Fortinet, Inc. (FTNT) Earnings Call Transcript & Summary

Okay. Well, hey, good afternoon, everyone. Welcome to day one of the Barclays Tech Conference. My name is Saket Kalia. I cover software here at Barclays. Honor to have the team with us here from Fortinet. We've got Michael Xie, Founder and Chief Technology Officer at Fortinet. We also have Peter Salkowski, SVP of Finance and Investor Relations. Just to frame this, we've got about 30 minutes together. Let's take the first 20 or 25 minutes to do some fireside chat with Michael and Peter, which I know is going to be fun and really educational. And then we'd love to make this interactive. If you have any questions, pop up your hand for the microphone in the back, we'd love to take any questions from the audience. And maybe with all of that as a framework, Michael, Peter, thank you so much. Peter, over to you.

One real quick. You will see the safe harbor statement, if you can throw that up on the screen, that would be great. I'd like to remind everyone that we may make forward-looking statements during today's fireside chat. You can read that there again. But these forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially from those projected in these statements. [indiscernible] Risk Factors in our most recent Form 10-Q and other reports that we file with the SEC for additional information on factors that may cause actual results to differ materially from those of our current expectations. All forward-looking statements reflect our opinions only as of the date of this presentation, and we take no obligation and specifically disclaim any obligation to update forward-looking statements [indiscernible].

Michael, maybe let's start with you. First of all, thanks so much for being with us here today. Really appreciate you taking the time.

So Fortinet announced a new segment breakdown on your last earnings call. As you were sort of thinking about the business now, I think, in 3 areas, right? So they are secure networking, secure operations and I think universal SASE, those are kind of the 3 new segments. And I'd love to dive into those segments a little bit later from a product perspective. But I want to start a little bit more broadly. Maybe you can just talk about why Fortinet decided to make this strategy change now. You and Ken have been through the ups and downs of hardware cycles before. Why is now the right time to maybe accelerate your business shift to SASE and Secure Operations. Does that make sense?

Yes. Well, thanks for having me. And so I think from the longer period of time, we see that SASE as just a natural evolution of the cybersecurity strategy. We have been working in this area, made the acquisitions actually a couple of years -- since a couple of years ago. And so we obviously need to build the foundations. And the way that we see it is we're not really shifting away from our firewall business, but we see that SASE is more like a natural addition of that business. And underneath, the technology is the same, FortiOS. Rather than running on prem, the SASE allows us to run it on the cloud. I think there are a couple of drivers for us to call it out and make it one of the focuses. One is the -- in order for something to offer an effective SASE, we need to build up our global presence, or [indiscernible] POPs, the point of presence. We've been doing that for almost 2 years. We have about 30 or so POPs that we built. But I think a lot of competitors always supposed to have 100, 200 POPs. And we announced a partnership with Google, which they allow us to use their global premium networking, which adds about 180 POPs to our SASE offering almost instantly. So I think one of the reasons we were able to really start to strengthening our [indiscernible] SASE is because that expansion, global expansion [indiscernible].

That really makes sense. Peter, maybe just to level set us from a financial perspective, we all saw the numbers. But I think it's important for us to just sort of have a good understanding of the path that you've sort of articulated from here. Can you just maybe remind us of some of the expectations that you laid out for fiscal '24 in your last earnings call?

