Fortinet, Inc. (FTNT) Earnings Call Transcript & Summary

We're live. All right. Thanks, everyone, for joining us. My name is Sterling Auty, software technology analyst here at JPMorgan. Very happy to have with me the management team from Fortinet, both Ken Xie, Founder and CEO; and Keith Jensen, CFO. I'm going to turn the screen over to Keith just to do a safe harbor, and then we'll jump into our fireside chat. But before I do that, just a reminder for those attending, that you can click on the Q&A button and enter your questions there, and I'll incorporate them to our session. With that, Keith? Keith, you just have to unmute yourself.

Thank you, Sterling. We're set. I'd like to remind everyone that we may make forward-looking statements during today's fireside chat. These forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially from those projected in these statements. Please refer to our SEC filings, in particular, the risk factors in our most recent Form 10-K and Form 10-Q and to other reports that we may file from time to time with the SEC for additional information on factors that may cause actual results to differ materially from our current expectations. All forward-looking statements reflect our opinions only as of the date of this presentation, and we undertake no obligation and specifically disclaim any obligation to update forward-looking statements. Thank you, Sterling.

All right. Great. With that, Ken, you're one of the early pioneers in cybersecurity, and we've seen a lot of changes through the years, and there's an awful lot of now publicly traded cybersecurity companies. So for those attendees that are a little bit newer to the space, can you maybe spend a quick minute and give a sense of kind of where Fortinet is positioned within the overall cybersecurity landscape?

Okay, yes. Fortinet is a company I founded 20 years ago. Actually, it's my third company in the network security space. And before that is NetScreen, which we sold to Juniper. It's interesting, you can see the last 20, 30 years, so network security is starting to become more and more important in the whole cybersecurity space and have -- now has probably the biggest market share among all the cybersecurity sector here. And so Fortinet. So we IPO-ed in 2009, and thank you for JPMorgan who are the lead banker and keeping us -- Sterling, you're also [ one of the few ] being in this space for so long, 20-some years now. And so it's a very interesting space, work dynamic, but also keep on growing like around 10% year-over-year, and -- but also, however, fragmented. So far, the top 3, top 5 player, none of them over like 15%, 20% of market share. And at the same time, every year, there's a new function, new [ mega ] application will also come up. So we have addressed the issue. At the same time, the traditional function, the old function like firewall, VPN, you also need to keep up the performance requirement because networks like network speed almost double every 2 years. And the network security has to be in the middle of a network to stop the bad traffic. So that's where you cannot become a bottleneck and slow down the whole infrastructure. So it has to be fast enough. At the same time, network security need a lot more computing power on edge. It may be 30 to 100x more computing power process, the same traffic compared to networking, [ routing and switching ]. So that's the challenge we are facing, and that is a very intricate space.

Well, let's actually dive in there to start off because Fortinet, given your position inside of some of the biggest data centers within both corporate and telcos, et cetera, that speed paradigm is at its most. What's going to happen as 5G becomes more prevalent to the core and the edge of the network? And what's that going to do for the requirements for network security?

The 5G definitely increase the speed and connectivity. And the other part is a little bit similar. Like SD-WAN, they also can draw some traffic based on certain application or a kind of device, or it could be in the user level. So that's where we always believe we call secure-driven networking. That's where -- because so far, pretty much all the Internet traffic is still based on like the Internet protocol we designed like 30, 40 years ago and treat everything the same and deliver the address. And anything above that connection layer, like any application or content or user device, will be addressed by the security. But I do believe, going forward, there's a more need to do what we call the secure-driven networking, including 5G. That's where like a 5G and a secure SD-WAN, also secure WiFi, all this new network technology we kind of developed together with security internally for quite some long time ago, we believe that's the future trend.

Well, I want to -- let's take the conversation into SD-WAN. You've been talking about it for a number of years. And if I think about your product revenue growth, it had started to fade for a while, and it seemed to have kind of catch a resurgence on the back of what you're doing with SD-WAN. And I still believe that a lot of investors are confused in terms of what SD-WAN actually is and what it's providing for customers. Can you give investors a sense of exactly what SD-WAN is and Secure SD-WAN, specifically?

