Fortinet (FTNT) 10-K risk factor changes: FY2023 vs FY2022

- economic conditions, including macroeconomic and regional economic challenges resulting, for example, from a recession or other economic downturn, increased inflation or possible stagflation in certain geographies, rising interest rates, the war in Ukraine, the [removed: COVID-19 pandemic] [added: Israel-Hamas war, tensions between China and Taiwan,] or other factors;

- [added: sales strategy, productivity and execution, and] our ability to attract and retain new end-customers or sell additional products and services to our existing [removed: end-customers;][added: end-customers, including customer demand for platform solutions like ours versus point solutions;]

- component shortages, including chips and other components, and product inventory shortages, including those caused by factors outside of our control, such as [removed: the COVID-19 pandemic,] [added: epidemics and pandemics,] supply chain disruptions, inflation and other cost increases, international trade disputes or tariffs, natural disasters, health emergencies, power outages, civil unrest, labor disruption, international conflicts, terrorism, wars, such as the war in [removed: Ukraine,] [added: Ukraine] and [added: the Israel-Hamas war, and] critical infrastructure attacks;

- the level of demand for our products and services, which may render forecasts inaccurate, increase backlog [removed: and may be impacted by the COVID-19 pandemic] [added: or future inventory purchase order commitments] and [removed: supply chain constraints in ways that we are not able] [added: lead] to [removed: foresee;][added: price decreases;]

- the timing of channel partner and end-customer [removed: orders, market acceptance of our price increases] [added: orders] and our reliance on a concentration of shipments at the end of each quarter;

- the impact to our business, the global economy, disruption of global supply chains and creation of significant volatility and disruption of the financial markets due to [removed: the COVID-19 pandemic,] [added: factors such as] increased inflation or possible stagflation in certain geographies, [removed: rising] [added: increasing or decreasing] interest rates, the war in Ukraine and [added: the Israel-Hamas war and] other factors;

- the mix of products [removed: sold, such as the mix between Core Platform and Enhanced Platform Technology solutions,] [added: sold] and the mix of revenue between products and services, as well as the degree to which products and services are bundled and sold together for a package price;

- any decreases in demand by channel partners or end-customers, including any such decreases caused by factors outside of our control such as natural disasters and health emergencies, including earthquakes, droughts, fires, power outages, typhoons, floods, pandemics or epidemics [removed: such as the COVID-19 pandemic] and manmade events such as civil unrest, labor disruption, international trade disputes, international conflicts, terrorism, wars, such as the war in [removed: Ukraine,] [added: Ukraine] and [added: the Israel-Hamas war, and] critical infrastructure attacks;

- the effectiveness of our sales organization, generally or in a particular geographic region, including the time it takes to hire sales personnel, the timing of hiring and our ability to hire and retain effective sales [removed: personnel;][added: personnel, as well as our efforts to align our sales capacity and market demand;]

- sales [added: productivity and sales] execution risk related to effectively selling to all segments of the market, including enterprise and small- and medium-sized businesses, government organizations and service providers, and to selling our broad security product and services portfolio, including, among other execution risks, risks associated with the complexity and distraction in selling to all segments, increased competition and unpredictability of timing to close larger enterprise and large organization deals, and the risk that our sales representatives do not effectively sell [removed: our Enhanced Platform Technology products;][added: products and services;]

- execution risk associated with our efforts to capture the opportunities related to our identified growth drivers, such as risk associated with our ability to capitalize on the convergence of networking and security, vendor consolidation of various cyber security solutions, SD-WAN, infrastructure security, [removed: cloud] security [added: operations, SASE] and [added: other cloud security solutions,] endpoint protection, and IoT and OT security opportunities;

- changes in the growth rates of the network security market in particular and other security and networking markets, such as SD-WAN, OT, switches, access [removed: points] [added: points, security operations, SASE] and [added: other] cloud solutions for which we and our competitors sell products and services;

- the deferral of orders from distributors, resellers or end-customers in anticipation of new products or product enhancements announced by us or our competitors, [added: price decreases] or [added: changes in our registration policies, or] the acceleration of orders in response to our announced or expected price list increases;

- our ability to obtain and maintain permits, clearances and certifications that are applicable to our ability to conduct business with the [removed: public sector, including the] U.S. federal government, [added: other foreign] and [added: local governments and] other [added: industries and] sectors;

- the impact of cloud-based security solutions on our billings, [removed: revenues,] [added: revenue,] operating margins and free cash flow;

- our ability to both increase [removed: revenues] [added: revenue] and manage and control operating expenses in order to maintain or improve our operating margins;

- political, economic and social instability, including geo-political instability and uncertainty, such as that caused by the war in Ukraine, [added: the Israel-Hamas war, tensions between China] and [added: Taiwan, and] any disruption or negative impact on our ability to sell to, ship product to and support customers in certain regions based on trade restrictions, embargoes and export control law restrictions;

- possible impairments or acceleration of depreciation of our existing real estate due to our current real estate [removed: holdings] [added: investments] and future [added: acquisition and] development plans; and

- legislative or regulatory changes, such as with respect to privacy, information and cybersecurity, exports, the [removed: environment] [added: environment, regional component bans,] and [removed: applicable accounting standards.][added: requirements for local manufacture.]

This variability and unpredictability could result in [removed: our] failing to meet our internal operating plan or the expectations of securities analysts or investors for any period.

Adverse economic conditions, such as a possible recession and possible impacts of inflation or stagflation, [removed: rising interest rates] [added: increasing] or [added: decreasing interest rates,] reduced information technology spending, [added: including firewall and other security spending, or any economic downturn or recession,] may adversely impact our business.

Weak global and regional economic conditions and spending environments, based on a downturn in the economy, a possible recession and the effects of ongoing or increased inflation or possible stagflation in certain geographies, [removed: rising] [added: increasing or decreasing] interest rates, geopolitical instability and uncertainty, a reduction in information technology spending regardless of macroeconomic conditions, the effects of [removed: the COVID-19 pandemic] [added: epidemics] and [added: pandemics and] the impact of the war in Ukraine [added: and the Israel-Hamas war] each could have a material adverse impacts on our [removed: business,] financial condition and results of [removed: operations,] [added: operations and our business,] including [added: resulting in] longer sales cycles, lower prices for our products and services, increased component costs, higher default rates among our channel partners, reduced unit [removed: sales] [added: sales, lower prices] and slower or declining growth.

These can negatively impact our business by putting downward pressure on growth [removed: or] if we are unable to achieve the increases in product prices necessary to appropriately offset the additional costs [added: in a manner] sufficient to maintain margins.

The existence of inflation in certain economies has resulted in, and may continue to result in, [removed: rising] [added: increasing or decreasing] interest rates and capital costs, increased [added: component or] shipping costs, increased costs of labor, weakening exchange rates and other similar effects.

[added: Any of these impacts may] materially [added: and] adversely affect our business, financial condition, results of operations and liquidity.

We may experience slowing growth or a decrease in billings, revenue, operating margin and free cash flow for a number of reasons, including [removed: as] a [removed: result of the COVID-19 pandemic, a] slowdown in demand for our products or services, a shift in demand from products to services, decrease in services revenue growth, increased competition, [added: execution challenges including sales execution challenges and lack of optimal sales productivity,] worldwide or regional economic challenges based on inflation or possible stagflation, a regional recession or a recession in the global economy, rising interest rates, the war in [removed: Ukraine,] [added: Ukraine and the Israel-Hamas war,] a decrease in the growth of our overall market or softness in demand in certain geographies or industry verticals, such as the service provider industry, changes in our strategic opportunities, execution [removed: risks] [added: risks, lower sales productivity] and our failure for any reason to continue to capitalize on sales and growth opportunities due to other risks identified in the risk factors described in this periodic report.

In addition, we may not be able to sustain [added: our historical] profitability [added: levels] in future periods if we fail to increase billings, revenue or deferred revenue, and do not appropriately manage our cost structure, free cash flow, or encounter unanticipated liabilities.

[removed: The loss of the services or the] distraction of our senior management for any [removed: reason, including the COVID-19 pandemic,] [added: reason] could adversely affect our business, financial condition and results of operations.

Additionally, a small number of distributors represents a large percentage of our revenue and [removed: gross] accounts receivable, and one distributor accounted for [removed: 32%] [added: 33%] of our total net accounts receivable as of December 31, [removed: 2022.][added: 2023.]

Six distributor customers accounted for [removed: 69%] [added: 70%] and [removed: 68%] [added: 69%] of our total net accounts receivable in the aggregate as of December 31, [removed: 2022] [added: 2023] and [removed: 2021,] [added: 2022,] respectively.

We provide [removed: sales] channel partners with specific programs to assist them with selling our products and incentivize them to sell our products, but there can be no assurance that these programs will be effective.

Moreover, many of our channel partners are privately held, including [added: some of] our largest [removed: distributor,] [added: partners,] and we may not have sufficient information to assess their financial condition.

If our channel partners’ financial condition or operations weaken, their ability to sell our [removed: product] [added: products] and services could be negatively impacted.

They may also have incentives to promote our [added: competitors’ products to the detriment of our own, or they may cease selling our products altogether.]

[removed: Our channel partner sales structure could subject us to lawsuits, potential liability and reputational harm if, for] example, any of our channel partners misrepresent the functionality of our products or services to end-customers, our service provider customers suffer a cyber event impacting end-users, or our channel partners violate laws or our corporate policies.

Reliance on a concentration of shipments at the end of the quarter could cause our billings and revenue to fall below expected [removed: levels or delay collections and the related increase in free cash flow.][added: levels.]

If we do not have enough time after shipping our products for our systems to perform these processes prior to the end of the quarter, [removed: or] we have system issues that prevent processing in time to realize service billings in a quarter, [added: or there are delays in deals closing or deals are lost,] we will not be able to bill and realize billings for those services until [added: possibly] the following [removed: quarter,] [added: quarter at the earliest,] which may materially negatively impact our billings for a particular quarter.

Our billings and revenue for any quarter could fall below our expectations or those of securities analysts and investors, resulting in a decline in our stock price, if expected orders at the end of any quarter are delayed [added: or deals are lost] for any reason or our ability to fulfill orders at the end of any quarter is hindered for any reason, including, among others:

- disruption in manufacturing or shipping based on power outages, system failures, labor disputes or constraints, excessive demand, natural disasters or widespread public health problems including pandemics and [removed: epidemics such as the COVID-19 pandemic;][added: epidemics;]

[added: Revenue from the sale of new, or from the renewal of existing,] FortiGuard and other security subscription and FortiCare technical support service contracts may decline and fluctuate as a result of a number of factors, including fluctuations in purchases of [removed: Core Platform appliances or our Enhanced Platform Technology products,] [added: secure networking, unified SASE and security operations,] changes in the sales mix between products and services, end-customers’ level of satisfaction with our products and services, the prices of our products and services, the prices of products and services offered by our competitors, reductions in our customers’ spending levels and the timing of revenue recognition with respect to these arrangements.

- our ability to successfully anticipate market changes related to cloud-based solutions and to sell, support and meet service level agreements related to cloud-based solutions;

- inventory management, including future inventory purchase order commitments;

- based on supply chain shortages, including component and other shortages, our backlog has fluctuated over past quarters and any decrease in growth or negative growth of in-quarter billings and revenue may not be reflected by our aggregate billings and revenue.

As we have fulfilled, shipped and billed during a quarter to satisfy backlog, this has increased our aggregate billings and revenue during any particular quarter, and as the supply chain challenges normalize, the growth comparisons versus prior quarters where backlog contributed more to billings have become more challenging and may become increasingly challenging;

- investors’ expectations of our performance relating to environmental, social and governance (“ESG”) and commitment to carbon neutrality;

- certain customer agreements which contain service-level agreements, under which we guarantee specified availability of our platform and solutions;

- data security requirements that may be inconsistently enforced in certain jurisdictions;

- impairments as a result of certain events or changes in circumstances;

- changes in our estimated annual effective tax rates and the tax treatment of research and development expenses and the related impact of cash from operations;

- potential shift or migration from physical appliances that deliver on-premises network security to cloud and SaaS-based security services;

Our real estate investments, including construction or acquisition of new data centers, data center expansions or office buildings, could involve significant risks to our business.

In order to sustain our growth in certain of our existing and new markets, we may expand existing data centers, lease new facilities or acquire suitable land, with or without structures, to build new data centers or office buildings.

These projects

expose us to risks which could have an adverse effect on our results of operations and financial condition.

The current global supply chain and inflation issues have exacerbated many of these construction risks and created additional risks for our business.

Some of the risks associated with construction projects include:

- construction delays;

- lack of availability and delays for data center equipment, including items such as generators and switchgear;

- unexpected budget changes;

- increased prices for and delays in obtaining building supplies, raw materials and data center equipment;

- labor availability, labor disputes and work stoppages with contractors, subcontractors and other third parties;

- unanticipated environmental issues and geological problems;

- delays related to permitting and approvals to open from public agencies and utility companies;

- unexpected lack of power access;

- failure or inability for any reason to meet customer requirements;

- investor expectations regarding ESG;

- delays in site readiness leading to our failure to meet commitments made to customers; and

- unanticipated customer requirements that would necessitate alternative data center design, making our sites less desirable or leading to increased costs in order to make necessary modifications or retrofits.

All construction-related projects require us to carefully select and rely on the experience of one or more designers, general contractors and associated subcontractors during the design and construction process.

Should a designer, general contractor, significant subcontractor or key supplier experience financial problems or other problems during the design or construction process, we could experience significant delays, increased costs to complete the project and/or other negative impacts to our expected returns.

We have broad insurance programs covering our properties and operating activities with limits of liability, deductibles and self-insured retentions that we believe are comparable to similarly situated companies.

We believe the policy specifications and insured limits of these policies are adequate and appropriate.

There are, however, certain types of extraordinary losses which may not be adequately covered under our insurance program.

In addition, we could sustain losses due to insurance deductibles, self-insured retention, uninsured claims or casualties or losses in excess of applicable coverage.

If an uninsured loss or a loss in excess of insured limits occurs, we could lose all or a portion of the capital we have invested in a property, as well as the anticipated future revenue from the property.

In such an event, we might nevertheless remain obligated for any mortgage debt or other financial obligations related to the property.

Material losses in excess of insurance proceeds may occur in the future.

Such events could materially and adversely affect our financial condition and results of operations.

Additionally, under various federal, state and local environmental laws, ordinances and regulations, a current or previous owner or operator of real property may be liable for the costs of removal or remediation of hazardous or toxic substances on, under or in that property.

Those laws often impose liability even if the owner or operator did not cause or know of the presence of hazardous or toxic substances and even if the storage of those substances was in violation of a customer’s lease.

- inventory management;

[Table o](#i90327120283244798f2956555b82bd30_7)[f](#i90327120283244798f2956555b82bd30_7) [Contents](#i90327120283244798f2956555b82bd30_7)

- changes in our estimated annual effective tax rates;

We may be adversely affected by the effects of inflation or stagflation, rising interest rates or any economic downturn or recession.

Inflation or possible stagflation, rising interest rates and any economic downturn or recession in certain regions or worldwide each have the potential to adversely affect our liquidity, business, financial condition and results of operations by increasing our overall product cost structure or decreasing demand.

