Good afternoon, everybody. Hope everyone's doing well. My name is Hamza Fodderwala. I'm the U.S. cybersecurity analyst here at Morgan Stanley, with me, I have the pleasure of having the team from Fortinet. We have Chairman, CEO, Founder of Fortinet, Ken Xie, as well as Keith Jensen, the CFO. I'll make a brief programming note on my end before I shift it over to Keith for the safe harbor. For important disclosures, please see the Morgan Stanley Research Disclosure website at www.morganstanley.com/researchdisclosures. I'll switch over to you.
See if I can be as quick as you are, Hamza. Hamza, I'd like to remind everyone that we may make forward-looking statements during today's fireside chat. These forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially from those projected in these statements. Please refer to our SEC filings, and particularly the risk factors in our most recent Form 10-K and Form 10-Q and to other reports we may file from time to time with the SEC for additional information on factors that may cause actual results to differ materially from our current expectations. All forward-looking statements reflect our opinions only as of the date of this presentation, and we undertake no obligation and specifically disclaim any obligation to update forward-looking statements. Thank you, Hamza.
Wow, that was quite a mouthful. All right, let's start off. Let's make this a little fun, wake people up. Everyone's worried about the sustainability of product revenue growth, at Fortinet. I think that's the number one question I get. Your guidance implies about 15% product revenue growth, and you've been growing, you know, the last couple of years, high 30s, 40%. There is another vendor here that competes with you that says the market growth rate is low to mid-single digit. Why is that vendor wrong, and why do you think that you can grow much higher than low to mid-single digits?
I do believe the market will grow 10%-20% instead of mid-single digit.
Okay.
Because there's so many new use case for network security, which I have to say, most of them, the other vendor not covering. You can look at the Fortinet solution right now. Even last year, the SD-WAN and OT together contributed 25% or more of our business. That's really the new use case you don't exist in few years ago. The same thing for a lot of, like, internal segmentation, for secure the cloud east-west traffic and the supporting work from anywhere. So there's a lot of new use case beyond the traditional enterprise network security, which kind of only cover how company connect to the internet.
With Fortinet solution, because we not only have all this software approach, but also we very unique have own ASIC chip, which can go to much broader solution there at a much lower cost, better performance. That cover a lot of new use case in the network security. The traditional network security vendor, which most of the software solution running on a general purpose CPU cannot cover. For them, running all the software has to be on expensive server or has to using cloud computing power to cover the software function. We not only have all this software function, but with our ASIC advantage, it's huge computing power advantage from ASIC, that can cover a lot of other area. Like we see SMB today, in U.S., probably less than 20% SMB has any kind of network security coverage.
Now ransomware both target SMB and then for their software solution, very difficult to cover SMB. The same thing for whether the OT space. Most OT device probably have a difficult time to using any software to cover that, whether in the endpoint side or in the network security side. That's where our solution also can cover quite well in the OT area. That's where the huge new user case give us much bigger total addressable market. That's where we see the growth of total network security appliance product will be continue to be 10%-20%. You can look at both on the product revenue on the unit shipment. We have huge advantage there.
Got it. The network security market in terms of units will grow much faster than mid-single digits. Fortinet thinks 10%-20%. The reason for that is 'cause now a greater percentage of that is coming from these secular drivers like SD-WAN, OT, which 25% of your product revenue now growing, I think north of 50%. You have a very big install base, I think close to 700,000 customers, close to 10 million units.
Yes.
What percentage of that has SD-WAN and OT?
We can track in SD-WAN and OT last year by the new deal. When sales something is they voluntarily disclose how much is, I mean, where it's come from, what's the use case, whether SD-WAN or OT. That cover about 25%. For the existing customer, which they don't need to pay extra $1 for SD-WAN, so that case probably also much bigger. We don't quite track in that one. Also right now, we also don't charge an additional service fee for SD-WAN. That's we're going to probably in the future, that additional service revenue for us. If you the percentage they using SD-WAN, probably bigger than the SD-WAN, OT together, probably bigger than the 25%. Also it's a very fast-growing area.
SD-WAN probably like a $3 billion-$4 billion, I mean maybe $4 billion-$5 billion and keeping growing close to 30%. The OT probably bigger market even grow faster. We do see a quite good position in the space.
Got it. Let's talk a little bit about the services revenue. You know, Morgan Stanley, we estimate that for every appliance you sell, you're getting about $0.50 at ARR per appliance for the firewall business. I think some of your competitors are getting much more than that. How do you plan to drive higher service attached, particularly on the SD-WAN side?
