Fortinet
The firewall maker: it sells the box that decides which traffic may enter a company's network, then rents out the updates and threat feeds that keep the box useful.
The scores
Growth3/4 ↑
Two of the last three years grew 12% to 14%; the acceleration is one year old and sits in the cyclical hardware third.
Business quality3/4 ↑
The cost position shows as an appliance-revenue crossover, but that is one year of data and the appliance-free substitute is shipping today rather than announced.
Financial position4/4 ↑
Net cash of nearly $4B, nothing to refinance until 2031 at 2.2%, and half-year operating cash flow larger than the whole of the debt.
Execution record4/4 →
Beat every quarter in the window, raised the full-year revenue guide by $520M mid-year, and retired 12.5M shares at half today's price.
Per share capture4/4 →
Share count down 4.2% in a year, buybacks at 6.4 times stock compensation, no convertibles, and acquisitions paid in cash and immaterial.
Potential2/4 ↑
The upside is a cycle plus somebody else's regulatory and data-centre spending. The prize would not compose, and nobody has signed for the appliance revenue.
Risk profile3/4 →
Several disclosed dependencies rather than one. Three distributors are 53% of revenue and 87% of hardware is Taiwanese. None resolves in one step.
Valuation2/4 ↓
About $52 of enterprise value per dollar of operating profit assumes the peak quarter is the base rate, which its own second-half guidance contradicts.
Evidence quality3/4 →
Everything central is filed and current, but the load-bearing conclusion is an inference from a guidance bridge that no disclosure confirms until November.
The Verdict
We rate Fortinet unattractive. It sells the firewall box that decides which traffic enters a company's network, then rents out the updates that keep it useful. The business is strong, and box sales have surged as companies replace hardware bought in an earlier rush. The price treats that surge as permanent, though Fortinet's own guidance slows it sharply and replacement waves end, so it is full, not cheap. The view hinges on the rented protection growing fast enough to carry the company when box sales slow. The shares more than doubled in a year, mostly on buyers paying more for each dollar of profit.
The long caseCompanies are replacing firewalls bought in an earlier rush, but that wave ends; Fortinet's rented protection must grow fast enough to carry it once box sales slow.
The evidence under this - 8 claims
- He offers the figure inside an argument against the refresh reading, not for it - the same sentence goes on to say the growth is 'much bigger than just the refresh', so the number is being used as a denominator by a party with a view.
- Fortinet discloses no shipment or installed-base figures at all, so the five-year life cannot be checked against anything the company files, and a fleet average lengthens when customers defer.
- The 10-K's own risk factors list 'product refresh cycles' among the identified growth drivers, which is the company conceding the mechanism even while its chief executive argues past it.
- 2026-09-24editedRe-struck at the 2026-09-23 close in the 2026-09-24 maintenance refresh: the price had moved 13.5% since the thesis, past the 12% drift trigger. Also corrects the original figure, which was not a close: $154.84 was an intraday price from a pack fetched at 16:24 UTC on 8 September while the session was open; the close that day was $157.47.
- Fortinet beat the revenue its guidance implied by 8.4% in Q2 2026 and 6.7% in Q1 2026, and raised the full-year revenue guide by $520M at the midpoint between February and July, so the implied second-half rate is a floor the company has repeatedly cleared rather than a forecast.
- The service revenue guide is a range of only $40M against a revenue range of $160M, so the implied product figure inherits the whole of the revenue range: the arithmetic at the top of the revenue guide and the bottom of the service guide gives second-half product growth nearer 32%.
- Management guides 'on a quarter-by-quarter basis' by its own description, which is a statement that the full-year figure is not a considered second-half forecast.
- Check Point's multiple is set by 6.3% total revenue growth against Fortinet's 18.8% over the same trailing period, so equalising the two assumes away the growth difference that justifies most of the gap.
- Palo Alto trades at a higher multiple of sales than Fortinet on far lower GAAP profitability, so the cohort does not agree on what a network security business is worth and Check Point is one reading rather than the answer.
- The arithmetic holds the operating margin at its trailing level; Fortinet has expanded it from 23.4% in 2023 to 33.7% in Q2 2026, and further expansion would reach the same operating profit on less revenue.
- 2026-09-24editedRe-struck at the 2026-09-23 close in the 2026-09-24 maintenance refresh: enterprise value $109.7B to $127.2B and the ratio 44.9 to 52.1; Check Point's cohort reading moved from 18.6 to 19.3, so the operating profit needed to close the gap moved from about 2.3 to about 2.7 times today's and the revenue from about $17B to about $20B.
- The second-half figure is derived from a guidance midpoint, and the service guide is a $40M range, so a top-of-range outcome puts second-half growth nearer 16% and would be a genuine re-acceleration rather than a flat line.
