Fortinet, Inc. (FTNT) Earnings Call Transcript & Summary

All right. Well, good afternoon, everybody. I hope everyone is doing well. My name is Hamza Fodderwala. I'm the U.S. cybersecurity analyst here at Morgan Stanley. And with me, I have the pleasure of having the team from Fortinet. We have Chairman, CEO, Founder of Fortinet, Ken Xie as well as Keith Jensen, the CFO. I'll make a brief programming now on my end before I shift it over to Keith for the safe harbor. But for important disclosures, please see the Morgan Stanley research disclosure website at www.morganstanley.com/researchdisclosures. And I'll shift it over to you.

See if I can be as quick as you are, Hamza. I'd like to remind everyone that we may make forward-looking statements during today's fireside chat. These forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially from those projected in these statements. Please refer to our SEC filings, in particular the risk factors in our most recent Form 10-K and Form 10-Q and to other reports we may file from time to time with the SEC for additional information on factors that may cause actual results to differ materially from our current expectations. All forward-looking statements reflect our opinions only as of the date of this presentation, and we undertake no obligation to specifically disclaim any obligation to update forward-looking statements. Thank you. Hamza?

Wow, that was quite a mouthful. All right. Let's start off. Let's make this a little fun, wake people up. So everyone is worried about the sustainability of product revenue growth at Fortinet. I think that's the #1 question I get. Your guidance implies about 15% product revenue growth, and you've been growing the last couple of years, high 30%, 40%. There was another vendor here that competes with you that says the market growth rate is low to mid-single digit. Why is that vendor wrong? And why do you think that you can grow much higher than low to mid-single digits?

I do believe the market will grow 10% to 20% instead of mid-single digits because there's so many new use case for network security, which I have to say, most of them, the other vendor is not covering. You can look at the Fortinet solutions right now. Even last year, the SD-WAN and OT together contributed 25% or more of our business. That's really the new use case which didn't exist a few years ago. The same thing for a lot of like internal segmentation, for security, the cloud infra traffic and supporting work from anywhere. So there's a lot of new use cases beyond the traditional enterprise network security, which kind of on a cover for a company connected to the Internet. And -- but with Fortinet solution, we [indiscernible] not only about the software approach but also we were very unique to have our own ASIC chip which can go to a much broader solution there and a much lower cost, better performance, that cover a lot of new use case in the network security, the traditional network security vendor, which most of the software solution running on the general-purpose CPU cannot cover. Because for them, running all the software has to be on an expensive server or has to be using cloud computing power to cover the software function, so we not only have this software function, but with our ASIC advantage, this huge computing power advantage from ASIC, that can cover a lot of other areas that we see. SMB today, in U.S., probably less than 20% SMB has any kind of network security coverage. But now we're at somewhere [indiscernible] SMB and then for their software solution, very difficult to cover SMB. The same thing for whether the OT space. Most OT device probably have a difficult time for using any software to cover that, whether in the end point side or in the network security side. So that's where our solution also can cover quite well in the OT area. So that's where the huge new user kits give us a much bigger total addressable market. So that's where we see the growth of our total network security [indiscernible] product will be continue to be 10% to 20%. You can look at both on the product revenue and the unit shipment. So we have a huge advantage there.

Got it. So the network security market in terms of units will grow much faster than mid-single digits, for net things, 10% to 20%. The reason for that is because now a greater percentage of that is coming from these secular drivers like SD-WAN, OT, which 25% of your product revenue now growing, I think, north of 50%. You have a very big installed base, I think, close to 700,000 customers, close to 10 million units. What percentage of that has SD-WAN and OT?

We can track in SD-WAN and OT last year by the new use -- I mean, the new deal. So when sales [indiscernible] so they voluntarily disclose how much is that. I mean where does it come from? What's the use case, whether SD-WAN or OT, so that comes about 25%. But for the existing customer, which they don't need to pay extra dollar for SD-WAN, so that case is probably also much bigger. We don't quite track in that one. And also, right now, we also don't charge an additional service fee for SD-WAN. So that's what we're going to probably -- in the future, that's additional service revenue for us. So we feel the percentage that are using SD-WAN probably bigger than the -- SD-WAN and OT together, probably bigger than 25%. And also, it's a very fast-growing area. SD-WAN probably like a 3 -- maybe $4 billion, $5 billion and keeping growing close to 30%. The OT probably bigger market even grow faster. So we do see a quite good position in the space.

Got it. Let's talk a little bit about the services revenue. So Morgan Stanley, we estimate that for every appliance you sell, you're getting about $0.50 of ARR per appliance for the firewall business. I think some of your competitors are getting much more than that. How do you plan to drive higher service attach, particularly on the SD-WAN side?