Yes. I mean we're not guiding to '24 yet. So obviously, just giving some sort of indications of where we think -- because people were concerned about what the future looks like always. I think from a billings perspective, what we said for 2024 was that we would expect the billings growth to return to double digits by the back half of next year. I think what's important in that is that's a change in the guidance that we had given in the second quarter earnings call. In the second quarter earnings call, we had said that billings growth could return to double -- mid- to high teens by the fourth quarter. Obviously, we pulled it back a little bit with how the third quarter -- or worked out and things like that. I think the question I get a lot following that up is, well, what gives you comfort to getting to double digits by the back half of next year? First of all, we'll be on an apples-to-apples comparison basis by the time we get to the fourth quarter. But what I mean by that is we won't have the backlog contributions that we had in the first half or first 3 quarters of 2023 to compare against when we get to the fourth quarter, right? It will be apples-to-apples in terms of that comparison. I think also we'll be further along in the SASE SecOps journey, which I think will benefit us by the time we get to the back half of next year, a little bit at least. And then I think just the conditions of the market, I think, will be better. I think right now, we're kind of going through a weaker macro, a bit of concerns there with regards to interest rates and all that kind of stuff. Although apparently a couple weeks ago interest rates were off the table. Everything is fine again. So I think that's kind of what we guided to. I think there's 3 -- We still have some analysts that are at much higher billings growth in the back half of the year. Last year, it's that they didn't listen to the last earnings call, they're still stuck on the prior guidance that we gave. And I think the Street needs to look at service revenue a little bit. We've seen a deceleration in the business this year. Service revenue is a backward-looking number.

That's right.

And so you need to look at service billings, which is more forward-looking and deferred revenue and the change in short-term deferred and look at your revenue there in terms of what that might translate to.

Got it. Super helpful, Peter, and I want to dig into some of those things later on. But Michael, I want to come back to you, and I'd love to dig into some -- into the 3 segments just a bit deeper. And I wanted to start with secure networking, right, which really makes up the largest portion of the business. I think it's 60% or 70%, you accept 70%, right? Can we just walk through -- again, you and Ken have been through multiple hardware cycles before. Can we just talk through some of the dynamics that are leading to that slower growth for firewall appliances right now? And again, because you've been through so many cycles in the past, how do you sort of compare this cycle to some of the prior cycles that you've seen? Does that make sense? Start us out there.

Yes, it makes perfect sense, right. So I think the -- there's obviously a cycle for any business and particularly in our hardware business. It's been sort of every few years it's accelerated and then slower, accelerate again, it's slower. This recent cycle is a little bit special because of the COVID and the supply chain issues. I think it's last year, there was a time where as long as we could ship, the customer would buy no matter what. And then -- so -- but now they would put in an order and want to wait for a longer period of time and then, when it's available, we can ship. So we have hundreds of millions of backlog. I forgot the number, but Peter should have this. Basically it piled up for a few quarters. Now, obviously, we're coming down to the end of that. So essentially, that backlog would be close to like very minimal to the normal level. So essentially, the growth -- because that backlog -- sitting in the backlog, that number will be added to our normal growth number. So making that a cycle much steeper and bigger than what you used to see. So I think that's one way. And I think the other thing is these cycles also have to do with, number one, is macro economy, interest rates and what-have-you, basically the customer's spending habits, and also how the technology evolves and then the customer would be basically -- when they're looking at different offerings, they would say, should I wait until something better appears or I need to buy something now. So these factors combined basically generate these cycles in our industry.

Yes, absolutely. Peter...

I have something to add to that. I think we're a victim of our own success, I think it's one way to look at it. I know people want to look at the future and say, "Oh, they guided at an implied 9% product revenue growth for 2023," but they have to remember, we had 40% -- 42% product revenue growth in 2022. So if you look at the overall health of the company, I'll take that 42%, right? Because that means I got it, and I'm growing and I'm continuing to grow off of that. So to Michael's point, there was a couple of years of abnormal growth that probably occurred because of the supply chain, and our ability to really manage our own inventory, which I think benefited us. If you go back to 2021 and it's kind of when the supply chain started to hit industries and people started talking about supply chain, Fortinet was probably 6 to 9 months lagged in terms of that impact because we had inventory and we were managing our own inventory. And so that benefited us, great for us, but we are going to have to cycle through that. Now what's important, though, is product revenue growth started to slow at fourth quarter to first quarter of last year. You don't see it as much in the fourth quarter last year and the first quarter of this year because of backlog coming down and contributing to product revenue growth. But we're already 3 or 4 quarters -- my point is we're already 3 or 4 quarters into the cycle in terms of that deceleration. And if you look at prior cycles, it was 2009, 2013 and 2017 were the bottoms. It was up 2, down 2, up 2, down 2, up 2, down 2. So don't know what this one is going to be...