- Service revenue lags appliance shipments by design, so a first half in which appliances grew 46.5% mechanically lifts service revenue for several quarters regardless of demand - which cuts both ways and is exactly why the 2027 rate matters more than the 2026 one.
- 2026-10-28editedQ3 2026 release (S19): service revenue grew 12.7% and the full-year service guide was set at $5.150B to $5.170B, implying about 12.6% in Q4 on the filed 2025 quarter.
The company
Every company network has a front door, and a firewall stands in it, deciding packet by packet which traffic may pass. Fortinet's FortiGate does that job on chips Fortinet designs itself, and the same software also runs in the cloud.
Buyers weigh it against Palo Alto, Check Point or Cisco, or against sending their traffic through a cloud service instead.
The evidence under this - 3 claims
- It is a claim about competitors made by an interested party, and neither Palo Alto's FY2025 10-K nor Check Point's FY2025 20-F confirms or denies it - both describe purpose-built appliances without saying what silicon is inside.
- The independent test that would settle it was not read: CyberRatings.org, the successor to NSS Labs, returns HTTP 403 to every non-browser client tried, so the performance the chip is supposed to buy has not been measured here.
- Fortinet's own product gross margin of 69.8% is below Palo Alto's 73.3%, so whatever the chip does, it does not show up in the cost of the box as reported.
How it makes money
A dollar arrives twice. The box is sold once. Then the customer rents the threat feeds, updates and support for as long as the box runs, and that rent is 62.3% of revenue. The rent is steady; the boxes come in waves, replaced every five years or so.
The evidence under this - 2 claims
- He offers the figure inside an argument against the refresh reading, not for it - the same sentence goes on to say the growth is 'much bigger than just the refresh', so the number is being used as a denominator by a party with a view.
- Fortinet discloses no shipment or installed-base figures at all, so the five-year life cannot be checked against anything the company files, and a fleet average lengthens when customers defer.
- The 10-K's own risk factors list 'product refresh cycles' among the identified growth drivers, which is the company conceding the mechanism even while its chief executive argues past it.
Where the money comes from, stream by stream
| Stream | Share of sales (Q2 2026) | How it earns it |
|---|---|---|
| Product | 37.7% | FortiGate appliances and other hardware, plus software licences, sold mostly through distributors and recognised when shipped. |
| Security subscription | 35.6% | FortiGuard threat feeds, SASE and other subscriptions running on the appliances or in the cloud, billed up front and recognised over the term. |
| Technical support and other | 26.6% | FortiCare support contracts and other services on the installed base, billed up front and recognised over the term. |
Who runs it
Ken Xie co-founded Fortinet in 2000 and has run it ever since. His brother Michael, the other co-founder, runs the technology, and Christiane Ohlgart became finance chief in 2025. The two brothers own nearly a fifth of the company, so they gain and lose with every other owner. Their yearly bonus rides on sales, invoices and profit, and their share awards on the stock beating the market. Nothing pays them for turning profit into cash.
The evidence under this - 3 claims
- Billings, a third of the bonus, counts multi-year contracts invoiced up front, so it rewards exactly the appliance wave the thesis reads as temporary rather than the steadier service revenue.
- No metric pays on free cash flow or return on capital, and the committee can adjust any payout for individual performance.
Why it wins, and who could beat it
Why customers come back
Fortinet designs the chip that does the costly part of the job, reading encrypted traffic, so a given speed costs it less silicon and power. It spends that saving on price, not margin: the founder says it adjusts prices monthly to hold its margin steady.
So the proof is volume. Its box sales passed Palo Alto's within a year, $773.0M against $738M, while its margin on each box sold is lower than Palo Alto's.
The evidence under this - 3 claims
- Fortinet's GAAP gross margin fell from 80.7% in Q2 2025 to 80.2% in Q2 2026, so the policy did not hold it exactly constant over the year in which memory prices moved.
- A pricing policy is not observable from outside: no filing discloses list prices, discounts or the timing of changes, so this is management describing its own conduct with nothing to check it against.
- The two quarters end a month apart, so this is not the same three months on either side.
- Fortinet's product line includes switches, wireless access points and 5G extenders as well as firewalls, while Palo Alto's product line is narrower, so part of the crossover is mix rather than firewall share.
- Neither company discloses units, so a revenue crossover is consistent with Fortinet selling more boxes at a lower price, which is what a cost position spent on price would look like.
The threat
The real rival is no box at all. Zscaler inspects a company's traffic in its own cloud, so a branch office needs no firewall, and Palo Alto sells the same kind of service beside its boxes. Zscaler's own annual report admits the limit: companies that have spent heavily on boxes may not be ready to give them up.
The evidence under this - 3 claims
The rivals: ZS, PANW, CHKP.
