Every Line Accelerated, the Guide Finally Moved More Than the Beat, and the Stock Still Closed Flat

Results vs. Consensus

Fortinet reported after the close on July 29, 2026 and held its call at 4:30 p.m. ET. The quarter cleared consensus on both lines that carry one and cleared the company's own guidance on every line the company guides, for the fifth consecutive quarter.

Q2 2026 Scorecard

The consensus bar deserves a note. At $1,885M it sat $5M above the company's own guidance midpoint of $1,880M and comfortably inside the guide range, meaning the Street was modelling the guide with no embedded beat, this after four straight quarters in which the guide had been exceeded. That is the context for an 8.6% revenue surprise: it is not that expectations were heroic and got cleared, it is that expectations were mechanical and got run over.

Q2 2026 vs. Company Guidance (issued May 6, 2026)

Year-over-Year Comparison

Sequential Comparison

Q1 is Fortinet's seasonal trough and Q4 its peak, so the Q1-to-Q2 step is normally the year's first positive sequential move. What matters is its size against the same step a year ago, because that comparison strips seasonality out of the demand read.

The seasonality read was the most underappreciated datapoint in the Q1 release and it works again here, in the same direction and with more force. Stepping from Q1 into Q2, Fortinet added 10.7% of revenue and 19.8% of product revenue this year against 5.9% and 10.8% a year ago. Product revenue nearly doubled its normal seasonal step. That is a demand curve steepening inside the seasonal pattern for a second consecutive quarter, which is harder to dismiss as order-timing than a single quarter was.

Revenue

Total revenue of $2,047.9M grew 25.6%, an acceleration from Q1's 20.1% and from the 14.4% and 14.8% posted in the two quarters before that. Three consecutive quarters of acceleration is now the pattern, not the exception. The composition remains the story: product revenue of $773.0M grew 51.9% and took the product share of revenue from 31.2% to 37.8%, a 653bp mix shift in one year and a wider shift than Q1's 506bp.

Management attributed the product line to two mechanisms rather than one. The first is unit growth, and the second is average selling price, with customers buying up the range. The CFO was explicit that both were present, which matters because a print driven purely by ASP would be a price story wearing a volume costume.

"Accelerating product revenue benefited from strong FortiGate unit growth and an increase in ASPs as customers shifted towards higher-performing models. Customer investments to secure AI workloads and mitigate AI-related risks drove both new business and upgrade activity across our installed base, supporting growth across hardware, software and attached services." — Christiane Ohlgart, CFO

The named wins point at the same demand. A cloud provider hosting generative-AI workloads signed an eight-figure deal to secure AI data centers, following a seven-figure deal with the same customer in Q1. A global pharmaceutical company signed a seven-figure FortiSASE deal covering more than 45,000 users, displacing an incumbent secure-service-edge-only provider. A utility signed a seven-figure deal for a communications modernization program across thousands of field locations. All three are infrastructure projects rather than seat expansions, which is what makes the revenue lumpy and the growth rate hard to annualize.

Service revenue of $1,274.9M grew 13.7%, an acceleration from Q1's 11.5% and the first improvement in that line after several quarters of deceleration. That inflection is the single most important number in the release for anyone underwriting 2027, and management said so directly.

Margins

GAAP gross margin of 80.2% was 44bp below the year-ago 80.7%, and as in Q1 the entire decline is mix. What changed is the magnitude of the underlying improvement. Product gross margin rose 235bp to 69.8%, against a 36bp improvement in Q1, while service gross margin slipped 11bp to 86.6%. A 235bp expansion in the product line during a quarter when input costs were the stated reason for raising prices is a fact worth sitting with, and we return to it below.

Operating leverage did the rest and did more of it than last quarter. Operating expenses grew 11.3% against revenue growth of 25.6%, taking the opex ratio from 52.6% to 46.6%, a 600bp improvement against Q1's 256bp. Within that, sales and marketing grew 13.0%, R&D grew 7.4%, and G&A grew 7.4%. GAAP operating margin of 33.7% expanded 556bp and non-GAAP operating margin of 38.0% expanded 490bp, both records for a second quarter.

The internal tension we flagged in Q1 has widened. R&D at 11.0% of revenue is now 187bp below the year-ago ratio and below Q1's 11.6%, which was itself the lowest in our dataset. A company arguing that the network security architecture is undergoing a generational change, and coining a new category name for it, is funding that argument with a shrinking share of revenue. The margin is real; part of it is being borrowed from the innovation line, and that borrowing has to be repaid at some point in a future operating expense line.

EPS and cash

Non-GAAP diluted EPS of $0.90 grew 40.6% and GAAP diluted EPS of $0.82 grew 43.9%. The direction of that gap is the notable part. Companies normally show faster non-GAAP growth because the add-backs are a fixed drag on the GAAP line; here GAAP grew faster, which means the add-backs shrank relative to the base. Stock-based compensation inside the operating income reconciliation grew 15.6% against revenue growth of 25.6%, taking SBC from 4.29% to 3.95% of revenue. Amortization of acquired intangibles fell to $9.9M from $13.2M. This is the arithmetic of a business diluting its shareholders more slowly while growing faster.

Cash generation was the least ambiguous part of the print. Operating cash flow of $1,043.6M grew 130.9% and free cash flow of $965.6M grew 239.9%, or 3.40 times the year-ago figure, at a 47.2% margin against 17.4%. Two things drove the gap and only one of them is repeatable: a $324.2M deferred revenue build, which is the billings beat landing on the balance sheet, and a capital expenditure line that fell 53.5% to $78.0M as the prior year's real-estate spending rolled off. The comparison is flattered by that base; the underlying conversion is not in doubt at a 50.6% first-half free cash flow margin.

Fortinet exited the quarter with $4,468.7M of cash and investments against $496.9M of long-term debt and no current portion, having repaid $500.0M of senior notes in the first half. Net cash of $3,971.8M is up from $2,925.9M at year-end even after $972.8M of buybacks and the debt repayment.

Segment Performance

Fortinet reports revenue in two lines, product and service. The three-pillar architecture management runs the business on is disclosed only as billings growth on the call and in the slide deck, never as revenue in the filings. Both views are shown below; the revenue table is the filed one and governs.