Yes. SD-WAN is interesting. Pretty much the first protocol, they can route the traffic instead of based on the fixed connection. Like MPLS, they can like dynamically route the traffic based on application or based on certain like bandwidth or certain cost dynamic of the traffic. And so that actually save the cost and increase the quality. So that's where you can see it's growing very, very quickly. And I think it's, last year, probably like $1.52 billion and grow like between 50 to 100x -- 50% to 100% year-over-year. And I believe we're still in very early stage. We'll keep on growing the next 5 to 10 years because these really address quite a lot of current networking protocol, Internet protocols issue. And for us, we developed this technology probably like 5, 7 years ago. And just like we developed WiFi with security 10 years ago, we do believe like secure-driven networking going forward, really the network traffic will be better routed based on not just the fixed connection of the address and treat everything the same, flat. It should be based on application, content, device, user, region, country, all these kind of things. That will be much better, more efficient, more secure, more safe and high quality if we can address that one. So that's where for our Secure SD-WAN solution, we not only can reroute some of the traffic based on application but also can be other function like with content, with -- at device level, user level or regional level. And that's actually much more than just the traditional SD-WAN or the other SD-WAN player.

So what do customers save economically switching off of MPLS? And where are the connection -- where is the traffic flowing through? In other words, is this branch office to the cloud, branch office to headquarters?

It's interesting. Probably majority of SD-WAN deal is involving mid- or high-end box. That's maybe more like between office or some data center, and they do see some other branch office. And for us, we're building SD-WAN function within the FortiGate, FortiOS. So like Fortinet is the lead provider of network security worldwide. So we have about 30% global deployment and that is close to 6 million FortiGate deployed. So that means all these users already have SD-WAN function in their pocket -- in their hand for free. And so that's where -- but we do -- can track in the new SD-WAN customer. And interesting, probably like 40%, 50% of SD-WAN customer we're tracking is a new customer, which had not been using FortiGate before. That's also helped us get into the new enterprise and new customer base. And like I said, SD-WAN is probably close to 10% of our business and still growing fast. And we kind of -- based on Gartner, like we're 9% of market share in last year and come from lower. Like 2018, we have almost nothing based on the Gartner, even we track some ourselves. But this -- last year, [ about numbers ], we're in the top 3, and then we're keeping grow faster. Probably the top 3 or top 5 vendors, we're the fast growing in SD-WAN provider because we have more a set of function. The average of ASIC computing power from the FortiGate, which is much more powerful compared to the other like universal CPU approach using a low-end general-purpose CPU. That's pretty much all other SD-WAN provider do, which have lacked the computing power to handle the requirement for security or additional SD-WAN function. And I do believe the SD-WAN will keep increase the usage and function and probably need more computing power going forward.

In terms of the -- great to see the market share increase. How big can the SD-WAN market actually get to?

The current forecast probably in 2, 3 years will be reaching from last year like a $1.5 billion to maybe like a $4 billion, $5 billion. But I do believe we'll keep on growing in the next 5 to 10 years. Maybe, Keith, you have some number, I believe, from IDC or Gartner.

I think you're spot on, Ken. I think in '18, it was viewed as being about $800,000; in '19, about $1.8 billion; and then to your point, in 2022, between $4 billion and $5 billion.

That makes sense. And is there -- there seems to be a couple of different approaches. You can have the firewall attach, SD-WAN, and then I think there's dedicated SD-WAN equipment that's out there. Is there an architectural advantage from one approach to the other?

Yes, a single box. And so compared to some other competitor, they may need to have a network box, an SD-WAN box, a security box, and that's where -- we have an all-in-one box, easy to manage. And also, the performance is much better; the cost, much lower. And so that's where -- whether the service provider, the customer all like this. And so we see huge demand for the SD-WAN.

All right. Let's switch gears. The other thing that's very topical, obviously, is COVID-19. And it seems like the network security vendors got a boost in March from VPN capacity being accelerated. What did you experience in the March quarter? And what have you seen thus far in the June quarter?

Yes. We see the last few months the requirement for work from home to access the company application data is that it might increase almost 10x, and especially the VPN side, because we are the only player using our own ASIC chip to accelerate, and huge computing power for VPN performance is, on average, about 10x better, faster than any other competitor will be using. We call the secure computing rating to do this. And the secure computing rating also has been there for the last 2, 3 years to compare the same-cost product with competitor -- with industry average. So that's where VPN or some other called network security functions, on average, about 10x better. So suddenly, whether existing customer or some other customer using competitor products or new customers, they see there's a huge advantage about ASIC-accelerated VPN. And whether it come from a new RFP or some come from existing customer, and so that's where we see quite big [ strength ]. But it's interesting, the other side, we do offer the endpoint like we call FortiClient. That probably grow year-over-year like 300%. But we offer that one for free if you will add it to the VPN. But if some enterprise also want to have some additional function, like how to manage sort of endpoint, then you need to pay for that. So that's where the FortiClient revenue we see the paid part grow like 300%; the free download, probably even much more than that. We don't track in that.

