Zoom: how it handled thirty times the usage in a few months of 2020

The situation

In December 2019, Zoom’s video meetings were attended by about 10 million people a day, according to figures reported by YourStory. By April 2020 the number had reached 300 million. The same report said the climb from 200 million to 300 million took only 20 days. That is thirtyfold growth in daily participants in about four months, caused by a change in how a large part of the world worked and studied rather than by any new product.

The company had planned for steady growth. It had not planned for schools, governments, families and entire offices moving onto its software at once. With the new users came attention to how the product had been built. Security researchers, regulators and journalists looked closely at features that had suited a business tool sold to paying companies but suited the public badly. On 1 April 2020 Zoom’s chief executive, Eric Yuan, announced a 90-day programme of seven security and privacy commitments and froze work on other new features.

The question for this case is what a fast-growing company should do when demand overtakes its readiness. Zoom could have kept shipping features to hold off rivals, or it could have stopped and fixed what was weak. It chose the second path. The financial results that followed, and a US regulator’s settlement later in the year, give a clear view of what that choice did and did not achieve.

Background

A founder from WebEx

TechCrunch reported in 2019 that Zoom was founded in 2011 and based in San Jose, California. Its chief executive, Eric Yuan, had come to the United States from China as a student. He applied for a US visa nine times over two years before getting one and arriving in Silicon Valley in 1997. He was the tenth employee at the video-conferencing company WebEx. When he left to found Zoom, 45 WebEx employees went with him. WebEx had been sold to Cisco in 2007 for $3.2 billion.

That history matters for two reasons. Yuan knew the market for business meeting software well, and he was building a product aimed at the weaknesses he had seen in the older generation. It also meant Zoom began as a company selling to organisations. The sources opened do not describe its early design choices, but the FTC’s later complaint and the changes made in 2020, such as default passcodes and waiting rooms, suggest a product built for known groups of users, not for large public meetings with strangers.

Funding and the road to a listing

By early 2019 TechCrunch put Zoom’s total funding at $145 million. It had been valued at $1 billion when it raised $100 million from Sequoia Capital in 2017. Reports at the time said it had filed confidentially with the US Securities and Exchange Commission and could list as early as April 2019, with Morgan Stanley expected to lead the offering. Yuan was ranked first on Glassdoor’s list of best-rated chief executives in 2018. The details of the offering itself are not in the sources opened for this case.

A product sold to paying customers

Zoom’s financial reports describe its customers by size, which shows where it saw its business. The financial results for the year to 31 January 2021 give an idea of the size of the base. At that point about 467,100 customers had more than ten employees, a figure that Zoom said had risen by roughly 470 per cent in a year. The growth rate suggests a base of roughly 82,000 such customers a year earlier. That is a derived figure and should be treated as approximate.

The industry

Video conferencing in 2019 was a market of established vendors, including the business Yuan had left, and of large technology companies that bundled meeting tools with other software. Customers judged these products on reliability, ease of joining and cost. Security was a purchasing criterion for large enterprises, which employed security teams to review suppliers, but it was rarely a feature that ordinary users thought about.

Two features of this market matter. The first is that video meetings have network effects at the edge. A tool spreads when one person invites many others, and a guest who has a good experience becomes the next host. A product that is easy to join spreads faster than one that is not. The second is that the cost of serving an extra user is real. Video uses a great deal of bandwidth and computing power, so a sudden surge in usage puts pressure on infrastructure as well as on support and security teams.

Regulation also shaped the situation. In the United States the Federal Trade Commission can act against companies for unfair or deceptive practices, including claims about security that turn out to be misleading. Privacy rules in places such as California affected how a company described its data handling. Zoom’s own 90-day report mentioned new policies connected to California privacy legislation, and a guide to how it responds to government requests for data.

The decision

By late March 2020 Zoom’s leadership faced scrutiny of its product at the same moment that demand was peaking. The sources do not set out the options the company weighed, so the alternatives below are framed as the obvious ones rather than as a record of internal debate.

Keep building features and fix problems as they appear

A company can respond to criticism with a series of patches while continuing to release new functions. The attraction is speed: rivals with large installed bases would not stop adding features, and growth might not last. The risk is that each patch deals with one complaint and leaves the design that caused it. When trust is the issue, a stream of fixes can look like a stream of admissions.