Reported revenue lines

Billings by pillar (management-disclosed growth rates)

Read the pillar table against the equivalent table in our Q1 note and the pattern is unambiguous: every disclosed pillar accelerated. In Q1 the acceleration was concentrated in the hardware line and the story could plausibly have been read as a firewall refresh with a good narrative attached. This quarter the software-led pillars moved with it, which is a materially harder pattern to explain as a supply-cycle artifact.

Product and Secure Networking

Product revenue of $773.0M grew 51.9% and secure networking billings grew 34%. The demand sources management named are the same three as last quarter, with AI infrastructure moving from an emerging line to the dominant one. The CEO's framing this quarter went further than in May: rather than defending hardware differentiation as still-relevant, he proposed renaming the category around it.

"By combining our secure networking and Unified SASE pillar, which both run on the same FortiOS to create what we are calling the SASE Firewall. Similar to UTM NextGen firewall replaced the traditional net-based firewall 20 years ago, I believe this new SASE Firewall, which addresses the fast-growing area of SASE, AI and quantum represent another massive opportunity for accelerated growth with a much larger total addressable market." — Ken Xie, Founder, Chairman and CEO

The commercial claim behind the rename is that on-premises and sovereign deployment is a market the cloud-only vendors cannot address, and that it is "approximately 2 to 3x larger than the cloud-only SASE our competitors are offering." Fortinet quantified the combined business at "over $2 billion" of billings growing 34%, which on total billings of $2,372.1M implies the two converged pillars are roughly 84% of the company. The pharmaceutical displacement described on the call is the cleanest evidence for the claim: the customer chose Fortinet specifically for the ability "to extend security processing to the edge through our on-premises appliances," which is precisely the capability a cloud-native competitor lacks.

Assessment: The category rename is marketing, but the underlying observation is not. If a meaningful share of what Fortinet books as product revenue is SASE demand arriving in a hardware invoice, then the durability read on the product line is better than a firewall-refresh framing implies, and the pillar split understates the SASE franchise. What has not changed since May is that the AI data center wins are lumpy project revenue that management still describes as early-stage, and lumpy revenue does not annualize cleanly.

Service

Service revenue of $1,274.9M grew 13.7%, up from 11.5% in Q1, and this is the line the 2027 case rests on. The mechanism has been visible on the balance sheet for four quarters: service billings growing in the mid-to-high twenties against service revenue growing in the low teens means high-margin revenue is accumulating as deferred revenue rather than passing through the income statement. Total deferred revenue reached $7,675.7M, up 17% by management's account and up $324.2M sequentially, which is exactly the deferred-revenue change in the filed billings reconciliation.

"This quarter's improved service revenue alongside robust product momentum and operational improvements driving revenue conversion reinforces our confidence in the long-term durability of our service business. We believe the first quarter of 2026 marked the trough for our service revenue growth rate, and we anticipate a positive trajectory in our growth rates going forward." — Christiane Ohlgart, CFO

That sentence is the most consequential forward commitment on the call, more so than any number in the guide, because it converts a modelling assumption into a management assertion that can be graded. The full-year service revenue guide backed it with money: the range went from $5.090–5.150B to $5.180–5.220B, an $80M lift at the midpoint with both ends moving, against a $20M lift last quarter achieved by raising only the floor.

Assessment: This is the condition we said in May would need to be met before the multiple could be justified, and it was met. A four-times-larger raise with both ends moving is a different act from tightening a range. Service gross margin of 86.6% means each converting dollar carries roughly 17 cents more gross profit than a product dollar, so the deferred balance is a genuine earnings asset rather than a bookkeeping curiosity. The reservation is unchanged in kind if not in degree: the conversion still lands mostly in 2027, and 13.7% is an inflection off a trough, not yet a trend.

Unified SASE

Unified SASE billings grew 35%, up from 31%, and FortiSASE billings inside it grew "over 100%." Management attributed the doubling to three sources at once: expansion into the installed base, competitive replacements, and new large-enterprise wins. The sovereign and on-premises deployment option is the recurring differentiator in each of the named deals, and it is the piece of the story that competitors structurally cannot copy without building hardware.

"Instead of juggling high-volume east-west traffic up to a cloud pop and back, it inspects and enforces security locally while seamlessly leveraging SASE for outbound traffic." — Christiane Ohlgart, CFO

One disclosure in this pillar went backwards in usefulness. Our Q1 note tracked large-enterprise FortiSASE penetration at 18%, up from 16% the prior quarter, and called it the cleanest sequential adoption metric Fortinet publishes. This quarter's prepared remarks state that adoption "increased to 90% of large enterprises." A move from 18% to 90% in three months is not credible on a constant definition, so the two figures are almost certainly measuring different things, and no reconciliation was offered. The effect is that the one clean adoption series in the disclosure set no longer has a comparable successor.

Assessment: The billings acceleration and the doubling of FortiSASE are real and independently corroborated by the deal descriptions. The disclosure regression is a genuine irritant: a metric that gets redefined in the quarter it would have looked strongest is the kind of thing that costs a management team credibility slowly rather than suddenly. We treat 90% as directionally supportive and quantitatively unusable, and we will look for a restated series next quarter.

Operational Technology

OT billings grew "over 55%," with the investor slide showing 56%. That is a very good growth rate and it is a deceleration from the "over 70%" disclosed in Q1. It is also the pillar we identified in May as the most durable expression of the AI security thesis, on the grounds that industrial segmentation demand is structural rather than cyclical, so the deceleration matters more than its size suggests.

"critical infrastructure is being targeted quite a bit more than maybe years ago. And it hasn't had that much security in the past from a cybersecurity perspective, mostly because the critical infrastructure was not integrated into IT networks. So we see a lot of white space, so to speak, from that perspective in this field. If you look at Europe, you have a lot of regulations, whether it's NIS2 or others that actually require critical infrastructure providers to secure their infrastructure." — Christiane Ohlgart, CFO

The regulatory driver named here is the strongest argument for durability in the entire call, because compliance deadlines are dated and largely insensitive to IT budget cycles. The CEO added a competitive observation that is either a decisive advantage or a warning depending on how it ages: "I have not heard a competitor talk about OT security yet." A category with no competitors is either a moat or a market that has not yet attracted the people who will compete in it.

