Product Revenue +41% Reprices the Stock in a Single Session; the Company's Own Guide Halves That Growth by H2

Results vs. Consensus

Fortinet reported after the close on May 6, 2026 and held its call at 4:30 p.m. ET. The quarter cleared consensus on every line that has one and cleared its own guidance on every line the company guides.

Q1 2026 Scorecard

Where no published two-source consensus exists, the company's own February guidance is the more honest bar. On that basis the quarter was not a modest beat but a rout.

Q1 2026 vs. Company Guidance (issued February 5, 2026)

Year-over-Year Comparison

Sequential Comparison

Q1 is Fortinet's seasonal trough and Q4 its peak, so the sequential declines below are normal in direction. What matters is their depth against last year's.

The seasonality comparison is the most underappreciated datapoint in the release. A year ago Fortinet gave back 7.3% of revenue and 20.2% of billings stepping from Q4 into Q1. This year it gave back 2.9% and 12.0%. That is a demand curve bending upward inside the seasonal pattern, not a one-quarter order-timing artifact.

Revenue

Total revenue of $1,849.6M grew 20.1%, the first 20% quarter since the last hardware cycle and a clear break from the 14.4% and 14.8% posted in the prior two quarters. The composition is what makes it a thesis event rather than a beat: product revenue of $645.1M grew 40.5% and moved from 29.8% of the mix to 34.9%, a 506bp shift in a single year. Service revenue grew 11.5%, which is the deferred-revenue engine working through last year's slower bookings and lagging by design.

Three sourced drivers sit behind the product line. AI infrastructure deployments produced two of the four seven-figure wins the CFO detailed, one a GPU-compute cloud provider securing a new AI data center and one a Middle East AI data center project for a generative-AI company. Operational technology billings grew "over 70%" as industrial and critical-infrastructure operators bought segmentation. And a technology refresh cycle is running through the installed base, with FortiOS 8.0 and two new high-end FortiGate models announced the same day as the print. Layered on top is a low-single-digit pricing contribution driven by memory costs.

The comparison that gives the number weight is external. Check Point reported Q1 2026 on April 30 with product revenue down 3% year over year, against +14% in the year-ago period, and attributed the shortfall to firewall appliances. Two firewall vendors in the same quarter, one at +41% and one at -3%, is not a market phenomenon. It is a share transfer, and the most likely mechanism is exactly the one Fortinet has argued for a decade: in-house ASICs and a directly managed manufacturing chain are worth the most when components are scarce and performance per watt is scarce.

Margins

GAAP gross margin of 80.3% was 67bp below the year-ago 81.0%, and the entire decline is mix. Both segments improved: product gross margin rose 36bp to 67.7% and service gross margin rose 28bp to 87.0%. The blended figure fell only because the 67.7% line grew 40.5% while the 87.0% line grew 11.5%. That is the arithmetic of a good problem, and it is worth flagging for the model, because as long as product leads, reported gross margin compresses even while both underlying margins expand.

Operating leverage did the rest. Operating expenses grew 14.2% against 20.1% revenue growth, taking the opex ratio from 51.5% to 48.9%. Within that, sales and marketing grew 17.2%, R&D grew 7.8%, and G&A shrank 2.8%. Non-GAAP operating margin of 35.8% was a first-quarter record and 380bp above the guidance high end. Note the internal tension: R&D at 11.6% of revenue is the lowest quarterly ratio in this dataset, which flatters the current margin and is not obviously the right posture in a year management is describing as an architectural inflection.

EPS and cash

Non-GAAP diluted EPS of $0.82 grew 41.4% and GAAP diluted EPS of $0.72 grew 28.6%, both comfortably outpacing revenue. The gap between the two growth rates is the non-GAAP add-back mix: the prior-year quarter carried a $39.9M gain on bargain purchase and a $10.8M equity-method gain that were both subtracted from non-GAAP net income, making the year-ago non-GAAP base of $0.58 unusually low relative to its $0.56 GAAP figure. Readers comparing the two headline growth rates should anchor on the GAAP number.

Cash generation is where the quarter is least ambiguous. Operating cash flow of $1,077.1M and free cash flow of $1,006.5M were both records, with a 54.4% free cash flow margin against 50.8% a year ago. The largest single contributor was a $235.7M deferred-revenue build, which is the billings beat showing up on the balance sheet rather than in the income statement, plus a $205.2M receivables release. Fortinet exited the quarter with $3,634.6M of cash and investments against $496.8M of long-term debt, having spent $823.0M on buybacks and retired $500.0M of senior notes in the same three months.

Segment Performance

Fortinet reports revenue in two lines, product and service. The three-pillar architecture management runs the business on, secure networking, unified SASE, and AI-driven security operations, is disclosed only as billings growth on the call and in the slide deck, never as revenue in the filings. Both views are shown below; the revenue table is the filed one and governs.

Reported revenue lines

Billings by pillar (management-disclosed growth rates)

Product / Secure Networking

This is the quarter's engine and the reason the stock moved. Product revenue of $645.1M grew 40.5%, and secure networking billings grew 32%. The demand is coming from three places that did not all exist a year ago: AI data center perimeters and east-west segmentation, operational technology, and a high-end appliance refresh into FortiOS 8.0. The CEO's framing is that hardware differentiation, dismissed as a legacy liability through the cloud-first years, is now the scarce asset.

