Fortinet FTNT

Reference table

1. What the business is, and how the disclosure works

Fortinet describes itself as "a global cybersecurity leader driving the convergence of networking and security." Founder, chairman and chief executive Ken Xie; approximately 15,311 employees per the vendor profile; Sunnyvale, California; NASDAQ-listed since 2009.

The company reports revenue two ways, and the vendor supplies both correctly.

By type (seg_prod, FY2025):

The three lines sum to $6,799.6M, matching reported FY2025 revenue exactly. Security Subscription plus Technical Support is what the company calls Service, and it was 67.4% of FY2025 revenue.

By geography (seg_geo, FY2025):

These sum to $6,799.6M exactly, and the home market is present — the Americas at 39.7%. The SYK/DHR/BMY failure mode (a missing home or rest-of-world region) does not occur here. Note that EMEA overtook the Americas as the largest region in FY2025, growing 18.3% against the Americas' 10.6%.

Customer concentration, from the 10-K, and it is significant

Fortinet sells almost entirely through distributors, and three of them are more than half the company.

The 10-K adds that "Six distributor customers who purchase directly from us accounted for 67% and 69% of our total net accounts receivable in the aggregate as of December 31, 2025 and 2024." This is a genuine structural risk that no ratio in the vendor file expresses.

Competitors, named in the 10-K: Check Point, Cisco, CrowdStrike, F5 Networks, Hewlett-Packard Enterprise, Huawei, Microsoft, Netskope, Palo Alto Networks, SonicWALL, Sophos and Zscaler. The list is worth reading for what it implies: Fortinet competes simultaneously against the largest software company in the world, the largest networking company, and a set of pure-play security firms — and the 10-K concedes that "several competitors are significantly larger, have greater financial, technical, marketing, distribution, customer support and other resources ... and have significantly better brand recognition."

2. The composition of the growth — the fact that governs this dive

The June 2026 quarter, from the 10-Q filed 2026-07-30:

Six months to June 2026: Product $1,418.1M against $968.0M, +46.5%; Service $2,479.4M against $2,201.7M, +12.6%; total $3,897.5M against $3,169.7M, +23.0%.

Read those two rows against each other and the entire investment question is visible. The company's headline growth rate is 25.6%. Its recurring growth rate is 13.7%. The gap is a hardware replacement wave, and hardware is not an annuity.

Two honest qualifications, because this cuts both ways.

First, the bull qualification, and it is substantive. Every FortiGate sold in a refresh drags subscription and support revenue behind it for the life of the box. The mechanism by which a product cycle becomes a service annuity is visible in the deferred revenue balance: $7,675.7M at 30 June 2026 against $6,567.6M a year earlier, up 16.9% — faster than the 13.7% at which service revenue is currently being recognised. Remaining performance obligations were $7.73B, of which $3.86B converts within twelve months and $3.08B in years two and three. Billings — revenue plus the change in deferred revenue — grew 33% to $2,372.1M. The invoiced base is running well ahead of the recognised base, and that is precisely what you would expect to see if the refresh were converting into an annuity rather than evaporating.

Second, the bear qualification. Billings and deferred revenue both include the hardware. A three-year subscription sold alongside a box inflates deferred revenue at the moment of the refresh and then amortises away. The forward-looking test is not the level of deferred revenue but whether service revenue growth accelerates above 13.7% in the coming quarters. It has not yet.

And gross margin already shows the mix effect. Blended GAAP gross margin was 80.2% in Q2 2026 against 81.5% in Q2 2025 — a 130 basis point decline. But it is not a pricing problem: product gross margin actually IMPROVED, from 67.4% to 69.8%, while service gross margin was 86.6% against 86.7%. The blended decline is arithmetic — a lower-margin line growing four times faster than a higher-margin one. That is a fact worth holding: the margin dilution is mix, not price, and it will reverse when the refresh does.

3. Growth, margins and the trajectory

The shape is a growth company that decelerated hard into 2024, expanded margin dramatically while doing so, and has now re-accelerated. Gross margin went from 75.4% in FY2022 to 80.8% in FY2025 — 540 basis points — and operating margin from 22.0% to 30.6%. That happened during the deceleration, which is unusual and creditable: Fortinet did not buy its way out of the slowdown.

