Fortinet, Inc. (FTNT) Earnings Call Transcript & Summary

All right. Welcome back, everybody, to our 5:10 Eastern session. I'm Walter Pritchard, Software Analyst here at Citi. I have 3 representatives of Fortinet. We got John Maddison, he's the CMO and EVP of Products; Keith Jensen, who's the CFO; and then Peter Salkowski is the VP of Investor Relations. I'm going to pass it over to Peter here for a second, and then we'll get going on our Q&A.

Thank you, Walter. Just a quick sharing on the screen here. Good afternoon, everybody. I'd like to remind everyone -- this is our safe harbor slide. Well, I'd like to remind everyone that we may make forward-looking statements during today's fireside chat. These forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially from those projected in these statements. Please refer to our SEC filings, in particular the risk factors in our most recent Form 10-K and Form 10-Q and other reports that we may file from time to time with the SEC for additional information on factors that may cause actual results to differ materially from those of our current expectations. All forward-looking statements reflect our opinions only as of the date of this presentation, and we undertake no obligation and specifically disclaim any obligation to update forward-looking statements. With that, Walter, I'll turn it back to you.

Great. Thanks, Peter. So we've got Keith on the finance side, and John on the product side. So we're going to go through these questions sort of together.

[Operator Instructions] So Keith, I wanted to start out with you, and then maybe John could add on here. We've asked most companies that we've had just this environment we're in is a very different environment than we were in 6 months ago from a business perspective. Could you talk about what you've seen over the first 2 quarters of the year and sort of how that informs your outlook as we move forward into the rest of 2020 with COVID and work from home and so forth?

Yes. I mean, that's a pretty broad question in terms of a pretty wild world. If you take back to the end of March through April, May, June, July, it's not been until recently that any 2 months looked kind of the same, if you will, back to back. At a very high level, unfortunately, the drivers in the industry continue to be the bad actors doing bad things. Bad actors like to take advantage of lots of data volumes and a large attack surface. So in one very simplistic way, work from home, where we see that has actually expanded the attack surface, and we certainly are seeing an increase in attacks that are being reported out to us. It's also become a geographic tale for us. A little bit unusual, about 75% of our business is international, 25% of it is in the U.S. So we get a little bit of a broader view sometimes. And we certainly saw that the success in coming back from the pandemic, if you will, worked out very well in Asia Pacific, that may be because they have different laws, regulations or what have you. They seem to do a very good job of controlling the pandemic. The other end of the spectrum has been the U.S., which has been a little more diversified in terms of its response, it's ability to open up and close and then have to close back down. And I think Europe has been kind of in the middle of that. We expected that as we got into the second quarter, and I think we really saw that very significantly. When we look at our customer diversification, we're kind of 1/3 small enterprise, 1/3 mid and 1/3 large enterprise. And I think we saw in the second quarter that it was a bit of a barbell. The SMB did surprisingly well, especially in the U.S., that smaller segment. I think that's just attributable to the vast size in that particular market, and the large enterprise did very well as well. And I think the mid-enterprise was the one that struggled, and I would attribute that to some data that we saw about capital raisings and fundings with that particular segment of the U.S. market, I think, was very much focused on just surviving, shoring up their balance sheet. So I'll kind of pause there because other are fairly high level, and maybe John wants to add something more to that.

Sure, John, maybe I'd kind of redirect it to you in terms of where you've seen customers focus from a demand perspective. What sort of projects have been move forward more aggressively? Which sort of projects have you seen maybe take more of a back burner?

