actually, Jason and Mustapha said that AI security budget was going to be at least partially come from reallocation from other areas. I'm just curious, what are those other areas of the parts of traditional security that you can take from? What's most at risk? It's actually not coming from security, it's coming from the business, because they understand the value that security's going to provide to them to keep the AI that they're creating safe. We're not taking anything away from IT or security itself. Okay. It's just additional funding that's coming in from the business. No more free lunch. Mustapha? Just curious. Yeah. For us, I think it's some reinvestment in terms of areas. When we think about all our security stack, what security stack do we have that's below in lack of controls, or it's not actually giving us the control we want? This is something we evaluate annually and say, if we can increase our security controls on AI stack, because it's the most imminent, we need to move some of those. It could be we are doing pen testing, for example. In this case, can that be allocated for prevention control instead of just testing? Some of the things that we're evaluating. Great. Thank you. All right. We have the question in the front here. We'll move here. I think here, in the front. We see the raised hand. Can I ask you to please state your name and company name before you ask your question? Sure, no problem. Keith Bachman from Bank of Montreal. Thanks very much for doing this. Very insightful. As we listen to customers in global SIs, a frequent conversation or identification or problem statement is understanding where the agents are, who owns them, what are the risk exposures. A lot of companies come to talk about a value proposition associated with solving that problem statement, not just Zscaler, but a number of companies. I'm interested from your perspective, when you think about that problem statement, which was identified here tonight, or today, excuse me, is it one company you think you'll work with or is there more than one organization that'll serve as that orchestration layer, for lack of a better word? More broadly, this is a Zscaler event. Unfair question, are there other vendors that you think might be able to contribute to helping with this problem? Thank you. You going to take that one? I can start. I have a lot of agents. When you think about the environmental ecosystem in terms of agents, there's agents that you're building for internal use or agent that you may be building for your customers. There's two components of that. Where Zscaler provides context is where it's sitting, because it's sitting on the endpoint, it has that visibility, it has the network traffic. That visibility, it's going to be there, that gives you that context. Even if you're using additional models or you're using different other agents that are not specifically enterprise use, you stand to have that visibility. The expansion they're doing allow us to see more and more. Now, there are places where you may add additional context or additional products, and I think Zscaler is thinking about that as it scale. From my visibility today and what I see, and I think the more some of these companies become platforms and give you more visibility, you would use them to actually give you information you need. Yeah. Another one. Oh, Wayne. I think that's exactly right. I think the visibility in a single platform is really beneficial to us. I couldn't tell you that there isn't going to be a best-of-breed from another product or solution. The key there is when that happens is the integration level. It's really how is Zscaler, how is product X playing together, and how do I integrate those together? It creates more opportunity, the real question is, if you're willing to go outside of the ecosystem, how much value does it provide to us? If it really is that much value, then it's about the integration for us. All right. We have question somewhere in the middle. We'll probably go there. Yeah, your hand is half raised, it looks like. Thank you. Eric Heath with KeyBanc. Thanks for all of you being here. I'm sure we haven't really touched on it, but more the SecOps side of things. I'm sure you all have other vendors that you're using for your SecOps organization, your SIEM, your EDR, et cetera. How do you think about Zscaler as a partner in the SecOps arena side of things with Red Canary and some of their ambitions there? Thanks. I don't think I would be the one to take that. Someone else can take this one. I'll take it. Yeah, I'm using that. Yeah. It's very interesting. I think the industry need a different view on operations and SIEM. That's a very challenging market right now. Most organization, I think, are struggling with the data coming in, and then the remediation or time to remediation. I think from a product perspective, when I saw it, I think it's really interesting, and it could solve a lot of problems that organization have, especially the remediation piece. What was interesting to me is the data aggregation and how much they're bringing all of that data, because that today, it's very costly for most organization ingesting that amount of data. Zscaler is able to do it effectively. I think it could be a great product for many organizations that would use that. I hope that's helpful. You should just stand up. Steve Koenig, Macquarie. Thanks for doing this. I appreciate it. You all cited AI as being the newest thing that's challenging you. With the agents that Anthropic is offering, okay, being deployable on the desktop or on the endpoint, or being deployable in the cloud, and potentially in the future, the big LLM providers, like pinning certificates to that stuff and decrypting the traffic so Zscaler wouldn't be able to see it potentially. Maybe I'm simplifying this too much, but with all this stuff changing so rapidly, how mature are the solutions being offered today for you all in terms of being able to empower your employees, but protect the use of this agentic technology in Claude on the desktop, Claude in the cloud? How do you think about doing that? Is it slowing down your rollout of these agents, say, Cowork or Claude, et cetera? Are you worried about that? Yeah. Where do you start to protect? It's a really good question, and I think it'll go back to partnering with a company like Zscaler to work through that. You're sometimes always playing catch-up, you only could do what you can, you have to really work with your security partners and your strategic partners in this space to be able to do that. You talked a lot about, you might not be able to see all of the traffic or everything that's going on, it's really being able to see some of it, understanding your environment, getting that somewhat of a visibility to be able to take corrective actions in your environment. It's going to continually evolve. Making a strategic partner like Zscaler, providing them feedback, you working together, is really going to help the product grow to be able to get what you need to get done. I think it's easier when you have a Zscaler and an Anthropic and Zscaler and an OpenAI having that integration because there's the power for us to be able to deploy, right? Today, I don't have that visibility that I want by giving my employees GPT and Claude Code in my infrastructure because I need additional security controls, just lacking. From this morning, looks like that's coming, that's amazing. Those are the kind of things that I think we need to be able to perform some of those