Nice to see you. Thank you for doing this.
Thank you.
It has been an interesting, as it always is, a couple weeks for both tech stocks and Fortinet.
Yeah. I mean, it has been crazy overall, right?
Crazy. Crazy.
It's like-
I will tell you that, a lot of Oh, we're live. Sorry. Okay. We're going to go ahead and get started. Not trying to shut down that group, but I imagine I'm going to stall for a little bit, because I think there's folks out in the hall getting ready to join us. I will say we're thrilled to have Fortinet here. It's a company I've covered for a long time. Great company in the market, probably best firewalls out there. I will also say at this particular time, you'll be happy to know that you won the prize, and you're wondering what was the prize. The prize is the most frequent source of questions right now that we get on any company is Fortinet. It relates to the firewall market.
I think folks rotate to Fortinet because it's more of a proxy of the firewall market. Palo, you got all these numbers going in and out, inorganic, organic. Check Point is losing share, so people don't really rotate on that particular company. You guys are the most frequent incoming question we've had in the last couple weeks. For that, we're grateful that you're here. With that said, let's jump into a few things, and we'll start at the market level first. My first question relates to just that, the firewall market. As you think about the puts and takes of calendar year 2027, as we're coming off of 2026 here effectively, and comparing and contrasting that to COVID, which was also an interesting time, call it 2021, 2022, how would you characterize the difference? Again, I'm asking at a market level to kind of normalize.
Yeah.
How would you compare and contrast the current period versus the COVID period?
Yeah, I think the main difference between now and the COVID period is during COVID, companies were preparing for remote access, yeah? That was the main use case for upgrading their infrastructure, buying firewalls, and then also adding on SASE functionality. Now in 2026, 2027, I think we have a lot more drivers for growth, yeah?
Okay.
We have AI that needs to be secured. We have sovereignty around AI, and for us, sovereignty is an important topic or hybrid infrastructure, control of your infrastructure, because we service a lot of companies outside the U.S., yeah? The customers are looking for more control over the infrastructure. Then we have, for us, for Fortinet, a big market is OT security, and that continues to get traction. I think we all hear a lot about OT risks, whether it's the refrigerators being out of control or water systems being attacked, just as some examples. Last year in 2025, airport terminals were hacked. So there's a lot around OT security that continues to be in the news and elevate that market for us, yeah? Why is Fortinet well-positioned? Because OT security is more of a hardware than a software play.
While we have products in all categories, I think we differentiate our, as you said nicely so, our firewalls are best in class. So that's where we have a lot of drivers that create demand for firewalls. Couple of years ago, I think everybody was talking about the cloud and said, "Well, Fortinet, your market is shrinking," yeah? We don't really see that the market is shrinking. We see that there's more use cases for all the functionality we're building into the firewall, yeah?
Okay. Okay. Let's take a step back is where I have asked every company that I have visited with today the similar question.
Yeah.
In terms of budgets for next year, your sales reps are coming back to you, probably trying to work down their quotas already.
Exactly.
At the same time.
Sometimes the sales reps.
That's right. That's right. At the same time, getting feedback presumably from corporates on budgets for your TAM. What a lot of folks wonder about in security is, okay, how much are budgets going up or down for security? Really, it's even a fine, a little double click on that is, there's many more demands and requests on security budgets than there is dollars.
Yes.
Where is the pool of funds going to come from that meets all the requirements being asked of security departments? What are you hearing about security budgets for next year? I'll give you more, I've had conversations with our internal folks from BMO. We have a security budget. It's going to grow X next year, but we're also tapping into a whole another pool of funds that's been created to support AI.
Exactly. Yes.
I don't know if that's common.
Yeah.
But give us a little bit of discussion on security budgets next year.
I think there are two benefits for Fortinet. One is, yes, security budgets are increasing. And typically when you invest in AI, you need to build out security for AI, and that comes with its own budget as AI is budgeted for. But then also, as you said, companies don't have infinite budgets. So where Fortinet plays a role is we can consolidate multiple functions in one firewall. Best example, and we see a lot of traction, even though it may be considered old tech, is SD-WAN. Many companies still have two providers, and pay basically twice the price when they could buy a firewall from Fortinet and consolidate two vendors into one, and so make room for more other security needs.
