Fortinet, Inc. (FTNT) Earnings Call Transcript

Good afternoon and good morning. This is Keith Weiss, Morgan Stanley's U.S. software equity research analyst, coming at you from Day 2 at our TMT conference. And, and really pleased to have with us this morning from -- wait, this afternoon from Fortinet, both Ken Xie, Founder and CEO; as well as Keith Jensen, the CFO over at Fortinet. Before we get started, I have a brief disclosure and I think the other Keith has a brief disclosure as well. From the Morgan Stanley side, please see our website at www.morganstanley.com/researchdisclosures for important research disclosures. And Keith, I believe you have a safe harbor you'd like to read.

Certainly, thank you, Keith. I'd like to remind everyone that we may make forward-looking statements during today's fireside chat. These forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially from those projected in these statements. Please refer to our SEC filings, in particular the Risk Factors in our most recent Form 10-K and Form 10-Q and to other reports that we may file from time to time with the SEC for additional information on factors that may cause actual results to differ materially from our current expectations. All forward-looking statements reflect our opinions only as of the date of this presentation, and we undertake no obligation to specifically disclaim any obligation to update forward forward-looking statements. Back to you, Pete. Keith.

Outstanding. Thank you. So thank you, gentlemen, for joining us this afternoon. A really interesting time to be talking about security, really interesting time to be talking about Fortinet more broadly in that security landscape. But I wanted to start out on sort of the macro picture, the security demand environment. From our perspective, coming out of calendar '20, we were coming into a better year of security spending even before SolarWinds hit, just predicated on what we're seeing in terms of work from home or distributed computing environment, those changing architectures, necessitating. People think about their security architectures in a new way was in our survey work and in our conversations rising the priority of security. And then you have SolarWinds come in on top of that to really heighten the threat environment. So maybe to phrase that in the form of a question, what are you guys seeing in terms of the overall spending environment on security coming out of calendar '20 into calendar '21? And two, how does SolarWinds kind of change that equation if it changes that at all?

Yes,. Keith, totally agree with you. We do see is that 2021 will be a stronger, better year compared to 2020 because, like I said, a lot of our companies, service provider, they leverage the new technology or whatever the new architecture needed to supporting work from home to leverage the SD-WAN 5G and some other zero trust network access and like SASE, all these things and both cloud and endpoint networking. So they do need to kind of upgrade or kind of adopt some of the new architecture. Compared to last year, they are probably more high on what they already have and the existing vendor maybe just add additional service instead of keeping buy some new products. So you can see most of the security vendor, the product revenue are pretty flat. And we are lucky we keep gaining the product revenue. But this year, we do see even stronger demand in both on the new architecture, the new product and also agree with you, the SolarWind is really helping that. But I do see SolarWind probably a little bit more long term, maybe towards the end of the year or next year and because it really related to the third-party supply chain security, maybe eventually can drive some new industry standard like from government, how they deal with like a healthcare standard, how -- the food supply chain standard, but that may take like a couple 2, 3 years to come. But long term, it's definitely helping drive the overall infrastructure security and raise the secured awareness in the short term. But is -- but even without SolarWind, we see it's a very strong year this year.

Got it. Got it. Shifting the conversation towards -- more towards Fortinet. I think one of the really -- one of the most interesting aspects of the story over the past couple of years is what has traditionally been a network security story and Fortinet came public and really came to its current size, on the back of consolidating that core network security space on the back of your next-generation firewall appliances. But now there's a networking component of the equation as well. SD-WAN is a big part of the story. Can you talk to us about why it's important that Fortinet brings both sides of the equation together for the end customer?. What is it important that you have both network security and the underlying networking capability that, that's going to secure?

Actually , from Day 1, when they started Fortinet, and it seemed like my previous company has said, NetScreen, we always want to see how the next-generation or next version of Internet may change it because so far, the Internet is more about connectivity and speed whether you go to the 5G or some other IPv6, whatever, it always bring more connectivity, more speed. And also, you can see there's a big gap between how the security, network for security and the traditional routing switching because the security they need on edge, maybe like 50 to 100 computing power to process the same data, same throughput compared to routing switching. So there's of a big gap as a security's relatively slow and kind of more expensive, more difficult to manage. So that's what we can see how we can bring like close our gap and make it kind of a security more faster and also like how we deal with SD-WAN and some other like Wifi. And going forward, 5G, really we call secure-driven networking, basically, it's really kind of applied somewhat high level, whether from application layer, the content layer, the user device layer towards the network side and make it working together, so that's where we see. It's very important to combine these 2 together and not just the SD-WAN, we did a few years ago. But also, like -- probably like 10, 12 years ago, we also combine our WiFi security with -- WiFi and security together and, going forward, 5G. And on the other side, security now need to deal with much broader, bigger infrastructure, not just the network side, but also involving the cloud endpoint with that 5G IoT security. So that's why I try to see how there's bigger infrastructure we call the fabric, Fortinet fabric, make it all kind of more -- covered broad tech service and more integrated together, especially in the OS level, in the ASIC level to improving the performance and to make sure different product functions working together and, at the same time, to automate. So that's where it's kind of a cover more broad, automate and integrate solution for the whole infrastructure.