things. I think that partnership will allow you to say, even if there's a certificate change in the middle later on, that partnership allow us to actually close that gap. I think I just want to add one point to it. Yes, 100%. Look, as these model providers are becoming more enterprise deployed, they know that security is top of mind for enterprises. We have partnerships, we have API integrations, and expansion of our footprint on the endpoint with products that we have launched and what we are doing in public cloud. We are bringing that coverage to make sure there are no gaps left anywhere. It is evolving landscape, and we are very focused on that. Next question. I think in the front here. Great. Thanks. Brad Zelnick with Deutsche Bank. Really appreciate you all making time and sharing your insights with us. As pricing models across cyber and IT in general evolve to more closely align and cover token costs and align the value, what you're paying with the value that you're realizing, how do you manage and mitigate and have visibility to where your CFOs aren't choking you out and where does Zscaler fit within all that? Yeah. Great question because we just went into the AI solution, I mean, those are the control, right? The capacity, that's the economy side of it, and it's probes and number of tokens that we're working with. I think it was interesting, I read an article not too long ago that was talking about people and companies were driving AI and AI use, and they were measuring who was doing the most AI. They were just using AI. They weren't being productive with AI. You have to change your measure as a business to what is the AI value providing, not just, "Hey, I used AI a whole bunch," but really, what was the productivity out of that AI? Somebody was trying to win a contest to say, "I hit so many things." When you think about like us, it's right now we do want to see people using it, right? You want that experimentation. You want that, and you're going to see some increased cost. The question ultimately is going to come down to, you're going to have to prioritize because it's not this unlimited bucket of money that we all have, right? When I look at probes and applications, I'm going to start to have to start to look at prioritizing my applications and understanding what I want to scan, what I don't want to, as we go through that mechanism. I think from a business perspective, like anything else, the scale and the cost is going to go up, but how do you measure the value of the cost that's going up and what are you actually running? Think about cloud costs, when everybody just threw up things in the cloud and didn't manage any of it, and somebody got a big bill at the end of the month, right? You really have to sit down and start looking at from a business perspective and say, what are you allocating, what are you permitting, and put some controls and access around it so that you can see the difference in what the money's being spent on. We have three. There's one in the middle. Let's start there. You're picking up the pace on me. Look at you. Hey, Jason. This is for Jason and Mustapha. Ashish Bhandari from Throughline Capital. Thanks for taking the time. Both of you spoke about using your Zscaler deployments to have better visibility into developer usage. That's an interesting use case and not something I explicitly thought about before. Maybe can you double-click into that? We've seen all the code gen tools go pretty nuts over the last 12 months, so I'd be curious how you're using Zscaler and other vendors to address that. Thanks. There's the capability, Zscaler, because it sits on the endpoint, you start to look at the capabilities they talk about, which is IDEs. The engines that the developers are using to write code. We have seen a lot of supply chain security happening lately, and this is the visibility. How do you use that to actually get better traction and make sure you know what the developers have? The second important piece is the API integration they have into the AI agent that allows you to see what's happening, what the developers are doing from a policy standpoint. I think with some of the enhancement that it's coming, you can even have predefined policies and say, someone can do this, or here are the parameters that you can actually do. I think that's powerful. That's missing today. Most organization, you either have to build something or go find a new provider that's doing that. That's, I think, in my view. Just to add to that, look, from our side, we have some very large customers who are big technology shops, who have big developer populations. Even with our core products like ZIA, even if you don't think agents and AI security, we have been covering them for many years. 100% a big focus area. I think there was a question you had in the middle. You've been raising your hand for a while. Over there. Meta Marshall, Morgan Stanley. Maybe a couple of follow-up questions. Jason and Wayne, you guys kind of didn't talk as much about the Agentic SOC, just kind of wondering, what solutions you are using to manage a lot more data coming in and a lot more signals that you guys are getting. Then on the second question, on the finer point around pricing, it sounded like the response to Brad's question was, we'll get the AI costs under control, that will level set the rest of the costs. I guess, just, is there a comfort right now with token-based pricing within security that kind of mirrors that AI pricing? I'll take the second one on the pricing. I'll take the first one. There we go. Yeah. I'll sit on the backside on the pricing. Are we comfortable? I think we're learning what comfort looks like. I think you're right, it's pretty new to us. Where it's at, I know there's going to be a ramp-up. Absolutely. We're going to purchase so much, especially on the probe side, and we're going to go out there, and then we're going to start to see the value of it. Naturally, the organizations are going to continue to grow. I think there's always going to be a capacity increase with that budgeting. I think you'd be hard-pressed today. It's easy for us to go out there and say, evaluate what we have today and say, "This is how much we need." I think what will be interesting is when we get six months or a year down the road and we start to see where this tiering level goes. Does it ever level off, or does it grow at a certain pace? Comfort, I don't know. I think that's a strong word. I think there's an expected cost, but comfort is something I think we just have to get better at. I always use the cloud. We just throw everything out there, and we'll see what happens. Then everybody started to figure out how to manage it. I think that's what we're going to learn very quickly, is how do you manage AI expenses and growth? I think comfort's probably a strong word. Yeah. I'm not going to talk vendors, I can talk strategy. Yes, as an organization, we are definitely looking at how we can use Agentic SOC, because as you heard, you're not going to be able to keep up with human speed anymore. You need to use agentic AI to be able to help you. That's a big focus area for us. You will hear that tomorrow's keynote, which is going into what we are doing in Agentic SOC. We have always integrated SIEMs and SOARs and are one of the highest fidelity security data provider. Our data is unique, and we can build a lot of findings on top of it. By integrating third parties and some of our investments in Avalor and Red Canary, you will hear what we are doing in that space. We have