Latest / Startup Stories with Fexingo: Conversations About Founders, Funding, and Building Companies from Zero / How Zscaler Built a Billion Dollar Business on Zero Trust Security
Transcript
- Lucas: If you work in any kind of corporate IT environment, you've probably heard the term 'zero trust' thrown around a lot in the last few years. It's become this catch-all phrase for modern cybersecurity. But the company that basically invented the zero trust architecture as a product — Zscaler — was founded way back in 2008, years before the term was cool. Luna: Right, and I think a lot of people assume it's just another legacy security vendor that pivoted. But Zscaler's origin story is actually pretty contrarian. Founder Jay Chaudhry bootstrapped the company for seven years before taking any venture capital. Lucas: Exactly. Chaudhry had already sold a previous security company, SecureIT, to VeriSign for around 70 million dollars in 2000. He could have retired. Instead, he started Zscaler from scratch with his own money — about 2 million dollars of personal savings — and didn't raise a dime of outside funding until 2015. Luna: That's almost unheard of in enterprise software today. Most founders raise a seed round before they even have a product. Lucas: And Chaudhry did it during the 2008 financial crisis, which makes it even more striking. He was convinced that the traditional network security model — the castle and moat approach where you put a firewall around your corporate network and trust everyone inside — was fundamentally broken. He believed that with cloud computing and mobile devices, the perimeter had dissolved. Luna: So what was his insight exactly? I mean, everyone saw the shift to cloud happening. Why didn't anyone else build this sooner? Lucas: Part of it was that the incumbent vendors — Cisco, Palo Alto Networks, Check Point — were all built around hardware appliances. Their business models depended on selling boxes that sat in data centers. Chaudhry's insight was that security should be delivered as a cloud service, not a box. He called it 'security as a service' long before that term existed. The idea was to route all traffic through Zscaler's cloud, inspect it, and only allow access based on identity and context — never trust any device or user automatically. Luna: So it's less about where you're connecting from and more about who you are and what device you're using. That's the core zero trust principle. Lucas: Exactly. Zscaler's platform essentially becomes the new network perimeter — but it's in the cloud. Every request goes through their proxy, and policies are enforced in real time. It's a massive technical challenge because you have to process billions of transactions a day with near-zero latency. Luna: And how did they get their first customers? Selling a completely new category to risk-averse CISOs can't have been easy. Lucas: Chaudhry's go to market strategy was actually very focused. He targeted chief information security officers at large enterprises who were frustrated with the complexity and cost of traditional firewall appliances. He would show up with a simple pitch: 'Stop buying boxes. Let us handle security in the cloud.' And because he had built the product himself with his own money, he could offer proof points from early deployments. Luna: I read that one of their early breakthrough customers was a major global bank. That's a huge trust signal. Lucas: Yes, and that was key. Once you land a bank, especially in the late 2000s, other large enterprises take notice. By 2010, Zscaler had about 500 customers, all acquired without a sales team — it was all founder-led sales. Chaudhry himself was the primary closer for years. Luna: So when did they finally decide to raise venture capital? Lucas: In 2015, they raised a 38 million dollar Series A from TPG and others. By then, they had over a thousand customers and were already doing north of 50 million in annual recurring revenue. Chaudhry said he didn't need the money for survival — he wanted to accelerate growth and expand globally. They followed up with a 100 million dollar round in 2017. Luna: And then the IPO in 2018. I remember it was a big deal because Zscaler was one of the first pure-play cloud security companies to go public. Lucas: The IPO priced at 16 dollars a share, valuing the company at about 2 billion. By mid-2026, the stock has traded as high as 250, and the market cap is well over 30 billion. That's a 15x return from the IPO in eight years. Not bad for a company that bootstrapped its first seven years. Luna: It's interesting — the zero trust concept has now been adopted by everyone, including the very incumbents Zscaler was disrupting. But Zscaler's architecture is fundamentally different because it was built cloud-native from day one. Lucas: That's the key moat. Competitors like Palo Alto Networks have added cloud features, but their core products were designed for on-premise appliances. Zscaler's entire stack runs on its own global cloud, with over 150 data centers. That's incredibly hard to replicate. And they've continued to expand — they acquired CloudKnox for cloud infrastructure entitlement management, and they've built out a zero trust platform for branch offices too. Luna: Recently, they also launched Zscaler for Users and Zscaler for Workloads, which essentially extends the zero trust model to every type of connection. It's become a platform play. Lucas: Right. And that platform shift is crucial because it increases switching costs. Once a customer routes all their traffic through Zscaler, ripping it out is a massive undertaking. That's how you build durable recurring revenue in enterprise software. Luna: Speaking of durable, one thing I admire about Chaudhry's approach is that he was willing to be patient. He didn't chase the hype cycle. He just built a product that solved a real problem and let the market come to him. Lucas: It's a lesson a lot of founders could learn from. You don't have to raise a huge round and burn cash to prove your thesis. If you can get to product-market fit on your own terms, you retain more control and ultimately create more value. Zscaler's story is a great counterexample to the 'move fast and raise money' mantra. Luna: Absolutely. And I think that's one reason why listeners really appreciate these deep dives into specific company stories. It helps to see the actual decisions behind the success. Lucas: Yeah, and that's actually something that keeps us going. We get notes from listeners saying these conversations have helped them think differently about their own work or their own startup. And it's not lost on us that a handful of you support the show directly through buy me a coffee dot com slash fexingo. That genuinely helps us keep doing these episodes without any ads. Luna: It's a small group, but it makes a real difference. And it means we can stay independent and focus on the stories we find most interesting. Lucas: Right. So back to Zscaler — one more piece I want to highlight. Chaudhry has said that the biggest challenge wasn't technology or competition. It was convincing the market that a new category was needed. He spent years educating CISOs about why the old model was failing. That missionary work is often underestimated in startup post-mortems. Luna: And now zero trust is basically mandated by the U.S. government's executive order on cybersecurity. So he was right, but it took over a decade for the rest of the world to catch up. Lucas: Exactly. That's the long arc of category creation. If you're building something truly new, you have to be prepared for a long education phase. But if you survive it, the payoff can be enormous. Zscaler is a masterclass in that. Luna: Great point. Thanks for walking us through this one, Lucas. Lucas: Thanks for the conversation. And to everyone listening, we'll be back with another startup story soon.