Yes. Yes. So like most companies we do executive briefings, and we probably did 4 to 6 a week in the physical format. In the virtual format, we're actually doing more, we're doing 6 to 12. We can't quite get in all of them each week. But again, a good majority of them. So I'm speaking to at least 6 or 7 customers from different industries and verticals. I think initially, there was this shock, 2 shock factors. One was, hey, I need to get all my users, my employees on the network, work-from-home situation ASAP within 24 hours. Now luckily, a lot of our systems can do that very quickly with capacity. But they also then decided, hey, I wanted to put some endpoint. They also, I think in the initial months or so, decided, yes, we're just going to push back some of these projects. And then I think after that, we very much came back. And what I'm seeing right now actually is a trend is more of this convergence of the CISO and the CIO being on the same call, maybe it's the virtual format. I'm not sure. And they're really talking about I need to make sure I start converging some of my networking technologies and my security technologies as I go forward, whether that be an appliance for SD-WAN or whether that be a cloud-delivered firewall, whether that be a virtual machine in east-west, it doesn't really matter, but there just seems to be a lot of cooperation going on between the CISO and the security operations and networking folks. I would say also, that's become a realism now around work from home is not a temporary thing. And it's not going to go from 5% to 100% and back to 5%. It's probably going to go back to 20% or 30% over time. And we're now starting to see customers work that into their architecture such that it's not just a case of a simple agent work from home. I'm actually broadcasting this from my home here in Sunnyvale over an SD-WAN connection, which may seem extreme at the beginning of the pandemic, but now we're getting customers are saying, "Oh, maybe I want to put that in to maybe 5% or 10% of my users." I would say the other thing that's happened is definitely some of the acceleration of cloud. But that's not just security for the cloud, it's security from the cloud. It may be SaaS. So overall, more cooperation between the CISO, CIO. Definitely a more long-term architecture type projections and be more flexible on how they get their users and devices to the applications.

Got it. And John, just a follow-up for you. I know Fortinet has been a share gainer in the market here for a number of years. How are you seeing sort of displacement type sales where somebody might be refreshing equipment of a competitor, is it a better environment for Fortinet to go in and displace? Or do customers sort of step back and say, "I'm just going to stick with what I have and not do that.”

Well, a lot of times they've got no choice. It's end of life. And you have to make a decision. I still think -- and when I speak to customers, and I put up this chart showing the percentage of cloud and VM and appliances, it's a very hybrid world for a long time. No one's going to go all live in the cloud. They're going to still have workers and campuses. There's still a lot of customers still have to have data centers because of legacy applications. And obviously, they've got right now not a lot of people traveling. So I think customers have not got a lot of choice when they end of life of the system. A lot of those vendors are not replacing those systems. And so that, I think, bodes well for us going forward and being able to replace them.

Got it. And then Keith, just make sure we hit on the second part of the question around how we think the environment plays out in the second half of the year, and you have some guidance out there, obviously, that has some assumptions behind it. And you'd also mentioned that no 2 months have necessarily been the same. So clearly, there's been uncertainty, but could you help us understand from an assumptions perspective around the guide, how you're impacting it for some of those things?

Yes. I think the -- we went to kind of the second quarter, which is we called that the learning curve for the 100-year pandemic, versus the third quarter. We like the pipeline. We like the way the quarter started in the second quarter. What I did not like was even though we made some adjustments for the close rate assumptions, particularly towards the end of the second quarter. They came in pretty much like we expected. We expected though or we had hoped that we would outperform. If you fast forward to the third quarter, we knew and we've talked about July came in strong, the pipeline looks strong. The sales capacity looks very strong. Probably took a little bit more of a haircut on the assumed close rate for the third quarter guidance than we did in the second quarter, which was already a bit of a haircut. And I think I would just offer that as we've gone through the July period of time, as we came into setting the guidance for August, I think things look very good and the term that's being used is we're seeing a lot of rebounds now, if you will. Rebounds by different geographies, rebounds by different customer segments, rebounds by different verticals. So I think we feel with the guidance that we set, I think we feel good.

Great. And then, John, maybe stepping back in a little bit more product-focused and longer-term outside of COVID. You've had a very strong position in the appliance world built around now the NP7 in your hardware architecture. Can you help us understand as you -- as we move through a world where appliances are part of the solution, and there's other solutions out there, how does Fortinet adapt to that? And what percentage of your customers do you think are sort of already moved into that world that you're living at today versus it's more of a forward-looking state that we're going to get to?