Up 2 years, down 2 years?

Up 2 years and down 2 years. Sorry. 2 years up, 2 years down, right? '09 to '11, '11 to '13.

So arguably, we're almost halfway through, right, depending on however long the cycle is.

And the question is going to be how much is the backlog contribution in this whole supply chain thing. Does that skew the other thing or do we return in a sort of normal cycle? And I...

So I think I would add, it's typically, in these cycles, when the business is growing at 30%, 40% year-over-year, you tend to basically keep the current process, that always works, and hire anybody that -- who looks like competent. And then when you grow to a certain extent, you will see that, okay, actually, some of the business processes, they don't scale up to this level, you need to actually take it apart and put in some new mechanism, make it more efficient. And the people that you hired maybe not 100% of them are obviously the people that you actually want, and you actually digest this growth, and then basically get some better people, to get more consolidated business people and processes. So I think we sort of, over the past couple decades have been going through these cycles to expand and then digest, expand and digest, it's mapped to a up 2 and down 2 type of cycle.

Yes, absolutely. Peter, maybe just to put a bow on sort of the firewall question, right? Like once we sort of pass this period of difficult compares to what I'll just air quote a normal environment, what do you think the market growth rate in firewall will sort of settle into over the next few years? And how do you think Fortinet growth will compare to that?

First of all, looking forward to a normal environment, whatever that is. God, I hope there's no more [indiscernible] events in the next 3 years. Yes. I think if you look at our network security business and the TAMs that we provided on the earnings call, and the growth rates that we provided of that, we think it's a high single-digit growth business for the industry. We think for Fortinet, we can return to double-digit growth. I mean, Ken will talk 10% to 20%, I don't know where we fall in that range at this point. But if you look at the 14 years that we've been a publicly traded company, one of the slides that we've included in the earnings deck was to show that, over that 14 years, our product revenue growth and our service revenue growth have CAGRed out to be 24% a year for the last 14 years, right? And so...

Largely organic, right?

Exactly, largely organic. There's not a lot of acquisitions in there. And only recently have there been price increases. And so I think we feel comfortable. There's also a part of that, we've talked about this more recently, part of that cycle or part of that growth in the network security business is we think we have a differentiated and superior product from an ASIC perspective, certainly from the hardware. It's really the operating system. We can get into that in a minute. But it's -- we can't take market share from companies who aren't replacing their own products, right? For us to go in and replace one of our competitors' firewalls, they have to -- the customer has to be wanting to take that out in the first place, right? And we're in a cycle right now where people are saying, I'm going to sweat my assets, I got high interest rates, interest rates have increased. We're back to 2009 in terms of interest rates, and we got there in less than a year. People are, I think, a little bit of shellshocked on that. So when we get back to that sort of happen again, and we do believe it's going to happen, then you have an opportunity to grow faster than the market because you can start taking market share.

At least more flex there.

But you also have to realize, I mean, we've doubled our -- our product revenue growth has probably doubled in the last 3 years. We're the largest company in the network security space in terms of product, than any other players. And it makes sense because we also have a very unique and differentiated solution.

Absolutely, absolutely. Michael, I want to shift gears and maybe talk about your SASE solution. And we touched on this earlier in your earlier response, but I want to talk a little bit about sort of the network POP coverage, right? Because I know it's important for your customers. So maybe you can just recap again sort of your strategy around coverage with the points of presence, right, or POPs? And how you're working with service providers sort of building your own POPs in sort of data centers? That sort of makes sense? How do you think about the coverage model overall, maybe is the question.

