UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-Q

(Mark One)

For the quarterly period ended September 30, 2024

or

For the transition period from to

Commission file number: 001-34511

FORTINET, INC.

(Exact name of registrant as specified in its charter)

909 Kifer Road

Sunnyvale, California 94086

(Address of principal executive offices, including zip code)

(408) 235-7700

(Registrant’s telephone number, including area code)

Securities registered pursuant to Section 12(b) of the Exchange Act:

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 (“Exchange Act”) during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

As of November 7, 2024, there were 766,452,698 shares of the registrant’s common stock outstanding.

FORTINET, INC.

QUARTERLY REPORT ON FORM 10-Q

For the Quarter Ended September 30, 2024

Table of Contents

Summary of Risk Factors

Our business is subject to numerous risks and uncertainties, including those described in Part II, Item 1A, “Risk Factors” in this Quarterly Report on Form 10-Q. You should carefully consider these risks and uncertainties when investing in our common stock. Some of the principal risks and uncertainties include:

• Our operating results are likely to vary significantly and be unpredictable.

• Adverse economic conditions, such as a possible economic downturn or recession, and possible impacts of inflation or stagflation, increasing or decreasing interest rates, changes in government spending or regulation or reduced information technology spending, including firewall spending, may adversely impact our business.

• We have been, and may in the future be, susceptible to supply chain constraints, supply shortages and disruptions, long or less predictable lead times for components and finished goods and supply changes because some of the key components in our products come from limited sources of supply.

• As a result of supply chain disruptions in previous periods, we increased our purchase order commitments in previous periods and, were in some instances required to and may in the future be required to accept or pay for components and finished goods regardless of our level of sales in a particular period, which may negatively impact our operating results and financial condition.

• Our billings, revenue, and free cash flow growth may slow or may not continue to grow, and our operating margins may decline.

• Our real estate assets, including construction, acquisitions, leasing activity, and ongoing maintenance and management of office buildings, warehouses, data centers and points of presence, as well as data center expansions or enhancements, could involve significant risks to our business.

• Our backlog may fluctuate over quarters. A reduction to backlog increases our aggregate billings and revenue during the quarter when delivered. If we experience supply chain shortages and cannot fulfill orders or if customers cancel or delay delivery of orders, our backlog may be affected, which will negatively impact our aggregate backlog to billings conversion and revenue in such quarter.

• As the supply chain challenges normalize, our product revenue growth rate may be lower versus prior quarters where delivery from backlog contributed more to billings. We expect billings growth to normalize and lower the impact from backlog fluctuations. For the first three quarters of 2024, the comparably lower backlog contribution to billings has resulted in decreased year-over-year quarterly growth rates.

• Any weakness in sales strategy, productivity, personnel and execution could negatively impact our results of operations.

• We are dependent on the continued services and performance of our senior management, as well as our ability to hire, retain and motivate qualified personnel.

• We rely on third-party channel partners for substantially all of our billings, revenue, and a small number of distributors represents a large percentage of our revenue and accounts receivable.

• Reliance on a concentration of shipments at the end of the quarter or changes in shipping terms could cause our billings and revenue to fall below expected levels.

• We rely significantly on revenue from FortiGuard security subscription and FortiCare technical support services, and revenue from these services may decline or fluctuate.

• We face intense competition in our market and we may not maintain or improve our competitive position.

• We are susceptible to defects or vulnerabilities in our products or services, as well as reputational harm from the failure or misuse of our products or services, and any actual or perceived defects or vulnerabilities in our products or services, failure of our products or services to detect or prevent a security incident or to cause a disruption to operations, failure of our customers to implement preventative actions such as updates to one of our deployed solutions or failure to help secure our customers, could cause our products or services to allow unauthorized access to our customers’ networks and harm our operational results and reputation more significantly as compared to other

companies. Our Product Security Incident Response Team publicly posts on our FortiGuard Labs website known product vulnerabilities, including critical vulnerabilities, and methods for customers to mitigate the risk of vulnerabilities. However, there can be no assurance that such posts will be sufficiently timely, accurate or complete or that those customers will take steps to mitigate the risk of vulnerabilities, and certain customers may be negatively impacted.

