Summary

  • Zscaler ended fiscal 2026 with US$3.353 billion of revenue and US$3.771 billion of ARR, both up 25%. Excluding Red Canary, revenue was US$3.209 billion and ARR was US$3.630 billion, each up 20%.
  • The company acquired Red Canary, SPLX, SquareX and Symmetry during the year for about US$957.7 million of disclosed cash consideration. Their disclosed goodwill balances totalled roughly US$800.3 million, although several allocations remain preliminary.
  • Management and PwC excluded all four acquired subsidiaries from the year-end ICFR assessment and audit. Together they represented about 0.1% of consolidated assets and 4.4% of fiscal-year revenue.
  • The roughly US$144 million gap between reported and Red Canary-excluded revenue looks close to 4.4% of reported revenue, about US$147.5 million. That is an apparent match, not a reconciliation: one scope contains Red Canary alone and the other contains four companies, with rounding and different measurement purposes.
  • A decision-useful bridge would show acquired ARR, recognised revenue, retention, cross-sell, gross margin, purchase-accounting revisions, integration costs and control inclusion for the same four businesses and the same periods.

One set of results contains three acquisition maps

Zscaler’s fiscal-year release makes the growth story look unusually clean. Revenue reached US$3.353 billion, 25% above the prior year. Fourth-quarter revenue reached US$898.2 million, also up 25%. Annual recurring revenue ended July at US$3.771 billion, again up 25%.

The company then supplies an acquisition adjustment. Remove Red Canary and full-year revenue becomes US$3.209 billion, growing 20%. Remove Red Canary’s US$141 million of period-end ARR and ARR becomes US$3.630 billion, also growing 20%. The adjustment answers an obvious question: how much of the reported growth rate survives after taking out the acquired managed-detection business?

But Red Canary was not Zscaler’s only acquisition during the year. The Form 10-K lists four: Red Canary on 1 August 2025, SPLX on 31 October, SquareX on 5 February 2026 and Symmetry on 27 May. The purchase-accounting note therefore has a four-company perimeter.

The financial-control report has another four-company perimeter. Management excluded all four subsidiaries from its assessment of internal control over financial reporting at 31 July because they were acquired during the year. PricewaterhouseCoopers excluded the same four from its audit of ICFR. Collectively, the omitted subsidiaries represented about 0.1% of consolidated assets and 4.4% of consolidated revenue.

These maps are legitimate for their stated purposes. A growth adjustment can isolate the acquisition with a material recurring-revenue contribution. Purchase accounting must record each completed business combination. Control standards can permit recently acquired operations to sit outside first-year testing when the scope and effect are disclosed. The analytical problem begins only when the maps are treated as interchangeable.

The numerical near-match is a trap

Reported fiscal-year revenue was US$3.3525 billion in the accounts and rounded to US$3.353 billion in the release. The release says revenue excluding Red Canary was US$3.209 billion. The rounded difference is therefore about US$144 million.

Four point four per cent of US$3.3525 billion is about US$147.5 million. At first sight, that looks like a convenient reconciliation: perhaps the four businesses outside ICFR testing generated almost exactly the amount removed in the Red Canary-only growth view.

That conclusion is not supported. The 4.4% is a collective ratio for Red Canary, SPLX, SquareX and Symmetry. The US$3.209 billion comparison removes Red Canary alone. The figures are disclosed at different precision, and one is designed for non-GAAP growth explanation while the other describes the scope of financial-control assessment. The filing does not allocate the 4.4% among the four subsidiaries.

It would be equally unsafe to conclude that SPLX, SquareX and Symmetry generated no revenue simply because Zscaler does not remove them from the published organic-style comparison. They arrived later, may have been early-stage or technology-led purchases, and may have contributed immaterial amounts at group scale. “Immaterial” is not the same as zero, and a missing adjustment is not a segment disclosure.

The near-match is useful precisely because it exposes the need for discipline. Numbers can be close while their populations differ. Acquisition analysis needs stable rows before it needs more decimals.

Red Canary’s ARR is a run rate, not a revenue line

Red Canary is the only acquired business for which Zscaler publishes a quarterly ARR contribution. It was US$114 million at 31 January, US$127 million at 30 April and US$141 million at 31 July 2026. The sequence shows a rising period-end run rate after the acquisition.