As a result of inflation, we have experienced and may continue to experience component, product and shipping cost increases.

Inflation, stagflation and any economic downturn or a recession may

The COVID-19 pandemic, including its ongoing variants, may adversely affect our business, for example, through product and component shortages.

The COVID-19 pandemic, including its ongoing variants, has negatively impacted the global economy, disrupted global supply chains, reduced demand for certain solutions and created significant volatility in, and disruption of, global markets.

The extent of the future impact of the COVID-19 pandemic on our operational and financial performance is unpredictable, adds uncertainty to our business and will depend on future developments, including the duration and spread of the COVID-19 pandemic and related restrictions on, and disruptions of business, supply chain and world economies, all of which are uncertain and difficult to predict.

There is a worldwide shortage of various components, impacting many industries, caused in-part by the COVID-19 pandemic.

We continue to experience ongoing product and component shortages, which have resulted in, and which we expect will continue to result in, extended lead times of certain products and significant disruption to our production schedule and predictability.

In fact, certain of our contract manufacturers and component suppliers have de-committed from their scheduled delivery dates and product and component delivery commitments.

We also have experienced and expect to continue to experience increased component costs, which have negatively impacted our gross margins.

An extended period of global supply chain disruption, demand reduction and economic slowdown would materially negatively affect our overall business and our operating results, including billings, revenue, gross margins, operating margins, cash flows and other operating results.

If the effects of the COVID-19 pandemic continue to limit the availability of our products, either by limiting components available, the actual manufacture and assembly or by limiting or restricting shipping of components and products, this could continue to result in increased product backlog, and result in lower billings, lower revenue and decreased profitability, and would negatively impact, and may materially negatively impact, our operating results and business.

In addition, we may face personnel-related risks as certain departments and locations continue to transition back to an in-person working model, including that “return to office” plans may be viewed negatively by employees and lead to attrition and difficulty in hiring.

The COVID-19 pandemic may adversely affect certain of our partners’ and customers’ ability or willingness to purchase our products and services, delay certain customers’ purchasing decisions and increase customer attrition rates, all of which will adversely affect our future sales, billings and operating results, possibly in a material way.

As a result, we may experience extended sales cycles; our ability to close transactions with new and existing customers and partners may be negatively impacted; our ability to recognize revenue from sales we do close may be negatively impacted; certain businesses will not buy our products and services when they otherwise would have; certain current partners, customers and customer prospects may go out of business or face significant business challenges, thereby negatively impacting our sales; product or component shortages, implementation delays or other factors; and our ability to provide technical and other support to our customers may be affected.

We have also offered, and may continue to offer, payment terms in excess of our contractual agreements to some of our distributors, which may decrease the likelihood that we will be able to collect from these customers.

In addition, the COVID-19 pandemic has caused an increase in certain of our expenses, including increased shipping costs, increased cancellation charges and increased component and product manufacturing costs.

The full impact of the COVID-19 pandemic is unknown at this time.

While we continue to monitor developments and the potential effect on our business, it is clear that the COVID-19 pandemic may negatively impact certain sales and may have a material negative impact on our operating results in the near term and longer term.

competitors’ products to the detriment of our own, or they may cease selling our products altogether.

Revenue from the sale of new, or from the renewal of existing,

indebtedness, sell selected assets or reduce or delay planned capital, operating or investment expenditures.

- longer sales processes for larger deals, particularly during the summer months or as a result of the COVID-19 pandemic and related travel and gathering restrictions;

The ongoing effects of the COVID-19 pandemic may increase the severity and unpredictability of a number of the foregoing risks, and the risks to our business presented by the COVID-19 pandemic may be more significant and for a longer term in certain international geographies where we do meaningful business.

Such

skills and technical knowledge that we require, including experienced enterprise sales employees and others.

A portion of our revenue is generated by sales to government organizations and to companies that perform on government contracts.

We derive a portion of our revenue from sales to government organization in the US (federal, state, local and education markets) and in foreign markets.

distributors and resellers for convenience or due to a default, and any such termination may adversely impact our future results of operations.

The war in Ukraine and any expansion thereof and our reduction of operations in Russia have affected, and may continue to affect, our business.

The war in Ukraine and resulting disruption are ongoing and likely to continue, and may also expand into other regions.

Some of the impacts and potential impacts of the war in Ukraine and possible expansion thereof include, but are not limited to:

- reduction of sales and revenue based on our reduction of operations and sales in Russia;

- difficulty in business planning and forecasting due to the uncertainty of the impact of the war on aspects of our business, such as on our distributors, resellers and end-customers;

- uncertainty and disruption in the general demand environment, including Russia, Belarus and Ukraine, which could reduce demand by distributors;

- increased costs and the diversion of management’s attention related to oversight of our international operations;

*•supply chain constraints, [removed: the global chip and] component [removed: shortages,] [added: availability] and other factors affecting our manufacturing capacity, delivery, cost and inventory management;*

[removed: *•increased] [added: *•increasing or decreasing] inflation or stagflation, and [removed: rising] [added: changing] interest rates in many geographies and changes in currency exchange rates and currency regulations;*

*•expected impact of sales [removed: of] [added: from] certain products and services;*

*•macroeconomic, geopolitical factors and other disruption on our manufacturing or sales, including [removed: the impact of the COVID-19 pandemic and other] public health issues, wars and natural disasters;*

- *drivers of long-term growth and operating leverage, such as [added: pricing of our products and services,] sales [removed: productivity] [added: productivity, pipeline] and capacity, [removed: functionality and] [added: functionality,] value [added: and technology improvements] in our service offerings;*

- *trends in revenue, cost of revenue and gross [removed: margin;*][added: margin, including expectations regarding product revenue and service revenue growth;*]

*•expectations that our operating [removed: expense] [added: expenses] will increase [added: year over year] in absolute dollars during [removed: 2023;*][added: 2024;*]

*•expectations that proceeds from the exercise of stock options in future years will be adversely impacted by the increased mix of restricted stock units [added: and performance stock units] versus stock options [removed: granted;*][added: granted or a decline in our stock price;*]

*•expectations regarding spending related to real estate acquisitions and development, [added: including] data [removed: center] [added: center, office building and warehouse] investments, as well as other capital expenditures and to the impact on free cash [removed: flow;*][added: flow and expenses;*]

- *estimates of a range of [removed: 2023] [added: 2024] spending on capital expenditures;*

- [removed: *statements regarding expected] [added: *expected] outcomes and liabilities in litigation;*

- Total revenue was [removed: $4.42] [added: $5.30] billion in [removed: 2022,] [added: 2023,] an increase of [removed: 32%] [added: 20%] compared to [removed: $3.34] [added: $4.42] billion in [removed: 2021.][added: 2022.]

- Product revenue was [removed: $1.78] [added: $1.93] billion in [removed: 2022,] [added: 2023,] an increase of [removed: 42%] [added: 8%] compared to [removed: $1.26] [added: $1.78] billion in [removed: 2021.][added: 2022.]

- Service revenue was [removed: $2.64] [added: $3.38] billion in [removed: 2022,] [added: 2023,] an increase of [removed: 26%] [added: 28%] compared to [removed: $2.09] [added: $2.64] billion in [removed: 2021.][added: 2022.]

- Total gross profit was [removed: $3.33] [added: $4.07] billion in [removed: 2022,] [added: 2023,] an increase of [removed: 30%] [added: 22%] compared to [removed: $2.56] [added: $3.33] billion in [removed: 2021.][added: 2022.]

- Operating income was [removed: $969.6 million] [added: $1.24 billion] in [removed: 2022,] [added: 2023,] an increase of [removed: 49%] [added: 28%] compared to [removed: $650.4] [added: $969.6] million in [removed: 2021.][added: 2022.]

- Cash, cash equivalents, investments and marketable equity securities were [removed: $2.26] [added: $2.44] billion as of December 31, [removed: 2022, a decrease] [added: 2023, an increase] of [removed: $736.0] [added: $183.9] million, or [removed: 25%,] [added: 8%,] from December 31, [removed: 2021.][added: 2022.]

- Long-term debt, net of unamortized discount and debt issuance costs, was [removed: $990.4] [added: $992.3] million and [removed: $988.4] [added: $990.4] million as of December 31, [removed: 2022] [added: 2023] and [removed: 2021,] [added: 2022,] respectively.

[removed: -] In [removed: 2022,] [added: 2023,] we repurchased [removed: 36.0] [added: 27.2] million shares of common stock under the Repurchase Program for an aggregate purchase price of [removed: $1.99] [added: $1.50] billion.

In [removed: 2021,] [added: 2022,] we repurchased [removed: 12.9] [added: 36.0] million shares of common stock for a total purchase price of [removed: $741.8 million.][added: $1.99 billion.]

- Deferred revenue was [removed: $4.64] [added: $5.74] billion as of December 31, [removed: 2022,] [added: 2023,] an increase of [removed: $1.19] [added: $1.09] billion, or [removed: 34%,] [added: 24%,] from December 31, [removed: 2021.][added: 2022.]

Short-term deferred revenue was [removed: $2.35] [added: $2.85] billion as of December 31, [removed: 2022,] [added: 2023,] an increase of [removed: $571.9] [added: $499.4] million, or [removed: 32%,] [added: 21%,] from December 31, [removed: 2021.][added: 2022.]

- Cash flows from operating activities were [removed: $1.73] [added: $1.94] billion in [removed: 2022,] [added: 2023,] an increase of [removed: $230.9] [added: $204.9] million, or [removed: 15%,] [added: 12%,] compared to [removed: 2021.][added: 2022.]

[removed: -] Our loss related to [removed: our equity method investment in] Linksys [removed: Holdings, Inc. (“Linksys”)] in fiscal 2022 totaled $68.1 million, [removed: which] comprised [removed: of] our proportionate share of Linksys’ financial results as well as the amortization of the basis differences of $45.9 million, which included a $17.5 million charge in connection with a valuation allowance established on deferred tax assets at Linksys, and the [removed: other-than-temporary impairment (“OTTI”)] [added: OTTI] charge of $22.2 [removed: million.][added: million recorded during the three months ended December 31,2022.]

Our revenue growth was driven [added: primarily] by [removed: both product and] service revenue.

In [removed: 2022,] [added: 2023,] the Americas region, the Europe, Middle East and Africa (“EMEA”) region and the Asia Pacific (“APAC”) region contributed 41%, [removed: 38%] [added: 39%] and [removed: 21%] [added: 20%] of our total revenue, respectively, and increased [removed: by 31%, 33%] [added: 22%, 23%] and [removed: 33%] [added: 12%] compared to [removed: 2021,] [added: 2022,] respectively.

Service revenue growth has accelerated over the past three years from [removed: 22% in 2020, to] 24% in 2021, to 26% in [removed: 2022.][added: 2022, to 28% in 2023.]

Service revenue growth of [removed: 26%] [added: 28%] in [removed: 2022] [added: 2023] was [added: primarily] driven by the strength of our [removed: FortiGuard and other] security subscription [removed: revenue and FortiCare technical support and other service] revenue, which grew [removed: 27% and 26%, respectively.][added: 33%.]

The increases [added: in service revenue] were primarily due to the recognition of revenue from our growing deferred revenue balance related to FortiGuard and other security subscriptions delivered to on-premise and cloud-based [removed: environments, as well as FortiCare and other technical support, including our customers moving to higher-tier support offerings and the early effects of certain pricing actions.][added: environments.]

In [removed: 2022, six] [added: 2023, seven] countries represented approximately 50% of our billings and the remaining 50% in the aggregate were from over 100 countries that individually contributed less than [removed: 4%] [added: 3%] of our billings.

Headcount increased [removed: by 24%] [added: 8%] to [removed: 12,595] [added: 13,568] employees as of December 31, [removed: 2022,] [added: 2023,] up from [removed: 10,195] [added: 12,595] as of December 31, [removed: 2021.][added: 2022.]

Impact of Macroeconomic [removed: Developments and COVID-19 Pandemic Update][added: Developments]

Our overall performance depends in part on worldwide economic and geopolitical [removed: conditions] [added: conditions, such as the war in Ukraine] and [added: the Israel-Hamas war or tensions between China and Taiwan, and] their impact on customer behavior.

Worsening economic conditions, including inflation, higher interest rates, slower growth, [added: any recession,] fluctuations in foreign exchange [removed: rates] [added: rates, instability in the global banking industry] and other changes in economic conditions, may [added: result in decreased sales productivity and growth and] adversely affect our results of operations and financial performance.

We have seen certain impacts on our [removed: business and operations,] [added: business,] results of operations, financial condition, cash flows, liquidity and capital and financial resources [added: such] as [removed: of] [added: longer sales cycles, delayed purchases] and [removed: during the year ended December 31, 2022.][added: increased commitments with certain suppliers and increased inventory and inventory purchase commitment reserves.]

The accounts receivable allowance for credit losses was [removed: $3.6] [added: $8.2] million as of December 31, [removed: 2022,] [added: 2023,] an increase of [removed: $1.2] [added: $4.6] million compared to [removed: $2.4] [added: $3.6] million as of December 31, [removed: 2021,] [added: 2022,] primarily due to an increase in past due invoices over 60 and 90 days.

Given the dynamic nature of these circumstances, the full impact of [removed: the COVID-19 pandemic] [added: worsening economic conditions] on our business and operations, results of operations, financial condition, cash flows, liquidity and capital and financial resources cannot be reasonably estimated at this time.

We typically sell our security solutions to distributors that sell to networking security focused resellers and to certain service [removed: providers,] [added: providers and managed security service providers (“MSSPs”),] who, in turn, sell to end-customers or use our products and services to provide hosted solutions to other enterprises.

Our end-customers are located in over 100 countries and include small, medium and large enterprises and government organizations across a wide range of industries, including [removed: education,] financial services, government, healthcare, manufacturing, retail, technology and telecommunications.

An end-customer deployment may involve as few as one or as many as thousands of [removed: Core Platform products as well as Enhanced Platform Technology] [added: secure networking, unified SASE and security operations technology] products, depending on the end-customer’s size and security requirements.

*•real estate investments, management of future growth including expansions and enhancements of current properties;*

*•our ability to successfully anticipate market changes related to cloud-based solutions and to sell, support and meet service level agreements related to cloud-based solutions;*

*•growth expectations for the secure networking market;*

*•forecasts of future demand and targeted inventory levels, including changing market drivers and demands;*

*•the effect of backlog from prior quarters, including its effect on growth of in-quarter billings and revenue;*

*•instability in the global banking system;*

*•expected impact of plans and strategy for the acceleration of our points of presence (“PoP”) deployment;*

*•expectations regarding uncertain tax benefits and our effective domestic and global tax rates, the impact of interpretations of or changes to tax law, and the timing of tax payments;*

Fortinet is a leader in cybersecurity and the convergence of networking and security.

Our mission is to secure people, devices and data everywhere.

Our integrated platform, the Fortinet Security Fabric, spans secure networking, unified SASE and AI-driven security operations to deliver cybersecurity where our customers need it.

As of December 31, 2023, over a half million customers trusted our solutions, including enterprises such as in the financial services, retail and operational technology market verticals, communication and security service providers, government organizations and small and medium-sized businesses.

As a global company headquartered in Sunnyvale, California with a large international customer base, the majority of our research and development is in the United States and Canada with a global footprint of support and centers of excellence around the world.

