Good day, and thank you for standing by. Welcome to the Fortinet first quarter 2022 earnings call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question- and- answer session. To ask a question during the session, you will need to press star one on your telephone. Please be advised that today's conference is being recorded. If you require any further assistance, please press star zero. I would now like to hand the conference over to your speaker today, Peter Salkowski, Vice President of Investor Relations. Please go ahead, sir.
Thank you, Laurie. Good afternoon, everyone. I'm pleased to welcome everyone to our call to discuss Fortinet's financial results for the first quarter of 2022. Speakers on today's call are Ken Xie, Fortinet's Founder, Chairman, and CEO, and Keith Jensen, our Chief Financial Officer. This is a live call that will be available for replay via webcast on the investor relations website. Ken will begin our call today by providing a high- level perspective on our business. Keith will then follow and then review our financial and operating results for the first quarter before providing guidance for the second quarter and updating the full year. We will then open the call for questions. During the Q&A session, we ask that you please keep your questions brief and limit yourself to one question to allow others to participate.
Before we begin, I'd like to remind everyone that on today's call, we will be making forward-looking statements, and these forward-looking statements are subject to risks and uncertainties which could cause actual results to differ materially from those projected. Please refer to our SEC filings, in particular the risk factors in our most recent Form 10-K and Form 10-Q, for more information. All forward-looking statements reflect our opinions only as of the date of this presentation, and we undertake no obligation and specifically disclaim any obligation to update forward-looking statements. Also, all references to financial metrics that we make on today's call are non-GAAP unless stated otherwise. Our GAAP results and the GAAP to non-GAAP reconciliations is located in an earnings press release and in the presentation that accompanies today's remarks, both of which are posted on the investor relations website.
Ken and Keith's prepared remarks today for the earnings call will be posted on the quarterly earnings section of our investor relations website immediately following today's call. Lastly, all references to growth are on a year-over-year basis unless noted otherwise. I will now turn the call over to Ken.
Thanks, Peter, thank you to everyone for joining to this call to review our outstanding first quarter 2022 results. Our better than expected first quarter results demonstrate a strong demand of our cybersecurity innovation. Total revenue growth of 34%, driven by record product revenue growth of 54%. Total billings increased 36%. Our strong result reflect new order that was significantly greater than anticipated, partially offset by an increase in backlog. As a result, bookings increased 50% year-over-year to $1.276 billion, which included booking growth from SD-WAN of 54%, Global 2000 growth of 61%, OT growth of 76%. For the quarter, net new backlog was 9% of bookings as we continue to navigate a challenging supply chain environment.
We believe that the hybrid network is here for the foreseeable future, and Fortinet is pushing the boundary of what is possible with innovation to enable customers to successfully operate in today's elevated threat environment. Our solid performance and the market share gains are being driven by our effort to make our customers' entire infrastructure more secure and integrated in a zero-trust network. Fortinet's Security-Driven Networking approach converges networking functionality with security capability fueled by our powerful FortiASIC SPU to provide the best performance and a rich functionality. The new FortiOS 7.2 offers multiple new and enhanced services across FortiGuard, FortiCare, and FortiTrust, such as ZTNA, identity, inline sandboxing, advanced device protection for OT and IoT environments, ISAC as a service, and inline CASB. Fortinet provides one of the broadest security services offering on average of half the cost compared to our main competitors.
In addition, we have prioritized our most organic research and development efforts on integrating security products into a centralized FortiOS fabric platform, which Gartner refer to as a cybersecurity mesh architecture. Today, we announced a new suite of FortiGate powered by our FortiASIC SPU. The FortiGate 3700F, 600F, and 70F deliver high- performance converged networking and security with Security Compute Rating of five times on average better performance than competitive offerings. During the quarter, we are pleased to receive the Gartner Peer Insights Customers' Choice for both WAN infrastructure and next- generation firewall for three years in a row. Our innovation positions Fortinet as one of the most influential cybersecurity leaders. These growth drivers and organic innovation is accelerating our growth potential to new level.
Before turning the call over to Keith, I would like to thank our employees, customers, partners, and suppliers worldwide for their continuous support and hard work. It is their collective effort and the trust that will contribute to Fortinet's strong growth and the market share gains.
Thank you, Ken, and good afternoon, everyone. Before adding to Ken's comments and going into more detail on our Q1 financial results, I'd like to briefly discuss a wording change in how we describe our business.