Who else does this, rival by rival
| Ticker | Rival | How far along | Priced against it |
|---|---|---|---|
| ZS | Zscaler Zero Trust Exchange (Zscaler, Inc.)Priced against it: No usable figure | On sale | No usable figure |
| PANW | Prisma Access with Prisma SD-WAN (Palo Alto Networks, Inc.)Priced against it: Yes | On sale | Yes |
| CHKP | Check Point Software TechnologiesPriced against it: Yes | On sale | Yes |
How big it could get
How big this could get
Nobody publishes how many sites must run a firewall, so there is only a floor: Fortinet, Palo Alto and Check Point sold about $5.50B of boxes between them in their latest years, leaving out Cisco, Huawei and others. Europe added a push in 2024, a cybersecurity law with fines of at least €10M or 2% of turnover, but no country publishes how many companies it covers.
The evidence under this - 2 claims
- The three product lines are not defined identically: Fortinet's includes switches, wireless access points and 5G extenders, Palo Alto's is narrower, and Check Point's line is 'products and licences' and so carries software revenue that is not a box at all.
- The three fiscal years end on three different dates - 30 June 2026, 31 July 2026 and 31 December 2025 - so the sum spans about eighteen months of trading rather than one year.
- It excludes Cisco, Huawei, SonicWALL and Sophos entirely, and Huawei alone is on any reading a large share of appliance units outside the United States, so the figure is a floor on the listed pond rather than a measure of the market.
Who has signed
$7.73B of rent is contracted and not yet earned, $3.86B of it due within a year. But that is the rent on boxes already sold. Fortinet discloses no count of orders for new boxes, so nobody has signed for the second-half hardware sales its guidance implies.
The evidence under this - 2 claims
Where the growth is coming from, business by business
Where the growth is coming from
| Business | Share of revenue | Growth: last quarter | Last half-year | Last year |
|---|---|---|---|---|
| Product | 38% | +51.9% | +46.5% | +32.4% |
| Security Subscription | 36% | +13.2% | +12.3% | +12.1% |
| Technical Support and Other | 27% | +14.4% | +13.0% | +12.9% |
| Whole company | 100% | +25.6% | +23.0% | +18.8% |
The filed split through 2026-06-30. These rates are not carried forward: the reading below says why.
How we read it: The blend. Product is a revenue type, not a business: its 46% is a hardware cycle, price rises and five-year replacements, that guidance cuts to 18.5% in the second half, after falling 1% in 2024.
The results
The numbers
Sales grew 19% over the twelve months to Jun 2026, about the same pace as the 14% in the year to Dec 2025.
Operating margin is 32%, up from 23% in the year to Dec 2023.
Running costs take 48¢ of each sales dollar, down from 57¢ in the year to Dec 2021.
Each dollar put into the business earns 77% a year after tax, up from 48% in the year to Dec 2021.
It turned 43% of sales into free cash, $3.20B over the last twelve months.
It holds $2.93B of cash against $497M of debt, $2.44B more cash than it owes.
The share count fell 11% in 4.5 years, and pay in shares costs 4.0% of sales.
All the numbers
Filed figures from the company's 10-K and 10-Q, read 2026-10-04. Fiscal years end in December.
| Dec 2021 | Dec 2022 | Dec 2023 | Dec 2024 | Dec 2025 | 12 mo to Jun 2026 | |
|---|---|---|---|---|---|---|
| Size and growth | ||||||
| Sales | $3.34B | $4.42B | $5.30B | $5.96B | $6.80B | $7.53B |
| Sales growth | +29% | +32% | +20% | +12% | +14% | +19% |
| Profit | ||||||
| Gross margin | 77% | 75% | 77% | 81% | 80% | 80% |
| Operating margin | 19% | 22% | 23% | 30% | 31% | 32% |
| Net margin | 18% | 19% | 22% | 29% | 27% | 28% |
| What growth costs, per sales dollar | ||||||
| Research and development | 13% | 12% | 12% | 12% | 12% | 11% |
| Sales and marketing | 40% | 38% | 38% | 34% | 35% | 33% |
| General and admin | 4.3% | 3.8% | 4.0% | 4.0% | 3.4% | 3.1% |
| Pay in shares | 6.3% | 5.0% | 4.7% | 4.4% | 4.1% | 4.0% |
| Capital spending | 8.9% | 6.4% | 3.8% | 6.4% | 5.4% | 2.6% |
| Cash | ||||||
| Cash from operations | $1.50B | $1.73B | $1.94B | $2.26B | $2.59B | $3.40B |
| Free cash flow | $1.20B | $1.45B | $1.73B | $1.88B | $2.23B | $3.20B |
| Balance sheet | ||||||
| Cash and short-term investments | $1.32B | $1.68B | $1.40B | $2.88B | $2.50B | $2.93B |
| Debt | $988M | $990M | $992M | $994M | $996M | $497M |
| Net cash | $331M | $692M | $406M | $1.88B | $1.50B | $2.44B |
| Returns and shares | ||||||
| Return on capital | 48% | 76% | 179% | 103% | 71% | 77% |
| Shares (diluted) | 835M | 805M | 788M | 772M | 765M | 740M |
What growth costs
Growing has made Fortinet more profitable: sales have risen faster than the cost of selling, running the company and paying staff in shares, so each new dollar of sales costs less to win. Research spending has kept pace with sales. Part of the recent jump came from cheaper boxes, though, and this year's building programme will push spending on property back up.
