Fortinet Inc

NASDAQ:FTNT

Earnings Call Analysis

Fortinet Q1 2024: Strong Free Cash Flow, SASE Focus, Optimistic FY Outlook

In Q1 2024, Fortinet's operational margin increased by 200 basis points to 28.5%, setting a record for the first quarter. The company generated record operational cash flow of $830 million, with an adjusted free cash flow margin of 61%. Fortinet has been investing in the unified SASE and secure operations market, which made up one-third of the quarter's billings. Despite a 6% decline in total billings, revenue reached $1.35 billion, a 7% increase year-over-year. For Q2 2024, Fortinet expects revenue between $1.375 billion and $1.435 billion and operating margins of 25.75% to 26.75%.

Financial Discipline and Operating Performance

Fortinet demonstrated robust financial discipline in Q1 2024. The company increased its operating margin by 200 basis points to a record 28.5% and generated a record cash flow from operations totaling $830 million. The adjusted free cash flow margin stood at an impressive 61%, emphasizing the high efficiency of the business. Despite macroeconomic uncertainty, Fortinet managed to drive substantial operating margins, achieving favorable outcomes across key financial metrics.

Revenue and Margin Insights

Total revenue grew by 7% to $1.35 billion, primarily driven by a significant increase in service revenue of $944 million, which rose by 24% and now accounts for 70% of total revenue. The shift towards service revenue, which typically carries higher margins, bolstered the overall gross margin to 78.1%, up 180 basis points. However, product revenue decreased 18% to $409 million, reflecting the challenging comparisons to last year's backlog fulfillment.

Strategic Wins and Expansions

Fortinet secured several significant deals in Q1, illustrating strong market penetration and customer trust. For instance, a major U.S. financial institution selected Fortinet solutions for data center updates and consolidation, emphasizing Fortinet's ability to lower the total cost of ownership and meet stringent performance requirements. Similar successes were noted with a hospitality company and a large hotel and restaurant chain, highlighting Fortinet’s competitive pricing and comprehensive security solutions.

Investment in SASE and AI Integration

The company continued its focus on the unified SASE (Secure Access Service Edge) and advanced AI technologies. Unified SASE accounted for 24% of total billings in Q1 2024, with Fortinet planning to run promotions to introduce these solutions to new customers. The company also launched FortiAI, an AI-driven security solution, aiming to enhance its network and security products further. Fortinet's commitment to integrated security solutions positions it strongly in the increasingly digital and connected world.

Guidance and Future Outlook

For the second quarter of 2024, Fortinet expects billings between $1.490 billion and $1.550 billion, and revenue in the range of $1.375 billion to $1.435 billion, representing a 9% growth at the midpoint. The non-GAAP gross margin is projected to be 76.5% to 77.5%, with a non-GAAP operating margin between 25.75% and 26.75%. Full-year guidance includes expected billings of $6.400 billion to $6.600 billion, revenue between $5.745 billion and $5.845 billion, and non-GAAP earnings per share of $1.73 to $1.79.

Strategic Positioning and Market Share

Fortinet believes it is gaining market share in secure networking, with significant investments in advanced FortiOS and FortiASIC technologies. The recent Gartner Magic Quadrant recognitions underscore its leadership in various segments, including secure SD-WAN and enterprise firewall solutions. The company’s holistic and integrated platform approach, powered by one operating system, positions it uniquely against competitors, allowing for consolidation of security solutions and enhanced customer value.

Earnings Call Transcript 2024-Q1

[Operator]

Good day and thank you for standing by. Welcome to the Fortinet 1Q 24 Earnings Announcement Conference Call. [Operator Instructions] Please be advised that today's conference is being recorded.

I would now like to hand the conference over to our first speaker today, Peter Salkowski, Senior Vice President of Investor Relations. Please go ahead.

[Peter Salkowski, executive]

Thank you, Brianna. Good afternoon, everyone. This is Peter Salkowski, Senior Vice President of Finance and Investor Relations at Fortinet. I am pleased to welcome everyone to our call to discuss Fortinet's financial results for the first quarter of 2024. Joining me on today's call are Ken Xie, Fortinet's Founder, Chairman and CEO; Keith Jensen, our CFO; and John Whittle, our Chief Operating Officer.

This is a live call that will be available for replay via webcast on our Investor Relations website. Ken will bring our call today by providing a high-level perspective on our business. Keith will then review our financial and operating results for the first quarter of 2024 before providing guidance for the second quarter of 2024 and updating the full year. We'll then open the call for questions. During the Q&A session, we ask that you please be yourself to one question and one follow-up question to allow others to participate.

Before we begin, I'd like to remind everyone that on today's call, we will be making forward-looking statements, and these forward-looking statements are subject to risks and uncertainties, which could cause actual results to differ materially from those projected. Please refer to our SEC filings, in particular, the risk factors in our most recent Form 10-K and Form 10-Q for more information. All forward-looking statements reflect our opinions only as of the date of this presentation, and we undertake no obligation and specifically disclaim any obligation to update forward-looking statements.

Also, all references to financial metrics, which we make on today's call are non-GAAP, unless stated otherwise. Our GAAP results and GAAP to non-GAAP reconciliations are located in our earnings press release and in the presentation that accompany today's remarks, both of which are posted on our Investor Relations website. The prepared remarks for today's call will be posted on the quarterly earnings section of the Investor Relations website immediately following the call. Lastly, all references to growth are on a year-over-year basis unless noted otherwise.

I'll now turn the call over to Ken.