Quarterly, and the acceleration is unmistakable:

Five consecutive beats, and they are getting larger: +8.5%, +17.3%, +9.0%, +32.5%, +20.6%. The Q1 2026 beat of 32.5% on EPS and the Q2 revenue beat of 8.4% ($2,047.9M against $1,888.5M expected) are the two prints that produced the 107% six-month move. The earn_cal basis is consistent across all five rows — actual and estimate are both non-GAAP — so no PLD-style mid-series basis switch is present and the beat series is a like-for-like comparison.

Guidance, from the 8-K of 2026-07-29 (Exhibit 99.1, fully extracted — a genuinely useful filing rather than a cover page):

Two observations on this guide, both important and neither flattering.

First, the Q3 revenue midpoint of $2.055B is only +0.3% sequentially on the June quarter's $2,047.9M. After two quarters of 20%+ growth, the company is guiding to a flat sequential quarter. That is management's own signal on the shape of the refresh, and it is half-weighted here as company guidance — but it is a number, not a narrative.

Second, FY2026 billings of $9.350–9.550B against FY2025 billings of $7,553.7M is +23.8% to +26.4% — well above the +19% revenue guide. Billings are the leading indicator and they are still accelerating. FY2024 billings grew only 2.1% ($6,532.5M against $6,399.5M) and FY2025 grew 15.6%. The billings series is the strongest single piece of evidence that this is more than a one-quarter spike.

4. Balance sheet and the enterprise-value rebuild

Filing-verified, 30 June 2026 (10-Q filed 2026-07-30):

The debt situation is simple and clean, and the filing settles it. Fortinet issued $1.0 billion of senior notes in March 2021 in two tranches: $500M of 1.0% notes due 15 March 2026 and $500M of 2.2% notes due 15 March 2031. The cash-flow statement in the June 10-Q shows "Repayment of senior notes (500.0)", and the balance sheet's current-debt line is zero at 30 June 2026 (total current liabilities of $4,840.8M reconciles exactly as $282.5M + $393.7M + $322.8M + $3,841.8M). The 2026 notes are gone. The only remaining borrowing is $496.9M of carrying value on the 2031 notes at a 2.2% coupon. Moody's upgraded the senior unsecured rating to A3 from Baa1 in the quarter.

Correction — the vendor omits the short-term investments, exactly the PDD/ISRG pattern. km_ttm.enterpriseValueTTM is $121,038,670,663. Market capitalisation is $123,476,670,663. The difference is exactly $2,438,000,000, which is cash of $2,934.9M less long-term debt of $496.9M. The vendor nets against cash and equivalents only, ignoring $1,134.7M of short-term investments and $399.1M of long-term investments — both of which are marketable securities the 10-Q discloses in the fair-value hierarchy alongside cash equivalents.

The rebuilt enterprise value:

> Market cap $123.477B (733.6M shares × $168.29)

> + total debt $0.497B

> − cash $2.935B

> − short-term investments $1.135B

> = corrected enterprise value $119.904B

> (counting the $399.1M of long-term investments as well: $119.505B)

The correction is modest — 0.94% — because net cash is small against a $123B market capitalisation. We make it anyway, because the direction of the error is the same one that made PDD's enterprise value 78% too high, and reporting it is the point.

What the balance sheet actually says. Fortinet has more cash and investments than debt by a factor of nine, interest coverage of 135.6x, and a $500M obligation that does not mature until 2031 at a 2.2% coupon. Financial risk here is effectively zero. The one item that looks alarming and is not: total stockholders' equity of $1,551.1M against a $123.5B market capitalisation, giving priceToBookRatioTTM of 79.8x and returnOnEquityTTM of 187.9%. Both are artefacts of $8.51 billion of cumulative buybacks since 2016 against a company that had negative book equity as recently as 31 December 2023. priceToBookRatioTTM, priceToFairValueTTM (identical at 79.8x), returnOnEquityTTM and debtToEquityRatioTTM are all rejected as lenses here. returnOnInvestedCapitalTTM of 32.8% is the honest return measure. Note the vendor's own composite rating scores Fortinet 1 out of 5 on both price-to-book and price-to-earnings, dragging the grade to B / 3 — a screening artefact, not a judgement.

The one genuine balance-sheet observation: $7,675.7M of deferred revenue is 70.7% of total assets. Fortinet is financed by its customers. That is a strength — it is why free cash flow ($2,226M in FY2025) exceeds net income ($1,853M) by 20% and why incomeQualityTTM is 1.685 — but it also means the liability side of this balance sheet is an obligation to deliver service, not to repay money, and reading total liabilities of $9,308.1M as leverage would be wrong.