The evidence under this - 2 claims
- The largest step, operating margin from 23.4% to 30.3% in 2024, came as gross margin rose from 76.7% to 80.6% in a year product revenue fell 1.0% (C04), so mix toward service did part of the work that scale is credited with.
- Capital spending of 2.6 cents is a trough: the company guides to $350M to $550M of infrastructure investment for 2026 (C41).
The last report (29 Jul)
Quarter ended June 2026, filed figures.
In the September 2026 quarter sales grew 20.5% to $2.08B, hardware sales rose 36.8% to $765M and subscriptions grew 12.7%. The company raised its full-year guide for the third time, to 20% growth, and kept 34 cents of each dollar as operating profit.
Both lines slowed from June, when hardware grew 51.9% and subscriptions 13.7%. But Fortinet's new guide leaves hardware growing near 28% in the second half, against the 18.5% its earlier guide implied: the surge is lasting longer than the case allowed.
What it did to the thesisIt tested the case that this is a replacement wave that fades. Hardware slowed but stayed strong and the guide rose again, so the wave is lasting longer than we allowed. The view stays Unattractive because the price still treats the surge as permanent, but conviction is on watch.
The quarter in detail
Sales growth from the previous quarter, filed figures.
Earnings per share $0.90 against $0.75 expected; $0.82 as filed, the gap being what the company adds back.
The evidence under this - 4 claims
Product growth slowed from 51.9% in Q2 2026 to 36.8%, and service growth slowed from 13.7% to 12.7%, so both lines decelerated even as the full-year guide was raised.
- 2026-10-28editedQ3 2026 release (S19) reports product revenue of $765.0M against $559.3M a year earlier.
- The second-half figure is derived from a guidance midpoint, and the service guide is a $40M range, so a top-of-range outcome puts second-half growth nearer 16% and would be a genuine re-acceleration rather than a flat line.
- Service revenue lags appliance shipments by design, so a first half in which appliances grew 46.5% mechanically lifts service revenue for several quarters regardless of demand - which cuts both ways and is exactly why the 2027 rate matters more than the 2026 one.
- 2026-10-28editedQ3 2026 release (S19): service revenue grew 12.7% and the full-year service guide was set at $5.150B to $5.170B, implying about 12.6% in Q4 on the filed 2025 quarter.
- The full-year service revenue guide implies about 13.5% growth for 2026, barely above the 13.2% Fortinet actually delivered in 2025 - so the trough is a quarterly one inside a rate that has been roughly flat for two years, not a return to the 19.8% of 2024.
- Service revenue is recognised over the contract term, so it follows appliance shipments with a lag: the same mechanism that lifts it in the second half of 2026 will pull it down again if the appliance line normalises in 2027.
- It is a forecast about the company's largest revenue line given by the company, with no filed figure standing behind it until the quarter is reported.
- Q3 2026 service growth was 12.7%, down from 13.7% in Q2 and not the positive trajectory the chief financial officer expected from the Q1 trough; the raised full-year service guide implies about 12.6% in Q4 (S19).
- 2026-10-28editedQ3 2026 release (S19) shows service growth easing to 12.7%, so the counter-evidence now records that the expected rise did not arrive in the quarter
What management did with the money
It bought back 12.5 million shares for $972.8M in the first half, against $151.8M of stock paid to staff, and the diluted count fell to 739.9 million from 772.7 million a year earlier. It holds $3.97B more cash than debt, with nothing due until 2031.
Insiders in 2026Q2: 25 purchases and 63 sales, from their Form 4 filings.
The evidence under this - 2 claims
The price, and where we disagree
In short. Full. The price assumes Fortinet's recent burst of growth, driven by customers replacing their hardware, is the new normal rather than a peak. It holds only if subscriptions speed up enough to carry the company when hardware sales slow.
The shares rose 110.3% in a year while earnings per share grew 43.9%: most of the rise is buyers paying more for each dollar of profit, not more dollars.
The September-quarter results are out: the replacement wave lasted longer than the case allowed. The next test is the December-quarter results in February 2027, which show whether hardware growth falls toward the 20% the guide implies.
