Fortinet, Inc. (FTNT) Earnings Call Transcript & Summary

Okay. Good afternoon, everyone. My name is Brian Essex, Goldman Stock security software analyst. So thank you to everyone for joining us today for our second day of our Technology and Internet Conference. Just a quick note before I get started, if anyone on the webcast has questions they'd like to address, please enter those questions in the webcast portal. I'll try to leave 10 or so minutes at the end, depending on how many questions we have. And we'll do -- to get to some of those questions and we'll do my best to get to as many as I can. Today, I have -- I'm very excited to have Ken Xie, Founder, Chairman, CEO of Fortinet; and Keith Jensen, the company's CFO. What I'll do to start though is I'll pass it off to either Keith or Peter, whoever wants to do kind of safe harbor disclosure, and then we'll kind of kick it off from there.

Sure, Brian, this is Keith. And my understanding is that they're going to put the safe harbor language up, and there's not a need for us to read through it. So I assume that will happen at some point during the presentation.

Okay. Got it. We'll assume that that's going to happen. And maybe I'll just move right into Q&A then.

So first, I'd like to touch on the macro. Either Ken or Keith, there's a certain -- a certain portion of the business, particularly the mid-small side of the business, you may not have a great deal of visibility into. But for segments such as large enterprise, what were conversations like as you kind of moved through the pandemic last year? How they changed through the year, and how do you feel about the business going into 2021?

I can go a little bit first, and then Keith will help me. I think if we count 1 years ago when the pandemic start, the corporate IT had some rush by whether to fix the work-from-home issue or like how to handle these lot of data to ASIC remotely. So using VPN or ASICs. And then once pandemic goes through, we do see a lot of companies started thinking how to digitize their whether service or how to work from home, kind of make it more permanent. So that's the internal process, whether if you look at -- whether the remote base of service kind of approach of kind of like a Zero Trust remote access or place some of the VPN alone. And then probably, right now, a lot of them are thinking maybe work-from-home will be like long-term solution. And also what's the infrastructure impact they may have, how to make the home office more like a branch office, they call a home branch. All these kind of things going on. So it's quite some change. And also, they started thinking what's the right way to do the whole infrastructure. But before, they only like have all these campus or working environment are secured. At home, it's all mixed traffic, whether the entertainment use or -- it's obviously all mixed together, so they try to see what was the way they can expand some of the working environment, both the quality and security work-from-home because as you can imagine if you're in a call right now, if there's something going on, or especially some meeting, important meeting, it could be pretty damaging there. So that's where there are a lot of solutions starting to come up. And so we call it security-driven networking, make sure it's -- they have a very good quality network, and the same time, it's very secure. It's more like the campus of branch office environment that also can be extended to home.

All right. That's super helpful. And maybe I need to ask the obligatory SolarWinds question. How did that change things? How did that change the narrative with companies that you have conversations with both like during the event and as you're kind of sitting here in 2021?

It's from the marketing impact, it's similar like how the target Sony case happen in like 2012, 2013. So all the companies starting -- especially government, is starting like -- I mean, raised awareness of all this importance of a cyber security. But this trend all come from the supply chain from third party. So sometimes, even their corporate IT can be pretty good, but somehow, they simply also have difficult time when it happens. So that's where I feel they may bridge the whole industry standard, or to certify some third party, whether software or hardware or other things, make sure they meet certain security standards. And at the same time, leverage some other like service providers, equity vendor and also help them like what's the right architecture to prevent this to happen, or if it's happening, how to quickly like contain it and make sure it's not spread out, reduce the damage and also make sure they can also do the remediation or other things can be done. But on the other side, it's really, like I said before, the whole infrastructure security is very important, internal segmentation, and also make sure to secure all part of the infrastructure, not just the server, but also like the home device and the network itself and also working with cloud. And it's the whole infrastructure security that is very important.

Right. That's super helpful. I wanted to ask, one of the narratives that we hear from investors quite a lot, and I think one of your peers talks about it as well, is no longer needing an appliance to do security at some point. And I guess, as we kind of walk through this whole kind of software meets the world theme, how do you think about the future of Fortinet? And how you're positioned for things like Zero Trust and SASE and the mix of software versus appliances that you might have several years down the road given where we see digital transformation playing out?

