Good afternoon, everyone. Thank you for joining us. My name's Brian Essex. I cover mid-cap, large-cap software for J.P. Morgan. Today we're excited to have Fortinet with us. On stage we have Christiane Ohlgart, the CFO, and Robert May, who is EVP of Product and Technology Management.
Yeah.
Thank you both for joining us. We really appreciate it. Maybe I wanted to kind of start with, you know, one of the most popular questions I got after earnings because you guys spent a lot of time talking about AI. You flagged a couple of large deals in AI, for AI data centers. Could you help us understand, you know, how large that business is and what kind of inbound traffic you're getting for that AI data center type business?
Let me start with what kind of interest we're getting. AI is very broad for us, right? It's not only the AI data center, and Robert can talk a little bit more of what we're seeing. There are a lot of security needs around AI as companies figure out what they want to do, they also realize that using AI in the cloud is going to be costly in the long term, yeah? They're evaluating whether they can bring certain AI models into their own data centers and into certain specific racks. Of course, you have a lot of companies building out AI data centers now. That's what we're seeing more and more coming online. Maybe Robert, you want to comment?
Yeah, sure. I think, like on the data center side, you've kind of got two dynamics, right? You've got existing data centers that are being repurposed or adding AI You know, stacks in there, and then you've got brand-new deployments now. Each of these obviously take time to build out, and you start with a small footprint, and you continue building it out. We've had obviously large success in the data center for a long time due to the high performance, the low latency, the low power consumption of the ASIC technology. It's something that is obviously attractive even more so in the AI era, so.
Great. Maybe Christiane, if we think about your exposure to data centers overall, any way you kind of get a sense of how large that exposure is? I've always kind of in the back of my head thought about maybe some of your peers who are more large enterprise exposed with bigger firewalls having better exposure. How do you think about it as a percentage of your business?
I mean, I think we've always talked about if we look at our firewall estate, it's about one-third of the revenue comes from large firewalls, and one-third from medium size, and 1/3 From smaller firewalls. As you know, our business is extremely diverse, but we sell a lot into financial services and also into public sector, they tend to have larger data centers. The benefit for Fortinet on the data center build-out for AI infrastructure is really our low power consumption and our advantage there, which is extremely important when you think about AI, which consumes a lot of power. You asked about the opportunity, right? We all want to quantify it. I think what I said in the earnings call is that the build-outs that we saw were pretty much reference architectures.
I think for us it's not about one big quarter with AI data centers, but it's going to be a consistent deployment as more companies start to look at how do they deploy AI and as other enterprises ramp up. Fortinet is globally diversified, so it's not a U.S.-specific opportunity. It is a global opportunity, and a lot of enterprises think about where do they run their AI deployments. If you think about Fortinet's footprint outside the U.S., we have high market share in EMEA. Especially with the sovereignty rules there, they're a lot more concerned about where the data sits, and so that's a good opportunity for us.
Got it. One of the things you said at dinner last night I thought was pretty compelling, so I wanted to ask, you know, both you and Robert, you know, in terms of the ASIC architecture of the firewalls that you have exposed to data centers, and then other feature functionality within your firewalls. One of the things that caught my ear was particularly the, you know, energy consumption component of it. You know, how much of a factor is that in the decision process as well as some of the other feature functionality that you might have, like unified OS to manage your estate.
Sure, yeah. Well, certainly the power consumption is more of a concern now. Like it's always been a concern for, you know, other reasons in places like Europe and what have you. Now with AI, it's really drawing a ton of power, so there really, you know, an advantage of having a much lower powered device overall. When you look at the amount of power consumption per gigabit of traffic or what have you, it's quite compelling.
In terms of the other feature functionality, I think, you know, one of the big things, right, as you're building out a data center, it's not just the traffic coming in and out, it's also the east-west traffic that is going to those AI workloads. Having the ability to run the same OS in a virtual environment on top of NVIDIA chips, for example, BlueField DPUs, is really compelling because that means the operations team only has to manage really one set of security, right, for all of the data centers. It really provides [audio distortion].
Got it. Then I want to ask about, you know, one of the other things that I think it was Ken on the earnings call alluded to, but almost like a return to edge or a on-premise renaissance, so to speak. Particularly when comparing this spending cycle to the spending cycle that you may have seen during the COVID era. Could you maybe compare and contrast the dynamics of what you're seeing right now from a demand environment relative to what you saw maybe during, you know, that kind of 2019 to 2022 timeframe?
