Fortinet, Inc. (FTNT) November 12, 2026 Conference Transcript

Okay, we're going to go ahead and get started. So not trying to shut down that group, but all right, I imagine I'm going to stall for a little bit while because I think there's folks out in the hall getting ready to join us. I will say it's we're thrilled to have Fortinet here. It's a company I've covered for a long time. And Great company in the market, probably best firewalls out there. I will say at this particular time, you'll be happy to know that you won the prize and you're wondering what was the prize. The prize is the most frequent source of questions right now that we get on any company is Fortinet. And it relates to the firewall market, I think. Folks rotate the Fortinet because it's more of a proxy of a firewall market. Fallow, you've got all these numbers going in and out, inorganic, organic. Checkpoint is losing shares, so people don't really rotate on that particular company. So you guys are the most frequent incoming question we've had in the last couple weeks. So for that, we're grateful that you're here. With that said, let's jump into a few things, and we'll start at the market level first. And so my first question relates to just that, the firewall market. And as you think about the puts and takes of calendar year 27, as we're coming off of 26 here effectively, and comparing and contrasting that to COVID, which was also an interesting time, call it 21, 22. So how would you characterize the difference? And again, I'm asking at a market level to kind of normalize. But how would you compare and contrast the current period versus the COVID period?

Yeah, I think the main difference between now and the COVID period is during COVID. Companies were preparing for remote access, yeah? And that was the main use case for upgrading their infrastructure, buying firewalls, and then also adding on SASE functionality. Now in 26, 27, I think we have a lot more drivers for growth, yeah? We have AI that needs to be secured. We have sovereignty around AI, and for us, sovereignty is an important topic or hybrid infrastructure, control of your infrastructure, because we service a lot of companies outside the U.S., and the customers are looking for more control over their infrastructure. Then, we have... For us, for Fortinet, a big market is OT security, and that continues to get traction. And I think we all hear a lot about OT risks, whether it's the refrigerators being out of control or water systems being attacked. Just as some examples, last year in 25 airport terminals were hacked. So there's a lot around OT security that continues to be in the news and elevate that market for us. And why is Fortinet well-positioned? Because OT security is more of a hardware than a software play. While we have products in all categories, I think we differentiate our, as you said, nicely so, our firewalls are best in class. So that's where we have a lot of drivers that create demand for firewalls. A couple of years ago, I think everybody was talking about the cloud and said, well, Fortinet, your market is shrinking. We don't really see that the market is shrinking. We see that there's more use cases for all the functionality we're building into the firewall.

Okay. Okay. Let's take a step back. I've asked every company that I've visited with today a similar question. In terms of budgets for next year, your sales reps are coming back to you, probably trying to work down their quotas already.

So don't trust the sales reps. That's right.

That's right. At the same time... Um, getting feedback, presumably, from corporates on budgets for your TAM. And what a lot of folks wonder about in security is, okay, how much your budget's going up or down for security? Um, but really, it's even a fine, a little double click on that is, there's many more demands and requests on security budgets than there is dollars.

Yes.

And so where is the pool of funds going to come from? That meets all the requirements being asked of security departments. Like, what are you hearing about security budgets for next year? And I'll give you more, you know, I've had conversations with our internal folks from BMO. We have a security budget. It's going to grow X next year, but we're also tapping into a whole other pool of funds that's been created to support AI. I don't know if that's common, but give us a little bit of discussion on security budgets next year.

So, I think there's, there are two. Benefits for Fortinet, right? One is, yes, security budgets are increasing, and typically when you invest in AI, you need to build out security for AI, and that comes with its own budget as AI is budgeted for. But then also, as you said, companies don't have infinite budgets. So where 4DNet plays a role is we can consolidate multiple functions in one firewall. Best example, and we see a lot of traction, even though it may be considered old tech as SD-WAN. Many companies still have... Two providers and pay basically twice the price when they could buy a firewall from Fortinet and consolidate two vendors into one and so make room for more other security needs. And so that vendor consolidation, reducing from 200 apps to a couple of vendors is something that we see and that helps customers do more with not less, but with the same.

