Fortinet (TICKER: FTNT) Fortinet Inc Ftnt Ceo Ken Xie Presents Morgan Stanley Technology Media And Telecom Conference

Fortinet, Inc. (NASDAQ:FTNT) Morgan Stanley Technology, Media and Telecom Conference 2022 March 9, 2022 2:30 PM ET Company Participants Ken Xie - Chief Executive Officer Keith Jensen - Chief Financial Officer Conference Call Participants Hamza Fodderwala - Morgan Stanley Hamza Fodderwala Well, good morning, everybody. We're just getting settle down here and to those of you listening in. So my name is Hamza Fodderwala. I'm cybersecurity analyst here at Morgan Stanley. And with me, I have the pleasure of welcoming Ken Xie, CEO; and Keith Jensen, CFO of Fortinet. Thank you guys very much for joining us. Ken Xie Thank you. Good to be here. Hamza Fodderwala Before I begin, just a brief programming note. For important disclosures, please see the Morgan Stanley research disclosure website at www.morganstanley.com/researchdisclosures. Excuse me. Question-and-Answer Session Q - Hamza Fodderwala So Ken, maybe if I can start-off with you. Just on the overall security demand environment, it seems like stronger than it's ever been or maybe stronger than it's been in several years. What would you attribute that to? And to what degree do you think this is cyclical versus structural going to last for a long time? Ken Xie Yes. Like we mentioned on the earnings release, we do see three drives in the space. First, the threat environment got worse and worse and not ready to drive pretty much all the security company, the tailwind there. And also, the consolidation is the other driver. We see some other competitors mentioned about that because in the security space, definitely the management cost is rather high. And so if you have like a 20, 30, 40 different vendors, each have a different product to manage, the platform has some advantage. They can only - they integrate, automate together. So that's also helping drive all this consolidation, both on the vendor side and also on some product side. That's I feel we're keeping last for the next 5, 10 years. And on the other side, we also see -- very unique to Fortinet, we see the convergence of a security networking together. So we're keeping talking about this in almost 20 years since our beginning when Fortinet started 22 years ago. Eventually, we do feel the network need to be handled what security is handling today, it's the high layer, whether the content or application, the user or the device, all these things which today, and I will talk about the same trust level with the connectivity speed, but security has to deal without a high layer, which needs much more computing power, so that's where we -- on the day one, 22 years ago, we leveraged the ASIC technology to lower the computing costs, increase computing power and also add additional performance and more function. So that's where we see a rather strong demand is changing whether because the threat environment will go to internal like all the ransomware attack, all because the multi-layer more people get connected, whether the 5G to 6G. And also we see the SD-WAN is one of our good story. We're keeping ramp-up SD-WAN with Secure SD-WAN solution, last quarter almost doubled compared to a year ago. Now it's about 16% of business there. So that's where we see all these three drivers will be continue to drive the whole space, and particularly for Fortinet and the convergence story, the consolidation story we feel will be last for the next 5 years to 10 years and continue keeping -- helping the business. Hamza Fodderwala Yes. Just on the threat environment, I think what's on top of a lot of people's minds is obviously the tensions in Russia and Ukraine and to what extent that could have potential blowback from a cyberwarfare perspective? I'm just curious, Fortinet works with some of the largest private and public sector organizations in the world, what's the temperature in the room when you talk to executives and corporate leaders? Ken Xie We're definitely making the situation -- I mean the threat environment, definitely, the level goes higher now. And at the same time, we've been working with quite a lot of government enterprise and try to see -- prevent all this kind of a cyber -- war cyber attack, which we feel network security in the best position to really add more protection, not just for the enterprise, but also for a lot of new areas on the infrastructure and whether utility and some other service provider. So that's what, is a huge potential. And also last quarter, probably the first quarter, we announced how the percentage we got for OT space. It's about 8%, growing almost 70% year-over-year. We don't believe that is also huge potential because anything happening in the cyberwar, probably the first you need try to target is a lot of infrastructure, a lot of utility, all this contents. And it's a pretty -- I have to say there way below on the average protection, some other vertical, whether finance service, health care compared to that one, that we see pretty strong growth, especially in the last few quarters, probably Keith knows the number. We say the nontraditional top five verticals for us, which we see pretty strong growth, a lot of come from like manufacturer, utility. And it's a pretty, pretty strong healthy demand right now. Hamza Fodderwala Yeah. That's definitely something I want to dig into. Before that, you talk a lot about this convergence between security and networking. It seemed like, at least in the last couple of decades that security and networking were decoupling a little bit more when we think about Cisco and whatnot. Why do you think there's been a convergence now? And how much of the networking budget could Fortinet potentially take? Ken Xie Because you can look at the security on average, they need about sort of 100 times more computing power to process