Yeah. I think the interesting metric when you look out there, obviously we're very pleased with the service revenue. I think you've seen sequential growth on service revenue that's gone something on the order of by quarter 22%, 24%, 26%. We provided some guidance, I think, that suggests 27% as we look forward. I believe that, you know, as the firewall, we sell two subscriptions to the firewall. One is support, called FortiCare, the other is FortiGuard which are the security updates. As we look at customers today and we listen to CIOs and CISOs about their concepts of consolidation, it's not just vendor consolidation, but it's also consolidation of doing more things on an individual appliance. This is where our FortiGuard bundles come into play.
Really, that's about explaining to not only our customers, but to our channel partners and training our sales team about all the functionality that can now be done in a firewall and how that continues to expand over time. That firewall can either be a physical appliance or it can be a virtual machine.
Yeah, I think first we have a pretty healthy margin, both the service margin, product margin, operation margin. If you look in the service, I totally agree, we charge much less than our competitors. There's a few other area we kind of are keeping adding new function, which also has a potential service revenue like SD-WAN. On the other side, we also go through a lot of this business goes through a channel service provider. We also try to leave them some room to add some additional service for their business there. That's why we do see service will be keeping growing faster than we have in the past because from the product revenue side, we are the number one.
We are ahead of any other competitors, which all this product has a much more new function and that can attach on the additional service. Also, when the service renewal come up, like Keith mentioned, whether the price increase, whatever, also starting catching up that one. That's why we see the margin and the growth of service revenue will be keeping improving.
Got it. Got it. I want to talk a little bit about Fortinet's single vendor SASE strategy. I think Fortinet's view is SASE is a convergence of security and networking. I think others view the market a little bit differently. What is Fortinet's strategy in SASE, number one, and why is Fortinet better positioned to go after that market, given the operating system and the price performance advantage that you have?
I personally view the SASE, like I keep mentioning the last few years, is it has to be much broader, more distribute solution there. I think the good part is, well, it's a service deliver model. Another part is not just limit to the cloud. It also has to be on-premise and also has to be like, that's why we call it universal SASE. Not just for some enterprise, but also can be for like SMB, can be for some other like different vertical space, healthcare, manufacturer, all these other area. The service provider, telecom provider will be a bigger player, will be important partner to offer the same service. We look in the technology also, they're still in the early stage, not quite mature enough.
You need to integrate a lot of SASE function into the same OS, in the same appliance, instead of in the POP, you have a few different machine, 100 different function. That's what making SASE more efficient, especially for a lot of service provider. If you look at today's SASE business there, it's more for certain enterprise using cloud way to deliver that one. Also the, it's quite more expensive compared to on-premise solution there. The same time, kind of a, some cost going forward, also quite expensive compared to whether on-premise or edge solution there. That's why we call the Universal SASE. It has to be more broadly deployed and more like a real-time process of traffic, both on-premise and also in the cloud.
also leverage agent, not just a software agent load on the device, but also the hardware agent. That's why we call the FortiSwitch. FortiAP can be the agent of forward traffic to the FortiGate or the network gateway to process or leverage the infrastructure from telecom service provider instead only vendor their own POP. That's why we see it's a much bigger market with a lot of service provider, telecom provider, cloud provider to be participate and offer their own kind of secure service because they have the customer, their own infrastructure, which costs much less compared to the POP owned by the SASE provider today. And also for us, we do have some POP ourself. We also have a different approach in the POP.
We tend to be more own the POP from the real estate to the connection there, which will be the cost will be half or less compared to you lease or rental the POP from whether some cloud provider or some other one. That's making the whole business model more profit, more efficient. It's similar like some telecom company, cloud provider business model going forward. Instead of short-term, you probably can ramp up quick, but then the cost in the next few years will be very, very high and making most SASE company losing money today.
Okay. Your SASE strategy is partnering with the service provider. Sounds like white labeling through the service provider, as well as you do have POPs to host your own SASE solutions. How many POPs does Fortinet currently have? How many do you expect to have once you've fully built them out?
We have a tons of POP ourself, but also if you count on the facility working with the telecom provider, it's much bigger number, few hundred to 1,000 number there. That's where the partnership we announced in the last few months, whatever, with a lot of telecom provider, and the same time, some new partnership going forward right now, is how to leverage the facility from the telecom provider, cloud provider, and then enable them to offer the SASE using our product. That's where we see the big growth potential there.
How big is the FortiSASE business today? If it's small like when do you expect it to reach generate meaningful billing for Fortinet?