one last question that we can take. We'll go in the back there, and then we'll wrap up. Yep. Speed dating. Great. Thanks, guys. Peter Levine, Evercore. We're at the Zscaler conference, maybe if you take a step back, if you think about identity, network, endpoint, cloud security, what's the first layer of defense that you're defending now against some of these AI attacks? I know you're investing a lot more in Zscaler and their AI products, if you think about identity or endpoint, where are you spending most of your capital today to defend against this? Identity still to me is extremely high. You start with identity and the roles and segmentation as you talk about that, it all bleeds right back into zero trust where it happens. Whether I have identity and I have ZPA, and I can apply an individual to an application or system and really put that enforcement in policy. I feel like it always starts with me in the identity and the credential space, because once I know that, then I can control and enforce policy through whatever mechanism I feel that is, whether they're coming through an agentic AI, they're not a real person, or if they're a real person or not, then I apply that. I think identity has to be a strong focus, and then everything else builds from there. I would say identity first, data second. Identity, you use it to make sure you know who's coming in and what they need access to. In the event of a zero-day, or they just walk in and get access to the data, it's copying that data and validating that. If you connect those two together, and I think you have a good chain of security, which I think Zscaler is trying to get up. All right. I think with this, we'll wrap up the panel. Thanks for your questions and thanks for sharing your insight, gentlemen. Next session, we'll need a few minutes to set up the stage, give us a couple of minutes, and we'll get back. Thank you. Thank you. Thank you. Identity can come first, but if they put you on the network, then it's no good. You got to see the whole thing. Exactly. Thank you. Yes, please. Great. Okay. We're going to get ready. We have plenty of time for Q&A with all these folks, so please raise your hands. We have some mic runners. Maybe start right up here with Brad. Thank you. Awesome. Thank you again. Can you guys hear me? Mic on? Yes. We're live? Okay, Brad Zelnick, Deutsche Bank. Great to see you all. Another Zenith Live in the books. Great stuff. Mike, I wanted to direct my question to you. One of the surprises coming away from Q3 results was guidance that we heard, which was incrementally conservative, the context around a few key sales departures as reason for that, which in the context of a company with 8,000 some odd employees was just a little bit surprising. Not to dwell too much on that, but looking forward, can you just talk about the resilience of the go-to-market organization, why the pipelines and the relationships are institutional relationships, and the risk that we bear going forward? We've all, as investors, seen these movies. Is there a risk of fallout that you've got dozens and dozens of others that are on their way out the door? Just any help you can share with that would be great. Thank you. Yeah. Good question. I think that the unique thing about that was just, it was just two at the same time. That was it. Right? Normally, there's always going to be turnover, especially in the world that we live in today with AI. There's always this new hot company that people want to go to, and they've got FOMO. A lot of the people here, and I always get so energized, I come to this event, and I hear the executives talk about how much they love their account teams. That relationship is so important. We have so many talented people here that love it. They love what they're selling. They love our solution. They love the future at Zscaler. I feel very confident that our strongest people are going to be successful and continue to thrive here. They also want to know they have a career path. As we grow, we put a lot of time and effort into career pathing these folks to make sure we keep the right people on board. It's healthy to have some level of turnover. In both instances, the people that left, one was a mutual thing, the other one was maybe a little bit more of a surprise. We've got great people on the bench to backfill. It also raises the game of other people and helps on that career pathing side. Do you know what I mean? They see a future. Other people, when one person goes, somebody else gets promoted. Maybe you bring in some new folks. A lot of times you have a strong bench, you can promote people, that means there's another set of promotions that go under that for worthy people. It's an opportunity as well. Yeah. Okay. How about John over here? Come sit up side to side. It's John DiFucci from Guggenheim. I have a couple of questions. I'm going to come to Mike, too, because I actually never met you, I have always wanted to. We hear a lot about a change in go-to-market strategy when you came on board, become a much more strategic partner with your customers, it all kind of makes sense. I think your product people have really built up the platform so that it's gotten to be more of a platform rather than being used for a couple of products. We do hear about a ton of large deals in the pipeline that continue to get pushed out. Yeah. I'm just curious, and I'm probably not the only one. Everybody checks here into the field, talks to partners. I just wondered what's going on with that. Are people sort of waiting to sign large deals? Are they fully committed to Zscaler as a platform? I heard your customers up here talking about Zscaler in solving the problem of AI, which I don't think any one vendor does that, but I don't know, maybe you guys think you do by yourself. How would you talk to that topic? I know there's a question in there somewhere, so I apologize, there's these big deals. You're a more strategic partner to your customers, they don't seem to be closing as much, I guess. Yeah. Maybe you just- Some deals happen faster than expected, too. It's a kind of a balance. The deals that take longer to get done, it's usually because there's a lot of testing that they have to do, and it's kind of a political landscape. A lot of people you have to get on board from different groups, right? That takes time. They want to go through the testing. They want to see what we can deliver. Sometimes there's new requirements they want to see us deliver before they're ready to take that deal to the next level. I think that's one of the strong suits of Zscaler is how closely tied we are to customers, how we listen, and actually deliver on those requirements faster than the competition. That's what I hear, at least. I'm probably biased, that's what they tell me. Sometimes it takes longer, right, to build in all those requirements, and then they're going to say, "Okay, now I'm ready to go because I've done the testing." Large companies, they spend a lot of time doing testing. A lot of time doing testing. Hopefully, AI can help solve some of that problem, right? They can speed that up. We get plenty of deals that happen ahead of schedule as well. I'm not super concerned on the time it's taking to get these deals done. That doesn't keep me up at night. Maybe I can give a perspective of a CIO because I was a professional CIO before getting onto Zscaler payroll. I think Dhawal mentioned this earlier as well. The large enterprises are also struggling with this AI tsunami is coming in. Who is the owner inside large