Fortinet - Cybersecurity Play

It was reported that Singapore lost >SGD500m to cybercrime in 2023. Imagine, our small country of a few million people, losing that much. What would that number be in China, US and Europe? Based on population sizes, it could be 300x more ((China’s 1.3bn + US’ 300m + Europe’s 500m) / Singapore’s 6m = 300). That’s USD150bn!

The company we are discussing today is one of the cybersecurity play listed in the US. Recently, the firm published some good quarterly investment materials and we shall be highlighting many of the key slides here starting the one on Total Addressable Market. The company estimates that its TAM is currently USD125bn but will grow to USD200bn by 2027.

Cybersecurity is big business!

Next, let’s take a look at the simple financials. It is also worth noting that the company has generated high teens growth to sometimes 30% YoY growth for more than 10 years. 

Simple financials (Dec 2024 estimate, USD)

• Sales: 5.5bn
• EBITDA: 1.7bn, EBIT 1.5bn
• Net income: 1.2bn, FCF: 1.7bn
• Debt: -1.0bn (net cash), Mkt Cap 38.7bn

Ratios

• ROE >100%, ROIC 70%
• EV/EBITDA 21.7x (Dec 24), PER 29.9x (Dec 24)
• Past margins: OPM 15-20%
• FCF yield 4-5% (4.4% based on no.s here)

As one the leaders in the cybersecurity space, the company has also enjoyed stable high margins, extraordinarily high ROICs and good Free Cashflow. Due to its recent earnings weakness, shared price collapsed, presenting an opportunity for us to buy. That said, it is still not cheap with PER at close to 30x based on consensus no.s although it looks better with c.5% FCF yield.

1. Fundamentals

Cybersecurity is a megatrend with hackers being way more sophisticated vs 20 years ago and companies and individuals needing more software and solutions to protect themselves. The company has projected market growth to be c.12% but its own revenue has grown close to 20% over the last 15 years.

The company has implemented its own rule of 40 stating that revenue growth and operating margins should exceed 40 in any given year. As we can see, it has comfortably achieved this over the last 5 years. Management is also focused on Free Cashflow and it started generating billion dollar FCF in 2021 and looks like it should hit USD2bn this year.

The company we are discussing today is Fortinet (FTNT US) and we have the following investment thesis:

Fortinet is a leader in network security and is a key beneficiary of the ever-growing cybersecurity megatrend. It is a differentiated player in its space with unique technology which has allowed the firm to build a strong and diversified customer base across geographies. It also boasts higher margins and stronger FCF growth vs its peers.

Fortinet is a network security specialist with 70% of revenue coming from its security network business. The firm is the only cybersecurity vendor with its own SPU or security processing unit with application specific design multi-core processor that has supported generations of secure infrastructure with every iteration. Its main product FortiGate Firewall has 20 years of track record and helped the firm expanded its business portfolio to encompass more recurring revenue and value added services such as SASE*.

Today, Fortinet has an another 20% of revenue coming for universal SASE and 10% from security operations. While its business is entirely related to network security, Fortinet has diversified its business across customer types, geographies and industries. The following charts provide the breakdowns showing how its businesses are evenly split.

*SASE or Secured Access Service Edge, extends networking and security capabilities allowing work-from-anywhere and remote workers, to take advantage of firewall as a service, secure web gateway and zero-trust network access and a medley of threat detection functions. 

Positives

Continuing increase in penetration of secured networks: Networking used to be simple installations. We only needed LAN cables but with the advent of cloud and increased cybersecurity threats, network has become increasing complicated and needed to be secured. Starting from a few years ago, secured network installation picked up globally and penetration stands at 40% of all networks today. This is expected to grow to more than 52% in 2030 i.e. more than half of all networks are secured networks. Fortinet stands to benefit from this trend as the leading player in the field.

High recurring gross profits: The nature of the cybersecurity business calls for monitoring, service and support. As such, c.65% of Fortinet’s gross profits comes from service and such high recurring gross profits look set to grow as we can see from the chart below:

As its installed base grows, cost is spread across to a bigger revenue pie and use cases are learnt and reapplied to solve similar problems with other clients. The strengthens Fortinet’s moat and widen the knowledge gap between the company and its smaller competitors. We shall revisit this point later.