Have you gotten any numbers about what security budgets may increase next year?

I mean, I hear like 5% to 10%, but we shall see. I think that the threat environment… It remains active.

Yeah.

I don't think it's getting any better. So from that perspective, we may also see what we saw in 2026 shifting from other budgets to security just because customers realize that security is an important aspect that they cannot delay.

Okay. Okay, let's go into a little bit of You recently reported your quarter. I think there was a little bit of confusion, say, on the second half. Growth guidance versus what happened in the first half. So maybe just review at a top level sort of how, you know, the various factors that would influence the guidance to include price and availability. How did that shape or inform your guidance for second half versus first half?

So let me start with the beginning of the year. At the beginning of the year, we assumed a pretty normal year, right? Something like 10 to 15% growth without including price benefits. And Fortinet is fortunate in a way that we have typically two quarters worth of on-hand inventory. So then the prices started creeping up, which was something we knew. And we were able to supply our customers pretty quickly and also pick up demand from our competitors who were already constrained with supply shortages. So we had an outsized first half, which was partially demand of our own customers and partially demand that we were fulfilling from competitors and driving market share gains. In the second half of the year, Not that we are supply chain constrained, but we don't have the same advantage because now the lead times have increased, our prices have increased, and we can't aggressively discount, or we still aggressively discount, but not as much as we had the lower cogs on the books. So I think half year two is more normalized, and half year one was just outsized because we were in a fortunate position to take market share gains.

And so just if I drill down on, Ken was pretty clear, you had some excess carrier, I'm not sure if excess is the right term, but availability in the first half. So you look at second half, you have normal availability of inventory, so you're not – if you got incremental demand, you could satisfy that incremental demand? I'm just – I'm not sure the inventory.

So we have normal inventory on hand, but if there's accelerated demand, we have less capability to pull in production just because the lead times have increased. While we've given out longer commitments to our contract manufacturers, there's not as much of an ability for them to get all the components. You're still a little flex then.

And then, so inventory may be less availability, which also, by the way, benefited in terms of price because you had lower cost on your books. So now you have more of a consistent level of inventory, probably less flexibility on the cost. But on pricing, your price increases in the second half are actually higher than your first half. And so that'll be an extra benefit. But do you think price realization will be consistent with the price increases?

So far, we see similar price realization. And so I think from our perspective, the benefit is that it's a supply chain constrained market. So our competitiveness. It hasn't decreased. Everybody has the same issue. Their prices go up. They have raised prices, and so our competitive pricing is still as good as it was before. For customers, it's a little bit more unfortunate because they need to pay more.

Right.

And the other part is that because we have our own ASIC, and especially in the firewalls, we have one component that is less impacted by the price increases, so it allows us to be more competitive as well.

Okay. And then maybe reflect on the customer behavior as associated with those price increases, right? So you had incredible demand in Q1, Q2. Um, and Talk a little bit about what you think customer behavior was as it relates to those price increases, including comments on how that may have impacted Q3, Q4. Like, you know, maybe customers were buying a little bit ahead of those prices.

Right, I mean, I think what sales did at the beginning of the year when they saw that the prices are going up, they said to the customers, hey, if you have plans to upgrade, and we know we had customers that needed to upgrade throughout the year. We suggest you do it earlier because the prices go up, and we can't guarantee availability. So there's definitely some of this element. On the other hand, in Q2, we were taking share from competitors because of all-hand inventory, but I wouldn't underestimate also the additional units or customer demand because of Mythos. I think the AI... There are revelations in April that you can... That the time to identify problems in your software and exploit them, have shortened to milliseconds after a release comes out, has been a big one and is going to continuously drive demand. And why is this beneficial for the firewall? Because in the end, no customer, even if a patch comes out, can deploy it right away. Customers need to go through testing, the integration testing, they need maintenance windows. They need protection while they are planning to apply the upgrade. Firewalls and also SASE for cloud-deployed software is an important security. measure to buy time. So that's what drives continued demand.

So is the replay cycle or refresh cycle staying the same? Because usually, firewalls are five to six years. And because of mythos and security vulnerabilities, does that contract, you think? The replacement cycle?

