Fortinet, Inc. (FTNT) Earnings Call Transcript & Summary

All right. Good morning. We will go ahead and kick it off. I am delighted to have on stage with me, Ken Xie, Founder and CEO of Fortinet; and Christiane, CFO. Thank you so much for joining us, Day 4 of the Goldman Conference.

Yes. Thank you.

So Ken, there's been so much discussion this week around the next phase of CapEx build-outs for AI. And I remember back in 2015, 2016, we were talking about the cloud build-out with the data centers from hyperscalers and the role that network security would play in that. So I want to bring the conversation into today. When -- as investors, we hear about the CapEx build that's happening for AI today. How do you think about where network security fits when we hear about Oracle and Microsoft building out these big data centers, either for training or for inference?

Yes. I think for AI-related security business, we put in 3 different categories. We call the AI-Assist, which we have probably a dozen products right now using AI-Assist. This is the FortiManager, FortiAnalyzer, FortiSIEM/SOAR. So watch customer pay 20% to 25% more, they can get all the AI helping automate all this management tool we call the AI-Driven SecureOp, which is about 11% of our business last quarter grew like 35%. The other part we call the AI Protect is AI helping the secure operation, automate all this kind of signature, all these newer tech. And that's where -- we're doing that for actually 15 years now. And then there's also we call the AI-SecureAI. It's protect AI infrastructure like Oracle, all this kind of data center. So we do working with both like the AI company and also some of the infrastructure company try to protect the AI, whether from some kind of agentic AI or some kind of data leakage or some other part. That's also we see some good potential because we feel we have the technology. We build our own ASIC chip for security, which can have a much faster, better computing power than any other kind of software approach, will be perfect fit for some kind of data center for all this kind of AI infrastructure there. So that's what we're closely working with them. But also internally, we use a lot of AI for R&D, use a lot of AI handle supporting. So we're doing that for like almost 15 years. So we -- if you look at the pattern, we have more than AI patent than other cybersecurity company, like over 550 patents related to the AI. So that's where we feel AI is important and a lot of growth potential, but it's still in the early days.

To your point on early days, is there a nuance here between training and inference? And what I mean by that is, as we go from more training workloads for AI to inference workloads for AI, presumably, the security changes when you go to inference because there's more enterprise adoption or there's more user adoption. Maybe just talk to us a little bit about that dynamic.

Yes, there's -- I feel eventually -- because right now, AI company just burn so much money. I think eventually, certain applications that they need to benefit from that, right? And then that's where the security come in and try to see -- I have to say each application vertical could be -- have different security concern, security need. So that's -- I think right now, we just see the own kind of using AI where to handle the customer support and we feel if we do it well, can lower the supporting cost a lot, can also get into the consumer supporting the home user market. And that's where the application we feel fit our need quite well because we have technology, ASIC can develop the product into that market. But without AI to handle the supporting, we just cannot really go for that market. That's some part. Maybe Christiane also see a lot of AI related, maybe even some other company mentioned AI also helping lower the G&A finance costs.

So yes, one of the areas that, of course, I'm involved in is looking at AI for us internally in the finance function. And so I'm going through the same processes that our customers go through, right, what are the risks around AI and how do we secure AI. And so it's related that we are looking at the risks, what security do we need and what security products does Fortinet have or needs to establish over time to secure prompt injection, LLMs, what information goes out of your own network into AI engines, right, and how do we make sure that this is secure. So it's kind of very collaborative for me to figure out how can I adopt AI and benefit from AI but also how do I work with the infotech team and what is it our customers are asking us because they have the same concerns about security around AI that we need to figure out together.

And Ken, at a very fundamental level, Fortinet's IP has been weighted towards secure networking, the convergence of both security and networking for quite some time now. What about on the networking side? Are we at the point where there is enough step-up of traffic because of AI such that to switch access points, the actual networking infrastructure also needs to be upgraded in addition to the firewall infrastructure?

Yes, that's where a few -- the networking security was still the top market in the cybersecurity space. Not just AI generates so much traffic, but also you connect a lot of device OT/IoT, whether the robot or connect the car or the appliance from home or connect online. I have to say most of the OT/IoT device, majority of time or maybe even most of the time, the only way to secure it is using network security because that's very different than the traditional endpoint market, which secure your laptop, your phone, which has a pretty standard OS to easily develop endpoint software to protect that. But if you look at all the OT/IoT, all these small appliance, all this kind of robot, all these connect car, they all have quite a very different OS, sometimes very limited computing power to add any security software on it. So that's where the protection pretty much all have to come from network security. Thus I do believe network security will keep growing. We keep be the top in the whole cybersecurity space. And that's also not only we're keeping selling more product, but also we are start to build our own infrastructure, we call the FortiCloud. That's also eventually combine all this kind of a hybrid approach, where we keeping driving the company growth.

