Fortinet, Inc. (FTNT) Earnings Call Transcript & Summary

Hello, everyone, and thank you for joining us for our first ever Virtual Growth Stock Conference. My name is Jonathan Ho, and I'm the research analyst here at William Blair & Company that covers Fortinet. I'm required to inform you that a complete list of research disclosures or potential conflicts of interest are available at our website at www.williamblair.com. With us today is Keith Jensen, the Chief Financial Officer of Fortinet; as well as Peter Salkowski, who is the Head of Investor Relations. With that, Keith, we very much enjoy having you with us today at our conference. And for those of us in the audience that are maybe a little bit less familiar with the company, can you maybe give us a brief overview of Fortinet just to level set the background around the company?

Absolutely, Jonathan. Thank you very much. And I will indeed give you a bit of an overview of the company. And then joining me today also is Peter Salkowski, our Vice President of Investor Relations, and he will also join us for some of the Q&A. But before that, let me give you maybe just over 5 minutes of background around Fortinet. But as every good finance person knows, you have to first start with the safe harbor language. We can spend a whole lot of time on that, if you like, but I don't think so. Fortinet is a leading cybersecurity company, and we use this slide just to provide a bit of a context, if you will, to the company. Starting on the left-hand side, the market cap number has moved a bit over the last several weeks. We're currently at $23.4 billion as of June 1. We are an S&P 500 company, and we've been an S&P 500 company for almost 2 years now. Continuing on the left-hand side, our billings in the prior year were about $2.6 billion. And one aspect I would offer about us as a company is that we have been a profitable company for every year as a public company. So that's 10 years that we've been profitable on both a GAAP, on a non-GAAP basis. Last item on this slide I would note is that we are a very technologically -- technical-focused company. We have over 660 patents worldwide. On the right-hand side, in terms of our footprint, about 30% of all firewalls in the world are FortiGate, Fortinet firewalls. That's spread over 455,000 customers. And we are -- we do believe that as the world for cybersecurity is evolving to a platform strategy, not unlike what we've seen historically, say, in CRM or ERP, where you've seen those move from a point solution to a platform strategy for the product. So firewalls would represent 1 of those 30, and the other 29 plus would be our fabric platform suite of products. Just a little bit of context about our financial performance. This chart on the left is designed to show our total revenue growth over the last 3 years, which you can see has averaged about 19%. Also, if you look at that chart on the left, you see the dark blue bars represent our product revenue segment as well as then we've broken out the service revenue segment down below. And why I think that's relevant, as you can see that service revenue has moved as a mix of business from 57% to 63%. That service revenue brings a certain level or a very high level of predictability to our business model as well as very healthy margins at about 87%, I believe, in the last period. Chart on the right is designed to note the -- our concept of balanced growth and balanced profitability. So while we have invested and grown the top line, at the same time, we've improved both our non-GAAP and our GAAP operating margins very significantly. In the case of non-GAAP operating margins, this increased over 900 basis points during that same 3-year period, hence, balanced growth and profitability. We're also a very diversified business, and these 3 charts are designed to kind of cover off that concept of diversification, whether it's customer segments, geographies or industries. When you look at our customer segments, it's fairly close to 1/3, 1/3, 1/3 between enterprise, mid-enterprise and SMB. And I would note that if you took a part of that 46% in that pie chart on the left, telco and enterprise, a segment of that is MSSP, which is probably really targeting the smaller business. And so maybe 5 to 10 points of that belongs over in the mid-enterprise and enterprise side. But you can see the very balanced approach that we have to our customer base. On a geographic basis, as you would expect, the large economies represent the majority of our business, Canada, Japan, France, United Kingdom, Germany and the U.S., but there's 80 countries in our portfolio in which no one country represents more than 3% of our business. And combined, those 80 countries represent half of our business or 50%. And that diversification is something -- the benefit of it is something that we're seeing as we watch the arc of the pandemic move, first, through APAC and then through Europe and now into Latin America and into the U.S. The last one is designed to give some context to the verticals that we service. We're very well-known for our MSSP as well as our telco segment of our business, and it's typically the largest or second largest vertical in any quarter. But financial services, education, retail and government are typically in the top 5. Government, for us, is actually more about international government, much less so about U.S. federal government, but it does include state and local governments in the U.S. The retail component, government component and the educational component. I would also note that education sometimes tops -- pops up in the top part, technology pops into the top 4 or 5. But for the full year 2019, it did not quite make the cut. Although it's done quite well, thus far, in 2020. One concept that's frequently associated with the Fortinet name is SD-WAN technology. The chart on the left represents our billings growth of SD-WAN quarter-to-quarter from Q1 '19 to Q1 '20. We've also used that chart to give a little bit of context with the light blue of how much of that is product and how much of that is service and then also showing the total billing growth of 3.7x. I believe it was Gartner that has reported that our market share growth in 2009 basically went from about 1% market share to 9% market share. So very impressive growth in terms of what we're doing with that segment of our business. The chart on the right provides our pipeline as of the beginning of each quarter. And what we're really trying to do is making sure -- or ensuring that our pipeline growth is going to continue to support the top line growth of the billings. And while I'll apologize for not including a Y axis with numbers on it, which perhaps are of interest, I would note that in our most recent earnings call, we have described that SD-WAN has reached a point that is very high single digits of our total billings. So that offers some context for you. Quickly on our allocation strategy, as you might expect of a company that has 660 patents, we invest very heavily in R&D. Both of our founders have electrical engineering backgrounds, advanced degrees, and that permeates throughout the organization. And that concept, that approach also manifests itself in our M&A strategy. Historically, we've been much more interested and focused on tuck-in acquisitions. When I talk about tuck-ins, I'm talking about $25 million to $50 million of spending for the acquisition. And we usually look at those as an opportunity to build out our fabric platform suite. You can see some examples that, most recently, SIEM, Endpoint, SOAR, network access control or NAC, if you will. When it comes to build versus buy, we tend to build it ourselves, but where we have an opportunity to build out the fabric platform with a tuck-in, we will execute that. But what we're looking for is an application or technology that we know and are comfortable that we can integrate that very quickly. It's one of the keys to our success, we believe, is a platform that is integrated and that integration then enables automation. We're also -- been very strongly focused on returning capital to our shareholders through a buyback. We have historically described ourselves as being opportunistic in our buyback approach. As you can see in the table at the bottom, I would describe us in the first quarter of this year and into April as being very optimistic or perhaps even extremely opportunistic by buying back over 11 million shares so far this year for just over $1 billion as we took advantage of what we were seeing with some dislocation in the market and the pricing. We still have about $547 million remaining under the authorization currently. I won't go through this, it's a fairly long chart, but really just to call out some of the key growth drivers that we're focused on. One is to continue to expand into the enterprise segment of the business. We're taking advantage of some of our competitors' refresh cycles that are various legacy incumbents as well as leveraging the third-party recommendations from Gartner and MSS -- or NSS Labs. The fabric platform, I think I've mentioned that, that platform strategy represents about 25% of our business. And then if we continue on just about being a very technologically focused company, and I would add to that SD-WAN, as I mentioned a moment ago. With that, Jonathan, I think we'll turn it back over to you for questions, if that's all right.