[Ken Xie, executive]

Thank you, Peter, and thank you to everyone for joining our call. Q1, we've managed business with strong spending discipline and increased our operation margin 200 basis points to a first quarter record of 28.5%. We also generated record cash flow from operations of $830 million, and our adjusted free cash flow margin was 61%. We remain focused on investing in a fast-growing unified SASE and secure operation market, which combined accounted for 1/3 of first quarter billings. We continue to gain security networking market share, leveraging our advanced differentiated FortiOS and FortiASIC technologies with an increasing number of large customer adopting our industry-leading secure networking solutions. Last month, attendance and our annual accelerate conference increased 25% year-over-year to nearly 5,000 participants, our unified SASE and new AI offering dominant the discussion with our partner and customers. For the first quarter, unified SASE accounted for 24% of total billings. To introduce customer and prospect to our new unified SASE solution, we plan to run attractive promotions this year in 2024. For several reasons, we believe no service secure company come close toward differentiated universal solutions. First, we have developed all unified SASE functionality into one single operation system, the FortiOS. This include a full networking and security set comprised of ZTNA, Secure Web Gateway, CASB and our market-leading SD-WAN and firewall technologies, providing content, application, user, device and location awareness to reduce the tax. Second, our unified SASE solution can be deployed on-premise in the cloud of both peer solutions send traffic to cope the PoP, increasing security risk and latency and is less efficient. Last, Fortinet unified SASE offer both traditional sulfur endpoint agents and higher agent such as for Wi-Fi access points and FortiSwitch for customers with easier deployment and more broad use cases such as unified SASE for OT and IoT devices. We expect our differentiated unified SASE offering to emerge as the SASE leader. Fortinet advanced platform approach has been earning third-party awards for many years. Last month, we entered Gartner Magic Quadrant for secure service edge.

As shown on the Slide 12 in the investor presentation. Fortinet is the only vendor recognized in the Gartner Magic Quadrant Report for security service edge SD-WAN, single vendor SASE, network firewall and enterprise wireless line infrastructure. all security and network offering from Fortinet are uniquely built on one operating system the FortiOS and a leverage of FortiASIC to increase secure computing power for more functions and better performance while lowering the cost and energy consumption. Fortinet secure solution, which are better integrated and ultimate together than competitors accounted for 9% of total billings, initially launched as part of our FortiSIEM and FortiSOAR, our gen AI technology FortiAI is being deployed across both networking and security products. And today, we announced the industry-first IoT security generative AI assistant. Customers can ask for FortiAI to help in 30-plus languages. Fortinet is also the market leader in OT security solutions, the fastest-growing space in network security with billings of device connected online, and the most OT device has a limited compiling power, making new secure the most effective experience of security.

Today, we announced the FortiGate 200G, a mid-range fire were powered by a new SD FortiASIC with secure computing rating of 3 expected performance real-time petites and industry average. We're enforcing our leading networking and unified SASE advantage that provides customers with industry-leading security functions, performance and power efficiency.

Before turning the call over to Keith, I wish to thank our employees, customers, partners and suppliers worldwide for their continuous support and hard work.

[Keith Jensen, executive]

Thank you, Ken, and good afternoon, everyone. Let's start with the key highlights from the first quarter. As Ken mentioned, we continue to manage the business through the macro uncertainty and successfully drove operating margin to a first quarter record of 28.5%, exceeding the high end of the guidance range by 200 basis points.

Free cash flow of $609 million represents a 45% free cash flow margin benefiting from strong Q4 '23 billings and their subsequent collection in Q1 of '24. Billings of $1.41 billion and revenue of $1.35 billion were within their respective guidance ranges. Looking at billings in more detail. While unified SASE and SecOps delivered strong billings growth, total billings declined 6% as expected. The billings performance was driven by the difficult year-earlier comparison, created by the backlog contribution to billings that occurred in last year's first quarter.

Total bookings were down just slightly. Unified SASE and SecOps had outstanding growth across a variety of benchmarks in the first quarter. In addition, we saw significant progress from our investments in unified SASE and SecOps. These include cross-selling into our large installed base. Existing customers delivered over 90% of SecOps in unified SASE billings. On an even more targeted basis, existing SD-WAN customers delivered 81% of unified SASE billings. Larger enterprises are proving to be our largest customer segment. with large and enterprise -- large and mid-enterprises representing 78% and 84% of SecOps and unified SASE billings, respectively. Even with increasing scale, both pillars have strong pipeline growth, 30% for SecOps and over 45% for unified SASE. More importantly, within SASE, the SSE pipeline growth is over 150%.

Our investment in SASE is being recognized by third-party agencies. We recently recorded the trifecta we Gartner SASE Magic Quadrants, SSE, SD-WAN and single vendor SASE. And as Ken noted, with last month's addition to SSE, Fortinet now appears in 5 network security Gartner Magic Quadrants, again, all running on a single operating system. With the SASE Magic Quadrant Trifecta, customers have shown increased interest in learning more about our unique SASE platform that runs on the one operating system with one unified agent, one management system, and one data lake. To offer an example of customer interest at our Accelerate conference early last month, the SASE demo booth was our most active as customers surveyed SASE's new features and functions including end-to-end digital experience monitoring, remote browser isolation, advanced data loss prevention and third-party SD-WAN connectivity. As a second example, Nearly 25% of the accelerated attendees who joined our CMO for the SASE breakout session. The attendee number for this breakout session would have been even higher if it wasn't for the fire marshals regulations that forced us to turn away customers and partners who are eager to hear more about the SASE offering.

And to offer one final example, the customer partner SASE Fast Track training program at Fortinet, which launched in January, is already this #2 most attended technical training session, trending only a single vendor SASE partner, SD-WAN. We're committed to driving more effective security solutions worldwide and welcome greater partnership with our industry peers. The new third-party SD-WAN connectivity technology is designed to support consolidation not only on Fortinet, but with Fortinet.

In terms of scale, we continue to open new Google and Fortinet PoPs in sync with our customers' expanding footprint and driving the deployment scale demanded by large enterprises. And a quick update on that 7-figure 300,000 seat education deal that we mentioned last quarter, the full production environment was activated in March, and we are on track to have their 300,000-plus seats on board to start the new school year.

To expand on Ken's earlier comment on today's AR-related announcement, Fortinet Gen AI assistant follows our FortiAI launch last year, by supporting and guiding SOC and NOC teams as they configure and manage changes to their network and investigate and remediate threats. Its intuitive interface allows individuals to engage using 30 different natural languages bridging the industry's skill shortage. I encourage everyone to visit fortinet.com to learn more about the Gen AI system.

