Fortinet, Inc. (FTNT) Earnings Call Transcript & Summary

Welcome, everyone. My name is Mark Moerdler, and I welcome you to our video-based version of the SDC. I hope you're enjoying all the meetings so far. I'm very pleased to have the senior management team from Fortinet here for a fireside chat. We have Ken Xie, Founder, Chairman and CEO of Fortinet; and Keith Jensen, CFO. You already have the ability to be able to ask questions and to vote on questions. So I would ask you to please add your questions online. I will be watching those and mixing them in with the questions I already have in hand. So I'm looking forward to the conversation. Let me first hand it off to Keith for some opening remarks.

Thank you, Mark. Specifically, our safe harbor statement, which reads, I'd like to remind everyone that we may make forward-looking statements during today's fireside chat. These forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially from those projected in these statements. Please refer to our SEC filings, in particular the risk factors in our most recent Form 10-K and Form 10-Q, and to other reports that we may file from time to time with the SEC for additional information on factors that may cause actual results to differ materially from our current expectations. All forward-looking statements reflect our opinions only as of the date of this presentation, and we undertake no obligation and specifically disclaim any obligation to update forward-looking statements. Thank you, Mark. Back to you.

Thank you so much. Maybe I'll start with a high-level question. The pandemic and work-from-home has had a big impact on the overall economy in many industries, and there's been a lot of talk about the impact on the cybersecurity market. Do you have any thoughts on how that impact is within the market in general and your own company? And how do you think that's going to affect going forward the demand and need for cybersecurity?

We definitely see kind of a little bit different pattern during the pandemic. Like 1 year ago, a lot of companies, they are rushed to supporting work from home. So just whatever the way they can get people connected, they're all fine. And -- but now after over a year during the pandemic and even some countries, some regions starting to reopen now, we're also starting to see some companies starting to rebuild the infrastructure supporting this work-from-home more permanently, which making like some of the remote connection more reliable, more secure, leverage some new technology, whether SD-WAN or 5G and, same time, changing the infrastructure to supporting, we call, Zero Trust Network Access, and at the same time, also working with some carrier service provider because most of, like connectivity service also provide the carrier, they also want to kind of support in certain securities, some others including SASE. So we do see pretty healthy demand right now. And also if you're going forward in the next 1 to 2 years, a lot of companies were rebuilding a new infrastructure to supporting whether work-from-home or some secure whole infrastructure we call the fabric, make sure not just the traditional security, just secure the working environment in the campus, in the company, but also remotely the mobile device. And it's kind of the new infrastructure, make sure cover all the tech age starting kind of a -- draw out more quickly with all this kind of pandemic. Basically, I think pandemic also accelerated some of these, we call the, whole infrastructure security concept, not just protect the company, but also go to the WAN like secured SD-WAN, also go internal like a security Wi-Fi, security internal segmentation, protect the server, protect the department, protect the data from ransomware. So it's kind of -- the whole infrastructure security become more and more important.

Makes complete sense. Creates some interesting opportunities. Maybe I'll go into products a bit and then look at some of the questions online. Starting with -- Fortinet is known for having proprietary security processing units. What is special about the technology? What's the edge that it gives you versus your competitors?

