Fortinet, Inc.

Good day and thank you for standing by. Welcome to the Fortinet OneQ24 Earnings Announcement Conference Call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question and answer session. To ask a question during the session, you will need to press star one one on your telephone. You will then hear an automated message advising your hand is raised. To withdraw your question, please press star one one again. Please be advised that today's conference is being recorded. I would now like to hand the conference over to our first speaker today, Peter Salkowski, Senior Vice President of Investor Relations. Please go ahead.

Thank you, Brianna. Good afternoon, everyone. This is Peter Salkowski, Senior Vice President of Finance and Investor Relations at Fortinet. I am pleased to welcome everyone to our call to discuss Fortinet's financial results for the first quarter of 2024. Joining me on today's call are Ken Zee, Fortinet's founder, chairman, and CEO, Keith Jensen, our CFO, and John Whittle, our Chief Operating Officer. This is a live call that will be available for replay via webcast on our Investor Relations website. Ken will bring our call today by providing a high-level perspective on our business, Keith will then review our financial and operating results for the first quarter of 2024 before providing guidance for the second quarter of 2024 and updating the full year. We'll then open the call for questions. During the Q&A session, we ask that you please limit yourself to one question and one follow-up question to allow others to participate. Before we begin, I'd like to remind everyone that on today's call, we will be making forward-looking statements, and these forward-looking statements are subject to risks and uncertainties, which could cause actual results to differ materially from those projected. Please refer to our SEC filings, in particular the risk factors in our most recent Form 10-K and Form 10-Q, for more information. All forward-looking statements reflect our opinions only as of the date of this presentation, and we undertake no obligation and specifically disclaim any obligation to update forward-looking statements. Also, all references to financial metrics which we make on today's call are non-GAAP unless stated otherwise. Our GAAP results and GAAP to non-GAAP reconciliations are located in our earnings press release and in the presentation that accompanied today's remarks, both of which are posted on our investor relations website. The prepared remarks for today's call will be posted on the quarterly earnings section of the investor relations website immediately following the call. Lastly, all references to growth are on a year-over-year basis unless noted otherwise. I'll now turn the call over to Ken.

Thank you, Peter, and thank you to everyone for joining our call. Q1, we managed business with strong spending discipline and increased our operation margin 200 basis points to a first quarter record of 28.5%. We also generated record cash flow from operation of 830 million, and our adjusted free cash flow margin was 61%. We remain focused on investing in a fast-growing, unified, sassy, and secure operation market. which combined accounted for one-third of first-quarter billions. We continue to gain security networking market share, leveraging our advanced, differentiated 40OS and 40AC technologies, with an increasing number of large customers adopting our industry-leading secure networking solutions. Last month, attendance at our annual Accelerate Conference increased 25% year-over-year to nearly 5,000 participants, Our Unified SASE and new AI offering dominant the discussion with our partners and customers. For the first quarter, Unified SASE accounted for 24% of total buildings. To introduce customers and prospects to our new Unified SASE solution, we plan to run attractive promotions this year in 2024. For several reasons. we believe no cybersecurity company comes close to our differentiated Unified CELSI solutions. First, we have developed all Unified CELSI functionality into one single operating system, the 4DOS. This includes a full networking and security stack, comprised of APNA, Secure Web Gateway, CASB, and our market-leading SD-WAN and firewall technologies, providing content, applications, user, device, and location awareness to reduce attacks. Second, our unified SASE solution can be deployed on-premise in the cloud of both. Peer solutions send traffic to cloud-based POP, increasing security risk and latency, and it's less efficient. Last, Fortinet unified SASE offers both traditional software endpoint agents and hardware agents such as 40 Wi-Fi access points and 40 switches for customers, with easier deployment and more broad use cases such as Unified SASE for OT and IoT devices. We expect our differentiated Unified SASE offering to emerge as a SASE leader. Fortinet's advanced platform approach has been earning third-party awards for many years. Last month, we entered Ghana Magic Quadrant for Secure Service Edge, as shown on the slide 12 in the investor presentation. Fortinet is the only vendor recognized in the Ghana Magic Quadrant report for Secure Service Edge, SD-WAN, Single Vendor SASE, Network Firewall, and Enterprise Wired and Wireless LAN infrastructure. All five security and network offerings from Fortinet are uniquely built on one operating system, the FortiOS, and a leverage of FortiASIC to increase secure computing power for more functions and better performance while lowering the cost and energy consumption. Fortinet's SecureOps solutions, which are better integrated and automated together than competitors, accounted for 9% of total billions. Initially launched as part of our FortiSIM and FortiSource, our GenAI technology, FortiAI, is being deployed across both networking and security products. And today, we announced Energy First IoT Security Generative AI Assistant. Customers can ask FortiAI to help in 30-plus languages. Fortinet is also the market leader in OT security solutions. the fastest growing space in network security, with billions of devices connected online. And most OT devices have limited computing power, making network security the most effective means of security. Today, we announced the FortiGate 200G, a mid-range firewall powered by a new SP5 for ASIC, with secure computing rating of 3 to 10 expected performance around competitors and industry average We're enforcing our leading security networking and unified SaaS advantage that provide customers with industry-leading security functions, performance, and power efficiency. Before turning the call over to Keith, I wish to thank our employees, customers, partners, and suppliers worldwide for their continued support and hard work.

