Fortinet - Q1 2024
May 2, 2024
Transcript
Operator (participant)
Good day, and thank you for standing by. Welcome to the Fortinet 1Q 2024 earnings announcement conference call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question and answer session. To ask a question during the session, you will need to press star one one on your telephone. You will then hear an automated message advising your hand is raised. To withdraw your question, please press star one one again. Please be advised that today's conference is being recorded. I would now like to hand the conference over to our first speaker today, Peter Salkowski, Senior Vice President of Investor Relations. Please go ahead.
Peter Salkowski (SVP of Finance and Investor Relations)
Thank you, Brianna. Good afternoon, everyone. This is Peter Salkowski, Senior Vice President of Finance and Investor Relations at Fortinet. I am pleased to welcome everyone to our call to discuss Fortinet's financial results for the first quarter of 2024. Joining me on today's call are Ken Xie, Fortinet's Founder, Chairman, and CEO, Keith Jensen, our CFO, and John Whittle, our Chief Operating Officer. This is a live call that will be available for replay via webcast on our investor relations website. Ken will begin our call today by providing a high-level perspective on our business. Keith will then review our financial and operating results for the first quarter of 2024 before providing guidance for the second quarter of 2024 and updating the full year. We'll then open the call for questions.
During the Q&A session, we ask that you please limit yourself to one question and one follow-up question to allow others to participate. Before we begin, I'd like to remind everyone that on today's call, we will be making forward-looking statements, and these forward-looking statements are subject to risks and uncertainties, which could cause actual results to differ materially from those projected. Please refer to our SEC filings, in particular, the risk factors in our most recent Form 10-K and Form 10-Q for more information. All forward-looking statements reflect our opinions only as of the date of this presentation, and we undertake no obligation and specifically disclaim any obligation to update forward-looking statements. Also, all references to financial metrics which we make on today's call are non-GAAP unless stated otherwise.
Our GAAP results and GAAP to non-GAAP reconciliations are located in our earnings press release and in the presentation that accompany today's remarks, both of which are posted on our investor relations website. The prepared remarks for today's call will be posted on the quarterly earnings section of the investor relations website immediately following the call. Lastly, all references to growth are on a year-over-year basis, unless noted otherwise. I'll now turn the call over to Ken.
Thank you, Peter, and thank you to everyone for joining our call. Q1, we managed business with strong spending discipline and increased our operating margin 200 basis points to a first quarter record of 28.5%. We also generated record cash flow from operations of $830 million, and our adjusted free cash flow margin was at 61%. We remain focused on investing in a fast-growing unified SASE and secure operations market, which combined accounted for one-third of first quarter billings. We continued to gain security networking market share, leveraging our advanced and differentiated FortiOS and FortiASIC technologies, with an increasing number of large customers adopting our industry-leading secure networking solutions. Last month, attendance at our annual Accelerate conference increased 25% year-over-year to nearly 5,000 participants.
Our Unified SASE and new AI offering dominate the discussion with our partner and customers. For the first quarter, Unified SASE accounted for 24% of total billings. To introduce customer and prospect to our new Unified SASE solution, we plan to run attractive promotion this year in 2024. For several reasons, we believe no service security company come close to our differentiated Unified SASE solutions. First, we have developed all Unified SASE functionality into one single operating system, the FortiOS. This include a full networking and security stack comprised of SSE, Secure Web Gateway, CASB, and our market-leading SD-WAN and firewall technologies, providing content, application, user, device, and location awareness to reduce attacks. Second, our Unified SASE solution can be deployed on-premise in the cloud or both. Peer solutions send traffic to the closest POP, increasing security risk and latency and is less efficient.
Last, Fortinet Unified SASE offer both traditional software endpoint agent and hardware agents, such as FortiWiFi access point and FortiSwitch for customers, with easier deployment and more broad use case, such as Unified SASE for OT and IoT devices. We expect our differentiated Unified SASE offering to emerge as a SASE leader. Fortinet advanced platform approach has been earning third-party award for many years. Last month, we entered the Gartner Magic Quadrant for Security Service Edge, as shown on the slide 12 in the investor presentation. Fortinet is the only vendor recognized in the Gartner Magic Quadrant report for Security Service Edge, SD-WAN, Single-Vendor SASE, and Network Firewalls, and Enterprise Wired and Wireless LAN Infrastructure.
All five security and network offerings from Fortinet are uniquely built on one operating system, the FortiOS, and we leverage our FortiASIC to increase secure computing power for more functions and better performance, while lowering the cost and energy consumption. Fortinet SecOps solutions, which are better integrated and automated together than competitors, accounted for 9% of total billings. Initially launched as part of our FortiSIEM and FortiSOAR, our GenAI technology, FortiAI, is being deployed across both networking and security products. Today, we announced the industry-first IoT security generative AI assistant. Customers can ask FortiAI to help in 30+ languages. Fortinet is also the market leader in OT security solutions, the fastest-growing space in network security, with billions of devices connected online. Most OT devices have a limited computing power, making network security the most effective means of securing them.
Today, we announced the FortiGate 200G, a mid-range firewall powered by a new SP5 ASIC, with secure computing performance 3-10 times better than our competitors and industry average, reinforcing our leading secure networking and Unified SASE advantage that provide customer with industry-leading security functions, performance, and power efficiency. Before turning the call over to Keith, I wish to thank our employees, customers, partners, and suppliers worldwide for their continuous support and hard work.
Keith Jensen (CFO)
Thank you, Ken, and good afternoon, everyone. Let's start with the key highlights from the first quarter. As Ken mentioned, we continued to manage the business through the macro uncertainty and successfully drove operating margin to a first quarter record of 28.5%, exceeding the high end of the guidance range by 200 basis points. Free cash flow of $609 million represented a 45% free cash flow margin, benefiting from strong Q4 2023 billings and their subsequent collection in Q1 2024. Billings of $1.41 billion and revenue of $1.35 billion were within their respective guidance ranges. Looking at billings in more detail, while Unified SASE and SecOps delivered strong billings growth, total billings declined 6% as expected.