enterprise to drive the AI? Some people appoint Chief AI Officers, some people make the data person be that. Some people keep the infrastructure. What's happening is they're all realizing that the right to play and right to win to protecting AI is the network providers, right? Among the network providers, we are getting lot of traction around how our network teams and the CISOs are bringing the application teams and the AI Officers, and that's why some of these testing cycles will take longer. We see the momentum, I see the recognition by some of the CIOs that Zero Trust providers have an advantage, that's what Jay highlighted in the town hall today as well, or in the keynote. Keith, up here in the front. Excuse me. Keith Bachman, Bank of Montreal. Thank you very much. Jay, I wanted to direct this to you as you, I don't know if you were in listening to the last panel, but identity was, no pun intended, identified as one of the key areas to spend as we look at the next period of months and if probably years. If I think about some of your offerings, it seems like you're encroaching on identity, right, in terms of your value proposition. Swamy and I we were talking about this last night, but I'm trying to understand where does Zscaler's value proposition start and stop relative to the identity partners, are you frenemies? Are you directly competing? This is particularly related to areas such as governance of agents is what I'm referring to. Thank you. Thank you. This kind of builds upon the question that got asked. I was listening to the answer as well. To me, the question is not that is identity more important or network more important, EDR more important. EDR does what it's supposed to do on the endpoint, right? It's like watching what's inside your house. It's useful, but it's contained to that. Identity is the starting point of access to something. Identity can be used to do old school access to put you on the network. Identity is useless because identity puts you on the network. You're on the network. You're going, you can go on the net. Identity combined with zero trust together is the real solution that says only this entity can talk to that entity. Our view has always been identity, tight integration, and then we are the switchboard that makes the right connection on one-to-one. Encroaching on identity. Let's talk what that mean. The basic identity starts with John's identity is this. We get that from Okta today or Microsoft. You have a number of things on top of that. Which device is John coming from? We know that because traffic comes from. Which location is he coming from? What's the behavior? Is the traffic flowing less than us? We adding value on top of identity by looking at a bunch of attributes. We call it additional authentication services we build on top of what we get, the basic identity. That we do that today for users. Now, this scope will become more important for agents because agents need to know a lot more than basic identity. The question is, should Zscaler provide the basic identity or what should it provide? Our view is that every provider that's going to allow you to create agents, Microsoft, AWS, Google of the world, identity just gets created. The basic identity of who this, what this agent is, comes from that agent. I don't need to compete to get that identity. I take that, I become the Switzerland. I can add a number of authorization services on top of that. Skills, tools, access, all the other stuff. We do all of that. That's becoming extremely important along with that. Yes, we are not directly competing in the basics of identity, but we are competing to deliver solutions. Customers don't buy identity for the sake of identity. Customers buy identity or ask to access certain application services. The question you can ask, is Symmetry identity play? Yes and no. The graph kind of say who is talking to who. It gives us meaningful information. We may not do the basic identity to compete. All the other value to make decisions about what to connect is very important for us, and that's really what our focus is. Maybe I'll just add quickly. We will and will continue to use that as context. It's very important context, as well as the authorization of what that identity is allowed to do. That's part of information we use in making our policy decisions. Being the one that grants that initially, that's a whole structure around who the business owner is of that. It gets very distributed in organizations. It has to cross lots of different parts. I don't know that there's a spot where it's critical that we own that piece. We need to know it, and we need to keep up to date, because the other part, too, when you look at this intersection is being an inline solution or being on the endpoint where the action's happening, which we're in both of those. There's also a whole question of that initial authentication or authorization that's granted to the application. What happens if the behavior or pattern changes while that session is open? We're in the best spot to actually take a real-time dynamic action, say, based on new information I know, I'm actually going to end that session or that conversation. That's a great spot to be able to enforce, and we do that in a couple of different areas, and that whole discussion is coming up on agents as well, too, right? In the middle of sessions. What happens if the risk changes or the posture changes? They're already authorized. The session's there. Who knows what to do? Who's in the spot to take that action? We're actually in a very good spot to do that. I may add one more comment to clarify it. I get asked by many CIOs. They said, "I thought identity provides policy of who accesses what. How come Zscaler is providing policy?" Okay. They get confused. My simple answer is, when I go to an international airport, they scan my driver's license or my passport, and that computer makes a call to a database of passports. Is Jay's passport valid or not? That's identity. I need somebody to sit in line to allow me to go or not go. We are in line inspecting everything. Identity, once you get checked out, identity's out of the way. Identity may have groups to say who can do what, but then it's out of the way. Being in line, to be able to add additional value, authorization, behavior, and all is what we can do. That's why we play a very important role. That's why having a basic identity for us is not that critical. Let's go with Catharine. Hi. Catharine Trebnick Rosenblatt. Can you unpack why you said ZIA and ZPA are growing? Is that due to the acceleration of Mythos in the landscape? You picked that up in your opening remarks. Thank you. When you talk about ZIA, ZPA, so there's a zero trust part for ZIA, ZPA users, then there's for workloads as well, and we'll take the same ZIA, ZPA for agents as well, because at the end of the day, the goal is who can access what application wherever, I think. On the ZIA side, largely that stuff comes from new logo acquisition, because most of the time when they buy ZIA, they do it for all users because they must protect all users. ZPA, many times, they have only bought partial users because it started out by replacing VPN. Now under Mythos, they're basically saying every user must be untrusted. We're seeing a lot of interest for people who have bought ZIA but haven't bought ZPA so far, or who have bought partial ZPA want to go to full ZPA. Those areas are directly beneficial because that does two things. With ZPA, you're hiding your private applications behind us. Also