As of December 31, 2023, we held 957 U.S. patents and 1,299 global patents and we are recognized in over 80 enterprise analyst reports demonstrating both our vision and execution across networking and security products.

- Secure Networking—Our Secure Networking solutions focus on the convergence of networking and security via our network firewall and our switches, access points and other secure connectivity solutions.

FortiOS is our networking and security operating system that is consistent across our firewalls and secure connectivity solutions and supports over 30 functions that can be delivered via a physical, virtual, cloud or SaaS solution.

When delivered via our network firewall appliances, functionality is accelerated through our proprietary ASIC technology.

These proprietary ASICs, combined with off-the-shelf CPUs and ASICs, allow our systems to scale, run multiple applications at higher performance, lower power consumption and perform more processor-intensive operations, such as inspecting encrypted traffic, including streaming video.

The Network Firewall solution consists of FortiGate data centers, hyperscale and distributed firewalls, as well as encrypted applications (SSL inspection, Virtual Private Network and

IPsec connectivity).

Our ability to converge networking and security also enables the ethernet to become an extension of a company’s security infrastructure through FortiSwitch and FortiLink.

Our wireless LAN solution leverages secure networking to provide secure wireless access for the enterprise LAN edge.

FortiExtender secures 5G/LTE and remote ethernet extenders to connect and secure any branch environment.

The Secure Connectivity solution includes FortiSwitch Secure Ethernet Switches, FortiAP Wireless Local Area Network Access Points and FortiExtender 5G Connectivity Gateways, among other products.

- Unified Secure Access Service Edge (SASE)—As applications move to the cloud and work from anywhere becomes established, cloud delivery is needed to enable secure access to applications on any cloud.

The Fortinet Unified SASE solution is a single-vendor SASE solution that includes Firewall, SD-WAN, Secure Web Gateway, Cloud Access Services Broker, Data Loss Prevention, Zero Trust Network Access and cloud security, including Web Application Firewalls, Virtualized Firewalls and Cloud-Native Firewalls, among other products.

These functions are delivered through our FortiOS operating systems, which can deploy the full SASE stack through the cloud or on our ASIC-driven appliances.

All functions can be managed through a unified management console.

- Security Operations (SecOps)—Fortinet’s Security Operations solutions comply with the NIST cybersecurity framework of identify, protect, detect, respond and recover, and are delivered as a platform that automates detection and response to accelerate discovery and remediation.

The SecOps solution includes FortiAI generative AI assistant, FortiSIEM Security Information and Event Management, FortiSOAR Security Orchestration, Automation and Response, FortiEDR Endpoint Detection and Response, FortiXDR Extended Detection and Response, FortiMDR Managed Detection and Response Service, FortiNDR Network Detection and Response, FortiRecon Digital Risk Protection, FortiDeceptor Deception technology, FortiGuard SoCaaS, FortiSandbox Sandboxing Services and FortiGuard Incident Response Services, among other products.

FortiGuard Labs is our cybersecurity threat intelligence and research organization comprised of experienced threat hunters, researchers, analysts, engineers and data scientists who develop and utilize machine learning and AI technologies to provide timely protection updates and actionable threat intelligence for the benefit of our customers.

FortiGuard Security Services are a suite of AI-powered security capabilities that are natively integrated as part of the Fortinet Security Fabric to deliver coordinated detection and enforcement across the entire attack surface.

The portfolio consists of FortiGuard application security services, content security services, device security services, NOC/SOC security services and web security services.

FortiCare Technical Support Service is a per-device support service, which provides customers access to experts to ensure efficient and effective operations and maintenance of their Fortinet capabilities.

Global technical support is offered 24x7 with flexible add-ons, including enhanced SLAs and premium hardware replacement through in-country depots.

Organizations have the flexibility to procure different levels of service for different devices based on their availability needs.

We offer three per-device support options tailored to the needs of our enterprise customers: FortiCare Premium, FortiCare Elite and FortiCare Essential.

The FortiCare Elite service aims to provide 15-minute response times for key product families.

We also offer training services to our end-customers and channel partners through our training team and authorized training partners.

We have also implemented a training certification program, NSE, to help ensure an understanding of our products and services.

- *the duration and impact of the COVID-19 pandemic, including various COVID-19 variants and “return to office” plans;*

*•expectations regarding uncertain tax benefits and our effective domestic and global tax rates, and the impact of the Tax Cuts and Jobs Act of 2017 (“TCJA”), the Coronavirus Aid, Relief, and Economic Security Act of 2020 and the Inflation Reduction Act of 2022 (*“*IRA”);*

[Table o](#i90327120283244798f2956555b82bd30_7)[f](#i90327120283244798f2956555b82bd30_7) [Contents](#i90327120283244798f2956555b82bd30_7)

Fortinet is a global leader in cybersecurity solutions provided to a wide variety of organizations, including enterprises, communication service providers and security service providers, government organizations and small businesses.

Our cybersecurity solutions are designed to provide broad visibility and segmentation of the digital attack surface through our integrated cybersecurity platform products and services providing a mesh architecture, which feature automated protection, detection and response along with consolidated visibility across both Fortinet-developed solutions and a broad ecosystem of third-party solutions and technologies.

Our cybersecurity platform portfolio leverages a common operating system or integration to this operating system across our product offerings and helps organizations better secure their environments and reduce their security and network complexities.

The Fortinet operating system has an open architecture designed to integrate Fortinet solutions with third-party solutions in a single ecosystem, enabling automated detection and response across the attack surface.

Our product offerings consist of our Core Platform (previously referred to as FortiGate network security) and our Enhanced Platform Technologies (previously referred to as Platform Extension).

The Enhanced Platform includes Secure Networking (Secure Switching, Access Points, 5G and Network Access Control), Network and Security Operations (Management, Analytics, Security Information and Event Management, Security Operations, Orchestration and Response and Email Security), Endpoint Security (Enhanced Detection and Response and Identity) and Cloud Security (Web Application Firewall, Cloud Network Security and Cloud-native Application Protection).

Our cloud- and hosted- Enhanced Platform Technology products and services include sandboxing, endpoint detection and response (“EDR”), email security, web application and application programming interface (“API”) security, cloud networking security and cloud-native protection as well as management and analytics.

Our FortiGuard security subscription services are enabled by FortiGuard Labs, which provides threat research and artificial intelligence capabilities from a cloud network to deliver coordinated protection for the ever-expanding attack surface through Core Platform appliance and virtual machine as well as all Enhanced Platform Technology products that are registered by the end-customer.

Our FortiCare support services provide both technical support and professional services to help our customers deploy, maintain, and operationalize our Core Platform and Enhanced Platform Technology products and services.

Our proprietary Application-Specific Integrated Circuits (“ASIC”) are implemented in our physical Core Platform appliances and are designed to enhance the security processing capabilities implemented in software by accelerating computationally intensive tasks such as firewall policy enforcement, software-defined wide-area network (“SD-WAN”), network address translation, Intrusion Prevention Systems (“IPS”), threat detection and encryption.

We also provide Fortinet

virtualized Application-Specific Integrated Circuits (“vASICs”) across our Core Platform virtual appliances to deliver similar accelerated capabilities when run in virtualized environments.

Our FortiOS operating system provides the foundation for the operation of Core Platform and Enhanced Platform Technology products, whether physical, virtual, private- or public-cloud based.

FortiOS directs the operations of processors and ASICs and provides system management functions.

We make regular updates to FortiOS available through our FortiCare support services.

Networking functionality and security capabilities are integrated into the FortiOS operating system to run both the Core Platform and Enhanced Platform Technology capabilities of our cybersecurity mesh architecture (“Fortinet Security Fabric”).

This approach to security combines discrete security solutions together into an integrated operating system which provides centralized management, visibility, automation and intelligence sharing to simplify operations and respond rapidly to threats.

The focus areas of our business consist of:

- Secure Networking—Our Security-Driven Networking solutions enables the convergence of networking and security across all edges to provide next-generation firewall (“NGFW”), SD-WAN, LAN Edge (Wi-Fi and switch) and secure access service edge (“SASE”).

We derive a majority of product sales from our Core Platform network security appliances.

Core Platform network security appliances include a broad set of built-in security and networking features and functionalities, including firewall, next-generation firewall, secure web gateway, secure sockets layer (“SSL”) inspection, SD-WAN, Intrusion Prevention system (“IPS”), sandboxing, data leak prevention, virtual private network (“VPN”), switch and wireless controller and wide area network (“WAN”) edge.

Our network security appliances are managed by our FortiOS network operating system, which provides the foundation for Core Platform security functions.

We enhance the performance of our network security appliances from branch to data center by designing and implementing ASICs technology within our appliances, enabling us to add security and network functionality with minimal impact to network throughput performance.

Along with our secure Wi-Fi access points and switches, we help organizations secure their networks across campuses, branches and work from anywhere (“WFA”) deployments.

For the Japanese market, we also offer high performance network switches marketed under Alaxala for data center switching.

FortiOS supports many more secure networking markets and applications than just Firewall.

These include:

- Network Firewall (“NFW”)

- Software-Defined Wide Area Network (“SD-WAN”)

- Secure LAN/WLAN (Wi-Fi and Switch) (SD-Branch/Campus)

- Secure Access Service Edge (“SASE”)

- Universal Zero Trust Network Access (“ZTNA”)

- Encryption Applications (SSL Inspection, Virtual Private Network (“VPN”), and IPsec Connectivity)

Further each security application has number of customer use cases.

For example, Network Firewall has the following use cases:

- Data Center Perimeter NGFW

- North–South Internal Segmentation Firewall

[removed: To minimize this risk, we maintain our] portfolio of cash, cash equivalents, investments and marketable equity securities in a variety of securities, including commercial paper, corporate debt securities, U.S. government and agency securities, certificates of deposit and term deposits, money market [added: funds, municipal bonds and marketable equity securities.]

A 10% decrease in interest rates [added: would have resulted] in [removed: 2022, 2021] [added: a decrease of $12.0 million in our interest income in 2023,] and [removed: 2020] would have resulted in an insignificant decrease in our interest income in [removed: each of these periods.][added: 2022 and 2021]

However, a substantial portion of our operating expenses incurred outside the United States are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates, particularly changes in the Euro (“EUR”), the [removed: Japanese yen (“JPY”), the] Canadian dollar [removed: (“CAD”) and] [added: (“CAD”),] the British pound [removed: (“GBP”).][added: (“GBP”) and the Japanese yen (“JPY”).]

We recognized an expense of [removed: $4.6] [added: $7.0] million in [removed: 2022] [added: 2023] due to foreign currency transaction losses.

Long-term material changes in the value of the U.S. dollar against other foreign currencies, such as the EUR, [removed: JPY] [added: GBP] and [removed: GBP,] [added: JPY] could adversely impact our operating expenses in the future.

For foreign currency exchange rate risk, a 10% increase or decrease of foreign currency exchange rates against the U.S. dollar with all other variables held constant would have resulted in a [removed: $16.4] [added: $14.2] million change in the value of our foreign currency cash balances as of December 31, [removed: 2022.][added: 2023.]

To minimize this risk, we maintain our

[Table o](#i90327120283244798f2956555b82bd30_7)[f](#i90327120283244798f2956555b82bd30_7) [Contents](#i90327120283244798f2956555b82bd30_7)

funds, municipal bonds and marketable equity securities.

[removed: - Support and Professional Services—FortiCare] [added: FortiCare] Technical Support [removed: Service] [added: Service] is a per-device support service, which provides customers access to experts to ensure efficient and effective operations and maintenance of their Fortinet capabilities.

Global technical support is offered 24x7 with flexible add-ons, including enhanced [removed: service level agreements] [added: Service Level Agreements] (“SLAs”) and premium hardware replacement through [removed: in-country depots.][added: in-]

The [removed: newly launched] FortiCare Elite service [removed: provides] [added: aims to provide] 15-minute response times for key product families.

During [removed: our] [added: the] year ended December 31, [removed: 2022,] [added: 2023,] we generated total revenue of [removed: $4.42] [added: $5.30] billion and net income of [removed: $857.3 million.][added: $1.15 billion.]

See Part II, Item 8 of this Annual Report on Form 10-K for more information on our consolidated balance sheets as of December 31, [removed: 2022] [added: 2023] and [removed: 2021] [added: 2022] and our consolidated statements of income, comprehensive income, equity (deficit), and cash flows for each of the three years ended December 31, [removed: 2022, 2021] [added: 2023, 2022] and [removed: 2020.][added: 2021.]

Our principal executive office is located at [removed: 899] [added: 909] Kifer Road, Sunnyvale, California 94086 and our telephone number at that location is (408) 235-7700.

We [added: also] offer training services to our end-customers and channel partners through our training team and authorized training partners.

We have also implemented a training certification program, Network Security [removed: Expert,] [added: Expert (“NSE”),] to help ensure an understanding of our products and services.

Since 2020, Fortinet [added: has] also [removed: offers] [added: offered] a number of free online training courses to help address prevalent industry-wide cybersecurity skills gaps and shortages.

We [removed: typically] sell [removed: our security solutions] to distributors that sell to [removed: networking security focused] resellers and to service providers and [removed: MSSPs,] [added: managed security service providers (“MSSPs”),] who, in turn, sell products and/or services to end-customers.

Our end-customers are located in over 100 countries and include small, medium and large enterprises and government organizations across a wide range of industries, including [removed: education,] financial services, government, [removed: healthcare,] manufacturing, retail, [removed: technology] [added: technology, education, healthcare] and telecommunications.

Customers may also access our products via the cloud through certain cloud providers such as Amazon Web Services, [removed: Google Cloud, IBM Cloud,] Microsoft Azure and [removed: Oracle] [added: Google] Cloud.

[added: Refer to Note 16] Segment Information in Part II, Item 8 of this Annual Report on Form 10-K for distributor customers that accounted for 10% or more of our revenue or net accounts receivable.

To support our broadly dispersed global channel and end-customer base, we have sales professionals in over [removed: 90] [added: 100] countries around the world.

Our internal marketing organization is responsible for messaging, branding, demand generation, product marketing, channel marketing, partner incentives and promotions, event marketing, digital marketing, communications, analyst relations, public [removed: relations] [added: relations,] and sales enablement.

We focus our resources on campaigns, [removed: programs] [added: programs,] and activities that can be leveraged by partners worldwide to extend our marketing reach, such as sales tools and collateral, product awards and technical certifications, media engagement, training, regional seminars and conferences, [removed: webinars] [added: webinars,] and various other demand-generation activities.

Our current manufacturing partners include ADLINK Technology, Inc. (“ADLINK”), IBASE Technology, Inc. (“IBASE”), Micro-Star International Co. (“Micro-Star”), Senao Networks, Inc. (“Senao”), Wistron Corporation [removed: (“Wistron”)] [added: (“Wistron”),] and a number of other manufacturers.

Approximately [removed: 88%] [added: 95%] of our hardware is manufactured in Taiwan.

Some of the components important to our business, including certain CPUs from Intel Corporation (“Intel”) and Advanced Micro Devices, Inc. (“AMD”), network and wireless chips from Broadcom Inc. (“Broadcom”), Marvell Technology [added: Group Ltd. (“Marvell”), Qualcomm Incorporated (“Qualcomm”) and Intel and memory devices from Intel, Micron Technology (“Micron”), ADATA Technology Co., Ltd. (“ADATA”), Toshiba Corporation (“Toshiba”), Samsung Electronics Co., Ltd. (“Samsung”), and Western Digital Technologies, Inc. (“Western Digital”), are available from limited or sole sources of supply.]

