Fortinet, Inc. (FTNT) Earnings Call Transcript & Summary

Good morning, everybody from New York. My name is Hamza Fodderwala. I'm the cybersecurity analyst here at Morgan Stanley. And this morning, I had the pleasure of hosting the team from Fortinet. We have the Chairman, CEO and Founder of Fortinet, Ken Xie; as well as Peter Salkowski, the Head of Investor Relations. Before we begin, just a brief disclosure from our end. For important disclosures, please see the Morgan Stanley research disclosure website at www.morganstanley.com/researchdisclosures. Peter, I believe you have a safe harbor statement to make as well before we dive in.

I do. I don't want to make this a whole disclosure conference session, but I do want to show our safe harbor slide for those of you who can speed read, I'll let you read that very quickly. Just basically anything we see today is as of today. And we -- if we have any forward-looking statements in there, this is our safe harbor statement with regard to that. That's it. Back to you, Hamza.

All right. Great. Let's jump right into it. Well, thank you guys for joining us. Ken, my first question for you, just around, obviously, Fortinet's had a really strong run year-to-date, really surprised many of us. I'm curious if you could just speak a little bit on the demand environment in terms of, as I guess some of us are coming back into the office or debating between hybrid workforce or not, what's really driving that demand? And how is it aligning with how people are designing their networks, the rising threat environment, just from a general standpoint, if you could give us some of the drivers of this really strong demand that you're seeing in 2021?

Yes. Like we mentioned in the earnings, we see 3 drivers for the growth. Definitely, like you mentioned, the threat environment has kind of much worse, especially when people work from home, and there's a lot of like attack surface exposed right now. And also, the reason where from our study is grow more than 10x compared to 1 year ago. So that's also a lot of business that needs to be protected their data, their infrastructure. The second part, we also see is really -- we see some consolidation, whether within the cybersecurity space or within the network security space. You can see like 10 years ago, the top 5 vendors has less than 50% of market share in the network security. Now on the top 3 were 50%. So there's some consolidation. The same thing like a network security vendors starting to have -- like employing some other e-mail web or cloud, all this kind of working together. They call the fabric approach, Gartner called mesh architecture, which consolidate approach will be much lower cost and easy to manage and defend security more efficiently. So that's pretty much all the enterprise agree with this, this kind of consolidation will be the future trend. So we do see that the non-FortiGate product grows much faster than a FortiGate, and in the last few years, basically. So that consultation was still going on. And we have a better position because most of our other products, more internally developed, which integrate all the way from day 1 compared to other vendor mostly come from acquisition will be more difficult to integrate and automate. And the third one is really the region we have for like over 20 years, when we started the company in 2000, we call secure-driven networking. We do believe that the networking space will be converging into a security or secure-driven networking. Because today's networking is still running the same protocol designed 40, 50 years ago, just given the connectivity and speed. But anything above that, like how the content or the application that the user, the device or the location, all this and all has to be handled by security. But more and more business, more company both in the local area network or wide area network, in the WAN, they do see the importance of before you do the networking, you know what's the content, what's the application, what's the device behind, the user behind all these things. So that's where we see the business we call like a secured SD-WAN go internal, inside the campus or data center to the segmentation study, have a very, very strong growth. And we do believe, long term, you can see the percentage of network security compared with the -- or the market size, the network security compared to the networking. Networking is pretty much flat in the last 5 to 10 years, but network security keeping grow much faster. And especially when we combine like SD-WAN with security, we see very, very strong growth, almost double year-over-year. And we believe we are the #1 leader now. So it's a very, very strong demand for the secure-driven networking. Eventually, I do believe, the secure-driven networking will be replacing the traditional networking, with the total addressable market will be over $100 billion. So that's the third trend. But also, the key is really security needs multiple computing power to close the gap because that's where -- that's also the reason when you handle the same data, same traffic, whether using security approach compared to traditional networking approach. The security approach needs like 30 to 100 time more computing power to processing traffic compared to the traditional routing and switching. We have to check the content application, the device user all these things behind, which the traditional routing and switching just give the connectivity. So that's the reason the ASIC can increase the computing power, lower the cost is very, very important to get a secure-driven networking going. So that's also the reason we invest in this ASIC technology strategy 21 years ago when we started the company, and we do see the benefit of that. And we do believe it's a long-term, huge potential and a huge benefit going forward when the networking security converge together.

