Fortinet, Inc. ($FTNT)

Amazing. Good afternoon, everyone. Thank you for joining us. So my name is Brian Essex. I cover Midcap large cap software for JPMorgan. And today, we're excited to have Fortinet with us on stage. We have Christian Olga, the CFO, and Robert May, who is EVP of Product and Technology Management.

Yes.

So thank you both for joining us. We really appreciate it. So maybe I want to kind of start with One of the most popular questions I got after earnings because you guys spent a lot of time talking about AI. You flagged a couple of large deals for AI data centers. Can you help us understand how large that business is? And what kind of inbound traffic you're getting for that AI data center type business?

Let me start with what kind of interest we're getting. AI is very broad for us, right? It's not only the AI data center and Robert can talk a little bit more of what we are seeing. But -- there are a lot of security needs around AI. And as companies figure out what they want to do, they also realize that using AI in the cloud is going to be costly long term. So they are trying -- they are evaluating whether they can bring certain AI models to their own data centers into certain specific reps? Or then, of course, you have a lot of companies building out centers now. And so that's what we are seeing more and more coming online. And maybe, Robert, do you want to comment? .

Yes, sure. I think like on the data center side, you've kind of got 2 dynamics, right? You've got existing data centers that are being repurposed or adding AI stacks in there, and then you've got brand-new deployments. Now each of these obviously take time to build out and you start with a small footprint and you continue out. We've had obviously large success in the data center for a long time due to the high performance, the low latency, the low power consumption of the ASIC technology. So it's something that is obviously attractive even more so In the AI era.

Great. And maybe, Christian, like if we think about your exposure to data centers overall, any way you kind of get a sense of how large that exposure is. I've always kind of in the back of my head thought about maybe some of your peers who are more large enterprise exposed with bigger firewalls, having better exposure. But how do you think about it as a percentage of your business?

So I mean, I think we've always talked about, if we look at our firewall estate, it's about 1/3 of the revenue comes from large fire walls and 1/3 for immediate size and wonder from smaller firewalls. And as you know, our business is extremely diverse, but we sell a lot into financial services and also into public sector, and they tend to have larger data centers. The benefit for Fortinet data center build-out for AI infrastructure is really our low power consumption and our advantage there, which is extremely important when you think about AI, which consumes a power and what is the -- and you asked about the opportunity, right? We all want to quantify it. I think what I said in the earnings call is that the build-outs that we saw were pretty much a reference architecture and so I think for us, it's not about 1 big quarter with AI data centers, but it's going to be a consistent deployment as more companies start to look at how do they deploy and as other enterprises ramp up. And Fortinet is globally diversified. So it's not a U.S.-specific opportunity. It is a global opportunity and a lot of enterprises where do they run their AI deployments. And if you think about Fortinet's footprint outside the U.S., we have high market share in EMEA and especially with the solvency roles there, they are a lot more concerned about where the data sits. And so that's a good opportunity for us.

Got it. And 1 of the things you said at dinner last night, I thought was pretty compelling. So I wanted to ask both you and Robert. In terms of the ASIC architecture of the firewalls that you have exposed to data centers and then other feature functionality within your firewalls. What are -- and 1 of the things that caught my ear was particularly the energy consumption component of it. But what -- how much of a factor is that in the decision process as well as some of the other feature functionality that you might have like unified OS to manage your estate?

Sure. Yes. Well, certainly, the power consumption is more of a concern like it's always been a concern for other reasons in places like Europe and what have you. But now with AI, it's really drawing a ton of power. And so they're really an advantage of having a much lower device overall. So when you look at the amount of power consumption per gigabit of traffic or what have you, it's quite compelling. In terms of the other feature functionality. I think one of the big things, right, as you're building out a data center, it's not the traffic coming in and out. It's also the east-west traffic that is going to those AI workloads and having the ability to run the same OS in a virtual environment on top of NVIDIA chips, for example, BlueField DPU is really because that means that the operations team only has to manage really 1 set of security, right, for all of the data centers. So it really provides a competitive advantage there.

Got it. And then I want to ask about 1 of the other things that I think it was Ken on the earnings call alluded to, but almost like a return to edge or on-premise renaissance, so to speak, particularly when comparing this spending cycle to the spending cycle that you may have seen during the COVID era -- maybe could you maybe compare and contrast the dynamics of what you're seeing right now from a demand environment relative to what you saw maybe during that kind of 2019 to '22 time frame?