Thank you, Ken, and good afternoon, everyone. Let's start with the key highlights from the first quarter. As Ken mentioned, We continued to manage the business through the macro uncertainty and successfully drove operating margin to a first quarter record of 28.5%, exceeding the high end of the guidance range by 200 basis points. Free cash flow of $609 million represented a 45% free cash flow margin, benefiting from strong Q4 23 billings and their subsequent collection in Q1 of 24. Billings of $1.41 billion and revenue of $1.35 billion were within their respective guidance ranges. Looking at billings in more detail, while Unified, SASI, and SecOps delivered strong billings growth, total billings declined 6% as expected. The billings performance was driven by the difficult year-earlier comparison created by the backlog contribution to billings that occurred in last year's first quarter. Total bookings were down just slightly. Unified SASE and SecOps had outstanding growth across a variety of benchmarks in the first quarter. In addition, we saw significant progress from our investments in Unified SASE and SecOps. These include cross-selling into our large install base. Existing customers delivered over 90% of SecOps and Unified SASE billings. On an even more targeted basis, existing SD-WAN customers delivered 81% of Unified SASE billings. Larger enterprises are proving to be our largest customer segment, with large and mid-enterprises representing 78% and 84% of SecOps and Unified SASE buildings, respectively. Even with increasing scale, both pillars have strong pipeline growth, 30% for SecOps and over 45% for Unified SASE. More importantly, within SASE, The SSE pipeline growth is over 150%. Our investment in SASE is being recognized by third-party agencies. We recently recorded the trifecta with Gardner's SASE Magic Quadrants, SSE, SD-WAN, and Single Vendor SASE. And as Ken noted, with last month's addition to SSE, Fortinet now appears in five network security Gardner Magic Quadrants, again, all running on a single operating system. With the SASE Magic Quadrant Trifecta, customers have shown increased interest in learning more about our unique SASE platform that runs on the one operating system with one unified agent, one management system, and one data lake. To offer an example of customer interest, at our Accelerate conference early last month, the SASE demo booth was our most active as customers surveyed SASE's new features and functions, including end-to-end digital experience monitoring, remote browser isolation, advanced data loss prevention, and third-party SD-WAN connectivity. As a second example, nearly 25% of the accelerated attendees who joined our CMO for the SASE breakout session. The attendee number for this breakout session would have been even higher if it wasn't for the fire marshal's regulations that forced us to turn away customers and partners who were eager to hear more about the SASE offering. And to offer one final example, The customer and partner SASE fast-track training program at Fortinet, which launched in January, is already the number two most attended technical training session, training only at single vendor SASE partner SD-WAN. We're committed to driving more effective security solutions worldwide and welcome greater partnership with our industry peers. The new third-party SD-WAN connectivity technology is designed to support consolidation not only on Fortinet, but with Fortinet. In terms of scale, we continue to open new Google and Fortinet Pops in sync with our customers' expanding footprint and driving the deployment scale demanded by large enterprises. And a quick update on that seven-figure, 300,000-seat education deal that we mentioned last quarter. The full production environment was activated in March, and we are on track to have their 300,000-plus seats on board to start the new school year. To expand on Ken's earlier comment about today's AI-related announcement, Fortinet's GenAI Assistant follows our 40 AI launch last year by supporting and guiding SOC and NOC teams as they configure and manage changes to their network and investigate and remediate threats. Its intuitive interface allows individuals to engage using 30 different natural languages, bridging the industry's skill shortage. I encourage everyone to visit Fortinet.com to learn more about the GNI Assistant. Rounding out our Billings Commentary, SMB was the top-performing customer segment, International Emerging was our best-performing geography, and our three largest industry verticals continue to be worldwide government, service providers, and financial services. Service provider and worldwide government experienced the highest growth, while retail and financial services were a bit more challenged. As noted in our prior call, the six eight-figure deals in Q4 23 pushed our average contract term in DSO to elevated levels. The average contract term in the first quarter was 27 months, down just under one month year-over-year and three and a half months quarter-over-quarter. DSO decreased 12 days year-over-year and 23 days quarter-over-quarter to 66 days. Turning to revenue and margins, total revenue grew 7% to $1.35 billion, driven by service revenue growth. Service revenue of $944 million grew 24%, accounting for 70% of total revenue, and a revenue mix shift to services of 10 points. Service revenue growth was led by over 30% growth from Unified SASE and SecOps. Product revenue decreased 18%, as expected, to $409 million, coming off a challenging 35% year-earlier compare impacted by backlog fulfillment in the prior year. Software license revenue increased 20% and represented a mid- to high-teens mix of product revenue. Total net product bookings were down just slightly. Combined revenue from software licenses and software services, such as cloud and SaaS security options, increased 29%, and represented an annual revenue run rate approaching $750 million. Total gross margin of 78.1% was up 180 basis points and exceeded the high end of our guidance range, benefiting from the mix shift to higher margin service revenues. Service gross margins of 87.9% were up 200 basis points as service revenue outpaced labor cost increases and benefited from the mix shift towards higher margins 40-yard security subscriptions. Product gross margin of 55.7% were pressured as we saw challenges related to inventory levels and the transition to a more normalized demand environment. Operating margin of 28.5% was 200 basis points above the high end of our guidance range, reflecting the strong gross margins and prudent cost management. Looking at the statement of cash flows, summarized on slides 16 and 17, free cash flow was $609 million. Adjusted free cash flow, which excludes real estate investments, was $821 million, representing a 61% adjusted free cash flow margin. Infrastructure investments totaled $222 million, including $212 million of real estate investments. Cash taxes in the quarter were $31 million. And while we did not repurchase shares in Q1, share buybacks have totaled $5.3 billion over the past four-plus years, and the remaining buyback authorization is $1 billion. Now I'd like to share a few significant wins from the first quarter. I'll start with the one eight-figure deal in the quarter, a competitive displacement and new logo win. This large U.S. financial institution selected Fortinet as part of their data center update and consolidation project. Keys to this win included our experience in this highly regulated, customer data-sensitive industry and our ability to lower the total cost of ownership and exceed their low latency performance requirements. Similar to other large financial institutions separating from their incumbent, this customer is expanding their Fortinet footprint by adding our SD branch solution and planning to consolidate additional technologies. Next, in the competitive seven-figure win, a hospitality company that serves over 5 million guests annually, updated their various Fortinet solutions, including their Florida Gate firewall footprint and 40 NAC solutions. Keys to expanding our relationship included our price-to-performance advantage on the firewalls and the NAC solutions' proven ability to discover and lock down devices that attempt to join their network, together with the operational simplicity and integration of the dozen different Fortinet solutions the customer uses. In another seven-figure deal, a hotel and restaurant chain purchased our SD branch solution for 800 locations, as well as our data center 40 gates for centralized management and enhanced security. This solution from our network security pillar included firewalls, switches, and access points, as well as a variety of software products. The SD branch solutions bring improved efficiency, and security over their branches and IoT devices. Key to this win, and in other retail opportunities, is enabling retailers to deploy, expand, and deliver a growing array of in-store digital solutions to support their customers' experience and increase their top-line performance. As these customer wins illustrate, our Security Fabric platform includes each of our security pillars, Unified SASE, AI-driven SecOps, and secure networking, making it the most integrated, most open portfolio of products in the industry, backed by one operating system, 40 OS, one unified agent, 40 client, one management console, 40 manager, one data lake, 40 analyzer, and open APIs and integration with over 500 competitor and other third-party products. This integration allows customers to consolidate security solutions, thereby reducing operational costs, while increasing security effectiveness. Moving to guidance, as a reminder, our first quarter and full year outlook, which are summarized on slides 21 and 22, are subject to disclaimers regarding forward-looking information that Peter provided at the beginning of the call. For the second quarter, we expect billings in the range of $1,490,000 to $1,550,000, which at the midpoint represents a decline of 1%. Revenue in the range of $1,375,000 to $1,435,000, which at the midpoint represents growth of 9%. Non-GAAP gross margin of 76.5% to 77.5%. Non-GAAP operating margin of 25.75% to 26.75%. Non-GAAP earnings per share of $0.39 to $0.41, which assumes a share counted between $775 and $785 million. capital expenditures of $30 to $40 million, a non-GAAP tax rate of 17%, and cash taxes of $240 to $270 million. Before updating the four-year guidance, I'd like to elaborate on the backlog headwinds easing in the second half of 2024 and share what we believe we are starting to see as early signs that the firewall digestion cycle is nearing completion. First, the billings headwind from last year's backlog drawdown is over $150 million in 2024 and gradually diminishes throughout the year with no headwind in the fourth quarter. And second, when looking for early signs of a more normalized firewall market, one metric we watch is the average days to register security service contracts, as shown on slide 19. In 2022, we noted the days to register had increased about 50%, which was consistent with customers' buying and stocking behaviors at the time. More recently, this metric decreased by about 25% from its peak and is now consistent with late 2021 levels. It is on a pace to return to normal levels in the second half of 2024. A reasonable read-through of the data is that customers are completing the inventory digestion process and are on the path to a more normalized firewall buying behavior. And with that, for the year we expect, buildings in the range of $6,400,000 to $6,600,000, revenue in the range of $5,745,000 to $5,845,000, which at the midpoint represents growth of 9%. Service revenue in the range of $3,940,000 to $3,990,000, which at the midpoint represents growth of 17%. Non-GAAP gross margin is 76.5% to 78%. Non-GAAP operating margin is 26.5% to 28%. Non-GAAP earnings per share are $1.73 to $1.79, which assumes a share accounted between $780 and $790 million. Capital expenditures are $350 to $400 million. The non-GAAP tax rate is 17%. And cash taxes are between $500 million and $550 million. I look forward to updating you on our progress in the coming quarters. Now I'm going to hand the call back over to Peter to begin the Q&A session.