And so that vendor consolidation, reducing from 200 apps to a couple of vendors is something that we see and that helps customers do more with not less, but with the same.
Right. Okay. Have you gotten any numbers about what security budgets may increase next year?
I mean, I hear like 5%-10%, but we shall see. I think that the threat environment remains active.
Yeah.
Yeah. I do not think it is getting any better. From that perspective, we may also see what we saw in 2026, shifting from other budgets to security just because customers realize that security is an important aspect that they cannot delay.
Okay. Okay. Let us go into a little bit of, you recently reported your quarter. I think there was a little bit of confusion, say, on the second half growth guidance versus what happened in the first half. Maybe just review at a top level how the various factors that would influence the guidance to include price and availability. How did that shape or inform your guidance for second half versus first half?
Let me start with the beginning of the year. At the beginning of the year, we assumed a pretty normal year, right? Something like 10%-15% growth, without including price benefits. Fortinet is fortunate in a way that we have typically two quarters worth of on-hand inventory. Then the prices started creeping up, which was something we knew, and we were able to supply our customers pretty quickly and also pick up demand from our competitors who were already constrained with supply shortages.
Right.
We had an outsized first half, which was partially demand of our own customers and partially demand that we were fulfilling from competitors and driving market share gains. In the second half of the year, not that we are supply chain constrained, but we do not have the same advantage because now the lead times have increased, our prices have increased, and we cannot aggressively discount, or we still aggressively discount, but not as much as we had the lower COGS on the books.
Right.
I think half year two is more normalized, and half year one was just outsized because we were in a fortunate position to take market share gains.
Just if I drill down on, Ken was pretty clear you had some excess capacity, I am not sure if excess is the right term, but availability in the first half. You look at second half, you have normal availability of inventory, so you are not If you got incremental demand, you could satisfy that incremental demand? I am not sure the inventory-
We have normal inventory on hand, but if there is accelerated demand, we have less capability to pull in production just because the lead times have increased. While we have given out longer commitments to our contract manufacturers, there is not as much of an ability for them to get all the components.
There is still a little flex then.
Yeah.
Okay.
Yeah.
Okay. Inventory may be less availability, which also, by the way, benefited in terms of price because you had lower cost on your books.
Yes, absolutely.
Now you have more of a consistent level of inventory, probably less flexibility on the cost. On pricing, your price increases in the second half are actually higher than your first half.
Correct. Yeah.
Do you think price realization will be consistent with the price increases?
So far, we see similar price realization. Yeah.
Okay.
I think from our perspective, the benefit is that it is a supply chain constrained market, so our competitiveness has not decreased. Everybody has the same issue. Their prices go up, they have raised prices, so our competitive pricing is still as good as it was before. For customers, it is a little bit more unfortunate because they need to pay more.
Right.
The other part is that because we have our own ASIC, and especially in the firewalls, we have one component that is less impacted by the price increases, so it allows us to be more competitive as well.
Okay. Then maybe reflect on the customer behavior as associated with those price increases, right? So you had incredible demand in Q1, Q2.
Yeah.
Talk a little bit about what you think customer behavior was as it relates to those price increases, and including comments on how that may have impacted Q3, Q4. Like, maybe customers were buying a little bit ahead of those prices.
Right. I mean, I think what sales did at the beginning of the year when they saw that the prices are going up, they said to the customers, "Hey, if you have plans to upgrade," and we know we had customers that needed to upgrade throughout the year, "we suggest you do it earlier because the prices go up and we can't guarantee availability." So there's definitely some of this element. On the other hand, in Q2, we were taking share from competitors because of on-hand inventory. But I wouldn't underestimate also the additional units or customer demand because of Mythos. I think the AI revelations in April that the time to identify problems in your software and exploit them have shortened-
Yeah
to milliseconds after a release comes out, has been a big one and is going to continuously drive demand. Why is this beneficial for the firewall? Because in the end, no customer, even if a patch comes out, can deploy it right away. Customers need to go through testing, the integration testing, they need maintenance windows. So, they need protection while they are planning to apply the upgrade.
Right.
Firewalls and also SASE for cloud deployed software is an important security measure to buy time.
Right.
Yeah. So that's what drives continued demand.
Is the replacement cycle or refresh cycle staying the same? Because usually firewalls are five to six years, and because of Mythos and security vulnerabilities, does that contract, you think, the replacement cycle?