The billings performance was driven by the difficult year-earlier comparison created by the backlog contribution to billings that occurred in last year's first quarter. Total bookings were down just slightly. Unified SASE and SecOps had outstanding growth across a variety of benchmarks in the first quarter. In addition, we saw significant progress from our investments in Unified SASE and SecOps. These include cross-selling into our large installed base. Existing customers delivered over 90% of SecOps and Unified SASE billings. On an even more targeted basis, existing SD-WAN customers delivered 81% of Unified SASE billings. Larger enterprises are proving to be our largest customer segment, with large and enterprise, large and mid enterprises representing 78% and 84% of SecOps and Unified SASE billings, respectively. Even with increasing scale, both pillars have strong pipeline growth: 30% for SecOps and over 45% for Unified SASE.
More importantly, within SASE, the SSE pipeline growth is over 150%. Our investment in SASE is being recognized by third-party agencies. We recently recorded the trifecta with Gartner's SASE Magic Quadrants, SSE, SD-WAN, and single-vendor SASE. As Ken noted, with last month's addition to SSE, Fortinet now appears in five network security Gartner Magic Quadrants, again, all running on a single operating system. With the SASE Magic Quadrant trifecta, customers have shown increased interest in learning more about our unique SASE platform that runs on the one operating system with one unified agent, one management system, and one data lake.
To offer an example of customer interest, at our Accelerate conference early last month, the SASE demo booth was our most active as customers surveyed SASE's new features and functions, including end-to-end digital experience monitoring, remote browser isolation, advanced data loss prevention, and third-party SD-WAN connectivity. As a second example, nearly 25% of the Accelerate attendees who joined our CMO for the SASE breakout session. The attendee number for this breakout session would have been even higher if it wasn't for the fire marshal's regulations that forced us to turn away customers and partners who were eager to hear more about the SASE offering. To offer one final example, the customer and partner SASE Fast Track training program at Fortinet, which launched in January, is already the number 2 most attended technical training session, training only a Single-Vendor SASE partner, SD-WAN.
We're committed to driving more effective security solutions worldwide and welcome greater partnership with our industry peers. The new third-party SD-WAN connectivity technology is designed to support consolidation not only on Fortinet but with Fortinet. In terms of scale, we continue to open new Google and Fortinet POPs in sync with our customers' expanding footprint and driving the deployment scale demanded by large enterprises. A quick update on that seven-figure, 300,000-seat education deal that we mentioned last quarter. The full production environment was activated in March, and we are on track to have their 300,000-plus seats on board to start the new school year. To expand on Ken's earlier comment about today's AI-related announcement, Fortinet's GenAI Assistant follows our FortiAI launch last year by supporting and guiding SOC and NOC teams as they configure and manage changes to their network and investigate and remediate threats.
Its intuitive interface allows individuals to engage using 30 different natural languages ... bridging the industry skill shortage. I encourage everyone to visit Fortinet.com to learn more about the GenAI assistant. Rounding out our billings commentary, SMB was the top performing customer segment. International emerging was our best performing geography, and our three largest industry verticals continued to be worldwide government, service providers, and financial services. Service provider and worldwide government experienced the highest growth, while retail and financial services were a bit more challenged. As noted in our prior call, the six eight-figure deals in Q4 2023 pushed our average contract term in DSO to elevated levels. The average contract term in the first quarter was 27 months, down just under one month year-over-year, and three and a half months quarter-over-quarter.
DSO decreased 12 days year-over-year and 23 days quarter-over-quarter to 66 days. Turning to revenue and margins, total revenue grew 7% to $1.35 billion, driven by service revenue growth. Service revenue of $944 million grew 24%, accounting for 70% of total revenue, and a revenue mix shift to services of 10 points. Service revenue growth was led by over 30% growth from Unified SASE and SecOps. Product revenue decreased 18% as expected, to $409 million, coming off a challenging 35% year-earlier compare, impacted by backlog fulfillment in the prior year. Software license revenue increased 20% and represented a mid- to high-teens mix of product revenue. Total net product bookings were down just slightly.
Combined revenue from software licenses and software services, such as cloud and SaaS security options, increased 29% and represented an annual revenue run rate approaching $750 million. Total gross margin of 78.1% was up 180 basis points and exceeded the high end of our guidance range, benefiting from the mix shift to higher margin service revenues. Service gross margins of 87.9% were up 200 basis points, as service revenue outpaced labor cost increases and benefited from the mix shift towards higher margin FortiGuard security subscriptions. Product gross margin of 55.7% were pressured, as we saw challenges related to inventory levels and the transition to a more normalized demand environment.
Operating margin of 28.5% was 200 basis points above the high end of our guidance range, reflecting the strong gross margins and prudent cost management. Looking at the statement of cash flows, summarized on slides 16 and 17, free cash flow was $609 million. Adjusted free cash flow, which excludes real estate investments, was $821 million, representing a 61% adjusted free cash flow margin. Infrastructure investments totaled $222 million, including $212 million of real estate investments. Cash taxes in the quarter were $31 million. While we did not repurchase shares in Q1, share buybacks have totaled $5.3 billion over the past 4+ years, and the remaining buyback authorization is $1 billion. Now I'd like to share a few significant wins from the first quarter.
I'll start with the 1 8-figure deal in the quarter, a competitive displacement and new logo win. This large U.S. financial institution selected Fortinet as part of their data center update and consolidation project. Keys to this win included our experience in this highly regulated customer data sensitive industry, and our ability to lower the total cost of ownership and exceed their low latency performance requirements. Similar to other large financial institutions separating from their incumbent, this customer is expanding their Fortinet footprint by adding our SD-Branch solution and planning to consolidate additional technologies. Next, in a competitive 7-figure win, a hospitality company that serves over 5 million guests annually updated their various Fortinet solutions, including their FortiGate firewall footprint and FortiNAC solutions.
Keys to expanding our relationship included our price to performance advantage on the firewalls and the NAC solution's proven ability to discover and lock down devices that attempt to join their network, together with the operational simplicity and integration of the 12 different Fortinet solutions the customer uses. In another seven-figure deal, a hotel and restaurant chain purchased our SD-Branch solution for 800 locations, as well as our data center FortiGates for centralized management and enhanced security. This solution from our network security pillar included firewalls, switches, and access points, as well as a variety of software products. The SD-Branch solutions bring improved efficiency and security over their branches and IoT devices. Key to this win, and in other retail opportunities, is enabling retailers to deploy, expand, and deliver a growing array of in-store digital solutions to support their customers' experience and increase their top-line performance.
