Fortinet, Inc. (FTNT) Earnings Call Transcript & Summary

All right. Welcome, everybody. Delighted to have you guys here. For disclosures, please see the Morgan Stanley research website at morganstanley.com/researchdisclosures. If you have any questions, reach out to your sales representative. I'm Meta Marshall. I cover the cybersecurity space here at Morgan Stanley. Delighted to have Fortinet here with us today. Ken Xie, CEO, Founder, Fortinet; and Christiane Ohlgart, CFO.

So maybe I want to start with, Ken, you've -- Fortinet has long been referring to this convergence of networking and security. Now as the Fortinet story evolves, we're seeing kind of this consolidation of multiple security solutions. like SASE, SecOps and more. Just walk us through the evolution of Fortinet and the prevalence of kind of this combination of networking and security and just how that gives you the legs for kind of a broader platform going forward?

Yes, great question. Also, thank you, Morgan Stanley, for hosting us again. Since Morgan Stanley lead our IPO 17 years ago, been here pretty much every year, the same. Yes, I think the convergence is where is the founding vision we have. So we do believe network and network security will be converged together to give you better visibility, better control for the traffic, whether inside the company or in the cloud. And also this year is the first year, the network security market, total addressable market will be larger than the networking market. And also with a lot of new things come up every year in cybersecurity, like SASE, like all the AI now, we also see convergence starting to get more and more important. And like the SASE is a function, just like in the past, there's like a company had a lot of individual function like FireEye for sandboxing, like before that one, like Intra for intrusion prevention. You can see in the network security space, a lot of time, the platform vendor gradually will integrate the single function into their platform and then making -- then have a much better position compared to the single function device, right? And that's where -- for the FortiOS, which were announced the FortiOS 8.0 next week in Las Vegas, we now have about 30 functional, including all the networking function and all the network security function, including SASE, SD-WAN and half the function starting using ASIC to accelerate. So we're using the same process, the same trick in the last 26 years in the company, keeping integrate more function and using ASIC to offload this function to the ASIC chip to get a better performance and also lower the cost. So that's the same process and that also addresses the converged market. So I think the market kind of grow maybe 7%, 8%. We do believe we're keeping increased market share. I think last quarter, 62% of business come from what we call secure networking, and then 27% come from the unified SASE. But unified SASE grew faster. We grew like 40% unified SASE last quarter. Definitely, we see the trend, customers a little bit more move to add additional security function like a SASE function. And that's also not just this cloud SaaS-based SASE function, but also we see a lot of -- we call the sovereign SASE, which a lot of service providers, they buy the product offer their own SASE service. We feel that market probably double, triple compared to the cloud SaaS-based SASE. And there are also a lot of other areas like OT also need all this kind of converged network, network security together to secure the OT device because a lot of like IoT, OT device have a difficult to install the agent. So that's where the only solution for them protection come from the network is. That's where the convergence is also helping. We see that grow also very fast. Last quarter grew 25%. Maybe anything you want to add?

I think we're good. I mean the -- I guess the question, between this networking and security, the ASIC has long been kind of part of your differentiation. As you move into more of these software-based categories, like how can you bring the success you've had in that convergence based around the ASIC to kind of some of these other software-based categories?

Actually, the new function always handled by software. The ASIC just add additional computing power to process the software function much more efficient. That's where the ASIC always come like 3 to 5 years after the software function being delivered [indiscernible] that we have the same process in the last 26 years, now the AI already in the eighth or ninth generation now, right? So that's where it's the same process, accelerate the software and increase the computing power by 5 to 10x. That's every product -- every quarter, we do release like a new FortiGate product every quarter. And we do compare with the same function for the same cost in the industry, all the other competitors. So in pretty much every function, we have 5 to 10x better performance for the same cost or the same function. That's compound benefit of ASIC, not just the security, but also networking side like SD-WAN, right? So it's the same trick. But ASIC, the only issue like ASIC, you do need to invest minimum 5 to 10 years to see the benefit. And also the economy of scale also very important because there's a big cost, initial investment cost, but also the unit per chip also depends on the quantity. So now we already have almost 60% of the unit shipment for the industry. So we do see the benefit of our economy scale now because we already have more than half the market share. That's the ASIC that will benefit the company. That's where we probably have the highest GAAP margin in the whole industry and also the [ Rule of 45 ] growth, we feel pretty comfortable for the next 5 to 10 years for the...