5. Cash flow and capital returns

Free cash flow has compounded 15.4% a year since FY2022 at a consistent 32-33% margin, and the June quarter printed 47.2% — a function of the billings surge landing as cash before the revenue is recognised.

Capex of 4.6% of revenue is high for a software company (capexToRevenueTTM 4.65%, capexToDepreciationTTM 1.018) because Fortinet buys and builds its own real estate and data centres: property and equipment, net, is $1,699.5M and rising. That is a deliberate choice and it depresses free cash flow relative to peers who lease.

No dividend. dividendPerShareTTM is zero and dividendYieldTTM is zero — correctly reported, not a data gap.

The buyback, and the fact that should be read twice. The programme has repurchased 267.3 million shares for $8.51 billion since 2016. In FY2025 alone it bought 28.7 million shares for $2.29 billion. Authorisation stands at $10.25 billion through 28 February 2027, with approximately $1.27 billion remaining as at 2026-02-24.

> "Subsequent to December 31, 2025 and through the filing of this Annual Report on Form 10-K, we repurchased 6.1 million shares of our common stock at an average price of $76.68 per share, for an aggregate purchase price of $470.5 million."

> — 10-K filed 2026-02-25

The board was buying its own stock at $76.68 five months ago. The stock closed at $168.29 — 119.5% higher. That is powerful evidence of a management team that understood what it owned when the market did not. It is also, unavoidably, evidence about the price today: $1.27 billion of remaining authorisation buys 7.5 million shares at $168.29 against 16.6 million at $76.68. Share count fell from 743.0M to 733.6M in the six months to June, a 1.3% reduction. Total shareholder yield is therefore roughly 1.5-2.5% and entirely buyback — and the buyback's value depends on the price at which it is executed.

6. Valuation — priced in or room?

At $168.29 (market cap $123.477B, 733.6M shares, corrected enterprise value $119.904B):

Estimate coverage is excellent in the near years and collapses after FY2028: 21-26 analysts on FY2026, 25-33 on FY2027, 9 on FY2028 EPS, and 3 on FY2029 and FY2030.

The FY2029 and FY2030 rows are internally broken and REJECTED. epsAvg for FY2029 is $3.550 and for FY2030 $3.771 — both BELOW the FY2028 figure of $4.240 — while revenueAvg rises from $9,979M to $11,423M to $12,192M across the same three years. netIncomeAvg shows the same inversion: $3,219.9M in FY2028 falling to $2,655.2M in FY2029. Revenue up 22% and net income down 18% over two years is not a forecast; it is a broken series, produced by three analysts. Neither row is used for anything.

est.ebitdaAvg and est.ebitAvg are fixed-ratio fabrications and are REJECTED in full. ebitdaAvg is exactly 52.55% of revenueAvg in every year from FY2026 through FY2030; ebitAvg is exactly 50.72%. Against reality, Fortinet's actual FY2025 EBITDA margin was 36.2% and its actual operating margin 30.6%. The vendor's FY2025 ebitdaAvg of $3,549.4M is 44% above the $2,464.6M the income statement supports. This is the signature named in the data contract. All forward valuation here runs on epsAvg and revenueAvg.

epsAvg, by contrast, validates cleanly. The FY2026 epsAvg of $3.423 sits inside the company's own guided range of $3.41–$3.47, and the FY2026 revenueAvg of $8,090.7M sits inside the guided $8.020–8.180B (midpoint $8.100B). The estimate block is, for the near years, essentially guidance — which makes it reliable and also means it contains no independent information.

Peer context. The vendor peer set is not usable — Autodesk, CoreWeave, Infosys, Motorola Solutions, Strategy Inc, Synopsys, Seagate and TE Connectivity are matched on market capitalisation, not on business. Not one direct security competitor appears in it. The 10-K's own competitor list — Check Point, Cisco, CrowdStrike, F5, HPE, Huawei, Microsoft, Netskope, Palo Alto Networks, SonicWALL, Sophos, Zscaler — is the relevant universe, and no peer multiples are supplied in the file, so no peer-multiple comparison is drawn.

