Zscaler beats Q4 estimates but shares hold flat after-hours. Shares in Zscaler Inc. sagged in after-hours trading today even after the cloud security company beat Wall Street estimates on both revenue and earnings in its fiscal fourth quarter and issued fiscal 2027 earnings guidance above analyst expectations. The stock fell 2% on the news, after gaining about 5% during the regular session ahead of the report. For the quarter that ended on July 31, Zscaler reported adjusted earnings of $1.19 per share, up from 89 cents in the same quarter a year earlier, on revenue of $898.2 million, up 25% year-over-year. Analysts had been expecting $1.09 per share on revenue of $877 million. Annual recurring revenue closed the year at $3.771 billion, up 25% year-over-year, with $246 million of that booked in the fourth quarter alone. Some of the growth was bought. Zscaler completed its $675 million purchase of managed detection and response provider Red Canary Inc. on Aug. 1, 2025, the opening day of its 2026 fiscal year, and that business carried $141 million of annual recurring revenue into the total. Minus Red Canary, the company's growth rate was 20%. Adjusted operating income of $218.4 million worked out to 24% of revenue, which Zscaler said is a record for the company, up from 22% a year earlier. The unadjusted net loss narrowed to $3.4 million from $17.6 million. Deferred revenue ended the year at $2.926 billion, 19% higher. The company generated $60.8 million of free cash flow, or 7% of revenue, against $171.9 million and 24% a year earlier, as capital expenditures and internal-use software costs jumped to $218.5 million from $78.7 million. Zscaler framed the year around AI. Its Agentic SecOps, data security and Security for AI lines now sit alongside the Zero Trust SASE products the company was built on. Chairman and Chief Executive Jay Chaudhry called the technology "one of the most significant opportunities in Zscaler's history." Users, workloads, branches and now AI agents get wired straight to the applications they need, Chaudhry said in the company's earnings release, with none of them joining a corporate network an intruder could then move around in. The agents themselves are now on the list of things customers ask Zscaler to secure. For most of its life, Zscaler sold seats. Growth is now "broadening beyond users," Chief Financial Officer Kevin Rubin said, crediting products that are not sold by the seat. The company's Z-Flex buying program is doing some of that work. Large deals set a record in the quarter, and Rubin said sales productivity improved. Zscaler expects revenue of $935 million to $939 million in the first quarter of fiscal 2027, growth of about 19%, with adjusted earnings of $1.15 to $1.16 per share. Analysts had been looking for about $928 million. For its fiscal year ahead, Zscaler said it expects adjusted earnings of $4.86 to $4.90 per share and revenue of $3.908 billion to $3.938 billion. Annual recurring revenue is expected to come in at $4.396 billion to $4.426 billion. Photo: Zscaler. A message from John Furrier, co-founder of SiliconANGLE: Support its mission to keep content open and free by engaging with theCUBE community. Join theCUBE's Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities. * 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more * 11.4k+ theCUBE alumni - Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network Are you an AWS customer? Support SiliconANGLE financially by buying your AWS services from its Marketplace portal page and links: https://siliconangle.com/aws-marketplace/. About SiliconANGLE Media. SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios - with flagship locations in Silicon Valley and the New York Stock Exchange - SiliconANGLE Media operates at the intersection of media, technology and AI. Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Its new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.

Train, triage, repeat: The AI agent changing how Red Canary Inc. fight phishing. Learn how Red Canary engineered a super agent - blending ML, a rules engine, similarity, agentic AI, and LLMs - to classify phishing emails. With 94% accuracy, it makes the case for what a hybrid AI SOC can achieve. June 30, 2026 Red Canary Inc. has already established that artificial intelligence is raising the bar for adversaries. This is especially the case when it comes to crafting phishing messages. These days, an AI tool can make personal and well-formatted phishing emails that seem legit, even to a trained analyst. Advances in adversarial deception and the sheer volume of potential phishing emails have pushed defenders to innovate. The Anti-Phishing Working Group (APWG) observed over 3.8 million phishing attacks in 2025 - with Q2 alone accounting for more than 1.1 million, the highest quarterly total in two years. At that scale, no team can tackle triage unaided. That's why Red Canary has equipped its phishing analysts with an AI triage agent built to handle the bulk of the triage work at scale. How does it work? Red Canary Inc. has learned that using one catch-all agent that is ok at doing many tasks is not very reliable or scalable. For this reason, Red Canary Inc. assembled a team of orchestrated subagents, integrated as a complex graph workflow that manages each of the agentic loops, chains and deterministic nodes. Each subagent is tightly scoped to specific subtasks of an email investigation and the whole agentic workflow, paired with a feedback loop, gives Red Canary Inc. accuracy of 94%. Email parsing and enrichment. The first subagent to see a reported email is its parsing and enrichment agent. Starting with the raw email, the subagent parses it into a standard data object to streamline analysis in the workflow. The subagent enriches the metadata with external services giving domain reputation, abuse levels and flagging other indicators from past phishing campaigns. Traditional and AI-powered feature extraction. The next subagent in the workflow is its feature extraction agent. This subagent analyzes the parsed email and produces a set of true/false features that drive the triage process. Features come from two sources: traditional code checks that follow classic boolean logic, where a feature is true if a condition is met, and AI-powered checks where the subagent uses carefully crafted prompting to return true/false values along with reasoning. Leveraging AI for feature extraction enables much richer signals powered by Natural Language Processing (NLP), capturing sentiment, intent, and emotion, all distilled into simple true/false features. Rules engine and deterministic outcomes. Before information reaches the classification subagent, it is first run through its rules engine. While its triage agent is highly accurate overall, AI is not perfect; the rules engine ensures deterministic outcome. Rules support both raw email data and extracted features, enabling TTP-level detection that pairs rich NLP features with atomic indicators from the email metadata. The rules engine can also be fine-tuned to fit specific customer environments, which is essential since each environment has unique characteristics that influence false positive rates. Rules can also be created from intelligence on emerging campaigns, eliminating the chance of the classification subagent missing novel phishing threats. Hybrid AI/ML classification. When no rule matches are found, its classification subagent makes the final decision. Extracted features are used to train a classical ML model on emails previously assessed by its analysts. The model is trained exclusively on true/false feature value, no customer data or email content is ever used in training. The feature importance weights from the trained model are then added to the classification prompt, allowing the subagent to factor them into its assessment, creating a hybrid AI/ML approach. After reaching a final classification, the subagent, a reasoning deep agent, generates a summary and explanation detailing the reasoning behind its decision. Transparent by design. Regardless of where the classification takes place, all classifications will have a category, a high level summary and a deeper explanation of the classification. The feature values and feature explanations can also be seen for those who want a deeper understanding of how the agent actually makes its decision. Always learning. As this is a new technology, Red Canary Inc. is constantly reviewing and refining its agent with analyst-driven feedback loops. These feedback loops not only improve the agent but maintain its adaptability - with analysts at the helm, continuously shaping new features and capabilities. A hybrid approach is the great enabler in the cat and mouse game of phishing technologies, allowing the analysts to focus on the more nuanced, bespoke phishing techniques while the agent does the bulk of the work. The dual-use dilemma: Rethinking detection for remote access tool abuse. How threat hunting evolves at scale. Investigating suspicious AI workflows in Microsoft Entra Agent ID: Assistive agents. * Threat detection Investigating suspicious AI workflows in Microsoft Entra Agent ID: Agent's user account. You'll receive a weekly email with its new blog posts. See Red Canary in action. Watch the 10-minute demo now. Security gaps? Red Canary Inc. got you.