Fortinet, Inc. (FTNT) September 8, 2026 Conference Transcript

All right, fantastic. We will go ahead and get started with the Fortinet session at the Goldman Sachs Communicope and Technology Conference. I'm Gabriela Borges. I cover software here at Goldman. Delighted to have on stage with me Kenji, CEO and co-founder, and Christiane, CFO. Thank you so much for joining us today.

Thank you.

So Ken, one of the ideas that we're exploring real-time is this idea of a cyber frontier model within a cyber security company. And the thought process is, as a cyber security company, you have an incredibly rich proprietary data set that you've been hurting for 10, 15, 20 plus years, because ML has been at the heart of Fortinet's roadmap since the time of its founding. How do you think about what a cyber frontier model within Fortinet could look like?

We definitely develop a lot of our own expert model and also kind of probably maybe the only separate company also build our own infrastructure, including the global data center with GPU, and already launched more than 20 enabled product, more in the security operation side. Like I said, the data is super important. Like we have a majority, more than half the global network security deployment give us a lot of data to analysis the global intrusion attack landscape there. So that also fits in our own kind of infrastructure model, the kind of AI infrastructure we feel we have a pretty good view of what's happening globally. But definitely also you need to use AI to fight or protect the other AI, which we feel is driving the huge growth going forward, which is really the new market we have not seen since we did Anastasia two years ago, which is a huge opportunity, including both the enterprise level, AI security, which we see a lot of internal segmentation, which is really the machine-generated traffic actually is a huge increase. At the same time, some service providers, especially the near-cloud provider, I hope that market for AI service provider near-cloud probably can be bigger than the traditional carrier or some kind of a security service provider because definitely AI changes the whole landscape, both in enterprise and some service software industry. So that's where some AI service provider will play a more important role, especially in the security.

Let's pick up on this AI service provider thread. So when I think about one of Fortinet's strengths with the cloud cycle, it was with the telecom service providers and that it's been a core part of your business for some time because of the performance and cost benefits that Fortinet delivers. Talk to us a little bit about what that looks like with the AI cloud cycle now and maybe as part of that, the opportunity that you may have with NeoClouds, for example.

Yeah, I think first, just like a SASE, we always believe there's a bigger market for service provider or even on-premise SASE or sovereign SASE, the same thing for AI. But besides the frontier AI model, there's always some service provider. There's always some kind of on-premise AI, SASE kind of security because they want to keep the data in their own kind of infrastructure process locally, not just some international, but even some big company in the U.S. have the same thinking. That actually drives the AI security, also drives some kind of near cloud. It's similar like a sovereign SASE, we feel it's a huge market and bigger than the cloud-only SASE by some early SASE provider. The same thing for AI security. The near cloud had another layer of AI service compared to some hyperscaler. So that's the part we feel eventually will drive most kind of security need for whether sovereign AI or some other local AI is a security market. Probably Christiana also see a lot of, especially from Europe, there are certain regulations.

So I think that the opportunity for us, because we develop a technology stack that others can operate, whether it's the sovereign SaaS stack or whether it is the infrastructure security for AI clusters, we see as well positioned for more of those regulatory environments where sovereignty is mandated. And especially in Europe, there's a lot of initiatives right now to build out AI infrastructure through local companies, right? And we want to be part of that journey, the security journey for AI infrastructure, similar to how we are partnering with global telcos on building out server and SASE and that it has been a theme for Fortinet for a long time that we partner with others to help build out infrastructure and so I think right now it's an inflection point with more infrastructure going on-prem not only going to the cloud that Fortinet is well positioned and especially on the AI side not only for service providers also for enterprises and Cloud AI, Frontier Labs are expensive, and so more and more customers are rethinking how much they should do themselves and build out their own GPU clusters and secure them and deploy open source models versus using AI through the Frontier Labs. And I think that's going to be a long-term theme that's going to play out over many years.

There's one key difference compared to the traditional carrier service provider to the near-cloud provider, the near-cloud make decisions much faster. They make decisions in months. You can see, we give example in earning, like Q1, there's near-cloud, they evaluate, they decide to purchase the same quarter for a few million, and then Q2, they are starting like five to ten times bigger. You can see they make decisions in months compared to the traditional carrier service provider. They take years to evaluate and make decisions, and, yeah, we feel it's a pretty strong growth, but also in the early stage.