I've been doing the network security for 30 years. Fortinet started 21 years ago. It's the third company starting in this space. So I see the security needs much more computing power to process the same data, same traffic compared to routing and switching. You only need about 30x, even 100x more computing power to process the same traffic. But also network security need to be in the middle of the network traffic to stop the bad content, bad traffic there. So they cannot slow down the whole things, but also need huge computing power. So using a general-purpose CPU is not enough. So that's where the ASIC can give huge computing advantage and a huge computing power to process a lot of security function, which is too slow to be processed using a general-purpose CPU. So on average, if you move some software function from general-purpose CPU to the designed ASIC, just like how the GPU processes, the graphic processes AI, the TPU the same thing. If they can improve performance for the same function 10 to 100x and also lower the cost and also add additional performance, so that's the reason from day 1 we started the company, we wanted to design ASIC 21 years ago. But also design ASIC take a long time to see the result and also big investment, need to have a big commitment also. So that's where we have to be -- commit early, have to have a huge investment and also need to have some economy of scale. Like you need to have the quantity to make ASIC working. Otherwise, per chip costs will be too high and will not make it working. I think after all these 21 years of investment, we're starting to see the huge benefit of leveraged ASIC, which every new product release, we also gave, we call it, secure computing rating. So on average, we have 5 to 10x better performance compared to all the competitors on the same function for the same cost. So that's because the ASIC benefit have a huge performance advantage because huge computing power being kind of added on the system because of the ASIC. So that's also kind of not just applied for the network security, but also some other function like SD-WAN, the 5G and some other internal segmentation or the other things. We see it's a long-term investment, gave us huge advantage over competitor if they only want software on the general-purpose CPU. We also use the same general-purpose CPU as any other competitors. But the additional ASIC have a huge computing power advantage and give additional function, additional performance, also lower cost. So that's the reason kind of we feel -- and also going forward, we see ASIC also can expand into the other tech service like from smart city, from OT/IoT space and connect the car. And just like Gartner, they said, going forward in the next few years, the edge computing, edge immersive technology was starting to replacing, we call, the mobile, which leveraged a lot of ASIC computing power in edge and can process a lot of data quickly in real time locally. So that we see as -- going forward, we still have a huge advantage with ASIC. May Keith...

Yes, go on. Sorry.

Yes. Keith may add some more.

I think the 2 ways that I look at it very simply to kind of package up what Ken said is, one, it's created a moat, right? You always want a moat when you're running a company or an investment in a market. And that barrier to entry is the ASIC Advantage that he has worked on for 21 years. And secondly, he mentioned the economies of scale. And to add a data point to that, we've shipped probably over close to 7 million units in our history. And so that chip cost, if you will, Ken talks about the economies of scale, you can see how it's getting amortized over a very, very large set of units.

Makes sense. Does the fact that you're using effectively a custom chip, an ASIC, but still a customized chip create an additional level of security since using something that they wouldn't run into an attacker if they were attacking more generic hardware?

Because they add huge computing power, we can process more function, faster speed. At the same time, they can free up the CPU to add additional new function. So that's where on average, our firewall gateway, FortiGate can have much more function and a much higher process speed, can also enable like more function to connect with other part of infrastructure. Like certain part of infrastructure, they need very low-latency, high-processing speed, which ASIC fit in quite well. But also ASIC, whatever you want, a function of ASIC you need around in the software first. And then once this is stabilized, then you move to the ASIC, which takes some time. But on the other side, they free up the general-purpose CPU. The ASIC also is programmable, right? So you can also, just like any other DSPs, some other processor, that's we call security processing unit, more like a GPU and the TPU is very programmable to adopt any new attack. At the same time, we're still using a general-purpose CPU to process some other function needed.

Makes sense. On your flagship FortiGate appliance, how do you see the future evolving? Particularly, we're hearing a lot, and we cover companies such as VMware and others in the space, we're hearing a lot of increased preference for software-defined networking and generic hardware. How should we think about -- how does that affect your future? Or does it not affect? Is it not competitive? Thoughts.

Some of -- they call the, SDN or SD-WAN, we do have that function around an ASIC. Because once you have certain function can be processed in a hardware level is in a much higher speed compared to the general-purpose CPU. And yes, I do believe some of the SD-WAN compound with security has a great future and ASIC is the one to close the gap between how fast the network can go and how the security gateway can be processed. Because right now, if you look at other security gateway, so on average, they are probably 100x slower than the routing and switching there because you have to process the data in like much more computing power to processing data; and on the other side, also much more expensive. It's probably like 50 to 100x more expensive to processing data compared to routing, switching. It's all because of the computing power required to process all secure data. So with ASIC, we can close that gap, lower the cost, add speed and can deploy more broadly into some new environment, in the past probably were costly or pretty much too slow, impossible to be deployed. That's how the ASIC has the advantage compared to only using general-purpose CPU software only. But on the other side, ASIC is also kind of a CPU. You can also quickly change in adopters like CPU can change it. So it's design architecturally process some security content, security encryption and intrusion and also the networking function like SDN and SD-WAN.