Absolutely. Yes. So we have basically 3 basic strategies of coverage. Number one is we have started building and we'll continue to build our own backbone. So we -- before the Google deal was announced, we had about like 30 -- and then we have about, I think, 35-ish POPs in operation now, and that will continue to expand. So these POPs, number one, allow us to basically run things at lower cost, because we own a lot of the structures and equipment. Number two is that we can basically build these on the different strategic locations. We can choose which locations that make sense for us that have the best return. And number three is that we can actually run our ASIC-based hardware, which further give us a cost advantage in performance. The second strategy on the presence is we collaborate with these large hyperscalers like Google. Yes, maybe there will be more coming down the road, which essentially they build these premium networking locations that offered as our POPs. So we run the FortiOS, usually like a VM, the virtualized or like container software, in these POPs. Now the benefit is like they have -- usually have very good global coverage. Their backend is very solid. The one disadvantage usually is the cost, because we cannot run our hardware in those POPs, like we have to rely on their entire stack, the virtual machine, the same public cloud limitations. But I think they will be a big part of our strategy because of the presence, even if it's at somewhat higher cost. And the third strategy for us is basically we do -- we have a really good relation with a lot of the carriers, service providers, internationally. So we offer a co-build functionality, allow these carriers to run SASE on their own networks, using our technology. So it wouldn't be like our POPs anymore, it will be their POPs. But our technology enables them to -- who owns those data centers could be a SASE provider.

Right, right. Interesting. Peter, maybe just on that point, can you just remind me what we said about the size of Fortinet SASE business currently and sort of how you thought about the estimated market growth rate? And actually, let's just start there. Yes.

Sure. I think SASE by -- defined in terms of what we talked about in third quarter earnings call, is about 20% of our business. I think what's important in that number is, if you look at what's listed underneath SASE, the first thing listed is probably SD-WAN, right? And up until really this point, although we've been talking about SASE most of this year, up -- and building out our own points of presence along that process, up until this third quarter, we were talking about SD-WAN as a percentage of billings, or we started combining it with OT and saying SD-WAN and OT combined, were 25% of billings. The last time we gave a number for SD-WAN was probably a year, maybe 18 months ago, and it was 15% of our billings at that point. So when you look at that 20%, most of that 20% is SD-WAN, right? And that's just being honest about what we were selling over the last several years in terms of our growth in SD-WAN. We have a SKU called FortiSASE that we're selling that combines or puts together all of the SASE solutions. The SSE side -- or the [indiscernible] services side of it. But that's a small part of the business today. We've done some things this year that got us to a point where talking about SASE made more sense. And Michael's talked about the Google cloud relationship. I would say that the Gartner Magic Quadrant for single vendor SASE that came out in August, putting Fortinet as a challenger in that Magic Quadrant from a -- for a company that hasn't talked about SASE for the last 5 years, to have the position that we have in that Magic Quadrant and be 1 of only 8 companies that are qualified as a single vendor SASE company says something about our solution and our ability on a going forward basis. And so -- and then also coming out with our SP5 chip earlier this year, starting to build it into our firewall capabilities, because that chip has 14 functions that are built into it that can speed the process up. The prior chip, the SSE 4 only had 7 functions. Some of those functions that are in that SP5 chip are SASE related, SD-WANs built into the chip, some of the Zero Trust capabilities built into the chip level. So we can accelerate the capabilities. I think what's really important on the SASE side, is we've talked about it as universal SASE. And I think that differentiation relative to our competitors is very important. Depending on the customer and their need or want, we can do SASE and the SASE capabilities in their data center, right? We don't have to take it off premise. We don't need -- taking it off-premise and really putting it in the cloud is really borrowing the cloud structures compute power, because the company doesn't have the compute power on-premise. That's not Fortinet's problem. We have the compute power on-premise. If you want to keep it on-premise, we can do it on-premise. If you want to do it in the cloud, yes, we can do it in the cloud. We just need to build out some infrastructure to be able to have our own infrastructure. But we can give you that same operating system on-prem and in the cloud wherever you need it. So if you look at our latest marketing brochure, it comes back to the terminology of Fortinet Everywhere. And we've been talking about being at all edges for a long time. It's really just moving that compute power to the cloud if that's where they want it, or we can do it in the data center. So I think to your -- to answer your question, Fortinet -- FortiSASE today is a very small part of our business. Keith talked on the earnings call about having a couple of hundred SASE customers today, with no marketing behind it, with no Google Cloud relationship, without the Gartner Magic Quadrant. We had adventurous or entrepreneurial sales people who went out and sold FortiSASE. We have tens of thousands of SD-WAN customers that we can upsell to SASE, and that will be our initial focus on a going forward basis.