Well, for us, a lot of people talk about our appliances and our custom developed ASICs and CSPUs that go inside there that give us big price performance advantage. That's, to me, a piece of it. But what's more important for customers is they can actually switch on a lot more applications or use cases as they refer to them. And so we continue to build additional use cases. Over the last 3 years, for example, we've built in both SD-WAN as well as SSL inspection. And we keep offloading the CPU so we can add more applications inside there. So I think in some ways, it's not -- the traditional firewall marketplace is almost 15 to 16 different use cases now. And so that gives us a lot of leverage to go in to do different areas of the business, different parts of the network. And so we will continue doing that. I do think long term -- if you look at the marketplace right now, and these are numbers from Gartner, then about 90% of the marketplace is still appliance, around 10% is virtual machine. That's going to increase over the next few years to be probably about 15% virtual machine. And the other piece is firewall as a service, which no one can register right now, it's almost nothing. That's going to change over the next 3 years to be more like 15% virtual machine, maybe 5% to 10% firewall as a service. So you still got up 75%, which is very much appliances. Customers don't want to put virtual machines facing the Internet for sure. So we still think there's a long runway for appliances in a hybrid world. But also, in our opinion, if I can run an appliance at 100x faster than a virtual machine, and I can put that in the cloud and offer that as a cloud service to the customers then to me, that gives me a big advantage over just using virtual machines.

And how do you think about the sort of competitive -- you outlined, I think, some of the competitive differentiation as we are in a world of appliances and understanding those aren't going away. But as we think about competitive differentiation in virtual firewalls as well as competitive differentiation in the sort of firewall as a service, firewall -- cloud firewall. How do you see that in the market changing as the sort of competitive lineup revolves around those new markets?

For virtual firewalls, there's 2 main areas. One is traditional kind of data center east-west, where you've got performances and requirements. There's also in NFVs for service providers and things like that. You've also got the cloud providers, AWS, GCP, Azure, where I think the benefit there from having one of our virtual firewalls specifically is that can work across all those clouds. But also, we see a marketplace where we can apply parts of our virtual machine to existing security capabilities. For example, WAF rule set in AWS can sit on top of a WAF from AWS. So it's not going to be a clear line between this is a singular product. There's going to be a combination of products that work well in that virtual machine and public cloud arena. And then coming to firewall as a Service, we actually we did our recent acquisition of OPAQ Networks, which allows us now to put a huge processing power of our hardware in the cloud for our customers. The customer is not going to know what's there. They're just going to get a cloud-delivered service, long-term or in the short term, some of the orchestration components of that cloud service, our SD-WAN or 5G or LAN edge capability can all be coordinated. So long term, I think it's all going to get orchestrated, but the customer won't care if it's an appliance in the cloud versus a virtual machine. And that appliance in our cloud will give us a competitive advantage from a performance perspective.

And actually, so you bring up a good point. I was -- Zscaler earnings going on right now. There's been quite a bit of rhetoric, I'd say, in the market around the architecture in firewall as a cloud. And I think the assertion that you make is that customer just wants to plug into something and have it work, like electricity. What have you seen in terms of -- I think the -- maybe the problem is here, there's not enough customer data points really to know what the world is going to look like because it's very early. But when you have taken that architecture to customers, sort of what feedback have you gotten on that? And is there anything that you feel like that architecture doesn't work well for it? Are there areas where you feel like that putting firewalls into your cloud services is a perfect fit for?

Well, I think long term, the customer is concerned about where their employees are, where the devices are and where the applications are and how to get them. And that's why, in our opinion, SD-WAN was a fundamental technology, not just for branch office, as I said, for home, for branch, for campus, the data center and for cloud because then you've got the ability to direct your users and devices to wherever the applications are and then to switch on the security wherever you want to. Do I want to have a thick WAN edge where I have lots of security on there? Or do I want to put that security at the cloud edge? Do I want to have some of the data center edge? Eventually, customers want that flexibility. So long term, the orchestration of those edges, WAN edge, data center edge, user edge, device edge, is very important to be orchestrated, so you can switch on that security wherever the customer wants it, wherever they feel it's the most necessary.

And then actually, last question for you for a second, John, on that one, I'll go back over to Keith. But on the product side, you have done -- Fortinet has been known for doing smaller acquisitions, more technical sort of buy. So you bought some technologies here. And you've been integrating -- I assume you're working on integrating them. But is there a point -- is there sort of milestones we should be watching for around especially the SASE piece that you've brought in most recently?