Rounding out our billings commentary, SMB was a top-performing customer segment. International emerging was our best-performing geography, and our 3 largest industry verticals continue to be worldwide government, service providers and financial services. Service provider and worldwide government experienced the highest growth while retail and financial services were a bit more challenged.

As noted in our prior call, the 6 8-figure deals in Q4 '23 pushed our average contract term in DSO to elevated levels. The average contract term in the first quarter was 27 months, down just under 1 month year-over-year and 3.5 months quarter-over-quarter. DSO decreased 12 days year-over-year and 23 days quarter-over-quarter to 66 days.

Turning to revenue and margins. Total revenue grew 7% to $1.35 billion, driven by service revenue growth. Service revenue of $944 million grew 24%, accounting for 70% of total revenue and a revenue mix shift to services of 10 points. Service revenue growth was led by over 30% growth from unified SASE and SecOps. Product revenue decreased 18% as expected, to $409 million coming off a challenging 35% year earlier compare impacted by backlog fulfillment in the prior year.

Software license revenue increased 20% and represented a mid- to high teens mix of product revenue. Total net product bookings were down just slightly. Combined revenue from software licenses and software services such as cloud and SaaS security options, increased 29% and represented an annual revenue run rate approaching $750 million. Total gross margin of 78.1% was up 180 basis points and exceeded the high end of our guidance range, benefiting from the mix shift to higher-margin service revenues. Service gross margins of 87.9% were up 200 basis points as service revenue outpaced labor cost increases and benefited from the mix shift towards higher-margin FortiGuard security subscriptions.

Product gross margin of 55.7% as we -- pressured as we saw challenges related to inventory levels and the transition to a more normalized demand environment. Operating margin of 28.5% and was 200 basis points above the high end of our guidance range, reflecting the strong gross margins and prudent cost management.

Looking at the statement of cash flows summarized on Slide 16 and 17. Free cash flow was $609 million. Adjusted free cash flow, which excludes real estate investments, was $821 million, representing a 61% adjusted free cash flow margin. Infrastructure investments totaled $222 million, including $212 million of real estate investments. Cash taxes in the quarter were $31 million. And while we did not repurchase shares in Q1, share buybacks have totaled $5.3 billion over the past 4-plus years and the remaining buyback authorization is $1 billion.

Now I'd like to share a few significant wins in the first quarter. I'll start with the 1 8-figure deal in the quarter, a competitive displacement and new logo win. This large U.S. financial institution selected Fortinet as part of their data center update and consolidation projects. Key to this win included our experience in this highly regulated customer data sensitive industry and our ability to lower the total cost of ownership and exceed their low latency performance requirements. Similar to other large financial institutions separating from their incumbent, this customer is expanding their Fortinet footprint by adding our SD branch solution and planning to consolidate additional technologies. Next, in the competitive 7-figure win, a hospitality company that serves over 5 million guests annually, updated their various Fortinet solutions, including their FortiGate firewall footprint and Fortinet solutions. Keys to expanding our relationship included our price to performance advantage on the firewalls and the next solutions proven ability to discover and lock down devices that attempt to join their network, together with the operational simplicity, and integration of a dozen different Fortinet solutions the customer uses. In another 7-figure deal, a hotel and restaurant chain purchased our SD branch solution for 800 locations as well as our data center FortiGates for centralized management and enhanced security. The solution from our network security pillar included firewalls, switches and access points as well as a variety of software products.

The SE branch solutions bring improved efficiency and security over their branches and IoT devices. Key to this win and in other retail opportunities is enabling retailers to deploy, expand and deliver a growing array of in-store digital solutions to support their customers' experience and increase their top line performance. As these customer wins illustrate, our Security Fabric platform includes each of our security pillars, unified South, AI-driven SecOps and secured networking, making it the most integrated most open portfolio of products in the industry backed by one operating system, FortiOS; one unified agent, FortiClient; one management console, FortiManager; one data lake FortiAnalyzer and open APIs and integration with over 500 competitor and other third-party products. This integration allows customers to consolidate security solutions, thereby reducing operational costs, while increasing security effectiveness.

Moving to guidance. As a reminder, our first quarter and full year outlook, which are summarized on Slides 21 and 22, and are subject to disclaimers regarding forward-looking information that Peter provided at the beginning of the call. For the second quarter, we expect billings in the range of $1.490 billion to $1.550 billion which at the midpoint represents a decline of 1%. Revenue in the range of $1.375 billion to $1.435 billion, which at the midpoint represents growth of 9%. Non-GAAP gross margin of 76.5% to 77.5%, non-GAAP operating margin of 25.75% to 26.75%. Non-GAAP earnings per share of $0.39 to $0.41, which assumes a share count of between 775 million and 785 million. Capital expenditures of $30 million to $40 million, a non-GAAP tax rate of 17% and cash taxes of $240 million to $270 million.

Before updating the full year guidance, I'd like to elaborate on the backlog headwinds easing in the second half of 2024 and share what we believe we are starting to see as early signs that the firewall digestion cycle is nearing completion. First, the billings headwind from last year's backlog drawdown is over $150 million in 2024. And gradually diminishes throughout the year with no headwind in the fourth quarter. And second, we're looking for early signs of a more normalized firewall market.

One metric we watch is the average days to register security service contracts, as shown on Slide 19. In 2022, we noted that the user registered has increased about 50%, which was consistent with customers buying and stocking behaviors at the time. More recently, this metric decreased by about 25% from SP and is now consistent with late 2021 levels. It is on a pace to return to normal levels in the second half of 2024. A reasonable read-through of the data is that customers are completing the inventory digestion process and are on the path to a more normalized firewall buying behavior.