Sure. From my side, I guess one of the things I hear constantly is the data sovereignty requirements, right? This isn't just AI, but also SASE and other technologies. Having the ability to run that in- country or in local service providers that want to offer services with it. In terms of contrasting that with, say, the COVID era, obviously, the drivers there were suddenly I've got a ton of remote users that need to access my network, right?
There was a totally different driver there. It was kind of a similar trend in that, in that way. In terms of AI and how that plays, obviously when companies are doing like initial projects for AI, they oftentimes might use public cloud, but they quickly realize the cost advantages of running their own security or their own AI infrastructure. They slowly start to migrate that back, especially as they scale up the usage, the token usage, and start to offer it as services for their customers.
Got it, super helpful. You know, one of the things that was, you know, really impressive about the first quarter was this phenomenal growth in product revenue that you had.
Yeah.
Then Christiane asked you the question of, you know, if you look at the relationship between product revenue and services revenue, just to understand how that may have shifted over the past, you know, year or so versus historically the relationship that you may have had. You referenced, you know, historically you had a higher mix of switches and access points, but this quarter was a higher mix of, you know, firewall- related hardware. How long has that kind of mix shift been persistent? You know, how do we think about the durability of that mix as we kind of look to the mix to expect for product and services for the rest of the year?
I think what we see is we see a lot of use cases for firewalls. AI is one. We continue to see high demand for operations technology. This has been a growth area for Fortinet for a long time. Over the last couple of quarters, we've always reported out that OT grew faster than the overall business, it's a significant component. OT does not only consume firewalls, but it's one area where we sell a lot of hardware into that use case.
With recent attacks, high- profile press releases about companies not being able to produce or having to close their stores last year in Europe or airport terminals not working. I think there's been more awareness how detrimental an OT attack can be. Companies are spending more money and are looking more into this area for security. In many cases, it's white space. It's a good business for us to grow in. In addition to the needs on the AI side to segment and then SD-WAN is having a renaissance as well. I'm confident about continued high growth for firewalls f or a significant time. It's not short term.
Great. Then I wanted to ask too, you know, with respect to, you know, the overall spending environment and the impact that recent AI-related events may have on that spending environment, you know, namely we've had several, you know, high profile foundation models come out and, you know, it's been highlighted their ability to find vulnerabilities, and potentially engineer exploits to those vulnerabilities. One of the issues that I think is, that I think maybe not well understood is that you have several different categories of vulnerabilities. You have packaged software where you can just push a patch. You have custom-built software, which may be a little more difficult, you may need to refactor that software.
You have hardware, which may be a little bit more challenging in that you might have to replace the hardware. Is that hardware component a factor in some of your customer purchasing decisions? I know you don't have like a clear crystal ball into what kind of refresh activity that you might have, but just wondering if that's part of the conversations that your customers are having, particularly given the elevated urgency you may have around, you know, an accelerated amount of vulnerabilities across that, you know, multi-product landscape.
Well, from my side, what I could see is like, obviously the last several years we've had a solid program of communicating with customers and keeping them up to date, and the latest version. There's always going to be some outliers where they're running very old equipment that can't upgrade to the latest version. I think we've managed that quite diligently, I would say. now another hand, it does trigger discussion, I would say, where it may be a consideration to say, "Well, maybe we should run the later version of the OS, and since we're going to go through an upgrade, maybe we decide to upgrade the hardware at the same time. These kind of discussions I think happen because it's an operational d iscussion there.
If you look at Fortinet, we've been extremely focused on improving our code quality, yeah. We've had as people know, vulnerabilities that we've communicated and worked with our customers to upgrade. I think we have a good program in place to work with our customers on upgrades. Hardware replacements are only required if you really run very old. The first step is always going to be upgrading your operating software, yeah, or upgrading your application software. Is everything vulnerable? No, only those components that are open to the cloud, yeah. A lot of estates are run without access to the cloud. I think that for every vendor, the situation is going to be a little bit different. Of course, there are now interests in putting also firewalls around your perimeter, new firewalls, to secure what you cannot upgrade as quickly inside.
Got it, s uper helpful. Then I wanted to ask about FortiOS 8.0.
That's an [exciting one].
Somebody falls into Robert's wheelhouse .
Yes, t hat's an exciting one.
I mean, introducing agentic AI as a pillar of that Security Fabric, you know, how should we think about the impact that has on, you know, the attach rate of higher margin security subscriptions across your firewall footprint?