Peter, as a reminder, during the Q&A session, we ask that you please limit yourself to one question and one follow-up to allow others to participate. Operator, please open up the line for questions.

Thank you. At this time, we will conduct the question and answer session. As a reminder, to ask a question, you will need to press star 1-1 on your telephone and wait for your name to be announced. To withdraw your question, please press star 1-1 again. Please stand by while we compile the Q&A roster. Our first question comes from the line of Hamza Fadarwala from Morgan Stanley. Your line is now open.

Good evening, and thank you for taking my question. Perhaps both for Ken and Keith, you spoke to a lot of green shoots in your prepared remarks, you know, SMB, service provider growth looks a little healthier. You're getting recognition on SASE and you spoke to competitive replacements. That said, the billings in Q1 was a bit closer to the lower end of your guidance versus the high end. So just curious, you know, what drove that and what gives you confidence based on what you're seeing in the pipeline to maintain your guidance and continue to assume a reacceleration in the top flight in the back half of the year? Thank you.

Yeah, I'll talk about the full year. I think that if you look at where we ended up in the first quarter, you know, inside the guidance range, maybe just a little bit of weakness that we saw in Europe, just enough to move us off the midpoint, but not really a big movement in terms of where we are in our final results compared to the midpoint. And if we look at where we end up for the total for the year, I don't think we're at all far off from the plan that we thought. Maybe there's some onesies and twosies there that you're kind of pointing out. But as we look at the pipeline, to your point, I think the mix that we see in our pipeline today, together with some of the hygiene improvements that we've worked on for the last six to nine months, I think we feel better about where we end up with the full year numbers, if you will. I think at the same time, when you look at the full year numbers, and some of the outperformance in the quarter or better performance, if you will, with service revenue and product revenue, you see us bringing that number up a little bit. But importantly, at the same time, you see us also bringing up the margin number on the bottom line by about three-quarters of a point.