"if you look at the Fortinet technology, we are the only cybersecurity company that build their own ASIC chip from day 1. So that gives us much better performance and lower cost, both on the computing power cost and also energy cost and also feed all these data center internal segmentation development quite well." — Ken Xie, Founder, Chairman and CEO

Fortinet quantified the claim as roughly "3 to 5x better performance for the same cost, same function and much lower energy consumption" across the top ten functions, and separately claimed "almost 60% market share on the unit shipment of the network security system." Both are company assertions rather than audited figures, but the unit-share claim is consistent with the divergence against Check Point this quarter.

Assessment: The product line is doing exactly what the bull case requires, and the external comparison makes it hard to dismiss as market beta. The unresolved question is duration, not magnitude. Two of the three drivers are cyclical by nature: a refresh cycle exhausts itself, and AI data center perimeter security is lumpy project revenue that management itself called early-stage. Only the OT and segmentation demand looks structurally recurring.

Service

Service revenue of $1,204.5M grew 11.5%, the slowest of the two lines and the one the Street will underwrite the out-years on. Service is a deferred-revenue business, so this quarter's revenue reflects bookings from prior periods; the forward indicator is service billings, which grew 27% and which the CFO described as having "reaccelerated." Total deferred revenue ended at $7,351.5M, up 15% by management's account, and the balance sheet shows a $235.7M sequential build.

"Service revenue grew 11% to $1.21 billion, while service billings growth reaccelerated to 27% and deferred revenue increased 15%, driven in part by SecOps ARR growth. We view service billings growth, deferred revenue and SecOps ARR growth, together with accelerating product revenue as leading indicators of future services revenue." — Christiane Ohlgart, CFO

The gap between 27% service billings growth and 11.5% service revenue growth is the single largest source of forward earnings visibility in the model, and it is also the reason the full-year service revenue guide moved so little. The FY26 service revenue range went from $5.050–5.150B to $5.090–5.150B, a $20M lift at the midpoint achieved entirely by raising the floor. A 27% billings line producing a $20M annual revenue-guide raise tells you management expects almost none of it to convert inside 2026.

Assessment: Positive on substance, conservatively guided. Service gross margin of 87.0% means each dollar of eventual conversion carries roughly 19 cents more gross profit than a product dollar, so the deferred build is a real 2027 earnings asset. Investors underwriting the current multiple on 2026 numbers alone are looking at the wrong year.

Unified SASE

Unified SASE billings grew 31% and now represent roughly a quarter of total billings, on the CEO's estimate. Two disclosures inside it matter. FortiSASE penetration of large-enterprise customers moved from 16% to 18% sequentially, against a year-ago base management characterized as an increase of over 45%. And sovereign SASE, where customers deploy the SASE stack inside their own data centers to satisfy data-residency rules, is now roughly as large as the cloud-delivered version.

"Sovereign SASE, I feel probably almost the same size as the cloud-based SASE. Probably even bigger. But also sometimes the Sovereign SASE because we're using the same OS, same FortiGate, sometimes they just buy as a firewall, gradually turn on the SASE function and deploy internally in their data center or infrastructure." — Ken Xie, Founder, Chairman and CEO

Assessment: Sovereign SASE is the most strategically interesting disclosure of the quarter and the least quantified. It is a category the pure-cloud SASE vendors structurally cannot serve, and Fortinet monetizes it partly as product revenue, which explains why some of the product strength is really SASE demand wearing a hardware invoice. It also means the pillar split understates the SASE franchise. The absence of any dollar or ARR figure for it is a real disclosure gap.

AI-Driven Security Operations

SecOps billings grew 23%, the slowest of the three pillars and the only one that decelerated relative to the combined SASE-plus-SecOps figure of 28%. Fortinet has more than 20 AI-enabled products in this pillar and cited SecOps ARR growth as a contributor to the deferred-revenue build, without disclosing the ARR figure itself.

Assessment: This is the pillar where Fortinet competes least advantageously, against dedicated platforms with stronger analytics heritage, and 23% in a quarter when the network side did 32% shows it. It is not a problem at 2026 scale. It becomes one if the AI security budget shifts from perimeter enforcement toward detection and response faster than Fortinet's SecOps stack matures.

Key KPIs

Key Topics & Management Commentary

Overall Management Tone: Management was assured to the point of understatement, delivering a five-point revenue beat and a 380bp margin beat as routine execution rather than as an inflection, and declining to characterize the quarter as anything other than "strong." The one place the posture softened was duration: on every question about how long the current demand and pricing environment lasts, the answers moved from specific to framework-level, and the guidance philosophy backed that up by raising the rest of the year far less than the quarter beat by. Confidence in the demand was total; confidence in its persistence was deliberately not offered.