Yes. I think the interesting metric when you look at it there, obviously, we're very pleased with the service revenue. I think you've seen sequential growth in service revenue that's gone something on the order of, by quarter, 22%, 24%, 26%. And we provided some guidance, I think, that suggests 27% as we look forward. I believe that as the firewall -- we sell 2 subscriptions to the firewall, one is support, called FortiCare; the other is FortiGuard that -- which are the security updates. As we look at customers today and we listen to CIOs and CISOs about their concept of consolidation. It's not just vendor consolidation, but it's also consolidation of doing more things on an individual appliance. And this is where our FortiGuard bundles come into play. And really, that's about explaining to not only our customers but to our channel partners and training our sales team about all the functionality that can now be done in a firewall and how that continues to expand over time. And that firewall can either be a physical appliance or it could be a virtual machine.

Yes. I think first, we have a pretty healthy margin, both the service margin, product margin, operating margin. And if you look at the service, I totally agree, we charge much less than our competitors. There's a few other areas where we kind of keeping -- adding new function, which also has a potential of service revenue like SD-WAN. But on the other side, we also go through a lot of -- this business goes through channel service provider. We also try to leave them some room to add some additional service for their business there. So that's why we do see service will be keeping -- growing faster than we had in the past because from the product revenue side, we are already #1. We are ahead of any other competitors, which all this product has a much more new function and that can attach to the additional service. And also, when the service renewal come up, like Keith mentioned, whether the price increase, whatever, also starting to catch up, that one, so that's where we see the margin and the growth of service revenue will be -- keeping improving.

Got it. Got it. So I want to talk a little bit about Fortinet's single vendor SASE strategy. So I think Fortinet's view as SASE is a convergence of security and networking. I think others view the market a little bit differently. What is Fortinet's strategy on SASE, number one? And why is Fortinet better positioned to go after that market given the operating system and the price performance advantage that you have?

I personally view the SASE like I keep mentioning in the last few years, it had to be a much broader, more distributed solution there. I think it's -- a good part is that it's a service [indiscernible] model. But on other part, it's not just limited to the cloud. It also has to be on-premise and it also has to be like -- that's what we call the universal SASE, not just for some enterprise but also can be for like SMB, it can be for some other like different vertical space, health care, manufacture, all this other area. And also, the service provider, telecom provider will be a bigger player, will be important partner to offer the same service. And also, we look at the technology also, they are still in the early stage, not quite mature enough. So you need to integrate a lot of SASE function into the same OS, in the same appliance instead of -- in the PoP, you have a few different machines and a hundred different functions. So that's what making SASE more efficient, especially for a lot of service provider. So if you look at today's SASE business there, it's more for certain enterprise using cloud way to deliver that one. And also the -- it's quite more expensive compared to on-premise solution there. And at the same time, kind of some costs going forward also quite expensive compared to whether on-premise or edge solution there. So that's what we call the universal SASE, it has to be more broadly deployed and more like a real-time process traffic, both on-premise and also in the cloud. And also leverage agent, not just a software agent, low down the device, but also the hardware agent that we call the FortiSwitch for the AP can be the agent of forward traffic to the FortiGate or the network gateway to process our leveraged infrastructure from telecom service provider instead the only vendor, the own PoP. So that's what we see. It's a much bigger market with a lot of service provider, telecom provider, cloud provider, to be participate and offer their own kind of security service because they have the customer, they own infrastructure, which costs much less compared to the PoP owned by the SASE provider today. So -- and also for us, we do have some PoP ourselves. We also have a different approach of the PoP. So we tend to be more on the PoP from the real estate to the connection there, which will be the cost will be half or less compared to your lease or rent of the PoP from whether it's some cloud provider or some other ones. So that's making the whole business, the more profit, more efficient. It's similar like some telecom company core provider business model going forward, instead of short term, you probably can run that quick, but then the cost in the next few years will be very, very high and making most of IT companies losing money today.

Okay. So your SASE strategy is partnering with a service provider. It sounds like white labeling through the service provider as well as you do have PoPs to host your own SASE solution. How many PoPs does Fortinet currently have? And how many do you expect to have once you have fully built them out?

So we have a tons PoPs ourselves, but also if you count on the facility working with a telecom provider, it's a much bigger number, a few hundred to thousand number there. So that's where the partnership we announced in the last few months whatever, with a lot of telecom provider. And at the same time, even had some new partnerships going forward right now is how to leverage the facility from the telecom provider, cloud provider, and enable them to offer the SASE using our product. That's where we see the big growth potential there.