Yeah, I think the high interest rate making the money kind of more expensive have a lot of enterprise kind of a, probably most favored OPAC instead of a CAPEX for some of the networking security project. So that's also the reason we started shifting the focus more on the kind of a SASE or kind of secure op, which is really more helping company saving the cost at the same time. kind of mobile some kind of OPEX model so that that's probably at the same time we do making some adjustment in certain product price back to like a pro-pandemic level before the supply shortage that's happening in Q1 probably has a little bit impact but it's a overall I think the the product competitive still more and more strong. We still see a lot of replacement of our competitive product, which tend to be more expensive. And especially the new 40 OS introduced last month with more functions, including all the functions, the unified CRC, all these things drive a lot of attention from the customer, and they all interest to this new OS and the new product we have launched.

Thank you.

Thank you, and one moment for our next question. Our next question is from Gabriela Borgs of Goldman Sachs. Your line is now open.

Good afternoon. Thank you. For either Ken or Keith, I'd love to get an update on your pricing strategy more broadly. More specifically, how do you think about the trade-off between discounting when you're cross-selling a broader bundle of portfolios such as SecOps or SSE services versus being able to capture some of the value from the cross-sell? How do you think about that trade-off? Thank you.

Well, I think our price strategy is pretty consistent in the last 20 plus years. We want to maintain a healthy growth margin and also a healthy margin for the partners and the When we see certain cost increase, like during the supply chain shortage, whether the component cost or some shipping cost increase, we kind of increase the price. But now some of the cost coming down, we also kind of return some margin to the partner and also lower some product price to match the pandemic level. But I think all this price change is over. And also, we probably more focus on the new products. and which follow kind of a healthy margin guideline. I don't think we're adjusting any pricing for the existing product anymore. It's really more focused on when we introduce a new product, we just want to make sure it has a healthy margin for all the parties.

Thank you.

Thank you.

Thank you, and one moment for our next question. Our next question comes from Brian Essex from JP Morgan. Your line is now open.

Great. Thank you for taking the question. I appreciate it. Maybe for Ken, in terms of the SASE traction that you saw in the quarter, how much was SD-WAN conversion and maybe a little bit, if you could give us a little more color on the split of the customers that you saw in that business, the split up maybe large, mid, small enterprise, so we can get a sense of competitively how you might be lining up against some of the peers in that SaaS market.

I think that's a great question.

I think we have a slide for that. Peter might have asked that question. Yeah. I think we also included in the prepared... Peter read my mind. And I'll tap dance here while somebody follows the actual slide number for you, Brian. But, yeah, I think that existing customers were over 90% for both SASE and for SecOps, so they were expansion sales. And Ken's kindly pointing out to me my slide number eight that's in the deck that actually gives you a little more context for it. One change you may notice there is that for the first few quarters when we talked about customer mix and the expansion opportunity, we did it by customer counts, believing that we were going to have a lot of penetration with the SMB space and that was where you get a larger number to start seeing some patterns. What we've now seen is that the large enterprises and the mid-enterprises are actually dominating both of those pillars of growth. And with that, we've just converted those pie charts to dollar values, which is more traditional where we expect it to get eventually.

Okay. Great. Thank you for that. Maybe just as a quick follow-up on that topic, I think you mentioned, if I'm not mistaken, unified SAFI, 81% of I'm sorry, SD-WAN, 81% of unified SASE billings. And I think you might have given that metric to back in SD-WAN last quarter, if you could maybe reiterate what that was.

Yeah, Brian, what we're trying to say there is that I think there's a common belief internally and probably externally that we're going to have a lot of success with the SASE solution by cross-selling our existing SD-WAN customers. And so the SASE billings that we saw this quarter I believe the number was 81% of those were existing SD-WAN customers.

Yeah, and also we build SD-WAN function into the 40 OS, which whenever we have a 40K, we build it like a close to 60%, 70% customer all have to own by the 40K. They have automatic SD-WAN function. And so that's where we do see... I see one customer, which we are fully tracking because it's a part of OS function. We have a charge. So we do believe a lot of them are interested to convert into SASE for SASE function there.

Got it. That's really helpful. Thank you very much. I really appreciate it. Thank you.

Thank you. And one moment for our next question. Our next question is from Fatima Bulani from Citi.

Your line is now open.

Thank you. Good afternoon. I appreciate you taking my question. Keith, I wanted to have you spend a little bit of more time talking about some of the geographic theater-level performances. So we've seen a pretty material deceleration in your America's Business, and Mia's been relatively resilient, and APAC's actually shrunk this quarter. So I was hoping you could put a lens on each one of those geographies to talk about any nuances or idiosyncrasies from a demand and or buying perspective from an end market standpoint or a customer attribution standpoint. And then just a follow-up with regards to if you can talk about the pipeline and pipeline growth you're seeing with secure SD-WAN proper, considering that is such an important conduit for future SASE upsells? Thank you.