The evidence under this - 5 claims
- 2026-09-24editedRe-struck at the 2026-09-23 close in the 2026-09-24 maintenance refresh: the price had moved 13.5% since the thesis, past the 12% drift trigger. Also corrects the original figure, which was not a close: $154.84 was an intraday price from a pack fetched at 16:24 UTC on 8 September while the session was open; the close that day was $157.47.
- One quarter's earnings growth is not the year's: over the same 252 sessions the company also moved from a 12.3% revenue growth year to a 19.1% guided one, so some of the multiple expansion is the market discounting a changed growth rate rather than paying more for the same business.
- The 252-session return starts from a depressed base - the shares traded near $79 through late 2025 after two years of 12% to 14% growth - so the comparison measures a re-rating off a trough as much as an over-extension at the top.
- GAAP earnings per share is flattered relative to revenue by the falling share count, so the earnings-per-share figure grew faster than earnings did and the implied multiple expansion is if anything understated.
- 2026-09-24editedRe-struck at the 2026-09-23 close in the 2026-09-24 maintenance refresh: the 252-session return moved from 96.4% to 110.3%. The earnings figure is Q2's and did not move.
- 2026-10-28editedQ3 2026 release (S19) reports product revenue of $765.0M against $559.3M a year earlier.
- He offers the figure inside an argument against the refresh reading, not for it - the same sentence goes on to say the growth is 'much bigger than just the refresh', so the number is being used as a denominator by a party with a view.
- Fortinet discloses no shipment or installed-base figures at all, so the five-year life cannot be checked against anything the company files, and a fleet average lengthens when customers defer.
- The 10-K's own risk factors list 'product refresh cycles' among the identified growth drivers, which is the company conceding the mechanism even while its chief executive argues past it.
How we read the multiple
A buyer pays about $53 for each dollar of yearly operating profit, what is left from sales after running costs. Check Point, the one rival profitable enough to compare, asks about $19.
That treats June's 25.6% sales growth as normal. To reach Check Point's level through growth rather than a falling share price:
- Operating profit would need to grow to about 2.7 times today's.
- At today's profit on each dollar of sales, that means yearly revenue near $20B.
Against its own history. Dearer than its own normal on every measure, most on sales. The acceleration behind that is a year old and sits in the cyclical third of the business.
The evidence under this - 4 claims
- Check Point's multiple is set by 6.3% total revenue growth against Fortinet's 18.8% over the same trailing period, so equalising the two assumes away the growth difference that justifies most of the gap.
- Palo Alto trades at a higher multiple of sales than Fortinet on far lower GAAP profitability, so the cohort does not agree on what a network security business is worth and Check Point is one reading rather than the answer.
- The arithmetic holds the operating margin at its trailing level; Fortinet has expanded it from 23.4% in 2023 to 33.7% in Q2 2026, and further expansion would reach the same operating profit on less revenue.
- 2026-09-24editedRe-struck at the 2026-09-23 close in the 2026-09-24 maintenance refresh: enterprise value $109.7B to $127.2B and the ratio 44.9 to 52.1; Check Point's cohort reading moved from 18.6 to 19.3, so the operating profit needed to close the gap moved from about 2.3 to about 2.7 times today's and the revenue from about $17B to about $20B.
- The six years the median covers include 2020 to 2022, when revenue grew 19.9%, 28.8% and 32.2% - faster than the 19.1% the current year is guided at - so the median was set on a stronger growth record, not a weaker one.
- A trailing sales multiple is struck on the twelve months to 30 June 2026, which contains only one quarter of the acceleration; on the guided full-year revenue the same market value is 16.2 times sales.
- 2026-09-24editedRe-struck at the 2026-09-23 close in the 2026-09-24 maintenance refresh: market value of $131,144.0M (the close times FMP's 733.7M shares) over trailing revenue of $7,527.4M and over the trailing earnings the pack's own multiple implies. The pack's 17.5 and 62.8 are the same ratios on an intraday 2026-09-24 price. The six-year medians did not move; the guided-revenue counter-evidence moved from 14.0 to 16.2 times with the price.
- Palo Alto's GAAP operating profit is depressed by share-based compensation and acquisition-related charges it excludes from its own non-GAAP figures, and it guides to a 29.5% non-GAAP operating margin for fiscal 2027. On that basis the gap to Fortinet's 38.0% non-GAAP figure is about eight points rather than five times.
- The two fiscal quarters end a month apart and Palo Alto closed an acquisition in the period, so the comparison is not like-for-like on either the calendar or the perimeter.
Priced against its rivals
The competitors its own annual report names, each confirmed against the rival's filing. Measured on company value for each $1 of operating profit, cheapest first:
| Ticker | Company | company value for each $1 of operating profit |
|---|---|---|
| CHKP | Check Point Software Technologies | 19.3× |
| FTNT | Fortinet | 53.0× |
| PANW | Palo Alto Networks | 459.2× |
The middle of the other 2 is 239.2. Fortinet, Inc. is 2nd cheapest of 3.