I think just to add to what Ken said, I think the operating system is extremely important for Fortinet. The FortiOS 7.0 came out earlier this year. We usually send out an updated version of the operating system every year. It's interesting in this space, people get enamored or focused on specific capabilities. So way back when it was mail, then it was Sandbox, then it was Endpoint. Today, things like cloud or Zero Trust Network access get a lot of attention. Fortinet has all of those capabilities built in our operating system, right? We can do things in the cloud, we can do things on-premise. We can do both. We think it's a hybrid cloud world. It will be a hybrid cloud world for a really long time. We have endpoint capabilities. We have FortiClient or what we call EDR to transfer -- and moving into an XDR sort of capability. We have Zero Trust Network Access. We also can do what we call micro segmentation with our firewall. So there's all these the shiny new objects, if you will, or the new theme that gets a lot of attention because the ransomware guys continue to -- or the bad actors continue to find different ways to attack. But in Fortinet's case, we can address all of those through one common operating system, an operating system that runs well and fast and has the computing power because of our ASIC strategy, but can also take that operating system and make it virtual and go into a cloud scenario, if that's where the security needs to be. So it's the ability to go across, what Ken was saying, the security-driven networking concept of being able to do a lot of the networking functionality because the network is important, but also being able to add the security layer on top of that has really been the -- basically the operating system working across all of that.

Got it. That's helpful. Definitely, there's a lot to unpack there. If I could just take it maybe piece by piece. Maybe just starting a little bit on the FortiGate side. I know you have a lot of use cases beyond just traditional firewalling. But it seems to make a lot of sense. You're seeing a lot of consolidation in the market, if you will, towards solutions like yourself, a lot of share gain. But the market for firewalling has also been really strong. And I think we're seeing that in other vendor results as well. Can you talk about maybe what is driving that? How long do you expect that demand environment to remain elevated? Is it people returning to the office? Is it perhaps more investment in the data center? There was obviously a lot of thinking that we'd be moving more towards cloud and this Zero Trust Network Access model, which would shift away from some of these on-premise components, but obviously, you believe that it's going to be more hybrid. So just maybe if you could talk a little bit about what's driving the demand and how do you expect the pace of that demand to evolve over time?

I do think in the network security will be seen for over long term, be the top business in the cybersecurity. For me, being in the network security for 30 years in company, you can see that -- because network security is in a very unique position, you get more device, more people being connected and the network security is the one in the middle kind of helping, like apply some kind of whether the policy or the way you want to handle the data, secure the data in the middle compared to other approach, whether it's an application or have to move data to the cloud or have to like install software in your own device, the network security is a much unique position. And also, especially when you combine the network security with the networking, it's a huge advantage because you have to have a network device there anyway. And just today's network device cannot go higher layer, the other content application, the network security can apply all that. So that as I do believe with more things get connected, especially whether the 5G or some other connected car, smart city, whatever, then the network security will get more and more important in the infrastructure, will continue to keep growing. And it's also no longer just secured a border, that's really when company connects the Internet, they put a firewall there, because there are so many different ways to connect Internet or also work from home. So that's where you can see the network security is starting to apply into the internal segmentation inside the company, into the work-from-home environment, into the OT, IoT space. And that's where we see the growth also very, very strong. And because the position of the network security compared to other cyber secured approach, I do believe -- even there is some move to the cloud, but in order to access the cloud, access the application, you still need the network and the network security there to make sure you are secure. And so that's where I think network security will be, continue to have a strong growth and continue to meet the wholesale cybersecurity space to be the #1 market there.