Yes. And maybe I'll stay on this idea of cloud for a moment. So you have the Lacework acquisition, and I think there's been an increase in investment in your cloud portfolio over the last 5 years or so. How do you feel about the quality of your virtual firewall product and your ability to protect north/south traffic in the cloud?

I think a lot of our virtual firewall is based on the same operation system, FortiOS. And the FortiOS has much more function integrated together compared to any other competitors. So now FortiOS can -- has about 30 functions integrated together, and about half of that 30 functions, we can use in FortiASIC to accelerate. That enable us to keep adding more function because if you look at the network security space, that's also the reason I started Fortinet 25 years ago because network security need a new function. 25 years ago, firewall network security pretty much as a firewall VPN and the intrusion prevention is a separate box. And then there's some application control has to do some software, and there's also like antivirus and endpoint software. So that's where whether you call next-gen firewall UTM, that we're starting to integrate more function into the same OS called next-gen firewall. Now that we're starting to see people need to concern what's the data leakage prevention, DLP, what's the CASB, what's the web, what that's called SASE. So that's where we feel we call the SASE firewall, is the SASE function need to built into the firewall. That's what keeping driving the network security growth. And that's where -- because most of the time, the attack all come from the networking side, right? So that's what protect the attack on networking side, using some kind of platform more efficient block no matter all the different application, all different approach. That's the most efficient way to do that. But that also need a lot of computing power, also need a real-time high-speed process all this data. So that's where the ASIC come in to help. At the same time, the single OS can kind of simplify the infrastructure, be more efficient. Otherwise, you have to have multiple bots line up, each provide different function there. So that's what we feel in the network security, keeping develop, integrate new function, keeping accelerated function and keeping make it easy to manage, deploy is more and more important. So that's the same trick we keeping doing for like 25 years.

Yes, absolutely. So let's talk about SASE in more detail. I want to better understand what's happening at the branch office because we have competitors like Zscaler, for example, that will say the displacement of firewalls at the branch office where you have a very strong position is actually accelerating. Now I think there is some nuance here in that not all branch offices are the same, and there are multiple ways that you can essentially protect your branch office. So maybe break it down for us, are you seeing pressure in branch office firewalls? To what extent can you cross-sell SASE into the branch office? Maybe just a little bit of a conversation on what's happening architecturally.

Yes. I think the branch and also some like retail vertical, if you can provide a solution, combine networking, combine security, combine all the other function together, and then they do need hardware to be deployed there, yes, you can for certain traffic into cloud process, but that's whether the latency, the cost will be much, much higher. And also, there's some kind of privacy data safety concern and also some service providers also want to offer their own kind of solving SASE, private SASE. First, I do agree, customers need some additional security function. The second point is really most current firewall vendor cannot provide all the additional security function like all the CRP, all the CASB, which SASE provides they have. So that's where the SASE market come up because they can add some additional function. But right now, they can only process in the cloud because they cannot integrate without other network security functions. So if you're using SD-WAN is a very good example, right? So we starting to integrate. And also if you look at the top 5 SD-WAN, we are the only one developed in-house, integrate with security. Within like a few years, we become the #1 player in the SD-WAN market because you don't need to separate SD-WAN with our own security single -- so it's the same thing for SASE. Once you have a SASE integrated with firewall with all other things, you don't have to get all the separate things also have to send the traffic remote process and send it back. So that's I see how network security market will keep evolving. So I don't feel SASE will replace network security, but all SASE will replace firewall, but firewall need to add a SASE function to keep it go to the next stage. So that's the way keeping happening in the network security have been there for like 30-plus years.

And Christiane, on this point on SASE being incremental to the firewall TAM, maybe you can share with us a little -- I know that SD-WAN is included in the firewall, it's not monetized separately. But talk to us a little bit about how your deal sizes change when you're able to upsell SASE and to the extent you're able to also upsell networking switches, access points, et cetera.