We focus our research and development efforts on developing new hardware and software products and services, and adding new features to existing [removed: products] [added: products, services] and [removed: services.][added: operating systems.]

As of December 31, [removed: 2022,] [added: 2023,] we had [removed: 1,285] [added: 1,299] U.S. and foreign-issued patents and [removed: 255] [added: 252] pending U.S. and foreign patent applications.

[removed: In addition, the laws] of [removed: some foreign countries do not protect our proprietary rights to as great an extent as] the [removed: laws of the] United States, and many foreign countries do not enforce these laws as diligently as government agencies and private parties in the United States.

We are subject to regulation by various federal, state, regional, local and foreign governmental agencies, including agencies responsible for monitoring and enforcing employment and labor laws, workplace safety, [added: security,] product safety, product labeling, environmental laws, consumer protection laws, anti-bribery laws, data privacy laws, import and export controls, federal securities laws and tax laws and regulations.

- compliance with industry standards and [added: security and other] certifications;

Among others, our competitors include [removed: Arista Networks, Inc.(“Arista”),] Aruba Networks, [removed: Inc.(“Aruba”), Barracuda Networks,] Inc. [removed: (“Barracuda”),] [added: (“Aruba”),] Check Point Software Technologies Ltd. (“Check Point”), Cisco Systems, Inc. (“Cisco”), CrowdStrike Holdings, Inc. (“CrowdStrike”), F5 Networks, Inc. (“F5 Networks”), Huawei Technologies Co., Ltd. (“Huawei”), Juniper Networks, Inc. (“Juniper”), Palo Alto Networks, Inc. (“Palo Alto Networks”), SonicWALL, Inc. (“SonicWALL”), Sophos Group Plc (“Sophos”), [removed: Trend Micro Incorporated (“Trend Micro”),] VMware, Inc. (“VMware”) and Zscaler, Inc. (“Zscaler”).

Some of these larger competitors have substantially broader product offerings and leverage their relationships based on other products or incorporate [removed: functionality into existing products in a manner that discourages users from purchasing our products.]

As of December 31, [removed: 2022,] [added: 2023,] our total headcount was [removed: 12,595] [added: 13,568] employees, approximately 30% of whom were employed in the United States and approximately 70% of whom were employed outside of the United States.

As of December 31, [removed: 2022,] [added: 2023,] women represented 25% of the members of our board of directors, and approximately 50% of our board of directors was from underrepresented communities.

We are committed to responsible environmental, social and governance (“ESG”) [removed: practices.][added: practices and having a positive impact on the sustainability of our society and planet.]

[removed: This commitment starts] [added: Our approach to ESG is based on a strong corporate governance structure, starting] with the Social Responsibility Committee of our board of [removed: directors providing] [added: directors, which provides] oversight of our Corporate Social Responsibility (“CSR”) strategy, initiatives and execution related to ESG matters.

In addition, our [removed: Global Head of Sustainability and CSR,] [added: CSR team,] along with our internal cross-functional employee CSR Committee, engage with internal and external stakeholders to lead CSR execution, communications and disclosure.

[removed: We have engaged with a consultancy] [added: decarbonization path] to [removed: measure] [added: reach net zero for] our Scope 1 and Scope 2 emissions [added: by 2030,] and [removed: to further engage on our path to carbon neutrality in alignment with the Paris Agreement we] formally signed on to the Science-Based Target Initiative commitment in September 2022.

We continue to focus on skilling, upskilling and reskilling individuals [added: and are on track] to reach our goal of training one million people in cybersecurity by [removed: 2026.][added: 2026 with over 430,000 individuals trained as of the end of 2023.]

We continued to expand partnerships with educational institutions and now [removed: count] [added: have] over [removed: 500] [added: 650] Authorized Academic [removed: Partners.][added: Partners in 99 countries or territories across the world.]

Governance. Our approach to responsible business is based on strong corporate governance practices that aim to ensure accountability while meeting our responsibilities across our value [removed: chain.][added: chain, starting with our employees.]

[removed: To promote ethical business practices, we have adopted policies related to proper business conduct and ethics that] [added: Our Codes of Conduct] apply to employees, partners and suppliers, and we have compliance trainings and controls in place.

Fortinet is a leader in cybersecurity and the convergence of networking and security.

Our mission is to secure people, devices and data everywhere.

Our integrated platform, the Fortinet Security Fabric, spans secure networking, unified Secure Access Service Edge (“SASE”) and AI-driven security operations to deliver cybersecurity where our customers need it.

As of December 31, 2023, over a half million customers trusted our solutions, including enterprises such as in the financial services, retail and operational technology market verticals, communication and security service providers, government organizations and small and medium-sized businesses.

As a global company headquartered in Sunnyvale, California with a large international customer base, the majority of our research and development is in the United States and Canada with a global footprint of support and centers of excellence around the world.

As of December 31, 2023, we held 957 U.S. patents and 1,299 global patents and we are recognized in over 80 enterprise analyst reports demonstrating both our vision and execution across networking and security products.

- Secure Networking—Our Secure Networking solutions focus on the convergence of networking and security via our network firewall and our switches, access points and other secure connectivity solutions.

FortiOS is our networking and security operating system that is consistent across our firewalls and secure connectivity solutions and supports over 30 functions that can be delivered via a physical, virtual, cloud or Software as a Service (“SaaS”) solution.

When delivered via our network firewall appliances, functionality is accelerated through our proprietary Application-Specific Integrated Circuits (“ASIC”) technology.

These proprietary ASICs, combined with off-the-shelf central processing units (“CPUs”) and ASICs, allow our systems to scale, run multiple applications at higher performance, lower power consumption and perform more processor-intensive operations, such as inspecting encrypted traffic, including streaming video.

The Network Firewall solution consists of FortiGate data centers, hyperscale and distributed firewalls, as well as encrypted applications (secure sockets layer (“SSL”) inspection, Virtual Private Network and IPsec connectivity).

Our ability to converge networking and security also enables the ethernet to become an extension of a company’s security infrastructure through FortiSwitch and FortiLink.

Our wireless local area network (“LAN”) solution leverages secure networking to provide secure wireless access for the enterprise LAN edge.

FortiExtender secures 5G/LTE and remote ethernet extenders to connect and secure any branch environment.

The Secure Connectivity solution includes FortiSwitch Secure Ethernet Switches, FortiAP Wireless Local Area Network Access Points and FortiExtender 5G Connectivity Gateways, among other products.

- Unified Secure Access Service Edge (SASE)—As applications move to the cloud and work from anywhere becomes established, cloud delivery is needed to enable secure access to applications on any cloud.

The Fortinet Unified SASE solution is a single-vendor SASE solution that includes Firewall, SD-WAN, Secure Web Gateway, Cloud Access Services Broker, Data Loss Prevention, Zero Trust Network Access and cloud security, including Web Application Firewalls, Virtualized Firewalls and Cloud-Native Firewalls, among other products.

These functions are delivered through our FortiOS operating systems, which can deploy the full SASE stack through the cloud or on our ASIC-driven appliances.

All functions can be managed through a unified management console.

- Security Operations (SecOps)—Fortinet’s Security Operations solutions comply with the National Institute of Standards and Technology (“NIST”) cybersecurity framework of identify, protect, detect, respond and recover, and are delivered as a platform that automates detection and response to accelerate discovery and remediation.

The SecOps solution includes FortiAI generative AI assistant, FortiSIEM Security Information and Event Management, FortiSOAR Security Orchestration, Automation and Response, FortiEDR Endpoint Detection and Response, FortiXDR Extended Detection and Response, FortiMDR Managed Detection and Response Service, FortiNDR Network Detection and Response, FortiRecon Digital Risk Protection, FortiDeceptor Deception technology, FortiGuard SoCaaS, FortiSandbox Sandboxing Services and FortiGuard Incident Response Services, among other products.

FortiGuard Labs is our cybersecurity threat intelligence and research organization comprised of experienced threat hunters, researchers, analysts, engineers and data scientists who develop and utilize machine learning and AI technologies to provide timely protection updates and actionable threat intelligence for the benefit of our customers.

FortiGuard Security Services are a suite of AI-powered security capabilities that are natively integrated as part of the Fortinet Security Fabric to deliver coordinated detection and enforcement across the entire attack surface.

The portfolio consists of FortiGuard application security services, content security services, device security services, NOC/SOC security services and web security services.

country depots.

Industry Background: The Trends Driving the Need for a Platform Approach

Modern networks are increasingly complex, spanning many edges as well as a mix of cloud and on-premises deployments.

Fortinet was founded with the mission of providing a converged networking and security approach that empowers organizations to adopt new technologies without worrying about how it would impact their ability to manage and secure their environments.

The escalating threat landscape has resulted in a significant increase in the demand for secure networking solutions.

In fact, we believe the demand for secure networking will overtake the pure networking market by 2030.

At the same time, businesses contend with an escalating threat landscape, a cybersecurity skills shortage, and siloed security tools that do not work well together.

They need to consolidate point products to gain better visibility and faster threat response times.

A platform approach–what we call the Fortinet Security Fabric–has emerged to address these challenges and support enterprises in reducing complexity and improving risk mitigation.

The concept of an integrated cybersecurity platform that converges networking and security and consolidates point products is what guides how we design our products and advise our customers and partners.

An end-customer deployment may involve as few as one or as many as dozens of different types of integrated products and services from across our broad portfolio that spans secure networking, unified SASE, and security operations.

In addition, we provide our cloud-based subscription offerings through Fortinet-owned data centers, as well as data centers operated under co-location arrangements globally, and via public cloud providers.

In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as the laws

functionality into existing products in a manner that discourages users from purchasing our products.

Fortinet is a member of the Dow Jones Sustainability Indices — World and North America, for the second consecutive year.

We are engaged on a

Fortinet is a global leader in cybersecurity and networking solutions for organizations, including enterprises, communication service providers, security service providers, government organizations and small businesses.

The focus areas of our business consist of:

- Secure Networking—Our Secure Networking solutions enable the convergence of networking and security across all edges to provide next-generation firewall (“NGFW”), software-defined wide area network (“SD-WAN”), LAN Edge (Wi-Fi and switch) and secure access service edge (“SASE”).

Traditional networking lacks awareness of content, applications, users, devices, location and more.

A secure networking approach converges networking and security into a single, accelerated solution.

A specially designed operating system and security processors work in concert to improve network performance and security posture while decreasing footprint and power consumption.

We derive a majority of product sales from our Core Platform (previously referred to as FortiGate) network security appliances.

Core Platform network security appliances include a broad set of built-in security and networking features and functionalities, including firewall, next-generation firewall, secure web gateway, secure sockets layer (“SSL”) inspection, SD-WAN, intrusion prevention system (“IPS”), sandboxing, data leak prevention, virtual private network (“VPN”), switch and wireless controller and wide area network (“WAN”) edge.

Our network security appliances are managed by our FortiOS network operating system, which provides the foundation for Core Platform security functions.

We enhance the performance of our network security appliances from branch to data center by designing and implementing Application-Specific Integrated Circuits (“ASIC”) technology within our appliances, enabling us to add security and network functionality with minimal impact to network throughput performance.

Along with our secure Wi-Fi access points and switches, Fortinet helps organizations secure their networks across campuses, branches and work from anywhere (“WFA”) deployments.

For the Japanese market, we also offer high performance network switches marketed under Alaxala Networks Corporation for data center switching.

FortiOS supports many more secure networking markets and applications than just firewall.

These include:

- Network Firewall (“NFW”)

- Software-Defined Wide Area Network (“SD-WAN”)

- Secure LAN/WLAN (Wi-Fi and Switch) (SD-Branch/Campus)

- Secure Access Service Edge (“SASE”)

- Universal Zero Trust Network Access (“ZTNA”)

- Encryption Applications (SSL Inspection, Virtual Private Network (“VPN”), and IPsec Connectivity)

Further each security application has number of customer use cases.

For example, Network Firewall has the following use cases:

- Data Center Perimeter NGFW

- North–South Internal Segmentation Firewall

- Distributed Network Edge Firewall

- East–West Micro Segmentation Firewall

- Virtual Firewall (“VM”)

- Cloud Native Firewall (“CNF”)

- Firewall as a Service (“FWaaS”)

- Containerized Firewall

- Endpoint Firewall

- SMB Firewall

- Home Firewall

- Zero Trust Access—Our Zero Trust Access solutions enable customers to know and control who and what is on their network, in addition to providing security for WFA.

Zero Trust Access solutions include FortiNAC,

[Table o](#i90327120283244798f2956555b82bd30_7)[f](#i90327120283244798f2956555b82bd30_7) [Contents](#i90327120283244798f2956555b82bd30_7)

FortiAuthenticator, FortiClient/EDR and FortiToken.

Our network access control solutions provide visibility, control and automated event responses in order to secure internet of things (“IoT”) and OT devices.

- Cloud Security—We help customers connect securely to and across their individual, hybrid-cloud, multi-cloud and virtualized data center environments by offering security through our virtual firewall and other software products and through integrated capabilities with major cloud platforms.

Our public and private cloud security solutions, including virtual appliances and hosted solutions, extend the core capabilities of Fortinet’s cybersecurity mesh architecture (“Fortinet Security Fabric”) in and across cloud environments, delivering security that follows their applications and data.

Refer to Note 12.

Commitments and Contingencies in Part II, Item 8 of this Annual Report on Form 10-K for additional information.

For the year ended December 31, [removed: 2022][added: 2023]

[removed: 899] [added: 909] Kifer Road

The aggregate market value of voting stock held by non-affiliates of the registrant, as of June 30, [removed: 2022,] [added: 2023,] the last business day of the registrant’s most recently completed second quarter, was [removed: $25,621,924,666] [added: $38,472,948,871] (based on the closing price for shares of the registrant’s common stock as reported by The Nasdaq Global Select Market on that date).

As of February [removed: 17, 2023,] [added: 22, 2024,] there were [removed: 784,066,289] [added: 763,030,948] shares of the registrant’s common stock outstanding.

