tapebrief
FTNT · Q4 2025

FTNT · Q1 2026 Earnings

Bullish

Fortinet

Reported May 6, 2026

30-second summary

Fortinet's Q1 FY2026 print is the most decisive validation of the product cycle yet: revenue of $1.85B (+20% YoY) cleared the high end of its own guide by $90M, non-GAAP EPS of $0.82 demolished the $0.59–$0.63 range by 19 cents, and non-GAAP operating margin of 35.8% printed 380bps above the guide ceiling. Product revenue accelerated again to +41% (from Q4's +20% and Q3's +18%), driven by AI infrastructure buildouts and OT billings up 70%, AI-driven SecOps billings reaccelerated to +23% from Q4's +6%, and management raised FY2026 revenue, EPS, billings, and service revenue while reaffirming margin ranges — telegraphing that the conservative-guide pattern is now structural.

Headline numbers

EPS

Q1 FY2026

$0.82

Revenue

Q1 FY2026

$1.85B

+20.0% YoY

Gross margin

Q1 FY2026

80.3%

Free cash flow

Q1 FY2026

$1.01B

Operating margin

Q1 FY2026

31.4%

Key financials

Q1 FY2026
MetricQ1 FY2026YoYQ4 FY2025QoQ
Revenue$1.85B+20.0%$1.91B-2.9%
EPS$0.82—$0.81+1.2%
Gross margin80.3%—79.6%+70bps
Operating margin31.4%—32.8%-140bps
Free cash flow$1.01B—$0.58B+75.0%

Guidance

Guidance is issued for both next quarter and the full year. Both may appear below.

Actuals vs prior guidance

MetricPeriodPrior guideActualΔResult
RevenueQ1 FY2026$1.700 billion to $1.760 billion$1.85 billion+$0.09 billion above high end of guideBeat
Non-GAAP EPSQ1 FY2026$0.59 to $0.63$0.82+$0.19 above high end of guideBeat
BillingsQ1 FY2026$1.770 billion to $1.870 billion$2.09 billion+$0.22 billion above high end of guideBeat
Non-GAAP Gross MarginQ1 FY202680.0% to 81.0%80.3%in-line (within range)Beat
Non-GAAP Operating MarginQ1 FY202630.0% to 32.0%35.8%+3.8 points above high end of guideBeat

New guidance

MetricPeriodGuideYoY
RevenueQ2 FY2026$1.830 billion to $1.930 billion+12.3% to +18

Changes to prior guidance

MetricPeriodPrior guideNew guideΔResult
Revenue
FY2026
$7.500 billion to $7.700 billion$7.710 billion to $7.870 billion+$0.01-0.17 billion at low/high endRaised
Non-GAAP EPS
FY2026
$2.94 to $3.00$3.10 to $3.16+$0.16 to $0.16 at low/high endRaised
Billings
FY2026
$8.400 billion to $8.600 billion$8.800 billion to $9.100 billion+$0.40 to $0.50 billion at low/high endRaised

Reaffirmed unchanged this quarter: Service Revenue ($5.090 billion to $5.150 billion), Non-GAAP Gross Margin (79.0% to 81.0%), Non-GAAP Operating Margin (33.0% to 36.0%)

Segment performance

Q1 FY2026
SegmentQ1 FY2026YoY
Product$0.645B+41.0%
Service$1.205B+11.4%
Product Revenue Growth YoY41%—
Service Revenue Growth YoY11.4%—

Platform metrics

Q1 FY2026
SegmentQ1 FY2026
Billings$2.09B
Billings Growth YoY31%
Free Cash Flow$1.01B
Operating Cash Flow$1.08B

Profitability

Q1 FY2026
SegmentQ1 FY2026
Non-GAAP Operating Margin35.8%
Free Cash Flow Margin54.4%

Management tone

Narrative arc: Product inflecting → Product accelerating + SASE #1 ambition → SASE/firewall market share leadership + competitive moat hardening → AI as the operating model, OT as foundational AI security layer.