FortiGate is now referred to as the core platform, and non-FortiGate is now referred to as the platform extension. This change helps to emphasize the importance of our FortiOS operating system. FortiOS drives our entire security platform across multiple platform extension use cases, including zero trust access, cloud security operations, and secure networking. With that in mind, let's start the more detailed Q1 discussion. Customer demand was again strong and broad-based across geographies, customer sizes, industries, use cases, and security solutions, reflecting three key demand drivers: the elevated threat environment, convergence of security and networking, and customers consolidating across our platform offerings. These key growth drivers are contributing to our strong results in accelerating pipeline growth. In short, we believe we're in a period of sustained high growth for the cybersecurity industry and Fortinet.
Moving to the Q1 financial results, total revenue of $955 million was up 34%, driven by record product revenue growth of 54%. Taking into account an $80 million sequential increase in product backlog, product bookings growth was 87%. Product revenue growth was broad-based, with core platform and platform extension product revenue growth at 50% and 59%, respectively. While we continue to see robust product growth from our SD-WAN and operational technology, or OT, the core platform product revenue growth was mainly driven by the wide range of other use cases embedded in our operating system. Service revenue was up 24% to $584 million. Support and related services was up 26% to $271 million, while security subscription services revenue was up 23% to $313 million.
To offer one observation about how customers may be responding to the supply chain challenges, we are seeing indications that a subset of customers place product orders further in advance and may have delayed purchases or registrations of the related service contracts. This, together with the timing differences related to product and service revenue recognition, creates a lag between product and service revenue growth rates. We expect quarterly service revenue growth to accelerate throughout the rest of the year. As summarized on slide six, total revenue in the Americas increased 32%. EMEA revenue increased 25%, and APAC posted revenue growth of 57%, which includes the contribution from Australia. EMEA's growth includes the impact of suspending operations in Russia. Nonetheless, EMEA easily exceeded their internal targets.
Looking forward, EMEA's pipeline growth indicates continued strength in our EMEA business, despite the situation in Eastern Europe and its potential impact on European economies. Platform extension revenue grew 49% and accounted for 34% of total revenue, up 3 percentage points. Moving to bookings, backlog, and billings. We are experiencing exceptionally strong demand that continues to exceed supply by more than historical norms. Bookings were up 50% to $1.3 billion, reflecting exceptional demand and a $116 million quarter-over-quarter increase in total backlog, bringing backlog to $278 million. Larger enterprises continue to favor Fortinet's industry-leading cost-for-performance advantage and are increasingly more appreciative of our integrated platform strategy. The platform strategy allows customers to converge networking functionality with security capabilities and consolidate multiple point products. The following key metrics illustrate growing demand from enterprise customers.
Global 2000 bookings were up over 60%. Large enterprise bookings were up over 65%. Secure SD-WAN bookings grew 54%, reflecting the convergence of networking and security, as well as a strong economic case. OT bookings were up 76%, illustrating the continued response to the elevated threat environment. As a reminder, backlog is excluded from the current quarter billings and revenue. However, it is expected to provide increased visibility and a top-line tailwind in future quarters. At $1.2 billion, billings were up 36%. Core platform billings were up 30% and accounted for 67% of total billings. As shown on slide seven, high-end FortiGates posted very strong billings growth with a mix shifting 6 points towards high-end appliances. Platform extension billings were up 50% and accounted for 33% of total billings, up 3 percentage points.
Average contract term was consistent year-over-year and down one month sequentially at 27 months. Moving back to the income statement, total gross margin was 74.4% as the revenue mix tilted 5 percentage points to product revenue from higher-margin services. Product gross margin of 57.4% reflects the impact of component and freight cost increases, as well as higher, less predictable component expedite fee expenses, and the impact of consolidating Alaxala's results. Service gross margin of 85.2% was impacted by Alaxala, costs associated with the expansion of our data center footprint, and increased labor costs. Operating margin of 22% exceeded the midpoint of our guidance range by 200 basis points due to increased sales productivity and efficiencies in other OpEx areas, offsetting the gross margin decline. Headcount increased 26% to 10,860.
Moving to the statement of cash flow summarized on slides eight and nine. Free cash flow was $273 million, representing a margin of 29%. Capital expenditures for the quarter were $123 million, including $93 million for real estate investments. Adjusted for real estate purchases, our free cash flow margin was 38%. Our capital expenditure strategy includes investing in cloud and data center infrastructure, as well as our office and warehouse capacity to support our higher levels of growth. We repurchased approximately 2.3 million shares of our common stock for a cost of $691 million. At the end of the quarter, the remaining share repurchase authorization was approximately $830 million, with the authorization set to expire in February 2023.
Inventory turns at 3.5x were up nearly 1.5x year-over-year. Now let's spend some time reviewing backlog in a bit more detail. As I mentioned earlier, very strong demand drove a $116 million increase in total backlog to $278 million. To put this in perspective, total backlog at the end of the first quarter was approximately 6% of our trailing 12- month total billings. We shipped 60% of the Q4 ending hardware backlog in the quarter. Consistent with prior quarters or prior quarter, 73% of the backlog relates to expected future product shipments, while the remaining 27% relates to various services. We believe our backlog is very strong and should provide a billings and revenue tailwind to grow in future periods.
