Fortinet Inc

NASDAQ:FTNT

Q1-2025 Earnings Call

[Operator]

Hello and welcome to Fortinet's First Quarter 2025 Earnings Conference Call. [Operator Instructions] Please be advised that this call is being recorded.

I would now like to hand the call over to Aaron Ovadia, Senior Director of Investor Relations. Please go ahead.

[Aaron Ovadia, executive]

Thank you and good afternoon, everyone. This is Aaron Ovadia, Senior Director of Investor Relations at Fortinet. I am pleased to welcome everyone to our call to discuss Fortinet's financial results for the first quarter of 2025. Joining me on today's call are Ken Xie, Fortinet's Founder, Chairman and CEO; Keith Jensen, our CFO; Christiane Ohlgart, our CAO and Sales Operations Leader; and John Whittle, our COO. As a reminder, Keith will be stepping down from the CFO role on May 15, and Christiane will take over as our next CFO.

Ken will begin our call today by providing a high-level perspective on our business. Keith will then review our financial result for the first quarter of 2025, and Christiane will provide a forward-looking view, including guidance for the second quarter and updating the full year. We will then open the call for questions. [Operator Instructions]

Before we begin, I'd like to remind everyone that on today's call, we will be making forward-looking statements, and these forward-looking statements are subject to risks and uncertainties, which could cause actual results to differ materially from those projected. Please refer to our SEC filings, in particular, the risk factors in our most recent Form 10-K and Form 10-Q for more information. All forward-looking statements reflect our opinions only as of the date of this presentation, and we undertake no obligation and specifically disclaim any obligation to update forward-looking statements.

Also, all references to financial metrics that we make on today's call are non-GAAP unless otherwise stated. Our GAAP results and GAAP to non-GAAP reconciliations are located in our earnings press release and in the presentation that accompany today's remarks, both of which are posted on our Investor Relations website.

As a reminder, this is a live call. It will be available for replay via webcast on our Investor Relations website. The prepared remarks will also be posted on the quarterly earnings section of our IR website following today's call. Lastly, all references to growth are on a year-over-year basis unless noted otherwise.

I will now turn the call over to Ken.

[Ken Xie, executive]

Thank you, Aaron, and thank you to everyone for joining our call. We are pleased with our strong performance in the first quarter, successfully balancing growth and profitability, including billing revenue growth of 14%, record first quarter operation margin of 34%, record free cash flow of $783 million, a margin of 51% and strong growth in secure operations and Unified SASE with security service edge billing growth of over 110%, which drove our Unified SASE billing growth to 18%, accounting for 25% of our business.

So Fortinet leadership in innovation and long-term investment is evident in our market position as the #1 deployed firewall vendor worldwide, a market leader in SD-WAN and OT security. And with our strong SASE strategy and growth, we are confident we will be #1 in this space as well.

The strong momentum behind our Unified SASE pillar underscore the value customer place on our single OS platform. The typical SASE journey begins with the customer initial purchase of Fortinet industry-leading, ASIC-based FortiGate firewall powered by FortiOS. From there, the majority of large enterprise customer expand into SD-WAN before progressing into a FortiSASE solution. This expansion path continue to grow as 73% of large enterprise customer have now adopted our SD-WAN solution and have either begun or are well positioned to transition to FortiSASE with a FortiSASE penetration among large enterprise increasing nearly 10% quarter-over-quarter to 11%.

We remain the only vendor to have organically developed all of the core SASE capability within a single operational system for the OS, including next-gen firewall, SD-WAN, ZTNA, Secure Web Gateway, CASB and DRP technologies. This native integration of networking and security reduce the capacity and operation cost while enhancing user experience and ensuring secure across both on-premise and cloud environments.

In addition to our traditional SASE offering, we also offer Sovereign SASE, a tailored solution for large enterprise and service providers that require full on-premise or in-country control of their data. With Sovereign SASE, customers can deploy FortiSASE within their own data centers, ensuring that our data is processed exclusively through customer-owned or country-specific locations to meet compliance requirement by country or industry regulations. This approach accelerates the performance through our FortiASIC technology and is well suited for highly regulated sectors such as finance, government and health care.

AI-driven secure operation billing increased by 29%, accounting for 10% of our business. As customers continue to consolidate multiple security vendors on our integrated and AI-enhanced FortiFabric solution. Looking ahead, in addition to SASE and SecureOp, we expect OT security and AI to be key growth drivers over the next 5 years.

In OT security, a rapidly expanding market driven by a surge in connected device, Fortinet is recognized as the only leader in the Westlands Advisory report, supported by over a decade of strategic investment, and a specialized solution position us for continued growth. We also continue to invest in our AI capabilities, which we began developing more than 15 years ago and now hold over 500 issued and pending AI patents, more than any other competitors. With our AI technology now integrated into a dozen product, new AI capabilities like FortiAI-Assist for automating security task, FortiAI-Protect for advanced threat detection and FortiAI-SecureAI for protecting AI infrastructure.