Okay. Got it. We'll circle up on those margins in a second. So as GenAI adoption drives more traffic and growth, just how are you seeing it kind of -- there's a lot of theories about how AI impacts the software. But how are you actually seeing it impact kind of the firewall network security demand? And just -- maybe just start with that piece of the question.

Yes. I think there's a lot of AI will change quite some SaaS or some software, something maybe AI may need the software. But what we see is really, especially a lot of the new GenAI, the AI agent, they do a lot of machine-to-machine talking. So when you look at where the AI agent is, where the traffic they generate, we found it more like east-west traffic, whether within the data center, within enterprise between departments, several of these things there. So that's actually making the traditional networking device have difficult time to control and manage all the genic traffic. So you do need to have a convergence story to deploy internal for the internal segmentation and also how to secure the AI data center, the East traffic, that's become more and more important. That actually drives some of our additional growth because some enterprise, they see, hey, how I can manage all this AI to kind of have all the API of my server, how to manage all this kind of the machine-to-machine traffic. So that we see a lot of protection have to go to the server level, have to go through all these things to really deal with all the kind of agent traffic.

Okay. Yes. I mean, certainly, we're seeing kind of the difference in the traffic flows from the bursty traffic in the past to kind of the steady flows that should be a catalyst for you guys. Maybe coming out of earnings, another kind of topical piece was around memory costs. You guys mentioned that you've raised prices kind of 5% to 20% based on kind of the particular product. Can you just walk through kind of how memory is impacting you guys so far and how you see it kind of playing throughout the year?

Yes. I mean I think there are 2 components, right? One is availability and one is price. We are actively sourcing with multiple providers. We are qualifying new components to make sure we have the availability, and we have pretty good supply chain relationships because we do direct sourcing. We are not just reliant on our contract manufacturers. And so of course, there are some price increases, but we are aiming to manage our margins accordingly. And also, we have significant inventory always. So we can buffer some short-term disruption, yes.

And then how did -- I mean, so you weren't in the same seat, but just how does the experience that you guys had during COVID and supply chain challenges kind of inform either changes that you're making to pricing or how you get visibility into what the impact of those price changes will be?

We want to -- like first, like we maintain 6 months inventory, just prepare for this one. That's where during the last supply chain issue 5 years ago, we actually like grow like a 2 to 3x gained more market share than any other competitor because we prepare this one. We also manage all these key component supply directly. We have own kind of manufacture center, shipping center globally, 3 biggest shipments, one in U.S., one in Europe, Netherlands, one in like Asia, Taiwan. So that's where -- because we maintain more inventory, we have a managed direct manufacturer, we feel we respond this much quicker. And also the buffer we have for the inventory also can very easily. So we see this as an opportunity to gain market share because some of our competitors only have like a couple of weeks inventory, right? So they call it intense supply, good or bad. But in this time, they are probably more in trouble. That's where some customers, they need this one, we are probably the only one can keep shipping. That's where we use this as a gaining market share. On the other side, for the margin, like we said, we maintain healthy margin. So whenever we see the margin kind of impact that the price increase of memory, if we use up the buffer, then we also increase the price. But it's -- and once the price drop, whether the memory or the operation shipping costs drop, we also lower the price. So that's where we feel -- so far, we feel we are probably the highest GAAP margin in the cybersecurity industry, right? So that's where we kind of Rule of 45 still pretty.

I think those margins are pretty uncontested. But yes. All right. So maybe turning to kind of the product revenue growth and refresh cycle. You previously referenced 10% to 15% product hardware growth over the medium, long term. Can you just walk through kind of how you see those -- the horizon for kind of that product outlook? And if any of that's kind of based on any upgrade cycles kind of coming up?

Will definitely accelerate the product revenue growth. If you look at the year 2021, I think product revenue growth almost 30%, '22 grew like 37%. And then it dropped down in '24, right? So '23 also 27%. But in the last 5 years, still CAGR over 20%, I believe 24%, 25%. But I believe in the last 20-some years, the product revenue should grow between 10% to 20% in a normal year. Just last year, we grew like 16%, I believe, the product revenue. So that's more normal. But with this supply chain issue, they can accelerate and then they sometimes maybe have to digest, but we're not changing the total average like 10% to 15%. The other thing, we do see a lot of opportunity in the OT security and also the software SASE initial deploy more in the hardware product side for a lot of service provider that also help in the product revenue side.