Maybe let's talk about early stage going to the longer-term dynamic that Christiane mentioned here. So tell us a little bit, Ken, you just mentioned, I think you said NeoCloud, they make an initial decision in 1Q, and then you can see five to ten times bigger of a deal in 2Q? Did I understand that right? Maybe just talk a little bit about the progression on what you're seeing in the pipeline. And a lot of us from the outside, we try to track CapEx. Is that the right way to think about what the trajectory of Fortinet's data center neocloud business could look like over a three-year time frame? Or any color you can give us on how to think about this opportunity?

It's still pretty early stage. It's difficult to, like, compared to the traditional carrier service provider, they have like 20, 30 years or whatever history we're working with them. So we know their model of this quite well. But near cloud, they're still in the run-pop stage, but they have a huge capital. They have a huge infrastructure they try to build. I feel it's still more in the early stage, more protect their own infrastructure or build up. If you look at different layers, they're more still in the infrastructure layer right now. They're not quite in protect the model application there yet. But once they suddenly offer the service in the higher layer, definitely there's another wave of opportunity. Right now it's very more, they're more building infrastructure, protecting infrastructure. Could be come from like a utility, energy, OT layer, could be the infrastructure of this layer. But they're making decisions, they're moving much faster. they see that demanding for their AI cloud service is huge.

And I talked, I think, in the Q1 earnings release about building out reference architectures, right? So the NeoCloud won't buy and put it on the shelves. They will buy firewalls and related services as they deploy the data centers. And so it's critical for us to be in early so that we can grow with them. And so that's where most of the mid-sized neoclouds are probably more likely to be our customers because they won't have their custom components, propriety components.

Yeah, that's where the ASIC advantage, the performant advantage is huge compared to other competitors in our space.

Christiane, you started talking a little bit about enterprises running more agentic processes, more open source, more open rates models in-house. So my next question for you is how do you both think about network traffic at your existing customers? And maybe there's two pieces. There is the classic firewall, when do you start to get a bottleneck in throughput because agentic activity has gone up? And then on the sovereign-sassy piece, are you already seeing a change in network activity because of agentic and what are the implications of that? So maybe we'll do the data center, the classic firewall east-north-south traffic question first.

So the classic data center, I would say customers just start building out their own infrastructure as they see cloud costs increasing month over month. And as I also see, what do they want to do with AI? And so we have the partnership with NVIDIA, right? So we are securing GPU clusters. We are also doing it internally, and that's a big market that enterprise customers are increasingly interested in. And your second part of the question was on the SASE side, right?

Are you seeing an impact in your SASE network? When you look at your network capacity versus the amount of network traffic, are you starting to see the trajectory of network traffic change because of agentic activity?

Put it this way, probably the recent AI-driven traffic is more like the east-west traffic, whether within the data center, within the enterprise. And also a few months ago, probably as well known, is the first time machine-to-machine traffic is overpassing the human-to-human-to-machine traffic on the whole Internet now. That's where the enterprise, they definitely want to have a better visibility, better control, especially in their own data center campus, what kind of traffic, what kind of agents are doing there. That's where we see increase of this new internal segmentation replacing the traditional network device. That's where the convergence we talk about for like 20, 30 years starting to accelerate by this AI kind of adoption there. But also there's a lot of new area, which whether the near cloud, there's a the sovereign sassy that's go beyond the traditional network security doing there and that we see it's a new market opportunity compared to the traditional whether network security or kind of replacing whether network security or kind of sd1 it's already we see it's a new market especially the on-premise sovereign sassy it's a compared to before the the cloud only SASE. From all feedback, most enterprises lack this hybrid model. They do need on-premise, they do need some kind of sovereign SASE, but they don't have much choice before. So somehow when we combine this SD-WAN, SASE firewall together in the same OS, can be deployed on-premise in the cloud or as a service provider, it's opened up huge opportunity for us and we see quickly, not only the new market, but also kind of replacing some of the existing players.