1. The AI security demand inflection

The organizing claim of the call is that artificial intelligence is expanding network security demand from two directions at once: infrastructure being built to run AI needs perimeter and segmentation security, and AI in attackers' hands is making the threat environment faster and more complex. Fortinet is positioned on both sides, selling appliances into AI data centers and selling AI-enabled detection into everyone else.

"Billings grew 31% year over year, driven by the continued convergence of networking and security, an approach Fortinet has led for 26 years, and by an increasingly complex threat environment that is being intensified by AI." — Ken Xie, Founder, Chairman and CEO

The CFO gave the mechanism in more operational terms, tying product strength directly to AI deployments: "This included a number of AI-related deployments, where customers invested in FortiGate to support increased throughput, segmentation and security requirements across AI infrastructure." Two of the four named seven-figure wins were AI data center projects, one for a GPU-compute cloud provider and one in the Middle East.

Assessment: The demand driver is real and it is early, which cuts both ways. It supports the argument that this is a multi-year cycle rather than a one-quarter spike, and it also means the revenue is project-shaped, lumpy, and dependent on third-party capital spending decisions Fortinet does not control. This is now the single largest swing factor in the model.

2. Product revenue reacceleration and what is inside it

Product revenue went from +18.0% in Q3 2025 to +20.4% in Q4 2025 to +40.5% in Q1 2026. That is not a smooth ramp; it is a step function, and the call did not fully decompose it. What management did disclose: technology upgrades, upselling, expansion into new use cases, a shift toward higher-performance products, and a low-single-digit pricing contribution.

"Total revenue grew 20% to $1.85 billion, with product revenue increasing 41% to $645 million as customers shifted toward higher-performance products." — Christiane Ohlgart, CFO

What was not disclosed is the split between AI-related deployments, the OT surge, the ordinary refresh cycle, and price. Any investor sizing 2027 needs that split, because three of those four decay and one does not.

Assessment: The number is excellent and the disclosure around it is thin. Absent a decomposition, the market is being asked to extrapolate a 40% growth rate from a black box, which is precisely the condition under which hardware cycles get over-extrapolated at the top.

3. Memory costs and the price pass-through policy

Component costs, memory in particular, rose sharply through early 2026 on AI data center demand. Palo Alto Networks put through a 10% hardware price increase in early April. Fortinet has taken pricing too, and was unusually explicit about the policy governing it.

"the policy we have is not like some other companies using this opportunity to increase margin. We are -- we just want to maintain the healthy margin. And when our cost increase, we also do the monthly adjustment. But when the cost is coming down, we also adjust lower, just maintain the same margin." — Ken Xie, Founder, Chairman and CEO

The CFO put a number on the effect and confirmed it is inside the guide: "So from a guidance perspective, we have -- we've baked in a low single-digit amount specifically into product." She also confirmed the symmetry: "So as our component cost increase, we are contemplating pricing actions, but we will also bring it down again when we don't have the pressures anymore."

Assessment: Commercially this is the right long-run posture and it buys channel trust, which is exactly how Fortinet took share in the last shortage. For the model, it means a low-single-digit slice of product revenue growth is explicitly borrowed, with management having pre-announced the repayment. It also caps the margin upside from the cycle, which is why gross margin guidance for the full year was left unchanged at 79.0–81.0% despite a Q1 print at the high end.

4. The pull-forward question and the 2021 precedent

The most consequential exchange on the call was about whether customers are buying ahead of further price increases and component scarcity, the way they did in 2021 and 2022, when 40%-plus product growth was followed by a two-year digestion. Management denied a material pull-forward.

"during the COVID, we do see some pull forward, especially like a retail when they have like a deployment, they schedule like for 12 months, they try to order ahead of time, make sure all the products are available for them. But this time, we don't see much pull forward, but we do see the demand is pretty strong. And also we kind of control the -- whether the channel inventory is some others is much and we don't see increase there also." — Ken Xie, Founder, Chairman and CEO

The CFO's differentiator was qualitative rather than evidentiary, resting on the character of demand rather than on order-book evidence: "Now it's about really a lot of significantly more threats." Notably, the CEO invoked the 2021 comparison himself as a bullish analogy, pointing to slides showing share gains through the last shortage and saying of the current growth rate, "It's pretty comparable. That time, we also grow like 40-some percent, yes."

Assessment: Management cannot have it both ways. If the current cycle is comparable to 2021 on the way up, the base case must include the possibility that it is comparable on the way down. The channel-inventory point is the strongest evidence offered, and it is real, but it was asserted rather than quantified. This is the primary bear risk and it will not be resolvable for two to three quarters.

5. Operational technology and the 70% line

OT billings grew "over 70%," the fastest disclosed line in the business, driven by ransomware and nation-state activity against critical infrastructure combined with industrial digitalization. Fortinet's argument is that OT sits underneath the AI stack rather than beside it.

"We see the OT grow like 70%. It's very, very strong growth because OT really like secured pretty much the bottom few layer of the AI 5-layer cake, right, whether the energy level, infrastructure level. All need leverage OT security. We are probably the only leader in that space, give us a lot of strong growth there." — Ken Xie, Founder, Chairman and CEO

Assessment: The most durable growth line disclosed in the quarter. OT security is regulatory-driven and replacement-cycle-slow, which makes it less prone to the air-pocket dynamic that threatens the enterprise refresh. Fortinet's ruggedized hardware position here is genuinely hard to attack from a software-only base. The frustration is that OT is not sized in dollars anywhere in the disclosure.