There are several reasons and comments we make to support our view, including existing customers account for 93% of our backlog, and no single end customer accounts for more than a low single-digit percentage of backlog. There are 10 deals in backlog, nine are from existing customers, with a remaining balance of over $1 million, that together account for less than 10% of total backlog. Remaining balance is defined as the original order amount less the partial shipments we've made. Just 5% of Q4 backlog was canceled in Q1, suggesting that double ordering is not a significant contributor to our backlog. We do not believe that customers are meaningfully pivoting to software form factors from hardware, as software is frequently a more costly option and may require architectural redesign and investment, and changes in form factors and other equipment beyond just the firewalls.
We believe our competitors are similarly impacted by the supply chain. Finally, more customers are accepting the supply chain challenges and working with us to mitigate the issues by switching products, adjusting deployment schedules, and accelerating evaluations of new products. Similar to others, we are experiencing ongoing supply chain challenges. Our responses to these challenges include significantly increasing inventory purchase commitments, redesigning products, qualifying additional suppliers, and working closely with our suppliers to further enhance our resiliency and mitigate the effects of disruptions. We expect supply chain constraints to be challenging throughout the remainder of the year. As a result, we expect component and logistics costs to remain elevated and backlog to increase through the course of the year. As we balance our pricing actions with the opportunity for continued market share gains, we have passed along most, but not all, cost increases.
As such, we expect ongoing pressure to gross margins. While the situation is very dynamic, we believe we will have access to sufficient inventory to meet our guidance. The outlook is also subject to the disclaimers regarding forward-looking information that Peter provided at the beginning of the call. For the second quarter, we anticipate bookings in the range of $1.325 billion-$1.385 billion, which at the midpoint represents bookings growth of 40%. We expect billings in the range of $1.225 billion-$1.265 billion, which at the midpoint represents growth of 30%. Revenue in the range of $1.005 billion-$1.035 billion. Non-GAAP gross margin of 74.5%-76%.
Non-GAAP operating margin of 22%-23.5%. Non-GAAP earnings per share of $1.05-$1.10, which assumes a share count of 165 million-167 million. We estimate second quarter capital expenditures to be between $75 million-$85 million. We expect a non-GAAP tax rate of 17%. For the full- year, we anticipate backlog could approach or possibly exceed $500 million and expect billings in the range of $5.5 billion-$5.58 billion, which at the midpoint represents growth of 32.5%. Revenue in the range of $4.35 billion-$4.4 billion, which at the midpoint represents growth of 31%.
This assumes the current supply chain environment remains constrained throughout the year. Total service revenue in the range of $2.64 billion-$2.7 billion, which represents growth of approximately 28% and implies full- year product revenue growth of approximately 36%. Given our current view of component costs and other supply chain pressures, we expect a non-GAAP gross margin of 74%-76%, non-GAAP operating margin of 24%-26%. Non-GAAP earnings per share of $5.00-$5.15, which assumes a share count of between 166 million and 168 million. We estimate full- year capital expenditures between $270 million and $300 million. We expect our non-GAAP tax rate to be 17%. We expect cash taxes to be approximately $260 million.
Lastly, I want to remind everyone that we'll be holding an Analyst Day on May 10th, coinciding with Accelerate 2022. A link to register for the webcast is located on the events and presentation page of Fortinet's Investor Relations website. Along with Ken, I'd like to thank our partners, customers, suppliers, and all members of the Fortinet team for all their hard work, execution, and success. I'll now hand the call back over to Peter to begin the Q&A.
Thank you, Keith. As a reminder, in the Q&A session, we ask that you please limit yourself to one question to allow others to participate. You can always come back into the queue. We're gonna test that theory on the first Q&A we're gonna take here. Operator, we can open the line, please.
Yes. As a reminder, to ask a question, you will need to press star one on your telephone. Again, to ask a question, that is star one. Our first question is from Fatima Boolani from Citi. Your line is open.
Good afternoon. Thank you for taking my questions. Keith, the question for you is on the product revenue performance quarterly, one of the more standout metrics among others in the print. You gave us a sense of the top-down dynamics that are helping with respect to demand environment, the threat environment, and consolidation activity as it relates to discrete products. From a bottom-up or a more micro perspective, can you talk to us about the net impact of the pricing increases that you've realized in the quarter? And if you can speak to linearity in the quarter, if there might potentially have been some acceleration or pull forward of demand that you might have seen later on in the year. Thank you.