To just highlight one area that Ken just mentioned operational technology, OT, right. Companies are connecting their manufacturing floors to the Internet and trying to manage them and efficiently run their businesses through an AI or ML sort of situation. You physically need to be able to protect those locations with physical devices because those are physical locations that are doing manufacturing. And they're not going to shoot it to the Cloud, have it protected and come back, that's not an efficient way to run that manufacturing or that operation. And so that needs physical devices. And so we called out on the third quarter earnings call that we saw a very strong growth in OT. I think we've provided some data, said it was up 77% on a year-over-year basis and said it was at least 6% of our billings in the quarter. So one of those areas, one example of where a physical firewall or networking and firewalling capability that Fortinet can provide is definitely seeing good growth. Micro segmentation is another example of the use of the firewall in an on-premise capability, where you're in a networking setting because you're really running with the network in line with what's going on in the network, but also offering a set of security capabilities that allow you to micro segment or really Zero Trust Network Access capabilities within your network on functionality.

Got it. That's super helpful. Maybe taking a step back. So you mentioned the security-driven networking strategy. Clearly, that's been working out for you and with the success that you've had with SD-WAN. I'm curious, when did you start to see this convergence? And what do you think is driving it? Because I think we were starting to think of security and networking as separate, right? I mean if security and networking were truly converging, then you would still obviously see Cisco continuing to gain more share in the network security space than some of the other networking vendors. So why do you think that we've seen decoupling, like in the last 10 years, and now we're seeing more convergence?

Like I said, the basic gap, I mean, the difference is really security need more computing power to process higher layer traffic compared to the routing and switching in the networking to just handle the layer 3 routing and switching there. So that's where security is much slow, more expensive and difficult to manage. But whenever we can close this gap, there's a huge demand. So SD-WAN, the WAN space compared to the traditional local area network with the data center is relatively slow on the speed and the gap is smaller. So that's where the user adopt the first, but also within the campus network, within the data center, they also have a very strong need. Just today, the network security speed, a lot of time has a difficult time to handle in more high-speed environment, which ASIC can help in a lot across this gap. But with the new kind of ASIC technology, with some other kind of [indiscernible] this space, like internal and the local area networking, I think that's also setting -- changing the whole landscape inside the company, inside the data center there. But SD-WAN is one good example. We do have like -- including -- I think I remember 15 years ago, we're starting to combine Wi-Fi with security together, FortiGate also Wi-Fi controller. Wi-Fi also ramp up very, very quickly. In the beginning, people just want to get connected. They probably don't care about the security that much. But once they get connected, the next thing they worry about how to handle this security, how to handle the data, the content or the application. And the same thing SD-WAN is probably the first protocol is launching some traffic based on certain applications, and also applied security there will be have huge advantage, huge benefit. Thus, we see very, very strong growth, especially we have the same OS, the same to handle both network and security. But go inside the company, go inside the data center, especially there's a lot of ransomware, a lot of security threat right now, we do see pretty strong demand. But also have to solve this kind of a performance gap issue and also increase some of the costs for internal networking security, which we see pretty strong demand, but also just starting ramp up right now.

Just to add to that, I think the -- your example of Cisco, for example, I think one of the advantages that Fortinet has is the fact that we've developed everything in-house. So our capabilities, our operating system is integrated to the point where everything can communicate with each other. Other players in the space have come into the security space through acquisition. It's very difficult to integrate these capabilities, especially if you're buying mature sort of capability, security capabilities to actually integrate them and get them to communicate with each other and be basically a holistic or one sort of operating system. And so I think that gives us a huge advantage over a lot of the other companies that are in the space.

Right. How much of that networking market do you think -- obviously, right now, you're taking -- you're doing a lot of good things with SD-WAN, but how much of the networking market you think can capture over time? And do you think other than the fabric approach that you have, is it also the fact that you are the price performance leader and that just gives you a structural advantage versus many others that are trying to break into -- from security networking or vice versa?