Rivals' figures come from a data provider, so read the spread of the group rather than any single pair.
Far dearer than Check Point for each dollar of operating profit. It looks cheaper than Palo Alto only because Palo Alto barely earns any.
Also checked and set aside: CrowdStrike Holdings (a substitute, not the same product); Cisco Systems (a substitute, not the same product); Microsoft (a substitute, not the same product); Hewlett Packard Enterprise Company (a substitute, not the same product); F5 (a substitute, not the same product); Netskope (a substitute, not the same product).
Private or foreign rivals that cannot be priced: Huawei Technologies Co., Ltd., SonicWALL, Inc., Sophos Group Plc.
Where we disagree with the market
The surge is a lasting platform shift, the story Fortinet told when it named a new product category on the July call.
The boxes are in a five-year replacement wave, and Fortinet's own guidance takes their growth from 46.5% to about 18.5%.
Buyers, not analysts, drove the rise: they split 29 buy, 33 hold and 6 sell. Our number needs two subtractions nobody prints, using the rent guide Fortinet raised in the same release.
Against us: the founder says product revenue is roughly triple five years ago, more than a replacement would explain, and the finance chief says rent growth bottomed in March. If it climbs past 16%, we are wrong.
What analysts say, and the evidence
The evidence under this - 6 claims
- Fortinet beat the revenue its guidance implied by 8.4% in Q2 2026 and 6.7% in Q1 2026, and raised the full-year revenue guide by $520M at the midpoint between February and July, so the implied second-half rate is a floor the company has repeatedly cleared rather than a forecast.
- The service revenue guide is a range of only $40M against a revenue range of $160M, so the implied product figure inherits the whole of the revenue range: the arithmetic at the top of the revenue guide and the bottom of the service guide gives second-half product growth nearer 32%.
- Management guides 'on a quarter-by-quarter basis' by its own description, which is a statement that the full-year figure is not a considered second-half forecast.
- Measured against 2021 - the year whose appliances a five-year life puts in the field now - trailing product revenue is 2.13 times, not three times. The three-times figure holds only against 2020, before the two boom years, and he does not say which base he is using.
- 2021 itself was a boom year in which product revenue grew 36.9%, so a multiple of it is a comparison against an already-elevated base rather than against a normal one.
- The argument is one Fortinet's own risk factors undercut: they list 'product refresh cycles' among the identified growth drivers the company is trying to capitalise on.
- The full-year service revenue guide implies about 13.5% growth for 2026, barely above the 13.2% Fortinet actually delivered in 2025 - so the trough is a quarterly one inside a rate that has been roughly flat for two years, not a return to the 19.8% of 2024.
- Service revenue is recognised over the contract term, so it follows appliance shipments with a lag: the same mechanism that lifts it in the second half of 2026 will pull it down again if the appliance line normalises in 2027.
- It is a forecast about the company's largest revenue line given by the company, with no filed figure standing behind it until the quarter is reported.
- Q3 2026 service growth was 12.7%, down from 13.7% in Q2 and not the positive trajectory the chief financial officer expected from the Q1 trough; the raised full-year service guide implies about 12.6% in Q4 (S19).
- 2026-10-28editedQ3 2026 release (S19) shows service growth easing to 12.7%, so the counter-evidence now records that the expected rise did not arrive in the quarter
- The second-half figure is derived from a guidance midpoint, and the service guide is a $40M range, so a top-of-range outcome puts second-half growth nearer 16% and would be a genuine re-acceleration rather than a flat line.
- Service revenue lags appliance shipments by design, so a first half in which appliances grew 46.5% mechanically lifts service revenue for several quarters regardless of demand - which cuts both ways and is exactly why the 2027 rate matters more than the 2026 one.
- 2026-10-28editedQ3 2026 release (S19): service revenue grew 12.7% and the full-year service guide was set at $5.150B to $5.170B, implying about 12.6% in Q4 on the filed 2025 quarter.
What could go wrong, and how we would know
The risks
- Price, not volume. The finance chief says price rises add 'high single digits' to second-half billings, so part of the growth is price.
- Three distributors. Three distributors were 53% of June-quarter revenue.
- Made in Taiwan. 87% of its hardware is built in Taiwan, with no long-term contract guaranteeing its chips' supply or price.
- No box at all. Cloud services inspect traffic without anything on site, and each branch they win is one fewer box to replace.
The evidence under this - 4 claims
- She said in the same answer that the quarter also saw good unit growth and good average selling price growth from customers moving to higher-performing models, so price is one of three contributors rather than the whole of it.
- Ken Xie said the company adjusts prices monthly against component cost and cuts them when memory prices fall, so the uplift is a pass-through that reverses rather than a durable price increase.