Perfect. Thank you for the overview. I just wanted to start out with some obligatory questions on COVID-19. This just seems to be an unavoidable topic. And so maybe just starting out with what you've seen on the customer side. Can you talk to any potential behavioral changes or any sort of near-term disruption that you've experienced? And how do you think about the Fortinet security platform and how you can maybe help address some of those challenges?

Yes. We talked about COVID-19 a little bit during our earnings call in the first quarter. And we made the observation about a couple of things that we had seen. One was, in the month of March, the billings activity is typically -- the last week of the quarter is the biggest week of any quarter for us as it is for most tech companies. The second and third week of March actually were the biggest weeks in the quarter for us. And when we peel back the onion on that, what we really heard back from our channel was that they were mitigating against possible supply chain disruptions. And their goal was to have inventory on hand for their last week of the quarter so that they could then sell-through some of that inventory and make their number in the quarter. I've also provided some information on the first quarter call in terms of where that channel inventory balance ended up because not everything sells through, and we wanted to understand how that may impact our repo activity. We also pointed out to 3 technology -- pointed to 3 technologies, Authenticator, Token and Client, that, in total, outperformed by about $10 million in the quarter. For context, that's a billings number. On the product line, probably about $5 million. For context, those 3 products probably would have been expected to bring about $10 million in the quarter, and they came in at about 20%. So probably a little bit heavier than we had seen normally. I think the other aspect about COVID-19 is the arc of the pandemic, and what we saw in our numbers in Q1 and as part of our guidance-setting process for Q2. More specifically, obviously, the pandemic hit in Asia Pacific first. And as we moved our way through the first quarter, obviously, we had interest in supply chain disruptions and concerns about that. But it really became, how is it impacting your APAC business in the first quarter. And then as we got towards executing the first quarter, APAC was coming back online from a customer viewpoint. Europe was the next geo to follow. So Europe kind of shut down shortly after APAC did and started to come back online. And then the U.S., as I think most of us know, really, we saw the big event towards the middle of March where shelter-in-place really became, certainly here in California on the coast, and then moved throughout the country. And if we continue with that observation about the arc of the pandemic, when we looked at the pipeline as part of the guidance-setting process in the second quarter, it became fairly obvious to us that we felt that the U.S. is going to have to work its way through the shelter-in-place and come back online. But at the same time, we expect an over performance from Asia Pacific and Europe and the rest of the world. I think the other -- one thing that we've made in terms of a change related to COVID-19 is that we offer a program called Network Security -- NSE, NSE training, Network Security Experts. It's an online level 1 through 8 training program that we typically make available to our channel partners because it enables them to better understand our product. But we made it open to everybody, end users and the general public. And one metric that we've looked at in terms of the adoption about people signing up and becoming certified as NSE experts, we have 150,000 people that became certified in the first 5 months of this year as NSE experts. If you were to compare that and give context, last year, for the full year, it was 110,000 people that had certification. So already, we're on a path to easily double that NSE certification.