Strong shareholder returns via share buybacks: Fortinet’s business is highly FCF generative and it has spent a significant sum in share buyback over the years, repurchasing 214m shares (c.20% of outstanding shares) for USD5.8bn. Fortinet’s current buyback until Jan 2024 will be accretive at current valuation and providing further downside support for share price.

Risks

High growth markets are naturally highly competitive and cybersecurity is no different. Fortinet needs to compete with its bigger and more prominent peer - Palo Alto Networks alongside a slew of US and global competitors. It is unclear if the firm can maintain its high margins indefinitely.

At the same time, behemoths like Microsoft, Google and Apple would also be keen to enter this space given its importance to their core business. These are trillion dollar companies that have all the resources to compete. Fortinent’s own slide below illustrates the risk we are discussing well.

Mitigating factor: Fortinet has USD5bn of revenue in its space, second only to Palo Alto (as shown above) and should be strong enough to compete against the peers listed above. On the other hand, if Google or Microsoft is looking for something to acquire in cybersecurity, then Fortinet will also be interesting as a target. So as long as management continues to execute well, earnings and share price should do okay.

Management

Fortinet is founded in 2000 by two brothers: Ken Xie (60) and Michael Xie (54) and together they still own c.20% of the company. Ken is Chairman and CEO while Michael is President and CTO. Needless to say, Fortinet will not be here today without them and while the management team is professional and strong, Ken and Michael will be instrumental to Forinet’s continuing growth.

2. Technicals

The following chart shows how Fortinet has traded over the last 5 years. Recall that Mar 2020 was an important point in time for many stocks as it reflected maximum fear at the height of the pandemic but looking at Fortinet’s stock price, it is probably not relevant and we see a stronger support near today’s share price of USD52.

Without looking at valuations (just pure technicals), the risk reward seemed to suggest USD50 at the downside and USD80 on the upside, as marked by its historical high. But if we want to be more conservative, the next support at USD30 marked around 2020-21 could be used. The math would then be 40% downside (USD 52, today’s share price / USD30 support) vs 60% upside (USD80, historical high/52, today’s share price).

To be clear, this is a first-cut rudimentary exercise using just technicals and we shall revisit this later with valuations which is more reliable.

The other important point to note with technicals is the drawdown. As we can see, drawdowns have been treacherous at close 50% twice just looking at the last 2 years. As our past investments have shown, it is not inconceivable that share prices plunge 50% even when our analysis shows everything is cheap. Just look at Idea #11 - Bayer!

So, I would caution that we size slowly with Fortinet given its business nature, share price volatility and high valuation.

3. Valuation

As a cybersecurity play, Fortinet does not come cheap and our usual valuation table below shows marginal upside. To recap, earnings are represented by Free Cashflow, EBITDA and Net Income.After ascribing the respective high multiples (20-25x) and adjusting for cash on its balance sheet, we are just getting USD54-61 which is quite far away from its historical high share price of USD80.

Compared to its peers (table below), Fortinet trades at a slight discount but it’s still not cheap. Again, this is a name that we should size small initially to adjust for its high valuation. If share price declines and valuation becomes reasonable, Fortinet could also become a take out candidate. As mentioned, megacaps like Google, Microsoft or even its peers might be keen to acquire Fortinet should it trade cheaply.

Intrinsic Value 

 There are two ways to think about Fortinet’s intrinsic value. We can take the average of the three intrinsic values, that gives us USD57 or c.10% upside. Or we can use the FCF IV of USD61 which has 19% upside. Personally I think the latter better reflects the cybersecurity growth opportunity. 

Now that we have the valuation numbers, let’s do the risk reward analysis again. On the downside, if we take down the valuation multiples by 5 turns across the three metric, we get -4 to -19% downside. As mentioned, the upside would be 19%. This shows that risk reward is just balanced. Not asymmetrical with a lot of upside and little downside but I would say that’s good enough.

Putting everything together, I would be initiating a small position at current share price of USD51. 

Huat Ah!

This post does not constitute investment advice and should not be deemed to be an offer to buy or sell or a solicitation of an offer to buy or sell any securities or other financial instruments.