with ZPA, the lateral movement goes away. We see Mythos as tailwinds for it. Second row. Couple of questions right there. Thank you. Awesome. Roger Boyd with UBS. Jay, can you compare the level of urgency you're hearing from CISOs today to what you saw during COVID? I think you laid out very clearly why zero trust architecture makes sense for this environment. I think the other question is, how quickly can customers get there? In COVID, we saw sales cycles meaningfully compressed. I'd just love to get your perspective on what you're hearing today. Yes. It's a very good question. The urgency for Mythos is actually higher in many ways. I didn't see the board level discussion happening as much with COVID. They wanted people to come back to work, but almost every CIO I have talked to or CISO, they said, "We got a task force. We are reporting to the board every week or every two weeks on the progress we're making." It's that level of stuff happening. The difference is the following. With COVID, you went home on Friday, you needed to access your work on Monday morning from home. The urgency was, give me something to get started. With Mythos, they're struggling. They're figuring out, what do I need to do? The first thing they all wonder is, what is this Mythos thing? What does it mean to me? The way Anthropic has done it's kind of a mystery thing out there. You don't know. You wonder about it. As we have talked to the customers and explained to them, they're looking for practical steps and saying, "What can I do and report to the board that I have done A, B, and C, and I'm making progress?" All of our discussions have essentially led to essentially deliverables where, yes, they're going to work on fixing vulnerabilities, but our current customers are actually working on hiding their applications behind us. They're working on moving to Zero Trust Everywhere. They're looking at the users not being on the network, and branch projects are actually gaining more interest. I think it will take sometime, I expect the momentum for ZPA kind of stuff will happen faster in the customer base. The new logo takes a little bit more time in testing. I clearly see the interest in moving more towards zero trust with Mythos than it was before Mythos. This is Shrenik Kothari from Baird. Jay, you have talked about how Agentic Exchange could be one of the largest transaction-based, traffic-based monetization opportunity. Even today, you sort of double down, talk about agentic transactions are order of magnitude, potentially can add more zeros. We heard from the customers, seems like from AI security and agentic privatization, they are adding to the budgets. There's appetite. In terms of just the core monetization parameters, you announced AI Broker, would love to hear more about how that becomes a commercial manifestation. It seems customers are anchoring towards agent identities or identity first. You talked a lot about identities being sort of the centerpiece. Just curious, how are you thinking about this monetization strategy? You saw our Agentic Exchange and the traffic that's coming through exchange for agents, essentially based on traffic or call in number of requests, which translates to tokens, becomes the commercial mechanism for us to monetize for it. We just launched it, I think. We are seeing a lot of interest building, our customers who work with us, early stage POCs and all that kind of stuff. I can tell you, I've not seen so much interest in any product than exchange for agents and it being a critical product like this. For example, I'll contrast the two areas. AI asset management, do they care about it? They do. They like it. Red teaming they do. They know that agentic is a hard and important problem to solve. They're working with us very closely. The exact pricing and all, we are still figuring out, the way we do pricing. I work with the first dozen, two dozen customers, figure out the traffic flow pricing that needs to be done. Pricing will probably get firmed up in the next couple of months as we see traffic, how much work needs to be done. I see lots of interest, and I'm looking forward to see the growth, and we'll share with you as we make progress in this area. It's an exciting, challenging problem. The number one reason I hear from CIOs is why we're not able to roll out these agentic projects in production at a large scale is lack of governance and data security issues. Let's go over here to the left side. My left. Thank you. Gray Powell with BTIG. Thanks for hosting the event today and good presentation. I understand that there's a lot of urgency and discussions created by Mythos, and I'm just trying to figure out how that materializes into demand. Specifically, do you see it driving more interest in the existing, the proven products such as ZPA? I'm asking because just the marketing on a lot of the AI security products, I just have to admit, it sounds the same. It's confusing to me. I think it's confusing to buyers. I'd really be interested if you could just talk about what you're seeing from the perspective of core product demand versus new AI security products and just how you see that playing out in discussions. I can start, and Swamy, you can add to it since you're very heavily involved. I'll give you a detailed answer. When we do our meetings with customers about what can I do to protect against Mythos, we have very specific six recommendations, and they have become as a result of lots of discussions. One, hide your attack surface. That's where ZPA plays a very important role because you're hiding attack surface of your private applications. Okay. Number two, if you got breached, how do you make sure the breach doesn't spread around? It needs Zero Trust at the user level first, because user the weakest link. That drives demand for ZIA, ZPA, both. We say, make each branch like an island. That makes sure the infection doesn't spread from branches. It really build demands for both users, branches, and even workloads. Number three, if you already got ZIA, ZPA deployed, which are foundation for your users, you need to make sure they're properly configured. We are doing validation of the configurations to make sure it's the best practice of forward configuration. Number four, while AI assets are not directly linked to Mythos, they're just showing up in every enterprise, and those AI assets are creating risk. Understanding what you have, what the risk is number four. Number five, you should discover and fix, well prioritize and fix vulnerabilities. Everyone is expected to do that. Six, you change from doing red teaming a couple of times a year to continuous automated red teaming. That's driving demand for our red teaming products. This is the list of recommendations that go through, customers prioritize it, they realize that Zero Trust becomes a foundation to do more and more of agentic stuff. That's how we see the demand being driven for AI as well as Zero Trust users and other things as well. I would say that if you look at the discovery that we announced, that is something that CISOs want right now. I always tell my team that you get to build the products that customers want yesterday. That is the demand on that, the POCs are going very well. Those conversations quickly switch into, how can I now manage it? Many of you have seen this NVIDIA 5-layer AI stack. If you look at the top layer, the application, we can protect it with secure, then these next two layers, models and LLMs, they would want to make sure that you govern that as well. What's happening