6a. What today's price assumes (the inversion)

At $168.29 — 45.0x the FY2027 consensus and 39.7x FY2028 — the price embeds:

• Revenue reaches $9.002B in calendar 2027 and $9.979B in 2028. (Consensus; 33 and 23 analysts on revenue.) That is +11.3% then +10.9%, decelerating from the +19% the company has guided for 2026. The price is not paying an 11% multiple, so either the price disagrees with consensus or the price is wrong.
• Non-GAAP EPS reaches $3.743 in 2027 and $4.240 in 2028. (Consensus; 25 and only 9 analysts.) FY2027 EPS growth of 9.4% against a 45.0x multiple is a PEG of 4.8. That is the arithmetic the bull case must dismantle.
• The product refresh does not simply reverse. (Our number, derived from the segment split.) Product revenue of $773.0M in Q2 2026 annualises near $3.1B against $2,218.4M for all of FY2025. If product revenue merely returns to its FY2025 level in 2027 while service grows 14%, total 2027 revenue is roughly $8.6B — 4.5% BELOW the consensus $9.002B. The refresh does not have to collapse for consensus to be missed; it only has to normalise.
• Non-GAAP operating margin holds at 35-37%. (Company guidance, half-weighted.) This has to happen while product — the lower-gross-margin line at 69.8% against service's 86.6% — grows as a share of revenue. The mix arithmetic works against it.
• The market keeps paying roughly 40-45x forward earnings. (Our number.) At 30x FY2028E the stock is $127; at 50x it is $212. This is the most fragile assumption in the price, and the evidence that it is fragile is that the street's own targets are already below the market: $151.31 consensus, $164 median, both under a $168.29 close.

6b. The return bridge (why the multiple moves)

Expected return over the next twelve months decomposes as: EPS growth (+13.3%, from FY2027E $3.743 to FY2028E $4.240) + multiple drift (COMPRESSION, from 45.0x to roughly 36x on the respective forward year, −20%) + shareholder yield (+1.5% to 2.5%, all buyback) ≈ −5% to −7%.

Our base assumes meaningful multiple compression, and the reason is the growth profile the multiple is attached to, not a rate or risk argument. Today the market pays 45.0x on the next calendar year. That multiple is appropriate to a company compounding EPS in the twenties. Consensus says Fortinet compounds at 9.4% in 2027 and 13.3% in 2028. A 45x multiple on a low-teens grower survives only while the current quarter's 26% headline is fresh. The compression we assume is not the mechanical rolldown of a forward year — at a constant price, 45.0x FY2027 becomes 39.7x FY2028 automatically, and that is not re-rating. We are assuming the market pays 36x FY2028E in twelve months' time against 45.0x FY2027E today: a genuine 20% de-rating.

Almost none of the expected return is left over after that. If the multiple simply held at 45.0x on FY2028E, the price would be $191 (+13.3%). At 32x it would be $136 (−19.2%). The entire outcome sits in a multiple we do not control, on a stock at an all-time high, where the sell-side's published targets are already below the price.

6c. Variant perception (where we differ, what would surprise)

• We differ from the price on what kind of growth this is, and the segment table settles it. The market has repriced Fortinet 107% in six months on a 26% headline. The recurring 62% of the business grew 13.7%, and security subscriptions grew 13.2%. We do not think a 45x multiple is the right price for a company whose annuity compounds in the low teens, however good the annuity is. This is our central disagreement and it is entirely arithmetic.
• We differ from consensus in the opposite direction on 2027 revenue, and we hold both views at once because they are not contradictory. Billings guided at $9.350–9.550B for 2026 already exceed the consensus 2027 revenue of $9.002B, and deferred revenue is compounding at 16.9% — faster than recognised service revenue. There is a real possibility that consensus revenue for 2027 is too low. But even if 2027 revenue comes in at $9.5B rather than $9.0B, at a 39.7x FY2028 multiple the stock needs the multiple to hold, and that is a different question from the revenue. A revenue beat does not fix a 45x multiple on a 9% earnings grower.
• We agree with the street's number and disagree with its process, which is worth stating. Our base of $152 and the street's consensus of $151.31 are within a dollar. But the street arrived there with 29 buys against 33 holds and 6 sells — an unusually negative distribution for a stock that has doubled — and a low target of $83, less than half the current price. The dispersion (high $203, low $83) is 2.4:1. That spread is the refresh-durability question priced as uncertainty, and we share the uncertainty rather than resolving it.
• Positive surprise that would force a re-rate upward: the 2026-11-04 print with service revenue growth above 17%, which would be the first evidence the refresh is converting into annuity; or Q3 revenue materially above the $2.100B top of the guide, breaking the flat-sequential shape management itself has signalled; or FY2027 guidance issued in February above roughly $9.5B.
• Negative surprise that would break the thesis: product revenue growth below 30% in the September quarter; service revenue growth below 13%; billings below the $2.250B guide floor; non-GAAP operating margin below 35%; or any disruption at Distributor A, which is 28% of revenue and 32% of net receivables. The stock has zero drawdown cushion — it closed at its all-time high — so any of these lands on a price with nothing beneath it until the 50-day average 10.2% lower.