Stop new features and rebuild trust

The alternative was to put a halt on work that did not concern privacy, safety or security and to redirect the engineers. Computer Weekly reported that from 1 April Zoom froze new feature work and sent its engineering resources to those goals. The attraction was a cleaner story and a more durable product. The cost was the risk of falling behind rivals during the busiest period the company had ever had.

Say little and wait for attention to move on

A third course was to respond narrowly, to the specific incidents, and wait. The size of the user base made this unattractive. Schools, governments and large companies were among the new users, and some of them were considering whether to ban the product. Silence would have given those customers no reason to stay.

What they did

Announce a 90-day plan

On 1 April 2020 Zoom launched a 90-day programme with seven security and privacy commitments. Yuan reported on each one in a blog post dated 1 July 2020. The seven were a freeze on non-security features, reviews by outside experts, a transparency report, a bug bounty programme, a council of chief information security officers, white-box penetration tests, and a weekly series of webinars.

Freeze features and ship security changes

According to the July report, Zoom released more than 100 features during the period. They included AES 256-bit GCM encryption for all meetings, free and paid, a security icon and encryption shield, a way to report a user, and meeting defaults for passcodes, waiting rooms and limited screen sharing. Hosts gained controls such as disabling multiple-device login and requiring consent to unmute. Zoom also acquired Keybase, with work under way on end-to-end encryption, and let paying customers choose the data centre used for certain processing. YourStory reported that the changes included a new icon for reporting uninvited guests.

Bring in outside experts

Zoom worked with outside specialists, including Alex Stamos and Lea Kissner, described by YourStory as a former Facebook security chief and a former Google privacy technology lead. The July report also named security firms Bishop Fox, Trail of Bits, NCC Group, Praetorian and CrowdStrike, as well as the Center for Democracy and Technology. Three of those firms carried out white-box tests of Zoom’s production environment, corporate network, web application and clients.

Open the process up

Zoom built a central bug repository that took reports from the bug bounty platforms HackerOne and Bugcrowd and from its own security email address, and hired more security engineers. It set up a council of 36 chief information security officers, led by Deputy CIO Gary Sorrentino, which met four times in three months. Computer Weekly said the council drew input from more than 30 large organisations, naming HSBC and Sanofi. Zoom held 13 weekly privacy and security webinars, one every Wednesday from 1 April, and then moved to a monthly schedule. It also published a guide to government data requests and began work on a transparency report, planned for fiscal second-quarter data later in 2020.

Change the people

The July report named Jason Lee as Chief Information Security Officer, with chief operating officer Aparna Bawa overseeing security work. It added that Zoom Phone had been added to Zoom for Government, which holds FedRAMP Moderate authorisation, from 15 June 2020, and that new research and development offices were planned for Phoenix and Pittsburgh.

What happened

Growth and profit

The financial results for the year ended 31 January 2021 show how demand held up. Revenue was $2,651.4 million, up 326 per cent. The growth rate implies revenue of roughly $620 million in the previous year, a derived figure. Fourth-quarter revenue was $882.5 million, up 369 per cent. Customers with more than ten employees numbered about 467,100, and 1,644 customers contributed more than $100,000 in trailing twelve-month revenue, up roughly 156 per cent. Zoom said the net dollar expansion rate for customers with more than ten employees stayed above 130 per cent for the eleventh quarter in a row.

The company was profitable as well as large. Net income was $671.5 million and free cash flow $1,391.2 million. Guidance for the next year was for revenue of $3.760 billion to $3.780 billion, which implies growth of about 42 per cent.

The regulator’s verdict

On 9 November 2020 the Federal Trade Commission announced a settlement with Zoom. The agency alleged that Zoom had claimed end-to-end, 256-bit encryption while providing a lower level of security, and that it held the cryptographic keys that could give it access to meeting content. It also alleged that cloud recordings were described as encrypted immediately after meetings when some were stored unencrypted for up to 60 days. A third allegation concerned a web server that Zoom installed on Macs through a manual update in July 2018, which bypassed a Safari safeguard and stayed on computers after users deleted the app. Apple removed it in July 2019.

The settlement required Zoom to run a documented information security programme, carry out annual risk assessments, manage vulnerabilities, use measures such as multi-factor authentication, review software updates so they would not weaken third-party security features, stop misrepresenting its privacy and security practices, undergo independent assessments every two years and notify the FTC of data breaches. The release as read did not mention a financial penalty.