As these customer wins illustrate, our security fabric platform includes each of our security pillars, Unified SASE, AI-driven SecOps, and secure networking, making it the most integrated, most open portfolio of products in the industry, backed by one operating system, FortiOS, one unified agent, FortiClient, one management console FortiManager, one data lake FortiAnalyzer, and open APIs and integration with over 500 competitor and other third-party products. This integration allows customers to consolidate security solutions, thereby reducing operational costs while increasing security effectiveness. Moving to guidance, as a reminder, our first quarter and full-year outlook, which are summarized on slides 21 and 22, are subject to disclaimers regarding forward-looking information that Peter provided at the beginning of the call.
For the second quarter, we expect billings in the range of $1.49 billion-$1.55 billion, which at the midpoint represents a decline of 1%. Revenue in the range of $1.375 billion-$1.435 billion, which at the midpoint represents growth of 9%. Non-GAAP gross margin of 76.5%-77.5%. Non-GAAP operating margin of 25.75%-26.75%. Non-GAAP earnings per share of $0.39-$0.41, which assumes a share count between 775 and 785 million. Capital expenditures of $30-$40 million, a non-GAAP tax rate of 17%, and cash taxes of $240-$270 million.
Before updating the full-year guidance, I'd like to elaborate on the backlog headwinds easing in the second half of 2024, and share what we believe or we are starting to see as early signs that the firewall digestion cycle is nearing completion. First, the billings headwind from last year's backlog drawdown is over $150 million in 2024 and gradually diminishes throughout the year, with no headwind in the fourth quarter. And second, when looking for early signs of a more normalized firewall market, one metric we watch is the average days to register security service contracts, as shown on slide 19. In 2022, we noted the days to register has increased about 50%, which was consistent with customers' buying and stocking behaviors at the time.
More recently, this metric decreased by about 25% from its peak and is now consistent with late 2021 levels, and is on a pace to return to normal levels in the second half of 2024. A reasonable read through of the data is that customers are completing the inventory digestion process and are on the path to a more normalized firewall buying behavior. And with that, for the year, we expect billings in the range of $6.4 billion-$6.6 billion. Revenue in the range of $5.745 billion-$5.845 billion, which at the midpoint represents growth of 9%. Service revenue in the range of $3.94 billion-$3.99 billion, which at the midpoint represents growth of 17%.
Non-GAAP gross margin of 76.5%-78%. Non-GAAP operating margin of 26.5%-28%. Non-GAAP earnings per share of $1.73-$1.79, which assumes a share count between 780 and 790 million. Capital expenditures of $350 million-$400 million, a non-GAAP tax rate of 17%, and cash taxes of between $500 million and $550 million. I look forward to updating you on our progress in the coming quarters, and I'll now hand the call back over to Peter to begin the Q&A session.
Peter Salkowski (SVP of Finance and Investor Relations)
Thank you, Keith. As a reminder, during the Q&A session, we ask that you please limit yourself to one question and one follow-up to allow others to participate. Operator, please open up the line for questions.
Operator (participant)
Thank you. At this time, we will conduct the question-and-answer session. As a reminder, to ask a question, you will need to press star one one on your telephone and wait for your name to be announced. To withdraw your question, please press star one one again. Please stand by while we compile the Q&A roster. Our first question comes from the line of Hamza Fodderwala from Morgan Stanley. Your line is now open.
Hamza Fodderwala (Executive Director)
Good evening, and thank you for taking my question. Perhaps both for Ken and Keith, you know, you spoke to a lot of green shoots in your prepared remarks. You know, SMB service provider growth looks a little healthier. You're getting recognition on SASE, and you spoke to competitive replacements. That said, the billings in Q1 was a bit closer to the lower end of your guidance versus the high end. So just curious, you know, what drove that, and what gives you confidence based on what you're seeing in the pipeline to, you know, maintain your guidance and continue to assume a re-acceleration in the top line in the back half of the year? Thank you.
Keith Jensen (CFO)
Yeah, I'll talk about the full year. You know, I think that if you look at where we ended up in the first quarter, you know, inside the guidance range, maybe just a little bit of weakness that we saw in Europe, just enough to move us off the midpoint, but not really a big movement in terms of where we are in our final results compared to the midpoint. And if we look at where we end up with a total for the year, you know, I don't think we're at all far off from the plan that we thought. You know, maybe there's some onesies and twosies there that you're kind of pointing out.
But as we look at the pipeline, to your point, I think the mix that we see in our pipeline today, together with some of the hygiene improvements that we've worked on for the last 6-9 months, I think we feel better about where we end up with the full year numbers, if you will. I think at the same time, you know, when you look at the full year numbers, and some of the outperformance in the quarter or better performance, if you will, with service revenue and product revenue, you see us bringing that number up a little bit. But importantly, at the same time, you see us also bringing up the margin number on the bottom line by about three-quarters of a point.
Ken Xie (CEO)
... Yeah, I think the high interest rates are making the money kind of more expensive, have a lot of enterprise kind of probably more favored OpEx instead of a CapEx for some of the networking security project. So that's where that's also the reason we starting shifting the focus more on the kind of a SASE or kind of SecOps, which is really more helping company saving the cost, at the same time kind of more some kind of OpEx model. So that that's probably... At the same time, we do making some adjustment in certain product price back to like a pre-pandemic level before the supply shortage.
That's happening in Q1, probably, has a little bit impact, but overall, I think the product competitiveness is still more strong, and we still see a lot of replacement of our competitor product, which tend to be more expensive. And, especially the new FortiOS introduced last month with more function, including all the function in the unified SASE. All these things drive a lot of attention from the customer, and they are all interested to this new OS and the new product we have launched.
Hamza Fodderwala (Executive Director)
Thank you.
Operator (participant)
Thank you, and one moment for our next question. Our next question is from Gabriela Borges of Goldman Sachs. Your line is now open.
Gabriela Borges (Managing Director and Senior Software Equity Research Analyst)
Good afternoon. Thank you. For either Ken or Keith, I'd love to get an update on your pricing strategy more broadly. More specifically, how do you think about the trade-off between discounting when you're cross-selling a broader bundle of portfolios, such as SecOps or SSE services, versus being able to capture some of the value from the cross-sell? How do you think about that trade-off? Thank you.