And with that, for the year, we expect billings in the range of $6.400 billion to $6.600 billion. Revenue in the range of $745 million to $5.845 billion which at the midpoint represents growth of 9%. Service revenue in the range of $3.940 billion to $3.990 billion, which at the midpoint represents growth of 17%. Non-GAAP gross margin of 76.5% to 78%, non-GAAP operating margin of 26.5% to 28%. Non-GAAP earnings per share of $1.73 to $1.79, which assumes a share count of between 780 million and 790 million. Capital expenditures of $350 million to $400 million, a non-GAAP tax rate of 17% and cash taxes of between $500 million and $550 million. I look forward to updating you on our progress in the coming quarters.

And I'll now hand the call back over to Peter to begin the Q&A session.

[Peter Salkowski, executive]

Thank you, Keith. [Operator Instructions] Operator, please open up the line for questions. .

[Operator]

Our first question comes from the line of Hamza Fodderwala from Morgan Stanley.

[Hamza Fodderwala, analyst]

Perhaps both for Ken and Keith, you spoke to a lot of green shoots in your prepared remarks, SMB service provider growth looks a little healthier. You're getting a recognition on SASE and you spoke to competitive replacements. That said, the billings in Q1 was a bit closer to the lower end of your guidance versus the high end. So just curious what drove that? And what gives you confidence based on what you're seeing in the pipeline to maintain your guidance and continue to assume a reacceleration on the top line in the back half of the year?

[Keith Jensen, executive]

Yes, I'll talk about the full year. I think that if you look at where we ended up in the first quarter, inside the guidance range, maybe just a little bit of weakness that we saw in Europe, just enough to move us off the midpoint, but not really a big movement in terms of where we are in our final results compared to the midpoint. And if we look at where we end up with the total for the year, I don't think we're at all far off from the plan that we thought. Maybe there's some more to an toss there that you're kind of pointing out. But as we look at the pipeline, to your point, I think the mix that we see in our pipeline today, together with some of the hygiene improvements that we worked on for the last 6 to 9 months, I think we feel better about where we end up with the full year numbers, if you will. I think at the same time, when you look at the full year numbers and some of the outperformance in the quarter or better performance, if you will, with service revenue and product revenue, you see us bringing that number up a little bit. But importantly, at the same time, you see us also bringing up the margin number on the bottom line by about 3/4 of a point.

[Ken Xie, executive]

I think the high interest rate, making the money kind of more expensive have a lot of enterprise kind of probably more favor OpEx instead of a CapEx for some of the bank working security project. So that's where -- that's also the reason we're starting shifting the focus more on the kind of skin of secure up, which is really more helping company saving the cost at the same time. kind of -- some kind of OpEx model. So that's probably -- at the same time, we do make some adjustment in the certain product price back to like per pedamic level before the sureties. That's happening in Q1, probably has a little bit of impact, but it's -- overall, I think the product competitive is still more and more strong, and we still see a lot of replacement of our competitive product, which tend to be more expensive. And especially the new foot introduced last month with more function, including the function in unified SASE, all these things drive a lot of our change from the customer, and they're all interested to these new OS and the new product we have launched.

[Operator]

Our next question is from Gabriela Borges of Goldman Sachs.

[Gabriela Borges, analyst]

For either Ken or Keith, I'd love to get an update on your pricing strategy more broadly. More specifically, how do you think about the trade-off between discounting when you're cross-selling a broader bundle of portfolios such as SecOps or SSE services versus being able to capture some of the value from the cross-sell. How do you think about that trade-off?

[Ken Xie, executive]

I think our price strategy is pretty consistent in the last 20-plus years. We want to maintain a healthy gross margin and also a healthy margin for the partners. And when we see certain cost increase like doing the supply chain shortage, whether the component costs or some shipping costs increase, we kind of increase the price. But now some of the costs coming down, we also kind of returned some margin to the partner and also low on product price to match the per pyretic level. But I think all this price change in missing is over and also we're probably more focused on the new product and which follow kind of a healthy margin guideline. And I don't think we have adjust any pricing for the existing product anymore. It's really more focused on when we introduce a new product, we just want to make sure it's a healthy margin for all the parties.

[Operator]

Our next question comes from Brian Essex from JPMorgan.

[Brian Essex, analyst]

Appreciate it. Maybe for Ken, in terms of the SASE traction that you saw in the quarter, how much was SD-WAN conversion -- and maybe a little bit -- if you could give us a little more color on the split of the customers that you saw in that business, the spot of maybe large and made small enterprise, so we can get a sense of competitively how you might be lining up against some of the peers in that SASE market?

[Ken Xie, executive]

I think that's a great question. I think we have a slide for that.

[Keith Jensen, executive]

Try to ask that question. Yes. I think we also included in the prepared and I'll tap the answer while somebody follows the actual slide number for you, Brian. But I think that existing customers were over 90% for both SASE and for SecOps. So they were expansion sales. And Ken's kindly pointing out to me my Slide #8 is in the deck that actually give you a little more context for it. One change you may notice there is that -- for the first few quarters when we talk about customer mix and expansion opportunity, we did it by customer counts, believing that we were going to have a lot of penetration with the SMB space. And that was where you get a larger number to start seeing some patterns. What we've now seen is that the large enterprises and the mid-enterprises are actually dominating both of those pillars of growth. And with that, we've just converted those pie charts to dollar values, which is more traditional where we expect it to get eventually.

[Brian Essex, analyst]

Okay. Great. Maybe just as a quick follow-up on that topic. I think you mentioned, if I'm not mistaken, unified SASE 81% of -- I'm sorry, SD-WAN, 81% of unified SASE billings. And I think you might have given that metric to back into SD-WAN last quarter, if you could maybe iterate what that was?

[Keith Jensen, executive]

Yes, Brian. What we're trying to say there is that I think we're -- there's a common belief internally and probably externally that we're going to have a lot of success with the SASE solution by cross-selling our existing SDN customers. And so the SaaS buildings that we saw this quarter I believe the number was 81% of those were existing SD-WAN customers.