I think because security touch all part of digital transformation or all part of the infrastructure, you can look at history what kind of architecture. You can look at like 20, 30 years ago, the PC server replaced the mainframe and terminal, right? So -- and then like 10 years ago, the cloud mobile started replacing some of the PC and server. But Gartner, they say in the next 2 years, they say that the edge and the immersive technology will replace cloud and mobile. It's always some -- like a 2-part: in some part, centralized; and some part somehow has been on the customer side, which mostly is more in the hardware. So that's always the case. And even like work-from-home, all these kinds of things, you do need hardware to make things working. I think some companies, they are probably more software-based. They don't have a capability to really work in hardware. And that sometimes, it all has to be using software instead of hardware because of their own limitation. But look at the whole infrastructure, you do need hardware. Even a lot of companies, whether cloud like a Microsoft or Amazon, all these things, they are kind of like a software company, but they also develop their own hardware, their own chip, right? So the same thing for Apple, because you have to address the whole infrastructure security and how a software need to be working together with the hardware, where the software runs up. So that's where, especially when you have the edge computing, whether like your auto-driving car, home appliance, your IoT device connected to 5G, you do need all these has to be working together. That's what we call the whole infrastructure security or secure-driven networking. So the best case really would be design the infrastructure, design the network already have security built in. So that's what make it more easy to manage, more secure. That's where like when you do SD-WAN or the 5G or any other new infrastructure, to consider to security together instead of our security add-on later. So that's what making the whole infrastructure more secure.

Got it. That's very helpful. Maybe Keith, I wanted to throw a question your way. You guys reported earnings last week, I think great results. I think some were a little surprised with the reaction of the stock, given the magnitude of the beat and the level of your guidance, particularly on the revenue side. Some may, though, have been concerned about margins implied by 2021 guidance. So I wanted to get your sense of how do you think about setting guidance there? And how should we think about margins in general, your approach to balancing growth and profitability?

Yes. Hey, Brian, and thanks for acknowledging the very strong performance in the fourth quarter of 2020 and throughout the entire year. I think the sales team would thank you as well if they were on the call. Yes, I think the first -- just stepping back on the margins, I think if you normalize the operating margin for the T&E and marketing savings that we had because of the pandemic in 2020 versus how we're modeling in 2021, we would make the point that we're actually taking margins up by 50 to 100 basis points. In terms of how we think about it, the company's been very successful for many years now executing on this balanced growth and profitability framework that we talked about. And I think we've quantified it a little bit over a year ago where we said we expected growth in the midterm to be over 15% each year and margins to be in that 25% average throughout that time frame. And if you look back at the performance during -- you've seen a company that's actually grown at over 20%, largely organically throughout the last 3 years, and it's added about 200 basis points of margin each year for the last 3 years. So I think that, at a very high level, that's kind of how we look at it. Now within that framework, there's years that maybe we tilt a little bit more towards profitability; in other years, we tilt a little bit more towards growth. And that's really a reflection of how we perceive the market opportunities as we start of each year. And I think, clearly, as we start off into 2021, we're fairly bullish in terms of what the opportunities are in front of us. And so within the framework, we've messaged that we see an opportunity for growth in 2021.

Great. That's super helpful. And then I guess, from a seasonal perspective, 1Q, the first quarter guide implies a more substantial seasonal revenue decline. Maybe thoughts about seasonality and how you expect things to play out through the year?

Yes. I think I would go back again to -- I don't think seasonality is going to be dramatically different for 2021. You can look at our growth rate that we've -- at the midpoint for the first quarter versus the full year, and I don't think you'd come away thinking that's a back-end loaded plan when you look at those numbers. And again, if you go back to the very, very strong performance we had in the fourth quarter, some of that sequential movement is perhaps just a little bit different than normally. But just again, I think that's just a function of what we saw with the strong performance in the fourth quarter.

Got it. And then I want to go back to a comment that, I think it was you that made it on the analyst call back. But you sounded pretty excited about your pipeline into 2021. How should I frame out the status of your pipeline relative to other years as you've entered the fiscal year? And what are you seeing that's making the most substantial impact to the pipeline as we enter 2021?

Yes. I think, obviously, we've figured out that the math works with our continued growth pattern, that the pipeline is larger now in absolute dollars than it's ever been in the past. But again, if we look at the percentage opportunity pipeline year-over-year and what we're seeing in the growth there, it's one of the key drivers in terms of going through the guidance-setting process. We also look at things like sales capacity, if you will, close rates that we have, TAM, sales productivity and so forth. And I think we're seeing a very strong alignment there. In terms of the -- what's in the pipeline, if you will, I would probably parse that maybe in 2 different areas. One is on the firewalls. In the firewall, you have the SD-WAN component of it, which is, I think, has done very well for us, and we expect that to continue on. But we've identified probably 15, 16 other use cases for firewalls. And we made the point in the fourth quarter that those other use cases for the firewalls actually grew faster even than SD-WAN did as a pure firewall play. And then if you look at the fabric part of it, I think we're seeing a lot of traction with this platform strategy. There's a very natural tension in virtually any technology set of, is it best-of-breed or is it a platform. And the reality is, just at some point in time, the cost effectiveness of the platform, the ease of management of an integrated system I think provides a fair amount of tailwind for us, and we're seeing that in our pipeline.