Today, we announced the FortiGate 700G series, a high-performance firewall for midsized business and distributed enterprise powered by our FortiASIC technology, which deliver a 5 to 10x performance advantage over our competitors; and FortiOS, the only operation system recognized across 5 secure networking Gartner Magic Quadrants. This approach significantly lower total cost of ownership and complexity while reducing energy consumption and drive Fortinet's continued strong growth and market share gain in secure networking.

I would like to thank our employees, customers, partners and suppliers worldwide for their continued support and hard work. I will now turn the call over to Keith and Christiane.

[Keith Jensen, executive]

Thank you, Ken. Thank you, Aaron. Welcome, Christiane, and good afternoon, everyone. Let's start with the key financial highlights for the first quarter before handing the call off to Christiane for a more detailed and forward-looking view.

We delivered strong performance and top line results that approach the high end of our guidance range together with record first quarter operating margin of 34%. Total revenue grew 14%, driven by strong product and service revenues with product revenue growth of 12%. In addition, new logos increased 14% to over 6,300 driven by continued worldwide investments in our channel partners.

Looking at our financial results in more detail. Total billings grew 14% to $1.6 billion, driven by 18% growth in Unified SASE and 29% growth in AI-driven SecOps. Unified SASE and SecOps now account for 25% and 10% of total billings, respectively, up 1 point each. RPO grew 12% to $6.5 billion, while current RPO grew over 15% to $3.4 billion. Unified SASE and SecOps ARR increased 26% and 30%, respectively, reaching a combined ARR of $1.6 billion.

Turning to revenue and margins. Total revenue grew 14% to $1.54 billion. Product revenue increased 12% to $459 million, driven by growth in both hardware and software solutions. FortiGate hardware revenue grew in the mid-teens, outpacing total product revenue growth, driven by strong performance in low-end and high-end models and supported by early-mover large enterprise customers upgrading their firewall infrastructure. Software license revenue grew in the mid-teens and represented a high teens percentage of total product revenue, driven by on-prem, time-based software license growth of over 30%. Service revenue of $1.08 billion grew 14% to 70% of total revenue. Security subscriptions revenue increased 16%, while support and related service revenues increased 12%. Service billings grew 14%, our highest growth rate in the past 5 quarters.

Total gross margin increased 380 basis points to 81.9% and exceeded the high end of the guidance range by 90 basis points. Product gross margin of 67.7% increased 1,200 basis points as inventory-related charges normalize from the highly elevated levels we saw in the first half of 2024. This added approximately 1,300 basis points to product gross margin and approximately 400 basis points to total gross margin. Service gross margin of 87.8% was down just 10 basis points as we successfully absorbed the increased costs associated with the expansion of hosted security solutions. Operating margin increased 570 basis points to a first quarter record of 34.2% and was 320 basis points above the high end of our guidance range, reflecting the strong gross margin and FX tailwind of around 100 basis points and cost efficiencies in the business.

Looking to the statement of cash flow summarized on Slides 18 and 19. Free cash flow tends to be seasonally strong in the first quarter and was a record $783 million, while free cash flow margin was 51%, up 6 points. Adjusted free cash flow was $839 million, representing a margin of 54%. The infrastructure investments were $67 million, down $155 million due to a lower level of real estate investment. Cash taxes were $27 million.

Average contract term was 27 months, roughly flat year-over-year and down 2 months quarter-over-quarter. And while we did not repurchase shares during the first quarter, we did repurchase approximately 4.6 million shares for a total of $401 million during the month of April. The remaining share buyback authorization as of today is approximately $1.6 billion.

I'll now turn the call over to Christiane to share a few significant wins from the first quarter as well as our more forward-looking view, including business conditions in the second quarter and full year guidance.

[Christiane Ohlgart, executive]

Thank you, Keith. As Ken mentioned earlier, the noteworthy headline in this uncertain macroeconomic environment is that customer adoption of our solutions is accelerating. This momentum is driven by 2 key factors: one, our decades-long innovation leadership; and two, our competitively differentiated dedication to putting the customer first. Together, this creates a powerful network effect with some of the most discerning organizations rapidly adopting Fortinet solution at scale. This is exemplified by Fortinet being the #1 solution in firewall as well as a leader in SD-WAN and OT security.

Also, our leading SASE strategy is driving strong growth, reinforcing our confidence in becoming the #1 player in the SASE market. Building on this momentum, our SSE solution is gaining strong traction fueled by continued success in upselling SSE to our large SD-WAN customer base. With both ARR and billings growth at over 100%, we believe FortiSASE is the fastest-growing SSE solution at scale in the market.

As shown on Slide 7, the typical FortiSASE journey begins with a customer purchasing our market-leading FortiGate firewall, followed by an expansion to SD-WAN and then on to our single-vendor SASE solution. Our adoption of SD-WAN and SSE continues to grow with our large enterprise expansion penetration rates increasing to 73% and 11%, respectively with the SSE penetration rate growth increasing nearly 10% quarter-over-quarter.

In addition, a second customer buying journey illustrates the growing convergence of security and networking. It, too, starts with our FortiGate firewalls and expands to our switches and access points. The key to this expansion is FortiOS FortiLink technology, which enables seamless management of our switches and access points through our unified operating system. Our increased penetration rates show the success of this strategy.