Yes, the ASIC gave us 5 to 10x more computing power compared to the general-purpose CPU can do for the same cost in function. And at the same time, the power consumption is about 2% of the general-purpose CPU doing the same computing calculation, the networking. So that's where the advantage is pretty huge. But also ASIC needs a long-term investment, to invest at least like 5 to 10 years, and spend $1 billion before you see the benefit of that. And also the economy of scale, also working for the ASIC industry is -- we have the quantity, the per chip cost can get much lower and has more benefit, which we have the quantity and none of our other competitor has. So basically, we had the quantity, more than the #2, #3, #4, #5 all add together, we still have more quantity than them altogether. So that's also working for us. And -- but on the other side, I do see once get connected, a lot of edge computing, this ASIC advantage we're keeping expanding beyond the traditional networking side.

Yes. I think it's important to realize that we're not just -- we don't sell networking capabilities, switches, routers, whatever, that aren't secure or to a customer that probably isn't already a Fortinet firewall customer, right? So it's not like we're going out and competing against a networking company, specifically on a switch basis, for example, right? We're going to be doing that in a security capability, sort of offering, where we're offering their firewalls along. SD-WAN is a prime example. We have what we call SD-Branch, where the company might be installing our firewalls in their branch locations or their retail locations, for example, 3,000 different retail locations. And in doing so, not only getting the SD-WAN functionality and security that's built into that operating system, but they might also go into that branch location and replace all the routers and switches there with all Fortinet equipment. So now it's the entire location is running on a Fortinet operating system, so the whole thing can communicate with each other. So in that case, we may be selling them switches and routers that go along with that. But we wouldn't just go in and compete on a networking basis simply as a networking company, that's not what we're about. We're about security and networking together.

Yes. We are doing some study, probably we'll release the data likely in the next year, which will be March next year, also with -- we call that Accelerate Partner Customer Conference. But you can see the last 20, 30 years compared to the networking side of the market, the network security market, you can see the percentage of network security go higher, higher percentage. And at the same time, from time to time, there are some bursts of growth on the networking, whether there's certain like a WiFi approach or whether the SD-WAN 5G, because some device, something want to get connected, so that's where people want to get connected first. But once they connect together, all kind of they see the importance of knowing what they're connecting to, what's the content with the application side, then security need to be stepped in. And so that's where -- and also once like the mature networking market, like within the company, campus or within the data center, which they also want to know what's the content that they are being connected, what's the application, and what was -- they need to have better visibility beyond just connections together, then the security to step in. And then they are starting replacing the traditional network device there, even costs higher and need more computing power, which we also try to help and solve that issue right now.

Ken, so you mentioned consolidation in security. And I mean, at Morgan Stanley, we've been calling for consolidation for many years now. And it seems like there's a different point solution that pops up every other day in security, and you talked about that a little bit. So I'm curious, I know we've had conversions in certain areas of security, but just that broad-based consolidation, like, where are you seeing it? Is it mostly more in the mid-market SMB? Are you starting to see it more in larger enterprises? If you could sort of give me a state of that and what's finally driving that now?

The enterprise definitely see some more consolidation. I have to say that the SMB, most of them still more goes to the service provider, the carrier or some other local service provider, a secure service provider, which they also benefit from the consolidation. So that's where basically -- the enterprise definitely see probably the driver for some of that and then the service provider is also the driver for the consolidation.

Got it. Got it. Shifting to Cloud. I know you've made some investments around Cloud security as well as your ZTNA offering. I'm curious when it comes to the cloud secure access product that I think you're still building out since one of your acquisitions. How are you thinking about building out a cloud network security model? Is it going to be leveraging the service providers? Are you going to have your own POPs? Just curious how you're thinking about the cloud portion of the network security market.