AI was upgraded from tailwind to operating model in a single quarter. Three quarters ago AI was framed as a future opportunity. Last quarter management disclosed "AI-driven SecOps billings +22% for the full year" and described AI as a discrete pillar. This quarter the framing is structural: "AI is expanding the attack surface and increasing performance requirements, which is driving higher and more durable security spend," with management explicitly attributing the +41% product revenue print to "customers invested in FortiGates to support increased throughput, segmentation and security requirements across AI infrastructure." The shift from "AI is a growth driver" to "AI is reshaping infrastructure spending in our favor" is the cleanest demand-side reframing in the coverage window and is what justifies the FY2026 revenue raise.

OT security was elevated from secondary segment to foundational AI infrastructure layer. Q3 had OT at +30%+, Q4 at +25%+. This quarter OT billings grew +70% — a step-function acceleration — and management's framing in Q&A repositioned OT as "the bottom few layers of AI five-layer cake," casting it as critical AI infrastructure security rather than a discrete vertical. Tied directly to "heightened ransomware and nation state activity targeting critical infrastructure." This is no longer a side bet; it's the second-fastest-growing pillar and management's preferred competitive moat claim ("Fortinet only leader in OT security").

Sovereign SASE has become an explicit competitive exclusion claim. Q2 framed sovereign SASE as taking "half the market share" within a few years. Q4 escalated to "none of our major SASE competitors offer Sovereign SASE." This quarter management stated flatly: "no major SASE competitor currently offers a comparable solution." The progression from forward-looking thesis (Q2) to operational claim (Q4) to definitional market exclusion (Q1) is the most prescriptive moat claim in the coverage window. Whether the cloud-only competitors close this gap in the next 12–18 months is now the binary question for the sovereign SASE thesis.

Supply chain rhetoric flipped from constraint to weapon. Three quarters ago the CFO described maintaining a 6-month inventory buffer as a defensive move. This quarter management framed direct supply chain management as actively "differentiating Fortinet and supporting market share gain" — turning the same operational capability into a customer acquisition lever. The reframing matters because it lets management claim share-gain momentum without needing to wait for a competitor stumble.

The conservative-guide pattern was tacitly acknowledged. A Q1 print of 35.8% operating margin against a guide ceiling of 32.0% — with the FY operating margin band reaffirmed at 33.0–36.0% — strains good-faith conservatism. Management's choice to reaffirm rather than raise the margin band signals either (a) genuine H2 spend ramp on sovereign SASE data center buildout and FortiOS 8.0 infrastructure or (b) explicit sandbagging to preserve a beat-and-raise cadence through the year. The Q2 operating margin guide of 33.0–35.0% (80bps below Q1 actual) suggests the latter.

Recurring themes management leaned on this quarter:

AI infrastructure demand driving FortiGate performance upgrades and security spendingSovereign SASE as differentiated competitive advantage vs. cloud-only competitorsOT security acceleration amid geopolitical threats and ransomware activityPlatform consolidation and vendor simplification accelerating wallet share gainsSingle FortiOS operating system enabling cross-pillar expansion and customer lock-inProprietary ASIC technology delivering superior performance and lower TCO at scale

Risks management surfaced:

Sophisticated attacks growing in both speed and complexity due to AI tool availabilityHeightened ransomware and nation state activity targeting critical infrastructureRapid AI adoption and increased geopolitical uncertainty expanding attack surfaceData sovereignty and regulatory compliance requirements necessitating private deployment optionsEconomic pressures and heightened regulatory scrutiny influencing customer spending

Q&A highlights

Tal Liani · Bank of America

Why is secure networking billing growing 32% YoY when competitors like Check Point report firewall growth deceleration? What drives this growth and how sustainable is it?

Management attributed growth to FortiGate's unique ability to in-house develop all new security functions (UTM, firewall, sandbox, SD-WAN, SASE, AI quantum computing) and integrate them into a single FortiOS, versus competitors relying on acquisitions. Highlighted FortiGate as the primary driver and noted comparable 40%+ growth 5 years ago during similar infrastructure cycles, driven by consolidation, simplicity, and improved security posture.