Yes. And as you say, we don't like to do huge acquisitions of -- based on revenue or customers. We like the IP. Sometimes we need to get there a bit faster. So we'll buy the IP, and just as importantly, the people. It's okay buying the IP, if the people leave, it's no good. So you've got to keep the people as you buy this IP. And so we like to buy those and integrate them into our security fabric as quickly as possible. And I'll highlight a couple. One was our enSilo, which was EDR technology, which absolutely fits perfectly into our endpoint solution set. Again, endpoint is going to be another area of convergence, where you've got traditional VPN, software-defined perimeter, EPP, EDR, MDR, all coming together eventually. Also SASE for us, allows us to do that same convergence within the cloud and through orchestration. So we'll -- I can't say we can continue to do acquisitions. That's not something we say. But we'll continue to look at opportunities to bring in technology to integrate quickly. And a lot of companies buy these big companies and it takes them months or forever to do the integration. That's absolutely not our style. We want to make sure we can integrate it as soon as possible.

Got it. And Keith, for you, around the discussion we're having here with John, where the various sort of numbers about maybe where -- what form factors are deployed in the future. How should we think about sort of the medium-term growth drivers for Fortinet as it relates to -- you've talked about traditionally FortiGate and then the non-FortiGate products and virtual cloud business and so forth. And you have obviously a subscription revenue stream that's attached to the appliances. It isn't necessarily driven by appliance shipments in the period. How should we think about kind of the growth drivers and how they may evolve as this medium-term scenario in the market plays out?

Yes. I think the platform or the fabric, as we call it, in figure that's roughly 25% of the business. That's going to continue to grow faster than the firewall. But the firewall is still going to represent that 75% of the business, and it's the cornerstone of the platform. It's shown the ability over a robust 10, 20 years to consolidate additional functionality inside the firewall, inside the operating system like SD-WAN and like SSL. So I see that there are use cases or customer cases where they may buy a fabric product first. But more often than not, they're going to buy the firewall, whether that's a virtual firewall or an appliance firewall. And then there's going to be this process of expanding through the platform. That platform is building that automation that the customers are really asking for right now and that automation is coming through the integration of those platform products. Yes, I think that's kind of the headline. I think that we'll continue to gain share in the enterprise. We've been successful in that high-end part of the enterprise. I think the cost advantage, the structural cost advantage that we bring to the party because of our proprietary ASIC strategy, I think that's going to continue to manifest itself. And to the extent that economies become more challenged and costs and budgets become more constrained, I think that provides us an opportunity to come into the enterprise and provide that competitive advantage that we bring, both in terms of the cost structure, but as well as the Gartner Magic Quadrant rankings, the NSS Labs and what have you. And I think to John's earlier point, there's now 15, 16 different use cases for firewalls, and we expect that we're going to continue to penetrate into those different use cases in our installed base and into new customers.

Got it. Makes sense. And then following on to that, Keith, on the appliance and firewall side, you have a number of subscriptions that you've attached and then you have the support business, I guess, mainly focused on the subscription side. What sort of opportunities do you see for that subscription attached to move higher over time? Is it -- are we mostly seeing -- going to see the driver of subscriptions be the installed base size? Or is there still an opportunity to increase the attach to a given installed base?

Yes. I think it's probably more a size than it is the attach, if you will. There has been -- as John worked -- has worked very hard, adding additional security offerings that, if you will, are upgrades to the existing bundles in many cases. But at the end of the day, you're typically attaching one security bundle to an appliance when there's an attachment. We are seeing other security offerings, if you will, that are part of that revenue line. But clearly, it still continue to be dominated by what we call our FortiGuard security subscription, and those are bundles.

Now -- go ahead, John.

Just a comment on that. I think, yes, actually the -- obviously, up until now, a lot of our subscription services have been based on security offerings. But I see, going forward, the capabilities to add more, what I call network operational systems. And so we have a service called 360 that adds orchestration for SD-WAN and SASE, for example. As we go forward, we will see us add AI capability for SD-WAN and WiFi. So it won't be just security going forward, it'll be the ability to add operational capabilities as well on top.

Okay. Got it. And then, Keith, on your end, the 24x7 support attach has been helpful to that -- the FortiCare line that you give us some visibility into. Can you help us understand kind of where that is from an attach perspective? And how -- I mean, I assume that went through to 100%, but how should we think about the future there?