Ken Xie (CEO)
I think our price strategy is pretty consistent in the last 20-plus years. We want to maintain a healthy growth margin and also a healthy margin for the partners. When we see certain cost increase, like during the supply chain shortage, whether the component cost or some shipping costs increase, we kind of increase the price. But now some of the costs coming down, we also kind of return some margin to the partner and also lower some product price to match the pre-pandemic level. But I think all this price changing, we think it's over. Also, we probably more focused on the new product and which follow kind of a healthy margin guideline.
I don't think we adjust any pricing for the existing product anymore. It's really more focused on when we introduce a new product, we just want to make sure there's a healthy margin for all the parties.
Gabriela Borges (Managing Director and Senior Software Equity Research Analyst)
Thank you.
Ken Xie (CEO)
Thank you.
Operator (participant)
Thank you, and one moment for our next question. Our next question comes from Brian Essex from JP Morgan. Your line is now open.
Brian Essex (Executive Director of US Software Equity Research)
Great. Thank you for taking the question. I appreciate it. You know, maybe, maybe for Ken, in terms of the SASE traction that you saw in the quarter, how much was SD-WAN conversion? And maybe a little bit, if you could give us a little more color on the split of the customers that you saw in that business, the split of maybe large, mid, small enterprise, so we can get a sense of competitively how you might be lining up against some of the peers in that SASE market.
Ken Xie (CEO)
I think that's a great question. I think we have a slide for that.
So you might have asked me to ask that question. Yeah.
Uh, let-
Keith Jensen (CFO)
Yeah, I think we also included in the prepared-
Brian Essex (Executive Director of US Software Equity Research)
Peter, read my mind.
Keith Jensen (CFO)
I'll tap dance here while somebody finds the actual slide number for you, Brian. But, yeah, I think that existing customers were over 90% for both SASE and for SecOps, so they were expansion sales. Ken's kindly pointing out to me my slide number 8, that's in the deck, that actually gives you a little more context for it. One change you may notice there is that, for the first few quarters, when we talked about customer mix and the expansion opportunity, we did it by customer counts, believing that, you know, we were going to have a lot of present penetration with the SMB space, and that was where you get a larger number to start seeing some patterns.
What we've now seen is that the large enterprises and the mid enterprises are actually dominating both of those pillars of growth. And with that, we've just converted those pie charts to dollar values, which is more traditional, where, you know, we expected to get eventually.
Brian Essex (Executive Director of US Software Equity Research)
Okay, great. Thank you for that. Maybe just as a quick follow-up on that topic. I think you mentioned, if I'm not mistaken, unified SASE, 81% of... I'm sorry, SD-WAN, 81% of unified SASE billings, and I think you might have given us that metric back in SD-WAN last quarter. If you could maybe-
Keith Jensen (CFO)
Just to, just to clarify a little-
Brian Essex (Executive Director of US Software Equity Research)
Yeah.
Keith Jensen (CFO)
Yeah, Brian, what we're trying, what we're trying to say there is that if, I think we're - there's a common belief internally and probably externally, that we're going to have a lot of success with the SASE solution by cross-selling our existing SD-WAN customers. And so the SASE billings that we saw this quarter, I believe the number was 81% of those were existing SD-WAN customers.
Ken Xie (CEO)
Yeah, and also we build SD-WAN function into the FortiOS, which, whenever we have a FortiGate, we believe, like, a close to 60%-70% customer all have the, buy the FortiGate. They have automatic SD-WAN function. And so that's where we do see a lot of SD-WAN, current SD-WAN customer, which we are not fully tracking because they are part of OS function, we free of charge. So we do believe a lot of them are interested to convert into SASE, full SASE function there.
Keith Jensen (CFO)
Got it. That's really helpful. Thank you very much. I really appreciate it.
Ken Xie (CEO)
Thank you.
Operator (participant)
Thank you, and one moment for our next question. Our next question is from Fatima Boolani from Citi. Your line is now open.
Fatima Boolani (Managing Director and Co-Head US Software Equity Research)
Thank you. Good afternoon, I appreciate you taking my question. Keith, I wanted to have you spend a little bit of more time talking about some of the geographic theater-level performances. So we've seen a pretty material deceleration in your Americas business. EMEA has been, you know, relatively resilient, and APAC's actually shrunk this quarter. So I was hoping you could put a lens on each one of those geographies to talk about any nuances or idiosyncrasies from a demand and, and/or buying perspective from an end market standpoint or a customer attribution standpoint. And then just a follow-up with regards to if you can talk about the pipeline and pipeline growth you're seeing with secure SD-WAN proper, considering that is such an important conduit for future SASE upsells. Thank you.
Keith Jensen (CFO)
Okay, where to begin? The kind of cherry-picking through some data points. I think first and foremost, the SMB, you know, continues to perform stronger than expectations, whether that's external to the company or from other sources, if you will. It's very resilient, and I think it's simply the breadth of the SMB space together with, as I've said in the past, the success of the channel program. I think Europe was just a tad bit light in the quarter, and a little bit on their enterprise side of their business, and probably just enough, as I said before, to move us off of the midpoint of our guidance. I think what we've spent a fair amount of time with more recently is looking at where are the eight-figure deals coming from.
If you're looking at the deceleration, and let's take the U.S. enterprise as an example of that, you know, last quarter, we talked about six eight-figure deals in the business. The vast majority of those were in the U.S. enterprise. This quarter, we generally noted that we had one eight-figure deal. And so you can see that those eight-figure deals can whipsaw that growth rate for the U.S. enterprise around quite a bit, really because of their opportunities in these eight-figure deals that maybe some of the other geos don't have. You know, we really don't have those opportunities in APAC and in some of the other geographies that we see in the U.S.
I think the other part of growth, I mean, I think we, I think we have to, you know, understand, you know, where the firewall growth is right now in terms of, the industry. And with that, it puts a lot of either pressure or opportunity for, us to sell the SASE solutions and the SecOps solutions. And you're probably seeing a little more maturity in the ability to sell or the openness to buy SecOps and SASE solutions in the U.S. and in Europe, the larger economies, than you are in APAC.