Yeah. Well, let's say in FortiOS 8.0 there's a couple of different areas, right? One is, at the highest level, you can say we talk about AI for security and security for AI, right? In terms of AI for security, this is really how we use AI to improve the product. This is usability, automation, those agents and assistants that you interact with. It really helps to speed up the deployment process, the troubleshooting, and any type of things on the operations side.
Mitigation, y eah.
Exactly, yeah. Then when we get into the other side of security for AI, there's a few different products there, but specific to, say, FortiOS 8.0, it's a lot about the shadow AI, right? Like many companies having conversations with, they really don't know what's being used in their network, right?
Right.
They want to uncover that, get the visibility, and then take back the control, right? This provides, you know, not just what, you know, SaaS services they're using, but also what agents are in the network, what are they communicating to, and gives them the ability to control that traffic. A lot of these capabilities come with some service component which is added on top, to go back to your kind of original question there for the service attach.
Right.
All these capabilities have that type of service attachment.
Got it. Then, you know, one, the other point that kind of came up briefly I think at dinner last night is, you know, your involvement with, you know, Glasswing and you know, OpenAI's tech access to those foundation models.
Yeah.
How critical or how much of an advantage is that for you to be able to utilize the findings from the visibility that those models provide in terms of what you're developing on your platform, to help protect, you know, not just your infrastructure, but your customers' infrastructure?
Yeah, sure. I mean, obviously for the last couple years we've had a large focus in this area. Glasswing is another tool, right, that gives another perspective, another set of visibility, for the engineering team to address issues that may come up. In terms of the criticality, you know, we haven't necessarily seen the level that's been reported in the media, you could say that way.
Right.
I think one thing it does really showcase is that for most enterprises, they're worried about all of the software and products that they're running, right? I think we've had a very effective way of working with our customers when there is something or an upgrade that needs to happen. Other vendors have maybe hidden things as bug fixes and stuff. I think Glasswing exposes that quite critically so that you can't do that anymore, right? It has to be open, transparent, and good communication with the customer base.
Right, g ot it. Maybe want to hit on macro real quick. Would love to get a sense of not just for 1Q, but what you've seen so far this quarter. You know, how has the macro impacted customer spending patterns? Then as a part B to that question, you know, it seems like security's been getting access to budgets outside of traditional security budgets, if you have a chief marketing officer that wants to secure his agentic project or whatever. It now also seems that both, you know, Mythos and GPT-5.5, you're getting kind of incident spending where people are freaking out or CIOs are freaking out, and you're getting this extra juice. What are you seeing across your platform, and is that, you know, for 1 Q and then 2 Q so far, is it a meaningful contributor to performance?
I mean, I think what we're seeing is that pipeline is improving significantly, yeah. You're right, I think security spend is getting prioritized, yeah, and probably also getting elevated because AI creates the need for security. You have nation state activity. I mean, the war in Ukraine has heightened those activities, and especially Europe is also very wary of Russian activities constantly. You see that, you see the increased attacks on critical infrastructure. We've seen all of these aspects benefiting Fortinet's pipeline and our strong belief in durable growth.
Got it, s uper helpful. I wanted to touch on sovereign SASE which we briefly discussed, but, you know, it seems like you've carved out a relatively unique position there, allowing customers to deploy SASE within their own data centers as opposed to relying on a vendor's public cloud. Could you elaborate on the competitors' landscape there a little bit? Specifically, you know, which customers do you see within sovereign SASE, like RFPs and, you know, what does that mean for potential market expansion for you?
Well, let's say when we talk about sovereign, I think there's a few different layers, right? It's like, what level of sovereign do I need, right? For the either the application I'm using, the data that is being sent through, and then the regulation, right? On some, say, applications you're using, maybe there is no concern. It's just a regular SaaS application. I'm fine with using the public cloud.
On the other extreme, it's like there's a highly regulated thing, or it's got my company secrets in it, so I want to make sure that's on premise, right? At Fortinet, we have like a SASE offering that spans both of these, right? You can, from the public, from the different public locations, you can select to use, you know, anything globally, or you can start to restrict that down and say, "I only want data centers that are in country," right?
Then you can even augment that with, say, FortiGate appliances to say, "Okay, I want to also install two additional locations maybe where I have a factory or I have some other specific locations that are performance requirements." When you get into sort of like, okay, I need to have sovereignty on premise for various reasons, the type of customers that we see in the early stage, of course, are the telco providers and the large financial institutions, which are wanting to basically have their own fully managed stack. The benefit there is we provide really the same technology, the same user experience and everything, but it's a drop-in solution. It's not, you know, integrating with virtualization and things. It's actually just drop it in the data center, and it's stand up and up and running very quickly. It's provides that same experience as the public offering.