Fantastic, fantastic. And thanks for the additional color in terms of your thoughts around this whole situation. One of the things that we've observed as part of this process is that Fortinet doesn't appear to have run into some of the VPN capacity buying issues that other vendors have said. And you didn't sort of reference any pull forward in demand. Can you maybe talk about maybe why your customer base hasn't run into that issue as much? And maybe what you have been able to upsell from the fabric as part of that process? I know you mentioned the 3 products. But what are the things that people are looking for when we look at this on a go-forward basis?

Yes. I think that we -- when you look at Fortinet, one of the things about Fortinet is the ASIC advantage. We're on our seventh and ninth generation of network processing chips and content processing chips and the fourth generation of System-on-a-Chip. And really that ASIC advantage, all about Moore's Law and we talk about speed and performance, but also it's been about creating capacity. And one of the -- and being very faithful in terms of what our performance is, looking at third-party testing and making sure that's accurately reflected in our data sheets. And what our customers saw was when they turned on the VPN capabilities, that they actually, within the Fortinet firewalls, really had the capacity without having to come back to us and buy a larger firewall. I think they're pleasantly surprised about that, but I think that just speaks to our culture and our ASIC advantage of it. So I wouldn't say that I saw in the first quarter bluebird deals where customers are coming to us and looking to buy larger firewalls in order to support work home. We did see some corner cases in terms of new applications being set up. And the example I would give is 2 large private colleges both adding study-at-home programs, 1 on the West Coast that had firewalls on-site destined for a different application that they quickly repurposed as to a work from home. So I didn't really get an incremental revenue in the quarter from that. On the other coast, on the East Coast, similar situation, that was a complete bluebird. So you had a -- like any quarter, when you look at your enterprise deals, you're going to have some puts and takes. And I think perhaps those puts and takes were a little bit different this quarter than they had been in other quarters even if it's an opportune time.

Got it. That makes sense.

Jonathan, just to -- I mean just to expand on that. I think the -- your question in terms of pull forward from a VPN capacity, firewall perspective, I think there's a question in the market of whether or not there was a pull forward of firewall transactions into the first quarter, and that's going to have an impact on the back half of this year. As Keith pointed out, our only benefit really from the work from home was in the fabric products that support our VPN capabilities. And those capabilities were FortiCare or FortiGuard -- sorry, FortiClient for authentication, for the few cases that Keith pointed out. Really didn't see a need for people increasing their firewall capacity to handle the volume of people who are running on VPNs because those customers or our customers already have the capacity built into their system. So there really wasn't a pull forward. We looked at pull forwards in the first quarter in terms of what we saw and whether or not there was pull from the second quarter into the first quarter, and we really saw both things. We saw some deals that got pulled forward because people wanted to complete things before budgets went away or fear of budgets going away, but also some deals got delayed because they weren't sure what they were going to do and everyone was going home. And so you saw puts and takes in the first quarter. When we looked at April, to kind of give us some validation of whether or not things got pulled forward or pushed back, we look at April and we really didn't see the pull forward. In fact, we saw a pretty good April relative -- we said the linearity of April 2020 was better than what we saw in the last 3 Aprils. So we don't feel like there was a pull forward into the first quarter and saw pretty good strength just coming into the quarter.

Thanks for that extra color. It's always helpful to have a little bit of context around some of these events. I guess, if we step back and look at the longer-term implications around COVID-19, how should we be thinking about the work-from-home dynamics, digital transformation, shift to the cloud? What does that mean for Fortinet and for your business opportunity as we start to kind of exit this situation as well?