Okay, where to begin? I'm kind of cherry-picking through some data points. I think, first and foremost, the SMB continues to perform stronger than expectations, whether that's external to the company or from other sources, if you will. It's very resilient, and I think it's simply the breadth of the SMB space together with, as I've said in the past, the success of the channel program. I think Europe was just a tad bit light in the quarter and a little bit on their enterprise side of their business and probably just enough, as I said before, to move us off of the midpoint of our guidance. I think what we've spent a fair amount of time with more recently is looking at where the eight-figure deal is coming from And if you're looking at the deceleration, and let's take the U.S. enterprise as an example of that. Last quarter, we talked about six eight-figure deals in the business. The vast majority of those were in the U.S. enterprise. This quarter, we gently noted that we had one eight-figure deal. And so you can see that those eight-figure deals can whipsaw that growth rate for the U.S. enterprise around quite a bit, really because of their opportunities in these eight-figure deals that maybe some of the other geos don't have. We really don't have those opportunities in APAC and some of the other geographies that we see in the U.S. I think the other part of growth, I mean, I think we have to understand where the firewall growth is right now in terms of the industry. And with that, it puts a lot of either pressure or opportunity for us to sell the SASE solutions and the SECOP solutions And you're probably seeing a little more maturity in the ability to sell or the openness to buy SecOps and SASE solutions in the U.S. and in Europe, the larger economies, than you are in APAC.

Also, Japan probably comes about as the biggest country for us in APAC, probably one of the more APAC, which the currency... like the U.S. currency is pretty strong against Japan currency recently. That may also have some impact of some slowdown there. On the other side, we do see most SD-WAN customers definitely more interest in the SASE. And also in the current environment, more and more customers starting to turn on SD-WAN because SD-WAN definitely gave them a cost saving. So our average is about 50% cost saving compared to the traditional NPRS or other networking function there. So, we do see more and more customers first converting to SD-WAN customer and then using the same 45-second additional static function there.

Thank you.

Thank you, and one moment for our next caller.

Our next question comes from Tal Liani of Bank of America.

Your line is now open.

Hi, guys. You gave some comments at the end of your prepared remarks about signs of recovery of the firewall market, and would you mind to repeat that? You went over it quickly, and the question is also with it, do you expect the non-forti-gate to recover? Is there a correlation between the two? Do you expect the non-forti-gate to recover, or does it have its own cycle? On the first question, which is about the firewall recovery, do you see that the market share situation is changing, meaning the share gains you experience in the three years of the boom cycle Do you have any reason to believe that it's going to slow down or you're going to maintain market share gain? How does it change when the market recovers? What drives the share dynamics to change or to stay stable? Thanks.

You want to take the market share and the dynamics, and then I'll go through the algebra, slide 19.

Yeah, I think we believe we continue gaining market share. Even right now, the quarter last quarter in the sick because the Q networking, which are both the firewall and also some other like 40 Wi Fi 40 sati space there. And I think because the weather that strong performance advantage we have all kinds of more function can give a customer like a better ROI return and better security and also more deployed case compared to the traditional firewall. So we feel we're keeping gaining market share. But overall, I have to say that whether the network security firewall market or the networking market definitely is going down like 10% to 20% year over year. But even in that market condition, we're keeping gaining more market share in this environment. Keith probably answered the question.

Yeah, for people that have access to it, slide 19 in the deck. And for those, a lot of you have followed the company for quite a while, and you remember that we had some pressure on software revenue early in the pandemic. And we talked about things like the impact from our share, but also that we were seeing a delay in customers registering the service contracts that attach to the hardware contracts. And if you look at that chart, you can see that that delaying activity really started at the end of 2021, peaked at the end of the beginning of 23, kind of plateaued and now has moved down. And what we believe is you're seeing there is that when the supply chain hit, customers bought the equipment, put it on the shelves, and did not need to register the contract as quickly. And that's why you saw the increase in the days to register. Now as we move through the digestion cycle, you're seeing that inventories come off their shelves and those days to register are starting to return to normal. We're not quite there, but we're actually quite close to it. And I would just offer that I think, as I said, by the second half of this year on the current pace, we would return to where we were at pre-COVID on that metric. And again, we think that's a very good indicator of where customers are in the digestion cycle.

Got it. And what about the question on non-fortigate? What are the cycles with the non-fortigate on the non-fortigate side?

Well, first of all, you're going to get me in trouble for using the term non-fortigate. We talk about SASE and SECOPS, but we're all showing our age here a little bit.

The non-fortigate probably around 10% of our product. That's probably... I see that the networking side is definitely down a little bit, but there's some other, like, whether the 40 white, 40 male, some other, we see 40 black, we see pretty strong growth. So it's a mix. But overall, I think pretty much similar, like, at FortiGate is a mix. But definitely we see. And on the other side, we do see some early signs of interest, how customers are using our full system. uh wi-fi ap 40 switch as a hardware agent uh for the sassy uh so that's also one of the promotion we are we're going to run it's really offer some customers uh if they get a 40 wi-fi they probably can run some free 40 sassy function uh for some time uh so that that's we see could be driving additional 940 gate growth but we actually all the 940 gate product we also have technology we call the 40 link It's all linked with FortiGate, like FortiGate, whether it's kind of a 9G firewall host or SASE host working together with FortiWiFi or FortiSwitch. Thank you.

Thank you, and one moment for our next question. Our next question is from Rob Owens of Piper Sandler.

Your line is now open.

Thank you very much. Keith, I want to build a little bit on your answer to Fatima's question earlier. And I believe you used the technical term of whipsawing when it comes to growth, when you saw six large transactions, very large transactions in Q4 and one in Q1. And just, I want to ask it relative to health and enterprise and what you're seeing here in the pipeline. And should we expect similar types of results in terms of those very large deals as we move throughout the year, and how do you think the pipeline is setting up in relative health of the enterprise? Thanks.