It does not show recognised revenue for each quarter. Zscaler defines ARR as the next 12 months of revenue from subscription contracts at the measurement date. For ordinary contracts expiring in the next 12 months, the calculation assumes renewal on existing terms; the filing specifically excludes certain Red Canary subscriptions expiring in fiscal 2026 from that renewal assumption. ARR is useful as a recurring commercial scale measure, but it is not revenue, billings, RPO, deferred revenue or cash.

The full-year release provides a separate revenue view: reported revenue of US$3.353 billion versus US$3.209 billion excluding Red Canary. That roughly US$144 million rounded gap is closer to an annual recognised-revenue contribution, but it still is not a detailed acquisition schedule. Red Canary joined at the first day of the fiscal year, so it had almost a full-year contribution. SPLX, SquareX and Symmetry entered progressively later.

Timing matters. Comparing Red Canary’s US$141 million July ARR with a roughly US$144 million fiscal-year revenue gap does not imply flat performance or complete conversion. One is a forward annualised snapshot at year-end; the other spans recognised service over twelve months and is rounded. The acquisition began with deferred revenue, customer contracts and purchase-accounting adjustments that affect recognition.

A useful bridge would start with acquired ARR at close, add new contracts and expansion, subtract churn and contractual exclusions, and end with period-end acquired ARR. A second schedule would turn the same customer base into recognised revenue. Without both, the market can see that the acquired franchise is material but cannot see how much growth reflects retained inherited contracts, new Zscaler cross-sell or changes in measurement.

Four purchases created more than a product catalogue

The disclosed cash consideration was US$651.4 million for Red Canary, US$40.6 million for SPLX, US$112.8 million for SquareX and US$152.9 million for Symmetry. Added together, that is about US$957.7 million. Zscaler separately issued restricted stock subject to post-combination service conditions; those awards should not be casually folded into the cash sum.

The acquisitions filled different positions. Red Canary brought managed detection and response. SPLX extended AI-security testing. SquareX added browser-security capabilities, including unmanaged devices. Symmetry brought data and identity mapping intended to govern AI-agent communication. Commercial integration therefore has several routes: retain an existing service, embed acquired technology into the Zero Trust Exchange, cross-sell it, retire overlapping products or use talent to accelerate a new platform layer.

Purchase accounting shows how much value rests on execution rather than separable assets. The disclosed goodwill balances were US$545.445 million for Red Canary, US$39.2 million for SPLX after a measurement-period revision, US$93.0 million for SquareX and US$122.7 million for Symmetry. The sum is about US$800.3 million. Several allocations remain preliminary, so the total is an observation, not a permanent valuation ratio.

Goodwill is not a bill for failure. It commonly captures an assembled workforce and expected synergies that do not qualify as separately recognised assets. But it places more of the acquisition thesis outside assets that can be directly amortised and tracked. If customer retention, product integration or cross-sell disappoints, the distance between consideration and identifiable net assets matters.

SPLX provides an immediate example of measurement uncertainty. During the year Zscaler revised the value of acquired developed technology from US$14.1 million to US$3.3 million and increased goodwill from US$32.2 million to US$39.2 million, after moving from a benchmarking valuation to a replacement-cost approach. That is not an impairment. It is a purchase-price allocation changing inside the permitted measurement period. It demonstrates why preliminary acquisition tables should not be mistaken for settled economics.

A controls exclusion is not a failed audit

The phrase “excluded from our audit” can sound more alarming than the disclosure warrants. PwC issued an unqualified opinion on Zscaler’s consolidated financial statements. It also concluded that the company maintained effective ICFR at 31 July 2026, based on the applicable control framework, while explicitly excluding the four recently acquired subsidiaries from the control audit.

The distinction matters. An ICFR audit tests processes that support reliable financial reporting: authorisation, record maintenance, prevention or detection of material misstatement, and preparation of accounts. A newly acquired business may use different billing systems, contract repositories, approval chains and close procedures. Integrating those systems into the parent’s control environment takes time.

The disclosed scale is unusual enough to deserve attention. The excluded companies represented only about 0.1% of consolidated assets but 4.4% of revenue. That can occur in software and services businesses with asset-light operations, especially when goodwill and acquired assets are recorded at the parent level or the operating entities themselves hold few tangible assets. It does not mean 4.4% of group revenue was unaudited. Revenue and balances remain within the consolidated financial-statement audit; the exclusion concerns the scope of ICFR assessment and testing.

Nor is the exclusion evidence that controls at the subsidiaries were ineffective. It says they were outside that year’s asserted and audited perimeter. The next analytical question is temporal: when will each business enter the group control scope, and will any remediation or system migration be required before then?