What we see is with all the innovation that goes into our OS, customers will have to upgrade a little bit earlier because all the new functionality requires higher end devices. While devices may not be out of support, you may not be able to turn on all the features and functionality that you want
Right
with a lower powered device, yeah, lower memory device. That's also when you look at my remarks over the last couple of quarters, what we've seen is that the average ASP net of price increase has gone up, which shows us that customers are buying within each firewall band higher devices that allow them to switch on more functionality, which is good for us because it gives us the ability to upsell the customers on services over time.
Okay. We're going to stick with firewalls before we turn to services in a second.
Mm-hmm. Yeah.
But what I think investors are really sort of stuck on, I reflect back on the post-COVID period when Peter used to yell at me
I won't
investors are really trying to understand what does this really dynamic period of firewall imply for next year? You have a 50% comp in one instance, so extraordinary demand, again, some share gains, what it may portend for next year. So a couple different questions related to it. Again, just you can speak to either market dynamics or Fortinet, but number one, you have an exit rate established for Q4 implied for your guide. Don't know if that's the right jump off point as we're thinking about product growth next year, or as you've talked about, you think the durable growth maybe is mid-teens, 15% or something along those lines.
Just any guideposts that we should be thinking about as it relates to all the moving pieces, price increases, inventory, really hard compares, anything else you want us to consider as we're getting ready to turn the corner on the new year?
Right. I'm not going to guide today.
Yeah, not asking you to.
But from my perspective, or from our perspective, the market dynamics are absolutely intact, and they are much broader than they were during COVID. From that perspective, we're very confident about growth over the next couple of years, and we've always said our goalpost is that we outgrow the market. Because we don't do big acquisitions, our growth rates are pretty much organic, right?
Yeah.
And yeah, we benefited from pricing increases this year, but as did our competitors. So it's a like for like, yeah? From a growth rate perspective, there's still a lot of new demand drivers for product, and as I said, there's still also a significant cohort of customers that have older devices that they purchased during COVID that we can upgrade.
Yeah.
I am not worried about continuing to sell product into our customer base and acquire new customers. We also have competitors that have big refresh cycles coming up, so that is an opportunity to take some market share. If the market is good, we should be benefiting from it.
I will break it down in a couple pieces, but if any way to think about how prices may impact the market next year. Everybody has been taking prices this year.
Yep
Because component costs have been going up. Is it as simple as thinking about, okay, price increases will be at whatever component costs do? Or is there a different way to think about what price increases may be for firewalls broadly next year?
I think we have been pretty clear to the investors that we will adjust pricing to make sure that our gross margin stays around 80% between service and product.
Right.
But of course, we also need to adhere to market dynamics. If the prices go up, we will continue to adjust our hardware pricing. If component prices come down, we've structured the pricing this year in a way that we have a base price for services and an uplift, and we can bring down that uplift without impacting services and renewals, which is important, yeah?
Why would we bring down prices? Because we continue want to take market share, yeah? Newer products may have lower-priced memory components, and you need to make sure that newer generation products don't cannibalize other products. So, from a market perspective, you want to be competitive, yeah.
Okay. On the refresh, even if 2021 and 2022 were really good firewall years. As you said, customers, A, that life cycle may be shrinking, but even if we said it didn't, 2021 and 2022 were good years. So that, to me, would suggest 2027 should be an opportunity for ongoing refreshes for the entire firewall industry. So 2027, from a refresh cycle, should be a tailwind, should it not?
That's why we talked about the market, right? The dynamics, yes.
Yeah. Okay.
I think customers make their buying decisions based on their new architectures that they have, yeah? In 2021, 2022, it was predominantly giving employees access to on-site resources, yeah, because they were all remote. Now, in the new world with people being hybrid, agents coming into play, more network traffic, there's going to be a re-architecture going on, and I think that's what we see over the next couple of years to meet that demand, yeah.
Okay. Okay. Any Again, I said I was going to jump off of firewalls, but here I go back in again. SASE is promoted by some of your friends at other companies as an architecture to maybe eliminate the need for not eliminate, but maybe reduce the need to firewalls. Are you seeing any tension there from an architectural perspective as we move into AI?