6. Sovereign SASE and the data-residency wedge

Fortinet's SASE differentiation rests on being able to deploy the same FortiOS stack either in its own cloud or inside a customer's or a telco's data center. Management said no major SASE competitor offers a comparable capability and that European service providers are launching sovereign SASE services on Fortinet product.

"Demand for our Sovereign SASE continues to be strong and no major SASE competitor currently offers a comparable solution." — Christiane Ohlgart, CFO

The CEO added that sovereign deployments frequently begin as firewall purchases with SASE functions enabled later, which means part of what shows up as product revenue today is SASE demand that will convert to service billings over time.

Assessment: Structurally the best competitive position Fortinet holds outside OT, and it is being monetized in a way that flatters product revenue today and understates the SASE franchise. If the sovereign wedge is as large as management implies, the 2027 service revenue line is being underestimated by the Street.

7. Service revenue lag and the conversion question

The most pointed pushback on the call came on why 27% service billings growth and a 15% deferred revenue increase produced only a $20M lift to the full-year service revenue midpoint. The CFO's answer was mechanical and, on its own terms, correct.

"I'm super enthusiastic about our services billings, 27% growth. Deferred revenue grew 15%. So I think it all trends in the right direction. The conversion from the balance sheet into revenue just takes longer. So you don't see it immediately. But the trends are all positive." — Christiane Ohlgart, CFO

She was more specific on the mechanics of the guide itself: "this is where we've adjust at the low end of the range to bring up the midpoint, but it's not that you can get super fast acceleration of the balance sheet."

Assessment: The lag is real accounting, not evasion. But it also means the 2026 P&L understates the franchise while the 2026 multiple is being paid on the 2026 P&L. That asymmetry is the strongest argument the bulls have, and the reason a Hold here is a rating on price rather than on the business.

8. FortiOS 8.0, FortiASIC, and the hardware argument vindicated

Fortinet launched FortiOS 8.0 and two new high-end appliances, the FortiGate 3500G and 400G, alongside the print. The strategic point management pressed repeatedly is that a single operating system spanning roughly 30 functions, accelerated by proprietary silicon, is a structurally different asset from a portfolio assembled through acquisition.

"I feel some of our competitor, they kind of cannot come up the new function quick enough or kind of cannot integrate. They have to go through acquisition to meet all this demand, end up, they become like a multi-point solution." — Ken Xie, Founder, Chairman and CEO

The CEO extended the argument to a broader claim about where compute is heading, arguing that edge processing is reclaiming workloads from the cloud because AI-era decisions need to happen in real time: "the edge eating cloud is more because I kind of built ASIC for like 20, 30 years because we want to increase the computing power and also real-time processing on the appliance on edge."

Assessment: The most credible part of the bull case, because it is the part with a decade of sunk investment behind it that a competitor cannot replicate on a two-year horizon. It is also the part most likely to be over-priced at a cyclical peak, because vertical integration looks like genius in a shortage and like trapped capital in a glut.

9. The new SD-WAN and SASE bundle

Fortinet introduced a bundled SD-WAN and SASE service designed to accelerate attach rates, combining what management described as four or five previously separate services into one package, with SASE licences included based on appliance model from the FortiGate 6K up through the mid-range.

"we combine like 4, 5 different separate service into one bundled service, including some SASE license based on the model of our product from like FortiGate 6k up to like middle-range product." — Ken Xie, Founder, Chairman and CEO

The CFO framed the upsell mechanism from the opposite direction: "As we upgrade our customer base, these features become more interesting, and so it allows us also to sell higher the next higher-end model typically for the edge, which is super beneficial for us as well."

Assessment: A sensible way to convert the installed hardware base into recurring revenue and the most direct answer to the service-conversion criticism. It also carries near-term pricing risk that nobody asked about: bundling four or five services usually means discounting them, and no bundle economics were disclosed.

10. Capital allocation

Fortinet repurchased 10.6 million shares for $827M during the quarter, a further 1.9 million shares for $146M quarter-to-date, and repaid $500.0M of senior notes, all while generating record free cash flow. Diluted share count fell 4.4% year over year.

"We repurchased 10.6 million shares of common stock for $827 million during the first quarter and an additional 1.9 million shares for $146 million quarter-to-date. The remaining share repurchase authorization as of today is approximately $766 million." — Christiane Ohlgart, CFO

Assessment: Well executed and, in hindsight, well timed, since the entire Q1 repurchase was completed below the pre-print $89.95 close. The forward point is less comfortable: roughly $766M of authorization remains against a run rate that consumed more than that in a single quarter, and the stock is now 20% higher. The FY26 diluted share count guide of 743–749M, down 4M at the midpoint from February's 747–753M, implies the buyback continues, but at this price the per-share arithmetic is materially worse.

11. The guidance philosophy

Management raised the full year while explicitly declining to extrapolate the quarter, and said so in as many words.