- The figure is a band rather than a number, given on a call and reconciled to nothing filed, so its size cannot be checked.
What we still do not know
- Whether the growth is more boxes or higher prices. No unit shipments, installed base or order figure is disclosed.
- Which year is the right base for the wave. Box sales are 2.91 times their 2020 level but 2.13 times 2021's, and the founder's 'roughly triple' rests on the first.
- How many companies Europe's cybersecurity law covers. No member state publishes its register.
The evidence under this - 4 claims
- She said in the same answer that the quarter also saw good unit growth and good average selling price growth from customers moving to higher-performing models, so price is one of three contributors rather than the whole of it.
- Ken Xie said the company adjusts prices monthly against component cost and cuts them when memory prices fall, so the uplift is a pass-through that reverses rather than a durable price increase.
- The figure is a band rather than a number, given on a call and reconciled to nothing filed, so its size cannot be checked.
- Which base is the right one is a judgement about when the installed appliances were actually bought, and Fortinet discloses no shipments by year, so neither 2020 nor 2021 can be shown to be the correct denominator.
- Revenue is not units: average selling prices have risen, by the chief financial officer's own account, so a 2.13 times revenue ratio overstates the ratio of boxes.
- Fortinet also sells to customers it did not have in 2021 - over half a million now by its own count - so part of any multiple is new logos rather than replacement.
- Measured against 2021 - the year whose appliances a five-year life puts in the field now - trailing product revenue is 2.13 times, not three times. The three-times figure holds only against 2020, before the two boom years, and he does not say which base he is using.
- 2021 itself was a boom year in which product revenue grew 36.9%, so a multiple of it is a comparison against an already-elevated base rather than against a normal one.
- The argument is one Fortinet's own risk factors undercut: they list 'product refresh cycles' among the identified growth drivers the company is trying to capitalise on.
What would change our view
- Unattractive→AttractiveThe wave proves not to be a wave, at a price nearer the comparable
It needs all of:
- ○Box sales keep growing above 30% through 2027, past the wave's window, or rent growth tops 16% for two quarters running.checked at the next results, due by 11 Feb
- ○The company's value, debt included, falls to about 28 times yearly operating profit, most of the way toward Check Point's roughly 19.about ≈$96.24 today, 46% below the last close
- Reopens the researchThe billings growth is shown to be volume, not price
It needs:
- ○Fortinet shows that more boxes shipped, not higher prices, drove second-half billings growth.checked at the next results, due by 11 Feb
We would also be wrong if
- Its cloud security and factory-network billings keep growing above 50% for a full year.
- Operating margin holds above 33% even as box growth falls below 20%.
What is coming
- November 2026 Q3 2026 results: Whether product growth falls toward the roughly 18.5% the guidance implies for the second half while service growth climbs toward 14%, or the guide is raised a third time.
Every dated event ahead
- November 2026 Q3 2026 results: Whether product growth falls toward the roughly 18.5% the guidance implies for the second half while service growth climbs toward 14%, or the guide is raised a third time.
- February 2027 Q4 and full-year 2026 results, with 2027 guidance: Whether the 2027 outlook plans for appliance revenue to fall back after the replacement wave, and whether service growth keeps rising into the year.
- 28 February 2027 Share repurchase authorisation expires: Whether the board renews the buyback at today's price after buying nothing in May and June, which tests the reading that it buys only when the stock is cheap.
Since we wrote this
- 29 OctEarningsFortinet's call: price rises and spent stock lifted hardware; services slip to 2027. View heldQ3 2026 results.
- 28 OctEarningsProduct growth 36.8%, year raised again; view heldThe replacement wave lasted longer than our case allowed, but the price still pays for it being permanent; Unattractive and Medium hold, with conviction on watch.
- 5 OctThesis reviewThe long case now sits under the verdictAfter the five-name pilot, the owner asked for the long case on every thesis.
- 4 OctThesis reviewOwner's checklist: revenue streams, cost of growth, management, catalystsThe owner's checklist found the method silent on who runs the company, what growth costs, where the money comes from and what is dated ahead; this pass fills those four blocks from the proxy and filings.
- 24 SepPrice movePrice figures updated after a 13.5% rise. View heldThe rise took the price to about $52 for each dollar of operating profit, from about $45. Nothing about the business was read, and the move pushes the way the view already points.
- 8 SepThesis writtenUnattractive, medium convictionWritten six weeks after June's results, with the shares nearly doubled on a hardware surge that Fortinet's own guidance slows by more than half.
Also checked 1 time with nothing new to act on.
Sources 19
Sources - 19
Every claim above cites one of these, or states the reasoning that derived it. The quote is frozen at the date it was read: a link can rot, and an agent fetch returns a reading of a page rather than the page. Backs counts the whole claim ledger, so it can name a claim this page does not surface.