is, when users were using internet, you would type www.something. In the era of agents, the equivalent of www is MCP. The AI Broker that we launched was effectively how to really govern the activity that's happening. Within MCP, you could invoke skills, tools, and other prompts that you can put in. All of them have to be governed, that's why people are excited, beginning with the discovery. Maybe just one other comment to add on that. When you think about protecting your organization, the core capabilities that Zscaler has, as Jay mentioned, specifically ZPA hiding that attack surface of your applications, that's the most obvious thing that everyone should be doing. That's driving a tremendous amount of conversations. It's also when you have that discussion, it's clear it's understood. Now people need to do it, there's the getting the mindset to make changes, it's not a hard discussion with people on that. What I've seen with Mythos is that recognition of, I know I need to do more now. If I haven't done this already, now it's time to do that. That second part about MCP servers and all of the assets that are part of using AI for productivity, it is not a chicken and egg, you are not going to spend all your money on securing something that you have not even figured out how to use yet. Right? All of those pieces are popping up in organizations, I get why you say it sounds confusing, because each of those terminologies, those pieces of things that are part of using AI for productivity, it is Claude Cowork, it is MCP servers, it is A2A, it is all these different pieces that people It is at the endpoint. It is what am I using a foundational model in the cloud? Everyone is trying to figure out how do I use it, how do I get productivity, I think in the earlier discussion, people talked about am I seeing the actual outcomes versus just usage. The fast follow on that is, if I am really going to use this at scale in production, how the heck do I secure it? Everyone is looking for those attach points, I think what you saw from Dhawal this morning and in the discussions today, we do think we have these right three pillars for how to look at that is all new for folks, right, in terms of where are they going to spend. It does sound like a lot of people, like it is that gold rush type mentality, where every big company and startup is going to say, "Well, I am going to help you with that specific piece of it." Right? That is why you see a lot of common story lines in there, everyone saying, "I am going to be the one who is going to do that." We believe we can too. Steve. Grab him over here on my right, your left. Steve Koenig, Macquarie. This one is for Mike, and if Jay wants to follow up, maybe he'll want to as well. Just maybe extending the last question, when it comes to these conversations that become about securing agentic AI in the enterprise, which is complicated and difficult for the enterprises to, number one, figure out what they want to do with the agentic AI, and then they got to secure it. Zscaler has a ability to enter into those conversations, and you have solutions that help with that. I'm wondering, how does that affect your sales motions in the sense that what used to maybe be an easy conversation about ZIA or ZPA or even Zero Trust Everywhere now becomes a conversation that is potentially much more complex because the whole issue of protecting AI enters into that, and then maybe does that change the nature of your sales cycles that would've been much easier? How do we deal with that? I guess that's the question. Yeah. Well, it's still early, right? We're learning. There's new personas that we're going to have to build relationships with. The way we've got the sales org set up, we have Dhawal's team that has some core folks that are very, very knowledgeable and go very deep with those personas today. Then we're training people by region, by area, where the major buying centers are, to make sure we have enough people that are enabled to have those level three, whatever, level two, level three conversations. Yeah, we're learning as we go. There's one thing that's very clear: everybody wants to have that conversation with us, and they all do feel like, especially if they're our customer today, they feel like they would prefer if we had the right solution for them because we're already there in line, and we see all their traffic. We have this advantage, and we feel like we have the right to go win. Yeah. They feel the same thing. Yeah, if I may add, many times the notion of who is the buyer matters. Zscaler has traditionally sold to two most important buyers. CIO is number one, CISO is number two. Why it's a CIO number one? Six years ago, I used to think that CISO was number one. The transformation is driven by the CIO. CIO, CISO, and head of infrastructure networking, these folks play a role. Lot of the discussion about even agentic stuff go to CIO. Some companies do have Chief AI Officer or Chief Data Officer. Actually intro gets made by the CIO. If we didn't have access to the CIO or CISO, we would be wondering about which solutions. Take all the security solution we have. They all lead up to the CISO. AI solution lead up to CISO and CIO both. I think from access point of view, fairly well-covered. The key for us is how do we streamline our teams to be more effective? There's some similar things to what we have been selling, there's some different things. Take what's similar. The notion of exchange for agents, user branches are pretty similar. There's some nuanced things underneath, but explaining that philosophy of we did it for users, now we're doing it for agents, is fairly easy to explain and get the stage going via an account exec. We can pull in our seasoned subject matter experts as they're needed. Also, we have evolved some of these specialty teams, too. I mean, Mike did specialty teams in his previous company, where they actually had different buying centers. HR in one case, IT in second case, some another case. We have specialty sales team, for example, for data security, which can get pretty complicated. Data security is still sold to the CISO, someone under the CISO. The technology functionality can be complicated, we had experts who actually talk about that area. Similarly, we had a few others. We also evolve. When a new product comes in, under product management, we learn, we understand, and we figure out how to go forward with it. For AI overall, everyone wants AI. Rather than having a small specialty team of AI, we actually want everyone to sell AI. That they'll be backed up by some experts, domain experts, not specialty salespeople, but domain experts who could be pulled in for deeper discussions. We are learning the process. The part of selling AI Protect, which is assets management, secure access, and the guardrail and red teaming, is fairly straightforward. We learned quite a bit in the past few months. The learning will probably happen about our exchange for agents in the next couple of months, but there's a high degree of interest. Todd, right in the middle. Thanks. Todd Weller with Stephens. A question for Adam. Adam, you come from the SecOps world. It's a new space for Zscaler, not as known. It's a crowded space. What's the strategy for breaking into that market, and what is it about the solution that you think is differentiated and will resonate with the customers? Sure. I think you heard a touch of it from the folks on the panel before. Yeah, it is new, so they're also learning how we're approaching this. I think