Yes. I think when -- as we look -- as Fortinet looks forward in terms of what the world might look like in the future, the first step is to kind of look at who Fortinet is in terms of that diversification slide that I mentioned a moment ago. If you're a very U.S.-centric enterprise firewall company, digital transformation may mean something quite different immediately than if you're perhaps a company that's selling more broadly across a different set of geographies into a different set of customer classes as well as a different set of verticals. And I think it's important for us to keep that in mind as we process through that and understand it. The key to this, I think, is if you look at the cybersecurity industry, particularly the firewalls, and say, what are the drivers of the business, and it's always been about the volume of data and the expansion of the attack surface. And the sad reality is, to the extent that the bad guys find more and more places through the data and through the attack surface to exploit, there's going to be a need and there's going to be a demand for various security offerings. And so in some -- in some ways, work from home and cloud continue that theme of just expanding the attack surface and driving an unfortunate demand for more and more security offerings.

That makes a ton of sense. And I mean, I think we're all going to figure out what happens in this kind of new world as it continues to evolve. Maybe shifting gears to more of the SD-WAN discussion, I think that's something that continues to be top of mind for folks. Does Fortinet today offer its own Firewall-as-a-Service? Or do you have any plans to offer a Firewall-as-a-Service? Can you talk about maybe the pros and cons of one approach versus another when it comes to that SD-WAN side?

Specifically, to answer that question, yes, we do offer Firewall-as-a-Service.

Okay.

Yes. I mean, I think that -- I mean, if you look at the market for Firewall-as-a-Service, I think if you look at our Analyst Day slides from last November, our Chief Marketing Officer, John Maddison, presented a slide that showed the network security market in 2019 versus where it's going to be in, I think, 2023. And Firewall-as-a-Service was about 1% of the market today, and I think it's expected to be 2% of the market in 4 years from now. Now the market is growing, so it's expanding a little bit in terms of its percentage of market as well. But not a big part of the market, so not something we're really focusing a lot of our attention on, to be honest. We think without the physical -- the other part of that slide that shows -- I mean, I forget the numbers, I don't have them in front of me. But the firewall or appliance side of that business, while still being the majority of the business, call it, 66-or-so percent now going to like 63% or something like that on a going-forward basis. So maybe coming down a little bit, but not to the extent that -- it's still the majority of the overall network security business.

That makes sense. That makes sense. And you certainly don't want to overinvest in a market that's going to take a long time to transition maybe to the cloud service side. With that in mind, you do work with a number of MSSPs to offer Firewall-as-a-Service. Can you maybe talk about how you leverage MSSP vendors and how you think about using those MSSPs to reach a broader audience?

Yes. We're just toggling between our mute buttons here, Jonathan. I apologize. I'm going to hand this back to Peter. MSSP.

Okay. Sorry, Jonathan, I missed the beginning of the question. Can you turn yours up because I have to listen to yours?

Yes. So the question is you do use MSSP partners for Firewall-as-a-Service. They obviously use your hardware as part of their offering. But can you talk about broadly how you leverage the MSSP channel and how you use them to kind of get to a broader customer base?

Yes. The history of Fortinet is really the service provider space many years ago, right, as a way in which to move into other markets, not just domestically, but certainly international. When you look at the breadth of our revenue, the diversity of our revenue across the world, we sell into the service providers, which is really the MSSP market, 3 ways, right? We sell to the telcos to use to protect their own infrastructure. We sell to them and they use our products to do what's called MSSPs, or managed security service providers, where they're providing a service to their customers, but using our product to do that. A great example of that, you'll see several press releases on our website. We talk about SD-WAN. We're selling SD-WAN functionality capabilities through our firewalls and our operating system to the MSSP. And then MSSP is then selling that service to its customers as a service provider. And then lastly, we use the service providers as a channel. Just like any other channel partner, we sell through them to their customers our firewall products or a lot of our different products that they can then install in their locations. So MSSP is certainly a growing part of that business as more and more companies look to sort of outsource the security capabilities. They don't have the technology bandwidth or the IT department to be able to handle the security aspect of it. They outsource it to the MSSP or their service provider. And we benefit from that by selling the product or the equipment to the service provider in that situation.

That makes sense. Maybe shifting gears a little bit to public cloud security. How do you think about sort of the CSPM space or securing the public cloud? And what's Fortinet's view on your role as more and more infrastructure shifts to the cloud?