[Ken Xie, executive]

And also, we build HVM function into the FortiOS, which whenever you have a FortiCare, we believe like close to 60%, 70% customer all have by the FortiCare. They have automatic function. And so that's where we do see other SD-WAN -- SD-WAN customer, which were not fully tracking because the part of our list function free of charge. So we do believe a lot of them are interest come into SASE for SASE function there.

[Operator]

Our next question is from Fatima Boolani from Citi.

[Fatima Boolani, analyst]

Keith, I wanted to -- have you spent a little bit of more time talking about some of the geographic theater level performances. So we've seen a pretty material deceleration in your Americas business. And he has been relatively resilient and APAC actually shrunk this quarter. So I was hoping you could put a lens on each one of those geographies to talk about any nuance or idiosyncrasies from a demand and/or buying perspective from an end market standpoint or a customer attribution standpoint? And then just a follow-up with regards to if you can talk about the pipeline and pipeline growth you're seeing with secure SD-WAN proper considering that is such an important conduit for future sappy upsells.

[Keith Jensen, executive]

Okay. where to begin. Kind of cherry picking through some data points. I think one -- first and foremost, the SMB continues to perform stronger than expectations, whether that's external to the company or from other sources, if you will, it's very resilient. And I think it's simply the breadth of the SMB space together with, as I've said in the past, the success of the channel program. I think Europe was just a tab that light in the quarter and a little bit on the enterprise side of their business and probably just enough, as I said before, to move us off of the midpoint of our guidance. I think what we spent a fair amount of time with more recently is looking at where the 8-figure deal is coming from. And if you're looking at the deceleration and let's take the U.S. enterprise as an example of that. Last quarter, we talked about 6, 8-figure deals in the business. The vast majority of those are in the U.S. enterprise. This quarter, we generally noted that we had one 8-figure deal. And so you can see that those 8-figure deals can whipsaw that growth rate for the U.S. enterprise around quite a bit really because if there are opportunities in these 8-figure deals that maybe some of the other geos don't have. We really don't have those opportunities in APAC and some of the other geographies that we see in the U.S. I think the other part of growth, I mean, I think we I think we have to understand where the firewall growth is right now in terms of the industry. And with that, it puts a lot of the pressure or opportunity for us to sell the SASE solutions and the SecOp solutions. And you're probably seeing a little more maturity in the ability to sell or the openness to buy SecOps and SASE solutions in the U.S. and in Europe, the larger economies than you are in APAC.

[Ken Xie, executive]

We also Japan probably kind of about is the biggest country for us in APAC and probably 1/3 of more APAC, which the currency like the U.S. currency pretty strong again. Japan currency is that may also have some impact of some slowdown there. On the other side, we do see most SD-WAN customers definitely more interest in the and also in the current environment, more and more customer set in terms SD-WAN because SD-WAN definitely give them a cost saving. So on average, it's about 50% in cost savings compared to the traditional NPI or other networking function there. So we do see more and more customer first converting to SD-WAN customer and then using the same [indiscernible] adding additional SASE function there.

[Operator]

Our next question comes from Tal Liani of Bank of America.

[Tal Liani, analyst]

You gave some comments at the end of your prepared remarks about signs of recovery of the firewall market? And would you mind to repeat that? You went over quickly in -- the question is also with it, do you expect the non-FortiGate to recover? Is there a correlation between the two? Do you expect the non-FortiGate to recover? And -- or does it have its own cycle. On the first question, which is about the firewall recovery, do you see that the market share situation is changing, meaning the share gains you experienced in the 3 years of the boom cycle, do you have any reason to believe that it's going to slow down or you're going to maintain market share gain? How does it change when the market recovers, what drives the share dynamics to change or to stay stable?

[Keith Jensen, executive]

Do you want to take the market share and make and then I'll go through the algebra -- Slide 19.

[Ken Xie, executive]

I think we believe we continue gaining market share even right now the quarter -- last quarter in the call secure networking, which both the firewall and also some order like for the WiFi FortiSASE space there. And I think because whether the strong performance advantage, we have all kind of more function can give a customer like a better ROI return and better security and also more deployed case compared with the traditional firewall. So we feel we're keeping gaining market share. But overall, I have to say that whether the network secure our market or the medical market definitely has gone down like 10% to 20% year-over-year. But even in that market condition, we keep on gaining more share -- market share in this environment. Keith probably will answer the digestion question.

[Keith Jensen, executive]

But yes, for people that have access to it, Slide 19 in the deck. And for those -- a lot of you have followed the company for quite a while and you remember that we have some pressure on software revenue early in the pandemic, and we talked about things like the impact from Russia, but also that we were seeing a delay in customers registering the service contracts that attached to the hardware contracts. And if you look at that chart, you can see that, that delaying activity really started at the end of 2021, peaked at the end of the beginning of '23, kind of plateaued and now has moved down. And what we believe as you're seeing there is that when the supply chain hit, customers bought the equipment, put it on the shelves and did not need to register the contract as quickly and that's why you saw the increase in the days of register. Now as we move through the digestion cycle, you've seen that inventories come off their shelves and those days to register are starting to return to normal. We're not quite there, but we're actually quite close to it. And I would just offer that, I think, as I said, by the second half and the second half of this year on the current pace, we would return to where we were at pre-COVID on that metric. And again, we think that's a very good indicator of where customers are in the digestion cycle.

[Tal Liani, analyst]

Got it. And what about the question on non-FortiGate. What are the cycles within non-FortiGate on the FortiGate side?

[Keith Jensen, executive]

Well, first of all, you're going to get me in trouble for using the term non-FortiGate. We talked about SASE and SecOps, but we're all showing our age here a little bit.