32% YoY billing growth in secure networkingFortiGate drives most of network security growthFortiOS 8.0 integrates ~30 functions5 years ago, comparable 40%+ growth during similar infrastructure cycle

Brad Zelnick · Deutsche Bank

What specifically is Fortinet seeing in the AI data center security market—competitors, partnerships, sales cycles, and how much of the strong guidance is driven by pipeline for these opportunities?

Management emphasized Fortinet's unique ASIC chip development since inception, providing 3-5X better performance for same cost and lower energy consumption vs. competitors. No direct competitive threats on performance/cost. Highlighted east-west traffic security, internal segmentation, and data center reference architectures as key tailwinds. Management is confident in AI data center pipeline contributing to guidance but noted early-stage deployment.

Only cybersecurity company with own ASIC chip from day one3-5X better performance for same cost vs. competitors on top 10 functionsCompeting on internal segmentation and east-west traffic securityAI data center opportunity still in early stage; long-term growth runway

Saket Kalia · Barclays

Post-Mythos, what are customers telling you about their reactions? Which Fortinet portfolio areas benefit most? And is early ordering creating an 'air pocket' risk similar to post-COVID?

Management emphasized 'use AI to secure AI' theme. Over 20 products using/building AI. Highlighted OT security growing 70% as foundational layer of AI infrastructure security. Differentiated from COVID by noting current threat landscape is accelerating more fundamentally. Stated no significant pull-forward detected; attributed growth to sustained demand from AI data center buildouts and internal deployments, not inventory cycling.

Over 20 Fortinet products using/building AIOT security growth: 70% YoYOT is 'bottom few layers of AI five-layer cake'Fortinet only leader in OT security

Fatima Bulani · Citi

With strong AI infrastructure buildout tailwinds, should we expect product mix to shift toward higher-end FortiGate SKUs? And why isn't services revenue guidance stronger given product mix uplift and improved attach?

Management confirmed strong growth in high-end appliances driven by data center, but also noted low-end SD-WAN/SASE growth (31% unified SASE, 40% Q4 LASI). Launched new bundled service (Slide 14) to accelerate SASE/SD-WAN adoption. Services billings grew 27%, deferred revenue +15%. CFO stated conversion from balance sheet takes time; trends positive but not immediately visible in revenue. SASE adoption in big enterprise now 18% (up from 16%), tracking strong growth.

Unified SASE billings grew 31%Q4 LASI grew 40%Services billings growth: 27% YoYDeferred revenue growth: 15%

Gray Powell · BTIG

Are branch office firewall customers converting to SD-WAN and then to Secure Service Edge? What is the ballpark uplift to customer annual spending? How should we think about this installed base upgrade opportunity?

Management confirmed field observation of branch firewall customers turning on SD-WAN and converting subscriptions to SSE. Launched bundled service (Slide 14) combining 4-5 separate services into single bundle for products ranging from FortiK40/60 to mid-range. Noted SASE/SD-WAN adoption in large enterprises growing from 16% to 18% quarter-over-quarter. CFO added that higher-end model upsells are also occurring alongside upgrades.

Branch firewall-to-SD-WAN-to-SSE migration pattern confirmedNew bundled service combines multiple services across product range (FortiK40/60 to mid-range)SASE/SD-WAN adoption in big enterprise: 16% → 18% QoQUplift includes upsell to higher-end edge models