If you look on the number, one vendor, they say in the last six quarter, they say they're the leading vendor in the SASE space. In the last six quarters, they say they have a billion-dollar business there in SASE. For us, that's also count SD-WAN. If you look at our SD-WAN, that using the way they define a SASE, we're much bigger than they are. In the last four, three or four quarter, we have over $1 billion just counting SD-WAN itself, and not even counting on additional software SASE service.
That's why it depend on how you define a SASE, and for us, we do see, like SASE definitely the one use case, especially for certain cloud enterprise solution there, but there's a much bigger use case for SD-WAN solution, for some other service-based solution, and leverage service provider. That's where depend on how you count on the number. Based on the number we have, we're probably also the biggest SASE provider if you count SD-WAN with the other solution there.
I think Ken's covered a lot of ground there, so maybe three quick points. One is, you know, it's all about a single operating system, and then so that with our SASE solution, it's one operating system that we're talking about. Two, if you think about POPs, you know, really not as quite as relevant to us in terms of the count of POPs, because our expectation that we're leveraging the service provider's infrastructure as we go forward.
Three, you know, as you look at the different elements inside of a SASE solution, including SD-WAN and CASB and so forth, if you want to look at just the and call our SD-WAN business a SASE business, you know, from some of the numbers we've given before, you can pretty much reverse engineer that pretty well. That got pretty close to about $1 billion in business last year.
Yeah, if you see the function being processed in the POP, we can handle in the same FortiOS, same FortiGate. We have like 10 million FortiGate in the field. That's always an integrate function, all the SASE function in the same FortiOS, same FortiGate. We even using some hardware agent called FortiSwitch, FortiWiFi to fortify the process. That can be millions of POP. I think it's a, it's a little bit different way we cover the solution, we try to be more working with a partner service provider, it's a much bigger total addressable market and also much more new use case compared to the traditional enterprise, cloud-based SASE solution.
Let's dig in on SD-WAN. SD-WAN, you know, we estimate is about a $1 billion-dollar bookings business for Fortinet. Roughly, I think MPLS spend is about $45 billion annually based on the current pipes that exist out there. I think the SD-WAN market is maybe 10% of that. Do you expect the SD-WAN market to become as big as the MPLS market? Or what percentage do you think it will become of the MPLS market as it exists today?
SD-WAN market is a different kind of study. I'd say probably the number, I'd say, will be maybe around $4 billion-$5 billion last year, and it's still growing close to 30% year-over-year. If you look at all the top five vendor, whether Cisco, VMware, like, whatever, Palo Alto Networks, HP, I think it's, we are the only vendor develop SD-WAN internally and integrate with security solution and also using ASIC to accelerate. So that's why we have the study, like, where it's a huge ROI return benefit, using the Fortinet SD-WAN solution. It's, like eight months, return on kind of investment, and the ROI probably in two years will be 300%.
That's where, you know, early, I'm pretty much confident, I'd say, within the next couple years, we'll be the number one vendor in SD-WAN space. At the same time, there's a lot of additional service we can get come out of SD-WAN and also can kind of drive a lot of additional business there, come from SD-WAN. I think SD-WAN market will be replacing most of the MPLS and also even replace the majority of the routing business there. There's some core routing still need to use router, but SD-WAN, a lot of edge routing, whatever, will be using SD-WAN because much more efficient as per deliver traffic based on application. That's why SD-WAN is pretty much the first protocol you can deploy.
You can route all the traffic based on different application, will be more efficient and will be more cost saving, will be a market solution, especially we develop the technology and also leverage ASIC, lower the cost and add a lot of performance, and same time, more function can be integrated together with SD-WAN.
Got it. you said, 200%-300% ROI when you rip out the existing telco MPLS lines when customers deploy SD-WAN?
Yeah. That's a study we made for a few enterprise, and that's a public material.
Yeah. Forrester did the study for us, if you will. I think the other, you know, what Ken's kind of describing is the evolution of the SD-WAN market. In the very early stages, it was very easy to kind of think about that as the MPLS savings and, you know, logically, that was looked at in the retail vertical. It was very successful. It caught fire because of the ROI, and you see that in some of the numbers. Now we're starting to see SD-WAN with new use cases coming online and seeing customers getting more creative in terms of how they're using that technology, how more features are being added to it, how it fits into the SASE model as a key component of the SASE delivery.
You know, starting to measure it against MPLS made a lot of sense when it was very much about a branch savings opportunity, but now I think it's starting to progress into something else, something more.