Yeah. From that perspective, we certainly heard a lot about, you know, your telco provider traction and, you know, how might the profile of that customer cohort, you know, in terms of service providers, whether it's Neocloud or telco providers, how is that shifting given what you're seeing in the demand environment today?
I would say the service providers have two main reasons why they are looking at sovereign SASE, right? When SASE was becoming more attractive, they started reselling because they needed an offering for their customers, so they started reselling some of the of our competitor solutions. The problem is they don't own the customer this way. Yeah? They're replaceable and that doesn't give them the attachment to the security spend of the customer. If they have their own sovereign SASE solution, they can actually own the customer, and they can continue to service the customer with all the needs the customer has.
The other aspect, I think, is that many of the service providers also host public sector applications and data centers, and with more sovereignty requirements, especially in the public sector, Europe is a good example. They are looking at being able to service their big customers. The big agencies that have a lot of data that needs to be stored in country and shouldn't be accessed from outside from different providers. This is a main driver for service providers looking at our sovereign SASE solution.
Got it. Are those dynamics shifting? I mean, I think you mentioned that, you know, your business tends to be a third, a third, a third small, mid, and large enterprise. Is the mix shift of enterprise size shifting at all given what you've seen over the past few quarters in terms of growth dynamics for the company?
I think our focus over the years has been on larger enterprise customers and service providers, so we see a little bit of that mix shift. It doesn't mean we're deprioritizing, the lower end of the market, but also the lower end of the market is continuously serviced more by service providers just because security gets so much more complex. That's a big focus area for us to make sure we capture, and we service the needs of all customer segments.
Got it. Another point, I'll ask one more question, and then I'll open it up if anyone has questions from the audience just to give you guys a heads-up. I wanted to ask about the SD-WAN and SASE service bundling. What has the impact been on your business so far, and to what extent might you pursue bundling for other products and services to accelerate traction of the business?
Well, certainly so far, I mean, it's only been a couple of months, right?
Yeah.
We seem to definitely a large attraction towards it. Really it just makes the overall SD-WAN experience smoother and everything, but then it adds additional SASE starter pack to the SD-WAN deployments. What that means is that the IT can just immediately start to use it and get comfortable and then start to roll it out in a more normalized way instead of another separate project that they have to issue RFP and everything for. In terms of that kind of motion, I don't know, the bundling part is one aspect, it's really the other motions around, say, the endpoint or the security operations areas. These are other areas where traditionally you see multiple different endpoint technologies or multiple different products in the SOC. These are quickly converging together to have, you know, more unified offerings and you know, single licensing, single SaaS portal elements that really bundle everything together.
Got it.
I think on the SD-WAN SASE bundle, the main benefit that we see is that if a customer has kind of this SASE starter pack and they already have deployed SD-WAN, they can see how easy it is to deploy SASE, b ecause it's just a small, what we call starter pack, they can deploy it and then we hope to upsell the customers as we may displace competitors or as we may displace VPN solutions or similar, yeah.
Got it. I want to reach out, see if anyone in the audience had a question for the company, and then I have a follow-up. Well, I'll hit you with the follow-up. Please feel free to raise your hand if you do have questions that come to mind. I want to follow up on that, on the SASE SD-WAN relationship. I know historically you've had a bit of a different go-to-market motion than other vendors in the space where, you know, you focused on converting SD-WAN customers to SASE. Is that dynamic changing at all? Are you leading with SASE? Is that becoming a higher mix of SASE business or is SD-WAN conversion still like your bread and butter in terms of how you're growing that business?
I mean, I would say the main benefit for customers can be experienced if you have both SD-WAN and SASE, because then you only have to manage one set of policies. It can extend easily. You don't duplicate your efforts. Our SASE solution can do exactly the same that what our competitors can do. If you don't integrate it into the network, you still manage duplicate environments. I think that's the true benefit for our architecture is that you can manage one environment holistically, yeah.
Got it.
Yeah. I think what I kind of see on the project-by-project basis is there's kind of like maybe three different areas, right? One is where they've already deployed a Fortinet SD-WAN, and then they're looking to do a remote access project, and then they realize quickly that, oh, this just plugs directly in. I can shortcut a lot of these operational things, both in the turning it on and also in the ongoing management. The other one is when maybe they're deploying an SD-WAN project, and then they quickly realize, "Oh, I can actually do SASE at the same time.