Yes. I think the key data points we talked that -- I believe we said the mix right now between 8x5 and 24x7 is about 62%, 64%, something like that. That's moved up 2 points year-over-year. Why that's relevant? Because that's an acceleration from where we were a year ago, it was about 1 point. And the question then becomes, how long are you going to keep doing it? And I think we're going to keep doing it for an extended period of time. And why I say that is, one, we've taken 24 -- or 8x5 off the price list pretty much. And that really was something that we completed, I would say, 2 quarters ago. The other thing is revenue in the services line is a lagging indicator. It tells you what we did historically. It's all very nice, very predictable. But when I look at that same information on a billings basis, I can see what the mix shift is on billings, and it's very dramatic, much more than that 64% number that I've talked about. And when you look at that billings mix shift that has continued to grow and now, to some extent, accelerate that's telling me that, that revenue mix shift is going to continue in the future that's going to lag that billing shift.

Got it. That makes sense. And then, John, going back to you on the product side. I think one market we're seeing certainly a resurgence in, for sure, revenue and companies and so forth is around the endpoint space. And Fortinet has been in that market for a long time. I think recently, there was some an uptick given COVID and pulling through some of those products. But how do you think about strategically the endpoint market relative to Fortinet's position overall in the security space?

Well, interestingly, I left an endpoint company called Trend Micro to join Fortinet 8 years ago because I thought endpoint was dead. Well, how wrong was I. Maybe the consumer, Microsoft has probably taken the consumer business, but endpoint is still a thriving business. It's very fragmented, though. We've got 60-plus vendors in there. You've got some traditional vendors probably not faring so well that used to own a lot of the marketplace. And we think it's a very important marketplace. It is the second largest cybersecurity marketplace out there. And as I say, we have a product that we built ourselves. We have -- we just added to that product. We think there's going to be this convergence of these different agents. You ask any CIO they'll say their biggest fear is the security slowing down the laptops and stuff, you're adding too many agents on there. And so I think there's a good opportunity here to add not only some of the new EDR capability, but also some of the managed detection and response and start to kind of bring those agents together, so they're not having to deploy 10 agents on an endpoint, but we see it as a very important marketplace for us.

Got it. On -- Keith, one question that came in through the submission, just had here, was around the first half performance of the business. And I think in some of the -- the core hardware markets, I think there's been a debate about where things pulled forward versus pushed out. And I think your Q2 performance, you talked more about some deals that didn't close. But sort of what evidence do you have in what happened in Q2 and Q1 that was business pulled forward into the first half? Or was it pushed out? Or is it sort of a wash?

Yes. I think to answer your question directly, I think that's sort of a wash. And why do I say that? I think we've been very transparent that where we saw a pull in, we saw that in our 3 work-from-home technologies, the Authenticator, the Token and the Client. And we quantify that for people. We said that we probably got about a $10 million billings, overperformance in the first quarter beyond our expectations. And then we fast forward and get that same number in the second quarter, it was about a $5 million overperformance. I don't think the -- in that time frame, if you will, that March-April time frame, pull forward, drag out, what have you. I think that companies were trying to survive. If you were standing up an environment for work from home or for study from home or what have you, as a customer or a school district, you weren't going off for an RFP or an RFI or what have you. You were going through your incumbent. And I think in those instances, it became key, what was your VPN capacity? And was it as advertised? I don't think we've got a lot of lift there because I do think that our VPN capacity was -- is very strong and we're very faithful to our data sheets. And I don't really think that we got much pull in, in that regard. Where there's some onesies and twosies, if you will, of deals have slipped from Q1 to Q2 or from Q2 to Q1 the other way, probably, but not a significant part of the business at all. At the end of the second quarter, that's where the close rates came into play. We thought we're -- we thought we had a pretty good sense of what close rates were going to be in a pandemic. And we did see some deals that went for final signature at the end of the second quarter that flipped, that final signature just did not happen. So I think that's really kind of how I would describe the second quarter. And I think we've gotten to whatever normal is, I think that June, July, August -- and August, that's felt like more consistency, less volatility than we saw, say, in that March, April, May time frame.