That timetable connects governance to economics. Billing, renewal, contract modification and customer-credit controls are the machinery through which acquired ARR becomes reported revenue and cash. A growth bridge without control integration is incomplete; a control statement without customer economics is equally incomplete.

RPO and deferred revenue do not solve the attribution problem

Zscaler ended July with US$7.3654 billion of remaining performance obligations. It expected to recognise 45% within twelve months and 90% within three years. Deferred revenue was US$2.9258 billion, 19% higher than a year earlier.

Both measures strengthen visibility, but neither isolates acquisition contribution. RPO is the contracted transaction price for obligations not yet satisfied. Deferred revenue is the unearned portion of billed subscription fees. ARR annualises a subscription run rate. A contract can affect the three measures at different times depending on term, invoice schedule, acquired deferred-revenue accounting and renewal assumptions.

It would therefore be wrong to subtract Red Canary ARR from RPO, or to use the deferred-revenue increase as proof that all acquisition revenue is secured. The public disclosures do not provide acquired RPO, acquired deferred revenue or a purchase-accounting roll-forward by company.

Cash flow adds another boundary. Fiscal-year operating cash flow was US$1.1297 billion, but fourth-quarter free cash flow fell to US$60.8 million, or 7% of revenue, as purchases of property, equipment and capitalised internal-use software reached US$218.5 million. The release explains the capital intensity of the quarter; it does not allocate acquisition integration cash, acquired working capital or acquired customer collections.

The correct response is not to force a synthetic answer from mismatched totals. It is to ask for one consistent acquisition schedule.

The bridge should keep four rows constant

A decision-useful table would list Red Canary, SPLX, SquareX and Symmetry in separate rows. Columns would show acquisition date, cash consideration, initial and final purchase-price allocation, opening ARR where relevant, closing ARR, recognised revenue, retention, cross-sell, gross margin, integration cost and ICFR status.

Not every field needs exact dollars. Ranges or materiality bands could protect commercial sensitivity. What matters is that the company retain the same four-row population across growth, accounting and controls. An “other acquisitions” subtotal would be better than allowing the reader to infer zero from silence.

For Red Canary, the market needs to distinguish inherited subscription renewal from new Zscaler-sourced demand. The disclosed exception for certain fiscal-2026 expiring contracts is a useful signal that management already has a more granular view. Publishing cohort retention or a close-to-year-end ARR bridge would make the US$114 million, US$127 million and US$141 million sequence more informative.

For SPLX, SquareX and Symmetry, the important evidence may initially be product integration rather than ARR. The market could track launched capabilities, customer adoption, attached contract value and final purchase accounting. A technology acquisition can create value without preserving a standalone revenue line, but that value should eventually appear in adoption, pricing, margin or retention.

For all four, control status should move from excluded to included on a disclosed timetable. The most persuasive evidence would be clean inclusion in fiscal-2027 ICFR testing, stable final valuations and growth that no longer requires acquisition-adjusted caveats.

The evidence supports growth, with a narrower claim

Nothing in the perimeter mismatch invalidates Zscaler’s reported results. Revenue and ARR grew 25%. Even the company’s Red Canary-excluded comparison shows 20% growth. RPO is large, deferred revenue expanded and fiscal-year operating cash generation remained strong. These facts are meaningful.

The narrower conclusion is about attribution. “Acquisition-adjusted” is not yet a complete synonym for “organic” when only one of four acquired businesses is removed and when the company does not publish consistent subsidiary-level bridges. It is a useful comparison constructed around the material contributor.

Likewise, the ICFR exclusion is not evidence of an adverse opinion. It is evidence that acquisition integration has an accounting-control clock as well as a product and revenue clock. Investors should watch those clocks converge.

Zscaler guides fiscal-2027 revenue to US$3.908 billion–US$3.938 billion and ARR to US$4.396 billion–US$4.426 billion. The next year will make the perimeter question more important, not less. Once the acquired businesses have been owned for a full cycle, inherited ARR, cross-sell, valuation changes and control inclusion should be easier to separate.

The defensible reading today is that Zscaler has strong reported and acquisition-adjusted growth, but not yet a single acquisition reconciliation. The company’s four new businesses appear differently in the growth release, the purchase-accounting note and the control opinion. A bridge using the same rows would turn three valid disclosures into one investable account of integration.

Sources