And then to the point, customers are buying higher 40 gates compared to the past. And how do we assess this? Basically, the average ASP for us is increasing, net of price increases. So we see true ASP increases, which which suggests that within each band, low-end, mid-range, and high-end, they are buying bigger devices. What we don't quite know, of course, is whether they are buying bigger devices because they are planning for more network security traffic or whether they want to deploy more of the functionality, whether it's SD-WAN, whether it's quantum encryption, whether it's all the AI visibility that comes with a new OS. That's hard to say, right? But we definitely see that customers are preparing for more requirements, more cybersecurity needs, and all the functionality and innovation that we are constantly rolling out with our OS versions.

I'm curious how we think about it. It's a little bit of a pricing question. So you're talking about an upgrade cycle where previously if I would have bought a firewall at X gigawatt capacity, I'm now buying one size up. What is the typical pricing delta between the different SKUs or cohorts? Is there a way to frame that?

It's very different by low-end versus high-end, right? The high-end has a big differentiation between the 1,000 model and 3,000, right, versus in the low-end. But it's meaningful from an A&P perspective.

Yes, that makes sense. What is the AI visibility that's in the new OS?

In the 4DOS, there's a lot more functionality as to AI visibility, where's the traffic going, which model traffic is sent to, what type of, also contextual, is there kind of personal data in the prompt? So a lot more visibility that we are providing through the 4D gate and related products that customers may want to deploy when they have more agentic traffic, more sanction, and they want to sanction the AI use a little bit more in their company.

Yeah, also a few, because some AI models starting market on funding, like vulnerability, are there. and we're working with all the Frontier AI company kind of try to quickly helping customers defend this kind of AI fund vulnerability. But I say it's still probably most of this vulnerability is still not in the wild yet. But on the other side, we're keeping pushing customers. Maybe you need to quickly patch in, quickly, whatever, but I feel some customers are still behind. and that's also probably some other customer they just try to buy some extra layer protection whether by internal segmentation or protect the new attack surface or even add a multiple layer defense like you would enable security you already the first layer because if you have a more vulnerability and whether OS layer browser application definitely the networking to help in defend in the first layer. That we see also kind of increase the business for us, especially in enterprise space.

How much of this change in buying behavior, and we'll talk now about some of the cyclical dynamics in your business as well, but I'm curious how much of a change you've noticed in customer behavior since early April when some of the more advanced frontier models first came out. How much of some of these dynamics that we're talking about can be pinned or isolated to that type of dynamic?

Definitely not to reduce some awareness. There's a someday some AI, like whatever security outbreak maybe happened, but that's where we do pushing customers need to be upgraded sooner, but they also have their kind of balance because there's certain operation costs for upgrade. There's a certain budget or some other things they need for the extra protection there. But I feel we will keep working with them before the big or whatever things may happen.

But in general, I would say these discussions have helped with advancing cyber security discussions to the executive level. It was there before but now I think the need for doing something if you have aged environments is very clear. It's a combination of factors. It's not only methods. It's also the nation state attacks whether it's in the U.S. on the water infrastructure, whether it's internationally from Russia on the infrastructure in Europe. So there's a combination of companies being afraid of more attacks, less time to identify them from AI, and then also the threat environment increasing from other actors that are out there in the world from geopolitics. And both sides, I think, are advancing discussions on investments in cybersecurity and how to best secure your infrastructure against these accelerating threats.

Very good. All right, let's talk about the memory environment. Bring us up to speed a little bit on what you're hearing in the field from customers specifically around pull forward on the firewall side because of memory pricing.

I feel we are more different compared to five years ago, the supply chain time issue. Long time, we definitely see more pull forward and also the increased inventory in the channel, even in the customer side. Since then, five years ago, we did a few change. Five years ago, when a customer buys the hardware, you have up to one year to register to enable service. We shortened that one to 90 days now. so that's where making customer no incentive to buy anything beyond 90 days because otherwise the service will be starting to apply it to child out it's a 40k 40k service the second one we also closely monitor the channel inventory so we don't see increase in the channel inventory so that's where avoid the pull forward and which happened five years ago but also we see some component like a memory where we're more using the ddr5 ddr4 compared to the hbm the high bandwidth ai using kind of memory so that price also kind of stabilized a little bit now compared to like six months ago there's a huge increase that's also kind of a stabilize the whole supply chain a little bit on the other side we always keeping the we call the the same growth margin healthy growth margin different than some component company memory company you see their gross margin big increase of big job but for us we are pretty maintain the same that's where when we see the component increase we increase the price but five years ago like we also decrease the price when we see the component price drop or the the kind of shipping cost drop towards the end of a covid time that's also i feel we build some good trust with our supplier with our customer partner we just want to maintain the same growth margin and and we are justified based on our kind of own supply chain cost changing i think so far working on quite well and the same time we do want to maintain about six months inventory as to to meet certain like a rush order or big surge of demand in something like that I think that's also working well with us. And we do work in with all the components supply, the manufacturer directly instead of go through third party. And our own ASIC, we're keeping about one year inventory. The system level, we're keeping about six months. So any whatever, so we have some buffer. We feel we can help and smooth out the whole thing.