We don't, because what we see is that the world is becoming more hybrid versus more cloud, yeah? Fortinet's thesis is that with a hybrid world, you need on-prem devices, you need security in the cloud, but why should you move all the traffic to the cloud when you want to inspect them on-prem, because the user is on-prem, yeah? From an architectural perspective, what we've done, and Ken created this notion of a SASE firewall, which is not a device, it's a market where the SASE functionality needs to sit in the cloud for remote users, but you want the same functionality, whether it's DLP, whether it's CASB, out there in your network, and then control that.
Our hybrid infrastructure meets both, and we think that for companies that are not cloud native, that is actually hugely beneficial because it is all orchestrated with one operating software. You have one ZTNA policy across the cloud and your on-prem environment, so a lot easier to manage.
Perfect. Perfect. Let us jump to services for a second, and then I will open it up to the audience for questions. On the recent earnings call, there was a lowering of the services revenue, 14%- 13%, so not a huge number, but can you just review the contributing factors, attach rates, ramping service deals, slower service activations?
If you could just review that, in particular, drill down on what was a more meaningful contributor to that change in growth trajectory.
Yes. It is correct, we brought down the service assumptions for the full year, even though we were still above what we thought at the beginning of the year.
Yep.
Yeah. This year has been good for product and for services, yeah? But what we saw in Q3 with a really large enterprise quarter is that, of course, enterprise customers know how to negotiate. So we had a couple of new customers that came on or that bought from Fortinet, and so it takes them longer to ramp, yeah?
So these were new logos?
New logos.
Okay.
Yeah. So we allowed them to have a little bit of a lag period. Typically for Fortinet, we have an auto-start policy for services to start within 60-120 days. That's not for large deployments necessarily working for customers. It takes them to distribute the devices into locations, so they have their go-live plan. So that was one element. We had customers signing up for larger services deployments, and we knew that we had it in the pipeline. But the activation, the start date of these EAs a little bit later, and that's what you also see why we had good billings, but the ARR didn't increase as much because the start date is outside the quarter.
With some of the negotiations, of course, with enterprise customers, your rate of services for the hardware stack is a bit more compressed due to volume discounting, yeah? Customers buy more from you, and they will say, "Well, but I'm not paying that many services," because-
Right
you get economies of scale on the customer.
Yeah, as any company does.
Yeah.
Every company does economies of scale.
It is actually good, while it is bad news that we did not generate as much revenue this quarter, and in Q4, it is actually good news because we were signing up new customers, new logos, and we got the billings.
Okay. What does that mean, as I just think about contextualizing mix risk? If you sell more new logos, large enterprise presumably, that puts tension on when the rev rec happens on those attendant services. As you think about the guide for Q3, Q4, how did you guys capture that potential risk of getting more of these incremental customers that may extend that duration of turning on, so to speak?
Yeah. When we started the quarter in Q3, I think we were not factoring that huge enterprise cohort into the mix of the service-
Okay
after we had really good growth in Q2. This is where we had a little bit of a change in assumptions, but on the other hand, we had really good wins. From my perspective, you can sign up customers without a lag, but then you probably discount more, and then you are impacting your exit rate. Or you can give them a little bit more value out of their service contract by starting when they deploy the devices, and then you keep your rate up. So, I am always a long-term thinker versus a short-term thinker.
Yeah. I think most companies do that, and I know, frankly, CrowdStrike is very effective about doing that. Maybe talk about those large enterprise customers. When they do get to the state where they are turning on, are they consuming at the same rate? In other words, are the subscription revenues as a percent of what they spend on firewalls consistent with the broader portfolio?
They are pretty much consistent. Depending on how I mean, the bigger the customer, the more compressed the service stack, even though you attach more services. Yeah.
Right, because they get discounts.
Yeah, because you get volume. Yeah. But overall, I mean, we have a good product and service mix, and we still, with all the new services that we announced in Q3 that are addressing specific AI risks, I think we have a lot of services to upsell in 2027.
So even the attach rates are similar, even the components of that stack are similar? In other words, they are consuming the same types of solutions, those large enterprises, as, say, your medium-sized customers are?
Yeah, because it is use case specific, right?
Okay.
For OT, we have specific OT subscriptions. For data centers, the customer typically buys the UTP or ATP bundle for specific FortiGuard security subscriptions. So it is very use case specific. It is not as much like, is it a large or small customer? Yeah.