the biggest piece from a SecOps standpoint is that organizations are and do have centers of gravity of data. So if you're a Zscaler customer, we are a center of gravity of data with what we do with ZIA, ZPA, DLP, what we have from our client perspective. Our approach to this is how do we bring that together in a meaningful way for the purpose of security, detection, investigation, and response, right? Because we have detections, we have signals, we have context, historically, we haven't brought that together in any fashion to help a customer through that investigation process. We've said you can stream it somewhere else to do it, but we hadn't offered that place. Yet, we also had capabilities like our threat hunting services, where we were uniquely positioned to use our data to find incidents that otherwise would not be found by streaming it off to some other SIEM or SecOps product. You wouldn't see it on the endpoint. We had people who liked that service from us, but it was a small, I'll call it pilot service. At the core of that is they were writing detections that could be found across that Zscaler ecosystem of data. That's part of what we've been bringing together. Foundationally, the data fabric that we acquired several years ago is what creates those entity relationships between all the information we have, third-party data like identity, context information like vulnerabilities and exposures, and asset information. We wound up having this foundation. We did the Red Canary acquisition, which brought in meaningful detection libraries and skills around how do I run detections against, not specifically Zscaler data, but any third party SIEM that you want to bring in. This past year, we've been bringing all of that together. What we're bringing to market, though, is the software platform, because Red Canary was an MDR. If you wanted that service, you got a service. If you wanted a software platform, you got a service, because that was the only thing that they had to sell. Had we not acquired Red Canary, part of their roadmap path was, how do I deliver this in a more cost-effective software platform way? That wasn't what they had built, and that's not where their 10 years of experience came from. Zscaler, as you know, that's what we build, right? We had this path that we were going down. We had the Red Canary acquisition, this year has been about bringing that together, where that Agentic SOC core platform becomes that foundation where I should be able to go, at a minimum, to any Zscaler customer and say, "We already have this data. I can make better use of this for you in detection, investigation, and response. Whether you send me anything else or not, happy to take more, and I can take more. Even if you don't, I will show you how I'm using an agentic framework to go through each of those steps and help you investigate incidents in a way you could not do before." If you want to send that off to your SIEM or whatever other product, you can do that too. Oh, by the way, if you want a service on top of that, we have expert skills for both threat hunting and full MDR that we can now offer on top of that. That's what you'll hear tomorrow in some of the keynote and then in a more formal launch. I think that's a valid entry into this space. Long answer, I'll just wrap this up. It also balances, I think, the long-term question about what will happen in the SOC and SIEM world, where there's this continuous, I can do the job if you give me all the data. I don't need any of the data. I'll just send agents to go get all the data when I need it. Right? Everyone I speak to in the SecOps world, you need a foundation of that data. We're not at the spot where this is just real-time, agents are just going to go grab data from their source at the moment they need it. You need that initial core foundation, and I think organizations will have several. Right? We won't be the only player that's there, I think we can also live, and it's important, we can live with those other players that are in place, which I think is a requirement for entering into this market when there are already other big players and crowded in there. I have to be able to show a customer that it's okay that you're working with CrowdStrike, who's a partner of ours. We can be in here, too, not just, oh, the only way this works is if you only use us. Okay, the right side here in the middle, Taz, and then we'll go to Eric. Just leave the mic there. Thank you. Hey, guys. It's Taz Koujalgi from Roth Capital. I had a question, I had a clarification on the Zero Trust for Agentic AI. Is there dependency on customers having ZIA and ZPA for users before they can use Zero Trust for Agentic AI? Or can customers who are completely new to Zscaler also use the Zero Trust for Agentic AI? They can go on their own. You don't have to buy the user before you do agents. If you have users, it becomes easier because you understand the stuff. This is not a dependency. Got it. Second part of the question is, you gave us the bookings number for AI Protect, $100 million over the last, I guess, one year. My question was, again, how much of that is coming from net new customers to Zscaler versus upselling? When customers buy AI Protect, existing customers, what is the typical uplift that you see in the deal value? It's a mix, is the answer. The uplift is a harder one. I haven't looked at that personally. I don't know if anyone here knows the answer. No. Uplift to a deal? I'm not sure. With the AI Protect. Yeah. We'll have to stay tuned for that one. We'll come back to you on that. Can you pass it to Eric, please? To your right. Thanks. Awesome. Eric Heath from KeyBanc. Jay, I guess this one's for you. Tracking all the breaches we see, I think a very common shortcoming or point of exposure is the hardware that sits on the perimeter, right? The firewalls, the SD-WANs, the VPN, et cetera. You always talk about how this is a weak point. Maybe I'm over-extrapolating and maybe I'm reaching, but it seems like Mythos can only accelerate that shortcoming from the hardware vendors. Yep. We know there's several hardware vendors that are constantly patching and being exploited and et cetera. Mythos only accelerates that. The ability for these hardware vendors to support these large fleets of hardware devices that need to be patched and fixed and whatever. Now, the conversation is the compressing timeline between vulnerability and breaching and exploitation. Yep. I know your answer is going to be yes to this, but do you think that this accelerates the transformation from hardware to the Zero Trust Exchange? Like I said, I think your answer is going to be yes, but in practicality, do you think this is going to be a real accelerant for customers to think the way you think? Having had probably well over 100 conversations with CIO and CISOs in the past couple of months, a light bulb for better understanding Zero Trust is going up. For example, we talked about users being untrusted should never be on the corporate network. Like going down. Some of our very progressive customers have already done it. Many haven't. No, they're saying, "Oh, I should be doing that." That understanding and learning for Zero Trust is going up. Understanding and learning that 300 branch offices, the firewall facing the internet is exposed to the internet is not a good thing, is going up. I do believe that Mythos is becoming an accelerant for adoption of Zero Trust, and it's going to start differentiating the firewall guys who always talk, "Well, we got Zero SASE or