Funtap
Fortinet's (NASDAQ:FTNT) business continues to struggle due to soft demand and excessive inventory levels throughout its supply chain. While conditions are currently difficult, Fortinet remains confident that headwinds will begin to ease later in 2024. Absent a further deterioration in macro conditions, this will probably prove to be the case, although a rapid rebound is already priced into the stock. I previously suggested that soft demand could cause Fortinet problems for an extended period of time. While it is too early to say whether this is the case, the stock is down around 11% since then.
Market Conditions
While macro weakness persists, Fortinet has suggested it is seeing some green shoots. This appears to be based on a belief that customers are beginning to work their way through excess inventory levels. Fortinet still has its own inventory problems though, and the weak demand environment appears to be pressuring pricing.
Figure 1: "Fortinet Pricing" Search Interest (source: Created by author using data from Fortinet and Google Trends)
Figure 2: Fortinet Product Gross Profit Margin (source: Created by author using data from Fortinet)
Fortinet's results have been poor in recent quarters primarily due to its dependence on revenue from hardware. There is little reason to believe that Fortinet's current struggles are due to any company specific issues, and current weakness will not persist indefinitely.
This will change overtime though as Fortinet's SASE and SecOps business grow in importance. Within cybersecurity there is a trend towards consolidation and Fortinet is likely to be one of the winners of this. Fortinet has suggested that companies are pursuing a platform approach as parts of their business are commoditized. In Fortinet's case this appears unlikely given the differentiation its ASICs and OS provide.
Figure 3: Firewall Units Shipped (source: Fortinet)
Lacework Acquisition
Fortinet recently agreed to acquire Lacework, which should help to fast track its cloud security business. Lacework has a Cloud-Native Application Protection Platform that leverages data and AI to detect anomalies. This is difficult as many “unusual” things happen in the cloud which rarely represent an attack. There is also a question of whether there is sufficient cloud data available for this approach to work. Lacework later introduced the Lacework Query Language to enable the creation of custom rules, which may have been the result of difficulties encountered with its AI approach. Lacework's technology includes an agent and agentless architecture for data collection, a data lake, and a code security offering.
At its peak, Lacework was valued at $8.3 billion, but the company has since run into hard times, recently laying off 20% of its workforce. Lacework had also been in acquisition talks with Wiz, with a reported $150-$200 million price tag. Lacework reportedly has around $100 million ARR and nearly 1,000 customers.
An acquisition of this size goes against Fortinet’s preference for internal development. The acquisition was probably attractively priced though and will allow Fortinet to quickly build a stronger position in cloud security.
Fortinet Business Updates
Fortinet continues to gain secure networking market share, with an increasing number of larger organizations adopting its solutions. While the market is currently soft, Fortinet believes that once the current digestion period is over, growth will return. There remain concerns about the impact of SASE on hardware demand though, with companies like Zscaler (ZS) extolling the virtues of their approach. Fortinet believes that SASE is only suited to remote workers and small branches, leaving firewalls with an important place going forward. Firewall market growth is also supported by a proliferation of firewall types (branch firewalls, campus firewalls, virtual firewalls, containerized firewalls, firewalls-as-a-service, operational technology firewalls). Fortinet's ASICs are also expected to retain an advantage in some use cases. For example, Fortinet can handle over 20 million transactions per second to defend against DDoS attacks.
SASE and SecOps accounted for around one-third of Fortinet's first quarter billings. Existing customers delivered over 90% of SecOps and SASE billings, which isn’t surprising given the size of Fortinet’s existing customer base. The vast majority of SASE and SecOps billings is coming from large and mid-sized enterprises.
SASE accounted for 24% of total billings, with existing SD-WAN customers delivering 81% of unified SASE billings. Fortinet plans on offering promotions for its SASE service in 2024, which could contribute to pricing pressure in the market. Fortinet’s SASE solution is already priced significantly below competitors, which makes sense given its focus on SMBs. While Fortinet is likely pricing aggressively to build market share, I also think Fortinet has a cost advantage over many competitors.
Fortinet SecOps accounted for 9% of total billings in Q1. This part of the business could be supported by the recent introduction of FortiAI. FortiAI uses generative AI to assist security teams with tasks like threat investigation and response. There is a proliferation of this type of solution in the market at the moment though and I question whether most companies have access to the necessary data to create a truly differentiated and valuable assistant.
Financial Analysis
Fortinet generated $1.35 billion in revenue during the first quarter, an increase of 7% YoY. Service revenue increased 24% to $944 million with SASE and SecOps revenue growth exceeding 30%. Product revenue was $409 million, a decrease of 18%. Combined revenue from software licenses and software services increased 29% to an annual revenue run rate of nearly $750 million.
Fortinet’s billings were $1.41 billion in the first quarter, down 6% YoY, although SASE and SecOps delivered growth. The exhaustion of Fortinet’s pandemic backlog continues to create a billings headwind. This will also bleed over into service revenue in coming quarters due to the services associated with hardware sales.
Figure 4: Fortinet Revenue (source: Created by author using data from Fortinet)
Fortinet believes that there are signs the current cycle has bottomed, with customers digesting the large purchases made over the past few years. This appears to be based on the time between when a customer purchases a firewall and registers security services contracts. After increasing significantly exiting the pandemic, this time is now normalizing, suggesting that customers no longer have excessive inventory on hand. There is still a $150 million USD billings headwind from Fortinet drawing down its backlog last year though.
There are also inventory levels in other parts of the supply chain to consider. In addition to Fortinet, distributors and resellers maintain inventory. Fortinet's inventory turnover increased in the first quarter and distributor inventory levels also reportedly improved.
Fortinet expects billings to be between $1.49 and $1.55 billion in the second quarter, representing a 1% YoY decline at the midpoint. Revenue is expected to be $1.375-$1.435 billion, a 9% growth rate at the midpoint. Fortinet is guiding to full year billings between $6.4 and $6.6 billion. Revenue is expected to be $5.645-$5.845 billion, representing 9% growth at the midpoint.
Figure 5: Days to Register Security Service Contracts (source: Fortinet)
Figure 6: Job Openings Mentioning Fortinet in the Job Requirements (source: Revealera.com)
Fortinet's gross margin was 78.1% in the second quarter, with strong service revenue growth providing a boost. Service gross margin was 87.9% and product gross margin was 55.7%. The decline in product margin was attributed to inventory levels and a more normal demand environment pressuring product prices. Fortinet's operating margin was 28.5% and there is still further potential upside as the business scales. Fortinet's strong margins go a long way toward supporting its valuation.
Figure 7: Fortinet Profit Margins (source: Created by author using data from Fortinet)
Figure 8: Fortinet Job Openings (source: Revealera.com)
Conclusion
While Fortinet expects the hardware side of its business to rebound in coming quarters, I tend to think this will take time due to the amount of demand that was pulled forward during the pandemic.
Longer term there is still a large opportunity though, as network security is around 10x more expensive than an equivalent networking device. The secure networking business also provides Fortinet with a large customer base (~700,000 customers) in which to sell additional solutions.
Fortinet's SASE and SecOps businesses are currently too small to move the needle. These will become material contributors over the next few years though. In addition, the Lacework acquisition could help Fortinet to scale its cloud security business.
Fortinet appears to be one of the more attractive investment opportunities within cybersecurity at the moment. Given the quality of Fortinet's business, it is difficult to see the company's valuation falling too much further. The longer that growth remains weak the more pressure there will be on the share price though.
Figure 9: Fortinet Relative Valuation (source: Created by author using data from Seeking Alpha)