Yes absolutely. Maybe just to bring some of the stuff home, and maybe it's a question that both of you can tag team. But as we've sort of rethought the segmentation of the business, how do go-to-market strategy changes, kind of play into this as well? And maybe as part of that, obviously, Patrice, right, the very long-standing Chief Revenue Officer, I think announcement that he's going to retire. Maybe we could touch on that as well.

I can maybe provide some comments on the technology side. Go-to market for SASE, which is basically a cloud offered -- operated security versus the primarily on-prem or VM-based firewall FortiOS, there definitely is some differences. The sales force between how to basically sell these, present these to POCs and basically answer RFPs. Now, however, if you look at us versus some of the major competitors, our SASE is built upon the same FortiOS that we've been selling for like 20 years. A lot of our sales team are super familiar with that. So it's actually a smaller challenge for us than for a lot of the other companies. And we're in that journey. We -- I think last number I saw was 97 of the sales people have been trained and certified on SASE. So it's a relatively quick process for us. But obviously, we're always -- when you're growing from a small number to a big number, it's going to take time. So I think we're in that process now.

To clarify, 97% of the salespeople, not 97 people. It's a broad number.

97%, yes.

97% of the sales people have been trained on SASE.

That's quick, huh. 97%? Wow.

Well, we've been doing it for a while. On the Patrice one, Patrice has been with the company almost 20 years. Came in -- used to be a distributor, owned his own company, as a reseller, and so was a Fortinet reseller and then became -- grew through the company in terms of he used to run France, and now, you know. I think it was in 2015, he became Head of Sales U.S. -- or Global Sales. I think if you go back to 2015, we were $740 million of revenue. I think our guidance for this quarter at the midpoint is $5.3 billion. So I think he's done just fine for us. Ken will say that he's been trying to talk to Patrice out of retiring for several years now. You kind of knew it was getting closer when Patrice started working on his golf game. So this isn't really that big of a surprise. And it's something that he told us, we've announced it. But we're not looking until probably sometime in next year. I think the 8K said middle of 2024.

Yes.

The follow-up question, which is a fair question, is what are we going to do about it? Patrice is going to certainly work with us. We have a fairly large, very strong bench of people who have been with the company for a long time in sales. I think the -- Patrice was based in Europe and our European sales force is very strong and does a great job. Not that our U.S. sales force isn't doing a great job, but I think it's -- I think we'll look at a model that we've had before where we had a head of sales in the U.S -- or Americas, Canada, U.S. and Latin America, and then a head of sales running Asia Pac and EMEA, to give more of that -- not just to give it more close in terms of where the head of sales people are, but they're different markets, sure, right? And we're the #1 -- if we're not #1, we're #2 in most European countries. And we're 70% of our revenues outside of the United States, right? And so when you start looking at that, it's a different sales motion in a lot of the EMEA countries. We go through our channel. They work very well with us. We're very well-versed in doing that. Whereas in the U.S., it's a much more direct sales kind of motion. You got to build those -- even if it's through the channel, you still got to build those relationships. Ken's not here because he's in the Midwest right now meeting with a customer, right? Keith's not here because he's at the same meeting. You have to have that relationship and build those relationships, a different sort of way of doing it. And I think having someone geographically closer to those, I think, will be what we'll look at.