Let's stay on this idea of channel inventory. So the 90-day dynamic makes complete sense to me. The channel inventory dynamic makes less sense to me because, of course, the channel is actually selling through because customers are actually buying. Maybe just explain why the fact that channel inventory is low suggests to you that there's no pull forward.

Because the 90-day, right?

Sure, yeah, so the two go together.

On the other side, we also discourage channel to buy too much inventory. So we can control whether the discount of some incentive, make sure they just have enough inventory to grow their business instead of just, like, that's keeping, like, more inventory because the price may increase. But we also told them the price may drop. Like a few years ago, we do drop the price. So if you have too much inventory, you also probably stuck with some of the inventory. And that's why we told no need to pull forward or some extra inventory would not help.

I know none of us are memory analysts on this stage. Your comment on pricing coming down is a really good one because it's based on what you've seen in prior years.

I say stabilized.

Sorry, I mean historically you've adjusted pricing both on them down. My question for you, and maybe it's more of a how do we think about this, Most of the data points we see around hyperscale at CapEx and supply-demand, for example, it's just that things may get worse before they get better. And so I guess my question for you is, do you envision a scenario where memory pricing goes from being stable to actually Fortinet being in a position to lower prices at any point in the next one year, two years, three years?

I see the price increase also. I'm sure it's more in the HBM, which is more like a high bandwidth. Because we are more using DDR4, DDR4, that's more the traditional, that's the system level. And there's a lot of smaller memory manufacturers doing that DDR4, DDR5 compared to the HBM. There's only a few bigger manufacturers doing that. So in that level seems to be more stabilized compared to the high HBM memory.

Christian, you have the wonderful job of setting expectations, not just for the second half of the year, but also longer term. And Fortinet just put up a 52% product growth number, which is incredible. And in the past, you've talked about, look, in a normal year, product revenue likely grows north of 10%, if I'm remembering right, and there is the share dynamic that we've all talked about. And so, Christian, tell us a little bit about how you would advise us to think about the normalized growth rate of Fortinet over the next 18 months when you're going to be comping the 52% year-over-year number?

So that's a good question, and it's a difficult one. I mean, overall, we see a good demand environment, and we think there are continued tailwinds from all markets, whether it's AI, whether it's sovereign SaaS, whether it's regular SaaS, OT, quantum. I mean, it plays out across the board, right? That's also why we're saying we're guiding one quarter at a time because there are so many dynamics playing out right now that while we have visibility of how the pipeline shapes, it's hard to say whether decisions are accelerated or playing out in normal course, right? From a long-term growth perspective, We had benefits right now from pricing on the product side, which was a little bit higher than on the overall side, of course. But we saw great unit growth as well. So it's not just pricing related, but if we assume the pricing dynamics are a little bit more consistent, we won't have that same impact next year. So I think that's where we are still evaluating more from a unit growth perspective, how much more can we grow there, and then how does it translate into billings. We are also very, very focused on attaching more services, selling more services, and building out that portfolio because the service revenue is what renews and gives us long-term growth as well and the penetration in the customers. So we are not coming out with 2027 numbers yet. I think we're feeling good about 2027, but we need to assess the unit volume in the different product segments as well as the service attach rates and renewals and how we come out there. I think what we feel good about is that we are outgrowing markets, and right now the growth for the cybersecurity market looks really good and with more focus on on-prem and sovereign deployments as our customer base is extremely global. And so I think hardware has seen a resurgence, and so I think we are well prepared.