So what we see is with all the innovation that goes into our OS, customers will have to upgrade a little bit earlier because all the new functionality requires higher-end devices. So while devices may not be out of support, you may not be able to turn on all the features and functionality that you want with a lower power device, lower memory device. So that's also when you look at my remarks over the last couple of quarters, what we've seen is that the average ASP net of price increase has gone up, which shows us that customers are buying within each firewall band higher devices that allow them to switch on more functionality, which is good for us because it gives us the ability to upsell the customers on services over time.

We're going to stick with firewalls before we turn to services in a second, but you know what? I think investors are really sort of stuck on, and I reflect back on the post-COVID period. When Peter used to yell at me, is investors are really trying to understand what does this really dynamic period of firewall imply for next year? And so you have a 50% comp in one instance, so extraordinary demand, again, some share gains. You know, what it may portend for next year. And so a couple different questions related to it. Again, just you can speak to either Market Dynamics or Fortinet. But number one, you have an exit rate established for Q4 implied for your guide. Don't know if that's the right jump off point. As we're thinking about product growth next year, or as you've talked about, you know, you You think the durable growth maybe is mid-teens, 15% or something along those lines, but just any guideposts that we should be thinking about as it relates to all the moving pieces, price increases, inventory, really hard compares, anything else you want us to consider as we're getting ready to turn the corner on the new year?

Right. So I'm not going to guide today.

Yeah, not asking you to.

So from my perspective, or from our perspective, the market dynamics are absolutely intact. And they are much broader than they were during COVID. So from that perspective, we're We are very confident about growth over the next couple of years, and we've always said our goalpost is that we outgrow the market. Because we don't do big acquisitions, our growth rates are pretty much organic. We benefited from pricing increases this year, but as did our competitors, so it's a like-for-like. From a growth rate perspective, there's still a lot of new demand drivers for product. And as I said, there is still also a significant cohort of customers that have older devices that they purchased during COVID that we can upgrade. So I'm not worried about... Continuing to sell product into our customer base and acquire new customers. We also have competitors that have big refresh cycles coming up. So that's an opportunity to take some market share. And if the market is good, we should be benefiting from it.

So I'll break it down in a couple pieces, but if any way to think about how prices may impact the market next year, so everybody's been taking prices this year because component costs have been going up. Is it as simple as thinking about, okay, price increases will be at whatever component costs do, or is there a different way to think about what price increases may be for firewalls broadly next year?

So I think we've been pretty clear to the investors that we will adjust pricing to make sure that our gross margin stays around 80% between service and product. But of course, we also need to adhere to market dynamics. So if the prices go up, we will continue to adjust our hardware pricing. If component prices come down, we've structured the pricing this year in a way that we have a base price for services and an uplift, and we can bring down that uplift without impacting services and renewals, which is important. Why would we bring down prices? Because we continue on to take market share, and then newer products may have... Lower-priced memory components, and you need to make sure that newer generation products don't cannibalize other products. So you need, from a market perspective, you want to be competitive.

And on the refresh, even if we, 21 and 22 were really good firewall years, and as you said, customers, A, that Life cycle may be shrinking, but even if we said it didn't, 21 and 22 were good years. So that, to me, would suggest 2027 should be an opportunity for ongoing refreshes for the entire firewall industry. So 27 from a refresh cycle should be a tailwind, should it not?

That's why we talked about the market and the dynamics, yes. I think customers make their buying decisions based on their new architectures that they have. In 2021, 2022, it was predominantly giving employees access to on-site resources because they were all remote. So now, in the new world, with, with, um... People being hybrid agents coming into play, more network traffic, there's going to be a re-architecture going on, and I think that's what we see over the next couple of years to meet that demand.

Okay, okay. And then any, again, I said I was going to jump off of firewalls, but here I go back in again, but SASE... is promoted by some of your friends at other companies as an architecture to maybe eliminate the need for, not eliminate, but maybe reduce the need to firewalls. Are you seeing any tension there from an architectural perspective as we move into AI?