Portions of the registrant’s definitive Proxy Statement relating to its [removed: 2023] [added: 2024] Annual Meeting of Stockholders (“Proxy Statement”) are incorporated by reference into Part III of this Annual Report on Form 10-K where indicated.

| | | | [Risk Factor [removed: Summary](#i90327120283244798f2956555b82bd30_10)] [added: Summary](#i980f0e0da2e545ad8a4174683b30b0d6_10)] | | | [removed: [1](#i90327120283244798f2956555b82bd30_10)] [added: [1](#i980f0e0da2e545ad8a4174683b30b0d6_10)] | | |

| Item 1. | | | [removed: [Business](#i90327120283244798f2956555b82bd30_16)] [added: [Business](#i980f0e0da2e545ad8a4174683b30b0d6_16)] | | | [removed: [3](#i90327120283244798f2956555b82bd30_16)] [added: [3](#i980f0e0da2e545ad8a4174683b30b0d6_16)] | | |

| Item 1A. | | | [Risk [removed: Factors](#i90327120283244798f2956555b82bd30_19)] [added: Factors](#i980f0e0da2e545ad8a4174683b30b0d6_19)] | | | [removed: [13](#i90327120283244798f2956555b82bd30_19)] [added: [8](#i980f0e0da2e545ad8a4174683b30b0d6_19)] | | |

| Item 1B. | | | [Unresolved Staff [removed: Comments](#i90327120283244798f2956555b82bd30_22)] [added: Comments](#i980f0e0da2e545ad8a4174683b30b0d6_22)] | | | [removed: [48](#i90327120283244798f2956555b82bd30_22)] [added: [43](#i980f0e0da2e545ad8a4174683b30b0d6_22)] | | |

| Item 2. | | | [removed: [Properties](#i90327120283244798f2956555b82bd30_25)] [added: [Properties](#i980f0e0da2e545ad8a4174683b30b0d6_25)] | | | [removed: [48](#i90327120283244798f2956555b82bd30_25)] [added: [45](#i980f0e0da2e545ad8a4174683b30b0d6_25)] | | |

| Item 3. | | | [Legal [removed: Proceedings](#i90327120283244798f2956555b82bd30_28)] [added: Proceedings](#i980f0e0da2e545ad8a4174683b30b0d6_28)] | | | [removed: [48](#i90327120283244798f2956555b82bd30_28)] [added: [46](#i980f0e0da2e545ad8a4174683b30b0d6_28)] | | |

| Item 4. | | | [Mine Safety [removed: Disclosures](#i90327120283244798f2956555b82bd30_31)] [added: Disclosures](#i980f0e0da2e545ad8a4174683b30b0d6_31)] | | | [removed: [48](#i90327120283244798f2956555b82bd30_31)] [added: [46](#i980f0e0da2e545ad8a4174683b30b0d6_31)] | | |

| Item 5. | | | [Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity [removed: Securities](#i90327120283244798f2956555b82bd30_37)] [added: Securities](#i980f0e0da2e545ad8a4174683b30b0d6_37)] | | | [removed: [48](#i90327120283244798f2956555b82bd30_37)] [added: [46](#i980f0e0da2e545ad8a4174683b30b0d6_37)] | | |

| Item 6. | | | [removed: [\[Reserved\]](#i90327120283244798f2956555b82bd30_40)] [added: [\[Reserved\]](#i980f0e0da2e545ad8a4174683b30b0d6_43)] | | | [removed: [50](#i90327120283244798f2956555b82bd30_40)] [added: [48](#i980f0e0da2e545ad8a4174683b30b0d6_43)] | | |

| Item 7. | | | [Management’s Discussion and Analysis of Financial Condition and Results of [removed: Operations](#i90327120283244798f2956555b82bd30_43)] [added: Operations](#i980f0e0da2e545ad8a4174683b30b0d6_46)] | | | [removed: [51](#i90327120283244798f2956555b82bd30_43)] [added: [49](#i980f0e0da2e545ad8a4174683b30b0d6_46)] | | |

| Item 7A. | | | [Quantitative and Qualitative Disclosures about Market [removed: Risk](#i90327120283244798f2956555b82bd30_55)] [added: Risk](#i980f0e0da2e545ad8a4174683b30b0d6_58)] | | | [removed: [71](#i90327120283244798f2956555b82bd30_55)] [added: [66](#i980f0e0da2e545ad8a4174683b30b0d6_58)] | | |

| Item 8. | | | [Financial Statements and Supplementary [removed: Data](#i90327120283244798f2956555b82bd30_58)] [added: Data](#i980f0e0da2e545ad8a4174683b30b0d6_61)] | | | [removed: [73](#i90327120283244798f2956555b82bd30_58)] [added: [68](#i980f0e0da2e545ad8a4174683b30b0d6_61)] | | |

| Item 9. | | | [Changes in and [removed: Disagreements](#i90327120283244798f2956555b82bd30_148) [w](#i90327120283244798f2956555b82bd30_148)[ith] [added: Disagreements with] Accountants on Accounting and Financial [removed: Disclosure](#i90327120283244798f2956555b82bd30_148)] [added: Disclosure](#i980f0e0da2e545ad8a4174683b30b0d6_154)] | | | [removed: [112](#i90327120283244798f2956555b82bd30_148)] [added: [107](#i980f0e0da2e545ad8a4174683b30b0d6_154)] | | |

| Item 9A. | | | [Controls and [removed: Procedures](#i90327120283244798f2956555b82bd30_151)] [added: Procedures](#i980f0e0da2e545ad8a4174683b30b0d6_157)] | | | [removed: [112](#i90327120283244798f2956555b82bd30_151)] [added: [107](#i980f0e0da2e545ad8a4174683b30b0d6_157)] | | |

| Item 9B. | | | [Other [removed: Information](#i90327120283244798f2956555b82bd30_154)] [added: Information](#i980f0e0da2e545ad8a4174683b30b0d6_160)] | | | [removed: [114](#i90327120283244798f2956555b82bd30_154)] [added: [109](#i980f0e0da2e545ad8a4174683b30b0d6_160)] | | |

| Item 9C. | | | [Disclosure Regarding Foreign Jurisdictions that Prevents [removed: Inspections](#i90327120283244798f2956555b82bd30_160)] [added: Inspections](#i980f0e0da2e545ad8a4174683b30b0d6_163)] | | | [removed: [114](#i90327120283244798f2956555b82bd30_160)] [added: [109](#i980f0e0da2e545ad8a4174683b30b0d6_163)] | | |

| Item 10. | | | [Directors, Executive Officers and Corporate [removed: Governance](#i90327120283244798f2956555b82bd30_166)] [added: Governance](#i980f0e0da2e545ad8a4174683b30b0d6_169)] | | | [removed: [114](#i90327120283244798f2956555b82bd30_166)] [added: [109](#i980f0e0da2e545ad8a4174683b30b0d6_169)] | | |

| Item 11. | | | [Executive [removed: Compensation](#i90327120283244798f2956555b82bd30_169)] [added: Compensation](#i980f0e0da2e545ad8a4174683b30b0d6_172)] | | | [removed: [114](#i90327120283244798f2956555b82bd30_169)] [added: [109](#i980f0e0da2e545ad8a4174683b30b0d6_172)] | | |

| Item 12. | | | [Security Ownership of Certain Beneficial Owners and Management and Related Stockholder [removed: Matters](#i90327120283244798f2956555b82bd30_172)] [added: Matters](#i980f0e0da2e545ad8a4174683b30b0d6_175)] | | | [removed: [114](#i90327120283244798f2956555b82bd30_172)] [added: [109](#i980f0e0da2e545ad8a4174683b30b0d6_175)] | | |

| Item 13. | | | [Certain Relationships and Related Transactions, and Director [removed: Independence](#i90327120283244798f2956555b82bd30_175)] [added: Independence](#i980f0e0da2e545ad8a4174683b30b0d6_178)] | | | [removed: [114](#i90327120283244798f2956555b82bd30_175)] [added: [110](#i980f0e0da2e545ad8a4174683b30b0d6_178)] | | |

| Item 14. | | | [Principal Accounting Fees and [removed: Services](#i90327120283244798f2956555b82bd30_178)] [added: Services](#i980f0e0da2e545ad8a4174683b30b0d6_181)] | | | [removed: [114](#i90327120283244798f2956555b82bd30_178)] [added: [110](#i980f0e0da2e545ad8a4174683b30b0d6_181)] | | |

| Item 15. | | | [Exhibits and Financial Statement [removed: Schedules](#i90327120283244798f2956555b82bd30_184)] [added: Schedules](#i980f0e0da2e545ad8a4174683b30b0d6_187)] | | | [removed: [115](#i90327120283244798f2956555b82bd30_184)] [added: [111](#i980f0e0da2e545ad8a4174683b30b0d6_187)] | | |

| Item 16. | | | [Form 10-K [removed: Summary](#i90327120283244798f2956555b82bd30_196)] [added: Summary](#i980f0e0da2e545ad8a4174683b30b0d6_199)] | | | [removed: [118](#i90327120283244798f2956555b82bd30_196)] [added: [114](#i980f0e0da2e545ad8a4174683b30b0d6_199)] | | |

- Adverse economic conditions, such as a possible economic downturn or recession, and possible impacts of inflation or stagflation, [removed: rising] [added: increasing or decreasing] interest [removed: rates] [added: rates, instability in the global banking system] or reduced information technology [removed: spending] [added: spending, including firewall spending,] may adversely impact our business.

- We [removed: are] [added: have been, and may in the future be,] susceptible to supply chain constraints, supply shortages and disruptions, long [added: or less predictable] lead times for components and finished goods and supply changes because some of the key components in our products come from limited sources of supply.

- Our billings, revenue, and free cash flow growth may slow [added: further] or may not continue, and our operating margins may decline.

- We are dependent on the continued services and performance of our senior management, as well as our ability to hire, retain and motivate qualified [removed: personnel, particularly for our sales organization.][added: personnel.]

- We rely on third-party channel partners for substantially all of our [added: billings,] revenue and a small number of distributors represents a large percentage of our revenue and accounts receivable.

- Reliance on a concentration of shipments at the end of the quarter could cause our billings and revenue to fall below expected [removed: levels or delay collections and the related addition to free cash flow.][added: levels.]

- We generate a majority of [added: billings,] revenue and cash flow from sales outside of the United States.

- A portion of our revenue is generated by sales to government organizations and [added: other] customers, which are subject to a number of regulatory requirements, challenges and risks.

- We depend on [removed: third-party manufacturers] [added: third parties] to provide various components for our products and build our products and are susceptible to manufacturing delays, capacity constraints and cost increases.

- We are susceptible to defects or vulnerabilities in our products or services, as well as reputational harm from the failure or misuse of our products or services, and any actual or perceived defects or vulnerabilities in our products or services or the failure of our products or services to detect or prevent a security [removed: breach] [added: incident, or the failure to help secure our customers or cause our products or services to allow unauthorized access to our customers network,] could harm our operational results and reputation more significantly as compared to certain other companies given we are a security company.

In addition, any [removed: potential] [added: additional] future impairment of the value of our investment in Linksys Holdings, Inc. (“Linksys”) could negatively affect our financial condition and results of operations.

- Global economic uncertainty and weakening product demand caused by political instability, changes in trade agreements, wars and foreign conflicts, such as the war in Ukraine [added: and the Israel-Hamas war] or tensions between China and Taiwan, could adversely affect our business and financial performance.

For the Year Ended December 31, 2023

| Item 1C. | | | [C](#i980f0e0da2e545ad8a4174683b30b0d6_549755815465)[ybersecurity](#i980f0e0da2e545ad8a4174683b30b0d6_549755815465) | | | [43](#i980f0e0da2e545ad8a4174683b30b0d6_549755815465) | | |

| | | | [Exhibit Index](#i980f0e0da2e545ad8a4174683b30b0d6_196) | | | [112](#i980f0e0da2e545ad8a4174683b30b0d6_196) | | |

| | | | [Signatures](#i980f0e0da2e545ad8a4174683b30b0d6_202) | | | [115](#i980f0e0da2e545ad8a4174683b30b0d6_202) | | |

- As a result of supply chain disruptions in previous periods, we increased our purchase order commitments in previous periods and, as a result, may be required to accept or pay for components and finished goods regardless of our level of sales in a particular period, which may negatively impact our operating results and financial condition.

- Our real estate investments, including construction, acquisitions, sales, or strategy changes, and ongoing maintenance and management of office buildings, warehouses, data centers and points of presence, as well as data center expansions or enhancements, could involve significant risks to our business.

- Our backlog has fluctuated over past quarters and any decrease in growth or negative growth of in-quarter billings and revenue may not be reflected by our aggregate billings and revenue.

As we have fulfilled, shipped and billed during a quarter to satisfy backlog, this has increased our aggregate billings and revenue during any particular quarter, and as the supply chain challenges normalize, the growth comparisons versus prior quarters where backlog contributed more to billings have become more challenging.

- Any weakness in sales strategy, productivity and execution could negatively impact our results of operations.

- We order components from third-party manufacturers based on our forecasts of future demand and targeted inventory levels, which exposes us to the risk of both product shortages, may result in lost sales and higher expenses, including excess inventory charges and costs related to future purchase commitments, and may require us to sell our products at discounts or offer various other incentives.

| | | | [Exhibit Index](#i90327120283244798f2956555b82bd30_193) | | | [116](#i90327120283244798f2956555b82bd30_193) | | |

| | | | [Signatures](#i90327120283244798f2956555b82bd30_199) | | | [119](#i90327120283244798f2956555b82bd30_199) | | |

- The effects of the COVID-19 pandemic, including its ongoing variants, will likely continue to adversely affect our business, for example, through product and component shortages, longer product lead times, changes in customer buying-behavior, including delays in service contract registrations, accelerating or delaying purchases, changes in the mix of backlog and the related margins.

- The war in Ukraine, its related macroeconomic effects and our decision to reduce operations in Russia have affected and may continue to affect our business.

- Insufficient inventory or components, including finished goods, chips and other components, and including component or inventory shortages related to the COVID-19 pandemic, manufacturer’s capacity, shipping challenges, delays in timing of receipts of inventory, or other factors affecting the global supply chain, may result in lost sales opportunities or delayed billings and revenue and increased costs, and may harm our gross margins and our product price increases designed to help mitigate lower gross margins may not be acceptable to customers.

[Table o](#i90327120283244798f2956555b82bd30_7)[f](#i90327120283244798f2956555b82bd30_7) [Contents](#i90327120283244798f2956555b82bd30_7)

Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, end users, business partners, stockholders and employees.

Our board of directors is actively involved in oversight of our risk management program, and information and product security represent an important component of our overall approach to enterprise risk management (“ERM”).

Our risks from cybersecurity threats are considered in conjunction with other risks in our ERM program.

In addition, we leverage a cybersecurity-specific risk assessment process and strategy based on the NIST Cybersecurity Framework to manage risks to organizational operations and assets, individuals and other organizations associated with the operation and use of systems.

Risk assessments are periodically conducted to identify threats and vulnerabilities, and then used to determine the likelihood and impact for each risk using a qualitative risk assessment methodology.

In general, we seek to address cybersecurity risks through a broad, cross-functional approach that is focused on

preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

Governance

The Audit Committee of our board of directors (the “Audit Committee”) is responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events.

Our executives with responsibility over cybersecurity provide quarterly reports to the Audit Committee as well as to the Chief Executive Officer and other members of our senior management as appropriate.

These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape.

Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee.

We also actively engage with key vendors, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

The Audit Committee also receives prompt and timely information regarding any cybersecurity threat or incident that meets established reporting thresholds, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved or otherwise addressed.

We believe our systems and processes with respect to the management of risks associated with cybersecurity threats are adequate.

We have experienced, and may in the future experience, adverse impacts to our operations as a result of cybersecurity incidents.

However, to date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition.

If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results or financial condition.