Answers to last quarter's watch list

Whether Q1 non-GAAP operating margin holds above the guided 30.0–32.0% range, and by how much. Resolved positively, emphatically. Q1 operating margin printed 35.8% — 380bps above the guide ceiling. The FY operating margin guide of 33.0–36.0% was reaffirmed despite the print, confirming the guide is structurally conservative. Real FY2026 EPS power is materially above the raised $3.13 midpoint.
Resolved positively
Whether service recognized-revenue growth holds 11–12% or breaks below 11%, and whether service billings sustains the +18% Q4 pace. Resolved with mixed read. Recognized service revenue grew 11.4%, just inside the 11–12% band; service billings accelerated to 27% from Q4's 18%, well above the Q4 pace. The leading indicator strengthened materially while the recognized line continues to lag — consistent with management's H2 2026 inflection commitment. Status: Resolved positively (billings); continue monitoring (recognized revenue).
Whether AI-driven SecOps billings growth reaccelerates off the Q4 +6% print. Resolved positively. AI-driven SecOps billings grew +23% in Q1 — a material reacceleration from Q4's +6% — supported by 20+ AI-enabled products and the CFO's framing of AI as a fundamental platform driver.
Resolved positively
FY2026 product revenue trajectory against the 10–15% "midterm average" framing. Resolved decisively — outside the framing. Q1 product revenue grew +41%, nearly 3x the high end of the band. Ken Xie explicitly drew the parallel to a similar 40%+ growth period 5 years ago, repositioning the band as a long-term average rather than a near-term ceiling. The FY2026 revenue raise to +15% YoY (from +10–13%) is the guide-level acknowledgment that the band was sandbagged. Status: Resolved positively (the framing was conservative).
Sovereign vs. public SASE revenue mix disclosure. Not resolved. Management again declined to disclose a specific split, instead doubling down on the moat claim ("no major SASE competitor currently offers a comparable solution"). The headline rhetoric escalated; the quantification did not.
Continue monitoring
Pricing yield realization. Partially resolved. Brad Zelnick's question elicited a CFO disclosure that "low single-digit pricing increase" is baked into product guidance — meaningfully below the 5–20% range management disclosed at Q4. The pricing lever is contributing modestly to the FY raise but the bulk of the raise is volume/mix, not price. Status: Resolved (price is a smaller contributor than initially flagged).

What to watch into next quarter

Whether Q2 non-GAAP operating margin holds above 35% versus the guided 33.0–35.0% range. A further sizeable beat would force management to raise the FY operating margin band, which has now been reaffirmed at 33.0–36.0% despite Q1 printing 35.8%.

Whether product revenue growth holds in the 30%+ range or reverts toward 20%. Q1's +41% is the cleanest expression of the AI infrastructure thesis to date, but is also the toughest comp for FY2027. A Q2 print above 25% would validate Ken Xie's "5-years-ago parallel" framing; a print below 20% would suggest Q1 included AI data center deal lumpiness.

Service billings growth holding above 20% as the leading indicator for the H2 2026 recognized-revenue inflection. Q1 service billings of +27% is the strongest signal yet for the inflection; sustaining it through Q2 is what determines whether H2 2026 actually delivers.

OT security billings growth sustainability above 50%. Q1's +70% is a step-function vs. Q4's +25% — testing whether it's a structural reset to a higher growth rate or a single-quarter spike from a few large critical-infrastructure deals.

Whether the FortiSASE large-enterprise penetration rate continues climbing 200bps/quarter (16% → 18% in Q1 → 20% in Q2?). The penetration cadence is the cleanest measurable proxy for whether management's "fastest-growing SASE leader at scale" claim is compounding or plateauing.

Whether AI-driven SecOps billings growth holds at or above the +23% Q1 rate. Q1's reacceleration from Q4's +6% to +23% is a sharp positive inflection; sustaining the rate through Q2 would confirm the AI-platform monetization thesis rather than a one-quarter bounce.

Sources

  1. Fortinet Q1 2026 press release / 8-K exhibit: https://www.sec.gov/Archives/edgar/data/1262039/000126203926000010/ftntq1-2026ex991.htm
  2. Tapebrief Q4 FY2025 prior brief.
  3. Tapebrief Q3 FY2025 prior brief.
  4. Tapebrief Q2 FY2025 prior brief.

Get the next brief, free.

We publish analyst-grade earnings briefs the same day or morning after every call — headline numbers, segment KPIs, Q&A highlights, and tone analysis. Free during beta.

This is not investment advice.