• If our internal enterprise IT networks, our operational networks, our research and development networks, our back-end labs and cloud stacks hosted in our data centers, colocation vendors or public cloud providers are compromised, public perception of our products and services may be harmed, our customers may be breached and harmed, we may become subject to liability, and our business, operating results and stock price may be adversely impacted.

• We have incurred indebtedness and may incur other debt in the future, which may adversely affect our financial condition and future financial results.

• We generate a majority of billings, revenue and cash flow from sales outside of the United States.

• We may not be successful in executing our strategy to increase our sales to large- and medium-sized end-customers.

• A portion of our revenue is generated by sales to government organizations and other customers, which are subject to a number of regulatory requirements, their own supply chain and contractual requirements, challenges and risks.

• We order components from third-party manufacturers based on our forecasts of future demand and targeted inventory levels, which exposes us to the risk of both product shortages, may result in lost sales and higher expenses, and inventory excesses which may result in inventory charges and costs related to future purchase commitments, and may require us to sell our products at discounts or offer various other incentives.

• We depend on third parties to provide various components for our products and build our products and are susceptible to manufacturing delays, capacity constraints, cost increases, and changes in the geopolitical environment.

• Our inability to successfully acquire and integrate other businesses, products or technologies, or to successfully invest in and form successful strategic alliances with other businesses, could seriously harm our competitive position and could negatively affect our financial condition and results of operations.

• Investors’ and regulators’ expectations of our performance relating to environmental, social and governance factors may impose additional costs and expose us to new risks.

• We are exposed to fluctuations in currency exchange rates, which could negatively affect our financial condition and results of operations.

• Our proprietary rights may be difficult to enforce and we may be subject to claims by others that we infringe their proprietary technology.

• The trading price of our common stock may be volatile, which volatility may be exacerbated by share repurchases under our Share Repurchase Program (the “Repurchase Program”).

• Anti-takeover provisions contained in our certificate of incorporation and bylaws, as well as provisions of Delaware law, could impair a takeover attempt.

• Global economic uncertainty can weaken and harm our financial position.

• Weakening product demand caused by political instability, changes in trade agreements, wars and foreign conflicts, such as the war in Ukraine and the Israel-Hamas war or tensions between China and Taiwan, could adversely affect our business and financial performance.

PART I—FINANCIAL INFORMATION

FORTINET, INC.

CONDENSED CONSOLIDATED BALANCE SHEETS

(unaudited, in millions, except per share amounts)

See notes to condensed consolidated financial statements.

FORTINET, INC.

CONDENSED CONSOLIDATED STATEMENTS OF INCOME

(unaudited, in millions, except per share amounts)

See notes to condensed consolidated financial statements.

FORTINET, INC.

CONDENSED CONSOLIDATED STATEMENTS OF COMPREHENSIVE INCOME

(unaudited, in millions)

| | | | | | | | | | | | | | | | | | | | | | | | | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | ---

Showing the first 8K of 105K characters. Open the full section

In addition to historical information, this Quarterly Report on Form 10-Q contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities and Exchange Act of 1934, as amended (the “Exchange Act”). These statements include, among other things, statements concerning our expectations regarding:

*•*continued growth and market share gains;

*•*variability in sales in certain product and service categories from year to year and between quarters;

*•*expected impact of sales from certain products and services;

*•*increasing or decreasing inflation or stagflation, and changing interest rates in many geographies and changes in currency exchange rates and currency regulations;

*•*competition in our markets;

*•*macroeconomic, geopolitical factors and other disruption on our manufacturing or sales, including the transition in administrations, public health issues, wars, natural disasters and economic growth;

*•*government regulation, tariffs and other policies;

• drivers of long-term growth and operating leverage, such as pricing of our products and services, sales productivity, pipeline and capacity, functionality, value and technology improvements in our service offerings;

• growing our solution sales through channel partners to businesses, service providers and government organizations, our ability to execute these sales and the complexity of providing solutions to all segments (including the increased competition and unpredictability of timing associated with sales to larger enterprises), the impact of sales to these organizations on our long-term growth, expansion and operating results, and the effectiveness of our sales organization;

*•*our ability to successfully anticipate market changes including those related to cloud-based solutions and to sell, support and meet service level agreements related to cloud-based solutions;

*•*growth expectations for the secure networking market;

*•*supply chain constraints, component availability and other factors affecting our manufacturing capacity, delivery, cost and inventory management;

