[Audio Gap] Companies. I wanted to get your perspective.
Yes. I would say cybersecurity is a very resilient market. The threat actors are not going away. And so far, we don't see any impact on our business from the volatility that you hear about and the expectations that GDP might go down. So we are very confident that we are not going to be impacted. And so far, we don't see signs.
Yes. And Ken, any -- when you discuss with your customers, when you discuss kind of spending plans with the customers, how do they react to the uncertainty because of tariffs, et cetera, is there any hesitation? And the reason why I'm asking is because there are two parts to your business. You have the growth SaaS and OpSec and others. And then there's also the more "legacy" that customers can sweat out or customers can upgrade -- delay upgrades. So how do they react to the uncertainty overall?
I think if you look at the cybersecurity space, there's some change in our environment where the working environment of most device connect online now. So that all drive the additional growth plus now the AI is the other driver. So we don't see this spending slowdown even in the current environment, a lot of uncertainty, but cybersecurity is probably more resilient compared to other IT spending.
So even -- like there's up and down in different markets this year, but cybersecurity market is still pretty stable, whether on the stock market or some other things there. I do believe the convergence will continue to going forward.
And also, the format may change a little bit because the next 10 years probably need more secure, a lot of device compared to the last 20, 30 years, more secure people, whether the laptop or phone or this connection there. So a lot of OT/IoT security keeping growing, which Fortinet is the leader -- probably the only leader actually based on the Westlands report.
On the other side, some change in whether like SASE, ZTNA will also transition the current firewall into the next generation, right? So traditional firewall is more about the NAND. There's a firewall VPN. That's my previous company [indiscernible]. And then we start the Fortinet, there's other -- we call the UTM, our next-gen firewall. Now in the same FortiOS, you see all the SASE function built in, all the DLP, all the CASB, all the WAF, all the function are built in the same OS as a firewall SD-WAN.
So we feel this network technology -- network security technology will continue to evolve, especially when we secure this IoT/OT environment, it's very different than secured people, laptop, mobile phone. You have a pretty standard operation system. But OT/IoT most device has a different operating system, has a very limited computing power.
Most of the time, the only way to secure it is really by network security. It's very different than the traditional endpoint security market as a pretty standard operation system. So this is our different operating system, and that's where there will be 10x more device connected online in the next 10 years compared to people connect.
So that's where we feel there's a lot of driver for the network security growth. Network security continue to be one of the biggest market in cybersecurity. So we do see it keep growing double digit.
And Tal, I think you mentioned tariffs, right? And I think there's a lot of anxiety around tariffs because we still promote our hardware, which is extremely important to accelerate security.
And so for us, I think it's important to understand that first of all, our products are predominantly exempt, maybe some cables coming from somewhere. Our market is not only the U.S., our market is very global. So that's another area where internationally, we are not impacted by U.S. tariffs.
And so I think we continue to say to our customers, to our partners, I don't want to say don't worry, but let's be transparent that tariffs right now should not have an impact on your pricing, on your products. And we will inform you if something changes.
I'll get back to it. I wanted to ask Ken about platformization. So -- and I'll ask it from a different angle, not the way that Palo Alto describes transformization. Bank of America says publicly that we have over 300 vendors for security. But on the other hand, when I look at the offerings today, I don't know if there is room in the market for another box, another point solution. It doesn't -- it could be a service. It doesn't matter. And we see companies offering wider and wider set of solutions.
Where is Fortinet in this journey to expand the portfolio horizontally and go into adjacent markets and offer, I'll call, it end-to-end solution, but you know what I mean, a platform for security?
I think that's where if you look at the platform, that all depends on where you deploy the platform. The network security tend to be more based on the middle of network, right, to stop the bad traffic or whatever. There's endpoint more deploying your laptop or mobile phone. There are some also deploying in the cloud like [indiscernible] or some other things there.
So that's where if you look at the network security, that's why I do believe a lot of -- since probably here, you do need the network security like OT/IoT security, most of the guys have to be used network security to secure. But network security, because it's more based on some appliance or some like screen traffic in the middle network there, you do need to handle more and more function.