"We are raising our full year guidance across all top line metrics, including billings, revenue and service revenue, while managing the second half of the year on a quarter-by-quarter basis." — Christiane Ohlgart, CFO

The phrase "managing the second half of the year on a quarter-by-quarter basis" is the single most important sentence on the call, and it is doing a lot of work. It is the verbal form of the arithmetic in the guidance section below: a $190M full-year revenue raise against a $119.6M quarterly beat, leaving 1.2% of upward revision spread across nine months.

Assessment: Either genuine conservatism from a management team with a strong beat-and-raise record, or a signal that they share the market's uncertainty about duration. On the evidence of this call, both are true simultaneously. What is not available is the reading that management believes 30% billings growth is the new run rate, because they had the opportunity to guide that way and did not.

Guidance & Outlook

The raise is real, and on billings it is substantial. But the shape of it is the story. Against February's guidance Fortinet beat its own Q1 revenue midpoint by $119.6M, and the full-year midpoint went up $190M. Subtracting the quarter that already happened, the implied revenue for the remaining three quarters rose from $5,870M to $5,940.4M, a lift of $70.4M or 1.2%. On billings the same arithmetic gives a $184.7M lift to the out-quarters against a $265.3M beat in Q1. In both cases, management chose not to let the full momentum of the quarter flow into the rest of the year.

Implied second-half ramp: the FY26 revenue midpoint of $7,790M less Q1's actual $1,849.6M and Q2's $1,880M midpoint leaves $4,060.4M for the second half, against $3,629.9M in H2 2025, or +11.9%. The same calculation on billings leaves $4,724.7M against $4,178.1M, or +13.1%. Non-GAAP EPS implied for the second half is $1.57. The full-year cadence embedded in the guide therefore runs +20.1%, +15.3%, then +11.9% on revenue, and +30.6%, +20.3%, then +13.1% on billings. Growth halves by the fourth quarter.

Street at: going into the print the consensus modelled $1.73B of Q1 revenue and $0.62 of non-GAAP EPS, implying deceleration from Q4's +14.8%. The new FY26 EPS midpoint of $3.13 is $0.16 above the prior guide and represents 13.4% growth on FY25's $2.76. Consensus will now anchor to the guide, which historically has been the floor rather than the expectation.

Guidance style: conservative and consistently so. Fortinet cleared the high end of its own revenue guidance and beat consensus EPS this quarter. The relevant question is not whether the FY26 guide is beatable, because it almost certainly is, but by how much, and whether the market is now pricing the beat rather than the guide. At 34.5x the guide midpoint, it is pricing at least some of the beat.

Analyst Q&A Highlights

What justifies the confidence behind the guide

The opening question went straight to the credibility of the raise, suggesting that even the Q2 guide looked deliberately cautious. Management answered with the demand drivers rather than with the arithmetic, pointing to fifteen years of AI investment, more than 500 patents, and an operating model that turns component scarcity into share gain.

Q: "Ken or Christiane, what drove the strength this quarter, but probably more so, what provides you with the confidence in this strong guidance? It would appear that even second quarter could be prudent to put it very mildly. Just curious as to your thoughts about it."
— Shaul Eyal, TD Cowen

A: "First, definitely, AI is a tailwind to drive the growth. And for us, we kind of also invest in AI for like 15 years with over 500 patents and a lot of internal usage and also like building the product. So that's where kind of -- we prepare for this growth also from the operations side, which is whether direct manufacturer operation, inventory, all these things."
— Ken Xie, Founder, Chairman and CEO

Assessment: The question named the tension in the guide and management did not engage with it directly. The answer explains why demand is strong; it does not explain why the second half is guided to grow at 12%. That gap between narrative and numbers went unclosed for the entire call.

Whether this is 2021 repeating, and whether an air pocket follows

The most substantive challenge of the call drew the explicit parallel to the post-COVID cycle, when early ordering pulled demand forward and created a hole in subsequent quarters. The response leaned on the threat environment being categorically different rather than on order-book or channel-inventory evidence.

Q: "I think back in the early 2020s post-COVID, we had the benefit of some early ordering which then created a bit of an air pocket in later quarters. Maybe the question is, how do you think about how much early ordering maybe helped this quarter? And what gives you the confidence that this also doesn't create an air pocket at some point in the future?"
— Saket Kalia, Barclays

A: "During COVID, I think there were some new requirements by the companies where they needed to secure remote access and digitize their business a little bit more. Now it's about really a lot of significantly more threats. So I think the demand for our product is going to continue as the AI data centers are going to be built out as customers are deploying AI internally. So we see significant tailwinds for our business and for our products specifically."
— Christiane Ohlgart, CFO

Assessment: The best question of the call and the weakest answer. The distinction offered is about why demand exists, not about whether it is being consumed early. Management then made the situation harder for itself by volunteering the 2021 comparison as a bullish analogy, which imports the 2023 outcome along with the 2021 growth rate.

Memory pricing and what is baked into the guide

A recurring line of questioning probed the component-cost environment and how much price is inside the revenue line. This produced the most useful quantification of the call, and an unusually clear statement of pricing policy that has direct implications for the durability of product revenue.