The relation SD-WAN and SASE, I think right now it's maybe kind of run reversed. SD-WAN is a much bigger market compared to SASE. Right now, the SASE, they talk about it a little bit more related to enterprise cloud deliver SASE. SD-WAN is a much bigger market that address a lot of networking issue there. A lot of SD-WAN customer, they actually come from totally different space and a different use case compared to the traditional even security or enterprise security. It's a quite a bigger, different market.
Got it. Fortinet's also been selling more networking in terms of switches and access points. I think that's about 12%-13% of your billings, based on disclosures you've given. Why is selling networking important, and how big do you think that business could be for Fortinet?
You can look on how networking and the network security. Network security more cover the high layer, like a content application, device user, location layer, compared to networking is more just connect everything and try to as fast as possible, more device being connected. If you do the traditional network security, because only software approach, they have very limited use case within whether enterprise or software solution go to the cloud using cloud computing power, because they have to use in the general purpose CPU. That's where using the additional ASIC give us much bigger, more broader, more use case compared to the traditional enterprise network security. That's also SD-WAN is one of the good example, with the OT and some other is very good example.
That's making the overall, whether the SD-WAN, the OT, some other, much bigger total addressable market and the growth probably even faster. That's why my estimate, probably last year, probably about 50% of business come from the new use case that traditional network security in the enterprise not cover. We have a lot of new use case, including I mentioned SMB space, right? In the U.S., there's probably 20 million-30 million SMB, and less than 20% of that has any security protection, network security protection. There's a huge growing market which the traditional network security can already cover. They have to build software on a quite expensive server, and the same time, they cannot consolidate the device, without a network device or the broadband access device.
That's where we feel the integrated solution, whether the security, the SD-WAN, the LTE, 5G, and also Wi-Fi, and also even internal switch and AP routing, all these kind of things, that will be the solution for a lot of, whether the SMB, the branch office or even like work from anywhere solution there.
Right. Ken, maybe just to shift a little bit on the tactical side. On the macro front, you mentioned on the earnings call that you saw a more modest budget flush in the U.S. enterprise. You also said in January that your pipeline growth in January was stronger than it was the same month a year ago. Square that for us. Like, what's going on?
Yeah. Well, I think as we expected as we look at the fourth quarter, and I think you've heard this from other vendors as well, that we did not expect to see a budget flush in the fourth quarter, that there was a lot of pausing, if you will, that was going on, particularly in November and less so in December. We did expect to see, and we did see more deals push out of the December quarter into the January quarter. The commentary around the pipeline is probably in the context of looking at the guidance that we provided for the full year and providing some comfort about it. In some ways, simplistically, the guidance setting process is, one, do you have the sales capacity to deliver it?
Two, do you have the pipeline for the sales people to go to sell against it? Three, are you assuming close rates? Very, very important now, they're not out of line and give you a productivity number that makes sense. I think when you look at that, the context of it, and while we were making the point that the pipeline growth was actually higher this January compared to a year ago, obviously the guidance is lower, right? I think we're trying to offer a level of caution and conservatism in our commentary.
Got it. Maybe shifting to margins. You know, Fortinet's kind of stayed at this 25%+ operating margin target, in terms of for the next at least three years, right? You're a much more scaled business now. You've got the higher services revenue mix. Why couldn't margins be much higher? Like, why stick at that 25%+ ?
We do need to invest in the growth, right?
Okay.
There's a lot of growth opportunity both in the network security area to cover a lot of new use case and also in the other product. We have about 30 different product beyond the network security, from endpoint through all the different web and email application to the cloud solution there. We call it Universal, whether it's ZTNA, Universal SASE, including different party infrastructure security. That's where we want to keep investing the growth.
We smile at each other because we kind of stake out our respective areas, if you will. I'm talking about margin, he's talking about market share. I think Ken makes a very good point. We're in an environment that is a very fragmented market in the security space when you look at it in a worldwide basis, and that's certainly where our customer base is. You know, by virtually any third party account, whether you're talking about Gartner or Forrester or what have you know, we have a competing, if not a superior product. In that environment, to the extent that you can add sales capacity and keep them productive through the pipeline, it makes a ton of sense to continue to do that.
Fair enough. From a capital allocation standpoint, I think, during the first three quarters of 2022, you bought back almost 5% of market cap. Just curious, why the pause in Q4, and how should investors think about share buyback in 2023?