So how big is the FortiSASE business today? And if small, like when do you expect it to generate meaningful billings?

So if you look at the number, one vendor, they say -- in the last 6 quarters, they say they're the leading vendor in the SASE space. In the last 6 quarters, they have $1 billion business there in SASE. But for us, that's also kind of SD-WAN. So if you look at our SD-WAN using the way they define a SASE, we're much bigger than they are. So in the last 4 -- 3 or 4 quarters, we have over $1 billion just coming from SD-WAN itself and not even counting on additional software SASE service. So that's why it's kind of hard to define a SASE. And for us, we do see like -- SASE definitely the one use case is part for certain cloud enterprise solution there, but that's a much bigger use case for SD-WAN solution for some other service-based solution and leverage service provider. So that's where depending on how you count on the number based on the number we have, we're probably also the biggest SASE provider, if you count SD-WAN with our other solution there.

Yes. I think Ken's covered a lot of ground there, so maybe 3 quick points. One is it's all about a single operating system. And then so that with our SASE solution, it's one operating system that we're talking about. Two, as you think about PoPs, really not as quite as relevant to us in terms of the count of PoPs because of our expectation that we're leveraging these service providers' infrastructure as we go forward. And then three, as you look at the different elements inside of a SASE solution, including SD-WAN and CASB and so forth, if you want to look at just -- and call our SD-WAN business a SASE business, from some of the numbers we've given before, you can pretty much reverse engineer that pretty well -- that got pretty close to about $1 billion in business last year.

Yes. And also, if you see the function being processed in the PoP, we can handle in the same [indiscernible] as in FortiGate. But you've like come in FortiGate in a field. That's always an integrated function, all the SASE function in the same [ FortiOS ] in FortiGate. And also, we're even using some hardware agent like Forti suite for the WiFi to FortiGate to process, that can be millions of PoP. I think it's a little bit different way we cover the solution. And also, we try to be more working with a partner service provider, and it's a much bigger total addressable market and also much more new use case compared to the traditional enterprise cloud-based SASE solution.

Let's dig in on SD-WAN. So SD-WAN, we estimate about $1 billion bookings business for Fortinet. Roughly, I think MPLS spend is about $45 billion annually based on the current pipes that exist out there. I think the SD-WAN market is maybe 10% of that. Do you expect the SD-WAN market to become as big as the MPLS market? Or what percentage do you think it will become of the MPLS market as it exists today?

SD-WAN Market is a different kind of study. I say probably the number I say, will be maybe around $4 billion, $5 billion last year and still growing close to 30% year-over-year. If you look at all the top 5 vendors, whether Cisco, VMware, like whatever, Palo Alto, HP, I think that we are the only vendor to develop SD-WAN internally, and integrate with security solution and also using ASIC to accelerate. So that's why we have studied like we a huge ROI return benefit using the Fortinet SD-WAN solution. It's like 8 months return on kind of investment and ROI probably in 2 years will be 300%. So that's where in earning, I'm pretty much confident I'd say within the next couple of years, we'll be the #1 vendor in the SD-WAN space. And at the same time, there's a lot of additional service. We can get -- come out of SD-WAN and also can kind of drive a lot of additional business there come from SD-WAN. I think the SD-WAN market will be replacing most of the MPLS and also even replace the majority of the routing business there. There's -- some core routing still need to use router, but SD-WAN or the edge routing, whatever will be using SD-WAN because it's much more efficient as -- deliver a traffic-based application. So that's where SD-WAN is pretty much the first protocol, you can deploy. You can read out the traffic based on different applications. It will be more efficient and will be more cost saving, will be a market solution, especially we develop the technology and also leverage ASIC, lower the cost and add a lot of performance. At the same time, more function can be integrated together with SD-WAN.

Got it. So you said 200% to 300% ROI when you rip out the existing telco MPLS lines when customers deploy SD-WAN.

That's the study we made with a few enterprise, and that's a public material.

Forrester did the study for us, if you will. And I think the other -- what Ken is kind of describing is the evolution of the SD-WAN market. In the very early stages, it was very easy to kind of think about that as the MPLS savings and logically that we look at it in the retail vertical. And it was very successful. It caught fire because of the ROI and you see that in some of the numbers. But now we're starting to see SD-WAN with new use cases coming online and seeing customers getting more creative in terms of how they're using that technology, how more features are being added to it, how it fits into the SASE model is a key component of the SASE delivery. So starting to measure it against MPLS made a lot of sense when it was very much about a branch savings opportunity. But now I think it's starting to progress into something else, something more.