So if you look at the FortiOS, so we started probably like 4, 5 function 25 years ago, traditional firewall VPN, antivirus intrusion prevention. Now we have about 30 function now, including all the networking function, all the switching, routing, all the SD-WAN and plus all the security function there. So I do believe we'll continue to add more function and integrate the same OS and then using ASIC to accelerate all this function.
Right now, ASIC can accelerate half of these 30 functions. So that's improving performance by 10x average. So that's the progress. That's also the reason in the network security space, you see pretty much no stand-alone or single point solution provider anymore, whether FireEye or some other one are starting to disappear.
If they only offer like sandbox single function there, you have a very difficult kind of competing with a platform when they add a new function with existing function integrate together, then starting to disappear.
The same thing, even like SD-WAN space, like 5, 10 years ago, a lot of SD-WAN players, so Fortinet is the only one we develop internally integrate with the firewall with our network security, now with the SASE. So that's where maybe in a few years, we become the #1 in SD-WAN because it's well integrated with other functions, very easy from networking to the firewall -- from firewall to the SD-WAN. That's where like over 70% -- actually 73% of enterprise customer, which is using our firewall also use our SD-WAN now.
So that's where when the function can integrate into the platform, especially network security, the single function device have very short life, only for a few years because once the platform player catch up, the customer always willing to use in the platform side, which costs lower and more easy to manage and working together better with other functions. So that's in the network security.
I think, in the endpoint in the cloud, it's a little bit different story because you do can load multiple agents on your laptop. You maybe can run multiple applications in the cloud also. But on the network security, mostly has a single box. So the more function they can process, the better.
So do you think there is synergy between SASE and firewall? And the reason why I ask it is because Zscaler is saying the opposite. They say SASE is a separate market. Actually, they want to replace firewalls.
Which is not the case. If you look at it, we only launched our own SASE like 18 months ago. So if you look at the Gartner Magic Quadrant, I think released last week, we become the fast-growing SASE in the top 3, top 4 player. And that's why in the earnings release, I keep saying, in a few years, we'll be the #1 SASE player.
So I feel we have three key differentiations compared to Zscaler and any other SASE player in the market. First, we have the technology, integrate all the SASE function, including SD-WAN in a single OS. So none of them in the single OS, they have to come from different box, different acquisition, SD-WAN, different CASB or different DLP. So we are the only one can integrate the same OS, which gives the customer -- you can deploy in the cloud or deploy on-premise using hardware, the same OS.
The second one, since we have the biggest customer base in the enterprise, sp we have over 800,000 customer base, bigger than any other SASE player. So that's where it's very quick for current firewall network security customer to migrate into SASE. That's the reason in the last like only 18 months, we've become the fast-growing and probably the top 3 players. So we have over $1 billion unified SASE market right now and continue to grow faster than any other SASE player.
And then the third one, also, we started to invest in this, we call it -- because SASE eventually, you not only compete on the function, but also compete on the cost of the infrastructure because SASE has to leverage cloud or infrastructure process all the traffic, right? So that's where whoever owns some infrastructure has a cost advantage because if you're using cloud provider compared to your own infrastructure, cloud provider charge probably like 5 to 10x more expensive than own infrastructure.
And even the colo, the only infrastructure probably only 1/3 cost compared to the colo. That's where in the last few years, we probably invest billions dollars into the infrastructure. So we have a global facility over 5 million square footage and a lot of data center, all this one, which we have our own [ engine ] running it, has much cost advantage.
So that's where the three key differentiations, own the technology into a single OS, the bigger customer base, very easy to migrate to SASE and then our own infrastructure, which none other SASE player has this advantage; so that's why we feel we will continue to grow probably fast in the SASE market and we will be the #1 in a few years.
So there are two deployment models for your SASE, one is to use your own infrastructure and the other one is to use public cloud, what's the -- I know you said once that if a customer uses your own infrastructure, your price could be 1/3 of the price of Zscaler, for example. What happens to the pricing advantage if the customer uses in areas where you don't have infrastructure or they have to use public cloud? What's your advantage then in that case?
There's also a third case is really we're working with the service provider carrier. So we offer, we call it sovereign SASE or private SASE, leverage their infrastructure, we provide the product, the technology, right? So that's the third mode.