So I think that's the true benefit of Fortinet, that we have the ability to upsell into our customer base over time and capture more mind share and show the customers the benefit of the FortiOS. How do the deal sizes change? There's not one formula because every customer is different. Some have more LAN/WAN requirements, some have more SASE requirements. And as you know, our SASE journey just started about 2 years ago. Before that, we were more relying on service providers to roll out SASE, and then we decided to develop it ourselves. So we see good penetration, and we see good win rates in our RFPs. But the growth potential is massive because, as you know, we disclosed, we are about 13% penetrated in the large enterprise space. So there's a lot more in large enterprise as well as in the rest of the market where we are the network security provider.

So maybe let's talk through the COVID cohort in particular, to the extent you already have engagement with those customers that bought additional product from you in 2020, 2021. What we're trying to figure out is, is there an additional upgrade cycle happening with that COVID cohort because they're engaging with you across more of the portfolio? So maybe illustratively or if you have any specific customer examples, what are you seeing from some of those best customers, those best deals that were coming down the pipe in 2020? What do those deals look like in 2025? Maybe for both Christiane and Ken, whoever would like to address.

So in the -- I mean, the best insight we have is in the large enterprise segment, right? And so I think in 2020, 2021, customers were trying to upgrade and secure their networks because everything digitized, nobody was in the office. What we see now is that they are optimizing for more traffic for AI for new security risks that weren't even so prevalent 5 years ago. And so there's constant discussion around what can -- what new security risks exist and what firewalls do I need to cover these risks and how do I evolve my network architecture. So there's definitely with the newer firewalls that we have, the more security they can process a significant opportunity over the next couple of years to sell more updated, upgraded technology to our customers and then expand into other products.

And I know we spent a lot of time talking about the ebbs and flows to the end of support cycle in particular. We're now mostly through the third quarter. Anything that you can share with us -- as you look at the updated data, I know how closely you pay attention to the units in the maintenance support system. Any updated thoughts you can share with us on how that end of support cycle is tracking and whether it is moving the business as meaningfully as you would have liked?

So I think what we need to understand is that, that end of support cohort is one part of the upgrade, right? It's typically a technology refresh that we've seen. So we pointed that out because it was more obvious in our installed base, and we had declared a lot of devices end of sale 5 years ago during the supply chain shortage. So we are tracking well, but we only have true visibility into what customers are doing in the enterprise segment. In the lower end of the market, we can see it after kind of registration rates and so on, services attached to devices update, but it's not that we have the visibility through the opportunities because it's truly channel-driven. In the higher end of the market, where we are involved with our sales teams and have direct discussions with the customers, we know pretty well what they are doing.

Yes. And also first, this end of service very different than the normal refresh 5 years. If you compare that, that's much smaller, very small part to the tier end of it. And the second, not happen all the time. And for us, also a little bit difficult to track because we have a 2-tier, 3-tier model, go to distributors, system integrator, all these things there. And also, the third point is really not refresh or end of service, never a top growth driver. The top growth driver always what's the new function you provide, how to protect the new attack surface, right? And also how to address whether the speed, the more kind of still happening every like 18 months or 24 months, the speed will double, there's more connection, like whether internal secure AI data center, all this OT/IoT, connect cloud, that's all keeping driving that one. So that's where in the past, we never put this as a kind of a growth driver. And also when we gave the midterm guidance in Analyst Day in November, we say if you look at the 3 categories, secure networking, which grew about 8% CAGR in the next 5 years, will grow faster because we are the only one have an ASIC unique advantage in the secure networking side. Unified SASE grow probably like 20 -- probably 18%. We're keeping growing over 20%. That's also come SD-WAN. We have over $1 billion business come from unified SASE also grow. Even we only launched SASE probably like less than 2 years ago, but we are fast growing. And same thing for seecureO. So it's 11% of business come from there. Also last quarter grew like 33% or 35%, something like that. So that's the growth driver. That's what we gave our confidence in the midterm, we'll grow higher than the market growth. Market growth 12% for the next 5 years. We'll grow above that 12-plus percent. So that's the guidance. That's the confidence that we have because we look at each category, we are better keeping gaining market share in each category. But refresh probably confused some of the analysts, but which we never consider as kind of the top growth driver.

Yes. I have 2 follow-ups here. This is really good detail. So I really like this point that the end of support cohort is actually a small piece of the refresh, and you have a lot of engagement across your customer base that is more technology-led and innovative-led. The question then becomes what happens over the medium term? And I know it's too early to talk about 2027 guidance. But the concern that investors have is if they calculate what they think the end of support cohort is and they subtract it, it suggests that product revenue next year could actually be negative. So could you just give us your thoughts here? Is there a scenario where product revenue next year is negative?