Assessment: A 56% growth rate does not need defending. But the sequence 70%-plus to 56% is the first deceleration in any pillar since we picked coverage up, and management was not asked to explain it. We are not treating one quarter as a trend, and the NIS2 argument gives this line a floor that the AI data center line does not have. We will watch whether OT reverts above 60% or continues to step down, because if the most structural pillar is decelerating while the most cyclical one is accelerating, the mix of the growth rate is getting worse even as its level improves.

AI-Driven Security Operations

SecOps billings grew 25%, up from 23%, and remain the slowest of the three pillars. Fortinet launched FortiSOC during the quarter, a cloud-delivered platform consolidating six security operations functions into one interface, and expanded FortiEndpoint into a single agent. The pillar is also where the announced partnerships sit, with Anthropic, OpenAI, and NVIDIA all named in the release.

Assessment: The verdict from May stands with a small upgrade. This remains the pillar where Fortinet competes least advantageously, against platforms with a stronger analytics heritage, and 25% while the network side does 34% shows it. The acceleration and the FortiSOC launch are the right direction. It becomes a thesis problem only if enterprise AI security budgets rotate from perimeter enforcement toward detection and response faster than this stack matures, and nothing in this quarter suggests that rotation has started.

Key KPIs

Key Topics & Management Commentary

Overall Management Tone: Management was more assured than at any point in the past five quarters and, for the first time, willing to put the guide behind the confidence rather than only the narrative. Where the May call answered questions about durability with reasons demand exists, this call answered them with a mechanism, a policy, and a raised operating margin range. The one place the posture outran the disclosure was pricing, where the quantified contribution grew while the framing stayed unchanged.

1. The "SASE Firewall" reframing

The call opened with a category rename. Management merged two of the three reporting pillars, secure networking and Unified SASE, into a single construct on the grounds that both run on FortiOS and that customers frequently buy one and enable the other. The commercial argument is that the combined market is two to three times the size of the cloud-only SASE market that competitors address, and that Fortinet is the only vendor that can serve both halves from one operating system.

"What makes Fortinet SASE Firewall unique compared to other competitors' SASE and firewall solution is that we are the only vendor to develop all key components of SASE Firewall in-house and integrate into a single operating system, FortiOS. Furthermore, we have developed our FortiASIC technology and invested in our own global infrastructure to accelerate the performance and lower the cost, making adoption and migration seamless for a large global customer base." — Ken Xie, Founder, Chairman and CEO

The rename is also a reporting convenience. Merging the two pillars makes the split between them irrelevant, and management said explicitly that the split is hard to compute: "sometimes a little bit difficult to categorize whether it belongs to unified SASE or secure networking because sometimes they may deploy as a secure networking first, but quickly ramp up to enable SD-WAN SASE." That is a defensible accounting reality and it is also a way of retiring a comparison that would otherwise get harder as the mix shifts.

Assessment: The underlying observation is right and materially changes how we read the product line. If SASE demand is arriving as FortiGate revenue, then the durability of product revenue is better than a hardware-refresh model implies. We are less comfortable with the disclosure direction: this is the second metric this quarter, alongside FortiSASE penetration, where the reporting basis moved in a way that makes quarter-over-quarter comparison harder. Combining two pillars that each accelerated is not an act that needs cover, which makes the timing benign, but the precedent is not.

2. Product acceleration and whether it can last

The opening question of Q&A went directly at durability, and management's answer was different in kind from May's. In Q1 the response was that demand is strong because AI is a tailwind. This time the CEO said the company had actively tested the alternative explanation and rejected it.

"We also spend a lot of time trying to study whether it's a new market trend or it's a supply or the other things. We do believe the growth actually is a long term for Fortinet." — Ken Xie, Founder, Chairman and CEO

He then made a quantitative point that is more useful than the qualitative one, in response to a question on refresh cycles. Against a roughly five-year appliance replacement cycle, product revenue has "probably tripled" versus five years ago and grew another 52% on top, which is arithmetically too large to be explained by units coming due for replacement. That is the first framework offered on either call that actually distinguishes refresh demand from expansion demand.

Assessment: The refresh arithmetic is a genuine contribution and it substantially weakens the simplest bear case, which is that a five-year cycle came due at once. It does not address the harder version, which is that customers are buying ahead of need in a tightening supply environment. Management addressed that separately and better than in May, which is the next topic.

3. Pricing: the contribution grew while the framing stayed the same

This is the disclosure that moved most against the thesis, and it moved quietly. In May the pricing contribution was described as "a low single-digit amount specifically into product," under a stated policy of reversing price increases when component costs normalize. This quarter the figure disclosed was larger and on a broader base.

"We have approximately high single-digit impact built into our billings assumptions for the second half. And it's very dependent on product mix and what is being sold because -- I mean, yes, there were price increases, but they were not for every product and every service." — Christiane Ohlgart, CFO

The two figures are not directly comparable, since one is on product revenue growth and the other on second-half billings, but the direction is not ambiguous: the price component of growth is larger than it was in May, not smaller. And the reversal is now closer, because the CEO said the cost pressure driving it has eased.

"Actually, like I said, we want to maintain the same gross margin. The memory price kind of stabilized in the last few weeks or even last few months. We do like a monthly adjustment based on the cost, but we want to maintain the same gross margin that's the policy." — Ken Xie, Founder, Chairman and CEO

There is a tension between that policy statement and the reported numbers. If pricing actions are calibrated to hold gross margin flat against rising component costs, product gross margin should be roughly stable. It expanded 235bp year over year and 204bp sequentially, to 69.8%. Either the price increases over-recovered the cost increases, or scale and mix contributed enough to swamp them. Both readings have the same implication for the give-back: the price that comes out may take more margin with it than a pure cost pass-through would.