the same data, same traffic compared to routing switching. So that's where -- that's the reason network security is more expensive, much slower and difficult to deploy in a lot of environments which they needed. And that also prevents a big internal infrastructure kind of protection to handle we call the east-west traffic. I think leverage our technology from ASIC, we can lower the security computing cost like a five times to ten times compared to the traditional using CPU to do all this kind of security computing there. At the same time, the last few years, you can see the ransomware attack ramp-up very quickly. So our study showed like compared to almost one year ago, the ransomware attack is up like eleven times compared to one year ago. And all this, our target company like internal data, all this since that's where the company needed to do the internal segmentation to manage, all this, how to secure east-west traffic, which traditionally no security can catch up all this things. The same thing for a lot of cloud provider, they also suffer all this kind of a similar attack and how to secure not just the south traffic, but also east west traffic within their, the data center also getting more and more important. And also some other technology like SD-WAN and the 5G ,6G, which using ICN Technology to handle a lot of traffic also sees a huge demand, how to -- based on different applications, different content of different user device location to handle the traffic. So the demand is very, very huge. And in the past, if you only leverage the traditional software technology, you leverage the CPU, which is not designed to handle all the secure computing. It's very difficult to deal with all this network security issues. So the demand is there, but just somehow the old technology cannot meet all the demand there. So that we see a pretty huge quick demand ramp-up, whether from Secure SD-WAN, from all this OT security, and all the 5G, 6G and even the traditional internal company network starting to be replacing by this network security to segmentation. Still not replaced all -- I think there are still certain parts still using the networking way. But also, because if you want to have this zero trust environment, the process, you had to have network security go inside the company, go inside data center to handle both the north-south traffic and east-west traffic, so that's really the need is all there. And it all depends on who can solve this issue, increase the speed, because there's almost like a one to 100 gap. So, the routing switching speed is still much higher like 50 to 100 times faster than network security can process, and at the same time, the costs also very, very high and more difficult to manage. So that's where we try to leverage all the technology we have and the investment we made in over 22 years and how to solve this basic issue there. Hamza Fodderwala Yeah. And Fortinet has done a much better job of having lower lead times relative to their competitors in this supply chain crisis that we're having. To what extent is that also accelerating your share gains in the networking space, because people see you as a partner they can trust and you can actually deliver the product? So, is that accelerating your share gain against some of the networking vendors that you compete with? Ken Xie I think, well, through a long-term investment, we have a few advantages. One, since we more handle the manufacturer operation directly our self, even have some of our own kind of manufacturer going on and including ASIC chip. And on the other side, we do have the quantity, so we can negotiate better compared to some supplier. So, we have almost 40% of the total unit shipment in the network security space, probably like three to10 time larger than the second, third, all the competitor we have there. Pretty much all the other top five competitors combined together, still less than what we have today. So that gives us a little bit better negotiating power. But demand is just so strong. Like last year, the whole product revenue growth 47%. And the last quarter, the booking of the product probably grew over 60%. That's even beyond our kind of forecast. So that's also making the backlog. Probably last quarter, we had maybe hundreds of million backlog compared to one year ago. And we do see the things we're starting improving, and we're hoping like the next few months towards the second half of this year things will be better, because we do have a very strong engineer team can redesign some of the product and avoid some component shortage. And at the same time, what can we supply working with manufacturer and since starting kind of improving right now, I'd put it this way. Keith Jensen Yeah, I'd probably just jump in a little bit on that and build on Ken's comment and say that in terms of competitive advantage, because we had more supply, as we entered this phase of the supply chain crisis and the pandemic. I think it's important to talk about specific product groups, if you will, and what competitive advantage we may or may not have. If you look at the switches and access point, that's a Cisco competitive environment. It's with our own installed base. And I think that, our lead time on switches, are probably not terribly different from there. So I don't know that there's really an advantage, if you will. If you look at the firewall space, if you look at the three different product families, low-end, mid-range and high-end, again, I think you've got to distill that a little bit. The mid-range has not been impacted significantly to this point and certainly not the high end. And there's a different competitor there, right? So on the high-end, you're more apt to run into, say, Palo Alto than you are or maybe a Cisco displacement and less so some of the other names. And so, I don't think that there was an availability advantage, if you will, with the success that we saw in the G2000 billings last quarter, which I think was 90% growth. I think that's just a competitive advantage that exists otherwise. As you move into the low end, you're more apt to run into maybe Cisco Meraki or maybe some smaller names perhaps in the space of Sophos or SonicWall or what have you. And I think that's a different dynamic. And maybe in that smaller space, particularly to your first question, in this elevated threat environment where you're seeing a lot of small companies come to the table now and make security purchases. I do think in that particular segment to the extent you have product available and it was at a price for performance advantage and the cost to manage. I do think that, that actually provided a significant amount of tailwind for us on the other side, though, that is where we saw most of the backlog for firewalls. It was in the low end. Hamza Fodderwala Right. And in the low end, there seems to be a lot more opportunity for sure and you have the top four firewall vendors, which I think account for maybe 60% of the market. So are you just seeing more share gains from that bottom 40 that don't have the supply chain visibility that you have? Keith Jensen No, I think the -- obviously, we are -- we added 6,000 new logos last quarter or thereabouts. And I think that was the third quarter in a row that we've been at 6,000. Again, I think that Hamza speaks to your point at the beginning about the elevated threat environment and companies are coming back and doing a lot of purchasing. I don't know that you would see -- I think the success that we also saw on the high end, again, over 90% of the G2000 billings growth, I think our growth has come across customer segments, whether it's small enterprises, mid-enterprise or large enterprises. Ken Xie I think a lot of come from like Global 2000 company, which grew like 90% over one year ago last quarter, most of them I saw is our current customer just to work from anywhere, work from home, whatever. They do have a lot of demand for all kind of low and high and middle range products. Hamza Fodderwala So on the appliance demand front, there's obviously a view that more and more of the pace of change will shift towards cloud. So you're seeing appliance demand that's stronger than ever. Fortinet doesn't really benefit from your typical enterprise refresh cycle. So if you could boil it down to maybe two or three things just near-term, what's driving that appliance demand and it's going to keep it durable throughout the rest of the year? Ken Xie I think we see this way, I know a lot of companies talk about cloud. But if you look at our study, whether from Gartner, IDC, all these kind of things, in the next four, five years, the cloud will be about -- cloud security will be about $20 billion space. And the network security is probably still 2 times to 3 times larger and still a more healthy growth. And then if we see the convergence of our network and security, so for us, the total addressable market will be almost $200 billion. So that's where -- so when we look at the whole infrastructure, you need to have all the security protection and we see cloud just part of it, right? So that's where -- so we're different than some competitors. They say everything is about cloud. And the only thing -- Oh, maybe the only thing they have is cloud. So we see -- we need to also address beyond the cloud. And also, there's also talk about edge will be replacing the cloud in the next three to five years, right? Because there's a different -- I have to say, different application, they need to have a different kind of infrastructure to handle. Some may need a real time, some may need like address certain application and each has a defined advantage. So we'll rather cover more broad and also see how the market may ramp up in certain areas. So also for the cloud, we have a little bit different strategy, whether the cloud has zero trust, we feel probably we'll be working with a lot of carrier service provider or cloud provider will be better, more efficient compared to some companies try to build a lot of power themselves even they lose a lot of money there. And so we do feel we're working with a lot of providers, which they already have some infrastructure. They may not just have security, some other function solution and will be much healthy profit business model. That's possible for us like since IPO, almost 13 years ago now. So we want to keep that profit every year. And also, we want to maintain growth above the market. So that's the two models we want to maintain. And also, we feel that the healthy way to do the business compared to whether you don't have the growth, lose a lot of money or you have the profit which is also below market growth, which we feel -- maintain above market growth and at the same time, certain level of profit is more healthy. Hamza Fodderwala All right. Keith, I was wondering if we could do a bit of a rapid fire on supply chain and a few other topics, which I know are your favorite. So, on your last earnings call, you mentioned supply chain to start to ease in the back half. I think you just alluded to it earlier as well. So just comfortability around that and... Keith Jensen Yes, I would say I feel very much the same as I have now for probably several weeks or months. I think September, October was the low watermark for -- at least for us and our manufacturing team and our operations team in terms of waking up in the morning to unpleasant e-mails from suppliers decommitting. And it still happens, but nothing like what they went through in the past. And I think it's a much more balanced set of good news and bad news. And good news comes from their hard work of scouring the market for components and work around together with our own engineering team, qualifying different suppliers, making changes in the product set up, designing around some products that are in short supply. It will be a long process, but I have certainly not seen anything in terms of the negative news that we saw in September and October. As we continue to move through the rest of the year, I still feel the same way. Maybe we'll get some improvement towards the very end of the second quarter with some product announcements, and we'll see how those come to market that are designed around some things. That would be small. We may get some small incremental improvements as we move through the second half of the year and into 2023. I think that we introduced the new metric last quarter to help investors and others better understand the business. The backlog number we provided, we expanded our guidance so that people had a better clarity to our business. I still feel good about how we're going about approaching the business. If our bookings number comes in different than what I expected it to be higher or lower or what have you, then I would expect that backlog is going to move with that. So, my point of that is, look at backlog and bookings together. If one comes in higher, understand and look at the importance of looking at the other one. So that was not a rapid fire response, I apologize. Hamza Fodderwala No worries. And just assuming, let's say, the supply chain crisis lasts for a little longer. I think in the past, Fortinet's had a bit more inventory relative to other competitors. Last time, I think you mentioned something like five or six months. Any color there on what the latest on that is? Keith Jensen Yes. Ken and I have debated internally for any occasion about how to utilize capital and how much we want to invest in inventory. Ken has always been a very firm believer of having lots of inventory on hand. So I have effectively lost that argument for years and years to come. Because we are spot on in terms of being well positioned for the -- for what we've gone through in the last year. And so clearly, there's nothing other than a capital allocation strategy. We've shown that we don't have large inventory write-offs and other risks that may exist in other industries. I think it continues to make a lot of sense to keep inventory turns at levels that we have historically in that two to three-point level when we have the chance to. Hamza Fodderwala So, I imagine like your partners or the distributors that you work with, you don't want to be building inventory as well. To the extent that you have visibility, is there a sense of any change in earlier double ordering at all? Keith Jensen No. I'm seeing no indications of those things. We do have visibility to inventory at our distributors. And I think I've alluded to it in some conversations before, and I'll just cap it again. We typically keep one to two weeks of inventory in the channel, and that's where we ended up in the fourth quarter, perhaps just a little bit below our historical average. So it's not the distributors are stocking up inventory. I think they like the stock up inventory, but it simply is a supply chain challenge. And they too don't care to tie up a lot of capital of inventory if they don't have firm orders. So it's not logical that would happen. If I thought I was seeing duplicate orders, I would start to see my backlog evaporate, I have not seen that. I'm seeing no indications, no metrics to support there's any sort of concern about double ordering or pull forward or things of those nature. Hamza Fodderwala Got it. I think Fortinet did a couple of price increases earlier this year, I think, late last year as well in that high single-digit territory. How much of that gets eaten up by distributor discounts? Keith Jensen It's probably about half right away normally. And then they are -- depending upon the deal and different topics of conversation, contractually, you're going to see the distributor is probably going to get a 40% or 50% discount to start. And then you may get into higher discounting, you start to see it move through the channel and depending upon strategies or what have you. Hamza Fodderwala Yes. And let's say, you roll forward back half of this year, early next year, component costs start to ease a little bit. Do you see like that those price increases just largely going away as lower discounting activity comes back? Ken Xie Particularly, we still have the advantage. That's for every new product release, we call the secure computing reading. So that's where for the same function, for the same cost, how much additional performance we have. So we have averaged about five times to 10 times better performance for the same cost on the performance and function. So that's where we do have a huge advantage leveraging our technology, ASICs all these things. So even we raised some price keeping our margins kind of similar compared to like one to two years ago. We still have a huge advantage. So that we feel. And at the same time, we also kind of leave us some -- quite some money on the table for the service. So that's where we can charge more on the service compared with some of our competitors, which we feel eventually we may just keeping, Hamza, improving some of that. But right now, we just -- we see the product demand is so strong, and we just try to help customers deploy as much as possible. Hamza Fodderwala Got it. And just another question before I open up to the audience. On the macro front, so you mentioned earlier this week, you have like 1% or 2% of your revenue coming from Russia, Ukraine. And you have a big European exposure as well. I'm just curious if you're seeing any spillover effect, let's say, like who wouldn't tried to consolidate the Eastern Bloc, what percentage of revenue is coming from that territory for Fortinet. Keith Jensen So I think we've talked about being a very diversified business for quite some time now. And I think about Europe, the Europe number is 30 -- high 30% I think. But if you look at Russia, it's 1%. If you look at the Eastern Bloc or top 10 countries that, I guess, of old Russia, that's about 3% of revenue. I'm not concerned. Hamza Fodderwala Okay. And just around Europe, I mean there's some obviously concerns around perhaps some macro slowdown later this year, anything that you're hearing from your customers at all just around security spending? Okay. I just want to see if anybody from the audience has any questions. Unidentified Analyst Thank you. Ken, returning to your comment a few minutes ago around how in the enterprise environment, security historically has not kept up with networking speeds. So routers and switches typically can move traffic and move bandwidth faster than networking security equipment. As assumably speeds on networking continue to get better, now looking forward five, 10 years, does the ASIC advantage in your network security equipment become incrementally more acute as a result. I guess to say it differently, is your network security equipment basically what can keep up with the increasing bandwidth that's going to be flowing through these enterprise environments in these higher throughput networking tools. Ken Xie Definitely, we're helping the convergence of our secure networking together because right now, if you look at -- the reason a lot of companies offer all these ransomware and some other attacks where they want to hacker get in, they pretty much really they can move anywhere inside the company, because they don't build infrastructure based on this kind of zero trust. Within the -- if you look at how the switch and router, they just treat all the traffic in the same trust level and there's no checking on what the content application, user device, or this level, which handled by security. So that's where the ASIC basically does the same as like the GPU, TPU or IPU. They can -- improving the security computation easily by like a 10 time performance. So that's enabled this network security deployed into the environment is better inside the company or inside some other infrastructure traditionally, the cost or the speed prevented to be deployed there, which is a huge demand right now. So that's where we see the ASIC has a huge advantage on the cost, on the efficiency and also be able to deploy in an environment traditionally cannot be deployed, because the tech service keeping increased with all the new connectivity and even in some application move to the cloud, but the cloud security also is a concern. So, more application to the cloud may increase the security issue, because you have access to that cloud and increase more traffic there. But that's where we see is a huge potential. The convergence of network security will be driving quite a big growth in the next five to 10 years. Hamza Fodderwala Ken, I want to go back to you. So on SD-WAN, so you mentioned it's about 16% of billings. You have, I think, 500,000 customers, maybe a little bit more than that now, some millions of firewalls. When you think about the penetration within that base from a unit level, like how much opportunity is there to turn on SD-WAN for a lot of these customers? Ken Xie For that 16%, we only count on the initial order, but basically every FortiGate we have today, they can -- for the existing customers, they can often turn on SD-WAN. So the real use are probably much bigger than not. So our estimate is easily over like a $1 billion -- kind of $1 billion run rate opportunity there are using that, because SD-WAN, they come based on the different application, have a different route for the network traffic for us, right, not just based on application, you can also based on the content user device to have kind of different path to handle all this one connection there. So we do see eventually like whether the 5G, 6G or some other one, once they handled by this, they call ICN, this technology to add security on top of that, definitely, we're helping improving a lot of our performance and more secure, more application and more applications more efficiently. So, SD-WAN by itself, we'll see the market will continue keeping growing like 40%, 50% in the next few years. And is much better, more efficient compared to the traditional old NPI from other one. And also once you have all this Work from Anywhere. And also like in the zero trust environment we see the Secure SD-WAN also secure 5G, 6G solution also a huge opportunity going forward. Hamza Fodderwala Yeah. Yeah. And a lot of that is just coming from the installed base, it seems OT security, you mentioned it's 8% of your billings now. There seems to be a lot of focus on OT just given the risk to the energy grid system. I'm curious do you think this could be the next act for Fortinet after SD-WAN? Do you think this can be an opportunity that's as big as SD-WAN, is today? Keith Jensen I do feel it will be bigger, because if you look at the OT environment, pretty much the only way you can efficiently secure is really by a network security, but OT is different than some other traditional endpoint security, which you install in some like Microsoft OS or some other part. Most OT device will all run different OS. There's some kind of more limited computing power can install any additional software agent. So the way to secure this and pretty much all have to come from network side. And especially, when you're using 5G, 6G to connect a lot of device, how to handle on the network side is -- for the securities not very important for all this, so we do see it's a huge opportunity going forward. Hamza Fodderwala All right. Well, with that, we're unfortunately out of time. Ken, Keith, thank you so much for your time. Really appreciate it. Keith Jensen Okay. Thank you. Ken Xie Thank you.