For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see our risk factors, including our risk factor titled *“If our internal enterprise IT networks, on which we conduct internal business and interface externally, our operational networks, through which we connect to customers, vendors and partners systems and provide services, or our research and development networks, our back-end labs and cloud stacks hosted in our data centers, colocation vendors or public cloud providers, through which we research, develop and host products and services, are compromised, public perception of our products and services may be harmed, our customers may be breached and harmed, we may become subject to liability, and our business, operating results and stock price may be adversely impacted.”*

Risk Management and Strategy

As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas:

Governance: As discussed in more detail above under the heading, “Governance,” our board of directors’ oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with executives with responsibility for cybersecurity, our Chief Executive Officer, Chief Technology Officer and President, Chief Financial Officer, Chief Operating Officer/General Counsel and other members of management.

Management is promptly updated regarding any significant security events and the Audit Committee regularly reviews updates from our information security and product security leaders about cyber threat response preparedness, security controls and procedures, security program maturity milestones, risk and approaches to risk mitigation and the current and emerging threat landscape.

In addition, all members of our board of directors receive management’s cybersecurity updates to the Audit Committee as part of their regular attendance at meetings of our board of directors.

Collaborative Approach: We have implemented a broad, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

In addition, we manage a cross-functional program across our engineering, manufacturing and technical services teams, together with our suppliers and channel partners, designed to ensure the proper security of our products from design through manufacture and shipment.

Information Security: We implement organizational, administrative and technical measures based on commercially reasonable procedures using: (i) industry standard information security measures prescribed for use by NIST; (ii) security measures aligned with the ISO/IEC 27000 series of standards, (iii) Sarbanes-Oxley and SSAE 18/ISAE 3402; (iv) privacy regulations such as the GDPR and the CCPA; (v) business continuity management measures aligned with the ISO/IEC 22301 standard; and (vi) other generally recognized industry standards, in each case, designed to safeguard the confidentiality, integrity, and availability of our infrastructure and data and the resiliency of our operations.

Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

Incident Response and Recovery Planning: We have established and maintains broad incident response and recovery plans that help enable its effective and orderly management of, and response to, any identified security incidents, including escalation and internal and external-notification steps, allowing the incident response team to respond in a timely manner and enlist appropriate personnel and third-party experts.

We maintain a process to promptly assess and assign severity levels to any identified security incidents in order to prioritize their importance and promptly direct resources to those issues of potentially greater impact.

The notification plan establishes steps to alert external stakeholders as appropriate, including law enforcement, regulatory bodies, investors, customers and other business partners.

Third-Party Risk Management: We maintain a broad, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

In addition, our Trusted Supplier Program is designed to ensure manufacturing partners undergo a selection and qualification process that adheres to NIST 800-161.

Education and Awareness: We provide regular, mandatory training for personnel and contractors regarding cybersecurity threats as a means to equip Fortinet personnel with effective tools to address cybersecurity threats and to communicate Fortinet’s evolving information security policies, standards, processes and practices.

Risk and Readiness Assessments: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to identify vulnerabilities and weaknesses, address cybersecurity threats and test its readiness to respond to cyber security incidents.

These efforts include a wide range of activities, including threat modeling, a variety of vulnerability and configuration scans, penetration testing, audits, tabletop exercises and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.

We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness and penetration tests.

The results of such assessments, audits and reviews are reported to the Audit Committee and our board of directors and to our management, and we adjust its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

Insurance: We maintain information security risk insurance coverage.

Our corporate headquarters is located in Sunnyvale, California and comprises approximately 395,000 square feet of building space on [removed: 20] [added: 21] acres of land.

We also own additional building space in Sunnyvale and Union City, California, [added: and Sydney, Australia,] for future development of approximately [removed: 470,000] [added: 450,000] square [removed: feet.][added: feet in the aggregate.]

[removed: We believe that our existing properties] are sufficient and suitable to meet our current needs.

We intend to expand our [removed: facilities] [added: facilities, develop unoccupied space,] or add new facilities to support our future growth and enter new [added: product] markets, and we believe that suitable additional or alternative space will be available or can be developed as needed to accommodate ongoing operations and any such growth.

Refer to Note 17, Subsequent Events, in Part II, Item 8 of this Annual Report on Form 10-K for the January 2024 purchase of an additional 480,000 square feet in Santa Clara, CA which is located in close proximity to corporate headquarters.

Along with our corporate headquarters, as of December 31, 2023, we operated the following facilities:

| | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| Location | | | | | | Owned Square Footage | | | | | | Description of Use | | |

| Burnaby and Ottawa, Canada | | | | | | 560,000 | | | | | | Datacenter operations, support functions and research and development | | |

| Union City, California | | | | | | 350,000 | | | | | | Manufacturing assembly and operations | | |

| Plano & Frisco, Texas | | | | | | 130,000 | | | | | | Office space and datacenter operations | | |

| Torija, Spain | | | | | | 120,000 | | | | | | Future development of datacenter operations | | |

| Chicago, Illinois | | | | | | 100,000 | | | | | | Office space and retail | | |

| Sunrise, Florida | | | | | | 100,000 | | | | | | Office space | | |

| Valbonne, France | | | | | | 70,000 | | | | | | Sales and support functions | | |

We believe that our existing properties

Along with our corporate headquarters, as of December 31, 2022, we own approximately 290,000 square feet in Union City, California, used for manufacturing assembly and operations; approximately 560,000 square feet of office space in Burnaby and Ottawa, Canada, used for operations, support and research and development work; approximately 100,000 square feet of office space in Chicago; approximately 100,000 square feet of office space in Florida; approximately 90,000 square feet of office space in Texas; and approximately 70,000 square feet of office space in Valbonne, France, predominantly used for sales and support.

As of February [removed: 17, 2023,] [added: 22, 2024,] there were [removed: 43] [added: 45] holders of record of our common stock.

Information responsive to this item is incorporated herein by reference to our definitive proxy statement with respect to our [removed: 2023] [added: 2024] Annual Meeting of Stockholders to be filed with the Securities and Exchange Commission (the “SEC”) within 120 days after the end of the fiscal year covered by this Annual Report on Form 10-K.

[removed: ][added: ]

| | | | | | | December [removed: 2017] [added: 2018] * | | | | | | December [removed: 2018] [added: 2019] | | | | | | December [removed: 2019] [added: 2020] | | | | | | December [removed: 2020] [added: 2021] | | | | | | December [removed: 2021] [added: 2022] | | | | | | December [removed: 2022] [added: 2023] | | |

| * Assumes that $100 was invested on December 31, [removed: 2017] [added: 2018] in stock or index, including reinvestment of dividends. Stockholder returns over the indicated period should not be considered indicative of future stockholder returns. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

From 2016 through [removed: 2021,] [added: 2022,] our board of directors approved increases to our Repurchase Program by various amounts and extended the term to February 28, [removed: 2023, bringing the aggregated amount authorized to $4.25 billion.][added: 2023.]

In [added: April 2023 and] July [removed: 2022,] [added: 2023,] our board of directors approved [removed: a] $1.0 billion [removed: increase,] [added: and $500.0 million increases in the authorized stock repurchase amount under the Repurchase Program, respectively,] bringing the aggregate amount authorized to be repurchased to [removed: $5.25] [added: $6.75] billion.

Since its inception, we have repurchased [removed: 211.4] [added: 238.6] million shares of our common stock under the Repurchase Program for an aggregate purchase price of [removed: $4.72] [added: $6.22] billion.

| Fortinet, Inc. | | | | | | $ | 100 | | | | | $ | 152 | | | | | $ | 211 | | | | | $ | 510 | | | | | $ | 347 | | | | | $ | 416 | |

| S&P 500 Index | | | | | | $ | 100 | | | | | $ | 129 | | | | | $ | 150 | | | | | $ | 190 | | | | | $ | 153 | | | | | $ | 190 | |

| NASDAQ Computer | | | | | | $ | 100 | | | | | $ | 150 | | | | | $ | 225 | | | | | $ | 311 | | | | | $ | 200 | | | | | $ | 332 | |

The following table provides information with respect to the shares of common stock we repurchased under the Repurchase Program during the three months ended December 31, 2023 (in millions, except average price paid per share amounts):

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| Period | | | | | | Total Number of Shares Purchased | | | | | | Average Price Paid per Share | | | | | | Total Number of Shares Purchased as Part of Publicly Announced Plan or Program | | | | | | Approximate Dollar Value of Shares that May Yet Be Purchased Under the Plans or Programs | | |

| October 1 - October 31, 2023 | | | | | | 7.7 | | | | | | $ | 57.43 | | | | | 7.7 | | | | | | $ | 980.0 | |

| November 1 - November 30, 2023 | | | | | | 9.1 | | | | | | $ | 49.75 | | | | | 9.1 | | | | | | $ | 529.1 | |

| December 1 - December 31, 2023 | | | | | | — | | | | | | $ | — | | | | | — | | | | | | $ | 529.1 | |

| Total | | | | | | 16.8 | | | | | | $ | 53.29 | | | | | 16.8 | | | | | | | | |

In January 2024, our board of directors approved a $500.0 million increase in the authorized stock repurchase amount under the Repurchase Program, bringing the aggregate amount authorized to be repurchased to $7.25 billion of our outstanding common stock.

As of February 23, 2024, approximately $1.03 billion remained available for future share repurchases.

In February 2024, our board of directors approved an extension of the Repurchase Program to February 28, 2025.

[Table o](#i90327120283244798f2956555b82bd30_7)[f](#i90327120283244798f2956555b82bd30_7) [Contents](#i90327120283244798f2956555b82bd30_7)

| Fortinet, Inc. | | | | | | $ | 100 | | | | | $ | 161 | | | | | $ | 244 | | | | | $ | 340 | | | | | $ | 823 | | | | | $ | 560 | |

| S&P 500 Index | | | | | | $ | 100 | | | | | $ | 94 | | | | | $ | 121 | | | | | $ | 140 | | | | | $ | 178 | | | | | $ | 144 | |

| NASDAQ Computer | | | | | | $ | 100 | | | | | $ | 96 | | | | | $ | 145 | | | | | $ | 217 | | | | | $ | 299 | | | | | $ | 192 | |

There were no repurchases of common stock during the three months ended December 31, 2022.

As of December 31, 2022, $529.6 million remained available for future share repurchases under the Repurchase Program.

[Table o](#i90327120283244798f2956555b82bd30_7)[f](#i90327120283244798f2956555b82bd30_7) [Contents](#i90327120283244798f2956555b82bd30_7)

| [Report of Independent Registered Public Accounting [removed: Firm](#i90327120283244798f2956555b82bd30_61)] [added: Firm](#i980f0e0da2e545ad8a4174683b30b0d6_64)] (PCAOB ID No.34) | | | [removed: [74](#i90327120283244798f2956555b82bd30_61)] [added: [69](#i980f0e0da2e545ad8a4174683b30b0d6_64)] | | |

| [Consolidated Balance Sheets as of December 31, [removed: 202](#i90327120283244798f2956555b82bd30_64)[2](#i90327120283244798f2956555b82bd30_64) [and](#i90327120283244798f2956555b82bd30_64) [2021](#i90327120283244798f2956555b82bd30_64)] [added: 202](#i980f0e0da2e545ad8a4174683b30b0d6_67)[3](#i980f0e0da2e545ad8a4174683b30b0d6_67) [and 202](#i980f0e0da2e545ad8a4174683b30b0d6_67)[2](#i980f0e0da2e545ad8a4174683b30b0d6_67)] | | | [removed: [77](#i90327120283244798f2956555b82bd30_64)] [added: [71](#i980f0e0da2e545ad8a4174683b30b0d6_67)] | | |

| [Consolidated Statements of Income for the [removed: year ended] [added: year](#i980f0e0da2e545ad8a4174683b30b0d6_70)[s](#i980f0e0da2e545ad8a4174683b30b0d6_70) [ended] December 31, [removed: 202](#i90327120283244798f2956555b82bd30_67)[2](#i90327120283244798f2956555b82bd30_67)[, 202](#i90327120283244798f2956555b82bd30_67)[1](#i90327120283244798f2956555b82bd30_67) [and](#i90327120283244798f2956555b82bd30_67) [2020](#i90327120283244798f2956555b82bd30_67)] [added: 202](#i980f0e0da2e545ad8a4174683b30b0d6_70)[3](#i980f0e0da2e545ad8a4174683b30b0d6_70)[, 202](#i980f0e0da2e545ad8a4174683b30b0d6_70)[2](#i980f0e0da2e545ad8a4174683b30b0d6_70) [and 202](#i980f0e0da2e545ad8a4174683b30b0d6_70)[1](#i980f0e0da2e545ad8a4174683b30b0d6_70)] | | | [removed: [78](#i90327120283244798f2956555b82bd30_67)] [added: [72](#i980f0e0da2e545ad8a4174683b30b0d6_70)] | | |

| [Consolidated Statements of Comprehensive Income for the [removed: year ended] [added: year](#i980f0e0da2e545ad8a4174683b30b0d6_73)[s](#i980f0e0da2e545ad8a4174683b30b0d6_73) [ended] December 31, [removed: 202](#i90327120283244798f2956555b82bd30_70)[2](#i90327120283244798f2956555b82bd30_70)[, 202](#i90327120283244798f2956555b82bd30_70)[1](#i90327120283244798f2956555b82bd30_70) [and](#i90327120283244798f2956555b82bd30_70) [2020](#i90327120283244798f2956555b82bd30_70)] [added: 202](#i980f0e0da2e545ad8a4174683b30b0d6_73)[3](#i980f0e0da2e545ad8a4174683b30b0d6_73)[, 202](#i980f0e0da2e545ad8a4174683b30b0d6_73)[2](#i980f0e0da2e545ad8a4174683b30b0d6_73) [and 202](#i980f0e0da2e545ad8a4174683b30b0d6_73)[1](#i980f0e0da2e545ad8a4174683b30b0d6_73)] | | | [removed: [79](#i90327120283244798f2956555b82bd30_70)] [added: [73](#i980f0e0da2e545ad8a4174683b30b0d6_73)] | | |

| [Consolidated Statements [removed: of](#i90327120283244798f2956555b82bd30_73) [Equity](#i90327120283244798f2956555b82bd30_73) [(Deficit)](#i90327120283244798f2956555b82bd30_73) [for] [added: of Equity (Deficit) for] the [removed: year ended] [added: year](#i980f0e0da2e545ad8a4174683b30b0d6_76)[s](#i980f0e0da2e545ad8a4174683b30b0d6_76) [ended] December 31, [removed: 202](#i90327120283244798f2956555b82bd30_73)[2](#i90327120283244798f2956555b82bd30_73)[, 202](#i90327120283244798f2956555b82bd30_73)[1](#i90327120283244798f2956555b82bd30_73) [and](#i90327120283244798f2956555b82bd30_73) [2020](#i90327120283244798f2956555b82bd30_73)] [added: 202](#i980f0e0da2e545ad8a4174683b30b0d6_76)[3](#i980f0e0da2e545ad8a4174683b30b0d6_76)[, 202](#i980f0e0da2e545ad8a4174683b30b0d6_76)[2](#i980f0e0da2e545ad8a4174683b30b0d6_76) [and 202](#i980f0e0da2e545ad8a4174683b30b0d6_76)[1](#i980f0e0da2e545ad8a4174683b30b0d6_76)] | | | [removed: [80](#i90327120283244798f2956555b82bd30_73)] [added: [74](#i980f0e0da2e545ad8a4174683b30b0d6_76)] | | |

| [Consolidated Statements of Cash Flows for the [removed: year ended] [added: year](#i980f0e0da2e545ad8a4174683b30b0d6_79)[s](#i980f0e0da2e545ad8a4174683b30b0d6_79) [ended] December 31, [removed: 202](#i90327120283244798f2956555b82bd30_76)[2](#i90327120283244798f2956555b82bd30_76)[, 202](#i90327120283244798f2956555b82bd30_76)[1](#i90327120283244798f2956555b82bd30_76) [and](#i90327120283244798f2956555b82bd30_76) [2020](#i90327120283244798f2956555b82bd30_76)] [added: 202](#i980f0e0da2e545ad8a4174683b30b0d6_79)[3](#i980f0e0da2e545ad8a4174683b30b0d6_79)[, 202](#i980f0e0da2e545ad8a4174683b30b0d6_79)[2](#i980f0e0da2e545ad8a4174683b30b0d6_79) [and 202](#i980f0e0da2e545ad8a4174683b30b0d6_79)[1](#i980f0e0da2e545ad8a4174683b30b0d6_79)] | | | [removed: [81](#i90327120283244798f2956555b82bd30_76)] [added: [75](#i980f0e0da2e545ad8a4174683b30b0d6_79)] | | |

| [Notes to Consolidated Financial [removed: Statements](#i90327120283244798f2956555b82bd30_79)] [added: Statements](#i980f0e0da2e545ad8a4174683b30b0d6_82)] | | | [removed: [82](#i90327120283244798f2956555b82bd30_79)] [added: [76](#i980f0e0da2e545ad8a4174683b30b0d6_82)] | | |

We have audited the accompanying consolidated balance sheets of Fortinet, Inc. and subsidiaries (the “Company”) as of December 31, [removed: 2022] [added: 2023] and [removed: 2021,] [added: 2022,] the related consolidated statements of income, comprehensive income, equity (deficit), and cash flows, for each of the three years in the period ended December 31, [removed: 2022,] [added: 2023,] and the related notes (collectively referred to as the “financial statements”).