Q: "Just to get your latest thoughts on memory pricing and any further price increases that you might be contemplating throughout the year? And maybe specifically, what's actually baked into the guidance along those lines?"
— Brad Zelnick, Deutsche Bank

A: "So from a guidance perspective, we have -- we've baked in a low single-digit amount specifically into product. And from what are our plans with regards to pricing, I mean we -- Ken has said it multiple times that we are trying to maintain gross margin. So as our component cost increase, we are contemplating pricing actions, but we will also bring it down again when we don't have the pressures anymore."
— Christiane Ohlgart, CFO

Assessment: Management answered this one fully and the answer is a mild negative for the out-years. A low-single-digit pricing contribution is inside the current growth rate with an explicit commitment to reverse it. That is a known future headwind of a few points on product revenue, self-imposed, and it partly explains why the second half is guided so conservatively.

Reconciling 32% secure networking billings against a competitor's declining firewall line

The sharpest framing of the quarter came from a question that set Fortinet's secure networking growth directly against a peer that had reported a weakening firewall market a week earlier, and asked whether comparisons or fundamentals explained the gap.

Q: "The most surprising part of your result is actually the billing growth of legacy, 32% year-over-year growth in secure networking. And Check Point, when they reported, they said that their firewall went down or the growth decelerated and the market is weaker. So the question I have for you is, how is your -- what are the firewall trends? What drives it? What drives this 32% growth in secure networking billing? And how sustainable is it?"
— Tal Liani, Bank of America

A: "And the drivers are not only AI, it is consolidation, it is simplicity. It is the security posture across the products that are driving significant interest into that network security portfolio, yes."
— Christiane Ohlgart, CFO

Assessment: The follow-up asked directly whether an easy comparison flattered the 32%, and the answer was that the situation is "pretty comparable" to five years ago, when growth was also "40-some percent." That is an honest answer and an uncomfortable one, since the five-years-ago period is the same cycle whose ending the bears are pointing at. The competitor divergence remains the strongest single piece of evidence that this is share capture rather than market beta.

Why the services guide barely moved

The most persistent pushback on the guide came on the services line, where a 27% billings growth rate and a 15% deferred revenue increase produced a full-year revenue-range adjustment that only lifted the floor.

Q: "Why aren't we seeing maybe a more visible bigger catch-up on the services side? And I guess, to ask it more simply, when I look at your services revenue guidance, you've only really tightened the range, bringing the low end of the services revenue up. So I'm just wondering if to the extent you are seeing a better product mix shift why we wouldn't see an even better attach on the services revenue?"
— Fatima Boolani, Citi

A: "I'm super enthusiastic about our services billings, 27% growth. Deferred revenue grew 15%. So I think it all trends in the right direction. The conversion from the balance sheet into revenue just takes longer. So you don't see it immediately. But the trends are all positive. ARR growth was really good. So I'm very happy with the quarter results and also with the attach rates of services with hardware."
— Christiane Ohlgart, CFO

Assessment: A fair question answered fairly. The revenue-recognition lag is genuine and the deferred balance of $7,351.5M is on the balance sheet where anyone can check it. The implication for positioning is that 2026 earnings understate the franchise and 2027 is where the services conversion shows up, which argues for owning the stock at a price that discounts 2026, not one that fully credits it.

Sizing the sovereign SASE opportunity

A line of questioning on the composition of unified SASE billings pressed for the split between SD-WAN and SASE and for the contribution of sovereign deployments specifically. The answer was directionally significant and completely unquantified.

Q: "And how much was contribution from Sovereign SASE? You're certainly getting a lot of focus right now on both sovereign data centers and sovereign infrastructure. I would love to understand the contribution there."
— Brian Essex, JPMorgan

A: "Sovereign SASE, I feel probably almost the same size as the cloud-based SASE. Probably even bigger. But also sometimes the Sovereign SASE because we're using the same OS, same FortiGate, sometimes they just buy as a firewall, gradually turn on the SASE function and deploy internally in their data center or infrastructure."
— Ken Xie, Founder, Chairman and CEO

Assessment: A material disclosure delivered as an aside. If sovereign SASE is at least as large as cloud SASE, then a meaningful share of what is currently reported as product revenue is really SASE demand, which changes both the durability read on product and the size of the eventual services conversion. The absence of any number attached to it is the largest disclosure gap in the quarter.

Whether the installed base is converting firewall subscriptions to SASE

The final substantive exchange came from field work suggesting branch-office firewall customers were beginning to enable SD-WAN and then convert to secure service edge, and asked for the spending uplift when they do. Management confirmed the behaviour and pointed to the new bundle as the accelerant, without sizing the uplift.