[Ken Xie, executive]

The notice probably around 10% of our product, that's probably -- all the networking side, definitely down a little bit, but there's some other like whether the FortiWeb, FortiMail some other we see for we see pretty strong growth. So it's a mix. But overall, I think pretty much similar like the FortiGate mix. But definitely, we see it. And on the other side, we do see some early signs of interest a customer using our full WiFi AP FortiSWitch as a hardware agent for the SASE. So that's also one of the promotions we're going to really offer some customer. If they got a fully Wi-Fi, they probably can run some free FortiSASE function for some time. So that we see could be driving additional non-FortiGate growth. But we -- actually, all the non-FortiGate product, we also have a technology called FortiLink. It's all liquid FortiGate, like FortiGate, whether that's kind of the aging firewall host or a host working together with for WiFi or FortiSwitch.

[Operator]

Our next question is from Rob Owens of Piper Sandler.

[Robbie Owens, analyst]

Keith, I want to build a little bit on your answer to Fatima's question earlier. And I believe you used the technical term of whipsawing when it comes to growth when you saw large transactions, very large transactions in Q4 and 1 in Q1. And just I wanted to ask it relative to health and enterprise and what you're seeing here in the pipeline. And should we expect similar types of results in terms of those very large deals as we move throughout the year? And how do you think the pipeline is setting up in relative health of the enterprise?

[Keith Jensen, executive]

Yes, I feel good about it. And I think we're -- the parallel that I've drawn in the conversations before is that if you went back to 2015, '16, you saw the company moving away from -- or expanding beyond the SMB space and doing $1 billion deals but it wasn't that there was enough $1 million deals that we couldn't get whipside by them then. Now we've got plenty -- well, I can always take more plenty of million dollar deals, but the $10 million deals are whipsawing us around a little bit. You saw that with a very strong performance in the fourth quarter. And I think we were pretty open about that in the fourth quarter and setting expectations for the first. One thing we have spent some time doing is going back and looking at the number of 8-figure deals we have by quarter, for, say, the last 3 or 4 years, and you're looking at a model that maybe had 1 of the other quarter or 5 years ago to now where you're probably average something on the order of 2, perhaps 3 of opportunities over a full year per quarter. They're going to get condensed sometimes in certain quarters. With our business model in the history, you see that Q4 obviously outperforms as does Q2 typically perform strongly. And I suspect as we look forward, we'll see a little more concentration on those 8-figure deals certainly in Q4 and maybe some in Q2. .

[Operator]

Our next question is from Saket Kalia of Barclays.

[Saket Kalia, analyst]

Okay. Great. Ken, maybe the first one is for you. I was wondering if you could just talk a little bit about how your conversations are going with customers around their plans to refresh their firewall appliances. And maybe specifically, when would we sort of expect that firewall refresh to sort of begin? Does that make sense?

[Ken Xie, executive]

Yes. The 3 parts of the business. One, like Keith mentioned, is really the digestion whatever supply chain issue. I think that's pretty much over, maybe just a few more months will be all normal. And the second part is really the refresh, which is the current customer over the new product, which has a better performance, all the things there. I have to say, in the economy slowdown of high interest rate environment, some customer may stretch the current product a little bit longer. And -- but we do see more cases, we call it replacement and also the new area like OT, IoT security. So we do see the requirement pick up quite well, which when they face in like where they need a new function, like the new SD-WAN function or the state function, a lot of our big enterprise starting using our product to replace a more competitive product because they have to offer like multiple product to match an FortiGate for the U.S. solution there. And we also have a much better performance and power efficiency. We use in ecomet the measure for every product. So that's replacement case, definitely picking up quite well. The refresh probably would still need some time to come.

And on the other side, the new area like OTT security, we see other strong growth. So that's a new market because really all this OT devices not connected online or kind of canola has now protection and pretty much impossible to run endpoint software because of different operating system living computing power. So we see this new OTL space pick up quite well. That's the new market. So long-term wise, I still believe the network security market continued to grow. And -- but probably will be more mix in the current environment, probably a little bit more towards the OpEx model, which is kind of a -- and -- but for us, the differentiation is really, we have all the staff in the same FortiGate operating system FortiOS, which customers can run with the on-premise or in the cloud and the pop. So we do see a lot of customers that in turn on the strategy function, maybe starting to SASE function first, then the additional strategy function, additional sat service. So that's the way they are starting doing now.

[Saket Kalia, analyst]

Got it. Got it. And maybe the follow-up is on that point, kind of if I can stay with you. Just on that topic of refresh and replacement is there any sort of change in thinking for those customers about firewall versus SASE? And I mean, as part of the discussion, you mentioned pricing earlier, are you getting any sort of pushback on just appliance pricing since sort of the prior round of adjustments that you did sort of during the supply chain?

[Ken Xie, executive]

We have not seen any pricing pressure discount because we tend to be much better performance and more function because of ASIC technology and none of our competitor has. On the other side, do you customers consider a new function they needed for security or higher network speed environment, I think compare us to some competitor because competitors sometimes they just cannot keep in function like all the SD-WAN function in their existing firewall for us is very, very different. So we have all the IT function, all the new SASE function built in into the same FortiOS running on different kind of FortiCare device there. So that's also kind of helping customers to really keep adding additional functions sometimes without really replacing the existing hardware, so that's really helping the customer keeping kind of adding surveys and had secured with new function there. And also, that's also driving a lot of replacement of our competitor solution, especially in the big enterprise environment. So that's we see the strong -- the strongest growing area for us actually is enterprise customers, which they not enter some finance stretch because the high cost are the money. But we do see that the growing in our enterprise space or strong and a lot of replacement of competitive solution using the FortiGate which has a more function, better performance, low cost and also more efficient on the energy consumption there.

[Operator]

Our next question comes from Brad Zelnick of analysts.

[Brad Zelnick, analyst]

And because we just had 2 for Ken, I think I'm going to now go for 2 with Keith, if we could. Keith, first one, I think, pretty straightforward with $1 billion left in your buyback authorization and the strong cash generation of the business, I was surprised to see and not buy back any stock in the quarter. Can you just remind us of your approach to buybacks and if any change in thinking around use of cash and specifically M&A?