Got it. Got it. Can you talk to us a little bit about the 5G part of the equation. You talked about that being a big opportunity for forint for a lot of investors, it's not clear how sort of the 2 come together. We think about you guys as very much a sort of an Internet protocol protection, right? On that core network side of the equation, where does 5G come into the Fortinet purview?

The 5G, we do see later this year, next year was, we're starting to ramp up pretty quickly because it's a more connected device, probably like 10x more than 10x compared to the other technology connecting all the devices together. And also, it's more addressed infrastructure and government and the business is more involved compared to whether 3G to 4G is still more like a personal mobile phone. And once you connect the device, you really address all these security because a lot of industry, whether smart city or utility or some other part of health care, once this device is being connected, you really need to have visibility. You need how to manage it, how to may be secure the data, the information there, which just really need security from almost from Day 1. So that's where we see it's a huge opportunity. And also, we have pretty good -- like the government and service provider is 2 big sector for us, and they're both heavily involved in 5G, both building the infrastructure and also quickly like ramp-up application in there. So we do see there's a huge opportunity going forward. And also, we're working very closely with our service provider with some government to make sure that the 5G infrastructure is secure from Day 1.

Got it. That makes a ton of sense. Keith, and maybe to bring you into the conversation, SD-WAN billings had a outstanding year ending calendar '20. I think you guys talked about it doubling on a year-to-year basis. Do you -- is there any impact of kind of the work-from-home dynamic going on in there? Was that a positive impact, and can we sustain that pace of growth in SD-WAN as we had head into calendar '21?

Yes. I think the -- in terms of SD-WAN what we saw in 2020, I don't know that I would say that was a work-from-home application directly. If you look back at the performance and the billings numbers, I go back to a couple of years, we said -- can say the target actually of 5% of billings, and we got to that. And then he said 10%, and now he's got us working towards 15% of billings. Ultimately, the goal is to be #1 in this particular market in a market that's expected to grow 40% over the next several years. Now as you look forward and, I think, as work-from-home environment has become maybe a little more robust and rigorous in some of their security applications, we are looking at some opportunities now of deploying the SD-WAN functionality in the home. But I think at this point, I'll probably just pause on going to too deep on that until we get a little further down the path on it.

Got it. That was a great little teaser. So I want to shift attention to the core firewall business. And I would say this is probably the primary bear case for investors, not just on Fortinet, but on the space. There's definitely a, what I would call an exaggerated perception, that as we shift more and more workloads to the cloud, as we make more use of public cloud applications, whether it's SaaS or Infrastructure-as-a-Service, the necessity for firewalling goes away over time. But contrary to that, you guys have been seeing strong growth in your firewall business. That was above-market growth rates. So both in terms of the short term and the longer term, how do you think about the health and durability of growth of core firewalls in the near term? And is that going to be able to sustain over the next 3, 5 years? There's still a position in corporate security architectures for core -- like a hardware-based firewall.

I think the traditional firewall space we don't see as the business is going down, probably even keeping growing, just they're not enough to cover the whole infrastructure because infrastructure security, attack service is expanding beyond that traditional firewall can cover. And like whether the mobile, work from home or some other part of internal segmentation and the zero trust network access, they do need some other technology to working together with the traditional firewall. And they need to expand to the one side like SD-WAN or 5G, which traditional firewall will not cover. They also need to go to the internal, go to the land side, whether the internal segmentation, the WiFi security and also work from mobile device internal segment and zero trust network access and also with service providers, SASE, different application. So that's where we need to be keeping expanding beyond the traditional deployment, which is only secured border, and if it's going inside, need to go outside and also need to be like a dynamic and cover the cloud endpoint, the mobile, some other part of it. So that's where the -- how we see it basically, how to make the whole infrastructure working together, secure together. And instead of -- in the past, probably the networking side not working much with endpoint, not working much with some other different applications or different cloud part, but now has to be all considered together as an integrated solution and automated solution. So that were we see the trends going on right now.