Q: "Specifically, are you starting to see more of your branch office firewall customers turn on SD-WAN components and then convert their firewall subscriptions to Secure Service Edge? And if so, I guess, how should we think about the ballpark uplift to a customer's annual spending?"
— Gray Powell, BTIG

A: "Definitely customers adding more turn into the firewall into SD-WAN and also into the SASE zero-trust environment now. So it's kind of helping accelerate additional service. Also, you can see we also have the slides -- thus, we're tracking the big enterprise. It's Slide 11. You can see the adoption of whether the SASE, SD-WAN with the big enterprise we're tracking. I think last quarter, the SASE about 16%, quarter-to-quarter is now at 18%."
— Ken Xie, Founder, Chairman and CEO

Assessment: The 16% to 18% sequential move in large-enterprise FortiSASE penetration is the cleanest evidence in the quarter that the land-and-expand motion is working, and 82% of large enterprise customers remain unpenetrated. The uplift question was not answered, which is the second time on this call that a request for unit economics produced a directional response instead.

What They're NOT Saying

1. The decomposition of 40.5% product growth: management named four drivers (AI deployments, OT, refresh, pricing) and sized exactly one of them, the low-single-digit pricing effect. Without the split between project-shaped AI revenue and recurring refresh demand, no one outside the company can model 2027 product revenue with confidence, and that is the single line the multiple now depends on.
2. Any dollar figure for OT, sovereign SASE, or SecOps ARR: the three fastest-growing or most strategically distinctive parts of the business are disclosed only as growth percentages. SecOps ARR was cited as a contributor to the deferred-revenue build without the ARR itself ever being stated.
3. Backlog and order-book composition: in a quarter where the central debate is whether demand was pulled forward, management asserted that channel inventory had not increased but disclosed no backlog figure, no book-to-bill, and no lead-time commentary. The one metric that would settle the pull-forward question was not offered, and no analyst extracted it.
4. Why other income nearly doubled: other income of $47.9M against $26.1M is up 83.5% and represents 7.3% of pre-tax income. It appears in no prepared remark and no question. For a company whose interest income fell 25.7% in the same period, an unexplained below-the-line swing of this size deserved a sentence.
5. The reconciliation between the second-half guide and the demand narrative: the entire call argued that AI is a durable multi-year expansion of the security TAM. The guide implies second-half revenue growth of 11.9%. Management characterized this as "managing the second half of the year on a quarter-by-quarter basis," which is a description of a process, not an explanation of an expectation.
6. Bundle economics: the new SD-WAN and SASE bundle combines four or five previously separate services into one package. No pricing, no expected margin effect, and no attach-rate target were given, and no analyst asked whether bundling is accretive or dilutive to service revenue per customer.
7. Capital-allocation intent above $100: with roughly $766M of authorization left after a quarter that consumed $823.0M, and a stock 20% higher, management was not asked and did not volunteer whether the buyback pace continues at the new price. The FY26 share-count guide implies it does.

Market Reaction

• Pre-print setup: FTNT closed at $89.95 on May 6, up 13.3% year to date against the S&P 500's 7.6%, but down 16.0% over the trailing twelve months and up 9.3% over the trailing thirty days. The 52-week closing range entering the print was $74.39 to $108.69, so the stock sat 17.2% below its 52-week closing high after a year of round-tripping.
• After-hours move: shares traded up to roughly $104 in the extended session on May 6, about 15.6% above the close, with the gain holding through the 4:30 p.m. ET call.
• Next-day session: FTNT opened at $105.26, a 17.0% gap, traded a $104.51 to $112.39 range, and closed at $107.97, up 20.0% or $18.02 on the day. The S&P 500 fell 0.4% in the same session.
• Volume: 18.1 million shares against a 30-day average of 5.6 million, or 3.2 times normal.

The magnitude of the move says more about positioning than about the print. Consensus entering the quarter modelled 12.4% revenue growth and 5.2% EPS growth, which is to say the Street had Fortinet as a mid-teens grower decelerating toward low-teens. A 20.1% revenue quarter with 40.5% product growth did not beat that model at the margin; it invalidated it. When a stock that has gone nowhere for twelve months delivers a result that breaks the framework rather than the estimate, the repricing is discontinuous, and 3.2 times normal volume is what forced re-underwriting looks like.

Context sharpens this. Over the prior five years, only about 47% of Fortinet's earnings reactions were positive, with a median negative reaction of roughly 11%, so the pre-print options and positioning setup was defensive by history. The +20.0% session sits near the top of that five-year distribution. The close of $107.97 also finished within 0.7% of the pre-print 52-week closing high of $108.69, meaning a single session erased a year of underperformance and left the stock at the top of its range with no technical overhead and no valuation cushion.

The sell-side response was revealing in its shape. Two of the four captured day-after actions raised price targets without raising ratings, and both landed at $100, below where the stock had already closed. The genuine upgrades came from the two most bearish starting points. That is a Street marking targets to a price that ran past them rather than a Street underwriting a new growth algorithm, which is a fair description of where the fundamental debate actually stands.

Street Perspective

Debate: Is this a durable AI-driven demand cycle or a shortage-era pull-forward

Bull view: the bull case on the Street is that AI has permanently raised the network security bill in two ways, by building physical infrastructure that needs perimeter and east-west segmentation, and by arming attackers, and that the OT line growing over 70% is evidence of a structural rather than cyclical expansion. On this reading a 30% billings quarter is the start of a multi-year re-rating, not the peak of one.