Got it. And I want to kind of like maybe use that opportunity to kind of segue into some product commentary. So one of the things I think that's been really interesting from my perspective is the strength of firewall activity in 2020, and the strength that we're seeing, at least from CIOs who we speak to and the channel that we speak to, firewall spend remaining robust through 2021. What is your outlook on that? How do you view the drivers there? And do you think that strength persists? Do you think we have more difficult comps in 2021 as a result?

I think that the firewall market will continue to grow just like it did in the last 30 years in the space, 30 years now. And because firewall is very unique and it's in good position, it's the needle of the network to really stop all the bad traffic. In the past, firewall is more like open access internally with encrypted traffic. Then like 20 years ago, when we started Fortinet, we pioneered -- we're the -- remember, we call that UTM firewall, the firewall could stop the malware, also the virus or the intrusion there into the endpoint software. And then nowadays, firewall is also starting to handle some other application and also like using the Zero Trust network to replace the VPN. So we're also, of course, announcing the FortiOS 7.0 and also the SASE integration into the firewall. So instead of you have to pull The traffic to the service provider path, you can have the firewall local to process all the traffic. And whether -- and even in the home, so that also will be very, very efficient. Instead of you have different path in the process of different applications, different traffic, if you can process all this within your own kind of gateway, so that's where we increase the -- like the security level, reduce the latency, so that's also where we're integrating the FortiOS 7.0. So that's why we feel it's much better level. So the firewall works simply to integrate more function, like your sandbox, the separate box, now it's part of the firewall and intrusion prevention, same thing. And which we do believe, because firewall is in a unique position in the middle of network to stop the bad traffic, we can integrate more function, and at the same time, we can increase the speed. And also more close to the customer, close to the data, so that's also the reason I'm going to say the edge will replace the cloud because like 90% data all generally on the edge, you need to process real-time local, if you can. So that's where we see the firewall market, network security market will continue to grow. So that's where we also backed by a lot of research with the current IDC. You can see by 2024, so the whole network security product market of $100 billion, and then the network security is $48 billion. It's about half of it, and the [ growth ] of $10 billion. And so, as you can see, it's still a huge market going forward because like 99% attack or threat all come from the network side, right? So you have to stop from where it's come from and not make the whole infrastructure secure -- we call it security-driven networking. So that's where firewall continue to grow. So we don't see any slowdown. That's also the reason we see the product revenue growth in last quarter, 21%, so because of firewall -- they do need a firewall to stop, whether at home or work environment, also deliver network traffic at the same time.

That's really interesting. And on that, how much growth do you see from competitor displacement versus developing new use cases for firewall?

I think if the market grows 10%, we grow 21%, definitely. We do take over some of the competitors, right? Because so far, we see all the other networks that we vendor, we don't see their products has any growth. So that's where -- because the advantage we have, whether from ASIC or most a function of the internal development integrate together, so that make it automate together. So that's the advantage compared to our competitor acquisition. Most likely, it will be different product and is difficult to integrate to automate. So that's the challenge we're facing. So we try to plan this, we invest this ahead of time. And so that's where the investment on the internal development or the function, make sure it's integrated ultimately from day 1. At the same time, using the ASIC to lower the computing cost and increase the computing power and also more function can be added in. So that's definitely we see it a lot of long-term benefit.

And Brian, if I can just step in. I think you've touched on 2 very key points about the business. One is competitor displacements, particularly as we move up on the enterprise, is a key part of the business. And I don't want to ignore the very kind question about new use cases and point out SD-WAN is a new firewall use case. So thank you for asking that question.

I was going to get there, too. I want to ask Ken about SASE as well, given that we kind of touched on it briefly. How does your SASE offering compare to competition? And what are you seeing as the most prevalent use cases that you can address with SASE architecture?

Yes. The most benefit from SASE really is the service space, especially during the pandemic, a lot of IT people, they're very busy or they don't have some knowledge on working remotely, secure remotely. So that's the SASE benefits starting to come up. But also the SASE costs tend to be like 3 to 5x more expensive compared to if you have your own infrastructure, you manage all this together. And so that's where -- and for us, we do feel SASE eventually will be better for pretty much all the service provider to offer, and at the same time, you need to integrate and automate better instead of a different part and different products to handle all this traffic application. So that's where we -- we are the first one, we integrate SASE in the OS level instead of we have different SASE service, whether SD-WAN in different box, the web in different box, the firewall in different box, SASE in different box. So we have published in the same FortiOS, whether you can load on the cloud virtually or you can run it in our plants with virtual acceleration. So that's where the customer, the service provider or even the system integrator, they can select themselves, give them the flexibility, at the same time, integrate, automate better.

That's very helpful. And how meaningful -- I mean, what do you think your business mix is going to be going forward, large enterprise, mid-market, service provider? Is anyone going to really -- has any one of those segments are really going to be a dominant piece of your business? Or is it going to be relatively balanced across those segments?