Assessment: This is the most important negative disclosure on the call and it went unchallenged. A high-single-digit price contribution to second-half billings, under an explicit commitment to reverse it, with the CEO stating that the triggering condition has already stabilized, is a mechanical headwind of several points to 2027 billings growth that is now larger and nearer than we modelled in May. It is the single strongest argument for not paying a growth multiple on the current growth rate.

4. Pull-forward: a mechanism, finally

Last quarter management denied pull-forward by assertion and offered no channel inventory or backlog evidence, which we called the weakest answer of that call. This time the denial came with a structural reason.

"we don't see any like excess inventory or pull forward because we told the partner -- customer, there's no need to really take extra inventory. And also, we have a policy where we tend to start charging 90 days after shipment for some kind of service supporting. So that's where there's no incentive to keep an extra inventory." — Ken Xie, Founder, Chairman and CEO

The 90-day service-clock policy is a real economic disincentive to channel stocking: a partner that takes inventory early starts burning the attached service term before the box is sold. Combined with real-time downward price adjustment, a partner that stocks ahead risks holding units that are both aging on support and priced above the current list. Two independent facts in the filings are consistent with the claim. Inventory grew 6.7% since year-end against product revenue growth of 51.9%, and accounts receivable fell 13.9% to $1,455.6M while first-half revenue grew 23.0%, which is the opposite of what a stuffed channel usually produces.

Assessment: A material improvement on May's answer and the first evidence-shaped response Fortinet has given on this question. It is not the disclosure a skeptic would ask for, which remains backlog or book-to-bill, and neither has been offered in two quarters of being asked. But a mechanism that explains why partners would not stock, corroborated by two balance sheet lines moving the right way, is a substantially better argument than "we don't see it." We are moving this bear point from unresolved toward contained, without closing it.

5. The service revenue inflection

The services line was the subject of the sharpest pushback in May, when a 27% service billings growth rate produced a $20M full-year revenue guide raise achieved by lifting only the floor. This quarter the revenue line moved and management committed to the direction in a way that is gradable.

"Service revenue grew 14% to $1.27 billion, with growth improving from the prior quarter. Service billings growth, increased 26% and total deferred revenue increased 17%." — Christiane Ohlgart, CFO

Asked which components were driving it, the answer was broader than the attached-services mechanism alone: "It's attached services, which is FortiCare and FortiGuard as well as also growth coming from SecOps, which is typically more unattached solutions." The bundled SD-WAN and SASE package launched earlier in the year was named as an additional driver, still without a size attached.

Assessment: Delivered. This was one of the two things we said in May would have to happen before the multiple could be defended, and it happened faster than we expected. The $80M full-year raise with both ends moving, alongside an explicit statement that Q1 was the trough, converts an argument into a commitment. The number to grade next quarter is whether service revenue growth exceeds 14%, because a single quarter off a trough is an inflection and two make it a trend.

6. The operating margin guide finally moved

In May, Fortinet raised revenue, billings and EPS and left both margin ranges untouched, which we read as the clearest signal of caution in the guide. This quarter the non-GAAP operating margin range moved from 33.0%–36.0% to 35.0%–37.0%, a 150bp increase at the midpoint, while gross margin stayed at 79.0%–81.0%. Asked what changed operationally, the answer credited internal AI deployment and a deliberate posture rather than one-off cost deferral.

"we started that years ago in the support organization, and we've seen good success there with our significantly slower headcount growth or not even having to backfill certain roles in support. And we are doing it across many functions to make sure that we are on top of technology trends, deploy them internally and also mine our own data for better insights." — Christiane Ohlgart, CFO

The COO added the cultural framing, that the company deliberately tightens rather than relaxes when results are strong. That is a claim, but the 11.3% operating expense growth against 25.6% revenue growth is not, and the composition supports it: headcount-driven lines grew slowest, with R&D and G&A each up 7.4%.

Assessment: Raising the margin range is the guidance action that costs the most to walk back, which is why it is more informative than the revenue raise. Its arrival this quarter after being withheld last quarter reads as genuine confidence in the second half. The reservation is where the leverage is coming from. Support automation is a durable source; R&D at 11.0% of revenue is not, and part of the 490bp margin expansion is a deferral rather than an efficiency.

7. The Intel collaboration on SP6

The strategically largest announcement in the release got one question on the call. Fortinet is partnering with Intel on Security Processor 6, combining Fortinet's processor design with Intel's "design, development, packaging, and manufacturing capabilities to accelerate SP6 development while strengthening the resilience and diversity of Fortinet's global supply chain."

"the partnership with Intel also very, very significant because Intel is probably the only manufacturer in the U.S. probably do all this kind of chip manufacturing. And we have a great partnership. And we do believe combining the two company technology, innovation, we can really bring the network security to the new level." — Ken Xie, Founder, Chairman and CEO

Two readings are available and the call supported only one of them. The favourable reading is supply-chain diversification and faster time to market for the silicon that underpins the entire performance argument, plus a domestic manufacturing option with obvious value in a tariff and export-control environment. The less favourable reading is that the crown jewel of the vertical-integration thesis now has an external dependency in it. Nothing in the disclosure indicates which parts of SP6 Fortinet retains and which Intel supplies, and the question was not asked.

Assessment: Net positive on the evidence available and under-disclosed relative to its importance. Bull pillar one, vertical integration, is the pillar that carried the quarter, and a partnership that touches it deserves more than a bullet in a highlights list. We are treating it as supportive because acceleration and supply resilience are the stated purposes, while noting that we cannot yet assess how much of the ASIC value chain is being shared.

8. Sovereign SASE moved from an aside to a strategy

In May, sovereign SASE surfaced as an unprompted CEO aside, sized only as "probably almost the same size as the cloud-based SASE." This quarter it has a product behind it. The FortiGate 1200G with FortiSASE Outpost, announced the day before the print, brings SASE enforcement onto the customer's own appliance while keeping cloud-based policy management, and the pharmaceutical win was attributed directly to that capability.

"the product we announced yesterday, the FortiGate 1200G, we do put some -- like a big percent of content emphasize how this outpost SASE deployment is important for a lot of customers because you can process all this data locally on the FortiGate and at the same time, can also leverage some cloud management to really force some policy globally." — Ken Xie, Founder, Chairman and CEO

The demand driver named is data sovereignty regulation, concentrated in EMEA and in public sector customers globally, which is the same regulatory dynamic driving the OT line. Management also said service providers, previously slow to invest behind their own SASE infrastructure, are now accelerating.