Now I'd like to review some deals that showcase our SASE adoption and customer expansion. In an 8-figure displacement deal, an international government purchased our SD-WAN solution as well as our FortiSASE solution to secure the hybrid workforce of 6,000 users. This customer chose Fortinet for its ability to deliver flexible and consistent security enforcement, ensuring secure access to both on-premises and cloud applications while maintaining a seamless user experience. By harnessing the power of our FortiOS, we delivered superior performance over the competition, reduced total cost of ownership and effectively consolidated multiple security functions into a single integrated platform.

In another SASE win, we replaced the incumbent vendor at an international education provider, which chose FortiSASE for their 40,000 users. The decision to transition to FortiSASE was driven by ongoing performance challenges with their previous SASE vendor. Keys to this win included FortiSASE's ease of use, seamless integration with the Fortinet Security Fabric and proven scalability across their SD-WAN sites. Based on the success from their proof of concept, this customer will benefit from improved performance, consistent security for users everywhere and greater operational efficiency.

In a 7-figure deal, a large multinational manufacturing company selected our SD-WAN and multiple SecOps solutions. Fortinet displaced the legacy SD-WAN provider by demonstrating how FortiOS simplifies operations, reduces total cost of ownership and unifies security and networking functions on a single platform. The integrated nature of FortiOS also enables seamless alignment with the company's existing Fortinet security infrastructure, establishing a strong foundation for future projects.

Lastly, a Fortune 500 company signed an 8-figure deal that spans all 3 of our pillars. Over the past 3 years, they have expanded their FortiGate installed base by more than 80%, driven by our world-class support for their data centers and branch locations as well as the automation and seamless integration enabled by our FortiOS operating system.

Rounding out the billings commentary. Large enterprise was our top-performing customer segment with growth of around 30%. The number of deals greater than $1 million were up 30%, including 3 8-figure deals this quarter, up from 1 during the same period last year. EMEA was our best-performing geography, driven by mid-teens growth from International Emerging. Among our top 5 verticals, financial services and worldwide government led the way with growth of over 20%.

Before moving on to guidance, I'd like to spend a few minutes discussing the current U.S. tariff situation. The U.S. tariff situation landscape is evolving rapidly, and our comments on this call reflect the information currently available to us. Despite the current geopolitical uncertainties, demand for our cybersecurity solutions remains strong. Our pipeline continues to grow, and we are not seeing signs of near-term erosion. Additionally, our close rates remain robust, and sales cycles are tracking within our normal historical range.

For the second quarter, we do not expect U.S. tariffs to have a meaningful impact on our operating margin as only a few components are subject to tariff charges. Should tariffs increase in the future, we expect any resulting impact on our operating margin to be limited to hardware sales to U.S. customers. As long as our international hardware sales do not flow through the U.S., they are not subject to U.S. import tariffs.

Moving on to guidance. As a reminder, our second quarter and full year outlook, which are summarized on Slides 21 and 22, are subject to the disclaimers regarding forward-looking information that Aaron provided at the beginning of the call.

While our business remains strong and we outperformed on the top line in the first quarter with continued confidence in our ability to execute, we recognize that our customers' investment decisions can be influenced by the broader economic outlook. As a result, we are maintaining our full year billings and revenue guidance ranges to account for potential top line risks associated with the evolving geopolitical environment. Regarding the record firewall upgrade cycle that we've spoken about previously, we continue to expect the firewall upgrade cycle to gain momentum in both purchasing and planning activities in the second half of 2025.

Looking at the bottom line. The U.S. dollar weakened more than anticipated from early February when we first issued our 2025 guidance. As a result, we expect an operating margin headwind of approximately 120 basis points to the second quarter and approximately 90 basis points to the full year, which is factored into today's outlook. Despite the FX headwinds, we are raising the midpoint of our full year operating margin guidance as a result of our first quarter outperformance and expected efficiencies in the business. Our continued business momentum and strong execution gives us confidence that we are on track to achieve the Rule of 45 for the sixth consecutive year.

For the second quarter, we expect billings in the range of $1.685 billion to $1.765 billion, which at the midpoint represents growth of 12%; revenue in the range of $1.59 billion to $1.65 billion, which at the midpoint represents growth of 13%; non-GAAP gross margins of 80% to 81%; non-GAAP operating margins of 31.5% to 32.5%; non-GAAP earnings per share of $0.58 to $0.60, which assumes a share count between 773 million and 777 million; infrastructure investments of $180 million to $200 million; a non-GAAP tax rate of 18%; and cash taxes of $230 million to $255 million.

For the full year, we expect billings in the range of $7.2 billion to $7.4 billion, which at the midpoint represents growth of 12%; revenue in the range of $6.65 billion to $6.85 billion, which at the midpoint represents growth of 13%; service revenue in the range of $4.575 billion to $4.725 billion, which at the midpoint represents growth of 15%; non-GAAP gross margins of 79% to 81%; non-GAAP operating margins of 31.5% to 33.5%; non-GAAP earnings per share of $2.43 to $2.49, which assumes a share count of between 769 million and 779 million; infrastructure investments of $380 million to $430 million; non-GAAP tax rate of 18%; and cash taxes of between $525 million and $575 million.

I will now hand the call back over to Aaron to begin the Q&A session.