We don't, because what we see is that the world is becoming more hybrid versus more cloud. And so Fortinet's thesis is that With a hybrid world, you need on-prem devices, you need security in the cloud, but why should Move all the traffic to the cloud when you want to inspect them on-prem, because the user is on-prem. And so from an architectural perspective, what we've done and can created this notion of a SASE firewall, which is not a device. It's a market where the SASE functionality needs to sit in the cloud for remote users, but you want the same functionality, whether it's DLB, whether it's CASB, out there. in your network and then control that and so our hybrid infrastructure meets both and we think that for Companies that are not cloud native, that's actually hugely beneficial, because it's all orchestrated with one operating software. You have one ZT&A policy across the cloud and your on-prem environment, so a lot easier to manage.

Perfect. Perfect. Let's jump to services for a second, and then I'll open it up to the audience for questions. On the recent energy call, there was a lowering of the services revenue, 14 to 13, so not a huge number. But can you just review the contributing factors, attach rates, ramping service deals, slower service activizations? If you could just review that in particular, drill down on what was a more meaningful contributor to that change in growth trajectory.

So, It's correct. We brought down the service assumptions for the full year, even though we are still above what we thought at the beginning of the year. So this year has been good for product and for services, but there's... What we saw in Q3 with a really large enterprise quarter is that, of course, enterprise customers know how to negotiate. And so we had a couple of new customers that came on or that bought from Fortinet, and so it takes them longer to ramp.

So these were new logos?

New logos, yeah. And so we allowed them to have a little bit of a lag period. Typically for Fortinet, we have an auto start policy for services to start within 60 to 120 days. And so that's not for large deployments necessarily working for customers. It takes them to distribute. The devices into locations, and so they have their go-live plan. So that was one element. We had customers signing up for larger services deployments, and we knew that we had this in the pipeline. But then the activation, the start date of these EAs is a little bit later, and that's what you also see why we had good billings, but the ARR didn't increase as much because the start date is outside the quarter. And with some of the negotiations, of course, with enterprise customers, your rate of services for the hardware stack is a bit more compressed due to volume discounting. Customers buy more from you, and they will say, well, but I'm not paying that many services because you get economies of scale. on the customer.

Yeah, as any company does. Every company does.

It's actually good. While it's bad news that we didn't generate as much revenue this quarter in Q4, it's actually good news because we were signing up new customers, new logos, and we got the billing.

And so what does that mean as I just think about contextualizing mixed risk? So if you sell more new logos, large enterprise, presumably, that puts tension on when the rev rec happens on those attendant services. And so as you think about the guide for Q3, Q4, is that, you know, how did you guys capture that potential risk of getting more of these incremental customers that may extend that duration of turning on, so to speak?

Yeah, when we started the quarter in Q3, we, I think we were Not factoring that huge enterprise cohort into the mix of the service after we had really good growth in Q2. And so this is where we had a little bit of a change in assumptions. But on the other hand, we had really good wins. And from my perspective, you can have... You can sign up customers without a lag, but then you probably discount more, and then you're impacting your exit rate, yeah, or you can give them a little bit more value out of their service contract by starting when they deploy the devices, and then you keep your rate up, so I'm always a long-term thinker versus a short-term thinker.

Yeah, I think most companies do that, and I know, frankly, CrowdStrike is very effective about doing that. And so, but you're, maybe talk about those large enterprise customers. When they do get to the state where they're turning on, are they consuming at the same rate? In other words, are the subscription revenues as a percent of what they spend on firewalls consistent with the broader portfolio?

They are pretty much consistent, depending on how, I mean, the bigger the customer, the more compressed the service stack, even though you attach more services.

Right, because they get discounts.

Yeah, because you get volume. But overall, I mean, we have a good product and service mix, and we still, with all the new services that we announced in Q3 that are addressing specific AI risks, I think we have a lot of services to upsell in 2017.

So even the attach rates are similar. Even the components of that stack are similar. In other words, they're consuming the same types of solutions as large enterprises as, say, your medium-sized customers are?

Yeah, it's use case specific, right? For OT, we have specific OT subscriptions. For data centers, the customer typically buys the UTP or ATP bundle for specific 40 guard security subscriptions. So it's very use case specific. It's not as much like, is it a large or small customer?