Ken Xie (CEO)
Yeah, also, Japan probably counts about as the biggest country for us in APAC, counts probably as one of the more, more APAC, which, the, the currency, like the U.S. currency, pretty strong against Japan currency recently, that may also have some impact, of some slowdown there. On the other side, we do see, most SD-WAN customers definitely more interest in the, the SASE, and also in the current environment, more and more customers setting up SD-WAN, because SD-WAN definitely gives them a cost saving. So our average is about 50% cost saving compared to the traditional MPLS or other, networking, WAN function there. So we do see more and more customers, first converting to SD-WAN customers and then using the same FortiGate, starting adding additional SASE function there.
Fatima Boolani (Managing Director and Co-Head US Software Equity Research)
Thank you.
Operator (participant)
Thank you, and one moment for our next caller. Our next question comes from Tal Liani of Bank of America. Your line is now open.
Tal Liani (Technology Analyst)
Hi, guys. You gave some comments at the end of your prepared remarks about signs of recovery of the firewall market, and would you mind to repeat that? You went over it quickly, and the question is also, with it, do you expect the non-FortiGate to recover? Is there a correlation between the two? Do you expect the non-FortiGate to recover and, or does it have its own cycle? On the first question, which is about the firewall recovery, do you see that the market share situation is changing, meaning, the share gains you experience in the three years of the boom cycle, do you have any reason to believe that it's gonna slow down or you're gonna maintain market share gain?
How does it change when the market recovers? What drives the share dynamics to change or to stay stable? Thanks.
Keith Jensen (CFO)
You wanna take the market share and the dynamics, and then I'll go through the algebra, the slide 19?
Ken Xie (CEO)
Yeah, I think we, we believe we continue gaining market share. Even right now, on the other quarter, last quarter, in the sec- we call secure networking, which, both the firewall and also some other, like, FortiWiFi, FortiSASE space there. And, I think because the, whether the strong performance advantage we have, all kind of, more function can give a customer like a, like a better ROI return and better security, and, and also more use case, compared with the traditional firewall. So we feel we're keeping gaining market share. But overall, I have to say that whether the network security firewall market or the networking market, definitely, has going down, like a 10%-20% year-over-year.
But even in that market condition, we keeping gaining more share, market share in, in this environment. Keith probably answer the, the digestion question.
Keith Jensen (CFO)
But yeah, if for people that have access to it, slide 19 in the deck, and for those, a lot of you have followed the company for quite a while, and you remember that we had some pressure on software revenue early in the pandemic. And we talked about things like, you know, the impact from our share, but also that we were seeing a delay in customers registering the service contracts that attached to the hardware contracts. And if you look at that chart, you can see that delaying activity really started at the end of 2021, peaked at the end of the beginning of 2023, kind of plateaued and now has moved down.
And what we believe is, you're seeing there is that when the supply chain hit, customers bought the equipment, put it on the shelves, and did not need to register the contract as quickly, and that's why you saw the increase in the days to register. Now, as we move through the digestion cycle, you're seeing that inventories come off their shelves, and those days to register are starting to return to normal. We're not quite there, but we're actually quite close to it. And I would just offer that I think, you know, as I said, by the second half, in the second half of this year, on the current pace, we would return to where we were at pre-COVID on that metric. And again, we think that's a very good indicator of where customers are in the digestion cycle.
Tal Liani (Technology Analyst)
Got it. And what about the question on non-FortiGate? What are, what are the cycles with the non-FortiGate on the non-FortiGate side?
Keith Jensen (CFO)
Well, first of all, you're gonna get me in trouble for using the term non-FortiGate. We talk about SASE and SecOps, but we're all showing our age here a little bit.
Ken Xie (CEO)
The non-FortiGate probably come probably around 10% of our product. That's probably, actually, the networking side definitely down a little bit, but there's some other, like, whether the FortiWeb, FortiMail, some other, we see FortiNAC, we see pretty strong growth. So it's a, it's a mix, but overall, I think pretty much similar to like the, like FortiGate is a mix. But definitely we see... And on the other side, we do see some early sign with interest, customer using our FortiAP, even FortiSwitch, as a hardware agent for the SASE. So that's also one of the promotion we're going to run.
It's really offer some customer, if they get a FortiWiFi, they probably can run some free FortiSASE function, for some time. So that, that's we see could be driving additional non-FortiGate growth. But actually, all the non-FortiGate product, we also have technology we call the FortiLink. It's all linked with the FortiGate, like FortiGate, whether it's kind of a the next-gen firewall host or SASE host working together with the FortiWiFi or FortiSwitch.
Tal Liani (Technology Analyst)
Thank you.
Operator (participant)
Thank you, and one moment for our next question. Our next question is from Rob Owens of Piper Sandler. Your line is now open.
Rob Owens (Senior Research Analyst)
Thank you very much. Keith, I wanted to build a little bit on your answer to Fatima's question earlier, and I believe you used the technical term of whipsawing when it comes to growth, when you saw six large transactions, very large transactions in Q4 and one in Q1. And just, I wanted to ask it relative to health and enterprise and what you're seeing here in the pipeline. And should we expect similar types of results in terms of those very large deals as we move throughout the year? And, and how do you think the pipeline is setting up and relative health of the enterprise? Thanks.
Keith Jensen (CFO)
Yeah, I feel good about it, and I think we're... The parallel that I've drawn in conversations before is that if you went back to 2015, 2016, you saw the company moving away from or expanding beyond the SMB space and doing billion-dollar deals. But it wasn't that there was enough million-dollar deals that we couldn't get whipsawed by them then. Now we've got plenty, well, I could always take more, plenty million-dollar deals, but, you know, the 10 million dollar deals are whipsawing us around a little bit. You saw that with a very strong performance in the fourth quarter, and I think we were pretty open about that in the fourth quarter, setting expectations for the first.
One thing we have spent some time doing is going back and looking at the number of eight-figure deals we have by quarter for, say, the last 3 or 4 years. And you're, and you're looking at a model that maybe had one every other quarter, 5 years ago, to now, where you're probably averaging something on the order of 2, perhaps 3 of opportunities, you know, over a full year per quarter. They're gonna get condensed sometimes in certain quarters. With our business model and the history, you see that Q4 obviously outperforms, as does Q2 typically performs strongly. And I suspect that as we look forward, we'll see a little more concentration of those eight-figure deals, certainly in Q4 and maybe some in Q2.