Yes. Our approach, both on the cloud and also whether they call SASE or some other service provider model, is different than some other vendor. Basically, we do see a long-term carrier service provider in a much better position because they have infrastructure to offer this kind of service-based security approach, including SASE. And that's where we are working more closely with them, like we announced the partnership with AT&T, with Verizon, with Comcast, with BT, with Orange or other. So we're working with also a long, long time in front of our beginning like when we started the company. So that's what we feel. They have an infrastructure customer base and more close resources supporting their customer there. Just they also not aggressively invest or kind of a more little bit slower compared to some other security vendor there. But long term, they are the profit business model for them to offer the service. On the other side, we also believe some of this, like whether zero trust SASE will be better integrated into the OS level, which will be more easy to manage, more easy to scale and also eventually also can be pushed to the edge, to the local process instead of have to always forward to the data center for the POP or for some cloud infrastructure there. That's also the trend [indiscernible], which edge computing will be replaced in the cloud in the next 5 years. So that's where we kind of announced in March early this year the FortiOS 7.0, with building SASE, zero trust and 5G and SD-WAN in the same FortiOS, FortiOS 7.0, which announced early this year. And it's more consolidated, more integrated approach in the same OS for this service compared to like different server, different box, within like the cloud infrastructure there. And that's the approach, it's kind of unique, but also take a little bit long time to build. But I do believe will be last much longer with more kind of a healthy business model compared to the current rush into the space, and with a big loss of the money and try to gain some customer base. So that's why we're more working through the long-term approach with the service provider and with better integrated solution, eventually may also accelerate by the ASIC, has a huge computing power advantage compared to the current software approach.

I think, Hamza, a couple of things to point out. We do have a very strong cloud business. It's a driver for our business. If you look at -- I'd like to put a plug in for my Investor Relations presentation that's up on our website. Slide 25 will give a breakout of FortiGate versus non-FortiGate billings. It has some cloud data on there that I think that people would appreciate. In 2020, our cloud business was about $237 million of billings, growing at a 2-year CAGR of about 38%. That's accelerated with the rest of our business this year. If we assume a 40% growth rate this year, that cloud business on itself is going to be $330 million of our billings this year. So it's a fairly decent size of our business and growing quite rapidly. The other side of that, though, in terms of like rapid move to the cloud, you have to look at our customer base, right? And where our businesses are. 50% of my billings comes from 100 countries, right? 50% of my billings comes from 6 countries, the U.S. and a couple of -- 4 European companies and countries in Canada. The other 50% comes out of 100 countries, no one of which is more than 3% of my billings. So you start talking about cloud access, you start talking about Internet access, and all those kinds of things that we take for granted here in the United States, we're in a lot of countries where that just doesn't -- that isn't realistic. And so those companies or those customers of ours aren't necessarily looking to go to the cloud, they're still working on much different kinds of capabilities at this point. So we're moving there. We're having certainly very good success there. But we also have -- we still believe it's a hybrid cloud world and going to be that way for a long time, and our customer base would suggest that.

Got it. I know we only have a couple of minutes left, but I wanted to touch a little bit on the OT opportunity. You've been talking a lot more about that. I noticed that your recent event, you had a number of OT vendors there as well. How big do you think that this business could be? Do you think it could be bigger than the SD-WAN business over time just given the demand that you're seeing out there?

Long-term definitely will be a very strong growth driver, because when you get all this things connected, IoT connected, and also the OT industry also kind of suffered a lot of our ransomware attack and they see the important of protecting their infrastructure, their data there. So we do see pretty strong growth. I think we gave the data. We say we grow like 77% year-over-year and is now probably between 6% to 10% of the business. Sometimes a little bit difficult to measure it. They using the same product for today. So that's where we see pretty strong growth, but also depend on the threat landscape and depend on how quickly people invest into this, whether the 5G or some other part of this kind of infrastructure. But this definitely is one of the growth -- very strong growth driver for us.

Got it. Well, with that, unfortunately, we're out of time. Thank you guys very much for joining us this morning, and have a great rest of your day.

Thanks a lot.

Thank you.