*•*forecasts of future demand and targeted inventory levels, including changing market drivers and demands;

*•*the effect of backlog from current or prior quarters, including its effect on growth of in-quarter billings and revenue;

• our ability to hire properly qualified and effective sales, support and engineering employees;

*•*risks and expectations related to acquisitions and equity interests in private and public companies, including integration issues related to go-to-market plans, product plans, employees of such companies, controls and processes and the acquired technology, and risks of negative impact by such acquisitions and equity investments on our financial results;

• trends in revenue, cost of revenue and gross margin, including expectations regarding product revenue, service revenue growth and inventory related charges;

• trends in our operating expense, including sales and marketing expense, research and development expense, general and administrative expense, and expectations regarding these expenses;

*•*expected impact of plans and strategy for the acceleration of our points of presence (“PoP”) deployment;

*•*expectations that our operating expense will increase year over year in absolute dollars during the remainder of 2024;

*•*expectations that proceeds from the exercise of stock options in future years will be adversely impacted by the increased mix of restricted stock units and performance stock units versus stock options granted or a decline in our stock price;

*•*uncertain tax benefits and our effective domestic and global tax rates, the impact of interpretations of or changes to tax law, and the timing of tax payments;

• expectations regarding spending related to real estate assets, acquisitions and development, including data centers and points of presence, office building and warehouse investments, as well as other capital expenditures and to the impact on free cash flow and expenses;

*•*estimates of a range of 2024 spending on capital expenditures;

• expected outcomes and liabilities in litigation;

• our intentions regarding share repurchases and the sufficiency of our existing cash, cash equivalents and investments to meet our cash needs, including our debt servicing requirements, for at least the next 12 months;

*•*other statements regarding our future operations, financial condition and prospects and business strategies; and

*•*adoption and impact of new accounting standards.

These forward-looking statements are subject to certain risks and uncertainties that could cause our actual results to differ materially from those reflected in the forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to, those discussed in this Quarterly Report on Form 10-Q and, in particular, the risks discussed under the heading “Risk Factors” in Part II, Item 1A of this Quarterly Report on Form 10-Q and those discussed in other documents we file with the SEC. We undertake no obligation, and specifically disclaim any obligation, to revise or publicly release the results of any revision to these and any other forward-looking statements. Given these risks and uncertainties, readers are cautioned not to place undue reliance on such forward-looking statements.

Business Overview

Fortinet is a leader in cybersecurity and the convergence of networking and security. Our mission is to secure people, devices and data everywhere. Our integrated platform, the Fortinet Security Fabric, spans secure networking, unified SASE and AI-driven security operations. As of September 30, 2024, our end-customers were located in over 100 countries and included enterprises such as in the financial services, retail, healthcare and operational technology market verticals, communication and security service providers, and government organizations. We currently have approximately 77% of the Fortune 100 companies and approximately 71% of the Global 2000 companies as customers. As a global company headquartered in Sunnyvale, California our research and development is centered in the United States and Canada with a global footprint of support and centers of excellence around the world. As of September 30, 2024, we held 1,027 U.S. patents and 1,371 global patents and we are recognized in over 130 enterprise analyst reports demonstrating both our vision and execution across security and networking products.

• Secure Networking**—Our Secure Networking solutions focus on the convergence of networking and security via FortiOS, our networking and security operating system that is the foundation of our Fortinet Security Fabric platform and supports over 30 functions that can be delivered via a physical, virtual, cloud or software as a service (“SaaS”) solution. When delivered via our network firewall appliances, functionality is accelerated through our proprietary ASIC technology. These proprietary ASICs, allow our systems to scale, run multiple applications at higher performance, lower power consumption and perform more processor-intensive operations, such as inspecting encrypted traffic, including streaming video. Fortinet’s network firewall offerings consist of a FortiGate data center, hyperscale and distributed firewalls, as well as encrypted applications (SSL inspection, virtual private network and IPsec connectivity). Our ability to converge networking and security also enables the ethernet to become an extension

of our customers’ security infrastructure through FortiSwitch and FortiLink. Our wireless LAN solution leverages secure networking to provide secure wireless access for the enterprise LAN edge. FortiExtender secures 5G/LTE and remote ethernet extenders to connect and secure any branch environment. Fortinet’s Secure

Showing the first 8K of 78K characters. Open the full section

There were no material changes in our market risk during the nine months ended September 30, 2024 compared to the disclosures in Part II, Item 7A of the Form 10-K.