That makes sense. That makes a lot of sense. We've got about 5 minutes left before I maybe shift to some margin questions. Any questions here from the audience?

Thank God, margin question.

Maybe we'll get right into it from a margin perspective. And again, maybe a question that both of you can tag team. But just maybe on margins more broadly, Ken and Keith, I think, reiterated sort of their 25%-plus margin target for fiscal '24 on the last call. But Fortinet's been sustaining. I mean, 26%, 27% margins here over the last few years. And you guys, correct me there if I'm wrong. So maybe the question is, how is the team sort of thinking about this balance of growth and profitability now that we're starting to see growth maybe a little bit more normal?

I think as a company, Fortinet's been always very disciplined in spending. We don't have huge acquisitions, and then we obviously look at the valuation of the acquisitions very carefully. And so I think in the past, I think one of the challenges is forecasting our margin, because when you do that and when the sales knock it out of the park, and we've consistently been doing that, then you've got a better margin then, because we don't want to just spend it in the last day of the quarter just to make the margin lower. So now I'd say moving forward, if the forecast is accurate, which we think will be, and then I think we'll be able to manage the margin and hit the targets. And if they can deliver that, they can hit it again out of the park again quarter-over-quarter, and then I think we're probably going to see higher margins in the future too.

I think the other side of that is Ken has always been wanting to grow the business, right? And you've seen it a few times in the history of Fortinet. The one to go back to is kind of probably 2013, '14, '15 time range, very strong growth. But the margins went from 25% to 12%, right? Since 2017 was the first time that they had a 25% target, which back then the margins were in the mid-teens. They said 25% by 2022. I've been here since 2018. We've said 25% for the last 5, almost 6 years now that I've been here. Yes, we reached 25% early, right, before even 2022, I think because of COVID, we actually got there in 2021. And we've capped that as a floor now as sort of the margin. Like we're just basically telling people, look, we can grow the business, we'll guarantee a floor of 25% on an annual basis, not on a quarterly basis because first quarters can always be wacky. But on an annual basis, we can keep that as a floor. But we want the flexibility to grow the business and be able to invest in sales and marketing and R&D to grow the business on a going-forward basis. So that's where Ken gets comfortable to say, I'm going to give you 25%. If you go back to 2022, margin benefited a couple of hundred basis points just from FX, right? Because we price everything in dollars, dollar was really strong. We pay 70% of our people in local currencies because they're outside of the United States. So we got a couple of hundred basis points of benefit from that, so we did 27% that year. If you look at this year, I think our guidance is around 27%, again, somewhere in that range for the full year. You're seeing the benefit of the model, right? In last year, when product revenue growth was growing 42%, services revenue declined from 65% of my revenue a couple of years ago to about 60% of my revenue. Well, now with services growing faster than products, I'm going back to more services, I'm getting the benefit of an 85% gross margin on services, that's dropping to my operating margin line. So depending on how that plays out in the future, right, there's a little bit of variability that's going to be there. I don't know what the dollar is going to do next year. I had heard it was going to get weaker, but now I'm not sure because interest rates are coming down next year. I don't know what the hell is going on. So we'll see, but the point is we'll guide it to at least managing at 25%. I'm in charge of building the model for next year right now. I will tell you that we're above 25% in terms of the internal look. But now the question is, going back to Ken and Michael and others, is what do we need to spend on? What do we need to focus on? What are our spending categories? And how -- where do we stay within that 25%.

Got it. Got it. Well, guys, we've got about 30 seconds left, maybe just the last question, an open ended, right? I ask you this on callbacks. Is there anything that we didn't ask that we should have? Is there any last message that you want to get across as we leave these folks and wrap up the session here?

I think just the Fortinet business continues to be an innovation-driven company. And we have a lot of strength in technology and we'll continue to invest. And I think we feel confident about the technology in a lot of markets. I think the long-term outlook for us looks good.

Couldn't think of a better way to end it. Michael, Peter, thank you so much for the time. Appreciate it.

Appreciate it.