Makes sense. So interesting, you're also offering FortiGate, et cetera, for a virtual environment. What's the primary target market? And how should we think about your ability to -- the ability to deliver that level of performance and capability when you're using in a virtual world versus in ASIC world?

I think the -- if you look, they do have certain security function application move to the cloud into the virtual environment. And ASIC can also lower that cost a lot. Because once the secure computing requirement in the cloud in virtual environments starting to get bigger and bigger, you also need to consider how to lower that computing cost, cost by the security function there, which ASIC can easily apply into that environment and easily lower the cost by 10 to 100x applied ASIC in that virtual environment, which we already see some of the service provider, cloud providers starting to kind of leverage that advantage now.

Interesting. I'm going to change gears for a second. We have some questions up. Hopefully, people will add additional ones. Maybe I'll throw one at you, Keith. Change of gears and we'll come back onto the hardware -- the technology levels in a moment. We see that current levels of growth, you're targeting mid-20s operating margins. Can you give us a sense of longer-term margin trajectory?

Yes. I think that we've been very transparent in terms of establishing a framework that we want to operate within. If you look back at our Analyst Day in March, we talked about, in 2023, we wanted to be at $5 billion for our midterm growth [Technical Difficulty] of billings, $4 billion in revenue. And then we thought we'd average 25% on the operating margin line. I think the -- within that framework, certain years may bias a little bit more towards growth and other years may bias a little bit more towards operating margin. And again, I think we've been pretty clear that in 2021, just as we started at the beginning of 2020, but -- and then we changed things on us a bit. But in 2021, we feel the bias is towards growth. And when we look at our first quarter numbers, we felt that the tailwinds that we had in terms of the level of hacking activity that was going on, the public discussion, budget changes, if you will, technology innovations, even GDP numbers that we thought it was going to be a year for growth felt very good coming into the quarter. And I think we came out at 27% billings growth, a 25% product revenue growth. And so those things that we felt we saw at the beginning of the year that this would be a year that would tilt towards growth, but still within that framework that we established of averaging 25% operating margin. But perhaps a little higher growth this year as we go through it.

Excellent. Follow-up question. The pandemic for a lot of companies in the tech space have work-from-home or a lack of T&E has a positive effect on margins, but it's also changed the way people work. How does -- how do you think it changed long-term Fortinet's way of doing business in terms of the mix of work from home and work in the office as well as the T&E expense line?

Yes. I'll take the T&E expense line and then kind of set it up for Ken to talk about how we seize the employee group going forward. The number that we gave was about 150 basis points of benefit in 2020 in the operating margin line because obviously you didn't have travel and you did not have marketing events. We expect that both of those activities would come back online in 2021, and we are indeed seeing that. When we talk to salespeople and we talk to marketing events people, et cetera, and customers and partners, there seems to be a very high level of getting out and about, again, getting on airplanes and going and seeing people. So I'm pretty convinced that, that benefit that we got last year is probably going to be a 1-year event for us. On the flip side, we had operating margins. I think FX this year could be a little bit more of a headwind for us, about the same number, if you will. Work-from-home, study-from-home, et cetera, those types of things, we're a very diverse company with offices and people in over 80 different countries. It's very geographically specific in terms of what people are doing and where different countries are in terms of health regulations and the pandemic, et cetera. But if Ken wants to speak more philosophically about what you'd like to see for the employee group, I'll let him do that.

It's -- I think for Fortinet, because a lot of like service or supporting we do is treated as an essential work even during the pandemic, so that's why we do have quite some people keeping -- working in office, in the lab during the pandemic. And also even like last night, I attended an event. They also estimate in the U.S. about 140 million worker during this time -- during the pandemic, I think it's close to 100 million people still working. And since -- the pandemic changing the way some people working, and I found that maybe some job can be done remotely, but they definitely have some other things that have to be working globally together, whether in the office and the lab environment also has to be on site, right? So that's what we see. They also need to protect the infrastructure, also supporting both how to remote access, how this kind of important data and at the same time -- and how to support another mobile device and the different kind of work environment there. So that's where we do see during the pandemic, the IT spending for security parts have gotten higher percentage compared to before. So we do see some healthy demand in the security -- service security environment, especially the network security, which is supporting how to secure remote access and protect all this kind of ransomware, all these other things. That's also the reason we feel like this is the time to invest in growth. And also we're starting like -- last year, we do see some pretty healthy growth recently.

