Zscaler closed its fiscal year on 31 July with revenue up 25% and then told investors to expect roughly 17% growth next year. Rubrik's quarter ended the same day; it raised its full-year targets and said its newest acquisition contributed nothing to the increase.

The two names sit in the same corner of the security market, both turned into rising trends this summer, and both jumped on 27 August in the session after CrowdStrike and Okta reported — Zscaler 11.0%, Rubrik 11.9%. What the reports now show is that they are not selling the same thing. Zscaler sells no appliance: its core products, Zscaler Internet Access and Zscaler Private Access, are a cloud proxy sold per user per year, so its earnings base is licensed seats multiplied by modules per seat. Rubrik sells data security and cyber recovery, charging for the volume of data under management and the ability to restore it. One meter is tied to white-collar headcount; the other is tied to data growth and ransomware mandates.

The seat meter slowed once the acquisition is removed

Zscaler's fiscal fourth quarter put annual recurring revenue at $3.771bn, up 25%. Excluding Red Canary, the managed-detection business it bought, ARR grew 20% and net new ARR grew 17%; Red Canary carried $141m of the total. Dollar-based net retention held at 115% through every quarter of fiscal 2026 — the modules-per-seat expansion did not widen. Customers spending more than $1m a year reached 785, up 18%, and the contracted book, remaining performance obligation of about $7.4bn, grew about 27%, only modestly ahead of reported revenue. Guidance for fiscal 2027 ARR of $4.396bn–$4.426bn is 16.6% to 17.4% growth.

The fear that buying a services business would dilute the model did not materialize: non-GAAP gross margin rose 90 basis points to 80.2% and non-GAAP operating margin hit a record 24.3%. Zscaler has still never reported a GAAP operating profit, losing $133.3m at that line in fiscal 2026. Alongside the guide it announced a restructuring of about 3% of staff at a charge of $30m–$33m, moving the money to specialist sellers and smaller-enterprise coverage. "It's essentially rebalancing, reallocation of some of our resources with better leverage and also better investments in the AI era we are looking at," chairman and chief executive Jay Chaudhry said on the 3 September call. The non-seat surfaces are real but small: bookings for Security for AI rose more than 50% sequentially, and the Z-Flex consumption contract produced more than $1.7bn of total contract value in fiscal 2026.

The data meter accelerated, and the stock fell anyway

Rubrik's July-quarter report showed revenue of $427.3m, up 37.9%, subscription ARR of $1.66bn, up 33%, net new subscription ARR up 35% and net revenue retention above 119%. Guidance went up across the board, to $1.88bn–$1.885bn of subscription ARR and $323m–$333m of free cash flow. "This is our 10th consecutive quarter of outperformance as a public company. And this quarter, we accelerated—yes, let me repeat, accelerated net new subscription ARR growth," chief executive Bipul Sinha told investors on 27 August. The suspicion that the growth is old perpetual-license customers being converted does not hold: cloud ARR is 89% of the mix and grew 39%, and the legacy pool is growing again on sovereign-cloud and regulated-industry demand.

The cautions are elsewhere. Gross margin slipped to 78.4% from 79.5% on falling material-rights revenue, which dropped from $8.5m to $4.7m sequentially. GAAP operating margin is -16.8% and the quarter carried a $61.8m net loss, so positive free cash flow rests on stock-compensation add-backs and deferred-revenue build; consensus sees no positive GAAP net income year before fiscal 2028. Shares fell 11.8% the day after the raise.

Where the budget is actually going

The rest of the group argues that consolidation, not seat count, is the buying unit. CrowdStrike posted record net new ARR of $333m, up 51%, with its FalconFlex bundle at $2.29bn of ARR, up 101%. Okta grew revenue 10.6% while operating income rose 161% — a seat business converting to profit rather than growth. Palo Alto's next-generation security ARR reached $9.10bn, up 63%, but its own fiscal 2027 guide implies 22–23% once CyberArk and Chronosphere sit on both sides. Fortinet, the profitable outlier at 33.7% GAAP operating margin, told investors on 29 July it displaced a cloud-only rival in a seven-figure pharmaceutical deal covering more than 45,000 users; Cloudflare, growing fastest at 35.9%, pitches an agent-first approach against what it calls legacy human-seat models. Both are aiming at the socket Zscaler bills per user.

The verdict

Zscaler's de-rating is earned: adjusted for CrowdStrike's four-for-one July split, Zscaler is the only one of the seven down over twelve months, by 36.7%, and the 17% guide explains why. It is also now the cheapest of the group at 35.0x forward earnings and 9.11x forward gross profit, and its trailing price against gross profit, 10.66x, is only about a tenth above the 9.42x of early May. The market has priced deceleration; what it has not priced is any evidence the non-seat surfaces break the headcount link. Rubrik is the mirror: the meter accelerated, but the same measure has gone from 10.48x in early May to 15.59x now, faster than its 36% gross-profit growth, and a beat-and-raise met with an 11.8% fall is what a multiple running ahead of a business looks like. Yields jumping after the 4 September jobs surprise explains the group-wide giveback since 31 August; it explains nothing about the gap between the two disclosure sets.

Both companies now have a number they must beat in public. Zscaler's is 115% net retention, unchanged for four quarters and the single figure that would show seats and modules expanding again.