Fortinet Is A Leader In A $200 Billion Market

In the recent write up on CrowdStrike (CRWD), we looked at one piece of the sprawling cybersecurity industry: endpoint security.

Endpoint security is extremely important. It is the "last line of defense" for many of the devices that users actually interact with, like laptops, mobile phones, and servers. CrowdStrike has a very strong position in that space.

But there is a lot more to it than just endpoint security. That particular segment makes up only 10% of the larger $200 billion cybersecurity market.

The company I'm looking at today, Fortinet (FTNT), has their own entry in the endpoint security space, but also offers products that cover much of the rest of the market. It is one of the most established and successful companies in its cohort.

And its stock is trading at an attractive price right now.

Let's take a look...

The Rest of Network Cybersecurity

A good bit of Fortinet's business is from hardware product sales for traditional "walled garden" enterprise networking and security. Just a few of the products sold by the company:

These represent the traditional "hard wired" company network, where all of the hardware for connectivity is owned by the corporation.

Fortinet also has a presence in "modern" corporate networks that are run through public internet connections. The company provides software that allows this (called SD-WAN controllers, for "software-defined wide area networks"), as well as software versions of the security applications listed above.

In endpoint security, Fortinet competes with CrowdStrike's Falcon with its FortiClient/FortiGuard platform.

Lastly, Fortinet is building out its offerings for a variety of newer security use cases. The company provides a wide array of products for VPNs and "zero trust" connections, SaaS connection firewalls, and several monitoring and response tools.

It is quite the extensive product portfolio! Fortinet's goal is to be a wholistic network security provider, whether that be traditional corporate networks or more modern cloud-based solutions.

Growth and Revenue Recurrence

Fortinet has a strong revenue growth history, with a 3-year CAGR of about 23%, and more recent trends exceeding 30% year-over-year.

From a top-down view, there is plenty of market potential to continue above-20% growth rates.

Fortinet is about a $4.4 billion revenue company at present. Management estimates the traditional enterprise networking and security market to be worth about $100 billion total by 2026. Combine that with another estimated $100 billion in newer solutions like Zero Trust, Cloud Security, and Security Operations, and there is quite an impressive market to attack.

I always like to buy leading companies in big market industries. It leaves ample room for continued rapid growth, even at a large scale, and even with a strong roster of competitors (which we will address later).

Recurring sales are less of a slam dunk. The hardware portion of the business is about a third of revenue, and has no built-in recurrence to it. Firewall appliances, switches, proxy servers and the like all have lifespans of many years.

However, 2/3rds of sales are from services. The service piece is split almost 50/50 between security subscriptions (for access to its cloud threat database) and maintenance fees (e.g. software updates) and technical support. These sales should be reliably recurring. Given that it is a majority of revenues, Fortinet gets the pass as a recurring revenue company.

Competitive Advantages

With such a huge and sprawling industry, there are bound to be some strong competitors. That is certainly the case here.

There are full solution providers that are very much like Fortinet, such as Palo Alto Networks (PANW).

Then there are a number of companies that are leaders in one of the segments of cybersecurity. Some good examples are (as mentioned) CrowdStrike (CRWD) in endpoint security, or zScaler (ZS) in Zero Trust.

And, of course, there are any number of competitors in enterprise networking equipment, including leaders like Arista (ANET) and entrenched behemoths like Cisco (CSCO).

Pretty much all of those companies are also Green Screen stocks at present! This is an attractive industry for investment, with great growth prospects and cash gushing business models.

All of this is to say that the opportunity is so large that competitive advantages aren't as critical here as they might be in industries with smaller addressable markets and lower barriers to entry.

Still, there are some to mention. Fortinet can claim a HIGH SWITCHING COSTS moat. Network security is mission-critical, "don't mess around with it" type stuff. Many of the firm's products run the "FortiOS", a common operating system that integrates with its cloud threat database FortiGuard. That makes it attractive for enterprises to standardize on Fortinet across the security stack, which in turn makes it harder to change vendors in the long run.

Is It Well Managed? Does It Make Money?

Brothers Ken and Michael Xie founded Fortinet in the early 2000's, and today continue to run the company as CEO and CTO, respectively. Ken has a long history in the industry, having previously founded Systems Integration Solutions (SIS), and Netscreen, which was sold to Juniper in 2004 for $4 billion. Collectively, they maintain 19% ownership, making both of them multi-billionaires who are highly invested in the company's future.

Founder-led firms always peak my interest. They are more likely to be managed for long-term gain (instead of quarter-to-quarter results). They better understand and cultivate a company culture. It is no secret that founder-led firms outperform the market.

Fortinet is financially impressive as well. Operating margins have steadily grown, from 7.4% in 2017 to over 20% today. Free cash flow margin has averaged an impressive 37% over those 5 years. Sales have increased 3x. The firm is efficiently run, with a free cash return on capital of over 60%! The Xie brothers have grown Fortinet without any of the value-destroying acquisitions we see in some companies.

Finally, unlike many tech firms, Fortinet has been a net share repurchaser, putting its ample cash flow to work reducing the share count by 10% over the last 5 years. That's largely unheard of in the tech space!

So, yeah... I would say Fortinet is very well managed and financially healthy.

Primary Risks

No investment is without risk. So what could go wrong with Fortinet?

Over a longer-term holding period, it is wise to be wary of the competition. While cybersecurity is a big industry, it is also one that has experienced rapid technological disruption. 20 years ago, the leaders were Symantec and Cisco. Today, both are seen as laggards. So far, Fortinet has been *gaining* market share, not losing it. If that trend were to start moderating or reversing, it would be cause for concern.

Seeing one or both of the founders leave would also be very concerning. Founder leadership is a substantial competitive advantage right now.

Finally, there is valuation risk. This is a $40 billion company still trading near 10 times sales. That implies substantial forward revenue growth, while still maintaining historical (very high) cash flow margins. If Fortinet's growth slows down, or new sources of revenue don't prove as profitable as in the past, the stock may prove to be overvalued.

Conclusion

I was a little hesitant to add another cybersecurity play to the Watch List so soon, but Fortinet is too good to pass up. The company is extremely well run, shareholder friendly, growing and gaining share in immense addressable markets, and has a largely recession proof business. Now looks like a good time to consider cybersecurity stocks, and this is one of the best available. A "green dot" stock for certain, it goes into the Watch List today.

Check out the FTNT stock page for thoughts on valuation and a good price to buy (members).