[Aaron Ovadia, executive]

Thank you, Christiane. [Operator Instructions] Operator, please open the line for questions.

[Operator]

[Operator Instructions] Our first question will come from Brian Essex with JPMorgan.

[Brian Essex, analyst]

Can you hear me okay?

[Keith Jensen, executive]

Yes.

[Brian Essex, analyst]

Great. Great. Congrats on the results for the quarter. I guess maybe for Keith, maybe -- or Christiane, could you unpack the dynamics behind the maintenance and services revenue? Just trying to understand. It's a segment that I think we were expecting to kind of accelerate the decline sequentially. So just trying to understand some of the puts and takes behind that and how you expect that to, I guess, grow throughout the rest of the year so you can kind of like level set expectations.

[Christiane Ohlgart, executive]

So on -- I think there are a couple of aspects that you touched on. One is the quarter-over-quarter slight decline is really affected by the Q4 having 2 more days than Q1, and that affects the daily rate going into revenue. Of course, we would have expected a slightly better acceleration, but there's a little bit more time that we need to grow our acquired entities and their revenue streams. So that's impacting Q1 service revenue predominantly.

[Brian Essex, analyst]

Is there a dynamic there between FortiGuard and FortiCare that we need to think about?

[Christiane Ohlgart, executive]

I would say current RPO is still strong. So I mean we have confidence in the growth.

[Ken Xie, executive]

Yes. And also the FortiGate growth above the billing growth, which will drive future service revenue. So we see the FortiGate growth -- billing growth actually a couple of points above the -- before the 2,000 kind of FortiGate gross average. So we see it's a pretty good sign. Plus, we're starting to add more service on top of FortiOS, and that's also what drive the future service revenue.

[Operator]

Our next question will come from Tal Liani with Bank of America.

[Tal Liani, analyst]

Can you hear me?

[Ken Xie, executive]

Yes, please.

[Tal Liani, analyst]

Okay. We spoke about -- in earlier quarters, we spoke about end of service coming -- bringing demand forward. Even in the last quarter, you said that demand is going to come this next 4, 5 -- 4 quarters. It's going to come this year instead of next year. So the question I have is, why is -- why are we seeing some lightness in the guidance for the next quarter? Why don't we see the demand coming forward to the next quarter? Can you just speak about the drivers? I just compare your numbers, your guidance to the consensus, and I'm trying to understand why don't I see already strength, especially ahead of a tariff increase that is going to increase the prices -- likely increase the prices for everyone.

[Ken Xie, executive]

I think -- I don't think we -- like we mentioned in the tariff, I don't think we plan to change the price under current condition. On the other side, there's still some uncertainty. So we try to be kind of a little bit careful. But we do see the customer like the solution we have and just some kind of the geopolitical and also some other part just increase some kind of uncertainties. So we try to be careful. Probably, Christiane, Keith, you know this better.

[Christiane Ohlgart, executive]

So I would say we saw good close rates and good linearity in Q2 in April. So it gives us confidence. But we also are tied a little bit by the expectations that we get from our sales teams. So we see good momentum. But sales has a trend with all the things that are going on in -- to go up in their expectations for us. And so I think that's where -- we'd rather be careful with the guidance and then, hopefully, are going to meet our numbers.

[Operator]

Our next call -- question comes from Gabriela Borges with Goldman Sachs.

[Gabriela Borges, analyst]

Maybe, Christiane, I'll pick up right where you left off on sales being hesitant. Clearly, we're all seeing similar headlines as you are. Maybe just tell us specifically, what are some of the conversations that sales is having from customers? What are the reasons they're hesitant to commit to purchasing Fortinet? And how are you thinking about maybe some of that hesitancy getting resolved? Is it maybe when we run into the lead time situation for the end of life? Or how do you think about that flowing through over the next few quarters?

[Christiane Ohlgart, executive]

We had a number of events in Q2, and we got really good feedback. So I think it's going to resolve. We have good channel activity. We have good channel programs. And I think some of you may have seen that in channel checks also that they are positive about Fortinet's programs. So I think it just needs to -- with all the macro news that are coming in every day and then don't turn out as bad as they are, there is hesitancy because until a PO is in, it can get delayed, yes? So we are positive. I mean I think you saw it from my comments. We haven't seen delays yet, but we don't know what happens over the next 2 months, right, or the rest of the year.

[Operator]

Our next question will come from Keith Weiss from Morgan Stanley.

[Keith Weiss, analyst]

Maybe carrying on with that line of thought, if you will. What gives you guys confidence that you're still going to be able to perform to like the stronger second half pickup? I get it there's a product cycle going on and people have to start preparing for end of life. But is there no risk there of potentially people kind of sweating the asset or pushing it out? I guess that's just a question of like where do you stem confidence that the second half will be stronger. And how much of that second half strength is implied in the guide right now?

[Christiane Ohlgart, executive]

I mean the second half strength is implied in the guide because we have harder comparisons to meet, right, as in the second half as well. What gives us confidence? We have a number of products that have been released, the next generation. And our products provide, I think, significant improvement of total cost of ownership and security compared to what customers bought 8, 9, 10 years ago. And we see the activity going on, especially in the enterprise.