Okay. You did make the comment on the call, I hope I paraphrase it right, but that services growth would be higher in 2027 than it was in 2026.
Right, which you can see from deferred revenue. Short-term deferred revenue is up in 2026 compared to last year. Short-term deferred revenue is the best indicator for what we are recognizing the next 12 months.
Yeah. The risk associated with that not happening, DR is on the balance sheet, so it gives you high visibility.
Yeah.
I guess if there were further extensions, I do not know, mix, more enterprise buy you, so maybe you get some extensions, good news longer term, but-
Yeah
Is that the risk that we should be thinking about, even though the DR is on the balance sheet?
Yeah. In general, it is a pretty solid indicator. This is why we were confident to make that comment down.
Okay. Let me take a break there because my voice is running out anyway. Any questions from the field? Okay, I will keep going. SecOps.
Yes.
Growth did slow a little bit in SecOps. I think you stated on the call that it was a little bit of lower benefit of pricing and maybe some duration issues, but maybe just talk about what happened in SecOps and how we should be thinking about that business.
I mean, I think there are the components of pricing that did not benefit SecOps as much. There is also the focus that right now the sales teams was extremely focused on upselling, upgrading on the network security side. What we did in 2026, and that is where I think we are building pipeline now, is that we consolidated multiple products into two platforms. One is the FortiEndpoint platform, where you can now have one agent and then license under that agent, EDR, DLP, different functionalities that you want to have on the endpoint. The same we did on the FortiSOC side. In the past, we had SIEM, SOAR, FortiAnalyzer, everything separately.
Yes.
Yeah. Now we are consolidating that into one solution. We also slowed down some of the activities in Q2 and Q3 on the SecOps side because we want to deliver the new solutions.
I got it.
Yeah.
Okay. Part of it was the bundling you did that maybe takes a little time to digest.
Yeah.
Okay. Any comments on how, when will that, I do not know if it is a go-to-market issue or customer issue, on digesting the new bundles, but will that all be normalized as we execute Q4 so that calendar year 2027 is a more normalized growth rate?
I'm pretty sure that it will normalize as our sales teams also focus on selling the broader portfolio, yeah, versus satisfying the immediate Mythos demand on upgrading firewalls, yeah.
Okay. Sorry, I'm taking a sip of water. Management has talked about on-prem sovereign SASE as being a large market, 2x, 3x what some of the cloud-only SASE market. It sounds quite impressive, but maybe drill down on why that's such a meaningful opportunity in and of itself, and why Fortinet is particularly well-positioned to win it.
Let me start with the latest part. Why is Fortinet well-positioned? Because we've created a technology stack that we can port from our own data center into a service provider. And what that allows us to do is, instead of us controlling the full network traffic, the service provider can deliver the service. And if you follow certain regulations, more and more markets want to have the ability to control where data resides and where network traffic flows and who controls it. Especially in Middle East and Europe, you have newer regulations. Fortinet, because while we were late to the market with SASE, we started initially with service providers. We built out, in the end, a stack that is easy portable.
We continue to do that not only for our SASE solution, but also for AI security and so on, that it's not dependent on certain proprietary cloud services, but that it is actually portable and can be delivered by us or can be delivered by third parties in a way that customers have control.
Okay. Why is the market so much larger, do you think, than I mean, Ken's given some big opportunity descriptions on why the TAM looks so intriguing. Are you getting that type of feedback from customers, or where is this confidence or optimism coming from?
I think the SASE market is the question, is it just the SSE component, right? Or is it the bigger stack?
Yeah.
For us, it is the unified SASE market with the on-prem opportunity, which opens it up to not only being delivered by us, but also by service providers in countries.
Yeah.
Especially one of our biggest segments is the government public sector segment. They are, of course, very interested in keeping their traffic in the country. So, that is a big segment that we can service with our sovereign SASE solution that competitors cannot as easily.
Right. Okay. Aside from a sovereign SASE, maybe give a little characterization about where you're winning in the non-sovereign side. In other words, cloud SASE. Where are you winning from? In other words, what type of customers are those? Presumably everybody has SASE solutions now. Who are you winning share from?
