Fortinet (FTNT) stock tanked AGAIN on a miss in billings last quarter, and a less than rosy outlook through the first half of 2024 didn’t. Does that mean Chip Stock Investor is done with Fortinet stock, one of our top cybersecurity positions?
Not necessarily. The company’s earnings call shed some light on the business strategy going forward that has stopped us from hitting the “sell” button.
Fortinet (FTNT) stock is having another post-earnings disaster!
Q3 2023 was solid enough, mostly in-line with expectations that we’ve been projecting (based on management guidance) for over a year now: lower product growth (firewall appliances, like for data centers and remote branch offices), but supporting consistent services growth.
It was once again guidance that tanked the stock for the second quarter in a row.
Fortinet is a top cybersecurity company, the second largest pure-play in the industry (by revenue and market cap) after Palo Alto Networks (PANW), both of these we own and make up by far the bulk of our bets on cybersecurity. Fortinet historically plays in the “Network Security” category, as has PANW, and Fortinet has been a standout long-time winner because of its custom-designed “Secure Processing Unit” (SPU) chips used in its firewalls – a piece of hardware, really a specialized server, used to secure things like a business branch office or location, or a data center. (This is why it’s a Chip Stock Investor favorite.)
But Fortinet is making a pivot towards that “Cloud Security” segment, more on that momentarily.
First some context for that stock price. We know that if you bought Fortinet recently, what just happened is incredibly painful. We aren’t immune, and don’t enjoy seeing our investments decline. That said, the share price is merely back to the same level where it was at the start of 2023, and at the same level of summer 2021. This is normal growth stock behavior, and certainly good performance considering (TWO!) “bear markets” in three years. This is why it’s important to diversify (individual stock prices are highly volatile), and important to build a position over time – perhaps even over the course of several years.
Ok, now the high-level numbers for Q3 2023:
- Revenue was up 16% YoY to $1.33 billion (3-year and 14-year CAGR of 27%)
- Service revenue: +28% YoY to $869 million (compared to 3-year and 14-year CAGR of about 27%, and driven by 34% growth in higher-margin security subscriptions which represents 57% of total service revenue)
- Product revenue: -0.6% YoY to $466 million (compared to 3-year CAGR of 28%)
- GAAP operating margin 22.7% vs 23.1% in Q3 2022
- Adj operating margin 27.8% vs 28.3% in Q3 2022
- GAAP EPS of $0.41 vs $0.29 in Q3 2022 (share count reduced by nearly 1% YoY)
- Adj EPS of $0.41 vs $0.33 in Q3 2022
- Free cash flow $481 million (36% FCF margin) vs $395 million in Q3 2022 (34% FCF margin)
The reason for the stock performance is management (co-founder and CEO Ken Xie, who started Fortinet in the mid-2000s after selling another of his startups to Juniper Networks, and CFO Keith Jensen) missed their own guidance for billings – which were $1.49 billion in Q3, versus the guide three months ago for $1.56 billion to $1.62 billion. (Billings are the value of invoices sent to customers.) Billings in Q4 are expected to be ~negative 5% compared to Q4 2022 ($1.7 billion last year to be exact). Deferred revenue (money collected from customers but not yet realized as service has not yet been delivered) did jump 26% YoY to $5.29 billion.
2023
However, the big takeaway from guidance is Fortinet will be a single-digit-percentage revenue growth business through at least Q2 2024. Blame the sudden falloff in product sales, especially firewalls which accompany networking devices due to the pandemic era spending spree, as well as a slowdown in services as large customers hold up on spending to manage their own cash flow.
But is something wrong? Is this now an ex-growth business, or is this a lull? After all, global cybersecurity industry spend is expected to be a low-teens-growth market for years and will pass up ½ trillion dollars per annum (our estimate) at some point, we think by the end of the decade.
Is Fortinet now going to get left behind after years of outperformance?
Ken Xie provided some great context, and we learned some new things about Fortinet during this call. Management was remaining mum on some of these topics up to this point, for obviously market competition reasons, but now we know some more details.
Network security, as we knew already, was the majority of FTNT revenue, but it was revealed to be 70% specifically in Q3 2023, or ~$930 million. This is the category that is tanking guidance, at least for the near-term, as customers ingest all that expanded network capacity they built starting in 2020. FTNT is pivoting its sales teams away from this for the time being. HOWEVER, Xie said on the earnings call that “the secure networking market is valued at $62 billion and is projected to increase high single digits annually to $86 billion by 2027.”
It’s still a growth industry, but a cyclical one. Sound familiar??? It’s a semiconductor stock!
In contrast, the Cloud Security (software) segment FTNT is pivoting towards, SecOps and SASE (pronounced “sassy,” a term coined by tech researcher Gartner in 2019, which stands for “secure access service edge”) will grow much faster.
Another quote from co-founder and CEO Ken Xie, “…SecOps is a $46 billion market growing at mid-teens annually to $78 billion by 2027. Fortinet’s SecOps platform is comprehensive and integrated, offering EDR, SIEM, SOAR, NDR and other integrated solutions.” Google Cloud made a key acquisition in this space, Mandiant (formerly FireEye). Cisco is also purchasing Splunk (SPLK), which also does a lot in this area with its SIEM and cloud observability software.
Xie continues, “…SASE, a $17 billion market expected to grow at a 20% compound annual growth rate to $36 billion by 2027. We believe Fortinet is the only company with a SASE service solution that can perform all functions in the Cloud or in an appliance all with a common operating system, including full networking and security stack, market-leading SD-WAN [software-defined wide-area network] offering ZTNA [zero trust network access, or sometimes referred to as zero trust architecture, basically those annoying prompts to enter your password or push notification to verify identity all the time] and management console. Our SASE service solution is supported by Google Cloud, with over 100 worldwide SASE Cloud locations together with our own 30-plus points of presence [POPs] and data centers.”
This is how we explain the difference between traditional (network, via hardware like a firewall) and cloud (software) cybersecurity at Chip Stock Investor. Cloud security (like SASE, ZTNA, etc.) are in support of new cybersecurity services where employees can be logging in from anywhere. So new security we like to describe is more like a counter-spy or counterintelligence agency. That contrasts with traditional cybersecurity which acts more like a castle and moat where employees only login from a branch office. In this post-pandemic world, there’s a place for both security architectures, but the counter-intelligence model is the clear growth market now that network capacity has been upgraded en masse.
In mid-October, FTNT had prepped us for this SASE pivot, announcing that expansion of POPs (simply, having hardware installed in a local data center for routing customer traffic). We shared our article about this on our YT channel community board: https://www.fool.com/investing/2023/10/19/fortinet-is-building-a-new-cybersecurity-service-w/
We think this is huge as FTNT leans into SASE and SecOps. But here’s the new data point. SASE was 20% of biz in Q3 (~$260 million revenue) and SecOps 10% (~$130 million). SASE in particular is much bigger than we thought. This competes, with PANW, the leader in single-vendor SASE, as well as upstart Zscaler (ZS), which is more of a secure service edge (SSE) than it is SASE, but that’s a topic for another time. Here’s a link to where you can see that Magic Quadrant: https://www.fortinet.com/solutions/gartner-magic-quadrant-single-vendor-sase
If you’re curious, here’s Gartner’s definition of SSE, vs SASE listed further up: https://www.gartner.com/en/information-technology/glossary/security-service-edge-sse
FTNT Management believes it can win by upselling its networking customers. Plus, those custom chips that power those networks will now be powering the new SASE service. We think this is again a big differentiator, especially vs ZS which tends to use off-the-shelf servers for its offering.
The overall outlook in the years ahead:
CFO, Keith Jensen: “Secure Networking, which currently accounts for 70% of our business, is expected to experience lower growth following 2 years of very robust growth. As a result, for the near term, we expect to deliver healthy profitability along with more modest growth. With execution and continued investment in the SASE and SecOps markets, we believe we can return to delivering mid-to-high teens top level growth — top line growth and while continuing to deliver operating margins of 25% or greater. In other words, a return to balance growth and profitability, which has led us to achieve the Rule of 40 status in 12 of 15 years, as shown on Slide 19.”
In short, slower growth for a while, but faster-expanding profit margins.
Can Fortinet pull it off?
The risk is no, this is now an ex-growth business, and that’s why the market has begun (emphasis here, it’s only begun) discounting the stock.
That being said, FTNT has been here before. Because we think business investment, and thus stock investment, should be measured over the course of many years, let’s go back a decade. FTNT had its IPO in 2009 and had a great run following the easing of the Great Financial Crisis. But look at the Q4 2014 revenue breakdown: $224 million, about a 50/50 split between product and services. Compare that to today where service is now 65% of the total.
FTNT is mostly an organic grower, vs PANW which went on that acquisition spree when Nikesh Arora took over in 2018 (around the time we started buying both of these stocks). The company has done a brilliant job. Look at the small scope of its products and services nearly 10 years ago. It’s grown both, and because it’s organic, it has those superb profit and FCF margins. But during the mid-2010s when it was embarking on new product and service expansion, revenue growth and FCF margin expansion slowed. We are in the midst of that happening again.
Maybe some strategic acquisitions will accelerate SASE expansion, but we would prefer FTNT to continue focusing on organic growth. That’s what they have done best.
The stock buyback increase is a good sign, as mentioned earlier. See the incremental $100 million step-up in buybacks this last quarter to about $600 million, vs $500 million last year? Management is buying the dip.
The stock does trade for 35 times TTM EPS, though. On an FCF basis, it’s just under 20 times TTM FCF. Are shares reasonably valued? Yes, but only if Fortinet can re-accelerate its overall growth by the second half of 2024, as the outlook currently states. Clearly the miss the last two quarters isn’t great. But cycles like this aren’t unusual (PANW had something similar a few years back), and the current Fed-driven-high-interest-rate economy is anything but normal or healthy, in our opinion. But neither was the Fed-driven-zero-interest-rate economy of last decade.
To be absolutely certain, FTNT deserves monitoring over the next year to see if positive progress is being made. But what else is new? This is the name of the game with investing in individual stocks. We still believe FTNT has the right mix of more gradual growth, expanding profit margins, and cash return to shareholders (via buybacks for now) to be a superb long-term compound grower. We aren’t adding here, but we already had a full position. If there are further bumps in the next few quarters, we might consider upping our investment.