I think we mentioned in the -- in our prepared remarks that FortiGate grew faster than the rest of product revenue, which I think is a testament to the strength that we are seeing. The same is true for OT. And so I think -- we are confident, yes, probably in this room more so maybe than sales when they talk to customers and need to put a commit on their pipeline, yes.

[Ken Xie, executive]

Yes. That's where -- we kind of measure the growth in 3 different pillars. So if you look at the secure networking, the traditional area, we are very strong. We are the only one with all the ASIC technology solutions, single FortiOS. So we continue gaining market share even we're already #1 leader there. And then the Unified SASE, we also believe we are like top 3, top 2 player and then also grow faster than any other player, and we'll be the leader. And so each of these -- also the SecureOp, which we grow like 29%, also probably faster than most other players of a similar size. So that's where each of this pillar will keep on gaining market share. Just we're not quite sure the overall market growth later this year and next year will be -- continue to hold up for whatever -- some forecast.

So that's where -- we do believe with the technology we have, the unique advantage we have for each pillar will drive us keeping gaining market share. But overall market condition kind of has a little bit uncertainty there. I know a lot of people talk about security a little bit more sticky and more resistant compared to some other, but they do have some impact. So we try to be careful. And -- but at the same time, we're hoping to overachieve all this guidance.

[Operator]

Our next question will come from Shaul Eyal with TD Cowen.

[Shaul Eyal, analyst]

Congrats on solid set of results considering the growing macro. The number of 8-digit transactions has been on the rise over the past few quarters. When we unpack those transactions, and I know they could differ from one another, are they representative of the entire Fortinet platform stack? Do they include SD-WAN and SASE? What's driving those large transactions predominantly from a product perspective?

[Christiane Ohlgart, executive]

So a significant driver for these large transactions is SD-WAN deployments and enterprises. And so typically, that's the starting point. But then as we mentioned, the customers are buying into the fabric and are buying additional solutions in addition to SD-WAN.

[Operator]

Our next question will come from Rob Owens with Piper Sandler.

[Robbie Owens, analyst]

A follow-on with Shaul's question there just around these large deals. Were they considered in the pipeline as you looked at the first quarter? I know back in the fourth quarter, on some of the larger transactions, you did talk about some potential pull-forward relative to the end of life. So curious if this was a similar experience with the larger transactions. Or was it more wall-to-wall SD-WAN deployment or global SD-WAN deployment like you spoke to? Just some more color would be great.

[Christiane Ohlgart, executive]

So no, these were transactions that were in the pipeline and closed as expected. So I think this is where our remarks came in. We do not see deals pushing out yet. But these deals also closed before the end of March, mostly.

[Operator]

Our next question comes from Eric Heath with KeyBanc.

[Unknown Analyst]

This is [indiscernible] on for Eric Heath. In your prepared remarks, you talked about how tariffs would impact hardware sales to U.S. customers. Are you able to quantify that impact to margin from tariffs? And also, could you talk through some steps you might be taking to evolve your supply chain to mitigate those impacts?

[Christiane Ohlgart, executive]

So we did not mention that we have impact from tariffs in Q1, right? So we don't expect any impact from tariffs in Q1 or significant impacts in Q2 because only very few of our products are subject to tariffs. And then it's only a small portion that actually gets imported into the U.S. for U.S. customers.

[Ken Xie, executive]

Yes. The other part is really because we design from ASIC chip to the system to all the OS and the service, we'll be able to relocate where we can manufacture. That's also because we also tend to have a little bit more inventory than some other company. So that also gave us some buffer. So so far, we don't see the impact of tariff yet.

[Operator]

Our next question will come from Saket Kalia with Barclays.

[Saket Kalia, analyst]

Christiane, maybe for you just to stay on that topic but just from a different angle. Can you just talk about whether there was any changing behavior from channel partners this quarter ahead of tariffs? I think some industries out there saw just some earlier purchasing ahead of potential price increases. Did Fortinet see any of that this quarter?

[Christiane Ohlgart, executive]

We got questions about whether we will increase our prices, but we did not see specific acceleration of deals.

[Keith Jensen, executive]

And Saket, maybe I'll just kind of fill in some of the -- to build on what Christiane just said in understanding, one, really aren't tariffs impacting our business today. And the first place that you'll see there would be in cash flow, right? You won't see it in the income statement because of how COGS is recognized for GAAP purposes for several quarters. So you really should just kind of assume there really isn't an impact on tariffs in that regard.

I think the other thing that you're probing at as a group is did we see pull-forward as we saw in other industries. And the answer to that is no, not really. And again, because in our business model and with our pricing advantage, that's really not under the gun. We're not raising prices immediately if we had tariffs because it will not hit our P&L for an extended period of time, if that helps.

[Saket Kalia, analyst]

Yes, that does help. Super helpful. If I can sneak in a follow-up maybe for Ken just to zoom out a little bit from the tariff discussion. Kind of -- it was great to see the unified SaaS business just continue to scale. Can you just talk about -- and there were some great deals that were called out in the prepared remarks. Can you just talk about what solutions you're typically replacing at these customers? I mean is it primarily VPN hardware? Or is it secure web gateways? Or is it other solutions that FortiSASE is able to replace?

