Jay Chaudhry is taking Zscaler beyond the policy layer that made it a leader in zero-trust access. The company’s acquisition of Red Canary added managed detection and response: teams of security specialists supported by technology that investigate threats and help customers contain them. The combination can connect prevention, visibility and incident response across a wider enterprise environment.
The strategic case is strong. Customers are consolidating security tools while facing a shortage of experienced analysts. Zscaler sees enormous traffic and identity context at the point where users, applications and data connect. Red Canary brings endpoint telemetry, detection engineering and human-led investigation. Together they can identify an attack path and help stop it.
The operating models are different. Zscaler’s cloud platform scales through software and infrastructure. Managed detection depends on people, shift coverage, case quality and close customer interaction. Chaudhry must integrate those models without turning a high-margin platform into a collection of labour-intensive services or weakening the responsiveness Red Canary customers bought.
The acquisition is already visible in growth
For the third quarter of fiscal 2026, ended April 30, Zscaler reported revenue of $850.5 million, up 25 per cent. Annual recurring revenue reached $3.53 billion, also up 25 per cent, including $127 million attributed to Red Canary. Organic recurring revenue grew 21 per cent. The company’s non-GAAP operating margin reached a record 23 per cent.
Those results show healthy demand and an immediate contribution from the acquisition. They do not yet prove that the businesses reinforce each other. Zscaler needs customers to adopt Red Canary alongside platform modules, renew the combined service and expand over time. Simply adding acquired revenue is an accounting bridge, not an integration outcome.
Chaudhry should disclose cohort evidence. How many Zscaler customers add managed detection? How many Red Canary customers adopt more Zscaler products? Do those accounts retain and grow faster than comparable customers? Cross-sell rates and service adoption will reveal whether a unified platform is forming.
Customer concentration also matters. Large enterprises may buy broad contracts, while mid-sized organisations often have the greatest need for managed expertise. Zscaler should ensure that packaging and support do not make the service accessible only to the largest accounts.
Detection needs context across control points
Security operations teams receive alerts from endpoints, identities, networks, cloud workloads and applications. An analyst must determine whether events are connected, which asset matters and what action is safe. Fragmented tools slow that process and create gaps.
Zscaler can add context from its proxy and zero-trust exchange: which user accessed an application, what data moved and which policy applied. Red Canary can connect endpoint behaviour and investigation expertise. The combined system can prioritise incidents that cross layers rather than treating each signal separately.
Integration should begin with a common data and case model, not a common user-interface colour. Customers need consistent identities, timestamps, asset ownership and severity definitions. Analysts should be able to move from a finding to the underlying evidence without opening several consoles.
Data quality remains a constraint. Missing endpoint coverage, encrypted traffic and unmanaged devices can create blind spots. Zscaler should show confidence and coverage rather than implying complete visibility. Red Canary analysts need freedom to request more evidence and challenge an automated correlation.
Human expertise is part of the product
Managed detection is judged during difficult moments. Customers expect skilled people to investigate at all hours, communicate clearly and avoid both alarm fatigue and false reassurance. Automation can accelerate triage, but it cannot replace accountability for a recommendation that may disrupt operations.
Chaudhry should protect Red Canary’s detection-engineering culture. Analysts need time to study attacker behaviour, tune detections and share lessons. If integration targets focus mainly on utilisation and cross-selling, service quality can deteriorate. Retaining experienced staff requires career paths and influence over product decisions.
Service levels should include investigation and notification, with severity definitions customers understand. Faster is not always better if an alert lacks context; slower is dangerous during active intrusion. Zscaler can publish performance ranges and explain how automation affects them.
The company must also define the customer’s role. Red Canary can identify and advise, but remediation may require internal teams or other providers. Runbooks, permissions and escalation contacts should be agreed before an incident. A platform promise should not blur responsibility.
Cash-flow pressure needs a clear explanation
Zscaler’s growth and operating margin remain strong, but capital spending and integration affect cash generation. The company guided to a lower full-year free-cash-flow margin than it had previously expected as it invested in infrastructure and absorbed the acquisition. Investors need to understand which costs are temporary and which reflect the new business mix.