Assessment: This is the most under-modelled part of the story and it is progressing exactly as the bull case would require: an aside in Q1, a product and a named displacement win in Q2. It is still entirely unquantified. Two quarters of describing a category as two to three times larger than the one competitors serve, without ever attaching a revenue, ARR or billings figure to it, is a disclosure gap that is now conspicuous rather than merely unfortunate.

9. Capital allocation: the buyback brake

The most revealing number in the quarter was one nobody asked about. Fortinet repurchased 1.9 million shares for approximately $146M in Q2, against a first-half total of 12.5 million shares for $972.8M per the filed cash flow statement. Buyback spending fell roughly 82% sequentially, in the quarter the stock rose from $89.95 on the day before the Q1 print to $153.62 at quarter-end.

Management flagged the average price paid year to date at around $78 per share, and stated approximately $766M of authorization remaining as of the call date. Separately, Moody's upgraded the senior unsecured notes to A3 from Baa1 and the shelf to (P)A3 from (P)Baa1, described in the release as the highest rating of any public cybersecurity company, which follows the $500.0M senior note repayment in the first half.

Assessment: This is price-disciplined capital allocation and it deserves credit, because the easy path for a management team watching its own stock double is to keep buying and let the average price tell a flattering story later. Cutting the pace by roughly four fifths as the multiple re-rated is management pricing its own equity the same way we are. It also removes a support from the per-share compounding case: at this pace the share count reduction slows materially from the 4.2% year-over-year rate, and buybacks stop being a reliable contributor to EPS growth.

10. R&D at 11.0% of revenue

R&D grew 7.4% to $225.0M while revenue grew 25.6%, taking R&D to 10.99% of revenue from 12.85%, the lowest ratio in our dataset and below the 11.6% we flagged as unsustainable in May. In the same quarter, management coined a new product category, launched a new SOC platform, launched a new appliance line, announced a partnership to accelerate the next-generation security processor, and argued that the network security architecture is undergoing a once-in-twenty-years change.

Assessment: Those two facts do not sit comfortably together. The most likely explanation is benign, that a revenue line growing 25.6% simply outran a spending plan set at the start of the year, and the ratio normalizes as hiring catches up. The less benign version is that the record operating margin is partly financed by underinvesting in the exact capability the thesis rests on. Either way, this is not a ratio to extrapolate. We assume reinvestment resumes and model operating expense growth accelerating in 2027, which is a reason not to capitalize the current 38.0% margin into a terminal assumption.

Guidance & Outlook

Beat versus raise: the test Fortinet failed in May and passed in July

The most useful diagnostic on a guidance raise is not its size but whether it exceeds the quarter that produced it. A company that beats by a dollar and raises the year by a dollar has banked the quarter and told you nothing about the future. Applying that test across both quarters shows a genuine change in behaviour.

On billings, the full-year midpoint rose $500M against a $232.1M beat, so management put $267.9M of incremental billings into quarters that have not happened yet. That is the first time in the two quarters we have covered that the raise has exceeded the beat on any headline metric, and it arrived alongside the operating margin increase that was withheld in May. Read together, the three guidance actions are more informative than the revenue number.

Implied second-half cadence

The deceleration we flagged in May is still embedded in the guide, off a materially higher base. The FY26 revenue midpoint of $8,100M less first-half actual revenue of $3,897.5M leaves $4,202.5M for the second half against $3,629.9M a year earlier, or +15.8%, up from the +11.9% the May guide implied. On billings the equivalent calculation leaves $4,992.6M against $4,178.1M, or +19.5%, up from +13.1%.

The shape inside the second half is where the caution lives. Q3 is guided to +19.1% on revenue and +27.2% on billings. Backing that out of the full year leaves an implied Q4 of $2,147.5M in revenue, +12.7%, and $2,692.6M in billings, +13.6%. On earnings the arithmetic is starker: the FY26 EPS midpoint of $3.44 less first-half actuals of $1.72 less the Q3 midpoint of $0.85 leaves an implied Q4 of $0.87, or +7.4% on last year's $0.81.

Street at: going into the print consensus modelled $1,885M of revenue and $0.75 of non-GAAP EPS, a bar that sat inside the company's own guidance range and $5M above its midpoint. The new FY26 EPS midpoint of $3.44 is +24.6% on FY25's $2.76 and $0.31 above the guide issued twelve weeks ago. Consensus will now anchor to the new guide, which has been the floor rather than the expectation in each of the last five quarters.

Guidance style: conservative, and now conservative in a more specific way. Fortinet has exceeded the high end of its own revenue guidance five quarters running, with the margin of the beat widening from $45M-scale in early 2025 to $117.9M this quarter. The Q4 implied numbers are best read as a placeholder rather than a forecast; management said as much when the CFO described "managing the remainder of the year on a quarter-by-quarter basis." The question worth underwriting is not whether Q4 beats $0.87, because it very likely does, but where the exit growth rate settles once the price contribution reverses.

Analyst Q&A Highlights

What is actually driving the acceleration, and whether it lasts

The first question of the session went at the central issue: two consecutive quarters of accelerating billings and product growth, and whether anything about it is structural. Management's answer this time began by naming the alternative hypothesis and saying it had been tested, which is a different posture from May, when the same question was answered by listing reasons demand exists.

Q: "This is the second quarter in a row of accelerating billings and product growth. And we've all talked about things like AI data center, OT and other trends. But I'm curious, what do you think is driving the accelerating growth here? And just as importantly, how durable do you think it would be?"
— Saket Kalia, Barclays

A: "We also spend a lot of time trying to study whether it's a new market trend or it's a supply or the other things. We do believe the growth actually is a long term for Fortinet. Definitely, you see the AI changed a lot of our security landscape. And also with our kind of like investment like from the ASIC chip, from our own infrastructure, from the R&D innovation, we also positioned much better than any of our other competitors."
— Ken Xie, Founder, Chairman and CEO

Assessment: The improvement is in the framing rather than the evidence. Saying the supply explanation was studied and rejected is a stronger answer than not addressing it, but the study was not shared and the durability claim still rests on architecture rather than order book. The refresh-cycle arithmetic offered later in the call did more work than this answer did.