[Ken Xie, executive]

I think we see both replacing some traditional, old like VPN but also replace some other SASE player competitor because we talked about for a few quarters, we have like 3 key differentiation in SASE. First off, SASE is integrated into the single OS platform, which none other player has that. So that was very easy for the traditional customer, which we are the #1 in the firewall space. Over half the global deployment, they can easily add a SASE service, add SD-WAN service to their current box, their current OS there. So that's -- probably over 90% growth come from this.

And then the second also differentiation, kind of also our early strategy. We try to work with a lot of carrier service provider. And then since they are more a little bit slow, so we decided to do ourself like 18 months ago. So now we still see the service provider and also a lot of bigger enterprise customer, especially in finance service, health care, they still want to do their own private SASE, Sovereign SASE. So their interest got higher and higher. So we started working with them. They're starting to see the real deployment of Sovereign SASE, which we can have -- build their SASE solution in their own data center. Just a few box can give them all the solution they need, supporting like 100,000, 10,000 customer, their user there.

And then the third one, really the global infrastructure we build out with a lot of our own kind of secure technology also give us a cost advantage and also give us more secure solution than some other SASE player. So that I see both the traditional VPN replacement and also like in Christiane's remark, we also replaced a few SASE player. That's a lot of -- it's the big enterprise area. So we see like the traditional one, probably more penetrated into the small SMB area, some mid-enterprise, which they also see the SASE give them some kind of ZTN solution. But in the big enterprise, we're certainly replacing a lot of other SASE player.

[Operator]

Our next question will come from Patrick Colville with Scotiabank.

[Patrick Edwin Colville, analyst]

I guess I want to just go back to Keith and Christiane about the service revenue downtick sequentially. I mean, Christiane, you mentioned this was because there was kind of 2 fewer days in fiscal first quarter versus 4Q. And I presume partly that's because of the leap year. But we didn't see this dynamic 4 years ago or even 8 years ago. So I guess what was different now? And could an explanation be that this is customers refreshing appliances and then not adding new subscriptions? They're just refreshing the existing subscriptions and that's why we see this dynamic?

[Keith Jensen, executive]

Patrick, I'm going to jump in because some of that was historical in nature. So I guess -- so we actually did have the same conversation in 2021, I believe it was, coming off of a leap year as well because the -- when you're doing year-over-year accounts, right, that was the unusual thing. It does seem that I forgot about that sometime in the last 3.5 years that, that bites me in the a**. And then from Q4 to Q1, you do just have the natural decline of 2 days, 2 days to 92 days, call it, 2%, which I think is what Christiane was talking about.

And then you were going down a path of customers refreshing on the service revenue. It wasn't clear. You were cutting out a little bit. But maybe a comment I'll offer, and Christiane can correct me, is that the conversation about the guidance-setting process and what we're seeing about pull-forward and such, look, I think in this environment where the guide ends up as a bit of an observer to the guidance and not a participant, I think it was prudent in terms of not passing through the beat, if you will.

I think that when you -- the conversations that Christiane is making reference to with channel partners and end users, if you compare where they are today on the upgrade cycle versus where they were 6 months ago, it's night and day and with our own sales team. I mean this is -- you're getting it in the channel checks. You're getting it in the surveys. It's real. We're picking up in the account plans as well. We are not seeing any signs to this point of customers suggesting they're going to change their design architecture. That has not come up or we've lost a deal because we're going to a SASE solution that they did. I think that the team here would move them in that direction of our own product. Similarly, you're not seeing competitor displacements against us. So I think those are the considerations that went into the guidance-setting process, but I'll let Christiane come back and make sure I haven't committed her to something she doesn't want to be committed to.

[Christiane Ohlgart, executive]

No. I mean Keith is right that there are a lot of factors why we guided the way we guided from what we can see and what we get from the sales teams, right? Also, don't forget that each fiscal year, you start rolling out new channel programs. And it takes a little bit of time until you see how these are picked up, right? So we expect service acceleration through our channel programs and we expect improvement. But from a quarter-over-quarter perspective and from a growth rate, we were not there where we wanted to be. And partially, it's also due to a little bit more churn on some acquired customers.

[Operator]

Our next question will come from Shrenik Kothari with Baird.

[Shrenik Kothari, analyst]

Can you guys hear me all right?

[Christiane Ohlgart, executive]

Yes.

[Shrenik Kothari, analyst]

Great. So Keith and Christiane, you mentioned that EMEA was your best-performing geo with mid-teens growth and partner-led momentum there, clearly a tailwind. And you also made it clear that tariffs pull-forwards are not really a dynamic. So just curious, what is driving strength out there? I mean I know Ken mentioned about the telco partnerships and kind of shaping demand for Sovereign SASE. Just curious if you can elaborate a little bit there. And in APAC, are you also starting to see traction from other modernization initiatives around OT or AI SOC deals as well? And I had a quick follow-up.

[Christiane Ohlgart, executive]

So in EMEA, specifically in International Emerging, you see a lot of strength in OT, right? So there's a lot of opportunity in OT and also in government. We see -- to your question on modernization, we see that in APAC as well. And we had good wins there in government as well as in other areas.