Got it. Got it. So there's a lot of newer cloud-based vendors who are out there talking about ripping out firewalls and ripping out edge appliances and moving all that capability to the cloud. But it seems like your perspective is, it's much more likely that enterprises expand their security architecture. They evolve it to start protecting these new threat vectors, these new technologies that they're adopting like a 5G, and it's more of an evolution versus a revolution of ripping and replacing. Is that the right way to think about it?

Yes, it's more like add on top additional beyond the traditional firewall. Traditional firewall is still there. I don't think they've been kind of replace up in -- kind of reduce the spending there. So that, you can see our few vendor, they keep growing in the traditional -- some of them maybe see some market share because they cannot keep up. Because traditional network firewall, whatever, they still need to keep up the new function requirement, keep up the speed requirement like the network still almost double every 2 years, so they will keep up on this. On the other side, they do need to cover more broadly infrastructure and expanding beyond the traditional border security. And so that's the part if they cannot keep up, then they starting losing some market share. But on the other side, secured -- every year, there's new things come up usually the quickest response really come from some new vendors with some point solution, whether it covers certain application of certain vertical space or some big enterprise. So that's where they really quickly respond. But on the long-term wise, you also need to working together with other part of infrastructure, other function on a separate security. So we have all the integration. So that's where sometimes you can use acquisition to quickly cover some of the function. But long term, the integration seems very important. Without the integration, it's very difficult to keep in growth because also that the separate product, all this different kind of a point solution, they add a lot of management costs. Most enterprise service provider has some difficult time to address all these added additional costs of the management.

Got it. And I think we've talked about this a lot over the years. Is that sort of pendulum between investor breeds and suites within security, there's a lot of parts of suites that make sense. You want to integrate the data that's coming from all the different parts of your architecture, you want to be able to coordinate the action amongst the various components of the security architecture. And to your point, it's just easier to manage, and you really take away some of the risks of trying to manage multiple products. But you still see a lot of best-of-breed buying take place in the security sector. When when we ask resellers, they say, listen, this is still very much a best-of-breed type category. Where do you think like -- is there -- is it different parts of the market? Is this like the suites win in the SMB part of the marketplace and its heart of the enterprise? Is it just a matter of time until everybody figures out that suites are the way to go? How should we think about that pendulum, that sort of -- that push towards a more consolidated solution and how that actually transpires over the next couple of years?

I think the new things always come up with a point solution first. You can look at whether the intrusion like 20, 15 years ago, intrusion detection prevention of a separate box, then eventually mostly integrated into the firewall, next-gen firewall. And then the same box, the same thing, 10 years ago, first come up a separate box now mostly also part of the gateway solution, suite solution now. The same thing for zero trust and for the SASE. So we are the first vendor announced that integrated OS level, zero trust network and SASE in OS instead of have a separate point of service solution. Because in the network security, it's pretty interesting. You need to have this box in the middle to stop the bad traffic, right? And so the less in the middle, the better. And also, you also need to process the traffic in real-time to handle very quickly. So the more, the deeper you can cover, the better. So that's where the point solution always very quickly address certain applications or certain attacks, certain vertical surface. But in the end, you also need the other part of infrastructure, the other function working together because the traditional part of some function of some other legacy parts never goes away. And then the new things keep come up every day, every year. And so that's where -- it's always kind of the balance about. There's always a new -- make a new challenge, new solution to meet with the point solution. And with the company, they have a more budget, sometime they need to cover threat of security quickly. That's where they adopt that point solution, first. And then in the end, they also need to consider the whole infrastructure to manage together with service providers and the other part, then gradually move to the integrated solution to the suite solution. So that seemed to happen in the last 20, 30 years I worked in the industry. It's always kind of -- this is evolving, and there's certain balance about it. That's why there's so many new security companies come up, but also very few keep growing, especially the organic growth because it's key part of innovation and the same time to address this kind of an integration issue, the performance issue, the cost issue.

Got it. Got it. I want to change gears a little bit and move to the non-FortiGate part of the solution portfolio, the fabric and the cloud solutions. And Keith, correct me if I'm wrong, I think you've talked about that, fabric and cloud being about $725 million run rate business today. You targeted that getting to be $1 billion business when you're exiting 2021. Can you talk about, one, what's in the portfolio, what and makes up fabric and cloud? And two, what are the big growth drivers? Where are you going to get that extra basically $250 million over the next year out of that solution portfolio?