Okay, okay. And you did make the comment on the call, I hope I paraphrase it right, but that services growth would be higher in 27 than it was in 26.

Right, which you can see from deferred revenue. Short-term deferred revenue is up in 2026 compared to last year. And so short-term deferred revenue is the best indicator for what we are We're recognizing the next 12 months.

And so the risk associated with that not happening. So DR is on the balance sheet. So it gives you high visibility. I guess if there were further extensions, I don't know, mix, you know, more enterprise by you. So maybe you get some extensions, good news, longer term. But is that the risk that we should be thinking about, even though the DR is on the balance sheet?

Yeah, in general, it's a pretty solid indicator. And this is why we were confident to make that comment down.

OK. OK. Let me take a break there because my voice is running out anyway. But any questions from the field? OK. I will keep going. SecOps.

Yes.

Growth did slow a little bit in SecOps. I think you stated on the call that it was a little bit of a lower benefit of pricing and maybe some duration issues, but maybe just talk about what happened in SecOps and how we should be thinking about that business.

I mean, I think there are... The components of pricing that didn't benefit SecOps as much. There's also the focus that right now the sales teams was extremely focused on upselling, upgrading on the network security side. And then what we did in 2026, and that's where I think we're building pipeline now, is that... We consolidated multiple products into two platforms. One is the 40 endpoint platform, where you can now have one agent and then license under that agent, EDR, DLP, different functionalities that you want to have on the endpoint. The same we did on the 4D SOC side. In the past, we had SIM, SOAR, Analyzer, everything separately, and now we are consolidating that into one solution, and so we also slowed down some of the... Um, activities in Q2 and Q3 on the, on the SecOps side, because we want to deliver the new, um, solutions.

I got it. Okay. So part of it was the bundling you did that maybe takes a little time to digest.

Yeah.

Okay. Okay. And then, um, any comments on how, so when will that... I don't know if it's a go-to-market issue or customer issue on digesting the new bundles, but will that all be sort of normalized as we exit Q4 so that calendar year 27 is a more normalized growth rate?

I'm pretty sure that it will normalize as our sales teams also focus on selling the broader portfolio versus satisfying the immediate mythos demand on upgrading firewalls.

Okay. Sorry, I'm taking a sip of water. Management has talked about on-prem, sovereign, SASE as being a large market, 2 to 3x, some of the cloud-only SASE market. It sounds quite impressive, but maybe drill down on why that's such a meaningful opportunity in and of itself and why Fortinet is particularly well-positioned to win it.

So, let me start with the latest part. Why is Fortinet while positioned? Because we've created a... Technology stack that we can port from our own data center into a service provider, and what that allows us to do is, instead of us controlling the full network traffic, the service provider can deliver the service, and if you follow certain regulations, more and more markets. We want to have the ability to control where data resides and where network traffic flows and who controls it. Especially in the Middle East and Europe, you have new regulations. So for the net... Because while we were late to the market with SASE, we started initially with service providers. We built out, in the end, a stack that is easy, portable. And we continue to do that not only for our SASE solution, but also for AI security and so on, that it's not dependent on certain proprietary cloud services, but that it is actually portable and can be delivered by us or can be delivered by third parties in a way. That customers have control. Cool.

And why is the market so much larger, do you think? I mean, Ken's given some big opportunity descriptions on why the TAM looks so intriguing. Are you getting that type of feedback from customers, or where is this confidence or optimism coming from?

I think the SASE market is the question, is it just the SSE component, right, or is it the bigger stack? For us, it's the unified SASE market with the on-prem opportunity, which opens it up to not only being delivered by us, but also by service providers and countries. And especially one of our biggest segments is the government, public sector segment. They are, of course, very interested in keeping their traffic in the country, you know, and so that is a big segment that we can service with our software and SaaSy solution that competitors cannot as easily.

Right, okay. Aside from a sovereign SASE, maybe give a little characterization about where you're winning in the non-sovereign side. In other words, cloud SASE, where are you winning from? In other words, what type of customers are those? Presumably, everybody has SASE solutions now. Who are you winning share from?