In our opinion, the financial statements present fairly, in all material respects, the financial position of the Company as of December 31, [removed: 2022] [added: 2023] and [removed: 2021,] [added: 2022,] and the results of its operations and its cash flows for each of the three years in the period ended December 31, [removed: 2022,] [added: 2023,] in conformity with accounting principles generally accepted in the United States of America.

We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the Company’s internal control over financial reporting as of December 31, [removed: 2022,] [added: 2023,] based on criteria established in *Internal Control – Integrated Framework (2013)* issued by the Committee of Sponsoring Organizations of the Treadway Commission and our report dated February 23, [removed: 2023,] [added: 2024,] expressed an unqualified opinion on the Company’s internal control over financial reporting.

Critical Audit [removed: Matters][added: Matter]

The critical audit [removed: matters] [added: matter] communicated below [removed: are matters] [added: is a matter] arising from the current-period audit of the financial statements that [removed: were] [added: was] communicated or required to be communicated to the audit committee and that (1) [removed: relate] [added: relates] to accounts or disclosures that are material to the financial statements and (2) involved our especially challenging, subjective, or complex judgments.

The communication of critical audit matters does not alter in any way our opinion on the financial statements, taken as a whole, and we are not, by communicating the critical audit [removed: matters] [added: matter] below, providing [added: a] separate [removed: opinions] [added: opinion] on the critical audit [removed: matters] [added: matter] or on the accounts or disclosures to which [removed: they relate.][added: it relates.]

[removed: In fiscal year] [added: During] 2021, [removed: the Company] [added: we] invested [removed: $160] [added: $160.0] million in cash for shares of [added: the] Series A Preferred Stock of Linksys [removed: Holdings, Inc. (“Linksys”),] for a 50.8% ownership [removed: interest.][added: interest in this privately held company.]

[removed: Evaluating whether the investment is other-than-temporarily impaired requires management to evaluate several qualitative and quantitative] [added: We considered various] factors [removed: including, among others,] [added: in determining whether an OTTI has occurred, including] Linksys financial results and operating history, [removed: the Company’s] [added: our] ability and intent to hold the investment until its fair value recovers, the implied revenue valuation multiples compared to guideline public companies, Linksys’ ability to achieve [removed: milestones and any notable operational and strategic changes (collectively, “impairment indicators”).]

The Company is involved in disputes, [removed: litigation] [added: litigation,] and other legal actions in the normal course of business.

Claims from third parties may result in a requirement to pay substantial [removed: damages and could prevent the Company from selling certain of its products.][added: damages.]

The Company accrues for a loss contingency if a loss is [removed: probable] [added: probable,] and the amount of the loss can be reasonably estimated.

Given the inherent uncertainty of the outcome of [removed: identified] current matters, auditing litigation contingencies required a high degree of auditor judgment and an increased extent of effort when performing audit procedures.

- We tested the effectiveness of controls over management’s litigation contingency accrual analysis and assessment of matters [removed: with potential impact.]

- We obtained and evaluated legal letters from internal and external legal counsel, and we discussed [removed: with internal legal counsel] the pending litigation [removed: matters.][added: matters with internal legal counsel.]

- We made inquiries with management to obtain an understanding of litigation matters that the Company is currently [added: undergoing.]

- We read available court [removed: filings] [added: documents] for litigation matters to search for contradictory information.

| | | | December 31, [removed: 2022] [added: 2023] | | | | | | December 31, [removed: 2021] [added: 2022] | | |

| Cash and cash equivalents | | | $ | [removed: 1,682.9] [added: 1,397.9] | | | | | $ | [removed: 1,319.1] [added: 1,682.9] | |

| Short-term investments | | | [removed: 502.6] [added: 1,021.5] | | | | | | [removed: 1,194.0] [added: 502.6] | | |

| Marketable equity securities | | | [removed: 25.5] [added: 21.0] | | | | | | [removed: 38.6] [added: 25.5] | | |

| Accounts receivable—Net of allowance for credit losses of [removed: $3.6] [added: $8.2] million and [removed: $2.4] [added: $3.6] million at December 31, [removed: 2022] [added: 2023] and [removed: 2021,] [added: 2022,] respectively | | | [removed: 1,261.7] [added: 1,402.0] | | | | | | [removed: 807.7] [added: 1,261.7] | | |

| Inventory | | | [removed: 264.6] [added: 484.8] | | | | | | [removed: 175.8] [added: 264.6] | | |

| Prepaid expenses and other current assets | | | [removed: 73.1] [added: 101.1] | | | | | | [removed: 65.4] [added: 73.1] | | |

| Total current assets | | | [removed: 3,810.4] [added: 4,428.3] | | | | | | [removed: 3,600.6] [added: 3,810.4] | | |

| LONG-TERM INVESTMENTS | | | [removed: 45.5] [added: —] | | | | | | [removed: 440.8] [added: 45.5] | | |

| PROPERTY AND EQUIPMENT—NET | | | [removed: 898.5] [added: 1,044.4] | | | | | | [removed: 687.6] [added: 898.5] | | |

| DEFERRED CONTRACT COSTS | | | [removed: 518.2] [added: 605.6] | | | | | | [removed: 423.3] [added: 518.2] | | |

| DEFERRED TAX ASSETS | | | [removed: 569.4] [added: 868.8] | | | | | | [removed: 342.3] [added: 569.4] | | |

| GOODWILL | | | [removed: 128.0] [added: 126.5] | | | | | | [removed: 125.1] [added: 128.0] | | |

| OTHER INTANGIBLE ASSETS—NET | | | [removed: 56.0] [added: 35.3] | | | | | | [removed: 63.6] [added: 56.0] | | |

| OTHER ASSETS | | | [removed: 202.0] [added: 150.0] | | | | | | [removed: 235.8] [added: 202.0] | | |

| TOTAL ASSETS | | | $ | [removed: 6,228.0] [added: 7,258.9] | | | | | $ | [removed: 5,919.1] [added: 6,228.0] | |

| LIABILITIES AND [removed: EQUITY (DEFICIT)] [added: STOCKHOLDERS’ DEFICIT] | | | | | | | | | | | |

with potential impact.

February 23, 2024

| OTHER LIABILITIES | | | 124.7 | | | | | | 149.8 | | |

| STOCKHOLDERS’ DEFICIT: | | | | | | | | | | | |

| Excise tax on net stock repurchases | | | — | | | | | | — | | | | | | (10.9) | | | | | | — | | | | | | — | | | | | | — | | | | | | (10.9) | | |

| Foreign currency translation adjustment | | | — | | | | | | — | | | | | | — | | | | | | (5.5) | | | | | | — | | | | | | — | | | | | | (5.5) | | |

| BALANCE—December 31, 2023 | | | 761.0 | | | | | | $ | 0.8 | | | | | $ | 1,416.4 | | | | | $ | (18.9) | | | | | $ | (1,861.7) | | | | | $ | — | | | | | $ | (463.4) | |

| Net income including non-controlling interests | | | $ | 1,147.8 | | | | | $ | 856.6 | | | | | $ | 606.7 | |

| Purchases of Investments in privately held companies | | | (8.5) | | | | | | — | | | | | | (160.0) | | |

| Excise tax payable on net stock repurchases | | | $ | 10.9 | | | | | $ | — | | | | | $ | — | |

The amounts previously reported as Income tax liabilities are included in Other liabilities.

Prior periods have been reclassified to conform with current period presentation.

As of December 31, 2023, we had two equity method investments, including our investment in Linksys.

As of December 31, 2023 and 2022, our equity method investments were recorded in other assets.

Inventory costs comprise primarily of the cost of materials and other component parts as well as capitalized overhead.

A write-down of inventory and a corresponding charge to cost of product revenue is recorded when inventory is determined to be in excess of anticipated demand or considered obsolete.

At the point of the write-down loss recognition, a new, lower cost basis for that inventory is established, and subsequent changes in facts and circumstances do not result in the restoration or increase in that newly established cost basis.

In addition, we record a liability for non-cancelable inventory purchase commitments with contract manufacturers and suppliers for quantities in excess of our future estimated demand forecasts.

The expense related to such accrued liability for inventory purchase commitments is recorded in cost of product revenue on the consolidated statements of income.

These

We have elected to account for the tax effect of the GILTI as a current period expense.

Internal use software development costs capitalized were not material for any periods presented.

are provided.

Recent Accounting Standards Not Yet Effective

*Segment Reporting*

In November 2023, the Financial Accounting Standards Board (the “FASB”) issued Accounting Standards Update (“ASU”) 2023-07, Segment Reporting (Topic 280): Improvements to Reportable Segment Disclosures, which is intended to

improve reportable segment disclosure requirements, primarily through enhanced disclosures about significant expenses.

ASU 2023-07 was effective for us beginning on January 1, 2024 and will be applied on a retrospective basis to all periods presented.

We are currently evaluating the ASU to determine its impact on our disclosures.

*Income Taxes*

In December 2023, the FASB issued ASU 2023-09, Income Taxes (Topic 740): Improvements to Income Tax Disclosures, which includes amendments that further enhance income tax disclosures, primarily through standardization and disaggregation of rate reconciliation categories and income taxes paid by jurisdiction.

The amendments are effective for our annual periods beginning January 1, 2025, with early adoption permitted, and should be applied prospectively.

We are currently evaluating the ASU to determine its impact on our disclosures.

| Product | | | $ | 1,927.3 | | | | | $ | 1,780.5 | | | | | $ | 1,255.0 | |

| | | | December 31, 2023 | | | | | | | | | | | | | | | | | | | | |

| Total available-for-sale investments | | | $ | 1,021.4 | | | | | $ | 0.6 | | | | | $ | (0.5) | | | | | $ | 1,021.5 | |

| | | | December 31, 2023 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| Commercial paper | | | 200.8 | | | | | | (0.1) | | | | | | — | | | | | | — | | | | | | 200.8 | | | | | | (0.1) | | |

| Corporate debt securities | | | 21.8 | | | | | | — | | | | | | 26.9 | | | | | | (0.1) | | | | | | 48.7 | | | | | | (0.1) | | |

| Total available-for-sale investments | | | $ | 269.7 | | | | | $ | (0.1) | | | | | $ | 38.6 | | | | | $ | (0.4) | | | | | $ | 308.3 | | | | | $ | (0.5) | |

[Table o](#i90327120283244798f2956555b82bd30_7)[f](#i90327120283244798f2956555b82bd30_7) [Contents](#i90327120283244798f2956555b82bd30_7)

Investments in Privately Held Companies – Refer to Notes 1 and 6 to the financial statements

*Critical Audit Matter Description*

This investment is accounted for under the equity method of accounting and is evaluated for events or changes in business circumstances that indicate that it’s carrying value might not be recoverable and whether any estimated decline in value is considered to be other-than-temporary.

In the fourth quarter of fiscal year 2022, management concluded that such investment was other-than-temporarily impaired and recorded an impairment charge.

Concluding on whether the presence of impairment indicators indicates that an investment is other-than-temporarily impaired, involves significant and complex management judgment.

Therefore, a high degree of auditor judgment and an increased extent

of effort was required when performing audit procedures to evaluate the appropriateness of management’s assessment of identified impairment indicators and the conclusions reached around whether these impairment indicators result in an other-than-temporary impairment.

*How the Critical Audit Matter Was Addressed in the Audit*

Our audit procedures related to management’s assessment of identified impairment indicators and the conclusions reached around whether these impairment indicators result in an other-than-temporary impairment included, among others:

- We tested the effectiveness of controls over management’s assessment of identified impairment indicators and the conclusions reached around whether these impairment indicators result in an other-than-temporary impairment.

- We evaluated management’s other-than-temporary impairment analysis of its Linksys investment by assessing whether certain indicators were present and whether those indications implied an other-than-temporary loss of value.

These procedures included but were not limited to:

◦We evaluated the reasonableness of the estimated cash flows by comparing such estimated cash flows to historical results and other internal and external information.

◦With the assistance of our fair value specialists, we evaluated the discount rates and revenue valuation multiples by testing the source information used in determining discount rates and revenue valuation multiples.

◦We tested the mathematical accuracy of the discounted cash flows analysis and the resulting estimated fair value of Linksys.

◦We compared Linksys’ estimated undiscounted cash flows and estimated fair value to Fortinet’s carrying amount.

◦We performed inquiries with relevant members of management to obtain an understanding of their current and expected performance for Linksys, including their understanding of any operational and strategic changes.

◦We performed a retrospective review of Linksys’ performance by comparing actual Linksys results to the performance expected by management when the Company initially invested in Linksys.

◦We evaluated the length of time Linksys has incurred losses.

◦We evaluated Linksys’ performance relative to its peers and to the economy by performing a comparison to peer company results and macro-economic trends.

- We tested the mathematical accuracy of the Linksys impairment as the excess of the investment’s carrying value over its estimated fair value.

undergoing.