Sure. From my side, I guess 1 of the things I hear constantly is the data sovereignty requirements, right? This isn't just AI, but also SASE and other technologies and having the ability to run that in country or local service providers that want to offer services with it. In terms of contrasting that with, say, the COVID era, obviously, the drivers there were suddenly have got a ton of remote users that need to access work, right? So there was a totally different driver there, but it was kind of a similar trend in that way. And in terms of AI, I know the plays, obviously, when companies are doing like initial projects or AI. They oftentimes might use public cloud, but they quickly realize the cost advantages of running their own security or their own AI infrastructure. And so they slowly start to migrate that back, especially as they scale up the usage the token usage and start to offer it as services for their customers.

Got it. Super helpful. And then 1 of the things that was really impressive about the first quarter was this phenomenal growth in product revenue had -- and then, Kristian, I asked you a question -- if you look at the relationship between product revenue and services revenue, just to understand how that may have shifted over the past year or so versus historically, the relationship that you may have had? And you referenced historically, you had a higher mix of switches and access points. But this quarter was a higher mix of firewall-related hardware. How long is that kind of mix shift been persistent? And how do we think about the durability of that mix as we kind of look to the mix to expect for product and services for the rest of the year?

So I think what we see is we see a lot of use cases for firewalls, AI is one. We continue to see high demand for operations technology. And this has been a growth area Fortinet for a long time. Over the last couple of quarters, we've always reported out that OT group than the overall business. And so it's a significant component. OT does not only consume firewalls, but it's 1 area where we sell a lot of hardware into that use case. And with recent attacks, high-profile press releases about companies of being able to produce or to close their stores last year in Europe or airport terminals not working. I think there has been more awareness, how detrimental an OT attack can be companies are spending more money and are looking more into this area for security. And in many cases, it's white space. So it's a good business for us to grow in. in addition to the needs on the AI side to segment and then SD-WAN is having a renaissance as well. So I'm confident about continued high growth for a significant time, it's not short term.

Great. And then I wanted to ask you with respect to the overall spending environment and the impact that recent AI-related events may have on that spending environment. Namely, we've had several high-profile foundation models come out, and it's been highlighted their ability to find vulnerabilities engineer exploit those vulnerabilities. How much -- 1 of the issues that I think is -- that I think maybe not well understood is that you have several different categories of vulnerabilities or packaged software where you can just patch a custom-built software, which may be a little more difficult. You may need to refactor that software. And then you have hardware, which may be a little bit more challenging and that you might have to replace the hardware. -- is that hardware component, a factor in some of your customer purchasing decisions. I know you don't have like a clear crystal ball into what kind of refresh activity that have. But just wondering if that's part of the conversations that your customers are having, particularly given the elevated urgency you may have around an accelerated amount of vulnerabilities across that multi-product landscape.

Well, from my side, what I could see is like, obviously, we've -- the last several years, we've had a solid program of communicating with customers and keeping them up right, athletes version. So there's always going to be some outliers where they're running very old equipment that can't upgrade to the latest version. But I think we've managed quite diligently, I would say. Now on other hand, it does trigger a discussion, I would say, where it may be a consideration to say maybe we should run the later of the OS. And since we're going to go through an upgrade, maybe we decide to upgrade the hardware at the same time. These kind of discussions, I think, happen because it's an operational discussion there. .

But yes, if you look at Fortinet, we've been extremely focused on improving our code quality -- and we've had, as people know, vulnerabilities that we've communicated and work with our customers to upgrade. And so I think we have a good program in place to work with our customers on upgrade. And hardware replacements are only recorded if you really want very old. So the first step is always going to be upgrading your operating software or upgrading your for your application software is everything vulnerable? No, only those components that are open to the cloud. A lot of estates are run without access to the cloud. So I think that for every vendor, the situation is going to be a little bit different. But of course, there are now interest in putting out of firewalls around your parameter, no firewalls to secure what you cannot upgrade as quickly in sight, yes.

Got it. Super helpful. And then I wanted to ask about 40 OS 8.0 falls in the Robert's Wheelhouse. I mean, introducing a Gentek AI is a pillar of that security fabric. How should we think about the impact that has on the attach rate of higher-margin security subscriptions across your firewall?