But also the traditional SD-WAN to SASE I think right now is a little bit kind of reversed. Actually, SD-WAN is a much bigger market compared to SASE. Right now, the SASE, they talk about it a little bit more related to enterprise cloud delivery SASE, but SD-WAN is a much bigger market that address a lot of networking issue there. And a lot of SD-WAN customers, they actually come from totally different space and a different use case compared to the traditional even security -- enterprise security. It's quite a bigger, different market.

Got it. Fortinet has also been selling more networking in terms of switches and access points. I think that's about 12% to 13% of your billings based on disclosures you've given. Why is selling networking important? And how big do you think that business could be for Fortinet?

You can look at how networking and the network security. Network security more cover the high layer like a content application, device user, location layer. Compared to network, it's more just to connect everything and try as fast as possible, more devices being connected. So if you do the traditional network security because the only software approach, they have very limited use case within -- whether enterprise or software solution go to the cloud using cloud computing power because they have to use in the general-purpose CPU. So that's where using the additional ASIC give us much bigger, more broader, more use case compared to the traditional enterprise network security. And that's also SD-WAN is one of the good example and the OT is another very good example. So that's making the overall, whether the SD-WAN, the OT, some other much bigger total addressable market and grow probably even faster. That's why, my estimate, probably last year, probably about 50% of the business come from the new use case, the traditional network security in the enterprise not cover. So we have a lot of new use cases, including I mentioned SMB space, right? So in the U.S., there's probably 20 million to 30 million SMB, and less than 20% of that has any security protection, network security protection. That's a huge growing market which the traditional network security can already cover. They have to build the software and a quite expensive server. At the same time, they cannot consolidate the device with other network device or the broadband access device. So that's where we feel the integrated solution, whether the security, the SD-WAN, the LTE, 5G and also WiFi and also even internal switching AP routing, all these kind of things, that will be the solution for a lot of whether the SMB, the brand traffic or even like work from anywhere solution there.

Ken, maybe just to shift a little bit on the tactical side. On the macro front, you mentioned on the earnings call that you saw a more modest budget flush in the U.S. enterprise. And then -- but you also said in January that your pipeline growth in January was stronger than it was the same month a year ago. So square that for us, like what's going on?

Yes. Well, I think as you -- as we expected as we look at the fourth quarter, and I think you've heard this from other vendors as well, that we did not expect to see a budget flush in the fourth quarter. There was a lot of pausing, if you will, that was going on, particularly in November and less so in December. But we did expect to see and we did see more deals pushed out of the December quarter into the January quarter. And the commentary around the pipeline is probably in the context of looking at the guidance that we provided for the full year and providing some comfort about it. In some ways, simplistically, the guidance setting process is, one, do you have the sales capacity deliver it; two, do you have the pipeline for the salespeople to go to sell against it; and three, are you assuming close rates, very, very important now that not out of line and give you a productivity number that makes sense. And so I think when you look at that, the context of it, and while we were making the point that the pipeline growth was actually higher this January compared to a year ago, obviously, the guidance is lower, right, and I think we're not trying to offer a level of caution and conservatism in our commentary.

Got it. Maybe shifting to margins. Fortinet kind of stayed at this 25%-plus operating margin target in terms of -- for the next at least 3 years, right? But you're a much more scaled business now. You've got the higher services revenue mix. Why can't margins be much higher? Like, why stick at that 25% plus?

So we do need to invest in the growth, right? So there's a lot of growth opportunity both in the network security area to cover a lot of new use cases and also in other products, we have about 30 different products beyond the network security from end point throughout the different [indiscernible] e-mail application, to the cloud solution there. And also, we see the -- we call it universal whether [indiscernible], universal SASE, including different party infrastructure security. So that's where we want to keep investing in growth.

We smile to each other because we kind of stake out our respective areas, if you will. I'm talking about margins. He's talking about market share. But I think Ken makes a very good point. We're in an environment that's a very fragmented market in the security space, when you look at it on a worldwide basis, and that's certainly where our customer base is. Two, by virtually any third-party account whether you're talking about Gartner or Forrester or what have you, we have a competing, if not a superior product. In that environment, to the extent that you can add sales capacity and keep them productive through the pipeline, it makes a ton of sense to continue to do that.

Fair enough. From a capital allocation standpoint, I think during the first 3 quarters of 2022, you bought back almost 5% of market cap. Just curious why the pause in Q4? And how should investors think about share buyback in 2023?