But it's really customer's choice, right? So sometimes they are already a cloud-like user, right? So they can use in whatever cloud they consume. But we do give them flexibility. You can use in the cloud, you can use in their own service provider or their own -- a lot of like a bank or finance service, they also try to use their own data center. So that's make the data stay within the data center, process within the data center. That's what we call the private SASE.
And then there's a lot of [ solvent ] SASE. We are much more international than most other SASE player. So we see a lot of [ solvent ] SASE requirement. And then the third mode is where they use our own infrastructure, which we have an advantage on the cost and also on the talent on the engineer side to supporting customers.
So we have a lot of other technology beyond just a SASE like secure storage, like secure like content, like all this Fortistack replace part of a virtual machine, all this kind of technology. So we'll be more secure, more cost efficient for our infrastructure. That's where we kind of let customers select.
Yes. Christiane, you made some comments in the last conference call about conservatism, sales conservatism during Q1 -- on the Q1 call. Can you walk us through some of the conversations you had with your sales team, with the market about the outlook? Can you also remind us the changes you've made in order to have -- to improve the pipeline hygiene and provide better outlook?
So let's start with conservatism, right? We came out of a, I think, month at the end of April where a lot of news came up, right, around tariffs and so on and what is the impact on companies, what is the impact on our customers, how do interest rates develop, how does the U.S. dollar develop. And so there was a little bit more uncertainty, despite the fact that I mentioned cybersecurity is resilient.
We had a good April, a good month 1. And -- but because we are a highly diversified company with a lot of business coming from smaller entities, a significant portion of our pipeline develops throughout the quarter. We have good visibility into large enterprise deals. We know the size. We know whether it's an existing customer or whether it's a new customer. So we can apply our kind of risk-adjusted models to the pipeline.
But for the lower end of the market, we rely on in-quarter pipeline. And so that's harder for us as well as for the sales teams to assess in times of uncertainty. So that's where some of the, what we may call, conservatism came in.
In addition, we've scrubbed the pipeline, of course, more so, and we are putting more diligence on the management of the pipeline. And so there may not always be run rate markers anymore in the pipeline until they know that is confirmed, is coming, right? So it's a combination of factors that made us pause a little bit to -- and say, okay, let's continue to execute well and see what Q2 brings.
And as far as the environment -- we're now in June. As far as the environment versus what you saw in April, are you in a better position, worse position? Or how did the environment change?
I think understanding a little bit more that there is going to be, I think, constant news, right, and trying to calm down the news and just allow us to work with our partners, give them confidence that the tariffs are not impacting them, give them -- and also the U.S. dollar, of course, with the deterioration may actually benefit us long term, not from a cost perspective, but from a sales perspective because we price in U.S. dollars internationally. So that can actually help us. I think we see good confidence globally that the markets are stable.
And you're a new CFO for the company, you're not new to the company, but new CFO. Can you talk to us about your guidance philosophy? How do you -- like how do you view when you provide guidance? How do you -- what are the things you're looking at? And how do you set the guidance?
So guidance setting is not a CFO job alone, right? It's not just mathematical models. It comes from a bottom-up pipeline perspective. It comes from factoring in multiple aspects, whether it's sales capacity, whether it's the economy, it's the sales commit, it's the composition of the pipeline and everything else. So that gives us kind of the overarching number for billings.
And then, of course, we look at deferred revenue for service revenue. We look at the pipeline composition to determine what -- how much is hardware. And I know that a lot of you are asking always what's the refresh cycle doing, right? So we -- of course, we look at what's the renewal pipeline versus what's the new business and refresh pipeline to determine what is our hardware revenue. And that's shaping.
Got it. I'll come back to something you said, but I want to ask Ken about data security, AI security because when we talk to companies, like we're not practitioners in the sense that I'm -- I look at the market from the outside. But when I hear a lot of start-ups and a lot of public companies talk about something, I know it's a trend. So I always see things a little bit in delay, but at least I can figure out there's a trend.
So the trend over the last few quarters or the last few months was that companies talk about data security -- more about data security and AI security. And we heard it from -- you look at the strategic direction of Zscaler and just the discussion I had now with [ Nikesh Prompalo ] and what they announced with security -- AI security, so what is -- first, what is your view on the space? And then, how is Fortinet playing in these markets?