Yeah, I feel good about it, and I think the parallel that I've drawn in conversations before is that if you went back to 2015-16, you saw the company moving away from or expanding beyond the S&P space and doing million-dollar deals, but it wasn't that there was enough of million-dollar deals that we couldn't get whipsawed by them then. Now we've got plenty, well, I could always take more, plenty of million-dollar deals, but the $10 million deals are whipsawing us around a little bit. You saw that with a very strong performance in the fourth quarter, and I think we were pretty open about that in the fourth quarter, setting expectations for the first. One thing we have spent some time doing is going back and looking at the number of eight-figure deals we have by quarter for, say, the last three or four years, and you're looking at a model that maybe had one every other quarter five years ago to now where you probably average something on the order of two, perhaps three of opportunities you know, over a full year per quarter. They're going to get condensed sometimes in certain quarters. With our business model and the history, you see that Q4 obviously outperforms, as does Q2 typically performs strongly. And I suspect as we look forward, we'll see a little more concentration of those eight-figure deals, certainly in Q4 and maybe some in Q2. Thank you.

Thank you. And one moment for our next question. Our next question is from Saket Kalia of Barclays.

Your line is now open.

Okay, great. Hey guys, thanks for taking my questions here. Ken, maybe the first one is for you. I was wondering if you could just talk a little bit about how your conversations are going with customers around their plans to refresh their firewall appliances. And maybe specifically, when would we sort of expect that firewall refresh to sort of begin? Does that make sense?

Yes. I see there's three parts of the business. One, like Keith mentioned, is really the digestion, whatever supply chain issue. I think that's pretty much over, maybe just a few more months. will be all normal. And the second part is really the refresh, which is the current customer over the new product, which has a better performance, all these things there. I have to say, during the economy slowdown or high interest rate environment, some customers may stretch the current product a little bit longer. But we do see more cases we call the replacements. and also the new area, like OT, IoT security. So we do see the recruitment pick up quite well, which when they're facing, like, whether they need a new function, like the new SD-WAN function or the SATI function, a lot of big enterprises starting using our product to replace a more competitive product because they have to offer, like, multiple products to match one of our 40K, the 40OS solution there. And we also have a much better performance and power efficiency. We're using the measure for every product. So that's replacement case definitely picking up quite well. The refresh probably would still need some time to come. And on the other side, the new area like OT, IoT security, we see very, very strong growth. So that's a new market. because usually all these OT device not connect online, all kind of connect online, has no protection, and pretty much impossible to run endpoint software because of different operating systems and limited computing power. So we see this new OT, IoT space pick up quite well. That's the new market. So long-term-wise, I still believe the network security market continues to grow like 10% to 20%. But it probably will be more mixed in the current environment, probably a little bit more towards the RPAX model, which is kind of a SASE. But for us, the differentiation is really we have all the SASE in the same FortiGate operating system, the FortiOS, which customers can run right on-premise or in the cloud and the top. So we do see a lot of customers that can turn on the SASE function, maybe second time, I see one function first, and then additional SASE function, additional SASE service. So that's the way they are starting doing now.

Got it. Got it. And maybe the follow-up is on that point, Ken, if I can stay with you. Just on that topic of refresh and replacement, is there any sort of change in thinking for those customers about firewall versus SASE? And, I mean, as part of that discussion, you mentioned pricing earlier. Are you getting any sort of pushback on just appliance pricing as since sort of the prior round of adjustments that you did sort of during the supply chain?

We have not seen any pricing pressure discount because we tend to be a much better performance and more function because our ASIC technology and not our competitor has. On the other side, during COSMA considered a new function they needed for security or higher network speed environment, I think compared us to some competitors, because competitors sometimes they just cannot keep adding new functions like all the SD-WAN, all the SASE functions in their existing firewall. For us, it's very, very different. So we have all the SD-WAN functions, all the new SASE functions built in into the same 40 OS, running on different kind of a 40K device there. So that's also kind of helping customers to really keeping adding additional functions sometimes without really replacing the existing hardware. So that's really helping the customer keeping kind of adding service and enhance security with new function there. And that's also driving a lot of replacement of our competitor solution, especially in the big enterprise environment. So that's where we see the strongest growing area for us actually is enterprise. customers, which a lot of them are under some finance stress because the high cost of the money. But we do see that the growing in our enterprise space, the developers are strong and a lot of replacement of competitive solutions using the 40 gate, which has a more function, better performance, low cost, and also more efficient on the energy consumption there.

Super helpful. Thanks, guys. Thank you.

Thank you and one moment for our next question.

Our next question comes from Brad Zelnick of Analyst. Your line is now open.

Great. Thank you so much for taking my questions. And because we just had two for Ken, I think I'm going to now go for two with Keith if we could. Keith, first one I think pretty straightforward. With a billion dollars left in your buyback authorization, and the strong cash generation of the business. I was surprised to see you not buy back any stock in the quarter. Can you just remind us of your approach to buybacks and if any change in thinking around use of cash and specifically M&A?

Peter's pointing at our CEO over M&A answers. We're all listening, leaning forward to hear what he wants to say. I don't think there's been any real change in our buyback philosophy. The term we use is we're very opportunistic. We do put up program in place with one of the Wall Street firms each quarter, and we renew it. I think the important part there is looking at the $5 billion that we've bought back over the last four years, and it's not that we're doing, you know, some other companies would do X percent of free cash flow or something like that. It is really looking for market opportunities, and when we see them, Ken typically steps in and has something set up in that regard. And now our CEO, John Whittle, has been getting a chance to join. Thanks, John.