Yes. Well, let's say, in 408, there's a couple of different areas, right? One is at the highest level, you can say we talk AI for security and security for AI, right? And in terms of AI for security, this is really how we use AI to improve the products. So this is usability, automation, those agents and assistance interact with. And it really helps to speed up the deployment process, the troubleshooting and any type of things on the operations side...

Mitigation.

Yes. Exactly, yes. And then when we get into the other side security for AI. There's a few different products there, but specific to say, 400, it's a lot about the shadow AI, right? Like many companies having conversations with, they really don't know what's being used in right? We want to uncover that, get the visibility and then take back the control, right? So this provides not just what SaaS services they're using, but also what agents are in the network, what and gives them the ability to control that traffic. And a lot of these capabilities come with some service component, which is added on top to go back to your kind of original question there for the service. So capabilities have that type of service attachment.

Got it. And then the other point that kind of came up briefly, I think, at dinner last night is your involvement with Glasswing and OpenAI stack access to those foundation models. -- how critical or how much of an advantage is that for you to be able to utilize the findings from the visibility that those models provide in terms of what you're developing on your platform to help protect not just your infrastructure, but your customers' infrastructure.

Yes. Yes, sure. I mean, so obviously, for the last couple of years, we've had a large focus in this area. And so glass wing is another tool, right, that gives another perspective, another set of visibility for the engineering team to address issues that may come up. In terms of the criticality, we haven't necessarily seen the level that's been in the media, you could say that way. But I think 1 thing it does really showcase is that for most enterprises, they're worried about all of the software and products that right? And I think we've had a very effective way of working with our customers when there is something or an upgrade that needs to happen. And other vendors have maybe hidden things as bug fixes and stuff. I think last wing that critically so that you can't do that anymore, right? It has to be open apparent and good communication with the customer base. Right.

Got it. Maybe 1 to hit on macro real quick. Would love to get a sense of not just for 1Q, but what we've seen so far this quarter, how has the macro impacted customer spending patterns? And then as a part B to that question, it seems like security has been getting access to budgets outside of traditional security budgets. If you have a Chief Marketing Officer that wants to secure his agent project or whatever. It now also seems that both Mythos and GPT 55, if you're getting kind of incident spending where people are freaking out or CIOs are freaking out and you're getting this extra juice. What are you seeing across your platform? And is that for 1Q and then 2Q so far? Is it a meaningful contributor to performance?

I mean I think what we're seeing is that pipeline is improving significantly. And you're right, I think security spend is getting prioritized and probably also getting elevated because AI creates the need for security. You have nation state activity. I mean the war in Iran has heightened those activities, and especially Europe is also a very worry of Russian activities constant -- so you see the increased attacks on critical infrastructure. And so we've seen all of these aspects benefiting Fortinet's pipeline and our strong belief in durable growth. .

Got it. Super helpful. I wanted to touch on sovereign Sassy, which we briefly discussed, but it seems like you've carved out a relatively unique position there, allowing customers to deploy SaaS within their own data centers opposed to relying on a vendor's public cloud. But could you elaborate on the competitors' landscape there a little bit? Specifically, which customers do you see within sovereign Sassy like RFPs? And what does that mean for potential market expansion for you?

Well, let's say, when we talk about sovereign, I think there's a few different layers, right? It's like what level of sovereign need, right, for the -- either the application I'm using, the data that is being sent through and then the regulation, right? So on some, say, applications you're using, maybe there is no concern. It's just a regular SaaS allocation and find the public cloud. And on the other extreme, it's like there's a highly regulated thing or it's gotten my company's secrets in it. So I want to make sure that's on right? So -- and then a Fortinet, we have for like a SaaS offering that spans both of these, right? So you can -- from the public -- from the different publications, you can select to use anything globally or you can start to down and say, "I only want data centers that are in country, right? And then you can even augment that with, say, FortiGate appliances to say, okay, I want to also install a couple of additional locations, maybe where I have a factory or I have some specific locations that are performance requirements. Then when you get into sort of like, okay, I need to have sovereignty on-premise for various reasons. The type of customers that we see in the early stage, of course, are the and the large financial institutions, which are wanting to basically have their own fully managed stack. And the benefit there is we provide really the same technology, the same user experience and everything, but it's a drop in -- so it's not integrating with virtualization and things. It's actually just drop it in the data center, and it stand up and up and running very quickly. So it provides that same experience as a public offering.