Synthos fair values

All three anchors are multiples of the FY2028 consensus non-GAAP EPS distribution (mean $4.240, low $3.614, high $5.384 — 9 analysts, disclosed as thin), cross-checked against the better-covered FY2027E of $3.743 (25 analysts). The FY2029 and FY2030 rows are rejected as broken and play no part.

• Bear ~$101 — 28x the FY2028 consensus LOW of $3.614. Cross-check: 27.0x FY2027E; roughly the 200-day moving average of $101.37, which is where this stock traded as recently as five months ago. The scenario: the refresh crests in the second half of 2026, product revenue reverts toward its FY2025 run rate, total growth falls to high single digits, mix pressure holds gross margin near 79%, and a low-teens grower with net cash earns a high-twenties multiple. −40.0%.
• Base ~$152 — 35.8x the FY2028 consensus MEAN of $4.240. Cross-check: 40.6x FY2027E; corrected enterprise value of $107.9B on FY2028E revenue of $9.979B is 10.8x sales. Sensitivity, stated openly: 32x gives $136, 40x gives $170 — essentially today's price. The whole answer lives in a 32-40x band. The scenario: the refresh converts partially into the service annuity, revenue lands near consensus, margins hold at the low end of guidance, and the multiple de-rates toward what a low-teens compounder with a fortress balance sheet is worth. −9.7%, plus roughly 2% of buyback yield.
• Bull ~$240 — 44.6x the FY2028 consensus HIGH of $5.384. Cross-check: 64.1x FY2027E. The scenario: the refresh is structural rather than cyclical because AI-era security requirements genuinely raise the installed-base spend per seat; service revenue accelerates through the high teens as the new boxes attach subscriptions; billings growth above 25% persists; and the market treats Fortinet as a 20%+ compounder. +42.6%. Note this bull case holds today's multiple roughly constant and relies entirely on the earnings distribution's high end — a 27% spread between the consensus mean and high, which is itself a measure of how unresolved this is.

Base is 9.7% below spot; asymmetry roughly 1.07:1 (40.0% down, 42.6% up). A near-symmetric distribution around a base below the current price is the definition of a name to watch rather than own, and it is why this is a Watch and not a Buy despite the business quality.

7. Knowledge base — one claim, conviction 45, three months stale

Raw entity hits: 1. Text-only hits naming Fortinet: 0 additional (the single text match is the same claim). Used as name-level conviction: 0. Sector-level text sweep: 33 raw, 5 used as labelled context, 28 discarded.

The single claim naming Fortinet, verbatim:

> 2026-05-09 · bullish · conviction 45 · horizon: fact · entities: DDOG, FTNT · channel: jordi_visser · speaker: jordi_visser · speaker_role: independent

> "Cyber/analytics names (Datadog, Fortinet) are separating from seat-based software (Adobe); software may outperform and semis underperform for a month or two."

What this is, stated without inflation. It is a named-speaker claim from a high-skill independent lane, which is the best attribution quality this process recognises — and it is a two-month rotation observation with a conviction of 45 and a horizon tagged "fact", which under the Synthos recency policy decays over months rather than years. It was made 87 days before this dive, its stated window ("a month or two") has expired, and it says nothing about Fortinet's business. As it happens the call was correct — Fortinet is up sharply since 9 May — but a correct two-month rotation call is not a reason to buy a stock at 45x forward earnings three months later.

A supplementary sector sweep on cybersecurity / cyber security / firewall / SASE across the full 51,928 claims returned 33 text hits, none of which carries FTNT as an entity. Twenty-eight are discarded and the reasons are worth listing because they are a clean demonstration of the homograph problem:

Five sector claims survive and are used only as labelled context for the exponential-potential score, never as conviction on Fortinet:

> 2026-07-27 · bullish · conviction 72 · speaker: Dan Ives · channel: anthony_pompliano

> "Rather than AI eating cybersecurity, the cybersecurity budget will double over the coming years because of AI, even as some SaaS software companies get disintermediated."

> 2026-07-14 · bullish · conviction 60 · speaker: Josh Brown · channel: compound_and_friends

> "Enterprise dollars are rotating out of SaaS into servers, storage, memory and cybersecurity for AI workloads."

> 2026-06-23 · bullish · conviction 48 · channel: compound_and_friends · no named speaker

> "Within software, stay with cybersecurity and very little else."

> 2026-06-08 · bullish · conviction 70 · speaker: Nikesh Arora · channel: all_in · MANAGEMENT VOICE — HALF WEIGHT

> "AI raises the terminal value of the cybersecurity industry — model capabilities to find code vulnerabilities are real ... so systemic breach risk and patching demand rise."

> Disclosure: the speaker is the chief executive of Palo Alto Networks, a direct competitor named in Fortinet's own 10-K. Under the house rule this is management voice, excluded from the conviction pool and quoted here at half weight. It is a competitor talking his industry's book, and it is treated as such. (An AI-model codename appearing in the original claim text is redacted per house rules.)

> 2026-02-15 · bullish · conviction 70 · channel: jordi_visser · no named speaker · entities: VIX

> "Own volatility through the year; recurring AI 'Jaws' shocks and cybersecurity breaches will repeatedly disrupt vulnerable software/cyber names."

> Note that this one cuts AGAINST the sector, not for it — it treats cyber names as disruption victims of volatility, not beneficiaries. We include it precisely because it does.

Concentration test. No single channel dominates the usable set: anthony_pompliano 1, compound_and_friends 2, all_in 1, jordi_visser 1. compound_and_friends supplies 2 of 5 (40%), above the one-third threshold, so the test applies: removing it leaves three claims (Dan Ives, Nikesh Arora half-weighted, jordi_visser negative) and the sector reading remains mildly positive with one dissent. The conclusion is unchanged.

Conclusion, stated as a finding. The Synthos knowledge base has no view on Fortinet. It has a sector view — that AI raises rather than reduces cybersecurity spending — which is supported by three independent voices, contradicted by one, and one of whose supporters runs a competitor. That view feeds the exponential-potential score of 6 and nothing else. It contributes zero to the fair value, zero to the verdict, and zero to the growth assessment. Conviction rating Low, breadth 1, and the thinness is a direct input to the Watch verdict.

8. Data integrity — what we rejected and why

Eight findings.

1. km_ttm.enterpriseValueTTM omits $1,134.7M of short-term investments — REJECTED and rebuilt. The vendor's EV of $121,038,670,663 is market capitalisation less exactly $2,438,000,000, which reconciles as cash of $2,934.9M less long-term debt of $496.9M at 30 June 2026. It ignores $1,134.7M of short-term investments and $399.1M of long-term investments, both disclosed in the 10-Q's fair-value tables as marketable securities. Corrected net cash is $3,573M (or $3,972M including long-term investments) and corrected enterprise value is $119.904B. Consequential corrections: evToSalesTTM 16.08x → 15.93x; evToEBITDATTM/enterpriseValueMultipleTTM 41.83x → 41.42x; netDebtToEBITDATTM −0.843x → −1.23x. The vendor reports net cash of $2.438B; the 10-Q supports $3.573B; we use $3.573B.

2. est.ebitdaAvg and est.ebitAvg are fixed-ratio fabrications — REJECTED in full. ebitdaAvg is exactly 52.55% of revenueAvg in every year from FY2026 to FY2030; ebitAvg is exactly 50.72%. Fortinet's actual FY2025 EBITDA margin was 36.2% and operating margin 30.6%. The FY2025 ebitdaAvg of $3,549.4M overstates the income statement's $2,464.6M by 44%. This is the APP/CVS/ISRG signature; no forward valuation in this dive touches these rows.

3. The FY2029 and FY2030 estimate rows are internally inconsistent — REJECTED in full. epsAvg falls from $4.240 (FY2028) to $3.550 (FY2029) and $3.771 (FY2030) while revenueAvg rises from $9,979M to $11,423M to $12,192M; netIncomeAvg falls from $3,219.9M to $2,655.2M over the same span. Revenue up 22% with net income down 18% is not a forecast. Both rows carry only 3 analysts on EPS. Neither is used.