So when you look at what happened in the March quarter with COVID-19, is there any concern that this is a pull forward in demand? And could it create some tough comparison, growth headwinds in the back half of the year?

First, I think we still -- not just us but also other competitors still relatively small market share. We do see Fortinet has more advantage on the VPN, on the other part of the SD-WAN. And I don't see -- this thing will end, not quick. I do see there's a long-term need of changing work from home or some other increase of the network, secure network solution for a lot of enterprise. So Keith, maybe you also see some additional things?

I think just kind of building on that comment of yours, Ken, I think the 3 products that we've talked about previously, FortiAuthenticator, FortiToken and FortiClient, those were very directly linked to the work from home activities that we saw. And I think we made the comment in the earnings call that we -- those 3 products combined outperformed by about $10 million in the quarter, beyond our expectations. But to put it in context, you're talking about $10 million on a $670 million quarter, so by itself, not a huge number. We did provide some clarity or some additional information about April in the earnings call, which included that those same 3 products continued to move in April as well. And I think that probably lines up a little bit with geographies that we saw. Those 3 products started to build a little bit in January and then through February, March and April. And our presumption is what we probably saw in January was more Asia Pacific. And then as we moved into February, it was probably a little bit more Europe. As we got into March, we probably saw the U.S. There's probably still a little bit of tail for those geographies, but now we probably are also seeing something from Latin America as well. And I think that kind of is a good segue into this diversification of the business that we're seeing, where less than 30% of the business is inside the U.S. And so we kind of are riding the different phases, if you will, of the pandemic across geographies.

But I want to get into the customer dynamics or demographics. But before I do that, is there any pull-through from FortiClient or FortiToken that can actually pull or increase demand in other parts of the product portfolio?

I feel it's more like FortiGate is the one pulling the other Fabric product. So FortiGate is still like 70-some percent, like 73%, around 73% of the total [ business ]; the other non-FortiGate, probably like 27%. That is -- you do see some of the Fabric product, we see huge increase like 2, 3x compared to other. Some maybe slowed down a little bit. If we need to deploy the cybersecurity in an office environment, that part may be slow a little bit.

Yes. That makes sense. And we do hear from investors questions over -- thinking that Fortinet kind of came from the mid-market and worked their way up into the enterprise. So how much of the business is still exposed to that kind of SMB segment?

SMB, actually, we do increase the percentage. Whether the low end, whatever, you can see the unit shipment grew like 30% in Q1 last quarter. Whether some SMB -- I think there's a few reasons. I do believe SMB is still -- very small percentage of SMB has the network security. Same thing for like work from home, most people just download the software on their mobile or laptop instead install the firewall network security. FortiGate [ manage ] the whole house, and -- but it comes from a very slow base, and the same -- that means a lot of potential to keep on growing. And on the other side, some verticals started doing quite well, like we mentioned about the carrier service provider. So last year, a little bit slow compared to 2018. Now we see it all come back, sudden become a #1 vertical for us again. And even on the retail, certain retail kind of slowdown and some other, they do see some online business need, whether drive by certain online selling or even service or need some payment, credit card protection, all these kind of things.

And how about -- in terms of some of the heavier-hit industries, any heavy exposure to the transportation, lodging and other hard-hit groups?

Yes. It's different by region, different by vertical. I know Keith is also tracking this quite a while. But because we have quite diversified business come from like different region, different verticals, different segments, so that's where we don't see the material impact for so far. And even because certain product, one day, we see even more benefit compared to some other competitors.

Yes. Just to layer on to that a little bit. I think that the top -- the 5 largest verticals from us typically represent about 2/3 of our business: telco carrier being one of those, of course; financial services; international government; education; and retail. And so retail will be the one that was probably -- it was flat year-over-year in terms of its mix of business, and we'll kind of see how that plays out. If you drop below those, the bottom third, if you will, of our verticals, tech is probably the one that's chomping at the heels to join the top 5. Then you get to these areas you kind of referred to, whether it's transportation, energy, utilities, manufacturing, typically in the mid-single digits of our business.

Ken, were there any lessons that you learned during the kind of 2008 through 2010 time frame that are takeaways that you can apply to how you manage the business through the current economic environment?

Like I say, it's a once on 10-year opportunity. And so if you prepare whether on the technology product or finance, some other, probably that's the time to invest in some growth. And for us has been -- from our beginning and even more after IPO, I think, 11 years ago, we have a quite balance among both growth and profitability. So we have pretty strong finance cash position. So that's where we leverage that. Like Q1, we buy with that -- we bought back about 10 million shares and used about $900 million, which -- so when we see some opportunity and, at the same time, even for hiring, we see more sales or I see come from competitor join us, but we also try to manage the costs, not grow faster than the top line growth. So that so far we see is -- all will go quite well. Probably Keith have more finance insight.