Rob Owens (Senior Research Analyst)
Thank you.
Operator (participant)
Thank you, and one moment for our next question. Our next question is from Saket Kalia of Barclays. Your line is now open.
Saket Kalia (Equity Research Analyst)
Okay, great. Hey, guys. Thanks for taking my questions here.
... Ken, maybe the first one is for you. I was wondering if you could just talk a little bit about how your conversations are going with customers around their plans to refresh their firewall appliances. And maybe specifically, when would we sort of expect that firewall refresh to sort of begin? Does that make sense?
Ken Xie (CEO)
Yeah. I see there's a three, three part of, the business. One is the, like Keith mentioned, is really the digestion, whatever, supply chain issue. I think that's pretty much over. Maybe just a few more months will be all normal. And the second part is really the refresh, which is a current customer over to the new product, which has a better performance, all these things there. I have to say, during the economy slowdown or high interest rate environment, some customer may stretch the current product a little bit longer. And, but we do see more case, we call it replacement, and also the new area, like OT, IoT security.
So we do see the replacement pick up quite well, which, when they face an, like, where they need a new function, like, the new SD-WAN function or the SASE function, a lot of big enterprise starting using our product to replace some competitive product because they have to offer, like, a multiple product to match one of our FortiGate, the FortiOS solution there. And then we also have a much better performance and power efficiency, we use ASIC company-leading measure for every product. So that's replacement case, definitely picking up quite well. The refresh probably would still need some time to come. And on the other side, the new area, like OT, IoT security, we see very strong growth.
So that's a new market, because usually all these OT devices not connect online or kind of connect online has no protection, and pretty much impossible to run endpoint software because of different operating system and limited computing power. So we see this new OT, IoT space pick up quite well. That's the new market. So long term wise, I still believe, the network security market continue to grow, like 10%-20%. And, but probably will be, more mixed in the current environment, probably a little bit more towards the, the OpEx model, which is kind of a SASE. And, but for us, the differentiation is really, we have all the SASE in the same FortiOS, the FortiOS, which customer can run right on premise or in the cloud and the top.
So we do see a lot of customers that can turn on the SASE function, maybe starting to turn on SD-WAN function first, and then additional SASE function, additional SASE service. So that's the way they are starting, doing now.
Saket Kalia (Equity Research Analyst)
Got it. Got it. And maybe the follow-up is on that point, Ken, if I can stay with you. Just on that topic of refresh and replacement, is there any sort of change in thinking for those customers about firewall versus SASE? And I mean, as part of the discussion, you mentioned pricing earlier, are you getting any sort of pushback on just appliance pricing since sort of the prior round of adjustments that you did sort of during the supply chain?
Ken Xie (CEO)
We have not seen any pricing pressure discount because we tend to be a much better performance and more function because our ASIC technology and none of our competitor has. On the other side, doing customer consider the new function they needed for security or higher network speed environment, I think compare us to some competitor, because competitor sometime they just cannot keep adding new function like all the SD-WAN or the SASE function in their existing firewall. For us, it's very, very different. So we have all the SD-WAN function, all the new SASE function built in into the same FortiOS, running on different kind of a FortiGate device there. So that's also kind of helping customer to really keep adding additional functions, sometime without really replacing the existing hardware.
So that's really helping the customer keeping kind of adding service and enhance security with the new function there. And also, that's also driving a lot of the replacement of a competitor solution, especially in the big enterprise environment. So that's where we see the strongest growing area for us, actually, is the enterprise customer, a lot of them under some finance stress because the high cost of the money. But we do see that the growing in our enterprise space is very, very strong and a lot of replacement of competitive solution using the FortiGate, which has a more function, better performance, low cost, and also more efficient on the energy consumption there.
Saket Kalia (Equity Research Analyst)
Super helpful. Thanks, guys.
Ken Xie (CEO)
Thank you.
Operator (participant)
Thank you, and one moment for our next call or next question. Our next question comes from Brad Zelnick of Deutsche Bank. Your line is now open.
Brad Zelnick (Managing Director of Software Equity Research)
Great, thank you so much for taking my questions. Because we just had two for Ken, I think I'm gonna- I'm gonna now go for two with Keith, if we could. Keith, first one, I think, pretty straightforward. With $1 billion left in your buyback authorization and the strong cash generation of the business, I was surprised to see you not buy back any stock in the quarter. Can you just remind us of your approach to buybacks and if any change in thinking around use of cash and specifically M&A?
Keith Jensen (CFO)
Peter's pointing at our COO for M&A answers, so we're all listening, leaning forward to hear what he wants to say. I don't think there's been any real change in our buyback philosophy. You know, the term we use is we're very opportunistic. You know, we do put up a program in place with one of the Wall Street firms each quarter, and we renew it. I think the important part there is looking at the $5 billion that we've bought back over the last four years. And it's not that we're doing, you know, that some other companies would do X% of free cash flow or something like that.
It is really looking for market opportunities, and when we see them, Ken typically steps in and has something set up in that regard. And now our-
Brad Zelnick (Managing Director of Software Equity Research)
Okay
Keith Jensen (CFO)
... John Whittle has been gonna get a chance to join.
Brad Zelnick (Managing Director of Software Equity Research)
Thanks, John.
John Whittle (COO)
Thank you for the question. On M&A, we've always been very, very disciplined. We've done some very strategic tech and talent tuck-ins, and I think you'll see... We're, we're open-minded, you know. We consider M&A as it makes sense, but, you know, that's definitely been our approach so far. And, you know, I think you'll see that approach continue, although we will be open-minded about M&A as it makes sense.
Brad Zelnick (Managing Director of Software Equity Research)
Thank you for that. Maybe just my, my follow-up.
Ken Xie (CEO)
I-
Brad Zelnick (Managing Director of Software Equity Research)
I'm sorry, please.
Ken Xie (CEO)
Probably is the most busy time in the last 10, 20 years now, to look at all different companies.
John Whittle (COO)
Yeah, we see a lot of opportunities in the security space, for sure. So yeah, we build a pipeline just like sales build a pipeline, and we consider them as they come along and reach out to us proactively as well.