Okay. We talked about AI security or AI driving network security traffic. But let's just talk about kind of the AI security opportunity separately. You guys have talked about that spanning kind of 3 separate vectors, AI data center, securing AI applications and AI-enabled solutions that help automate security. Just which do you think kind of represents the largest near-term and long-term opportunities for you guys?

The near term probably more come from the AI-driven security operations, which we have more than 20 products in that category. That category, we have about 40 products, but more than half now is AI-enabled. You can see last year, probably close to 30% growth. It's kind of about 11% of the total business still growing like 20%, 30%. And then on the AI secure AI data center, that's the other part. We see with the AI data center keeping building up because we have ASIC performance advantage. We secure a few biggest AI company worldwide and also helping build the data center with security, all the generative AI also increased a lot of traffic in the data center and enterprise. So we see that also kind of what drive the next few years' growth. And the new ASIC come up this year will also help, right? So that's where we -- and the long term, we also internally feel Fortinet probably is the most AI-enabled AI investor company than security company. We have probably more AI patent than any other company. And we also like probably half -- more than half the supporting customers are probably already using AI to handle that one. But R&D, we have a lot of R&D engineer technology coding using AI. We are also the only cybersecurity company invest our own kind of AI data center GPU farm. So we spend billions of dollars investing in all this infrastructure. That also will benefit both the short term and long term of internal also the customer. We have own kind of model. That's what we feel. We're still kind of more engineer-driven company, but we also kind of try to hire more like a younger AI engineer, not like me. So that's also keeping changing in the next few years, but I do believe AI will change in the space quite a lot.

Okay. And so when do you think that we can start to see some of that meaningful revenue hit?

We already see the benefit like the cost saving, whether in the customer support and some G&A, we use kind of AI replacing some of the GMV function. And I think -- like I said, the secure AI operation will be more benefit short term, right? So the data center AI probably we will still take a little bit more time because they tend to a bit long time to evaluate.

As they need to build them out, right? I think while we've seen already some traction in Q4 on some data center providers, it's going to take longer until they put the firewalls and security perimeter in place. So it's a longer-term tailwind for us for sure.

Definitely. Okay. Maybe circling back on the OT security piece. We had written a large report about this opportunity being a big market. You mentioned that you're seeing very strong growth there with kind of billings up more than 25% year-over-year. Just can you kind of speak to just how you see that opportunity and the competitive dynamics that are kind of benefiting you over the next couple of years?

Yes, definitely, OT security, I feel is quite important. Basically, there's not many firms studied OTM definitely one of the leading firms who studied that one. The other one we're using is Westland. So in the last 3 years, we are the only market leader in OT security there. But I do believe OT is starting to get more and more important [ OT/IoT ] security and also including edge computing or other like a robot or the things they connect the car. So that's where we feel it's a little bit different market than the traditional network security market, but we've been investing like in the last 10, 15 years. I do believe that market will be probably keeping growing faster than the average network security market will be a huge opportunity.

Got it. You've had 40% unified SASE billings growth in Q4. This has clearly been an area of more focus for you guys. Just how have some of the go-to-market adjustments you guys have made led to some of the growth that you've seen on the SASE side beyond just kind of products that you always have?

Yes. I feel we have 3 key differentiation than the other SASE player. First, we have a single OS, including the network security, SD-WAN, SASE together. We call the 3 into 1, right? So that's where that leverage of a huge installation base of we're the #1 firewall, #1 SD-WAN, they can more easy to migrate to the SASE. That's where over 97% of customers come from the current customer already using firewall SD-WAN. Second one, we are probably the only SASE company build their own global data center PO infrastructure, give us 1/3 cost compared to other SASE player. Whether they're using cloud or using colo, we have much lower cost. We have a long term -- we already invest $1 billion in the last 15, 20 years in all this infrastructure, not just for SASE, but other like e-mail security, secure log storage for the customers. We leverage that one as much lower 1/3 cost. The third one, also we feel we have a much bigger total addressable market than the cloud SaaS space, like sovereign SASE. It could be my mistake, like in the first few years, I only more focused on sovereign SASE. We did not launch our own kind of cloud [ SaaS, SASE ] only launched about 2, 3 years ago, right? But once we launch, we see very strong growth. But we also believe there's other part of the market, probably same or even bigger than the cloud SaaS, SASE. Sovereign SASE is a private SASE basically deploy SASE inside the company or inside whatever data center or inside the kind of service provider. So process traffic locally initially would more drive the product sales because we have the same OS and using AS to accelerate a lot of SASE function. So that's what drive the product revenue growth first. Eventually, the service revenue will follow. So that's a bigger total addressable market, 1/3 of cost and also like a 3 functions in the same OS, helping upsell, cross-sell quickly. So that's, I believe, will be the #1 SASE player in the next few years, just like firewall SD-WAN because of these 3 key differentiation.