These are kind of similar, but they're driven from a different starting point maybe. You've got a third category where maybe they're starting with a SASE project that maybe they aren't a Fortinet customer. This actually we see some motion to actually starting to reconsider, "Oh, maybe I should deploy SD-WAN at the same time as SASE." It's kind of coming from the opposite direction. The same operational benefits and everything.
Got it, s uper helpful. I want to ask a couple kind of shorter questions. One was on duration. We saw a little bit of longer duration, I think in this quarter. I mean, have you disclosed what duration is? How should we think about, you know, the profile of the contracts that you signed this quarter and what to expect, you know, kind of as we go through the rest of the year?
Yeah, we disclosed duration to be about two and a half years. What we typically see is when we sell a lot of product, we sell an additional initial service contract, and the initial service contract with most of the solutions are 36 months. It drives up duration versus when you have more services coming from renewals. It's going to flex up and down a little bit on that trajectory, right? The more new hardware we sell, the more you will see some increase in the service duration. It comes down again as some of these contracts are renewable more on, which is typically 12-18 months average term.
Got it. Then, you know, what about experience with regard to sales cycles in the quarter? I mean, has a focus on, you know, AI and high-end firewalls driven any kind of divergence in sales cycles between, you know, large enterprise strategic deals and what we've historically seen in the mid-market, particularly given the way that, you know, the current interest rate environment may have on or the impact that the rate environment may have on customer spending patterns?
I don't think we've seen too many discussions on financing deals or concerns around that. What we really saw in Q1 was certain deals coming back from Q4 that we had thought we had lost due to supply chain constraints. They came back specifically in LATAM. We saw a lot of higher close rates, higher win rates, and saw some acceleration of the deals.
Got it. You mentioned supply chain, we'll follow up on that too. You guys have done a great job historically, and we saw this was really evident during kind of the COVID era where, you know, you did an amazing job in terms of like managing the supply chain and making sure that you maintained a healthy amount of inventory where your customers didn't have that inventory, and certainly you took share on the back of that.
Yep
How would you compare the current in , y ou know, frankly, investors are asking about, you know, the impact of memory costs and potential supply chain constraints in the current environment, but you know, a bit of a different environment. Could you compare and contrast like, you know, what maybe the company saw during the COVID era, and how different is the environment you're seeing now, and then, you know, how you feel about the way that you're positioned from a inventory management supply chain perspective?
Fortinet has historically always had about two quarters worth of inventory on hand just to make sure we can be ready to supply, and we've never changed that. That benefited us in Q1. Of course, with the increase in demand, we're also going out to the market to try to accelerate production for the rest of the year. Everybody in the industry is impacted by the increase in memory chips components. We're working through that. The benefit for Fortinet is that we do not only rely on the contract manufacturers negotiating with the memory vendors, we also have direct relationships, and we can consign it to the contract manufacturers, and we're using that actively.
One of the things I think I asked you, I think it was yesterday, was one of the things that we've seen during, that we saw during the pandemic was, you know, a certain amount of overbuying. It, you know, I think you commented that it was the right move to make because you were able to take share.
Yes.
You know, what is your confidence level in the rate of, you know, inventory acquisition that you have now, and how it matches up with demand that you're seeing in the market?
I mean, we see strong demand, yeah, and we want to make sure that we can continue to deliver. Because our business is so global, every geo is a little bit at a different stage. Y eah, we feel good about what we've ordered and what we think we will need, yeah.
With regard to how you're spreading inventory across the globe, I think you've expanded the level of, I don't know, inventory management that you have on a global basis.
Yeah.
How has that impacted how you're managing your supply chain in the current quarters?
It hasn't really impacted how we manage supply chain, but with our continued growth, we needed more warehouse capacity. We bought a warehouse in Europe last year, which allows us now to have inventory in Europe, in Taiwan, and in the U.S. It also diversifies our capabilities or risk management, right? If there are constraints on freight getting out of a place, right? W e have more capabilities to meet the customers' demands, yeah.
Great. Maybe one last quick one. You know, level of confidence and visibility that you have in the rate of product growth that's embedded in your guidance for the rest of the year?
I mean, our visibility is typically two quarters out mostly. Then i t gets a little bit more blurry. The pipeline is shaping up nicely, and that gave us the confidence into a good guide up after Q1.
Yeah.
Yeah, that's where we are.
Sounds good. With that, I think we're out of time. Christiane and Robert, t hank you v ery much for joining us, and thank you all in the audience as well.
Yeah. Thank you, Brian.
Thanks.