[Shrenik Kothari, analyst]

Got it. And just a quick follow-up on the new logos. It was pretty solid, 14% year-on-year. Just curious, like how much of SASE, SecOps growth is now -- are now driven by kind of first-time Fortinet customers versus sort of expansion from your existing installed base? Are these kind of new modules landing early in the deals? Or are they still largely dependent on kind of anchoring FortiGate deployments?

[Christiane Ohlgart, executive]

I would say the majority of our new customers are smaller customers, as you can tell by the number of customers. We had some nice large new logos, but most of the smaller customers do start with the FortiGate.

[Operator]

Our next question will come from Brad Zelnick with Deutsche Bank.

[Brad Zelnick, analyst]

Can you guys hear me? Awesome. Last quarter, I think it was, you talked about investments that you're making in various forms of enablement. So that's the channel and your direct 2sales would be optimally positioned to capture the refresh opportunity. How is that progressing? And what have you seen over the past few months in terms of your competitors trying to capitalize on this end-of-service event that's coming up?

[Christiane Ohlgart, executive]

We don't really see -- I think our competitors are talking about it, but we don't really see competition in our end-of-support cohort.

[Keith Jensen, executive]

And then the incentives on that?

[Christiane Ohlgart, executive]

Yes. I mean there are a number of channel incentives to execute on new product combined with more services, right? So especially in the lower end of the market, I think the opportunity is huge to expand on SASE and other products. And we have multiproduct incentives with the channel partners.

[Brad Zelnick, analyst]

If I could maybe just ask one follow-up. I think this is the first quarter where you now have Linksys consolidated. I assume it's not all that material, but is there anything just to call out that we should consider when we think about the trends going forward in terms of contribution and flow-through to the financials?

[John Whittle, executive]

Yes. Let me -- this is John Whittle. I would say it's immaterial. I don't think there's anything to really factor in there.

[Keith Jensen, executive]

And I think in terms of what we -- I think in the first quarter guide, we provided what we thought the impact would be from the M&As. And I think we were in line with that, if I recall correctly.

[Christiane Ohlgart, executive]

Yes. And right now, we are letting them run on their own strategy while we are creating our internal integration play for service providers.

[Ken Xie, executive]

It's still like 1 to 2 years away to codevelop some new product for the consumer, leverage some of ASIC technology, some other like FortiLink technology. So it's a long-term growth potential, but it's not short term.

[Operator]

Our next question will come from Adam Borg with Stifel.

[Adam Borg, analyst]

Do you hear me okay?

[Keith Jensen, executive]

Yes, please.

[Adam Borg, analyst]

Great. Just maybe, Christiane, on the upcoming refresh cycle. Any way to talk through some of the assumptions, both in terms of, hey, the number of firewalls we expect to be refreshed, will it be the same or fewer than what they had previously? Obviously, I'm assuming the performance of the models will be greater given these are old models. And I know you talked about it a few minutes ago, but maybe talk a little bit more about are you expecting any type of shift towards virtual or SASE from physical as part of this refresh.

[Christiane Ohlgart, executive]

So what we are seeing so far, the customers that have EOS devices, the smaller customers are buying more. The larger customers who had large FortiGates, it depends on the strategy, and it depends on whether they are consolidating on bigger FortiGates or buying pretty much a similar amount of the same next-generation model, yes. So I don't think on the enterprise side and in the data center appliance, you see one strategy. It depends on customers. In the MSE and the smaller customer cohort, what we see is that they are buying more of what -- than what they had previously.

[Keith Jensen, executive]

Yes. An interesting conversation Christiane was sharing with me right before this call was that one of the challenges in tracking the refresh is not just that they're out there and saying, okay, I have 10 products that are going into service. But as she pointed out, they have those 10 plus they're buying for other use cases at the same time. So the deal sizes are getting bigger, but it's a little bit blurrier in terms of how much of that is the old product versus a new use case as you go forward. But I would say that the deal sizes, she's quite pleased with.

[Adam Borg, analyst]

That's great. And maybe just -- oh, go ahead.

[Ken Xie, executive]

Sorry. Also on the product side, we're keeping on developing new product like the one we announced today, the FortiGate 700G. So there's a few more coming towards later this year and next year. So that's where we try to time in some of the replacement from the product side and then try to make sure the new product is way better than the old one. So that's where -- sometimes they also try to see -- most of the customers are probably still 1 year away, so they still have some time to evaluate.

[Adam Borg, analyst]

That's great. I really appreciate the color there. And maybe just for Ken, a bigger-picture question. In our field work, data security just continues to come up as a really important priority. I know late last year, I think it was back in August, you guys acquired Next DLP. Would love to talk a little bit more about early feedback on that acquisition and how you're thinking about the broader data security opportunity for Fortinet.

[Ken Xie, executive]

Yes. That's a great acquisition technology for the DLP, not only enhance the SASE we had but also can be sold separately to enhance a lot of big enterprise, the data security, the data leakage side. So we see it's a very good product and team. And so it's -- I totally agree with you. Now it's -- they're kind of -- more kind of looking at how to secure the data. That's also the reason we kind of started pushing some of Sovereign SASE, some other -- especially in the finance service area, in the government, in health care. So the data is super important. So it's a very good solution there.