Well, maybe allow me to ask you about 4Q, where you have given implied guidance. Talk to us a little bit about, we get this question, while the implied guidance implies that unit growth slows from something that's much closer to 50% to something that's in the single-digit range. And then you layer in pricing on top of that. It's a very dramatic deceleration. Help us put that in context.

I think that we were very clear that Q4 was kind of a not yet factored into the annual guidance from a full perspective, right, because we don't know how Q3 plays out. And after Q3, we have better visibility. We continue to see strength in the pipeline progression and also on the demand side. But you will hear it after Q3.

Very fair. Okay, so one of my favorite times covering Fortinet was when you announced the Enterprise Bundle and you upgraded from the UTM Bundle. This was back in 2015, 2016. And it drove such a beautiful upgrade cycle on the services side of your business, which is a very high gross margin. And so, Christiane, you sort of alluded to this here with attach rates. Tell us a little bit more about, there's a new bundle that came out recently. Talk to us about the upgrade cycle and what is the premium. With UTM's enterprise, it was 65%, the cost of the box going to 80%, so we could do some really neat math around that. What does that look like in today's upgraded bundle cycle?

So we're still selling a good share of higher-end 40-card bundles, but not everywhere. And so what we did with the SD-WAN bundle is actually something that I think is very unique. We are selling to our customers the SD-WAN services that would typically not buy FortiGuard, but we've also embedded what we call a SASE starter license. And so for customers that are deploying SD-WAN, it's so compelling to also deploy our SASE solution because it's the same OS, it's the same policies, and it's very easy to deploy. Now that if they have the starter license, they can test it out. Depending on the size of the 40-gauge, they get like 10 to 15 users, and so they can use it in the IT department. And if they see how easy it is, how efficient they can manage it compared to having a cloud-only SASE solution, our goal, of course, is to upsell them when the competitors come up for renewal. And then it's an easy rollout because they were already able to configure it all. So that's where I think the new SD-WAN bundle is not only selling more services to customers that would have traditionally not sold as many, it's also our ability to get in early and show the value of our SSE, our 40 SASE solution, and then upsell as the customers may want to transition. Because every customer is afraid of switching, right? So you don't want to make a big investment when you don't know how it works for you, but if you can test it out and then you see how easy it is, then the switching costs have been reduced quite significantly.

Yeah, there's other additional surveys we're going to launch later this year, more related to the AI security, more related to the SASE, and especially the sovereign SASE, on-premise SASE surveys, which we feel also will help drive the additional surveys, which are already starting to deploy in the field with the new 4.0 at 8.0 we launched earlier this year.

Order of magnitude, how do I think about the pricing uplift from some of these dynamics like the SASE starter license, SD-WAN bundle, AI security bundle?

The bundle we launched for the new customer, I think the 50 or 55%. Right.

I mean, 20% is 40 care. That's normal, right? and then typically it's an additional 35% for cuts that we are targeting customers which would have normally only bought 40 care. So that's, I think, the beauty here. And then upsell from there if customers like 40 SASE.

And the 35% is for the SASE starter?

No, no, no. It's the SD-WAN services that make one SD-WAN more efficient. So customers can use SD-WAN within the OS, but then there are certain extra services they can deploy to get more visibility.

Yeah, I hear you. And then when you figure out what the configuration looks like on AI security, there would be another potential uplift off of that 30%. Very good. maybe we'll end here with a question on the trajectory of services revenue. So every quarter, Christian, you get the question on, well, product revenue did this, services revenue did this, there's a lag effect, it's accelerating, it's decelerating. Maybe just a level set for us, how do you structurally think about the growth in services? Could we be in a period of acceleration for what we hear, even though product revenue is likely going to decelerate from the 52%, how do we think about the acceleration cadence for services?

So service revenue is a combination of the product stack, right? Some products have more services and some products have fewer services attached and then also the unattached services. I think Fortinet is attaching. First of all, we sold more FortiGates and Ken has been talking about all the markets that we are playing in. So I think the growth for FortiGates will continue to be there, which allows us to attach more services. We are launching new services, and we also have newer software, like with the 4DAI gate, which is sold as a software subscription, which then also increases our ability to attach services. So I think we're preparing for more service growth, right? But some of it comes with additional hardware growth, and some of it is attaching more to existing infrastructure.

Fantastic. I think we can leave it here. Please join me in thanking Ken and Christiane for their time. Thank you so much.