On M&A, thank you for the question. On M&A, we've always been very, very disciplined. We've done some very strategic tech and talent tuck-ins, and I think you'll see we're open-minded. We consider M&A as it makes sense, but that's definitely been our approach so far, and I think you'll see that approach continue, although we will be open-minded about M&A as it makes sense.

Thank you for that. And maybe just my, my followup.

I'm sorry, please. Probably is the most busy time in the last 10, 20 years now to look at all different companies.

Yeah. We, we see a lot of opportunities in the security space for sure. Um, and, uh, so yeah, we're, we're, we're, we build a pipeline just like sales, build a pipeline and we consider, consider them as they come along and, and reach out to us on products as well.

Got it. That, that makes all the sense in the world. Um, and you guys have done a great job of it over the years. Maybe just on the margin discipline and the leverage that we're seeing in the quarter, Keith, can you maybe just give us an update on headcount plans and where you are year-to-date, and maybe relative to three months ago, how enthusiastic you are and where you are in sort of pushing or pulling back on the throttle to continue hiring and how we should think about OPEX. Thank you.

It's okay. I think we continue to invest, balance the growth and margin. So the area, like a lot of the long-term product, we continue to invest. And we do the selective hiring. And also, we also take this opportunity to make the management ratio or structure a little bit better. So it's more invest in the field sales engineer and also the R&D area and kind of more flat on certain management level and making the whole company more efficient.

Yeah, I think the setting aside the fact that I need more resources in finance, but I'm hoping Ken was just going to announce that, but probably not. I think the business model, Brad, you've seen it through the cycles where If you look back at 2017, for example, and you look at the gross margin number, when you start to see the slowdown or the pause, the cycle in the hardware, you start to see the mix shift to the really rich services. And then as the market recovers, you see that relationship change a little bit. Clearly, we're in a situation right now where the firewall market, that the mix really shifted 10 points to services, and I think that was 87% gross margin. You know, it's making margin targets very achievable, let's put it that way. And I would imagine, I think we've raised it by three-quarters of a point at the midpoint for the full year. That's a pretty big move at this point, and I think we feel very comfortable with that as we look at the rest of 2024. Excellent. Thank you.

Thank you, and one moment for our next question. Our next question comes from Ben Ballen of Cleveland Research Company. Your line is now open.

Thanks. I appreciate you taking the question. Good afternoon, everyone. Keith, I was hoping you could talk a little bit about the receivables drawdown and the DSO performance. I believe you made a comment on your prepared remarks about large steel impact in collections, but it does look like DSOs are below what we've seen for the last few years. So I'm curious if there's a change in working capital management. Anything notable there?

No, I don't think there's really a change. I think there's always a few puts and takes, if you will. I think the real driver was that last quarter we had those six, eight-figure deals, and I believe all those closed in the last week or two of the quarter, and so that put a lot of pressure on DSOs. and only having one eight-figure deal this quarter, which I believe closed fairly early in the quarter, not early, I mean mid-quarter, but not in the last week. So I think that's really all I would point to there.

Okay. And the last one for me, you talked a little bit about duration. If you step back, a lot of your business is done through the partner community. Do you have any thoughts on how much of that business is being financed by the partners themselves? to manage this, you know, kind of CapEx to OpEx appetite. Any thoughts there would be helpful. Thanks.

Yeah, I think when you say partners, I would say that all the large distributors that we're working with are offering financing programs either, you know, in some cases it might be through their own captive, but I think more often than not it's white labeling somebody else's product, if you will. I think that also some of the larger resellers are also offering financing. I think that where it makes a little more sense for ourselves as an OEM is on larger deals, whether we move to the extended payment program or working with the channel to provide them capital, if you will, for the financing. I think there's a lot of different ways to go there, but I don't think good credits, so to speak, are suffering because they can't find credit. I don't think that's the issue.

Thank you. Thank you, and one moment for our next question.

Our next question comes from Adam Borg of Stifel. Your line is now open.

Awesome, and thanks so much for taking the questions. Maybe for Ken, last quarter you talked about a great job with increasing traction with enterprise agreements, and I was hoping you could talk. Obviously, I know 1Q is typically a smaller EA quarter. Maybe talk a little bit more about the EA strategy overall and the go-to-market efforts to more systematically drive these enterprise agreements, especially in the back half of this year?

Yeah, I think we do see when we have more enterprise customers and they also want to be long-term customers and also with many different products, like the consolidation strategy they have right now, we see more EA. And at the same time, with that one, we definitely see

kind of a bigger deal and also kind of a more long-term customer what can we love right now yeah I think that John took this over so he gets to make that it's a victory lap on EA's but you know it's kind of alluded to it it tends to make a lot of sense when You're usually going to see it as part of your expansion inside of a larger enterprise. You're probably not going to see it frequently with the very first sale into a new logo. You could. And I think some things that are really starting to resonate there are the new 40 points program that we make available and things of that nature where customers have reached that point where they're very comfortable for the technology and our customer support, et cetera, and they start thinking about long-term relationships. They know they're going to buy more. They may not know what. But the combination of EAs and 40 points, I think, has been well received by the customer group.

That's great. And maybe just as a quick follow-up, in the slide deck, I didn't recall seeing the breakout of the FortiGate by small, medium, and large. I know that indicator has been less meaningful more recently. I'm just curious if there's anything interesting there as you think about the FortiGate sales by size. Thanks again.

No, I think you alluded to it. I think it's really, you see us, you know, at this point in the firewall lifecycle, firewall cycle, it's really, for us, we want to increase the focus on SASI. I think we feel very good about it. You see us adding some more information there. And to your point that it wasn't anything that was really new or earth-shattering on the FortiGates. Great. Thanks again.