February 23, 2023

| INCOME TAX LIABILITIES | | | 67.8 | | | | | | 79.5 | | |

| OTHER LIABILITIES | | | 82.0 | | | | | | 59.2 | | |

| EQUITY (DEFICIT): | | | | | | | | | | | |

| Non-controlling interests | | | — | | | | | | 16.7 | | |

| Total equity (deficit) | | | (281.6) | | | | | | 798.4 | | |

| BALANCE—December 31, 2019 | | | 858.7 | | | | | | $ | 0.8 | | | | | $ | 1,179.7 | | | | | $ | 1.1 | | | | | $ | 160.8 | | | | | $ | — | | | | | $ | 1,342.4 | |

| Investment in privately held company | | | — | | | | | | (160.0) | | | | | | — | | |

| Finance lease liabilities arising from obtaining right-of-use assets | | | $ | 0.7 | | | | | $ | 0.1 | | | | | $ | — | |

On April 14, 2022, our board of directors approved a five-for-one forward stock split of our common stock (the “Forward Stock Split”), which was conditioned upon obtaining stockholder approval for the Forward Stock Split, and to increase the number of our authorized shares of common stock.

On June 17, 2022, at our 2022 Annual Meeting of Stockholders, our stockholders approved the Forward Stock Split and the amendment and restatement of our amended and restated certificate of incorporation to increase the number of authorized shares of common stock from 300.0 million to 1.5 billion.

The par value of our common stock was not adjusted as a result of the Forward Stock Split.

Effective June 22, 2022, we filed our amended and restated certification of incorporation and completed the Forward Stock Split.

All share and per share amounts and related stockholders’ equity (deficit) balances presented herein have been retroactively adjusted to reflect the Forward Stock Split.

We apply fair value accounting for

If the actual product demand is significantly lower than forecasted, we could be required to record inventory write-downs which would be charged to cost of product revenue.

to varying limitations, for a refund within a reasonably short period from the date of purchase.

Based on that evaluation, our chief executive officer and chief financial officer concluded that our disclosure controls and procedures were effective as of December 31, [removed: 2022] [added: 2023] to provide reasonable assurance that information we are required to disclose in reports that we file or submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in SEC rules and forms, and that such information is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure.

Based on this evaluation, management concluded that our internal control over financial reporting was effective as of December 31, [removed: 2022.][added: 2023.]

The effectiveness of our internal control over financial reporting as of December 31, [removed: 2022] [added: 2023] has been audited by Deloitte & Touche LLP, an independent registered public accounting firm, as stated in its report, which appears in this Item under the heading “Report of Independent Registered Public Accounting Firm.”

There were no changes in our internal controls over financial reporting (as defined in Rules 13a-15(f) or 15d-15(f) under the Exchange Act) during [removed: 2022] [added: 2023] that have materially affected, or are reasonably likely to materially affect, our internal controls over financial reporting.

We have audited the internal control over financial reporting of Fortinet, Inc. and subsidiaries (the “Company”) as of December 31, [removed: 2022,] [added: 2023,] based on criteria established in *Internal Control – Integrated Framework (2013)* issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

In our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, [removed: 2022,] [added: 2023,] based on criteria established in *Internal Control – Integrated Framework (2013)* issued by COSO.

We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated financial statements as of and for the year ended December 31, [removed: 2022,] [added: 2023,] of the Company and our report dated February 23, [removed: 2023] [added: 2024] expressed an unqualified opinion on those financial statements.

February 23, 2024

February 23, 2023

Rule 10b5-1 Trading Plans

On November 13, 2023, Patrice Perche, our Chief Revenue Officer and Executive Vice President of Support, entered into a pre-arranged written stock sale plan in accordance with Rule 10b5-1 (the “Perche Plan”) under the Exchange Act for the sale of shares of our common stock.

The Perche Plan was entered into during an open trading window in accordance with our insider trading policy and is intended to satisfy the affirmative defense of Rule 10b5-1(c) under the Exchange Act.

The Perche Plan provides for the potential sale by Patrice Perche of up to (a) 141,981 shares of our common stock, including upon the vesting and settlement of RSUs and PSUs for shares of our common stock, and (b) the net shares (which are not yet determinable) after shares are withheld to satisfy tax obligations upon such vesting and settlement, in each case, at the market price, all between March 4, 2024 and June 1, 2025.

On December 6, 2023, Judith Sim, one of directors, entered into a pre-arranged written stock sale plan in accordance with Rule 10b5-1 (the “Sim Plan”) under the Exchange Act for the sale of shares of our common stock.

The Sim Plan was entered into during an open trading window in accordance with our insider trading policy and is intended to satisfy the affirmative defense of Rule 10b5-1(c) under the Exchange Act.

The Sim Plan provides for the potential sale by Judith Sim of up to 20,637 shares of our common stock between March 6, 2024 and March 8, 2025.

Each of the Perche Plan and the Sim Plan (together, the “10b5-1 Plans”) includes a representation from Patrice Perche and Judith Sim (as applicable) to the broker administering the plan that none of them were in possession of any material nonpublic information regarding us or the securities subject to the 10b5-1 Plans at the time the 10b5-1 Plans were entered into.

A similar representation was made to us in connection with the adoption of the 10b5-1 Plans under our insider trading policy.

Those representations for each 10b5-1 Plan were made as of the respective date of adoption of the applicable 10b5-1 Plan, and speak only as of that date.

In making those representations, there is no assurance with respect to any material nonpublic information of which Patrice Perche and Judith Sim were unaware, or with respect to any material nonpublic information acquired by Patrice Perche and Judith Sim or us after the date of each such representation.

Once executed, transactions under the Sim Plan will be disclosed publicly through Form 4 and/or Form 144 filings with the SEC in accordance with applicable securities laws, rules and regulations.

Except as may be required by law, we do not undertake any obligation to update or report any modification, termination, or other activity under current or future Rule 10b5-1 plans that may be adopted by Patrice Perche or Judith Sim or our other officers or directors, or their affiliated entities.

None.

Information responsive to this item is incorporated herein by reference to our definitive proxy statement with respect to our [removed: 2023] [added: 2024] Annual Meeting of Stockholders to be filed with the SEC within 120 days after the end of the fiscal year covered by this Annual Report on Form 10-K.

Information responsive to this item is incorporated herein by reference to our definitive proxy statement with respect to our [removed: 2023] [added: 2024] Annual Meeting of Stockholders to be filed with the SEC within 120 days after the end of the fiscal year covered by this Annual Report on Form 10-K.

Information responsive to this item is incorporated herein by reference to our definitive proxy statement with respect to our [removed: 2023] [added: 2024] Annual Meeting of Stockholders to be filed with the SEC within 120 days after the end of the fiscal year covered by this Annual Report on Form 10-K.

Information responsive to this item is incorporated herein by reference to our definitive proxy statement with respect to our [removed: 2023] [added: 2024] Annual Meeting of Stockholders to be filed with the SEC within 120 days after the end of the fiscal year covered by this Annual Report on Form 10-K.

Information responsive to this item is incorporated herein by reference to our definitive proxy statement with respect to our [removed: 2023] [added: 2024] Annual Meeting of Stockholders to be filed with the SEC within 120 days after the end of the fiscal year covered by this Annual Report on Form 10-K.

[removed: *2.Financial] [added: 2.*Financial] Statement Schedule:* Financial statement schedules have been omitted because they are not applicable or are not required or the information required to be set forth therein is included in the consolidated financial statements or notes thereto.

| [removed: [3.1](https://www.sec.gov/Archives/edgar/data/1262039/000126203922000023/ex31ftnt-amendedandrestate.htm)] [added: [3.2](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000024/ftnt-ex33restatedbylaws.htm)] | | | | | | Amended and Restated [removed: Certificate of Incorporation] [added: Bylaws] | | | | | | Current Report on Form 8-K (File No. 001-34511) | | | | | | June [removed: 22, 2022] [added: 23, 2023] | | | | | | [removed: 3.1] [added: 3.3] | | |

| [removed: [3.2](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000006/ftnt-amendedandrestatedbyl.htm)] [added: [3.1](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000032/ftnt-ex33_20230630x10q.htm)] | | | | | | [removed: Amended and] Restated [removed: Bylaws] [added: Certificate of Incorporation] | | | | | | [removed: Current] [added: Quarterly] Report on Form [removed: 8-K] [added: 10-Q] (File No. 001-34511) | | | | | | [removed: February 8,] [added: August 7,] 2023 | | | | | | [removed: 3.1] [added: 3.3] | | |

| [removed: [4.2](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000010/ftnt-ex42_20221231xk.htm)*] [added: [4.2](https://www.sec.gov/Archives/edgar/data/1262039/000126203924000014/ftnt-ex42_20231231xk.htm)*] | | | | | | Description of Securities Registered Pursuant to Section 12 of the Exchange Act | | | | | | | | | | | | | | | | | | | | |

| [removed: [10.1](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000010/patricepercheemploymentagr.htm)[7](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000010/patricepercheemploymentagr.htm)*] [added: [10.17](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000010/patricepercheemploymentagr.htm)†] | | | | | | Employment Agreement, dated as of January 24, 2018, between Fortinet UK Limited and Patrice Perche | | | | | | [added: Annual Report on Form 10-K (File No. 001-34511)] | | | | | | [added: February 24, 2023] | | | | | | [added: 10.17] | | |

| [removed: [10.1](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000010/ftnt-pperchechangeofctrlse.htm)[8](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000010/ftnt-pperchechangeofctrlse.htm)*] [added: [10.18](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000010/ftnt-pperchechangeofctrlse.htm)†] | | | | | | Change of Control Severance Agreement, effective as of February 21, 2023, between the Company and Patrice Perche | | | | | | [added: Annual Report on Form 10-K (File No. 001-34511)] | | | | | | [added: February 24, 2023] | | | | | | [added: 10.18] | | |

| [removed: [21.1](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000010/ftnt-ex211_20221231xk.htm)*] [added: [21.1](https://www.sec.gov/Archives/edgar/data/1262039/000126203924000014/ftnt-ex211_20231231xk.htm)*] | | | | | | List of subsidiaries | | | | | | | | | | | | | | | | | | | | |

| [removed: [23.1](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000010/ftnt-ex231_20221231xk.htm)*] [added: [23.1](https://www.sec.gov/Archives/edgar/data/1262039/000126203924000014/ftnt-ex231_20231231xk.htm)*] | | | | | | Consent of Independent Registered Public Accounting Firm | | | | | | | | | | | | | | | | | | | | |

| [removed: [24.1](#i90327120283244798f2956555b82bd30_199)*] [added: [24.1](#i980f0e0da2e545ad8a4174683b30b0d6_202)*] | | | | | | Power of Attorney (incorporated by reference to the signature page of this Annual Report on Form 10-K) | | | | | | | | | | | | | | | | | | | | |

| [removed: [31.1](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000010/ftnt-ex311_20221231xk.htm)*] [added: [31.1](https://www.sec.gov/Archives/edgar/data/1262039/000126203924000014/ftnt-ex311_20231231xk.htm)*] | | | | | | Certification of Chief Executive Officer pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002 | | | [added: | | | | | | | | | | | | | | | | | |]

| [removed: [31.2](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000010/ftnt-ex312_20221231xk.htm)*] [added: [31.2](https://www.sec.gov/Archives/edgar/data/1262039/000126203924000014/ftnt-ex312_20231231xk.htm)*] | | | | | | Certification of Chief Financial Officer pursuant to Exchange Act Rules 13a-14(a) and 15d-14(a), as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002 | | | [added: | | | | | | | | | | | | | | | | | |]

| [removed: [32.1](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000010/ftnt-ex321_20221231xk.htm)] [added: [32.1](https://www.sec.gov/Archives/edgar/data/1262039/000126203924000014/ftnt-ex321_20231231xk.htm)] | | | | | | Certifications of Chief Executive Officer and Chief Financial Officer pursuant to 18 U.S.C. Section 1350, as adopted pursuant to Section 906 of the Sarbanes-Oxley Act of 2002 | | | [added: | | | | | | | | | | | | | | | | | |]

| 101.INS* | | | | | | Inline XBRL Instance Document - the instance document does not appear in the interactive data file because its XBRL tags are embedded within the inline XBRL document. | | | [added: | | | | | | | | | | | | | | | | | |]

| 101.SCH* | | | | | | Inline XBRL Taxonomy Extension Schema Document | | | [added: | | | | | | | | | | | | | | | | | |]

| 101.CAL* | | | | | | Inline XBRL Taxonomy Extension Calculation Linkbase Document | | | [added: | | | | | | | | | | | | | | | | | |]

| 101.DEF* | | | | | | Inline XBRL Taxonomy Extension Definition Linkbase Document | | | [added: | | | | | | | | | | | | | | | | | |]

| 101.LAB* | | | | | | Inline XBRL Taxonomy Extension Label Linkbase Document | | | [added: | | | | | | | | | | | | | | | | | |]

| 101.PRE* | | | | | | Inline XBRL Taxonomy Extension Presentation Linkbase Document | | | [added: | | | | | | | | | | | | | | | | | |]

| 104* | | | | | | Cover Page Interactive Data File - the cover page from the Company’s Annual Report on Form 10-K for the year ended December 31, [removed: 2022] [added: 2023] is formatted in inline XBRL. | | | [added: | | | | | | | | | | | | | | | | | |]

| [10.](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000021/exhibit101-formofpsuawarda.htm)[19](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000021/exhibit101-formofpsuawarda.htm)† | | | | | | Form of performance stock unit award agreement under Amended and Restated 2009 Equity Incentive Plan | | | | | | Quarterly Report on Form 10-Q (File No. 001-34511) | | | | | | May 8, 2023 | | | | | | 10.1 | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

| [10.](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000021/exhibit102-globalrsuagreem.htm)[20](https://www.sec.gov/Archives/edgar/data/1262039/000126203923000021/exhibit102-globalrsuagreem.htm)† | | | | | | Form of restricted stock unit award agreement under Amended and Restated 2009 Equity Incentive Plan (Additional Form) | | | | | | Quarterly Report on Form 10-Q (File No. 001-34511) | | | | | | May 8, 2023 | | | | | | 10.2 | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| [97.1](https://www.sec.gov/Archives/edgar/data/1262039/000126203924000014/ftnt-ex971_20231231xk.htm)* | | | | | | Compensation Recovery Policy | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | | | | | | | | | | | | | | | | | | | |

| | | | | | | | | |

| --- | --- | --- | --- | --- | --- | --- | --- | --- |

| Date: February 23, [removed: 2023] [added: 2024] | | | | | | | | |

| /s/ Ken Xie | | | | | | Chief Executive Officer and Chairman | | | | | | February 23, [removed: 2023] [added: 2024] | | |

| /s/ Keith Jensen | | | | | | Chief Financial Officer | | | | | | February 23, [removed: 2023] [added: 2024] | | |

| /s/ Michael Xie | | | | | | President, Chief Technology Officer and Director | | | | | | February 23, [removed: 2023] [added: 2024] | | |

| /s/ Kenneth A. Goldman | | | | | | Director | | | | | | February 23, [removed: 2023] [added: 2024] | | |

| /s/ Ming Hsieh | | | | | | Director | | | | | | February 23, [removed: 2023] [added: 2024] | | |

| /s/ Jean Hu | | | | | | Director | | | | | | February 23, [removed: 2023] [added: 2024] | | |

| /s/ William H. Neukom | | | | | | Director | | | | | | February 23, [removed: 2023] [added: 2024] | | |

| /s/ Judith Sim | | | | | | Director | | | | | | February 23, [removed: 2023] [added: 2024] | | |

| /s/ Admiral James Stavridis | | | | | | Director | | | | | | February 23, [removed: 2023] [added: 2024] | | |

| Date: February 23, 2024 | | | | | | | | |