Yes, that was a pretty quick pace there in the first 9 months of the year, no doubt about that. Look, I think the -- to start with the concept that we're going to be very faithful to a single operating system. And with that, our M&A strategy has been clearly around tuck-ins. We've talked about the $25 million or $50 million. If we started doing $500 million, $1 billion deals, and maybe this is the nature of the question, it creates risk of that single operating commentary and strategy that we have. And so if you set aside that you don't need a large war chest necessarily for M&A, the question becomes, what is the logical thing to do with that. And one logical thing is we do invest in real estate. In consistent with long-term investors, Ken and Michael, we like to own our own real estate where we have significant footprint of engineers or data centers or PoPs or warehouses or what have you. And then the next place is returning capital to shareholders. This actually goes back, I think, as far as when we did an investment-grade debt offering of about -- of $1 billion in 2021, I think we're very clear then that the intention of those proceeds was to provide capital back to the shareholders of the company. And I think we've successfully done that. Net-net, we prefer to be opportunistic in the buyback strategy. And I would expect that you should see us continue with that behavior in the future.

One last quick question, and I'll open up the audience for Q&A. The CapEx, you mentioned that it was a pretty substantial step-up, $400 million to $450 million. You talked about the real estate expenditures, just explain what's driving that?

Yes. I think there's -- we provided enough commentary that includes in terms of the read through. We've talked about data centers. We've talked about PoPs. You're seeing their numbers increase. When I talk about the margins for services, I just talk about that have a little more of a headwind now because of costs related to hosting and costs related to data center. So I think that all makes sense in terms of pointing to the direction that we're -- one place where we're making investments, obviously, will be a SASE-type solution and other cloud-based or hosted-based offerings.

Great. Anyone in the audience have a question? Okay. I'd love to talk about OT security. So that's 10% of your bookings now. To get rid of that something like 80% of ransomware attacks focused on critical infrastructure. This is a roughly $0.5 billion business for Fortinet. There's all this focus from the administration at the federal level, focused on securing critical infrastructure. Do you think that OT security will be a bigger opportunity than SD-WAN even?

Yes, I do believe like with the ramp-up of multi-device connected, especially leverage 5G. 5G will connect 10x more device and connect the people. So there's a lot of risk and also a lot of opportunity for us. And also OT is also very different than connect your people, computer or device into Internet. Most OT device has very limited computing power and also running more old, different OS. Probably the only way to secure this device by network security. End point has pretty much very small even though market play in that space, different than in the laptop or whatever mobile phone environment. So that's where network security is very, very important for the OT area. And considering how big the risk, how big is the market potential, how many devices being connected, that's a huge market going forward.

Got it. Keith, a question for you on the guidance. So the #1 question that we got after Fortinet's earnings calls is, what gives you comfort that they can exceed the guidance that they set in 2023? I mean all this talk about backlog drain, cancellation rates upticking. So what gives you comfort that you can exceed that outlook?

Yes. I kind of touched upon it. I think the math is very simple. Do you have the sales capacity, do you have the pipeline, are you assuming a sales productivity and a close rate that are appropriately cautious or conservative, the pipeline being higher than it was before. And maybe to kind of tie that back to one of your very early questions, Hamza, in terms of other customers or other companies talking about what their expectations are for growth rates in the industry. I suspect that's very true for their customer mix and their geography and the use case that they're solving. But as Ken alluded to, much broader footprint, lots of opportunity, SMB, lots of other use cases coming online. SD-WAN remains very strong. OT remains very strong. And I think we have some other growth areas as well. So I feel -- I think the guidance, if you will, was certainly very appropriate in light of what we are looking at in the macro environment, together with the data that was rolling up and suggesting that 2023 was starting off with a lot of opportunity for us to go execute against.

Fair enough. I think one last question just on -- I think recently you had an announcement with -- to build your technology on top of the AWS Graviton CPU. Just thinking around that, what's the opportunity there? How do you think about the growth and the margin opportunity?

We do support in this ARM-based CPU, even a lot of our own kind of ASIC also some kind of ARM based. So that's where -- if there's any new like a CPU computing platform come up, so we all supporting that one. And so we see -- they are more try to address a lot of cloud computing there. But in the cloud computing, which is about $200 -- $200 billion market, I think right now, it's low single digit for the secure cloud computing there. So we do see a unique of own ASIC is more addressed to secure, I mean, secure computing, which also can be easily applied into the cloud, not just in the appliance, which we also see the huge advantage going forward. And we are a good partner with AWS. We're supporting them. They're supporting us, so both on the new technology front. Yes.

Okay. Great. Well, with that, Ken, Keith, thanks so much for joining us, and thank you, everybody, for joining us today.