That was a pretty quick pace there the first nine months of the year, no doubt about that. Look, start with the concept that, you know, we're gonna be very faithful to a single operating system. With that, you know, our M&A strategy has been clearly around tuck-ins. You know, we've talked about the $25 million, the $50 million. We start doing $500 million, billion-dollar deals, maybe this is the nature of the question, it creates risk of that single operating commentary and strategy that we have. If you set aside that you don't need a large war chest necessarily for M&A, the question becomes, you know, what is the logical thing to do with that? One logical thing is we do invest in real estate.
You know, it consists with long-term investors, Ken Xie and Michael. You know, we like to own our own real estate where we have significant footprint of engineers or data centers or POPs or warehouses or what have you. Then the next place is returning capital to shareholders. This actually goes back, I think, as far as when we did an investment-grade debt offering about $1 billion in 2021. I think we were very clear then that the intention of those proceeds was to provide capital back to the shareholders of the company, and I think we've successfully done that. Net, net, you know, we prefer to be opportunistic in the buyback strategy, and I would expect that you should see us continue with that behavior in the future.
One last quick question, and I'll open up the audience for Q&A. The CapEx, you mentioned that, it was a pretty substantial step up, $400 million-$450 million. You talked about the real estate expenditures. Just explain, you know, what's driving that.
I think we've provided enough commentary and clues now in terms of the read-through. We've talked about data centers. We've talked about POPs. You're seeing the numbers increase. When I talk about the margins for services, you know, I just talk about that I have a little more of a headwind now because of costs related to hosting and costs related to data center. I think that all makes sense in terms of pointing to the direction that, you know, one place where we're making investments, obviously, would be a SASE-type solution and other cloud-based or hosted-based offerings.
Okay. Anyone in the audience have a question? Okay. I'd love to talk about OT security. That's 10% of your bookings now. I think I read a stat, something like 80% of ransomware attacks focused on critical infrastructure. This is a roughly half a billion-dollar business for Fortinet. There's all this, you know, focus from the administration at the federal level focused on securing critical infrastructure. Do you think that OT security will be a bigger opportunity than SD-WAN even?
Yes, I do believe with the ramp up of more device connected, especially leverage of 5G will connect 10 times more device than connected people. There's a lot of risk and also a lot of opportunity for us. OT is also very different than connect your people computer or device into internet. Most OT device has very limited computing power and also running very old different OS. Probably the only way to secure this device by network security. Endpoint has a pretty much very small, even no market play in that space. It's different than the, you know, laptop or whatever mobile phone environment. That's where network security is very important for the OT area.
Consider how big is the risk, how big is the market potential, how many device being connected. That's a huge market going forward.
Got it. Keith, question for you on, on the guidance. you know, number one question that we got, after Fortinet's earnings calls is, you know, what gives you comfort that they can exceed the guidance that they set in 2023? I mean, all this talk about backlog drain, cancellation rates upticking. what gives you comfort that you can exceed that outlook?
Yeah. I kind of touched upon it. I think the math is fairly simple. Do you have the sales capacity? Do you have the pipeline? Are you assuming a sales productivity and a close rate that are appropriately cautious and conservative, the pipeline being higher than it was before? Maybe to kind of tie that back to one of your very early questions, Hamza, you know, in terms of other customers or other companies talking about what their expectations are for growth rates in the industry, I suspect that's very true for their customer mix and their geography and the use case that they're solving. But as Ken alluded to, you know, much broader footprint, lots of opportunity, SMB, lots of other use cases coming online. SD-WAN remains very strong. OT remains very strong. I think we have some other growth areas as well.
I feel, I think the guidance, if you will, was certainly very appropriate in light of what we're looking at in the macro environment together with the data that was rolling up and suggesting that, you know, 2023 was starting off, you know, with a lot of opportunity for us to go execute against.
Fair enough. I think one last question just on... I think recently you had an announcement with to build your technology on top of the AWS Graviton CPU. Just thinking around that, what's the opportunity there? How do you think about the growth and the margin opportunity?
We do support in this Arm-based CPU, even not our own kind of ASIC, also some kind of Arm-based. That's where, if there's any new, like a CPU computing platform come up, we all support in that one. We see, they are more try to address a lot of cloud computing there. In the cloud computing is which is about $200, $200 billion market, I think right now it's a low single digit for the secure cloud computing there. We do see our unique, but only ASIC is more addressed to secure, I mean, secure computing, which also can be easily applied into the cloud, not just in appliance. Which we also see the huge advantage going forward.
We are good partner with AWS. We supporting them, they're supporting us, both on the new technology front, yeah.
Okay, great. Well, with that, Ken, Keith, thank you so much for joining us, and thank you everybody for joining us today.
Thank you.