Well, not every. I mean, you still have customers that only have VPN and so on, right? You still win from those. But we're really winning from those customers that have hybrid architectures, that have remote users, that have on-prem users.
Okay.
They like the fact that our operating software spans from the firewall to the SASE portal, and you have just one policy that you can apply. For cloud-native, cloud-only customers, you still have the same functionality, but not the same benefit, that you have when you're a hybrid customer and need to manage a much more complicated architecture.
Are these mostly SMB, you think?
No. It's enterprise customers.
Are there dual sourcing at that juncture, if they're enterprise?
Some customers are dual sourcing, yeah. Some customers like the ease of management and reduced TCO by simplifying operations. Yeah. So, I mean, every customer has their own way of creating resilient infrastructures, which can be resilient through multi-vendor strategies or can be resilient through routing and different aspects of backup mechanisms. Yeah.
Again, staying away from sovereign side, or maybe including it, but who are you most frequently competing against, do you think, on the SASE side? Is it Netskope?
No, I think it's often Zscaler.
In the lower end, I think, or in the mid-size, it's Cato.
Okay. Interesting. Okay. Let's go. Fortinet recently launched FortiGuard Inline AI.
Yeah.
Maybe tell us a little bit about what are the opportunities there? How would you characterize the demand pipeline build? Any comments on Fortinet AI security?
I think that's the real upsell opportunity with so much more traffic and shadow AI in every organization, and us trying to do something quickly, and then we use our private subscription and just plug something in, right. You want to have, as a company, you want to not only know where traffic is flowing, you also want to inspect what is in the traffic, yeah. And this FortiGuard Inline AI Security Service can identify, are you putting IP, are you putting social security numbers, are you putting personal identifying information in a prompt, yeah, and trying to route it into, for example, an LLM. So, that's where this inline security can analyze what is in the traffic, not only where is it coming from and where is it going to.
Right.
And that's going to be critical for many customers to make sure that the AI usage is in line with policy, and you can govern actually AI.
So that's an opportunity, will create lift in FY 2027?
I'm pretty sure, yeah.
Okay.
And then the other aspect that I like is, you can also manage cost control with the AI inline security, so you can define how many tokens people can use.
Okay. All right, we're coming down to the last two minutes, last two questions, and I'm going to try to broaden my last question out, or second to last question out a little bit. But if you think about leaving investors with a view on how AI is going to impact your rev or opportunities, presumably to the better, what would you characterize as the most meaningful two to three opportunities as you look at calendar year 2027 to inflect positive on creating incremental revenues or ARR opportunities?
I think the two immediate big opportunities are security for AI, so securing all the AI use that we want to do in enterprises, yeah? And then because more and more enterprises want to build out their own AI infrastructure, yeah, it's also the security for the AI factory, yeah? And then as a longer term step, it is deploying AI in security to reduce your operational cost.
Right.
Yeah. So, to make it easier to operate.
Okay. Okay. We're going to end on margins then, and twofold is just any broader puts and takes that we should be thinking about at 2027. You've already said gross margins stay where they are, depending on component cost activities, you'll raise prices or decrease prices to offset that. But any just broader comments on how we should be thinking about operating margins is question number one. And the second is just capital deployment, but really M&A. Fortinet has historically not been an M&A acquirer. Ken just doesn't like to do that. Palo does. But any, AI is creating opportunities that maybe acquihires is the right strategy as you look out to try to get some incremental competencies that might otherwise take some time to develop. We're going to finish on those two questions, margins and M&A.
Yeah. We will continue to do tuck-in M&A, yeah. The key for us is that we can integrate it into our own products, yeah, and it's not sitting on top. It may sit on top initially, yeah, which we've done with some of the acquisitions, but then over time, it needs to fold in. On the margin side, Fortinet, I think, is one of the most profitable
Yeah
companies, yeah. We said we have a goal to have profitable balanced growth. We continue to have that goal. We will make investments where it helps us grow, yeah. So I'm not promising an operating margin right now, but rest assured, our margins will be solid, yeah.
Yeah. I know Ken likes operating margins. Listen
GAAP.
Yeah, that is right. On behalf of Bank of Montreal, we are really appreciative of you attending, coming from California via Canada. We are grateful that you are here, and we wish you all the best of luck closing out the year.
Yeah. Thank you.
Thank you.