How much of second-half growth is price

The follow-up to that opening exchange produced the most consequential number on the call, and it went unremarked afterwards. The question asked what the price increases taken to offset input costs contribute to product growth in the back half, and the answer both sized the contribution and moved the basis on which it is disclosed.

Q: "how are you thinking about the impact of price increases on your product growth for Q3 and Q4, right? I think there have been a couple of price increases, of course, to reflect, right, the higher input costs. But curious how you're thinking about the impact here as we go into the second half?"
— Saket Kalia, Barclays

A: "We have approximately high single-digit impact built into our billings assumptions for the second half. And it's very dependent on product mix and what is being sold because -- I mean, yes, there were price increases, but they were not for every product and every service."
— Christiane Ohlgart, CFO

Assessment: Answered fully and honestly, and the answer is the most negative disclosure of the quarter. The price contribution has gone from low single digits on product to high single digits on second-half billings while the commitment to reverse it stands and the triggering cost pressure has, by the CEO's own account, already stabilized. That is a quantified 2027 headwind sitting inside a growth rate the market is capitalizing at 44.8x.

Whether an air pocket follows, and why partners would not stock ahead

The most valuable disclosure in the session was not an answer to any question asked. Following the CFO's response on pricing, the CEO volunteered the commercial mechanism that removes a partner's incentive to stock ahead, which is the substance the pull-forward challenge had been seeking for two consecutive calls without getting it. The question that preceded it was about pricing and is quoted in the entry above; the exchange below is captured for the unprompted response alone.

A: "we just want to maintain the same gross margin. That's where we kind of real time adjust the price based on some component costs like memory, that's where -- so if the price is going down, we also real time dropping the price. So there's -- so that's also we don't see any like excess inventory or pull forward because we told the partner -- customer, there's no need to really take extra inventory. And also, we have a policy where we tend to start charging 90 days after shipment for some kind of service supporting. So that's where there's no incentive to keep an extra inventory."
— Ken Xie, Founder, Chairman and CEO

Assessment: The best unprompted disclosure of the call. A 90-day service clock that starts at shipment penalizes a partner for holding stock, and real-time downward price adjustment penalizes it again. Two filed balance sheet lines are consistent with the claim: inventory up 6.7% since year-end against product revenue up 51.9%, and receivables down 13.9% against first-half revenue up 23.0%. Backlog and book-to-bill remain undisclosed after two quarters of being asked, so this is corroboration rather than proof.

What is behind the services reacceleration

A recurring line of questioning sought to decompose the services improvement between the support and threat-intelligence components, on the theory that support revenue should mechanically rise with a larger installed base and therefore says less about demand than a broader improvement would. The answer claimed both, plus the unattached security operations line.

Q: "when you indicated that services growth would increase through the year, I was hoping you could give a little bit of color on the distinction between FortiCare and FortiGuard. In other words, the support function should increase because you have more firewall units in the field, and it's been going on for several quarters. So that should increase. But is there any color you can give on the contributing factors to the increase in service growth?"
— Keith Bachman, BMO Capital Markets

A: "It's both. It's attached services, which is FortiCare and FortiGuard as well as also growth coming from SecOps, which is typically more unattached solutions. And yes, we see good growth across both."
— Christiane Ohlgart, CFO

Assessment: The question isolated the right variable and the answer, while thin, is the more favourable one: growth in unattached security operations is demand, not an installed-base annuity. The follow-on comment that the company deliberately ensures attached services are sold alongside expansion deployments is the operational detail that makes the deferred balance a forecastable asset rather than a hopeful one.

Why operational technology decelerated, asked as a durability question

The exchange on OT was framed around what drives the growth rate and how durable it is, without addressing that the disclosed rate had stepped down from the prior quarter. The answer was the most substantive defence of any pillar on the call, and it rested on regulation rather than on the AI narrative.

Q: "On Slide 17, you depict that OT grew 56%, billings grew 56%. Maybe give a little bit of characterization about what's really driving the acceleration in OT and how durable is that? If it was AI-based, it would seem that, that has long-term durability. But just maybe flesh out a little bit on the why and the durability?"
— Keith Bachman, BMO Capital Markets

A: "critical infrastructure is being targeted quite a bit more than maybe years ago. And it hasn't had that much security in the past from a cybersecurity perspective, mostly because the critical infrastructure was not integrated into IT networks. So we see a lot of white space, so to speak, from that perspective in this field. If you look at Europe, you have a lot of regulations, whether it's NIS2 or others that actually require critical infrastructure providers to secure their infrastructure and have good reporting, have supply chain validations and so on for cybersecurity there."
— Christiane Ohlgart, CFO

Assessment: A regulatory mandate with a compliance deadline is the most durable demand driver a security vendor can have, and it is far more defensible than the AI framing the question offered. The exchange is notable for what it did not surface: the question characterized 56% as acceleration when the prior quarter's disclosure was above 70%, and nobody corrected the premise. A step down in the most structural pillar passed the call unexamined.

Whether 2027 can be modelled off these comparisons

The most commercially useful question of the call named the modelling problem directly: analysts have to set 2027 estimates tonight against product growth comparisons of 40% and then 52%. The response acknowledged the difficulty and declined to help, which is defensible on timing and unhelpful for anyone underwriting the multiple.

Q: "We sort of have to dial in our model this evening on these 50% plus product revenue growth comps and last quarter of course, north of 40%. So I guess give us a little bit of direction here. How should we be thinking about product revenue growth?"
— Gabriela Borges, Goldman Sachs

A: "I think we are focused on the durability of our growth. And the themes that we're seeing, whether it's AI, whether it's SASE, whether it's OT, they will continue into next year. And then the regulatory activity in some parts of the world will continue as well. I think the question is how much share can we capture from others and how much can we grow in our own customer base, and we will get you those numbers in January or February."
— Christiane Ohlgart, CFO

Assessment: A fair deferral and an expensive one. The company will not frame 2027 for six more months, during which the Street will anchor on second-half comparisons that management itself has guided to decelerate sharply. The CEO's contribution, that predicting the future is difficult and the two vectors are replacement and new categories, was directionally honest and quantitatively empty. This is the single largest information gap between the current price and the earnings that would justify it.