[Keith Jensen, executive]

Peter's point, get our COO for M&A answers. So we're all -- listen, leaning forward here wants to say. I don't think there's been any real change in our buyback philosophy. We -- the term we use is we're very opportunistic. We do put a program in place with one of the Wall Street firms each quarter and we renew it. I think the important part there is looking at the $5 billion that we bought back over the last 4 years, and it's not that we're doing some other companies would do x percent of free cash flow or something like that. It is really looking for market opportunities and when we see them. can typically steps in and have something set up in that regard. And now John Whittle has been -- going to get a chance to join.

[John Whittle, executive]

Thank you for the question. on M&A, we've always been very, very disciplined. We've done some very strategic tech and talent tuck-ins. And I think you'll see -- we're open-minded. We consider M&A as it makes sense, but that's definitely been our approach so far. And I think you'll see that approach continue, although we will be at the minded about M&A as it makes sense.

[Brad Zelnick, analyst]

And maybe just my follow-up. I'm sorry, please.

[Ken Xie, executive]

Probably is the most busy time in the last 10, 20 years now to look at all different companies.

[Keith Jensen, executive]

Yes. We see a lot of opportunities in the securities base for sure. And so yes, we build a pipeline just like sales build the pipeline, and we consider them as they come along and reach out on product as well.

[Brad Zelnick, analyst]

Got it. That makes all the sense in the world, and you guys have done a great job of it over the years. Maybe just on the margin discipline that -- and the leverage that we're seeing in the quarter, Keith, can you maybe just give us an update on head count plans and where you are year-to-date? And as maybe relative to 3 months ago, how enthusiastic you are and where you are in sort of pushing or pulling back on the throttle to continue hiring and how we should think about OpEx? If I can, we're going to say something on hire.

[Ken Xie, executive]

It's okay. I think we continue to invest balance the gross margin. So the area like a lot of on the long-term product, we continue to invest, and we do the selective hiring. And also, we also take this opportunity to mixing the management ratio or structure will be better. So it's more invest in the field sales engineering and also the R&D area and the kind of more flat on certain management level and making the whole company more efficient.

[Keith Jensen, executive]

Yes. I think the -- setting aside the fact that need more resources in finance, but I was hoping Ken was just going to announce that, but that's probably not. The -- I think the business model, Brad, you've seen it through the cycles where -- if you look back at 2017, for example, and if you look at the gross margin number, when you start to see the slowdown of the pause, the cycle and the hardware, you start to see the mix shift to the really rich services. And then as the market recovers, you see that relationship change a little bit. Clearly, we're in a situation right now with the firewall market that the mix shifted 10 points of services, and I think that was 87% gross margin. it's making margin targets very achievable, let's put it that way. And I would imagine, I think we raised it by 0.75 of a point at the midpoint for the full year. That's a pretty big move at this point and I think we feel very comfortable with that as we look at the rest of 2024.

[Operator]

Our next question comes from Ben Bollin of Cleveland Research Company.

[Benjamin Bollin, analyst]

Keith, I was hoping you could talk a little bit about the receivables drawdown and the DSO performance. I believe you made a comment on your prepared remarks about large deal impact in collections, but it does look like DSOs are below what we've seen for the last few years. So I'm curious if there's a change in working capital management. Anything notable there?

[Keith Jensen, executive]

No, I don't think there's really a change. I think there's always a few puts and takes, if you will. I think the real driver was that last quarter, we had those 6 8-figure deals, and I believe all those closed in the last week or 2 of the quarter. So that put a lot of pressure on DSOs and only having one 8-figure deal this quarter, which I believe closed fairly early in the quarter in mid-quarter, but not in the last week. So I think that's really all I would point to there.

[Benjamin Bollin, analyst]

Okay. And the last one for me. You talked a little bit about duration. If you step back, a lot of your business is done through the partner community. Do you have any thoughts on how much of that business is being financed by the partners themselves to manage this kind of CapEx to OpEx appetite? Any thoughts there would be helpful.

[Keith Jensen, executive]

Yes. I think when you say partners, I would say that all the large distributors that we're working with there offering financing programs, either in some cases, it might be through their own captive. But I think more often not, it's white labeling somebody else's product, if you will. I think that also some of the larger resellers are also offering financing. I think that where it makes a little more sense for ourselves as an OEM is on larger deals, whether we move to the extended payment program or working with the channel and provide them capital, if you will, for the financing. I think there's a lot of different ways to go there. But I don't think good credits, so to speak, are suffering because they can't find credit. I don't think that's the issue.

[Operator]

Our next question comes from Adam Borg of Stifel.

[Adam Borg, analyst]

Awesome. Maybe for Ken, last quarter, you talked about a great job with increasing traction with enterprise agreements. And I was hoping you could talk. Obviously, I know 1Q is typically a smaller quarter. Maybe talk a little bit more about the EA strategy overall and the go-to-market efforts to more systematically drive these enterprise agreements, especially in the back half of this year?

[Ken Xie, executive]

Yes, I think we do see when we have a more enterprise customer and they also want to be long-term customers and also with many different products like the consolidation strategy they have right now. We see more EA. And at the same time, with that one, we definitely see kind of a bigger deal and also kind of a more long-term customer can with us right now.

[Keith Jensen, executive]

Yes. I think that -- and John took this over. So he gets to make that [indiscernible] lap on EAs. But as Ken kind of alluded to it, it tends to make a lot of sense when -- you're -- most usually going to see it as part of your expansion inside of a larger enterprise. You're probably not going to see it frequently with the very first sale into a new logo, you could. And I think some things that are really we're starting to see resonate there are the new FortiPoints program that we make available and things with that nature where customers have reached that point where they're very comfortable for in that for the technology and our customer support, et cetera, and they start thinking about long-term relationships. They know they're going to buy more. They may not know what. But the combination of EAs and FortiPoints, I think, has been well received by the customer group.

[Adam Borg, analyst]

That's great. And maybe just as a quick follow-up. In the slide deck, I didn't recall seeing the breakout of the FortiGate by small, medium and large. I know that indicator has been less meaningful more recently. I was just curious, there anything interesting there as you think about the FortiGate sales by size.