Thank you.

And one moment for our next question. Our next question comes from Keith Bachman of BMO.

Your line is now open.

Good afternoon. Thank you very much. And Peter and Keith, I appreciate the slides. I did find seven and eight to be quite interesting and want to focus my first question on that. And if you look at the amount of billings from SASE, 24 percent, Is there just any clarification of that 24%? How much is SD-WAN? And then if I look at the SecOps, really interesting that enterprise is 40% of the SecOps. And is there just any patterns or anything that's kind of bubbling up as a frequent purchase within the SecOps portfolio you have that is serving to be pretty interesting to the enterprise. I thought that 40% number was quite interesting. And believe it or not, I'm going to count that as one question. And then, Keith, just anything you could think about or guide us on the FortiCare support line item as we think about the correlation to the product sales, and then I will cede the floor before Peter gets a chance to cut me off.

I think it's a great question. FortiCare, which is the traditional supporter offering, we talk about services being a lagging indicator. It's really what did you sell before and what are you recognizing now? What's important is that FortiCare is going to be more closely linked to more recent product sales because you have fewer products to attach it, so you'll probably see a little more pressure on FortiCare there. FortiGuard, which is the security subscriptions, which can be bundled, but they can also now be a variety of psych-op solutions and SASE solutions, is getting a fair amount of tailwind from those other two pillars. So you will start to see, I think, and have seen a little more divergence in the growth rates as it goes through this cycle that we know between FortiCare and FortiGuard. And the interesting thing is that FortiGuard actually has higher margins, if you will. And I think that We decided to call out one of the prepared remarks that if you looked at, you know, the SaaS and SecOps business, which I'll just broadly call SaaS, not County 40 Care and 40 Guard, and our software licenses, you're starting to see a company now that has a run rate of about $750 million in, say, non-hardware and non-attached service contracts, which is pretty impressive, I think.

I would say since we only launched our own 40 SaaS six months ago, we see pretty strong growth. But also SD-WAN has been there for a few years. So I have to say probably a majority, if not the most, SASE still more come from SD-WAN, which is in the chart there. Maybe the better way to say is really look at the pipeline. So that's on KISS script. He says it's a unified SASI probably pipeline growth like 45% and then the SSE pipeline growth over 150%. That's maybe a better indicator as a pretty strong for the SASI interest and also leverage of both SD-WAN and the firewall market leading position there. So we do see a lot of customer adding the SASI, adding the SD-WAN, and convert some of them to the additional surveys, which will probably come out about over 90% of all, like the SASI business right now. And there is also very strong interest from the customer right now. At the same time, some of the trial program, like you've seen the 40, Wi-Fi AP as a hardware agent offers certain free SASE service, that's also what drive additional like a differentiated SASE, unified SASE approach compared to the other competitor in the market, which we also believe will be quite a lot of SASE business going forward. So that's also the reason we believe probably within a few quarter to a few year will be the number one leader in the SASE market.

Thank you, and one moment for our next question. Our next question comes from Joseph Gallo of Jefferies. Your line is now open.

Hey, guys. Thanks for the question and getting me in here. A lot of cool stuff around AI at your conference. For 40 AI, any early feedback, and how are we thinking about monetizing that and any impact to gross margins? And when can that benefit Topline? Thanks.

Yeah, totally agree. There's a lot of interest in AI for the AI. We're starting to apply more for the AI to different products, which are helping customers efficiently manage their operation there. And that's also a drive for additional service, additional product sales there. I'd say it's still more in the early run-up stage, but its interest is rather high, and we do see some benefit already. But how soon will it be materialized?

Yeah, I think it's more tactical responses to you. In general, we're charging for it separately. It's on the price list. It's additive to it, and you're going to really push my technical knowledge. Maybe somebody here can help me out. But I think there's an LLM that the customer has to go out and buy on their own, in some cases, to enable it. And then I would offer a really shameless plug. I really tell you, you should go look at our website and see the demo that was done at Accelerate with 40 AI. It was fantastic.

Yep. No, we saw it live. Just a quick follow-up on, I really, really appreciate the time to register, days to register metric. It's really interesting. Was there any seasonality in that metric historically before or after firewall cycles? Just trying to better understand if we should expect to find a floor at 2019 levels or if there's a potential another leg down. Thanks.

I think probably if I look back to 20, 30 years, when there's a big attack in the space, then they try some kind of a new function, then there's some rush by or something, maybe impact some of that. Otherwise, it's pretty normal, I don't know, seven, eight weeks, whatever, for a customer to register. And then the last two, three years, the supply chain is really changing now. Sometimes certain channel partners or the distributor may try to have a little bit more inventory. And sometimes the customer, because it takes some time to deploy, they also try to order some actual inventory. But that's pretty much all normal now. If you place the order, you pretty much can get it delivered right away. No longer has a lead time anymore. So that's where we see it's a digestion pretty much a little over and it's pretty back to normal in the current environment now.

Yeah, I think the chart itself actually goes all the way back to 2019, and you can see it by quarter there. Nothing jumps out at me in terms of seasonality by quarter that would really have a call out to it.

This now concludes the question and answer session. I would now like to turn it back to Peter Salkowski for closing remarks.

Thank you, Brianna. I'd like to thank everyone for joining today's call. Fortinet will be attending investor conferences hosted by J.P. Morgan and Bank of America during the second quarter. Fireside chat webcast links will be posted on the events and presentation section of Fortinet's investor relations website. If you have any follow-up questions, please feel free to contact me. Have a great rest of your day. Thank you very much.

Thank you for your participation in today's conference. This does conclude the program. You may now disconnect.