Makes sense. Turning to the cloud. Help us understand what role does third-party security products play in a cloud environment? Isn't security provided guaranteed by the cloud vendor sufficient? How do you think about that?

I think cloud is a part of infrastructure. And so if you look by market data, so by the next 3, 4 years, the network security still has about $40 billion a year total addressable market. And the cloud probably from, right now maybe a few billion dollars go after the $10 billion. And at the same time, there's endpoint, there's all this kind of different, different part of security infrastructure market there. So I do see cloud as an important part of the infrastructure, but not the only infrastructure needed to support in business environment. So even to access the cloud, you still need all these SD-WAN, you still need all this kind of networking 5G to access the cloud, the data there. So that's where we see as a hybrid environment going forward. Cloud is important, but also just one part of the whole infrastructure need to be secured.

So you're a big believer that we are in a hybrid world for a long period of time. And if so, I guess, has Fortinet been more relevant, equally relevant?

I think we're positioned to be meeting all this whole infrastructure security kind of environment. If you look at some study from Gartner, they even say the edge and the immersive will be replacing the cloud mobile in a few years. They're probably even more kind of aggressive view that the world is changing, stay away from cloud. But we do believe cloud will always a part of infrastructure and same thing for like mobile and even the edge computing, the immersive technology is coming up very quickly, which we're also supporting that. But on the other side, a lot of our legacy traditional product infrastructure still function -- is existing quite well.

Makes sense.

And probably -- Mark, I'd probably add to that. I think there's a conversation to be had in here around the platform strategy. And why that's relevant is in the hybrid world particularly, when you talk to CIOs and you talk to CISOs, one of the items is top of mind right now is just vendor proliferation. They simply have so many different point solutions that they're being forced to manage, and they're talking to us about it takes an army of people to manage these. And when you open up a new attack surface where you bring on a new technology vendor, that simply makes that challenge then even more challenging. And so in a hybrid world, what we'd like to describe it as is security anywhere in any form factor. And yes, we certainly have the appliances and the ASIC strategy, if you will, for the on-premise solutions. And to your earlier question, we also have the virtual solutions, which can be in the form of pay-as-you-go to the cloud provider or bring your own license, et cetera. And what we're trying to satisfy there for the CIO and the CISO is some sort of -- some form of vendor consolidation. I'm not talking about buying a bunch of companies in the industry, but giving them a single management platform for that hopefully at least a subset of their security providers. And so when Ken talks about the hybrid world and why we're very comfortable and confident we're going to be relevant is because of that demand that we're seeing for vendor consolidation, some easing of the pain that they have on labor resources and managing point solutions.

Yes. The other point may impact the cloud also, there's certain other regulation like GDPR in Europe. And also in California, there's a certain regulation. We have to make the data vis-à-vis in a company within a state to protect the privacy, certain consumer right, all these kind of things. That may also impact how to balance them among cloud, among the edge, among the immersive, among the mobile device. So it's -- I do agree, it's a hybrid world going forward. I don't see that kind of changing because each infrastructure have their kind of own advantage, disadvantage in a certain way to provision.

That makes sense. Sorry, my system dropped for a second. That makes perfect sense. I remember when I was -- I've been going to the RSA conference for many years. And so much of the pushback from the CISOs has been the fact that there are Noah's Ark of different technologies and the interest in being able to consolidate. And I guess the argument you would make is the hybrid cloud makes that Ark even bigger.

Yes. We want to give the customer, the CISO the freedom to select whatever the infrastructure fits them the best instead of we try to force them one way or another. So we're basically supporting position to help them to make the whole infrastructure very secure.