I mean I think you asked how we changed our go-to-market, right? And I think the go-to-market needed to address these benefits of our 4D SASE solution directly with the customers. So what we did a little bit more is really make sure that we reach the end customer versus just relying on channel partners who have sold already other SASE solutions. So we needed to bring our customers on board about the benefits and especially the financial benefits they have, operational benefits they have from our SASE to consider the next steps, whether in an RFP to invite us or even look at displacements.

I mean there are certain SASE vendors who might have been here yesterday who like to talk about kind of SASE eventually leading to eliminating the firewall. I think this has been something that you guys have long said this is kind of the mark in some areas. Can you just kind of give a sense of where you think customers are just in terms of what SASE means to them and the presence of the -- continued presence of the firewall?

I think the firewall, just like in early days, just a firewall VPN, there's then the UTM next-gen firewall, the firewall also need to keep adding additional protection, additional function, just like the firewall add intrusion prevention, firewall add sandboxing the firewall also need to add SASE function, which is DRP, the CASB, all these other web, all these things there. So the current firewall, they don't have enough computing power to run this function at the same time or they don't have the function integrate together like most SD-WAN has a separate box. So we're the only one that integrate the firewall. So that's the firewall need to keep evolving there. That's one part. On the other part, if you only offer SASE in the cloud, SaaS-based area and you limit your kind of total addressable market. On the other side, I see their biggest competitor probably will be the hyperscaler cloud provider, like the Microsoft, right? They can very easily leverage their cloud infrastructure with much lower cost and they have enterprise customers, they can enable that SASE function, the same thing for Google. So that will be their biggest competitor going forward. For us, we more leverage our huge customer base. We have like 15 FortiGate deployed globally. They can enable the SASE function, whether they work from home or they work from a branch office or work in headquarter within data center. So we have the same approach we did like 10, 15, 20 years ago when there's like intrusion prevention and there's a sandboxing function, there's other like now the SaaS function or SD-WAN function. That's where the firewall platform need to keep adding function and also keeping our salary function using ASIC to handle the better speed and the more function kind of integrate together additional computing power. I feel the firewall also need to be keeping changing up evolving. Otherwise, we'll be falling behind. because a lot of -- you look at a lot of other old firewall company, whether they watch or some others kind of disappeared, even Juniper from my previous also disappear. If they don't add -- keep adding function, then they kind of falling behind. That's why we feel we need to add a new SASE function into the firewall. At the same time, we need to keep accelerate function and then keep looking for what's the new function we can integrate.

Got it. Okay. On the SecOps side, which now includes FortiXDR, FortiSIEM, FortiEDR, you guys saw a 21% growth in Q4. How are you making this kind of a natural upsell for Fortinet? And then are the -- what is the customer that's buying this kind of SecOps product?

Most come from our current customers. They kind of see the consolidation benefit. And also because most of the product also developed internally, so they integrate automate enable AI much better compared to most of our competitors come from acquisition. They do have some kind of benefit -- customer base benefit. But for us, so far, the secure more come from the current customer, see the benefit of consolidation and see the benefit of managed together lower the management cost. So we feel leverage our #1 in the firewall SD-WAN. We feel that upsell, cross-sell is more easy, cost lower, more efficient than try to target a new customer in this area.

Got it. You talked about this a little bit earlier, but you guys have been building out your own PoPs kind of post SASE. You've now talked about having over 170 PoPs. Just what is you've talked about having a large installed base now, but just how do we think about kind of investment that needs to go towards building out that platform going forward?

Yes. We now have over 200 PoPs, but also we do using the cloud provider. We have 3 different cloud providers working with us. We also have multiple colo company working with us right now. And plus our own kind of own data center PoP, which also have own kind of -- the server, the Fortistack, all these things. So we try to balance among the 3, right? So that's where -- that gives us, I feel the best cost advantage and also the best security because we feel leverage on kind of Fortistack, we get a better security and the cost also much lower. That's also the reason we can offer the SASE service and 1/3 cost than the competitors. I still enjoy a pretty healthy margin.