Margin visibility and whether more price increases are coming

A question on the credibility of the raised margin guide produced the clearest statement yet on where pricing goes from here, and it pointed downward. The answer also reframed the growth attribution away from price and toward the product cycle, which is the company's preferred emphasis and, on the gross margin evidence, not the whole story.

Q: "Margin guidance is really, really impressive. Can you just kind of talk about visibility into that? And do you envision any more price increases as it stands today?"
— Joseph Gallo, Jefferies

A: "Actually, like I said, we want to maintain the same gross margin. The memory price kind of stabilized in the last few weeks or even last few months. We do like a monthly adjustment based on the cost, but we want to maintain the same gross margin that's the policy. So that's we feel -- but like I said, it's still single-digit impact of the business. We do believe that the strong -- the bigger driver is really the new SASE Firewall approach."
— Ken Xie, Founder, Chairman and CEO

Assessment: Two statements in one answer that sit awkwardly together. Component costs have stabilized and the pricing policy is to maintain constant gross margin, yet product gross margin expanded 235bp year over year and 204bp sequentially. A policy of holding gross margin flat does not produce 235bp of expansion. Whichever explanation is right, over-recovery on price or scale effects swamping the pass-through, the give-back is nearer than it was in May and the margin at risk when it comes is larger.

What They're NOT Saying

1. Backlog and book-to-bill, for the second consecutive quarter. Fortinet has now been asked in two straight calls to substantiate the no-pull-forward claim and has answered both times with narrative and, this quarter, with mechanism. Neither answer included the one disclosure that would settle it. A company confident that 52% product growth reflects consumption rather than positioning has an easy way to prove it and continues not to use it.
2. Why operational technology decelerated from above 70% to 56%. Not disclosed as a deceleration, not asked as one, not explained. This is the pillar management has consistently pointed to as evidence that the demand cycle is structural, and it is the only disclosed line that went the wrong way.
3. Any reconciliation of the FortiSASE penetration metric. Large-enterprise penetration was 16% in Q4, 18% in Q1, and "90% of large enterprises" in Q2. Two of those three numbers belong to the same series. Nobody said which.
4. The size of sovereign SASE. Two quarters of describing a market as two to three times larger than the one competitors address, with a dedicated product now launched into it, and still no revenue, billings, ARR or unit figure attached. The claim is now load-bearing for the durability argument and remains entirely unquantified.
5. What Intel is actually supplying in SP6. The release says design, development, packaging and manufacturing. That range spans anything from a foundry relationship to shared architecture. Given that in-house silicon is the first pillar of the vertical-integration case, the boundary matters and was not drawn.
6. Any framing of 2027. Deferred to January or February. Management named the two variables that determine it, share capture and installed-base expansion, and sized neither. For a stock trading at 44.8x the current year, six months of silence on the following year is a long time.
7. Why R&D grew 7.4% in a quarter management describes as a category inflection. The margin beat was discussed at length and credited to AI-driven internal efficiency. That efficiency is in support and administrative functions by the CFO's own description, while the ratio that fell hardest relative to revenue was engineering.
8. The economics of the bundled SD-WAN and SASE package. Named again as a strong contributor to service growth, as it was in May, with no attach rate, no pricing, and no indication of whether bundling four or five services into one package is margin-accretive or dilutive.

Market Reaction

• Pre-print setup: FTNT closed at $153.22 on July 29, up 92.9% year to date from $79.41 and up 46.2% over twelve months, against an S&P 500 up 6.9% year to date. Critically, the stock was not making new highs into the print: it closed at $166.83 on July 14 and had drifted 8.2% off that level, finishing the trailing thirty days down 1.4%. The 52-week closing range entering the report was $74.39 to $166.83.
• After-hours move: shares traded up roughly 11% after the release, reaching approximately $170.30 by 6:57 p.m. ET, which would have been a new all-time closing high had it held.
• Next-day session: the stock opened at $164.00, a 7.0% gap, traded to an intraday high of $169.26 (+10.5%), fell to an intraday low of $152.23 (-0.6%), and closed at $154.25, up 0.7% or $1.03. Volume of 11.0 million shares was 1.9 times the 30-day average of 5.7 million.
• Relative performance: the S&P 500 closed up 1.7% the same session. Fortinet lagged the index by roughly 100 basis points on the day it reported 26% revenue growth, 33% billings growth, a record operating margin, and raised every top-line metric plus the margin range.

The distance between the headline and the tape is the whole point. A reader who saw only the after-hours print would record a 11% surge on a blowout quarter. What actually happened is that Fortinet gave back the entire move within a single session, on nearly double normal volume, while the broad market rallied. An opening gap of 7.0% that closes at 0.7% is not indecision, it is supply meeting a bid and overwhelming it.

The pre-print setup explains most of it. The stock entered the quarter having already doubled from the start of the year and having already set its closing high two weeks before the report. The re-rating did not begin on July 29; it began on May 7, when the Q1 print took the multiple from 28.7x to 34.5x, and it continued through eleven weeks in which the stock rose another 42.9% with no new fundamental information. By the time this quarter's numbers arrived, the market had already spent the beat.

The second contributor is the shape of the guide. A reader who moves past the raised full-year headlines to the implied fourth quarter finds revenue growth of 12.7%, billings growth of 13.6%, and non-GAAP EPS growth of 7.4%. Those numbers are almost certainly too low, given five consecutive quarters of the company clearing its own high end. But they are what the company published, and an investor being asked to pay 44.8x has to decide whether to underwrite the print or the guide. On July 30, at a price 11% above the prior close, enough of them declined to do either.