Other views

The regulator and its dissenters

The FTC voted three to two to issue the complaint and accept the consent agreement. Commissioners Rohit Chopra and Rebecca Kelly Slaughter dissented. The majority statement came from Chairman Joe Simons and Commissioners Noah Joshua Phillips and Christine Wilson. The sources opened do not give the dissenters’ reasons, so the case cannot say why they voted against, only that the decision was not unanimous.

Zoom’s own account

Yuan described the 90 days as a first step and said privacy and security remained ongoing priorities. YourStory quoted him on reaching the end of one stage: “I am proud to reach this step in our 90-day plan, but this is just the beginning.” A company report on its own programme is evidence of what it did, not independent proof that the product became safe. The report counted features and meetings, and it did not publish test results.

Questions of timing

Several of the FTC’s allegations concerned events well before the pandemic, including the July 2018 web server and encryption claims made earlier. The 90-day plan therefore addressed problems that predated the surge. The surge exposed them to a far larger audience, but it did not create them. A critic could argue that a company with a stronger security culture would not have needed a crisis to fix them.

Limits of the evidence

The sources do not show how many customers left because of security concerns, or how many would have signed up without them. The financial results show strong growth despite the criticism, which suggests that the product’s convenience outweighed concerns for most buyers. They cannot show how much growth the company lost.

Reading it through a framework

Network effects and switching costs

Zoom’s surge fits a network-effects pattern in which each new host brings guests, and each guest may become a host. Daily participants grew from 10 million to 300 million, and 100 million of that came in 20 days. Low friction in joining made the spread possible. Switching costs explain why many users stayed through the criticism. Once a school or office had set up recurring meetings, trained staff and invited outsiders by link, changing tools would have cost time. The net dollar expansion rate above 130 per cent for eleven quarters shows existing paying customers spending more, not fewer, dollars with Zoom. The framework also shows the weakness: where switching is cheap, as for casual users on the free tier, trust matters more.

Stakeholder mapping

Stakeholder mapping separates those with power and interest. Regulators held formal power and used it in November 2020. Large enterprise buyers held commercial power and were engaged through the council of 36 chief information security officers. Security researchers held influence because they could publicise weaknesses, and Zoom answered with a bug bounty and outside penetration tests. Employees were affected by the freeze and the redirection of engineering work. Individual and school users had the largest numbers but little power to demand change, so Zoom’s response to them took the form of defaults, such as passcodes and waiting rooms, that protected people without asking them to configure anything.

Since then

By the year ended 31 January 2025, Zoom’s revenue was $4,665.4 million, up 3.1 per cent on the year before, according to its results filed with the SEC. Enterprise revenue was $2,754.2 million, up 5.2 per cent. GAAP net income was $1,010.2 million, operating cash flow $1,945.3 million and free cash flow $1,808.7 million. Cash and marketable securities stood at $7.8 billion. The company had about 192,600 enterprise customers and 4,088 customers above $100,000 in trailing twelve-month revenue, up about 7.3 per cent. Online average monthly churn in the fourth quarter was 2.8 per cent, 20 basis points lower than a year earlier. Zoom said it would stop reporting the enterprise customer count from the first quarter of its next fiscal year.

Set against the year ended January 2021, revenue was about 76 per cent higher, which is a calculation from the two figures, and net income was higher too. The explosive growth of 2020 gave way to slow single-digit growth. The pandemic spike lifted the company to a new level, and it has held most of it, but the rate of increase has fallen sharply.

What to take from it

• Fast growth can expose weaknesses that a smaller user base never tested. Zoom’s design suited paying businesses and was less suited to a public of strangers.
• Stopping feature work to fix trust is a costly choice that can be justified. Zoom froze non-security features from 1 April 2020 and still reported revenue growth of 326 per cent for the year.
• Outside review adds credibility that internal statements cannot. Zoom used independent penetration testers, named advisers and a council of customer security officers.
• Claims about security are legal claims. The FTC’s complaint centred on what Zoom said about encryption and recordings, not only on how its software worked.
• A demand spike may set a new base rather than a new trend. Zoom’s growth in the year to January 2025 was 3.1 per cent.

Questions to think about

1. If you were Zoom’s chief executive in March 2020, what would you have wanted to know before deciding to freeze features?
2. How much of the criticism did the 90-day plan answer, and how much did it leave to the regulator?
3. Why might users stay with a product they distrust, and for how long?
4. What would a company need to show to turn a one-off surge into lasting growth?

Concepts at work

This case draws on network effects, switching costs and stakeholder mapping. Explore them in Insights.

Written from the public sources listed below. Figures are as those sources report them.