[John Whittle, executive]

And we're seeing that being -- we're seeing that being rolled out at scale at large enterprises, and we just have to accelerate that. But it's working well at scale at large enterprises.

[Operator]

Our next question will come from Junaid Siddiqui with Truist.

[Junaid Siddiqui, analyst]

Can you hear me?

[John Whittle, executive]

Yes.

[Christiane Ohlgart, executive]

Yes.

[Junaid Siddiqui, analyst]

All right. Great. Yes, I just had a question on the CNAPP market and the traction that you're seeing in Lacework. One of your competitors has effectively ceded that space to a partner of yours. How do you see that market shaping up? And who are you seeing from a competitive perspective? And how are you differentiating from some of those competitors?

[John Whittle, executive]

So I think we see opportunity with the Wiz Google development. I think that disrupts the market fairly significantly. And so we see significant opportunity there. We think the Lacework solution is a very good solution. I think we just have to -- it's a new sales motion for us a bit, and so we need to focus on that. So it will just take a little bit of time. But we see it as a good opportunity. Big market, obviously, a huge TAM and a lot of disruption in that market. And that solution just got a good rating. It's a very good solution. We just need to kind of refine the sales approach a bit.

[Operator]

Our next question will come from Keith Bachman with BMO.

[Keith Bachman, analyst]

I wanted to ask a little bit about sensitivities. And what I mean by that is, Ken, you highlighted the 3 buckets of spend that Fortinet has: secure networking, Unified SASE and SecOps. As you think about over the next number of quarters, is there any comment when you hear feedback from the channel on deal elongation? Is it more, in fact, on the subscription side than the hardware side with maybe users not wanting to sweat their assets for regulatory reasons or compliance reasons or governance or what have you? And is there thereby a risk of some crowding out, if you will, on hardware refreshes that perhaps are ongoing that may cause some weakness in the Unified SASE and/or SecOps? I think SD-WAN, probably not. But just talk about the buckets of spending in terms of sensitivities as we go out over the next number of quarters, whether it be de elongations or what have you. And Keith, certainly all the best to you.

[Keith Jensen, executive]

Thank you.

[Ken Xie, executive]

Yes. It's a good question. I think -- yes. I mean the industry like over 30 years see a few half and done in the economy in the big environment. So usually during the downturn, they tend to slow down some of the infrastructure change or the hardware purchase and then try to more like stretch whatever the things they have. So there is some uncertainty right now, I feel, but it's on the other side because the strengths we have, whether in network security or secure networking and also the Unified SASE, SecureOp. So we see that's also the opportunity during the downturn to gain market share quickly because we feel we are better positioned than the competitor.

So even -- the overall market may grow a little bit slow, but also that's our opportunity to gain more market share quickly because in each category, we have pretty unique advantage. Like secure networking is really -- carry the convergence and also leverage of ASIC and the single OS, the same thing I mentioned earlier about Unified SASE. And then you see the SecureOp also grow like 29%. It's all pretty strong growth. That's how we're continuing to keep invest in the growth and also do some long-term investment to keep in driving the next 5 to 10 years long-term growth. Both will benefit the space and benefit the customer and also the partner. So that's where we look at this.

But also, like last quarter, we also see probably the billing growth also the first time better than the last 6, 7 quarter, probably 7 quarter, and especially the FortiGate even grow better. So that I see is a good sign on the strengths we have. Maybe some is because we called the upgrade or core refresh. But on the other side, we do see the -- some smaller player in the space, whether secure networking, some other one, getting weaker and weaker. So we do see some take their market share and some other bigger players starting shifting some of the focus. And so with us, we feel we have a better product and better position. That's where -- in all 3 pillar, we do believe we're gaining share on each pillar of the market share. I'll ask probably Christiane and Keith, any -- John, any...

[John Whittle, executive]

I would just say, like Ken said, Q1, we felt good about the growth in Q1. The economy, the geopolitical environment was already kind of a bit uncertain. And then also in 2008-2009, through the financial crisis, we were private at the time but had good growth through that and then one of the first companies to go public after that based on good growth through that crisis as well. So I think Ken has always focused on never let the opportunities from a good challenge pass you by. And so we'll take -- we'll look at this from an opportunistic standpoint.

[Christiane Ohlgart, executive]

I would just add one comment as well. And I think what we heard from our customers at our customer events at RSA, they're -- most of them are going hybrid, right? They will have on-prem devices. They will have some cloud devices. They will have some public cloud. And I think that's our opportunity because we play in all markets, and they can leverage the OS. And I think that's the feedback that we got. So from our perspective, we are we are well positioned.

[Operator]

This concludes our question-and-answer session. I will now hand it back to Aaron Ovadia for closing remarks.

[Aaron Ovadia, executive]

Thank you. I'd like to thank everyone for joining today's call. We will be attending investor conferences hosted by JPMorgan and Bank of America during the second quarter. The fireside chat webcast links will be posted on the Events & Presentations section of our Investor Relations website. If you have any follow-up questions, please feel free to contact me. Have a great rest of your day.