Yes, we are a more long-term player in the space. So we started investing in AI probably 15 years ago. You can look at the number of patents we have, it's over 500, more than any other company in the space. But we are also a little bit different than some other company. They tend to announce something they are not there yet. So we tend to say something which we already deliver. So that's where we are different.
But for AI, we have probably three main buckets. The one we really call -- probably the biggest one right now, we call the AI Assist. So there's probably over a dozen products. We do charge 20%, 25% more when they enable the AI. It's like FortiManager, Analyzer, FortiSIEM, FortiSOAR, all these like helping the secure operation. So that's where we're starting to see some good revenue coming from we call the FortiAI-Assist.
They do have we call the FortiAI-Protect. That also come from the intelligent there, come from all these other like secure AI infrastructure, secure the data, what's the [ go-go ] into the model, what's come out. So that's also working quite well.
And then also internally, we also use a lot of AI to do the development to handle the customer supporting. There's like a 30%, 40% supporting already can handle -- using AI to handle. So that's where we are in the AI space for quite a while. And then we probably -- once we see the big achievement result, then we probably promote more instead of some other company always talk about since probably not there yet. So we will only release or see something when the products are released.
Yes. And there are two types of -- when you talk about AI, there is the utilizing AI to improve security or alternatively, the security of AI when you deploy AI models, how do you -- so can you distinguish between the two and talk about where you are? I think you spoke at the beginning, you spoke about using AI, utilizing AI in order to improve security.
Yes. I think that's why we have quite some improvement on both sides, whether using security to secure AI or kind of use AI internally. So we do have a customer more concerned about how AI eventually may cause some security issue. That's what we're keeping working with them, not just some customers, but also -- not just some AI company, but also some service providers, some customers which have the data feed into the AI. And -- but internally, we also use a lot of AI ourselves. So that's where it's kind of both.
Got it. Christiane, I'm going to go back to something you said, and I want to understand, when you provided Q2 guidance, it was a tad weaker than expected. And then when we spoke about conservatism, right?
Yes.
Is there a delay -- so before that, in the quarters before that, we spoke a lot about the refresh cycle of firewalls and end of service and replacement of end of service. So is there a delay in customers' deployment of new firewalls ahead of end of service because of the environment? Do you see any correlation between some economic uncertainty and the timing in which firewall upgrade is happening?
So far, I would say we haven't seen a delay. In Q1, we had good FortiGate growth, right, [ 15% ], which was higher than the overall product revenue growth. In Q4 last year, we saw good growth in the midrange segment. And so there are always different segments that are growing faster.
What gives me confidence is that when we analyze the customers that had end-of-support devices and who purchased in Q1, they all purchased more than their end-of-support devices, right? So we are able to expand and sell more devices, more services, which is what we actually want and what we promised we would do last year when we announced we have a pretty big cohort.
Yes. So you have a big -- so I asked you this question before I'm going to ask it again because it's important. When you show the chart, there was a big cohort for 2026 end-of-service. And there was not much, smaller from a number of products, for 2027. Does it mean that we're going to have 2 years of big kind of upgrades? Or is there a difference between the 2026 cohort and the 2027 cohort?
Yes, there's a pretty big difference in the two cohorts. The '26 cohort is composed of about, value-wise, 1/3 of large firewalls, 1/3 of midsized firewalls and 1/3 of small firewalls. The 2027 cohort is the low end of the low end, right? It's pretty much one model that drives all the units up. And so value-wise, it's not as important.
What we do have and what we expect, and this is why also our targets were set this way, is that we expect from the growth during COVID that in '27, '28, we will have a natural, not necessarily forced, upgrade cycle that customers will go through to the next generation because they've deployed the firewalls they purchased between '21 and '24 for 4, 5 years, which is a natural upgrade cycle. 2026 is really a forced one, where the technology is so old that it's not going to be supported by us anymore.
Got it. I want to go back to SASE, Ken, and ask about SASE because it's such a big opportunity. So there used to be 2 players in the market. And now we see Cisco, a firewall company, going into SASE. We see Check Point buying Perimeter 81. We see yourself.