Yeah. Yeah, I think the color I can offer on that is I think linearity was again strong in the quarter. We've been seeing strong linearity for probably four quarters in a row now, you know, measuring month one versus month two. We've talked before about the price increases. I think we've talked previously that after discounting, you probably get 55% or something like that. Pardon me, you get 45% afterwards. You know, that was probably a little bit optimistic on my part to think I was gonna get 45%. There was a little more discounting than maybe I anticipated through that process. I forgot your third area that you mentioned. I didn't write it down, Fatima, I'm sorry. Linearity pricing, something else.
That's good enough. Thanks.
Okay. Thank you.
Thank you. Our next question is from Brian Essex from Goldman Sachs. Your line is open.
Great. Thank you very much for taking the question, and congrats on the results, really impressive acceleration. You know, maybe for my one question, I'll commit to keeping to that. Would like to know where you're seeing. You've got some nice traction upmarket, it seems. I'd like to know how we should think about products as you go upmarket, as well as services, the margin involved. Maybe if you can hit on lead times as well. I've heard you've done a pretty good job of keeping lead times much lower than your peers. Is that winning you business upmarket substantially, you know, as you go to market?
Definitely, the Fortinet operations team did a very, very good job. Also, the model we have working with the manufacturer, doing our own ASIC chip directly, is also helping. That's where, compared to a lot of other vendors using, like, third-party off-the-shelf supply, which is more difficult to deal with the current supply chain issue. We do see, like, with the price increase sometime, like as Keith mentioned, there's some stronger request for some discount and which also, we have actual discount, probably the discount easier to go through product side than compared to the service side. There's a certain revenue recognition rule. We cannot discount service too much.
Also, since we have a very strong product, we use our Security Compute Rating, that's where for the same cost, same function, our performance tend to be 5 times better than competitors. We do have a market pricing power, which convince customer to move towards our product. Same time, same thing for the service. We do offer a very broad service, similar or better than competitor, but we probably only charge about average about half, especially with all the bundle all the things. That's where we do have the pricing power both on the product and the service. That's where steer customers during this time to move towards our solution.
Also, there's a lot of new use cases which our competitors don't have a new solution, like the SD-WAN, whether to go to OT with some other product, which also drives quite a lot of additional growth for us in that.
Yeah. I'd probably offer a little more color to behind Ken's comments there, if I could, Brian. I think, you know, if you think about the market, you know, let's take the networking equipment, switches, and access points. You know, I think the constraint exists all around the board, if you will. I don't know that us versus your more traditional networking companies have any more availability in those products than anybody else. You know, when we look at our backlog, you know, that mix seems to certainly support that. You know, firewalls, you know, I don't see a lot of customers switching over availability. I offered the comment earlier in the script, the prepared remarks, that 93% of our existing backlog, or pardon me, of our backlog is with existing customers.
There are 77% of new logos information in that number, not a very big number. If I look at new logos in terms of the billings and accounts that we got from the quarter, you know, it was very, very normal in terms of both the billings and the new logos. I think we're about 5,500 or so in new logos. Yeah, I don't really, you know, see that, if you will, as the concern. If I can pivot back to that, I mean, just quickly, I think your final question was about pull forward, and I suspect it'll come up again.
Again, I think if we were seeing that in light of these tremendous results, I don't think I'd sit here and see a pipeline with such a significant growth as what we're seeing. I don't really know that I would describe this as any sort of pull forward. Are there customers, large enterprises that came to us and placed orders for longer period deployment schedules? You know, certainly, and I think some of the comments in the script cover that.
Great. Thank you.
Uh-huh.
Thank you. Our next question is from Saket Kalia from Barclays. Your line is open.
Okay, great. Hey, guys. Thanks for taking my question here. Maybe a question for both of you, Ken and Keith. You know, I feel like we've talked a little bit about some of the redesign efforts with some of the newer appliance families recently. I was wondering if you could just talk about some of those efforts, you know, that Fortinet has done to maybe help ease some of those supply chain issues, and how helpful those changes could be in terms of fulfilling the demand that you're seeing.
Yeah, we started the redesign effort end of last year based on the supply restrictions. You can see the product we announced today, the FortiGate 70F, and even the FortiGate 600F, probably would move to like a kind of redesign. Then some of them also leverage our new FortiASIC chip. That's really helping customers have a different choice if certain products have some shortage. But also in general, we have a much broader product, both in the we call the core platform, FortiGate core platform, and also the platform extension. That gives customer much better choice. If certain products have shortage, they can easily steer to the next product but still offer a much better solution compared to other competitors.
That's where the redesign is actually helping a lot to reduce the supply chain limitation we have and also give customers more choice. We kind of we're keeping that effort and keeping offer of our broad product portfolio, and which we do feel during the supply chain issue maybe what will last through to the whole year this year will be definitely helping us and helping customers.