I think you're good, Ken. I think you did a very good job of that one.

How was the transition to work from home? And how have you seen the productivity levels of your employees under this kind of setup?

Like, most of the sales has been working from home anyway, and we do -- don't see much change. Maybe certain like they call the EBC briefing or testing, evaluation, maybe now they'd be challenged. And on the other side, we do see that supporting starting to get pretty heavy loading. So definitely more customers try to using more function of our Fortinet product. And the same time, we manage the manufacture and the shipping, supporting all directly instead of go through third parties. So we have a pretty good way to manage through all these crises, especially like in Q1. So we also have inventory turns about like less than 3x per year. So that means we -- on average, have about 4 months inventory turn. And so that's where we try to balance among what's the best total of those cost compared to inventory costs and opportunity costs and shipping costs and manufacturing costs, all this. So I think we have managed this all from very beginning, the same thing for supporting, the same thing for shipping logistics. And so we own our own shipping logistics center, the team and the same thing for the lot of direct connection with the manufacturer, including ASIC chip manufacturer. So that's where we feel it's much better compared to some other vendor in the space.

What do you think the hurdle is if -- that others that don't own their kind of shipping logistics, what's the risk in their kind of setup versus the benefit that you're getting?

So they probably need to depend on the third-party company to do, whether the manufacturer or the shipping or even sort of supporting, which probably less control. And so far, we don't see impact for us, basically. Probably, Keith, you have more to add on this because Keith managed this all work closely.

Yes. I just think, for context, to put numbers behind what Ken is describing about derisking it, when this thing -- when the pandemic got rolling towards the end of January, early February, we asked the manufacturing team to size the worst-case scenario in terms of supply chain impact. And for the quarter, the worst-case scenario for us was about 5% of total billings. And then as they continued to execute through the quarter through a variety of ways and such, I think they really brought that down into a fraction of that number. So our backlog was not significant. And I think what Ken is pointing out is part of that is the flexibility of controlling your manufacturing lines. Most of our manufacturing is done out of Taiwan, really enabled us in the operations team to have a lot of flexibility together with the sales team in actually delivering on the commitments for the quarter.

And that's also to your point. So that's both -- not only shipping but also supply chain and components for inventory.

Yes.

Yes. We also -- because we design ourselves, we can also change in the manufacturer location when needed, right, so from whether Asia or [ market ] here. At the same time, we also manage the shipping logistics directly. So even certain airline, air cargo short -- I mean is pretty tight, and we still can manage that quite well.

All right. Just as a reminder to the attendees, if you'd like to ask a question, just click on the Q&A button and enter it there, and I'll incorporate it into the session. Ken, when you think about Fabric, how does that position Fortinet to compete as we're seeing more transitional workloads into the cloud and the need for customers to not only secure their on-prem and their [ on-pen ] communications to the cloud but also start to secure their cloud workloads as well?

Yes. There's like 2, 3 parts. First, the reason they like the Fabric, our platform, is really they can manage different part of cybersecurity things together, like the networking, endpoint and different applications. [ You may worry ] about this together. So that's where, for us, most of the Fabric product, which has probably like 30 product now, most come from internally developed product, even like from endpoint, from all the web, e-mail, all different part. And last, making integrate and automate from day 1 compared to most other competitor contract acquisition and -- which is always very challenged to do the integration and automation after you acquire the company. So that's the benefit. But also compared to -- some go to the cloud, we do have the best cloud offering. And at the same time, we always say the edge computing also very important. And we call the Forti SASE is really -- there are some things that will be make sense go to the cloud, like your mobile, your laptop. Or when you work from home to access company, you have to go through cloud provider, a service -- telecom service program anyway. And -- but when in the office, you also forward all the traffic in the office to the cloud to process and coming back probably not the best, efficient way or the secure way or the way to do that. We'd rather prefer the process in the local area network environment, which is much faster compared to you have your full traffic back and forth. So that's what we call the Forti SASE. And also our strategy is really we do believe this kind of SASE as some part of the whole infrastructure security is better working with service provider because they're the one actually offer you the network access, Internet access. At the same time, they have their POP or data center, all these much more than any other, like some SASE provider. And so that's where we are -- we've been working from a few years ago. We say, hey, we'll be the -- working with a service provider will be the best approach for SASE, which is a part of the whole security for some enterprise. And -- but so far, it's worked out quite well.