Yes. And from that perspective, you certainly heard a lot about your telco provider traction and how might the profile of that customer cohort in terms of service providers, whether it's Neo Cloud or telco providers, how is that shifting given what you're seeing in the demand environment today?

I would say the service providers have 2 main reasons why they are looking at serving when Sassy was becoming more attractive, they started reselling because they needed an offering for the customer. So they started reselling some of the -- of our competitor solutions. And the problem is they don't own the customer this way. So they are replaced a bit, and that doesn't give them the attachment to the security spend of the customer. So if they -- if they have their own sovereign SARC solution, they can actually own the customer and they can continue to service the customer with all the needs the customer has. The other aspect, I think, is that many of the service providers also housed public sector applications and data centers and with more requirements, especially in the public sector. Europe is a good example. They are looking at being able to service their big customers, the big agencies that have a lot of data that needs to stored in country and shouldn't be accessed from outside from different providers. So this is the main driver for service providers looking at our service solution.

Got it. And -- are those dynamics shifting? I mean, I think you mentioned that your business tends to be 1/3, 1/3, 1/3 small, mid and large enterprise. Is the mix shift of enterprise size shifting at all given what you've seen over the past few quarters in terms of growth dynamics for the company? .

I think our focus over the years has been on larger enterprise customers and service providers. So we see a little bit of that mix -- it doesn't mean we are deprioritizing the lower end of the market, but also the lower end of the market is continuously serviced more by service providers just because security gets so much more complex. And so that's a big focus area for us to make sure we capture and we service the needs of all customer segments. .

Got it. Another point, and I'll ask 1 more question, and then I'll open it up if anyone has questions from the audience, just to give you guys a heads up. But I wanted to ask about the SD-WAN and SASE service bundling. What has the impact been on your business so far? And to what extent might you pursue bundling for other products and services to accelerate traction of the business?

Well, certainly, so far, I mean, it's only been a couple of months, right? -- but we see definitely a large attraction towards it. Really, it just makes the overall SD-WAN experience smoother and everything, but then it adds additional SaaS starter pack to the SD-WAN deployment. So what that means is that the IT can just immediately start to use it and get comfortable and then start to roll it out in a more normalized way instead of another separate project that they have to tissue RFP and everything for. In terms of that kind of motion, I don't know the bundling part is 1 aspect, but it's really the other motions around, say, the endpoint operations areas. These are other areas where traditionally you see multiple different endpoint technologies or multiple different products in the SOC. These are quickly converging together have more unified offerings and single licensing, single SaaS port, all like all these kind of elements that really bundle everything together.

But I think on the SD-WAN Sasi bundle, the main benefit that we see is that if a customer has kind of this as store pack and they already have deployed SD-WAN, they can see how easy it is To deploy SAC. Yes. And because it's just a small what we call starter pack, they can deploy it and then we hope to upsell the customers as we may displace as we may display VPN solutions are similar, yes.

Got it. I want to reach out to see if anyone in the audience had a question for the company. And then I have a follow-up. Okay. We'll hit you as a follow-up. But please feel free to raise your hand if you do have questions that come to mind. But I want to follow up on that on the SaaS SD-WAN relationship. I know historically, you've had a bit of a different go-to-market motion than other vendors in the space where you focused on converting SD-WAN customers to SASI. Is that dynamic changing at all? Are you meeting with SaaS? Is that becoming a higher mix of SASI business? Or is SD-WAN conversion still like your bread and butter in terms of how you're growing that business?

I mean I would say the main benefit for customers can be experienced if you have both SD-WAN and SASE because then you only have to manage 1 set of policies, it can extend easily. You don't duplicate your efforts. Our SASE solution can do exactly the same that what our competitors can do. But if you don't integrate it into the network, you still manage duplicate environments. And so I think that's the true benefits for our architectures that you can manage 1 environment holistically, yes. .

Got it. Yes. I think what I kind of see on the project-by-project basis kind of like maybe 3 different areas, right? One is where they've already deployed a Fortinet SD-WAN and then they want they're looking to do a remote access project and then they realize quickly that, oh, this just plugs directly in. I can shortcut a lot of operational things, both in turning it on and also in the ongoing management. The other 1 is when maybe they're deploying an SD-WAN project and then they quickly realize, oh, I can actually do Sasi at the same time, right? So these are kind of similar, but they're driven from a different starting point maybe. And then you've got a third category where it's maybe they're starting with a SASE project that maybe they aren't a foret customer. This actually, we see some motion to actually they starting to reconsider, "Oh, maybe I should deploy SD-WAN at the same time at Sassi,Soit's kind of coming from the opposite direction. But again, the same operational benefits and everything.