Very helpful. Thanks.
Thank you.
Thank you. Our next question is from Adam Borg from Stifel. Your line is open.
Great, thanks so much for taking the question. Either for Ken or Keith, I'm sorry if I missed it, but you know, in the past few quarters, you've talked about increasing traction in some of your non-traditional verticals. I was just curious how they performed this go around. Assuming you saw continued traction there, how are you thinking about making any additional investments to just better capitalize on the opportunity there? Thanks so much.
Yeah. Peter's got me on a word limit on the script, so I apologize that got taken out because I thought it was a worthwhile comment. In any event, yeah, we got more of the same. You know, we've been looking at about a three- or five-point shift to that other group. The other group is everything outside the top five. We got that again in the current quarter. You know, I think that if you look at that other group, the one vertical that continues to stand out, and I don't think it's surprising when you think about it, has been manufacturing. I think that really speaks to, you know, the threat environment, ransomware, OT, things of that nature.
You know, manufacturing is trying desperately to break into the top five of our verticals, and it's getting closer and closer every quarter.
Great. Thanks so much.
Uh-huh.
Thank you. Our next question is from Jonathan Ho from William Blair & Company. Your line is open.
Sorry about that. Had myself on mute. Yeah, this is John Weidner with Jonathan Ho. Thanks for taking my question. If I heard you correctly, when you mentioned use cases, SD-WAN, and OT, did you say that the other use cases contributed more to growth or just grew faster?
The SD-WAN, the OT definitely grow faster than the overall company base there.
I think the growth rates were faster, but the total contribution was greater in the other use cases, if we're trying to parse there.
Yeah. Also, the other prices
Okay.
Also have growth averages.
Okay. I just want to clarify that, and I'm hoping that doesn't count as actually my question, but I'll make it easier, one for my question. R&D spending going forward, what are your intentions? Do you anticipate any stepped- up investment, or do you anticipate pretty much typical what you've done in the past? Thank you.
We kind of view the real estate as kind of considered some long-term investment. We started doing that like 10, 15 years ago. It ends up our rental cost probably less than half compared to competitor similar of our size. So that's where the $100 million we save every year, probably where we're putting both the real estate and also the R&D, some other investment. Sorry, I misunderstand. As R&D is not real estate. Yeah, the R&D definitely we'll continue to invest in a lot of long-term R&D projects. It's a, yeah, from the ASIC, which we made the investment more than 20 years, give us a huge advantage on technology.
It enables us to pretty much become the only vendor that can meet this convergence of a security networking trend to offer our high-speed security, whether inside the company in one solution, you know, within the data center. You drive tremendous growth, and also much better, we call the Security Compute Rating, and also the service, which, with a large quantity of product being deployed, we can offer the service much cheaper than competitors for the same service. That really drives a huge value add to the customer.
Yeah, I think from a business model viewpoint, I think we kinda like where we're at with the level of investment that we're making in R&D. You know, we can move by a point or two, you know, in a given period. Yeah, and if you peel back the onion a little bit and just look at the R&D team, you know, there's certainly a significant number of engineers and percentages that are working on the ASIC and the chips and so forth. But I would also offer that we have more software engineers than we do hardware engineers. I think the reason for that is it goes back to some of the early comments in the text about how important the operating system is to us. The ASIC enables the operating system. They have to work together.
There's a significant investment there. I think also the other places, you know, with some of these, platform extensions, using the right term, we're seeing, you know, the opportunity there, I think, to make some more discrete investments and maybe mature some of those products along a little bit more. Just not suggesting significant changes in total spending, but just giving some insights in terms of where we see spending.
That's very helpful. Thank you very much.
Thank you. Our next question is from Michael Turits from KeyBanc. Your line is open.
Hey, guys. I was interested in the comments you made about the strength of hardware and not seeing form factors switch over significantly to software, and obviously, your product numbers were great. Can you talk about, and I know you've done it before, but both Keith and Ken talk about that, the sources of the hardware appliance security demand, and what those sources are, and really how sustainable that strong growth should be for how long into the future?
Look, I think, you know, you got to be a little bit bullish for this. I think the high-end FortiGates, you know, taking six points of market share is a pretty good indicator. Obviously, the high-end FortiGates are very much targeted at large enterprises, and I think that dovetails very nicely with some of the growth numbers that we gave on Global 2000 and on the large enterprises as well. You know, I still think that that's an opportunity for us where we have sometimes not always been viewed as the incumbent. I think if you look at our progress over the years, you know, in the enterprise sector, particularly in the U.S., which maybe has a little further to go, we're very, very pleased with that.