And how does that setup differ versus others in the marketplace? And maybe you can incorporate how does that compare or contrast from offerings that you get from vendors like Zscaler?

Like, first, we try to go through a service provider. I think the benefit with SASE is really you can forward some traffic to the cloud, like your endpoint traffic, whatever, which have the service provider to help you to manage instead that will depend on IT people or person themselves to do that. That's some of the benefit. But on the other side, forward some traffic back and forth may not be the most secure, efficient way to handle that. If you can process locally at the same time have some other people help to manage -- help you to secure it, so that's probably the best way. So that's why we do believe working with a service provider, which also is our biggest sector. So service providers also like that approach, right? So it's a -- they do feel sometimes the SASE players starting competing with them and take customer away from them. So that's where we see some other network security vendors starting to try to do some kind of SASE themselves, and then the service providers starting to stay away from them. It's kind of worry about, hey, why are you starting to take some of my customer now? So that's why we feel we do respect the partner, the service provider, their business model and working closely with them to offer that approach.

So Keith, if we kind of roll together all the things that we talked about in terms of the impacts of the current environment and some of these trends, how does this kind of impact your long-term targets, if at all?

Yes. I think the -- you kind of know the cadence -- obviously, we gave guidance for Q2, we've been up for the full year, and we provided our targets at our Analyst Day. And really, what we're looking at is our ability to execute the product suite that we have together with the strategy that we've been executing against. And I really don't think that anything that's happened related to the pandemic or what have you has changed any of our assessments in terms of how we view ourselves. I think the only uncertainty at the moment is what does Q3, Q4 look like? And then do we exit that in the shape of a V, a swoosh, a W or what have you? And I think then we'll have a better understanding of what to say about 2021 or 2022.

And how do you manage the head count through this environment, through this process?

We -- sorry, go ahead, Ken.

No. Go ahead, Keith.

I think we've been very successful over the last couple of years about this balanced profitability and balanced growth model that we've looked at. And probably over the last quarter or 2, we looked at the momentum that the company was building, and we started to communicate that. Within that framework, we thought it was time to tilt a little bit more towards growth than we had in the past. And I think you saw that in some of the head count hiring, particularly as related to sales in Q4 and Q1. I think we've now moved into more of a quality versus quantity hiring mode. I think we're very pleased with the quality of the candidates that are coming to our doorstep as well as the growth that our own people have shown over the last several quarters and years. So I do think that we'll continue to manage the business now over a longer period of time where head count growth should be at or below total top line growth.

That makes a ton of sense. And then looking at M&A, and maybe I should start with -- so you bought back quite a bit of stock last quarter. Is that kind of a -- not an admission but a statement on kind of where valuations on some of the potential M&A targets still are that you feel that it's a better investment just buying back stock? Or should we think that we could see an increase in M&A activity as I have to imagine that there's a bunch of private companies that just don't have the capital and liquidity to make it through this current [indiscernible]?

Look, I think the -- we've talked through the last couple of years that we thought our buyback strategy would be opportunistic. And March certainly provided, as Ken said, very clearly, this is a once in 10-year opportunity, Keith, with a lot of direction behind what we should be doing related to the buyback. So obviously, we applaud him for his direction. I think in terms of the M&A side of it, there's still plenty of dry powder for us with about $1.5 billion, $1.6 billion on the balance sheet and, if we needed to, plenty of borrowing capacity. The history has been tuck-ins, which fits in very nicely into our automation and integration strategy because we really do believe that the Fabric platform, it's providing a lift to us right now because of integration and automation. So I'll pause there because Ken's leaning forward. I think he may want to say something.

No, no. That's all, we're good. Yes. Like I said, the more challenge is really how to keeping things better after the acquisition, like integration and keeping the growth and all these things. That's where we will be very careful to any acquisition. And also, most acquisition we did also first from the partnership, like we have the FortiPartner program. Now we have almost 300 in the program now. So the few acquisition we made in the last 2, 3 years all come from this FortiPartner.

Got it. And kind of with our last minute, I'm asking all of my companies, given the environment, what are you doing with your own IT spending? Are you delaying your own purchases to see what's happening in the environment? Or are you pushing ahead as you had originally planned?

We don't see any slowdown or cost-cutting for the IT. And at the same time, security always the top priority for -- in the IT side. And this work from home probably even need more like network security, some other remote access. So we do see pretty healthy in the industry, network security industry.

That makes a ton of sense. All right, gentlemen. With that, Ken, Keith, thank you so much for joining us today. I really appreciate your time.

Thank you, Sterling.

Thank you, Sterling.

Thank you.