What do you think is going to -- first of all, do you think this market is commoditizing? Do you think that this market pricing will go down? I mean you're at the good side of the market because you are a price disruptor. But do you think overall, the pricing will go down commoditization? Or do you think that the market could still be this unique kind of high end, et cetera?
And also, sorry, it's a long question, but Microsoft. Microsoft is in the market. And their pricing, if you just look at what they say that they charge for Entra, is extremely disruptive. So just talk to us about overall the pricing environment and the market environment.
Yes, that's why I put in the 3 categories. There's like a dedicated SASE player like Zscaler and [indiscernible] all these things. There's come from the cloud provider or service provider, which is whether Microsoft, even Google starting to get in. I think some of the telecom service provider, we're also working with them, maybe will offer similar things soon.
And then there's a traditional firewall company try to evolve the firewall into SASE with all the SASE function integrated firewall, that's Fortinet, Palo Alto also. So that's where when there's more competition, I feel there will be a price pressure.
And also, we see who can like offer some easy migration. And so that's also kind of important. That's where -- for us, that's where the focus always on customer how to easily migrate from the traditional firewall into the SASE, all these other things in the same OS.
And then also, we started investing in infrastructure. Like 5 to 10 years ago, we spent billions of dollars in infrastructure, we feel will be a benefit in the next few years. You'll see the huge benefit. And so that's where compared to some other players in the space, I do believe that's also the strategy in the early days when we do SASE, I always try to enable the service provider, including cloud provider to SASE.
But I have to say, they moved kind of slower compared to the SASE player. So we don't want to miss the market. We also want to play ourselves. That's where we changed the strategy 18 months ago. You can see we are grow fast -- the fast-growing SASE player.
So that's where we feel will be more competition because there's a customer need. They do need to have supporting work-from-home, this kind of ZTNA environment. And on the other side, SD-WAN is the most important part of SASE. Since we are already the #1 in SD-WAN and also #1 in the firewall, which is the [ CMU ] SASE, so we do feel customer migration, we have the easiest solution to customer, which also can enable a lot of other service providers using our advantage and the ASIC advantage, right?
So that's where we feel we're positioned quite well in the SASE space to compete, which a lot of other SASE players don't have any of this advantage. So that's why we are pretty confident that I keep in saying, we'll be the #1 SASE player.
Great. We only have 1 minute left. Sorry. I know you probably have questions, but is there any questions from the audience? I only managed to ask -- I have 4 pages. I may have covered 1 page of questions. So I know there are probably some other questions from the audience. No?
So Ken, I'll ask you. I'll use the last minute just to ask you about OT. Last year, you said or recently, you said you're approaching $1 billion in OT. Can you talk about the opportunity? Can you talk about what is positioning you better than others in this space?
The OT area, we invest for over 10 years. Not only the platform, you do have some recognized solution, but also understand the OT environment, what's the traffic pattern, the protocol, what's the device, how to identify the device, how to secure all this traffic. So that's where we're doing that for more than 10 years. So we have probably $1 billion -- over $1 billion in OT security now.
That's also, I believe, OT will be one of the fast-growing network security market going forward because OT -- to secure this OT/IoT device, some other technology in the cybersecurity will be very difficult to apply, like all the endpoint solutions, some other traditional, even the cloud-based solution because OT is very -- a lot of data, a lot of devices on deployment edge. So you do need to have some physical, some edge solution to process in real-time.
So that's where we feel we have an advantage. So that's where -- because like I keep saying the next 10 years will be 10x more device connected online than people connect online. So that's where this 10x more device will create a lot of security issue and will be a big concern for most users.
And even people ourselves, we can see how many appliances are connected online now and how we can have to work remotely. And then eventually, all the robots, all the connected cars, all will have some security issue. So that's where we feel will be a huge market opportunity.
But also, it will be a pretty complicated market. It's very different than the traditional laptop or mobile phone security, OS ver standard. This one is a different OS, different device, different traffic pattern, different platform. So it will be a pretty complicated area, but you do need a long-term investment to play here.
Got it. Great. Thank you. We ran out of time. Thank you.