I would maybe supplement that, you know, in terms of that enterprise success with a metric that we've talked about from time to time in the past. I think maybe three or four years ago, we talked about in the U.S. of having an account rep ratio of about 65 accounts to one rep, in the U.S., and that's not really an enterprise model. We made a comment, you know, that continuously that we would work to move that number down, within the framework of balanced growth and profitability. That number today is about 13 or 14 accounts per rep. I don't think it's a coincidence that you're seeing the success in the large enterprise with the larger appliances, given the level of investment that we've been able to make in that segment of the market.
Yeah. Also, from our beginning, we more look at how to secure whole infrastructure, especially certain area, in the past, whether in the high-speed environment or kind of a branch or remote SD-WAN access. It's very, very difficult to involve in security because the speed requirement, because all these kind of difficult to manage. That's where we see with our own ASIC and the long-term investment from the ASIC, which will enable us to really get into this new area the traditional network security cannot solve. That's where we see huge growth in this area. At the same time, we keep promoting, we call the convergence of network security.
That's where, with the additional computing power from ASIC, and also the new FortiOS upgrade every year. We do see more and more security use cases and more security being deployed in the whole infrastructure, just beyond the traditional network security deployment.
Operator, next question, please.
Yes. Our next question is from Hamza Fodderwala from Morgan Stanley. Your line is open.
Hey, guys. Thank you for taking my question, and thanks for all the great detail earlier in the call. Keith, maybe one for you. Just, you attributed the gap in the product and the services growth to customers, at least a slight uptick in early ordering versus last quarter, it sounds like. I think that you mentioned that about 60% of the hardware backlog that you had in Q4 was built in Q1. So, in terms of your Q2 billings guide, how do you think about that backlog- to- billings conversion, you know, particularly in a perhaps less certain macro environment and perhaps a little bit more of an uptick in early ordering?
Yeah. I think this is related to how we think about what the backlog might mean. We've just to remind people, we made the switch, I think, in the middle of fourth quarter, asked our sales team to run the business on bookings, and then we would convert it to billings here, which means working very, very close with our manufacturing team and our operations team in terms of what they're seeing in terms of availability and what levers they have to pull. With that in mind, you know, I think the key now. Let me put it this way, I spend a lot more time with operations as part of the forecasting guidance process than I do with the sales team.
Where we've kind of settled out on that is that I get a weekly update from the sales team in terms of, you know, what their expectations of backlog are going to be, and we've been doing that every week this year, and I think some of last year. They've shown to be fairly darn accurate. You know, I think that what you see right now in the first quarter was very high bookings, you know, which drag along some backlog. I think that, you know, the operations team has done a very good job. One thing that we do now use is this concept of how much was net backlog increase as a percentage of bookings.
That number has hovered right around 8.5%-9% in the fourth quarter and the first quarter. When we wanna sanity check, you know, what we're hearing from the operations team, we now have a metric that we didn't have six months ago in terms of a little bit of history, and we apply that metric to it and say, or does that seem reasonable? For all their hard work when you get done, does that seem like it's a reasonable number? We think it has been.
Thank you.
Yeah.
Thank you. Our next question is from Adam Tindle from Raymond James. Raymond James, your line is open.
Okay, thanks. Good afternoon. Keith, I just wanted to ask a question to try to get to the heart of real-time demand, and certainly appreciate all the disclosures you've been giving. I'm looking at bookings. Obviously, it's been strong on a year-over-year basis, but from Q4 to Q1 sequentially, it was kind of the same level of increase as last year. If I heard you correctly, you can correct me if I'm wrong, but I think your guidance for Q2 bookings implied maybe down a little bit sequentially. I'm wondering if that's starting to signal that we're plateauing on incremental growth and demand and returning to a new or a more normal orders cadence.
Yeah. I think I probably wanna check the numbers. I'm looking at bookings number in the first quarter was about $1,275, and a bookings number in the second quarter that I think we talked about being at the midpoint, $1,355. So I don't know that I'm seeing a deceleration as that you may be concerned about.
Okay. I misheard you on the Q2 guidance. I was just looking at-
Okay.
From Q4 to Q1. Maybe another one to tackle while we're at it. You talked about the seasonality shift last quarter, 2 points-3 points to the back half of the year. Looks like that might be a little bit more smooth based on the updated Q2 guidance and full- year guidance. Maybe just what changed on that, expectations for a back half versus now.
Yeah. I think where we ended up on the full- year number, you know, through all the analysis that we do, you know, I think the raise for the full- year is roughly the beat that we had in the first quarter, plus the raise that we had in the second quarter. You know, and you know, we sanity check that with looking at our pipeline growth, our sales capacity, what we think the price increases are gonna deliver, some more metrics around the backlog and wanna make sure that we've, you know, we're not getting too far ahead of ourselves and over our skis. I think that's a pretty good number to be at right now in the current environment.