Got it. Super helpful. I want to ask a couple of kind of shorter questions. One was on duration. We saw a little bit of longer duration, I think, in the quarter this quarter. I mean, have you disclosed what duration is? And how should we think about the profile of the contracts that you signed this quarter and what to expect kind of as we go through the rest of the year?

So yes, we disclosed duration to be about 2.5 years. And -- what we typically see is when we sell a lot of product, we sell an additional initial service contract and the initial service contract with most of the solutions are 36 months. So it drives up duration versus when you have more services coming from renewals. And it's going to flex up and down a little bit on that trajectory, right? The more new hardware we said, the more you will see some increase in the service duration and then it comes down again as some of these contracts are renewal more on, which is typically 12 to 18 months.

Got it. And then what about experience with regard to sales cycles in the quarter? I mean, has a focus on AI and high-end firewalls driven any kind of divergence in sales cycles between large enterprise strategic deals than what we've historically seen in the mid-market, particularly given the way that the current interest rate environment may have on -- or the impact that the rate environment may have customer spending patterns.

I don't think we've seen too many discussions on financing deals or concerns around that -- so what we really saw in Q1 was certain deals coming back from Q4 that we had thought we had lost and due to supply chain constraints. They came back specifically in LatAm. We saw a lot of higher close rates, higher win rates. And so some acceleration of.

Got it. And you mentioned supply chain. So we'll follow up on that to you. You guys have done a great job historically and we saw this was really evident during kind of the COVID area where you did an amazing job in terms of like managing the supply chain and making sure that you maintained a healthy amount of inventory, where your customers didn't have that inventory you took share on the back of that. How has -- how would you compare the current -- and frankly, investors are asking about the impact of memory costs and potential supply chain constraints in the current environment. but a bit of a different environment. So could you compare and contrast like what maybe the company saw during the COVID area? And how different is the environment you're seeing now? And then how you feel about the way that you're positioned from an inventory management supply chain perspective?

Yes. Fortinet has historically always had about 2 quarters' worth of inventory on hand just to make sure we can be ready to supply, and we've never changed that. That benefited us in Q1. Of course, with the increase in demand, we are also going out to the market to try to accelerate production for the rest of the year. Everybody in the industry is impacted by the increase in memory chips components, -- and we are working through that. The benefit for Fortinet is that we do not only rely on the contract manufacturers, negotiating with the memory vendors. We also have direct relationships, and we can con to the contractors, and we're using that actively.

And 1 of the things I think I asked you, I think it was yesterday was 1 of the things that we've seen during -- that we saw during the pandemic was a certain amount of overbuying -- but I think you commented that it was the right move to make because you were able to take share -- what is your confidence level in the rate of inventory acquisition that you have now and how it matches up with demand that you're seeing in the market?

I mean we see strong demand and -- and we want to make sure that we can continue to deliver. And because our business is so global, every geo is a little bit at a different stage, but our -- yes, we feel good about what we've ordered we think we will need. .

And with regard to how you're spreading inventory across the globe, I think you've expanded the level of, I don't know, inventory management that you have on a global basis. How has that impacted how you're managing your supply chain in the current quarters?

It hasn't really impacted how we manage supply chain, but with our continued growth, we need more warehouse capacity. And so we bought a warehouse in Europe last year, which allows us now to have inventory in Europe in Taiwan and in the U.S. And it also diversifies our capabilities or risk management right if there are constraints on freight getting out of place, right? So we have more capabilities to meet the custmoer demand.

Great. Maybe 1 last quick one. Level of confidence and visibility that you have in the rate of product growth that's embedded in your guidance for the rest of the year?

So I mean our visibility is typically 2 quarters out, mostly and then it gets a little bit more bare the pipeline is shaping up nicely, and that gave us the confidence into a good guide up after Q1. And yes, this is where we are.

Sounds good. With that, I think we're out of time. So Chris Dana and Robert, thank you very much for joining us, and thank you all the odds as well.

Thank you, Brian.