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our chief executive officer and chief financial officer, evaluated the effectiveness of our disclosure controls and procedures (as defined in Rule 13a-15(e) or 15d-15(e) under the Exchange Act as of September 30, 2024. In designing and evaluating the disclosure controls and procedures, management recognized that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures must reflect the fact that there are resource constraints and that management is required to apply its judgment in evaluating the benefits of possible controls and procedures relative to their costs.

Based on that evaluation, our chief executive officer and chief financial officer concluded that our disclosure controls and procedures were effective as of September 30, 2024 to provide reasonable assurance that information we are required to disclose in reports that we file or submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in SEC rules and forms, and that such information is accumulated and communicated to our management, including our chief executive officer and chief financial officer, as appropriate, to allow timely decisions regarding required disclosure.

Changes in Internal Control over Financial Reporting

In accordance with the Internal Controls Guidance, management has excluded Lacework, a privately held data-driven cloud security company, and Next DLP, a privately held data security company, from its assessment of internal control over financial reporting as of September 30, 2024, because Lacework and Next DLP were acquired by us in business combinations during the quarter ended September 30, 2024. Lacework and Next DLP assets represented approximately 3.5% and 1.3% of our consolidated total assets, respectively, excluding the effects of purchase accounting, as of September 30, 2024, and their revenues represented approximately 0.9% and 0.1% of our consolidated total revenue, respectively, for the quarter ended September 30, 2024.

There were no other changes in our internal controls over financial reporting (as defined in Rules 13a-15(f) or 15d-15(f) under the Exchange Act) during the quarter ended September 30, 2024, that have materially affected, or are reasonably likely to materially affect, our internal controls over financial reporting.

PART II—OTHER INFORMATION

ITEM 1. Legal Proceedings

We are subject to various claims, complaints and legal actions that arise from time to time. We accrue for contingencies when we believe that a loss is probable and that we can reasonably estimate the amount of any such loss. There can be no assurance that existing or future legal proceedings arising in the ordinary course of business or otherwise will not have a material adverse effect on our business, consolidated financial position, results of operations or cash flows. Refer to Note 11. Commitments and Contingencies in Part I, Item 1 of this Quarterly Report on Form 10-Q for additional information.

Investing in our common stock involves a high degree of risk. Investors should carefully consider the following risks and all other information contained in this Quarterly Report on Form 10-Q, including our condensed consolidated financial statements and the related notes, before investing in our common stock. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any of the following risks materialize, our business, financial condition and results of operations could be materially harmed. In that case, the trading price of our common stock could decline substantially, and investors may lose some or all of their investment. We have summarized risks immediately below and encourage investors to carefully read the entirety of this Risk Factors section.

Risks Related to Our Business and Financial Position

Our operating results are likely to vary significantly and be unpredictable.

Our operating results have historically varied from period to period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control or may be difficult to predict, including:

• economic conditions, including macroeconomic and regional economic challenges resulting, for example, from a recession or other economic downturn, increased inflation or possible stagflation in certain geographies, changing interest rates, the war in Ukraine, the Israel-Hamas war, tensions between China and Taiwan, or other factors;

• sales strategy, productivity and execution, and our ability to attract and retain new end-customers or sell additional products and services to our existing end-customers, including customer demand for platform solutions like ours versus point solutions;

• our ability to successfully anticipate market changes related to cloud-based solutions and to sell, support and meet service level agreements related to cloud-based solutions;

• component shortages, including chips and other components, and product inventory shortages, including those caused by factors outside of our control, such as epidemics and pandemics, supply chain disruptions, inflation and other cost increases, international trade disputes or tariffs, natural disasters, health emergencies, power outages, civil unrest, labor disruption, international conflicts, terrorism, wars, such as the war in Ukraine and the Israel-Hamas war, and critical infrastructure attacks;

• inventory management, including future inventory purchase commitments;

• the level of demand for our products and services, which may render forecasts inaccurate, increase backlog or future inventory purchase commitments and lead to price decreases;