Brad Zelnick (Managing Director of Software Equity Research)
Got it. That makes all the sense in the world. And you guys have done a great job of it over the years. Maybe just on the margin discipline and the leverage that we're seeing in the quarter. Keith, can you maybe just give us an update on, you know, headcount plans and where you are year to date? And as you know, maybe relative to three months ago, how enthusiastic you are and where you are in sort of pushing or pulling back on the throttle to continue hiring and how we should think about OpEx? Thank you.
John Whittle (COO)
In fact, Ken was gonna say something on hiring.
Ken Xie (CEO)
It's okay. I think we continue to invest, balance the growth and margin. So the area, like, a lot of on the long-term product, we continue to invest, and we do the selective hiring. And also, we also take this opportunity to making the management ratio or structure a little bit better. So it's more invest in the field sales engineer and also the R&D area, and the kind of more flat on certain management level, and making the whole company more efficient.
Keith Jensen (CFO)
Yeah, I think the setting aside the fact that I need more resources in finance, but I was hoping Ken was just going to announce that, but apparently not. I think the business model, Brad, you've seen it, you've seen it through the cycles where, you know, if you look back at 2017, for example, and you look at the gross margin number, you know, when you start to see the slowdown or the pause, the cycle and the in the hardware, you start to see the mix shift to the really rich services. And then as the market recovers, you see that relationship change a little bit.
Clearly, we're in a situation right now where the, with the firewall market, that the mix, you know, it shifted 10 points to services, and I think that was 87% gross margin. You know, it's making margin targets very achievable, let's put it that way. And I would imagine, I think we've raised it by three-quarters of a point at the midpoint for the full year. That's a pretty big move at this point, and I think we feel very comfortable with that as we look at the rest of 2024.
Brad Zelnick (Managing Director of Software Equity Research)
Excellent. Thank you.
Operator (participant)
Thank you, and one moment for our next question. Our next question comes from Ben Bollin of Cleveland Research Company. Your line is now open.
Ben Bollin (Analyst)
Thanks. I appreciate you taking the question. Good afternoon, everyone. Keith, I was hoping you could talk a little bit about the receivables drawdown and the DSO performance. I believe you made a comment on your prepared remarks about large deal impact and collections, but it does look like DSOs are below what we've seen for the last few years. So I'm curious if there's a change in working capital management. Anything notable there?
Keith Jensen (CFO)
No, I don't think there's really a change. I think, you know, there's always a few puts and takes, if you will. I think the real driver was that last quarter we had those 6 eight-figure deals, and I believe all those closed in the last week or 2 of the quarter. And so that put a lot of pressure on DSOs. And only having 1 eight-figure deal this quarter, which I believe closed fairly early in the quarter. Not early, I mean, mid-quarter, but not in the last week. So I think that's really all I would point to there.
Ben Bollin (Analyst)
Okay. And the last one for me, you talked a little bit about duration. If you step back, a lot of your business is done through the partner community. Do you have any thoughts on how much of that business is being financed by the partners themselves to manage this, you know, kind of CapEx to OpEx appetite? Any thoughts there would be helpful. Thanks.
Keith Jensen (CFO)
Yeah, I think when you say partners, I would say that all the large distributors that we're working with are offering financing programs, either, you know, in some cases, it might be through their own captive, but I think more often than not, it's white labeling somebody else's product, if you will. I think that also some of the larger resellers are also offering financing. I think that, you know, where it makes a little more sense for ourselves as a, as an OEM, you know, is on larger deals. You know, whether we move to the extended payment program or working with the channel to provide them capital, if you will, for the financing. I think there's a lot of different ways to go there, but I don't think that...
I don't think good credits, so to speak, are suffering because they can't find credit. I don't think that's the issue.
Ben Bollin (Analyst)
Thank you.
Operator (participant)
Thank you, and one moment for our next question. Our next question comes from Adam Borg of Stifel. Your line is now open.
Adam Borg (Managing Director of Equity Research)
Awesome, and thanks so much for taking the questions. Maybe for Ken, you know, last quarter, you talked about, you know, a great job with increasing traction with enterprise agreements, and I was hoping you could talk, obviously, I know 1Q is typically a smaller EA quarter. Maybe talk a little bit more about the EA strategy overall and the go-to-market efforts to more systematically drive these enterprise agreements, especially in the back half of this year.
Ken Xie (CEO)
Yeah, I think we do see, when we have a more enterprise customer, and, they also, want to be long-term customer and also with, many different products, like, on the consolidation strategy they have right now, we see more EA. And the same time, with that one, we definitely see, kind of a, a bigger deal and also, kind of a more long-term customer, what can be left right now.
Keith Jensen (CFO)
Yeah, I think that, and John took this over, so he gets to make the victory lap on EAs. But, you know, as Ken kind of alluded to it, it tends to make a lot of sense when you're usually gonna see it as part of your expansion inside of a larger enterprise. You're probably not gonna see it frequently with the very first sale into a new logo. You could. And I think some things that are really we're starting to see resonate there are the new FortiPoints program that we make available and things of that nature, where, you know, customers have reached that point where they're very comfortable with Fortinet, with the technology and our customer support, et cetera, and they start thinking about long-term relationships.
They know they're gonna buy more, they may not know what. But the combination of EAs and FortiPoints, I think, has been well received by the customer group.
Adam Borg (Managing Director of Equity Research)
That's, that's great. And maybe just as a quick follow-up, in the slide deck, I didn't recall seeing the breakout of the FortiGate by small, medium, and large. I know that indicator has been less meaningful more recently. I was just curious if there was anything interesting there as you think about the FortiGate sales by size. Thanks again.
Keith Jensen (CFO)
No, I think you alluded to it. I think it's really—you see us, you know, at this point in the firewall life cycle, firewall cycle, it's really for us, we want to increase the focus on SASE. I think we feel very good about it. You see us adding some more information there, and to your point, that it wasn't anything that was really new or earth-shattering, on the FortiGates.
Ben Bollin (Analyst)
Great. Thanks again.
Operator (participant)
Thank you, and one moment for our next question. Our next question comes from Keith Bachman of BMO. Your line is now open.