Bear view: the bear camp contends that Fortinet has run this movie before. In 2021 and 2022 a component shortage plus a refresh cycle produced 40%-plus product growth, followed by two years of digestion in which product revenue went backwards. The current quarter has the same ingredients, including memory scarcity, price increases, and customers securing supply, and management's own analogy invites the comparison.

Our take: both are partly right and the resolution is a matter of proportion, not principle. The OT and sovereign-SASE demand looks structural; the high-end appliance refresh and the AI data center projects look cyclical and lumpy; the pricing contribution is explicitly temporary. The decisive evidence is the competitor divergence: Check Point's product revenue fell 3% in the same quarter, which means whatever Fortinet captured was largely taken from someone rather than created by the cycle. Share gains persist through digestion phases in a way that cycle demand does not, which is why we treat the business as structurally stronger than a year ago while treating the growth rate as unsustainable.

Debate: Does the second-half guide signal conservatism or genuine caution

Bull view: the sell-side view gaining most traction is that Fortinet always guides low, cleared the high end of its own revenue guidance this quarter, and that a full-year guide implying 11.9% second-half revenue growth after a 20.1% first quarter is a placeholder to be beaten, not a forecast. On that view the real FY26 EPS number is well above $3.16 and the stock is cheaper than 34.5x.

Bear view: skeptics note that management had every opportunity to guide the second half toward the first-quarter run rate and explicitly declined, choosing instead to raise the out-quarters by 1.2% on revenue against a 6.9% beat. A team this confident in durability does not hedge that hard, and the language about managing the second half quarter by quarter is what caution sounds like when it is being polite.

Our take: the bulls are probably right that the guide will be beaten and wrong about what that proves. Fortinet's guidance history makes a beat close to a base case, but the relevant risk is not the level of the second-half number, it is the shape of the growth rate as it decelerates from 30% billings toward the low teens. A stock at 34.5x forward earnings that beats a low bar while its growth rate halves does not re-rate further; it holds. That is the definition of a Hold.

Debate: Is 34.5x forward earnings the right price for this franchise

Bull view: the argument for paying up is that Fortinet is a 54% free-cash-flow-margin business with net cash of $3.1B, a 4.4% annual reduction in share count, non-GAAP operating margins near 36%, and a competitive moat in silicon and operating-system integration that cannot be replicated on a short horizon. Against software peers growing similarly, a mid-30s multiple on GAAP-profitable earnings is not demanding, and the services conversion still to come from a 27% billings line is upside not yet in the number.

Bear view: the bear camp points out that the entire re-rating happened in one session, taking the multiple from 28.7x to 34.5x on the same forward year, and that the buyer at $107.97 is paying a cycle-peak multiple on cycle-peak margins for a company whose own guidance implies low-double-digit growth six months out. Enterprise value at 9.9x forward revenue and 31.7x trailing free cash flow leaves no room for the deceleration management has already signalled.

Our take: the bear framing of the multiple is right and the bull framing of the business is right, which is why this is a rating on price rather than on quality. Our reservation is specifically about sequencing: the deferred-revenue conversion that would justify the multiple lands in 2027, while the product-cycle risk and the price-reversal commitment both land in the second half of 2026. Being asked to pay 34.5x today for a benefit that arrives after the risk is a poor trade, and a better entry is likely to present itself when the growth rate normalizes rather than when it peaks.

Model Update Needed

Valuation impact: at the May 7 close of $107.97 and the Q1 diluted share count of 742.8M, fully diluted market capitalization is roughly $80.2B and enterprise value roughly $77.1B against $3.1B of net cash. That is 34.5x the FY26 non-GAAP EPS guide midpoint of $3.13, 33.5x our $3.22 estimate, 9.9x enterprise value to FY26 guided revenue, and 31.7x trailing free cash flow of $2,435.5M. Applying a 30x multiple to our FY27 estimate of roughly $3.60 gives a fair value near $108, essentially the current price. The stock has already discounted the beat, and our price framework implies no meaningful upside from $107.97 on a twelve-month view.

Thesis Scorecard Post-Earnings

This is our initiation on Fortinet, so the pillars below are established here rather than carried forward, and each is scored against what this quarter's print and call revealed.

Overall: the business thesis is materially stronger than it was before this print. Fortinet demonstrated that its decade of investment in proprietary silicon and a single operating system converts into share when the supply environment tightens, and it did so against a directly comparable competitor moving the other way. The investment thesis is where the difficulty lies: the market repriced the entire improvement, and more, in one session.

Action: Initiating at Hold with a conviction of 6 out of 10. We would be buyers on a pullback toward the mid-$90s, which would restore a multiple near 30x on our FY26 estimate, or on evidence that the second-half deceleration embedded in the guide is not materializing. The two datapoints that would move us to Outperform are a Q2 print holding product revenue growth above 30% with disclosed backlog or channel-inventory support, and a services revenue guide raise that reflects the 27% billings line converting faster than management currently expects. The datapoint that would move us to Underperform is any evidence of order pull-forward, which given the 2021 precedent would imply a two-year digestion rather than a one-quarter reset.