Got it. Christiane, maybe turning back to you. Just in terms of how to think about kind of the growth cadence in '26 about the split between product and subscription and just kind of what are the moving parts to the low teens product growth guidance?

So I mean, it's beginning of the year. We just found out -- I mean there's a lot of moving parts, right, with supply chain, with growth opportunity from AI and so on. So we saw this as a trajectory into 2026 that we definitely can reach. And from a mix perspective, product versus subscriptions, we tend to sell more hardware-agnostic solutions. And so that takes a little longer to -- for services to follow, and that's what we built into our guidance as well.

Okay. Any nuances from geographic perspective? Obviously, we've had a lot of geopolitical attention paid over the last weekend. You guys have a big EMEA business. Just anything to think about kind of just from a geographic split?

Yes. I mean we saw good strength across the board, like similar to what we saw in Q4 so far. How this is going to change now for the last month, we will see, but the business is healthy.

Okay. Got it. From an operating margin perspective, Ken, you alluded to kind of leading margins a number of times. Just how do we think about kind of the margin trajectory of the business and particularly as you kind of layer in some of these hosting businesses?

I think this kind of long-term investment on infrastructure eventually payoff, you only take about 5 to 10 years. That's also the reason I don't see other competitors kind of do this long-term investment. Same thing for ASIC. We're still the only one keeping building ASIC chip, right? So it also take 5 to 10 years to see the benefit of that. So we are already starting to enjoy some of the benefit from the investment we made like 15 years ago. So that's where 15, 20 year ago, we started to invest in this infrastructure, data center, real estate. So that's where I think we'll continue to invest. We do see the payback starting to come back to help in the margin and more competitive.

Got it. Your capital allocation has been pretty aggressive of late. You've repurchased a significant amount of share over the past couple of quarters. Just had another $1 billion authorization in 2026. Just how should investors kind of think about kind of capital allocation and share buybacks as a piece of that?

I mean Fortinet is generating a lot of free cash flow, right? And that capital allocation question always comes up. We -- on the share buyback, we are typically opportunistic, and we see this as an opportunistic time to buy back shares. We will invest in M&A as we -- from a tuck-in perspective, like we have in the past. And of course, the infrastructure, as Ken just mentioned, is one area where we continue to invest in because it's going to give us long-term benefits from our margin perspective. So that's the strategy that hasn't changed.

Yes. We're pretty confident about like the future growth. We also believe in all these 3 pillars, each we're keeping gaining market share in each of the 3 pillars: network security, unified SASE, Secure OP. So on average, like we mentioned in the Analyst Day, a little bit over 1 year ago, if the market grows 12%, we're pretty confident in the midterm, next 3 to 5 years, we'll grow faster than the market. We're keeping gaining share. And that gives us the confidence, invest in the long term, also invest ourselves like buyback give us probably the best return.

Got it. Maybe just as a last question. Ken, I think you clearly laid out why Fortinet is kind of well positioned with AI. But what do you think that -- or do you think that investors are kind of getting wrong about the discussion about AI and cybersecurity right now?

I think AI will be the catalyst for a lot of change -- accelerate a lot of change. Also, I do believe the edge immersive will eat the cloud and mobile, right, so in the next 5 to 10 years. But for us, the hybrid approach probably will be better than too much depend on SaaS or software. That's because a lot of edge device, a lot of infrastructure and combined hardware, software, including ASIC will be more long-term benefit, drive the long-term growth in AI instead of too much depend on software or the SaaS. So that's kind of a combination of hardware, software infrastructure and more internally innovate, AI using AI, invest in AI, that's will be kind of -- will be positioned better for all this change. I think AI will drive a lot of change in the next few years. That we need to keep investing in that.

Yes. And if you look at the CFO perspective, I think there are a lot of -- 3 main vectors for us, right? It's AI used internally to drive efficiencies and improve margins, which we've done already on the support side. And then it's AI built into our products so that the efficiency we gain with certain AI solutions, our customers can get from AI agents to manage security, whether it's on the networking side or whether it's more on the SecOps side, right? And we've already -- we have a lot of solutions that have built in AI, but we have also launched a lot of solutions that have AI agents that help with the cybersecurity skill shortage, right, because you can't have that many people in your operations. And then the last one is AI threats, right, which -- and managing AI from a security perspective. So I think there's -- there are really 3 main tailwinds that hit cybersecurity companies in -- from different perspectives, but they are all business enabling, which is exciting.

Right. Well, Ken, Christiane, thanks so much for being here today.

Thank you.

Thank you.