Keith Bachman (Analyst)
Good afternoon. Thank you very much. And Peter and Keith, appreciate the slides. I did find 7 and 8 to be quite interesting and wanna focus my first question on that. And if you look at the amount of billings from SASE, 24%, is there any clarification on, of that 24%, how much is SD-WAN? And then if I look at the SecOps, really interesting that enterprise is 40% of the SecOps. And is there just any patterns or anything that's kind of bubbling up as a frequent purchase within the SecOps portfolio you have that is serving to be pretty interesting to the enterprise? I just thought that 40% number was quite interesting. And believe it or not, I'm gonna count that as one question.
And then, Keith, just anything you could think about or guide us on, on the FortiCare support line item as we think about the correlation to the product sales, and then I will cede the floor before Peter gets a chance to cut me off.
Keith Jensen (CFO)
I can go to the first one and cover FortiCare and FortiGuard. I think it's a great question, you know, FortiCare, which is, you know, the traditional support we're offering. We talk about services being a lagging indicator. It's really what did you sell before and what rep are you recognizing now? And what's important is that FortiCare is gonna be more closely linked to more recent product sales, right? Because you have fewer products to attach it, so you'll probably see a little more pressure on FortiCare there. FortiGuard, which is the security subscriptions, which can be bundled, but they can also now be a variety of SecOps solutions and SASE solutions, is getting a fair amount of tailwind from those other two pillars.
So you will start to see, I think, and have seen a little more divergence in the growth rates as we go through this cycle, as we know, between FortiCare and FortiGuard. And interestingly, that FortiGuard actually has higher margins, if you will. And I think that we decided to call out in the prepared remarks that if you looked at, you know, this SASE SecOps business, which I'll just broadly call SaaS, not counting FortiCare and FortiGuard and our software licenses, you know, you're starting to see a company now that has a run rate of about $750 million in, say, non-hardware and non-attached service contracts, which is pretty impressive, I think.
Ken Xie (CEO)
Mm-hmm. Yeah, I would say, since we only launched our own FortiSASE six months ago, we see pretty strong growth, but also SD-WAN has been there for a few years. So I have to say, probably most, a majority, if not the most, SASE still more come from SD-WAN, which is in the chart there. Maybe the better way to say is really look in the pipeline, so that's on Keith's script. He says, it's a unified SASE, probably pipeline grow, like, 45%, and then the SSE pipeline grows over 150%. That's maybe a better indicator as a pretty strong-...
For the SASE interest and also leverage both our SD-WAN and the firewall market leading position there. So we do see a lot of our customer adding the SASE, adding the SD-WAN, and convert some of them to the additional services, which probably come up about over 90% of our, like, the SASE business right now. And as there is also very strong interest from the customer right now. At the same time, some of the trial program, like using the FortiWiFi AP as a hardware agent, offers certain free SASE service.
That's also what drive additional like a differentiated SaaS unified SASE approach compared to the other competitor in the market, which we also believe will be drive quite a lot of SASE business going forward. So that's where that's also the reason we believe probably within a few quarter to a few year we'll be the number one leader in the SASE market.
Keith Jensen (CFO)
Operator?
Operator (participant)
Thank you, and one moment for our next question. Our next question comes from Joseph Gallo of Jefferies. Your line is now open.
Joseph Gallo (Software Research Analyst)
Hey, guys. Thanks for the question and getting me in here. A lot of cool stuff around AI at your conference. For FortiAI, any early feedback? And how are we thinking about monetizing that, and any impact to gross margins, and when can that benefit top line? Thanks.
Ken Xie (CEO)
Yeah, totally agree. There's a lot of interest in AI, FortiAI. We've been studying applying more FortiAI to different product, which are helping customer more efficiently, manage their operation there. But that's also what drive additional service, additional product sales there. I'd say it's still more in the early ramp-up stage, but it's the interest is rather high, and we do see some benefit already. But how soon will be materialize, maybe-
Keith Jensen (CFO)
Yeah, I think it's some more tactical responses to you. In general, we're charging for it separately. It's on the price list. It's additive to it, and you're gonna really push my technical knowledge, and maybe somebody here can help me out. But I think there's an LLM that the customer has to go out and buy on their own, in some cases, to enable it. And then I would offer a really shameless plug. I really tell you, you should go look at our website and see the demo that was done at Accelerate with FortiAI. It was fantastic.
Keith Bachman (Analyst)
Yep.
Keith Jensen (CFO)
All right.
Keith Bachman (Analyst)
No, we saw it live. Just a quick follow-up on, I really, really appreciate the time to register or days to register metric. It's really interesting. Was there any seasonality in that metric historically, before or after firewall cycles? Just trying to better understand, you know, if we should expect to find a floor at 2019 levels, or if there's a potential another leg down. Thanks.
Ken Xie (CEO)
I think probably if I look back to 20-30 years, when there's a big attack in the space, then they drive some kind of a new function. Then there's some like a rush by something, maybe impact some of that. Otherwise, it's pretty normal. I don't know, 7-8 weeks, whatever, for customer to register. And then the last 2-3 years, the supply chain really changing that. Sometimes certain, like, the channel partners or distributor may try to have a little bit more inventory, and sometimes the customer, because it takes some time to deploy, they also try to order some actual inventory. But that's pretty much all normal now. If you place the order, you pretty much can get it delivered right away, no longer has a lead time anymore.
So that's where we see it's the digestion pretty much is all over, and it's pretty back to normal in the current environment now.
Keith Jensen (CFO)
Yeah, and I think the chart itself actually goes all the way back to 2019, and you can see it by quarter there. Nothing jumps out at me in terms of seasonality by quarter that we really have that I would call out to it, so.
Operator (participant)
This now concludes the question and answer session. I would now like to turn it back to Peter Salkowski for closing remarks.
Peter Salkowski (SVP of Finance and Investor Relations)
Thank you, Brianna. I'd like to thank everyone for joining today's call. Fortinet will be attending investor conferences hosted by JP Morgan and Bank of America during the second quarter. Fireside chat webcast links will be posted on the Events and Presentations section of our Fortinet's Investor Relations website. If you have any follow-up questions, please feel free to contact me. Have a great rest of your day. Thank you very much.
Operator (participant)
Thank you for your participation in today's conference. This does conclude the program. You may now disconnect.