You know, there remains a lot of uncertainty, as you know, out there, and getting overly bullish on Q3 and Q4 right now. I think we'd like to see how this plays out a little bit more.
Understood. I'm looking forward to the Analyst Day. I'm sure Peter will plug it.
On that note, next question, please.
Thank you. Our next question is from Andrew Nowinski from Wells Fargo. Your line is open.
Great. Thank you, and congrats on a nice quarter. I just wanna ask about your pipeline because this is the second quarter in a row that you've talked about pipeline strength. You know, at the end of Q4, I think you said you had a strong pipeline entering 2022, and now you're saying you have an accelerating or you're seeing accelerating pipeline growth. I'm just wondering if you could put a finer point on that accelerating growth comment and where you're seeing that growth accelerating. Thanks.
Yeah. I think it's pervasive, right? You know, we look at the three different sources of pipeline, the way we talk about the channel, the marketing team, and the direct sales force. You know, I think we're pleased with the contribution from all three of them, no doubt about that. You know, we've talked for an extended period of time, a few years, about the importance of the channel and investments that we make in partnering with them and working together on that. You know, I think that the channel's holding up their side of the bargain as well. You know, I think the marketing team, I give them a ton of credit.
I love the Fortinet Championship event and the continued success for it and how they've now leveraged that in other geographies as well. The direct sales team continues to perform at a very high level, and you're seeing their numbers. Obviously, you know, to the extent that you were able to continue to add headcount, like the metric I gave earlier, you know, more people are gonna drive more pipeline. I don't know that I would isolate it to any one thing or any of those one- thing areas of where it's coming from, or even geographically. I mean, it's been strong throughout. Ken, I don't know.
Yeah, agree. Yeah, both additional investments we made in the marketing sales, and also we structure the team, make it more efficient and drive quite a lot of additional pipeline for us.
Okay, got it. Thank you.
Thank you. Our next question is from Ben Bollin from Cleveland Research. Your line is open.
Thanks everyone. I appreciate you taking the question. I was hoping you could address a little bit about how you view service opportunities longer- term. You suggested, you know, you're expecting some catch-up or acceleration on services through back half based on, you know, backlog lead times, procurement. Interested in how you think the elevated level of appliance placements this year could influence demand for services even beyond 2022.
Yes, it's a great question. We do see the service will drive additional growth, additional margin for us going forward, especially the new FortiOS 7.2 will offer quite a lot of new service. A lot of services today, we don't charge customer. Also, on average, our service cost is about half of our main competitors. There's a lot of room we can grow the service and improving the margin there. That will be. With the other, we call the platform extension product, which is upsell, cross-sell, which will also kind of drive quite a lot of additional service on the total solution there.
That's why we do believe the service is. I think it's in Q1 you see the product revenue grow so strong and, on the other side, the short-term service revenue also very, very strong. That's probably starting to come in later this year. The same time, the new additional service we launch with FortiOS 7.2, like the FortiTrust on the ZTNA, on identity, there's some other service, the CASB, some other we have. We do believe will be additional revenue, additional sales, additional margin for us.
Ben, it's Keith. Just from a modeling point of view, keep in mind that, you know, those price increases that we had in the second half of last year and the first quarter of this year, that we get that lift in product revenue immediately. It takes a little bit longer to see it in the services line because of how the timing of Revenue Recognition. I mean, I think you're gonna start to see, you know, between new sales and renewals, you know, the new price points that have been created for the services will start to have an impact, and that's part of the acceleration that we talked about.
Great. Thanks, guys.
Thank you.
Thank you. Our next question is from Rob Owens from Piper Sandler. Your line is open.
Hey, guys. This is Justin on for Rob. I just wanted to follow up on the OT topic. You guys have quantified the success in selling into this use case for a couple of quarters now. I'm just curious how you view the OT as a driver into 2022 and beyond, especially when you consider the explicit federal government guidance and broader spending intentions around protecting critical infrastructure.
Yeah, the OT definitely we see is a bigger market going forward, probably bigger than SD-WAN, which we see pretty strong growth and also. That's where the total OT starting catching up. I think last quarter. Right now OT may be close to 10% of the business, and but the growth is very strong. That's where we do see a lot of potential, and we also invest a lot in this area to meet the demand.
Got it. Thanks.
Thank you.
Thank you. Again, if you would like to ask a question, please press star one on your telephone. Our next question is from Gray Powell from BTIG. Your line is open.
Great. Thanks for taking the questions, and congratulations on the really strong results. Yeah, I guess I was just hoping to drill in on the SD-WAN side. How should we think about the growth of your SD-WAN business this year, with just within the context of guidance or maybe, you know, relative to the overall company growth? Then how do you feel about the competitive environment in that category, and just your ability to maintain growth at or above market rates, the next few years?