• our backlog may fluctuate over quarters. A reduction to backlog increases our aggregate billings and revenue during the quarter when delivered. If we experience supply chain shortages and cannot fulfill orders or if customers cancel or delay delivery of orders, our backlog may be affected, which will negatively impact our aggregate backlog to billings conversion and revenue in such quarter;

• as the supply chain challenges normalize, our product revenue growth rate may be lower versus prior quarters where delivery from backlog contributed more to billings. We expect billings growth to normalize and lower the impact from backlog fluctuations. For the first three quarters of 2024, the comparably lower backlog contribution to billings has resulted in decreased year-over-year quarterly growth rates;

• supplier cost increases and any lack of market acceptance of our price increases designed to help offset any supplier cost increases;

• the timing of channel partner and end-customer orders and our reliance on a concentration of shipments at the end of each quarter or changes in shipping terms;

• the impact to our business, the global economy, disruption of global supply chains and creation of significant volatility and disruption of the financial markets due to factors such as increased inflation or possible stagflation in certain geographies, increasing or decreasing interest rates, the war in Ukraine and the Israel-Hamas war and other factors;

• defects or vulnerabilities in our products or services, as well as reputational harm from the failure or misuse of our products or services, and any actual or perceived defects or vulnerabilities in our products or services, failure of our products or services to detect or prevent a security incident or to cause a disruption to operations, failure of our customers to implement preventative actions such as updates to one of our deployed solutions or failure to help secure our customers;

• compromising of our internal enterprise IT networks, our operational networks, our research and development networks, our back-end labs and cloud stacks hosted in our data centers, colocation vendors or public cloud providers, and resulting harm to public perception of our products and services;

• the timing of shipments, which may depend on factors such as inventory levels, logistics, manufacturing or shipping delays, our ability to ship products on schedule and our ability to accurately forecast inventory requirements and our suppliers’ ability to deliver components and finished goods;

• increased expenses, unforeseen liabilities or write-downs and any negative impact on results of operations from any acquisition or equity investment, as well as accounting risks, integration risks related to product plans and products and risks of negative impact by such acquisitions and equity investments on our financial results;

• investors’ expectations of our performance relating to environmental, social and governance (“ESG”) and commitment to carbon neutrality;

• certain customer agreements which contain service-level agreements, under which we guarantee specified availability of our platform and solutions;

• inconsistent data security requirements and enforcement across certain jurisdictions;

• impairments as a result of certain events or changes in circumstances;

• the mix of products sold and the mix of revenue between products and services, as well as the degree to which products and services are bundled and sold together for a package price;

• the purchasing practices and budgeting cycles of our channel partners and end-customers, including the effect of the end of product lifecycles, refresh cycles or price decreases;

• any decreases in demand by channel partners or end-customers, including any such decreases caused by factors outside of our control such as natural disasters and health emergencies, including earthquakes, droughts, fires, power outages, typhoons, floods, pandemics or epidemics and manmade events such as civil unrest, labor disruption, international trade disputes, international conflicts, terrorism, wars, such as the war in Ukraine and the Israel-Hamas war, and critical infrastructure attacks;

• the effectiveness of our sales organization, generally or in a particular geographic region, including the time it takes to hire sales personnel, the timing of hiring and our ability to hire and retain effective sales personnel, our efforts to align our sales capacity and market demand and any negative impact to our sales and the effectiveness of our sales team based on changes to sales compensation or to our sales compensation plan;

• sales productivity and sales execution risk related to effectively selling to all segments of the market, including enterprise and small- and medium-sized businesses, government organizations and service providers, and to selling our broad security product and services portfolio, including, among other execution risks, risks associated with the complexity and distraction in selling to all segments, increased competition and unpredictability of timing to close larger enterp

Showing the first 8K of 197K characters. Open the full section

Rule 10b5-1 Trading Plans

No director or Section 16 officer of the Company adopted or terminated a “Rule 10b5-1 trading arrangement” or “non-Rule 10b5-1 trading arrangement,” as each term is defined in Item 408(a) of Regulation S-K, during the three months ended September 30, 2024.

The exhibits listed in the accompanying Exhibit Index are filed or incorporated by reference as part of this Quarterly Report on Form 10-Q.

EXHIBIT INDEX

• Filed herewith.

Furnished herewith.

SIGNATURES

Pursuant to the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized.