Updates - Fortinet 2Q22 - Early Signs Of Macro Headwinds But Long-Term Sound
hapabapa
No Great News = Bad News
The headline for FTNT does not look great. Fortinet falls 16% as outlook drags down security stocks (NASDAQ:FTNT) Posting a no surprise ER, in a time when investors are in the risk-off mode, triggered a selloff in the shares of more than 16%. We continue to see a wide slash in valuations for software and tech names in general. Although we believe FTNT's results for this quarter show continued strength, apparently it is not good enough to induce a risk-on sentiment in the way NET did.
Our insight here is that investors should keep the big picture in mind while the majority of investors are chasing the fad. The earnings call was of the archetypical form whereby analysts focus mostly on asking questions about non-strategic matters so they can tweak their short-term models. As the adage goes, 'the devil is in the detail', so such lines of inquiry have their place, but for us it definitively shows that,
A. Investors are increasingly cautious and concerned about macro headwinds.
B. Investors are looking for short-term results and are hyper reactive to changes which may or may not be a good indicator of long-term results.
C. Analysts are focusing on fine tuning their models ready for the next quarter instead of thinking about strategic vision and execution.
We sense that this short-term perspective is more prevalent across less-covered stocks and/or companies with less buzz around the long-term vision.
Alpha opportunity from better understanding of the business
Both revenue and EPS were inline with the consensus. However, management provided soft guidance citing longer sales cycles to land deals, and possible short-term headwinds to service revenue.
Subsequently, analysts became deeply worried about the demand for the next quarter, asking if the refreshment cycle has ended (hence product revenue's 54% growth in last quarter didn't continue), if the weak guidance is an indicator that the business is turning, if seasonality and backlog factors are abnormal as they fish for data points to update their model (another indicator of weak sentiment and less caring of product fundamentals).
Thus, we believe an update on FTNT's fundamentals is useful for investors to gain an edge over street analysts who are overly focused on very short-term results.
Fortinet, Inc. (FTNT) Charting
Vision and Execution
A key to FTNT's strong investor returns for the past couple of years has been its durability of growth with strong profitability. There isn't that many companies who can keep c. 30% growth for several years after it was founded more than a decade ago while keeping the operating margin at 20%+, creating huge numbers of new products with modest R&D spending, and returning high amounts of cash via buybacks.
We continue to like FTNT's "always day-one" vision of where the market is heading and invest in R&D resources to develop home-grown BoB solutions. Furthermore, this is empowered by a unique set of talent with ASIC and hardware know-how (rare in the software-centric world), a strong footprint in Canada and China and the rest of the world (to lower costs), and an engineering culture that focuses on building new solutions quickly and efficiently. All of these result in better shareholder returns.
FTNT breaks down its product offerings into one network security platform, and four adjacencies including networking, ZTA, cloud security, and SecOps. We will briefly discuss each in the next sections.
Security and Networking
One particular visionary move that we saw from FTNT is its venture into SD-WAN. Back in 2019, FTNT was mostly a SMB-focused NGFW vendor. Unlike many other cohorts like Sophos, however, FTNT continues to innovate and target bigger markets. In this case, they saw the forthcoming SD-WAN opportunity was brewing. FTNT correctly foresaw the strategic importance of SD-WAN as the final piece of CPE (Client Premise Equipment) required, and a value-add to its existing NGFW business. We believe this continues to be a multi-year theme to unfold and evolve.
Why? If SD-WAN is going to be the future, it could be the only WAN Edge CPE required for many enterprises. You don't need a dedicated NGFW, load balancer, application steering device etc., - numerous boxes chained together in the server room. Instead, these individual networking functions can be virtualized (Network Function Virtualization, or NFV) and run as independent software within the single SD-WAN box. This is not only for inside out but also for Telcos, who service tremendous amounts of users. It could eliminate the need for multiple hardware installations, time-consuming maintenance, and reserve precious space in cellular towers. Should SD-WAN continue its strong momentum, NGFW vendors could get smoothed out in the future. FTNT is the only vendor able to envision this great opportunity early on, while PANW only played catch up in 2020 by acquiring CloudGenix, a second-tier software-focused SD-WAN vendor during the liquidity crisis.
Furthermore, the foundational technology behind SD-WAN is the IPSec tunnel that allows enterprises to get rid of pricey MPLS and instead procure commercial broadband connectivity for their WAN. Coincidentally, IPSec acceleration is a key part of FTNT's ASIC, and therefore, with simple code changes, FortiGate NGFW can turn into powerful SD-WAN CPE offering IPSec throughput at orders of magnitude more scale than a similarly priced x86-based COTS (Commodity Off-The-Shelf) CPE.
When FTNT entered space, there wasn't too much hope priced-in to this greenfield opportunity. The space was crowded with both networking incumbents and startups. Incumbents like CSCO acquired BoB leader Viptela and was cross selling aggressively in their huge sales distribution network. VMW acquired VeloCloud, the second BoB leader behind Viptela, known for its white label COTS CPE and advanced SD-WAN operating system and upper application stack. Standalone startups such as Silver Peak were considered to be the de facto leader due to being early in the game with best-in-class networking performance.
Cisco Named a Leader in the 2018 Gartner Magic Quadrant for the WAN Edge Infrastructure
FTNT as a security-focused vendor without much of a software-defined footprint was considered a second-tier player. However, FTNT has been smart in leveraging its huge base of existing FortiGates, hardware talents, and ASIC R&D. In the subsequent updates of FortiOS 5, FTNT provided SD-WAN functionality as a free addon to all existing upgradable devices. Then, existing users of FortiGate could turn the NGFW into a cutting-edge router with great performance efficiency due to ASIC acceleration.
Furthermore, with NGFW serving as the router (SD-WAN), FTNT eliminates the operational overhead associated with tuning NGFW together with router and various networking devices. Making things even more appealing for enterprises, SD-WAN allows for zero touch provisioning, which means that in many branches, enterprises could ship one FTNT box, and let non-technical employees plug in and within one click, the NOC & SOC operator could manage thousands of SD-WAN + NGFW devices at the same time. This has proven to be a strong selling point during COVID-19 as it lowers down the cost, allows for greater safety when physical work is minimized, and increases the networking performance while keeping the security standard intact.
Thus, SD-WAN activates FTNT's second S-curve and creates another growth boost outside of its core security business. Historically, security vendors are not good at doing the networking, and this applies vice versa. However, with strong home-grown engineering expertise, over time FTNT has been able to bring in BoB networking functions, integrate it with BoB NGFW, and offer the bundle at a low cost, while delivering substantially faster performance.
Aside from SD-WAN, FTNT also has been seeding its own networking infrastructure hardware such as switch, WiFi AP, Cellular extender, NAC, and phone line. These solutions are mostly on par or less mature relative to incumbents due to FTNT's smaller scale. However, it is amazing that FTNT is able to develop these solutions with very little R&D. In some niche technologies such as WiFi and low power SOC for compact devices, FTNT has the best technology out there but thus far has not sold it aggressively.
However, with its success in SD-WAN, and an increase in demand for lower cost, and integrative solutions, FTNT's investment in these areas has started to compound. In particular, FTNT's solution in the OT (Operational Technology) space leads the rest of competition by at least three years or longer. This is thanks to its investment in WiFi AP, extender, and branch form factor, FTNT is able to pack all functions required for one branch into a SOC chip and provide it in a SD-WAN box. This means that the end user no longer needs to buy multiple devices, power them with enough power supply, and manage them. This is especially valuable for OT use cases as security, flexibility, and agility is a key concern in many production environments.
Furthermore, with unified hardware, FTNT is able to offer and sell more back office operational software tools. In particular, its FortiManager and FortiAnalyze allows NOC and SOC to remotely manage and analyze a fleet of devices very efficiently, which is super important in the post COVID era.
Similar to the emergence of DevOps, and now DevSecOps whereby multiple function teams are tightly coupled together, Network Operation (NetOps) and Security Operation (SecOps) are growingly coupled together. The clearest value proposition here is that the sources of intelligence over network and security are merging together due to SD-WAN and proliferation of NOC & SOC tools. Take SD-WAN for example, in order to increase the performance of networking, you need to gain application level insight into packets. This application awareness is both important for networking and security. SOC analysts want to know who are using the application for what purpose to better protection the network. NOC analysts want to leverage this contextual insight to better optimize the network performance.
Furthermore, numerous customer solutions built by scripts were replaced by vendor’s software as a service products. This allows NOC and SOC to reduce the headcount and allow one analysts to handle more workloads. Therefore, we believe FTNT also has very strong value proposition here to provide the NOC and SOC product with the best security built-in.
Therefore, we are not surprised to see that networking revenue is becoming 1/3 of FTNT's revenue, growing 2x faster than its security revenue due to smaller revenue base, and superior ROI and competitiveness against incumbents. We believe this is the powerful revenue driver for FTNT as the market TAM is c. $80bn while there is a huge gap between FTNT's current penetration versus what it should be. Furthermore, as street analysts don't even cover FTNT's security product suite too well, its networking products are further left in the dust. Therefore, should our thesis hold, FTNT's growth has just started and its growth runway continues to be greater than a normal security vendor.
ZTNA
Zero Trust, Cloud Security, and SecOps are adjacencies that FTNT naturally expands into, in a similar vein to PANW.
Here we highlight FTNT's FortiSASE solution, which has competitive advantages over incumbents like ZS because of:
- A cleaner-slate, microservice-based architecture acquired from Opaq Security.
- Similar to ZS, colocation-based infrastructure offers strong cost advantages over others that operate on public clouds.
- Strong cost advantages enabled by FortiGate being hosted in Equinix colocation data centres. In theory, this means that FTNT can offer the same security screening service at 1/5 of the cost while maintaining the same c. 75% GM.
- Highly flexible deployment options, best optimized for every possible use case.
The fourth point is another testament that FTNT's management remains highly visionary. Back when Gartner first proposed the concept of SASE, FTNT wasn't manipulated in chasing the hype and refrained from implementing it strictly to the Gartner standard/definition. Instead, FTNT correctly articulated the continued need for edge devices on-prem, and therefore, its SASE architecture is a mixture of cloud-delivered and edge on-prem-delivered. This allows customers to have the best latency as the closest PoP for most enterprises would be their branch FortiGate instead of colocation data centres that are closer than cloud DC but still far away from employees.
We were surprised that Gartner didn't even notice FTNT's vision and sound justification, and had only created a new name for this architecture called Cybersecurity Mesh Platform in 2021. Fortinet Security Fabric: The Industry’s Highest-performing Cybersecurity Mesh Platform
From this perspective, FTNT is the best vendor to deliver ZTNA and SASE service to customers as it owns every possible breakout including branch office CPE, home CPE, colocation DC, enterprise DC, and public cloud. Other vendors such as ZS or PANW either lack on-prem or colocation footprint.
The caveat for FTNT's SASE solution, however, is that because FTNT runs so many product lines, it doesn't focus that much on GTM. As a result, although FTNT holds the best theoretical model for SASE, a majority of customers go to ZS's SASE with simpler to understand architecture and better focused marketing. Furthermore, with lower adoption, FTNT isn't able to bring in huge amounts of PoPs on time. With colocation, FTNT should have been able to bring in <50ms for global users via building small PoP in all major cities. However, FTNT chose to only offer 1-2 PoP for one country in the most populated area. This is even 1/10 smaller than Netskope, who started its colocation in a similar time frame, and ventured into network security only around 2019.
Therefore, our overall impression of FTNT's ZTNA and SASE potential is that it holds great assets, but don't expect it to contribute meaningful growth upside as the product line grows roughly at the same pace with its core network security business.
SecOps
This is another huge area where FTNT has strong leverage to take on existing incumbents, but due to wide product line, we don't think it is going to be a material growth driver.
The most significant edge for FTNT in the space of SecOps, and to a lesser extent NOC, cloud security, and ZTA, is its potential to be the single orchestration layer for multiple hardware and software products.
FTNT has a good SecOps portfolio including XDR, managed services, security training, remediation and response, and attack surface management. With contextual enrichment from FortiGate and related networking products, FTNT has a great data source on par with the best players such as Lacework (a report coming soon) and PANW.
FTNT also has barebone level cloud security capabilities including DevSecOps (shift-left), CWP, CASB, and strong WAF, ADC, GSLB, and NGFW thanks to its hardware root.
Most notably, it also has very compelling networking software services that are maturing alongside its growing SD-WAN and network infrastructure hardware portfolio.
With these diverse sets of solutions under one cover, it should be very easy for FTNT to either build its own data lake or source COTS solutions from DataBricks or SNOW. It is part of FTNT's future vision that all of these would be combined and correlated by an AI/ML engine. We believe FTNT can at least grow this type of service to be on par with the quality of its existing security portfolio. It would continue to support FTNT's future runway and sustain durable growth, but not likely to generate incremental growth in the same way that the networking business is doing.
Investment Potential
To conclude, we continue to love FTNT for its unrivaled ability to continue to grow at c. 30% at a high revenue base, high operating margin, and long years into the business.
The key catalysts include converged security/networking demand, vendor consolidation, hybrid environments, and an increasingly sophisticated threat landscape. These catalysts are driving the continued impressive sales performance among the enterprise sector. In 2Q22, large enterprise YoY bookings growth was 55%, and the number of deals worth $1m or more increased 50% YoY. These drivers combined with hot areas like SD-WAN, ZTNA, and SecOps, will offer FTNT durable growth in the coming quarters, and even years ahead.
/content/files/static-files/2d21430a-2c22-4b9d-b7f5-3f4bdaa420b6.pdf
Furthermore, with its strong homegrown engineering capability, FTNT is able to bring up the latest solutions on par with rivals at lower costs. It remains the most diversified name in the cybersecurity, both in terms product portfolio and geography.
We believe that, irrespective of macro headwind, FTNT's long term runway is ever expanding.
- Its core firewall shipment will continue to gain market share and dominate.
- Its networking products are highly competitive and will continue to grow via taking market share against incumbents.
- Its adjacencies will continue to support the core and elevate the revenue growth CAGR at 25%+.
In discussing the valuation, we have to highlight the recent macro headwinds and volatilities. Technically FTNT shouldn't be hugely impacted by the weakening demand because it has diversified into enterprise, shows greater growth in EMEA and APAJ to support weaker NA business, and has a broad base of cost-effective products that should see sustained demand in a mild recession as the demand for maximum value within performance-cost continues to grow. However, the delays in recognition of service revenue and the disclosure of lengthening sales cycles, as discussed in the earnings call, might be early signals that customers are postponing projects and dragging their heels, and hence investors should not be surprised if FTNT experienced a slow down in growth in the midst of an economic downturn.
Multiples
Fortinet, Inc. (FTNT) Charting
Before pandemic, FTNT, CHKP, and PANW, the FW Trio, were trading at a similar EV/S band (c. 6x - 8x revenue). After the pandemic hit, PANW and FTNT outperformed CHKP in both revenue growth and multiple expansions. From the tactical allocation perspective, PANW is relatively undervalued vs FTNT as the market looks more for profitability and organic growth narratives.
In the recent sell off however, FTNT and PANW's EV/S are converging together again. If we are going to see a come back to pre-pandemic multiples, then both names could have c. 25% more to decline.
From the long-term guidance perspective, if FY25 revenue is at $8bn, and we assign an arbitrary 7x EV/S multiple (historical average of CHKP) and discount it back to the present at 10% discount rate, we would arrive at an EV of about $42bn, which is around where FTNT is right now.
Fortinet, Inc. (FTNT) Valuation
DCF Valuation
From the pure DCF valuation perspective, based on what we believe are conservative growth, FCF margin, and discount rate parameters, we've arrived at an EV that is about 1.5x what the market is currently pricing in. This means that from our perspective, both FTNT and PANW's higher-than-pre-pandemic multiples are justified and they should be able to sustain the multiples, and expand them in conjunction with increasing market optimimism (whenever that may occur) due to the heightened awareness and positive long-term tailwinds pertaining to digital transformation, and the subsequent demand for security that has been structually underinvested for multiple decades.
Our shortcut DCF update has produced an intrinsic EV of c. $59bn. We predict FTNT should easily beat its FY25 $8bn revenue target one year in advance. Compared to FTNT's current EV of $42bn, this represents 40% upside, based on conservative parameters.
To summarize this section:
- We believe the near-term FTNT uncertainty has been heightened but to speculate when and how the demand is going to shift is a low alpha strategy.
- However, we do have continued conviction into FTNT's longer-term demand and fundamentals. Should both FTNT's and PANW's EV/S multiples revert back to pre-pandemic levels, investors should further capitalize on the opportunity.
- For now, FTNT is attractively valued, not at a huge discount but not at the bubble phase either.
- It is worth investors to continue to hold it in the long term portfolio.