Yeah, first I think the SD-WAN will continue to grow like 30%-40% year-over-year in the probably next five years. Because it's a technology that definitely can route traffic-based applications, all these things. It's a very big benefit for the customer. So for us, we offer the only security combined with SD-WAN and also leverage own ASIC to have a huge performance advantage and give us more function. So that's where. The SD-WAN we sell is a part of the platform, the FortiGate platform. We don't even charge the service, but that's also additional compared to our other vendor, they do have some kind of service charge related to SD-WAN.
We do see we have a huge advantage both on the function and the cost in the SD-WAN. We'll continue keeping gaining market share. We do feel we'll be keeping growing above the market growth. We feel this is the part that we call convergence of security and networking together. SD-WAN is more addressed on one side, but also we're helping drive the LAN side inside the company, the segmentation inside the data center, and eventually make the whole infrastructure more secure for the customer.
Understood. That's really helpful. Thank you very much.
Thank you.
Thank you. Our next question is from Irvin Liu from Evercore ISI. Your line is open.
Hi. Thanks for the question. I was surprised to hear that 93% of backlog is from your existing customers, but I was wondering if you can help us parse through some of that strength within your existing customers. How much of this is
Addressing the broader growth of their IT workloads and more attack surfaces versus a like-for-like growth in or versus, let's just say, installed base refresh. Is this more of you displacing other vendors within your current customer base?
Yeah, I don't. I can't really quantify it, or I just haven't looked at it that way. It's a good question, a good approach. You know, if I were to make informed judgments, if you will, you know, I think that expansion is by far the largest opportunity for us. You know, it's just the nature of the business. I think the refresh and the competitive displacements are probably fairly close to each other, I would imagine, for the remainder. Refresh for us is, you know, we have a very long product suite, so we tend to always have a new product. You saw the three new products come out, being announced today. There's always some sort of refresh activity in our own product list going on there.
I would also note that we are consistently getting more at- bats, if you will, more opportunities with sales for competitive displacement. I would imagine just, you know, my gut is, again, refresh and competitive displacements are probably in a similar neighborhood, but expansion is the biggest.
We have the biggest customer installation base in the industry. We have probably close to 40% of total hot spots deployed in the industry, probably more than the number two, number three, number four add together. That gives us a quite broad customer base, and I think it's close to 600,000 customers. Some of them may only using Fortinet solution in part of infrastructure. We do see the benefit expand to the additional infrastructure and also whether we call fabric or mesh network, or manage together. We do see a lot of expansion beyond the initial deployment.
Thank you. That's helpful.
Thank you.
Thank you. Our next question is from Gregg Moskowitz from Mizuho. Your line is open.
Okay. Thank you for taking the question. Keith, just to follow up on early ordering. Last quarter, you had estimated that low single digits of your Q4 business came from products ordered in advance. How would you size this for the Q1? And then just a clarification, if I may, 'cause obviously the backlog went up very impressively. Are switches and access points still about 2/3 of your backlog today? Thank you.
Yeah. I think the backlog is getting closer to 50/50 between networking equipment, or I guess I should call it platform extension, because it's in there, and the firewalls or the core platform. I think it's kinda balanced out. I do think it's low-end FortiGates that are still dominating in the Fortinet space, if you will. I don't remember quantifying early ordering as a percentage, if you will. It's certainly something we've talked about here internally as our way of measuring that, and I think that's, you know, why we've kind of provided. Peter's gonna give me some coaching here.
Well, I think what we said in the fourth quarter last year was that we knew of some transactions, a couple of deals that we knew were gonna be ordered in or that'd be delivered into 2022 that were ordered and they're part of backlog and were in the backlog in 2021 at the end of the year. That was a few, a couple of other million-dollar deals is what we're referring to.
Yeah. Look, I think the constraint, if you will, on that is more around when is the supply gonna be available. Because it's in backlog. We can deliver it as soon as the supply arrives, but it's more a function of how we're, you know, working with our suppliers than anything else.
That's helpful. Thank you.
Mm-hmm.
Thank you, Gregg.
Thank you. There are no further questions in the queue. Do you have any closing remarks?
Thank you, Laurie. I'd like to thank everyone for joining us on the call today. As a reminder and a plug, Fortinet will be hosting an Analyst Day on Tuesday, May 10th, next week. A link to register for the webcast can be found on the Events and Presentations page of the company's investor relations website. If you register now, it's just a little quicker next Tuesday. You can also register day of. Again, thank you very much for your time. Appreciate the interest in Fortinet. Everybody have a great day. Take care. Bye-bye.
Thank you. This concludes today's conference call. Thank you for participating. You may now disconnect.