Zero Trust SASE," because they see the difference. Now they're asking a question. Now, do I have a lateral movement or not? What's going on? This is happening, and also the point you said, patching. The bigger boxes you got everywhere, the more software functionality you sit in a box that's scattered around, the bigger the risk because bigger the issues out there. The less you got sitting on the devices, less likely you have issues out there. More likely, take the branch office. We do have a branch appliance, though, right? We try not to get there, but we are there because the customer needs. We run them, we manage them, we operate them, we upgrade them, okay? Essentially. We're taking the risk away. Also in the traditional world, there are firewalls sitting inside the campus, deep inside, that only are under customer's control. Those are the kind of things sitting out there. I do believe that it is accelerating this stuff, and hopefully we'll show you results in coming quarters. Okay, we're going to go over to George. Go ahead. Thank you. George Iwanyc with Oppenheimer. Kevin, bringing you into this since you haven't had a chance to talk yet. Maybe giving us some perspective on, there's a lot of opportunities here, how you're prioritizing your investment with respect to your product and sales and marketing. Yeah, no, I appreciate the opportunity to answer the question. Some of it has been answered as we've gone through this conversation. As we think about when we bring new innovations to market, the way we're thinking about AI is different than we've thought about some of the other products. We have a dedicated team with Dhawal and Swamy who are acting, in effect, like a startup within the organization to really move with speed. They're working directly with Mike's organization to enable as many of the sellers and the people within his org to be able to sell it broadly. Obviously, AI is just a very important element, both in terms of what we're providing our customers, but also internally. That is a priority internally if we think about in that regard. And then the other products, we have specialty teams where we specifically identify resources that can help Mike's team go and sell. Actually, those live within Mike's team, so they're part of them. That's how we think about the trade-off in different investments. We, like every other business, go through an annual process of setting our operating plan, and we identify key priorities. AI will continue to be very top on those priority lists. If I may add, while our portfolio has grown, has become pretty large, we actually say no to many projects and many initiatives. EDR has been asked for many times. We said no. Identity has been asked for many times. We have said no. We're fairly disciplined. When we do projects that are very synergistic to Zscaler, they don't require as big of an investment as it would be if we were to do the old way. Five years ago, I told you when we did sandboxing, literally the amount of effort that was needed to do sandbox on Zscaler, ZIA platform, probably 25% of the total effort as compared to if it were done by an independent company. The rest of the stuff was already in place. They're taking traffic. They're opening files. All the stuff was being done. I talked this morning at Agentic Exchange, building on top of Zero Trust Exchange, probably 70% of the pieces that are there, 30% is what we're adding. Take, for example, you heard about Zscaler Cellular. It's a very cool and exciting area of opportunity. What are we doing? The amount of effort needed. It's a very small team that's leveraging all the back end, but a new use case to take traffic, take the telemetry from these IoT devices. Being doing the smart thing, being around our core competency is what makes us more productive in delivering more products with great returns. I think we have time for one more. Let's make that Rich in the back. Hi, Rich Poland from Wells Fargo. Thanks for taking my question. I think we talked a lot about just the investments in a lot of things, AI and the product side that can really, I think, drive a lot of expansion with the existing base. When we think about one of the things that was said last quarter, the new logo side. It seems like that's more of an emphasis now, targeting that 2K to 10K employee range. I guess, both Jay and Mike, can you talk a little bit about just what's needed there, what's needed to enable that? What did you see that prompted you to want to focus there more and just any color around what you're doing there? Mike, why don't you start, and then you can add on the next level of detail. I think what we shared with you before is that we have focused on larger customers, and we come down market from there. The question wasn't that we are now, for the first time, adding new logos, the new logo for more reps. We are adding more and more people, the higher end of the market is fairly well covered. If I do add X more account execs, they're actually naturally going to the next level of the stuff. The next layer, 2K to 10K accounts, they actually have fairly limited coverage, fairly limited install base. By default, they end up getting more new logos and very few current customers. It's naturally going to take us in that direction, was one thing we told you. The second thing we said is we are looking at more focused incentives for new logos here. In the past, we had done some spiffs and all. We're looking at doing more because it's a good opportunity for us. Mike. Well, first off, that's just the space where there's most new logos exist. It's a lot of fertile hunting ground. Every enterprise company goes through this where you sell, you add customers, and then it's a lot easier to do upsells, especially when you have a platform like we have. Everybody wants to work on existing customers because it's just easier to get deals done. It's easier, right. I think historically, we've been too lenient on how we set up the territories, and that space between the 2,000 and 10,000 has just gotten ignored. We realized, we brought some outside help in to help us analyze the numbers. We said, "Wow, this is a big opportunity. We've got to go back to this and actually focus the territories. When you do territory planning, if you set up the territories so that there's no way you can make your number unless you sell these new logos, you get that energy, and everybody starts rowing the boat in that order to go get that. The alignment with marketing and how you spend money based on existing customers. Our previous regime was really focused on upsales. Now we're just balancing that out. One point of just clarification. You've heard us talk about the 20,000 plus or minus largest companies in the world. This population is included in that 20,000. It's not like we're all of a sudden going to a completely different- Yeah. ideal customer profile. We're really talking about the same population of companies that we have been for many times. Just making sure we have appropriate coverage and focus. Great. Do you want to close us out, Jay? Yes. I hope you heard that we see a massive opportunity. The market is getting hotter and hotter. There's nothing hotter than cyber in today's world. Having a platform that's expanding and growing at a faster pace and the go-to-market engine and focus on account-centric stuff, pretty well-positioned, pretty excited to really serve our customers and keep on innovating. Thank you for joining us and look forward to working with you in coming sessions. Yeah. Thank you.