Yes, I think, I mean -- cloud is the -- probably between asking us about SD-WAN and asking about cloud, those are probably the two big questions today. I think, certainly, in a COVID-19 world, those two questions have sort of bubbled up from the top: SD-WAN because it's been a big driver of us and we've been very successful there; and cloud, I think, because people look at that as a concern. It's been a concern for years. We've heard about it for years. The cloud commentary sort of died down there for a little while. But now that we're in this work-from-home COVID-19 world, it's popped back up. Really no change on our side. I think the view on our side is it's very important to have a hybrid cloud approach in that and being able to protect the on-premise capability, having the same security solutions in the cloud, so that everything is on the same operating system. Everything, that if you change your security rule on-premise, it's automatically populated into your cloud. So you're not -- you don't have to manually go to the cloud and make the change, which, if you forget to do that or don't do it correctly, leaves you open to vulnerabilities. And so having a broad platform of products, which is what our security fabric products provide us, and being able to have those available in every cloud that's out there, some Google, Azure, Amazon, being able to protect those different clouds, so a multi-cloud approach, but also being able to protect on-premise as well as in the cloud and a hybrid cloud approach is very important. And we -- the interesting thing is you look at Fortinet, as a lot of people think of us, as an appliance, ASIC-based. We have more software engineers than we have hardware engineers. We have to write the software that works on our ASICs, that works on our firewalls. We are writing that software. We're writing the same software that everyone else is writing from a security perspective with the advantage that our software runs faster on our appliances because we have an ASIC-based capability that allows us to do that.

Absolutely. Absolutely. Maybe shifting gears to margins a little bit. As we look at sort of the operating leverage in the model, you've talked about being profitable since becoming public as a public company. But how should we think about that leverage going forward? And in particular, if you're selling more software-oriented solutions or subscriptions, what does that sort of look like from a leverage standpoint?

Keith, you're on mute.

But I've been unmuted by the host now. So thank you to the host, whomever that may be. I think you start at the gross margin line, and you look at the two things that are perhaps standing out right now. One is on the product gross margin, what you're really seeing there and Peter made reference to it, is the software presence. We don't talk a lot about how large software is to us, and that includes bringing your own license in a private cloud, bringing your own license in a public cloud as well as certain cloud provider offerings, if you will. But you are definitely seeing that show up in the product gross margin line. I think it's up about 150 basis points year-over-year last year. And we would expect, certainly in the current environment, that, that benefit that we're getting that lift in the product gross margin is going to continue. And then if you move down to the services gross margin line at 87% gross margin on those services, and we've seen the shift from product to services, we noted a moment ago, about 6 points, that mix shift to services continues to provide tailwind for us on the gross margin line. And within this framework of balanced growth and profitability that we've talked about, those 2 components that are working together to create more gross margin is enabling us the -- or providing us the ability to make the investments that we need to make in order to penetrate into the enterprise, to extend the SD-WAN market share advantage and to continue to push the fabric platform. And I think that has shown throughout 2019 and into 2020, that we are continuing to successfully execute that balanced growth and profitability concept.

Absolutely. Sorry, I was on mute this time. So maybe one last question as we come to the end of this time. You guys have made some investments in terms of engaging the channel, trying to get, I guess, more mind share in the enterprise. Can you talk about what's been most successful there? And what some of those efforts have really focused on over time?

Yes, I think the -- first and foremost, I think it's been the quality of the conversations with the channel, not just what we're talking about, but who we're talking about, particularly when we look at some of the distributors and the larger resellers. And I think we've moved, over the years, up inside their organization and have better clarity in terms of what they value, right? Do they value incentive payment programs where you hit certain targets? Do they value more about training their people? Do they value more about funded heads that are on-site? And understanding what their key metrics are, together with our key metrics so that we're executing successfully. I think the -- internationally, the channel program is perhaps a little bit different. They take on more responsibility for some of the advertising. And perhaps in some ways, they were a little more advanced than the U.S. channel had been until a few years ago. I think the U.S. is now very definitely giving a run for the money, if you will, to the international team in terms of channel partners. At the end of the day, I think the proof in the pudding is how your channel partners react. And we can look at the number of resellers that are being added each and every month to our suite of resellers, together with how they're then allocating resources internally. And what we've been seeing over the last several quarters is they're only taking their own resources, their own head count and they've been tilting them towards Fortinet. And we view that as a very, very positive outcome.

Absolutely. Well, I wanted to thank you both for joining us for our conference. We've really enjoyed the discussion here. We wish you the best of luck on the rest of the day, and we'll be in contact soon.

Thank you.

Thank you, Jonathan. Good evening.

Good evening. Bye-bye.