Managed services naturally carry different gross margins from pure software. Chaudhry should not force them to match immediately through understaffing. He should show how automation, shared infrastructure and scale improve economics while maintaining response quality.
Capital spending can support data centres, computing and product capacity required for growing traffic and AI workloads. It should be linked to utilisation and customer demand. A platform that overbuilds ahead of uncertain consumption can weaken returns; one that underbuilds risks latency and reliability.
Acquisition accounting can obscure organic performance. Reporting Red Canary revenue separately during the early period helps investors evaluate growth and margin. Over time, integrated contracts will make separation harder, increasing the importance of operational measures.
Consolidation must preserve customer choice
Security buyers want fewer disconnected tools, but they do not want dependence on one vendor to become a new risk. Zscaler should support endpoint, identity and cloud technologies from other suppliers. Red Canary built value by working across customer environments, and that breadth should continue.
Open interfaces allow customers to send findings to their data lake, ticketing system and other response tools. They also let independent researchers and partners extend detections. Chaudhry can make Zscaler the primary platform without requiring every surrounding product to come from Zscaler.
Packaging should be modular. A customer may want managed detection without replacing all access controls, or Zscaler services with another response provider. Commercial incentives can reward broader adoption while avoiding punitive terms for mixed environments.
Regulators and boards increasingly examine concentration in critical technology suppliers. Portability, transparent outages and tested recovery reduce that concern. A consolidated platform should improve resilience, not create a single opaque point of failure.
AI should assist investigations before it automates containment
Zscaler can use AI to summarise cases, correlate signals and recommend actions. Red Canary’s history of analyst decisions provides valuable examples for evaluation. The first objective should be consistency and speed in investigation, not unsupervised control of production systems.
An AI recommendation needs evidence: the events, affected assets, uncertainty and likely impact of remediation. Analysts should be able to modify and reject it, and those outcomes should improve future performance. Customers need logs showing how a conclusion was formed.
Containment actions such as disabling an identity or isolating a device can stop an attack but also interrupt business. Automation should operate within pre-approved runbooks and require confirmation for critical assets. Rollback and alternate access paths must be tested.
Chaudhry should publish evaluation methods rather than broad claims about autonomous security. False positives, missed incidents and unsafe recommendations are meaningful measures. AI that reduces analyst workload while preserving oversight will improve margins more sustainably than a system that appears efficient by shifting risk to customers.
Asia will demand flexible delivery
Asian customers vary widely in regulatory requirements, cloud architecture and availability of security talent. Managed detection can be particularly valuable where specialist teams are scarce. It also raises data-residency, language and time-zone requirements.
Zscaler needs regional operations and clear choices about where telemetry and case data are processed. Local partners may assist remediation, but quality and responsibility must remain consistent. Multilingual communication during an incident is a safety requirement, not a localisation feature.
Different sectors will require different runbooks. A bank, manufacturer and public agency cannot apply the same containment action to a critical system. Red Canary’s service model should adapt while its core evidence and escalation standards remain uniform.
Successful regional deployments can demonstrate that the combined platform scales beyond North American operating assumptions. They will also test whether Zscaler can deliver human expertise economically across markets.
The integration should make security operations simpler
The acquisition will succeed if customers receive fewer low-value alerts, faster investigations and safer remediation through a coherent service. It will fail if they inherit another console, unclear responsibilities and more expensive bundles.
Integration leadership needs a named owner and a limited set of milestones. Product, service and sales teams should share responsibility for adoption and quality. Quarterly reviews can examine customer outcomes, staffing, platform reliability and realised savings, preventing financial targets from outrunning operational evidence.
Jay Chaudhry has the distribution and data context to move Zscaler closer to the centre of security operations. Red Canary supplies the human judgement that a software platform often lacks. The leadership task is to make those strengths complementary without concealing the cost of service or narrowing the ecosystem. Growth from the acquired revenue is already visible; durable value will appear in renewals, response quality and improving economics after the integration work is complete.