I mean, you still have customers that only have VPN and so on, right? So you still win from those. But we're really winning from those customers that have hybrid architectures. They have remote users, they have on-prem users, they like the fact that Our operating software spans from the firewall to the SASE portal, and you have just one policy that you can apply. So for cloud-native, cloud-only customers, you still have the same functionality but not the same benefit that you have when you're a hybrid customer and need to manage a much more complicated architecture.

Are these mostly SMB, you think?

No, it's enterprise customers.

And are there dual sourcing at that juncture if they're enterprise?

Some customers are dual sourcing, yeah. Some customers... We liked the ease of management, and we reduced TCO by simplifying operations. So I mean, every customer has their own way of creating resilient infrastructures, which can be resilient through multi-vendor strategies, or can be resilient through routing and different aspects of...

Again, staying away from sovereign, or maybe including it, but who are you most frequently competing against, do you think, on the sassy side? Is it Netsco?

No, I think it's often Zscaler. And in the lower end, I think, or in the midsize, it's Kato.

Okay, okay. Interesting. Okay, let's go. Fortinet recently launched FortiGuard inline AI. Maybe tell us a little bit about what are the opportunities there? How would you characterize the demand pipeline build? Any comments on Fortinet AI security?

I think that's the real upsell opportunity with so much more traffic and shadow AI in every organization and us trying to do something quickly, and then we use our private subscription and just plug something in, right? You want to have, as a company, you want to not only know where traffic is flowing, you also want to inspect what is in the traffic. And this inline AI security can identify are you putting IP, are you putting social security numbers, are you putting personal identifiable information in a prompt and trying to route it into, for example, an LLM. And so that's where this inline security can analyze what is in. In the traffic, not only where is it coming from and where is it going to. And that's going to be critical for many customers to make sure that the AI usage is in line with policy and you can govern actually AI.

So that's an opportunity. We'll create lift in FY27.

I'm pretty sure, yeah. And then the other aspect that I like is you can also manage cost control with AI inline security, so you can define how many tokens people can use.

Okay. All right. We're coming down to the last two minutes, i.e., last two questions, and I'm going to try to broaden my second-to-last question out a little bit. But if you think about leaving investors with a view on how AI is going to impact your revenue opportunities, presumably to the better, What would you characterize as the most meaningful two to three opportunities as you look at calendar year 27 to inflect positive on creating incremental revenues or ARR opportunities?

I think that the two immediate big opportunities are... Security for AI. So securing all the AI use that we want to do in enterprises. And then, because more and more enterprises want to build out their own AI infrastructure, it's also the security for the AI factory. And then, as a longer-term step, it is deploying AI. In security to reduce your operational cost, yeah, so to make it easier to operate.

Okay, okay. We're going to end on margins then, and twofold is just any broader puts and takes that we should be thinking about at 27. You've already said gross margins sort of stay where they are, you know. Depending on component cost activities, you'll raise prices or decrease prices to offset that. But any just broader comments on how we should be thinking about operating margins is sort of question number one. And the second is just capital employment, but really M&A. Fortinet has historically not been an M&A acquire. Ken just doesn't like to do that. Paolo does. But AI is creating opportunities. That maybe aqua hires is the right strategy as you look out to try to get some incremental competencies that might otherwise take some time to develop. So we're going to finish on those two questions, margins and M&A.

Yeah, we will continue to tuck in M&A. The key for us is that we can integrate it into our own products, and it's not sitting on top. It may sit on top initially, which we've done with some of the acquisitions, but then over time, it needs to fold in. On the margin side, Fortinet, I think, is one of the most profitable companies. We said we have a goal to have profitable, balanced growth. We continue to have that goal. We will make investments where it helps us grow. So I'm not promising an operating margin right now, but rest assured, our margins will be solid.

Yeah, I know Ken likes operating margins.

End gap.

Yeah, that's right. On behalf of Bank of Montreal, we're really appreciative of you attending, coming from California via Canada. But we're grateful that you're here, and we wish you all the best of luck closing out the year.