- S01primarycompany filing2026-02-25Item 1 business and the named competitor list, the revenue disaggregation for 2023-2025, the contract manufacturing and ASIC supply disclosure, and the risk factors including product refresh cycles as a stated growth driverbacksC01C03C04C13C50C51C52
- S02primarycompany filing2026-08-05the service revenue split, remaining performance obligations, the distributor concentration table, the geographic split, the monthly share repurchase table and the senior notes maturity schedulebacksC02C20C22C24C25C40C45C46
- S03primarycompany release2026-07-29the income statement, balance sheet and cash flow statement for the quarter and half, the GAAP to non-GAAP reconciliation, and the raised Q3 and full-year 2026 guidancebacksC02C03C04C10C11C12C18C19C21C22C23C41C51
- S04primarytranscript2026-07-29the billings growth by pillar, the price-increase contribution to second-half billings, management's five-year appliance life and its case that the growth is more than a refresh, and six analyst questions of which the first two were about durability
We have approximately high single-digit impact built into our billings assumptions for the second half.
backsC06C08C09C14C19C23C32C33C41 - S05primarycompany release2026-02-05the original full-year 2026 guidance issued in February 2026, against which the July raise is measuredbacksC18
- S06primarycompany filing2023-02-24product and service revenue for 2020, 2021 and 2022 - the previous appliance buying wave, five years before the current onebacksC05C51
- S07primarycompany release2026-09-01a competitor's own filed appliance revenue, product gross margin and GAAP operating income - the benchmark Fortinet's cost position is measured against, struck by a party with the opposite incentivebacksC10C11C12
- S08primarycompany filing2025-08-29the competitor's own description of its hardware next-generation firewalls and its cloud-delivered single-vendor SASE - the two products that attack Fortinet from both sidesbacksC17
- S09primarycompany filing2026-03-31the competing gateway range and the throughput axis buyers compare on, and a listed pure-play's growth rate as an outside read on how fast the market itself is movingbacksC30
- S10primarycompany filing2026-09-03the attacker's own description of appliance-free inline inspection, and its own statement of why customers do not abandon appliance architecturesbacksC15C16
- S11primarygovernment data2022-12-14the date from which national cybersecurity risk-management measures became applicable across the European Union, taken from the directive itself rather than from a summary of it
By 17 October 2024, Member States shall adopt and publish the measures necessary to comply with this Directive. They shall immediately inform the Commission thereof. They shall apply those measures from 18 October 2024.
backsC31 - S12primaryvendor data2026-09-08Research pack, FTNT, frozen at content/FTNT/research-pack.jsoncontent/FTNT/research-pack.jsonprice and the return series, the market value, the trailing multiples against the company's own six-year medians, the analyst split, short interest and the filed competitor cohortbacksC37C45
- S13primarycompany filing2026-08-04the transaction codes, the prices and the Rule 10b5-1 flag behind the aggregate insider figures in the packbacksC35
- S14primarygovernment data2022-12-14the size of the penalty behind the regulatory driver - the number that makes compliance spending non-optional rather than advisory
essential entities are subject, in accordance with paragraphs 2 and 3 of this Article, to administrative fines of a maximum of at least EUR 10 000 000 or of a maximum of at least 2 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the essential entity belongs, whichever is higher.
backsC31 - S15primarygovernment data2022-12-14the route by which the prize could one day be composed - the registers exist by law, and no member state publishes an aggregate count from them
By 17 April 2025, Member States shall establish a list of essential and important entities as well as entities providing domain name registration services.
backsC31 - S16primaryvendor data2026-09-24Research pack, FTNT, refreshed 2026-09-24 (last completed session 2026-09-23)content/FTNT/research-pack.jsonThe 2026-09-23 close of $178.74 and the 252-session return of 110.3% to it; the 7 May 2026 session in the price history; trailing revenue of $7,527.4M; the trailing sales and earnings multiples on the vendor's market value at fetch time (17.5 and 62.8, struck intraday on 2026-09-24) against their six-year medians of 9.1 and 43.4; and the filed competitor cohort, in which Check Point's company value is 19.3 times its operating profit.backsC27C28C29
- S17secondaryvendor data2026-09-24Market value of $131,760.3M at a price of $179.58, a share count of 733.7M, used to strike the market value at the 2026-09-23 close ($131,144.0M) rather than at an intraday price.backsC28C29
- S18primarycompany filing2026-04-29beneficial ownership as of 31 March 2026, the executive officers and their tenure, the 2025 bonus program's metrics, weights and payout, and the RSU and relative-TSR PSU designbacksC47C48C49
- S19primarycompany release2026-10-28the Q3 2026 income statement, product and service revenue, billings, free cash flow, the raised buyback authorisation and the Q4 and full-year 2026 guidancebacksC04C53