[Keith Jensen, executive]

No. I think the two that take it really -- you see us at this point in the firewall cycle, it's really for us, we want to increase the focus on SASE. I think we feel very good about it. you see us adding some more information there. And to your point that it wasn't anything that was really new or earth shattering on the FortiGates.

[Operator]

Our next question comes from Keith Bachman of BMO.

[Keith Bachman, analyst]

And Peter and Keith, I appreciate the slides. I did find 7 and 8 to be quite interesting. And I want to focus my first question on that. And if you look at the amount of billings from SASE, 24%. Is there -- just any clarification on -- of that 24%, how much is SD-WAN? And then if I look at the SecOps really interesting that enterprise is 40% of the SecOps. And is there just any patterns or anything that's kind of bubbling up as a frequent purchase within the SecOps portfolio you have that is serving to be pretty interesting to the enterprise. I just -- I thought that 40% number was quite interesting. And believe it or not, I'm going to count that as one question. And then just anything you could think about or guide us on the FortiCare support line item as we think about the correlation to the product sales, and then I will cede the floor before Peter gets a chance to cut me off.

[Keith Jensen, executive]

I need to reverse what I covered FortiCare, FortiGuard. I think it's a great question is FortiCare, which is the traditional support offering, we talk about services being a lagging indicator. It's really what did you sell before and what rep you're recognizing now. And what's important is that FortiCare is going to be more closely linked to more recent product sales, right, because you have fewer products to attach it. So you'll probably see a little more pressure on FortiCare there. .

FortiGuard, which is the security subscriptions, which can be bundled, but they can also now be a variety of SecOp solutions and SASE solutions is getting a fair amount of tailwind from those other two pillars. So you will start to see, I think, and have seen a little more divergence in the growth rates as it goes through the cycle if we own between FortiCare and FortiGuard. In the FortiGuard actually has higher margins. And I think that we tried to call out in the prepared remarks that if you look at the SASE SecOps business, which I'll just broadly call SASE not currenty FortiCare and FortiGuard and our software licenses. You start to see a company now that has a run rate of about $750 million in say non-hardware and nonattached service contracts, which is pretty impressive, I think.

[Ken Xie, executive]

And I think since we only launched our own FortiSASE six months ago, we see pretty strong growth but also SD-WAN has been there for a few years. So I have to say, probably most -- a majority if not the most, SASE still more comes from SD-WAN, which is in the chart there. Maybe the better way to say is really look at the pipeline, so that's on key script. He said -- it's a unified SASE probably pipeline grow like 45%. And then the SSE pipeline growth over 150%. That's maybe a better indicator as a pretty strong for the interest and also leverage our both SD-WAN and the firewall market-leading position there. So we do see a lot of customer adding the SASE, adding the SD-WAN and convert some of them to the additional service, which will probably come about over 90% of our -- like the SASE business right now. And is also very strong interest from the customer right now. And at the same time, some of the trial program like using the FortiWiFi AP as a hardware agent offers certain free SASE service. That's also what drive additional like differentiated -- unified SASE approach compared to the other competitor in the market, which we also drive quite a lot of SASE specifies going forward. So that's -- that's also the reason we believe probably within a few quarters or a few years, we'll be the #1 leader in the sag market.

[Operator]

Our next question comes from Joseph Gallo of Jefferies.

[Joseph Gallo, analyst]

A lot of cool stuff around AI at your conference. FortiAI, any early feedback? And how are we thinking about monetizing that? And any impact to gross margins? And when can that benefit top line?

[Ken Xie, executive]

Yes. Could agree, there's a lot of interest in AI -- we started our time more fully to different products, which are helping customers more efficiently manage their operation there. And that's also what drive additional service, additional product out there. I'd say it's still more in the early ramp-up stage, and -- but the interest is we very high end, we do see some benefit already -- but how soon will be materializing.

[Keith Jensen, executive]

Yes, I think it's some more tactical responses to you. In general, we're charging for it separately. It's on the price list. It's additive to it and you're going to really push my technical knowledge, maybe somebody here can eat me out. But I think there's an LLM the customer has to go out and buy on their own in some cases to enable it. And then I would offer a really shameless plug. I really tell you, you should go look at our website and see the demo that was done at Accelerate with FortiAI, it was fantastic.

[Joseph Gallo, analyst]

Yes. We saw it live. Just a quick follow-up on really, really appreciate the time to register or days to register metrics really interesting. Was there any seasonality in that metric historically before after firewall cycle? Just trying to better understand if we should expect to find a floor at 2019 levels or if there's a potential another leg down?

[Ken Xie, executive]

I think probably if I look back to 2030 years when there's a big attack in the space, then they drive some kind of a new function, then there's some rush by something maybe impact some of them. Otherwise, it's pretty normal, I don't know, 7, 8 whatever a customer to register. And then the last 2, 3 years, the supply chain really changing sometimes certain channel partners on the distributor may try to have a little bit more inventory and some kind of customer because it takes some time to deploy, they also try to order some actual inventory. But that's pretty much normal now. If you play the order, you pretty much can better deliver right away. No longer has to lead time anymore. So that's where we see is the digestion pretty much go over, and it's pretty back to normal in the current environment now.

[Keith Jensen, executive]

And I think the charts actually goes all the way back to 2019. And you can see it by quarter there. Nothing jumps out of me in terms of seasonality by quarter that we really have that I would call out to it.

[Operator]

This now concludes the question-and-answer session. I would now like to turn it back to Peter Salkowski for closing remarks.

[Peter Salkowski, executive]

Thank you, Brianna. I'd like to thank everyone for joining today's call. Fortinet will be attending investor conferences hosted by JPMorgan and Bank of America during the second quarter. Fireside chat -- website link -- webcast link will be posted on the Events and Presentations section of our Fortinet's Investor Relations website. If you have any follow-up questions, please feel free to contact me. Have a great rest of your day. Thank you very much.

[Operator]

Thank you for your participation in today's conference. This does conclude the program. You may now disconnect.