Street Perspective

Debate: Has the durability question been answered

Bull view: the bull case on the Street is that two consecutive quarters of acceleration across every disclosed pillar, not just hardware, retires the shortage-and-refresh explanation. Software-led billings lines do not accelerate because memory is scarce. Add the refresh arithmetic management offered, that product revenue has tripled over a five-year replacement cycle and grew another 52% on top, and the pull-forward thesis runs out of mechanism.

Bear view: the bear camp contends that the evidence remains circumstantial after two quarters of being asked for something better. There is still no backlog figure, no book-to-bill, and no channel inventory disclosure. The one pillar management has consistently cited as structural, operational technology, decelerated from above 70% to 56% and was not asked about. And the price contribution to growth got bigger, not smaller, which is exactly what a late-cycle print looks like.

Our take: the bulls have the better of this now, which is a change from our May position. The breadth of the acceleration is the decisive fact: a supply-driven hardware cycle does not lift security operations billings from 23% to 25% or double FortiSASE. The 90-day service-clock mechanism, corroborated by inventory up 6.7% against product revenue up 51.9% and receivables down 13.9%, is a real answer rather than a denial. We are moving this from an open question toward a resolved one while noting that the disclosure Fortinet keeps declining to make is the one that would close it entirely.

Debate: How much of the growth rate is borrowed from 2027

Bull view: the argument on the optimistic side is that the pricing contribution is small relative to the growth rate and largely irrelevant to the earnings power, because Fortinet prices to hold gross margin, so a reversal takes out roughly equal amounts of revenue and cost. The volume story survives intact at high-thirties to mid-forties product growth even stripping price entirely, and the deferred services conversion arriving in 2027 more than offsets it.

Bear view: the skeptical case notes that the disclosed contribution moved from low single digits on product revenue growth to approximately high single digits on second-half billings in a single quarter, and that the company has committed publicly to reversing it once component costs normalize, which the CEO says has already begun. That is not a modelling nuance, it is a self-announced subtraction of several points from 2027 billings growth, arriving in the same year the comparisons are hardest.

Our take: the bear framing is closer to right and the bull's gross margin argument is contradicted by the company's own numbers. If price were purely a cost pass-through calibrated to hold margin flat, product gross margin would be roughly stable. It expanded 235bp year over year. Some portion of the price taken has stuck as margin rather than covered cost, which means the give-back removes margin as well as revenue. This is the most quantifiable risk in the story and the least discussed, and it is the primary reason we will not capitalize the current growth rate.

Debate: Is 44.8x forward earnings defensible after a 42.9% run

Bull view: the case for paying up is that this is now a company compounding revenue in the mid-twenties with a 38% non-GAAP operating margin, a 50.6% first-half free cash flow margin, $4.0B of net cash, an A3 credit rating, and demonstrated share capture against a direct competitor. Against software peers with similar growth and worse GAAP profitability, a mid-forties multiple on a number the company has beaten five quarters running is not obviously demanding, and the services conversion is upside not yet in estimates.

Bear view: the bear camp points out that the stock has now re-rated twice on the same story. The multiple went from 28.7x to 34.5x on May 7 and from 34.5x to 44.8x by July 30, a 56% expansion in twelve weeks against a 9.9% increase in the full-year earnings guide over the same period. Enterprise value of $110.2B is 13.6x guided revenue against 9.9x a quarter ago. The buyer at $154.25 is paying a peak multiple on peak margins for a company whose own fourth-quarter guide implies 7.4% earnings growth.

Our take: the arithmetic settles this one and it settles it against paying up. Since our last note the price rose 42.9%, the full-year earnings guide rose 9.9%, and the forward multiple therefore rose 30.0%. Four-fifths of the return since May came from re-rating rather than from earnings. Our fair value work lands at $146 to $162 on 36 to 40 times a 2027 estimate of roughly $4.05, which brackets the current price rather than beating it. The business improved and the price improved more, and that is a Hold regardless of how good the quarter was.

Model Update Needed

Valuation impact: at the July 30 close of $154.25 and the Q2 diluted share count of 739.9M, market capitalization is roughly $114.1B and enterprise value roughly $110.2B against $3.97B of net cash. That is 44.8x the FY26 non-GAAP EPS guide midpoint of $3.44, 43.5x our $3.55 estimate, 38.1x our FY27 estimate of $4.05, 13.6x enterprise value to FY26 guided revenue, and 11.7x guided billings. Three months ago at $107.97 the equivalent figures were 34.5x and 9.9x. Applying 36x to 40x to our FY27 estimate produces a fair value range of $146 to $162 against a spot of $154.25, which is no meaningful upside on a twelve-month view. The upside case, in which the price reversal does not bite and services conversion accelerates, supports roughly $174 at 40x a $4.35 estimate. The downside case, in which the product cycle rolls and price reverses in full, supports roughly $113 at 30x a $3.75 estimate. That skew, +13% against -27%, is the rating.

Thesis Scorecard Post-Earnings

The pillars below are the standing thesis established at initiation in May, scored against what this quarter's print and call revealed. They are not re-derived here.

Overall: the business thesis strengthened again and by more than last quarter, while the investment thesis weakened. Of the seven standing pillars, one bull pillar was upgraded, one bear point was downgraded, one bear point escalated, and the valuation constraint tightened materially. The two conditions we set in May for an upgrade to Outperform were substantially met: product growth held far above 30%, and the services guide raise reflected genuinely faster conversion. What we did not anticipate was that the stock would rise 42.9% before those conditions were tested, which converted a rating that was about business risk into one that is almost purely about price.

Action: Maintaining Hold, conviction 5 out of 10, reduced from 6. The lower conviction is deliberate and reflects that this is now a narrow valuation call on a business executing better than we modelled, and that we were wrong on the trade for a quarter. We are not chasing at 44.8x with the price give-back approaching and the fourth quarter guided to 7.4% earnings growth. The datapoints that would move us to Outperform are a third consecutive quarter of service revenue acceleration above 14% combined with an actual backlog or book-to-bill disclosure, or a de-rating toward the mid-$120s that restores a multiple near 32x our 2027 estimate. The datapoint that would move us to Underperform is the first quarter in which product revenue growth falls below 25% while the price reversal is still ahead rather than behind, because that combination would put both the growth rate and the margin under pressure at the same time.