4. est.epsAvg and est.revenueAvg for FY2026 are VALIDATED against company guidance — and used, with a caveat. epsAvg of $3.423 sits inside the guided $3.41–3.47; revenueAvg of $8,090.7M sits inside the guided $8.020–8.180B. They are reliable. They are also, for the current year, simply a restatement of guidance and therefore contain no independent information — which is disclosed rather than presented as corroboration.

5. The income-statement D&A line and the cash-flow D&A line disagree by a factor of two — cash flow used. inc_a FY2025 reports depreciationAndAmortization of $152.0M; cf_a FY2025 reports $336.3M. The difference is depreciation charged into cost of revenue rather than operating expense. We use the cash-flow figure of $336.3M for any EBITDA reconstruction and flag that the income-statement field understates it by 55%. The vendor's own ebitdaMarginTTM of 38.44% implies trailing EBITDA of $2,893.5M, which is consistent with the cash-flow basis and is therefore accepted.

6. Book-equity metrics are economically meaningless here — REJECTED as lenses. priceToBookRatioTTM and priceToFairValueTTM (both 79.84x), returnOnEquityTTM (187.9%) and debtToEquityRatioTTM (0.320x) are arithmetically correct and all distorted by the same thing: $8.51 billion of cumulative buybacks against a company whose total stockholders' equity was NEGATIVE $463.4M at 31 December 2023 and is $1,551.1M today. returnOnInvestedCapitalTTM of 32.8% is used instead. Note the vendor rating scores Fortinet 1 out of 5 on both price-to-book and price-to-earnings, dragging the composite to B / 3 — a screening artefact.

7. The vendor peer set is unusable — DISCARDED. Autodesk, CoreWeave, Infosys, Motorola Solutions, Strategy Inc, Synopsys, Seagate and TE Connectivity are matched on market capitalisation, not on business. Not one of the twelve competitors Fortinet names in its own 10-K appears. No peer-multiple comparison is drawn.

8. quote.yearHigh/yearLow disagree with tech.hi52/lo52 — tech used. Quote: $170.35 / $70.12. Tech: $168.29 / $74.39. The quote figures are intraday extremes; the tech figures are closes. We use tech throughout. Note that tech.hi52 equals tech.last exactly and pct_from_hi and max_dd_from_peak are both 0.00% — this is not a defect; it is the legitimate case of a stock closing at its highest close in the series.

One observation rather than a finding. The momentum oscillators in tech are milder than the return series would suggest: RSI 55.2 and MACD +2.99 at a record close, against a three-month return of +88.6%. That combination normally indicates a multi-week consolidation immediately before the current move rather than a blow-off, and it is internally consistent with a 50-day average of $151.11 sitting only 11.4% below the price after a near-doubling. We lean on the return series and the moving averages and do not draw any conclusion from RSI or MACD here.

Not defects, correctly reported and independently confirmed: seg_prod sums to $6,799.6M for FY2025, matching reported revenue exactly, with the company's own three-line revenue disaggregation intact; seg_geo sums to $6,799.6M with all three regions including the Americas home market present; inc_q revenue for the June 2026 quarter ($2,047.9M) matches the 10-Q income statement to the dollar, as do Q2 gross profit and operating income; dividendPerShareTTM of zero is correct — Fortinet pays no dividend; interestCoverageRatioTTM of 135.6x is consistent with $496.9M of 2.2% debt; incomeQualityTTM of 1.685 correctly reflects operating cash flow of $2,590.6M against net income of $1,853.4M; profile.currency is USD and inc_a[0].reportedCurrency is USD — no currency mixing; and earn_cal uses a consistent non-GAAP basis across all five reported rows, so the beat series is like-for-like.

8-K scan for corporate actions postdating the statements — completed, and the result is a finding rather than an absence. The three retained 8-Ks are 2026-05-06 (Q1 results, Exhibit 99.1 fully extracted), 2026-06-16, and 2026-07-29 (Q2 results, Exhibit 99.1 fully extracted). No merger, acquisition, divestiture, financing or capital-structure event postdating the 30 June 2026 balance sheet appears in any of them. The one balance-sheet event of the period — the repayment of the $500M 1.0% senior notes in March 2026 — is already reflected in the 30 June 2026 filing and in the cash-flow statement. This is a verified-clean result on the highest-yield check in the process, and it is stated as such.

Non-equity tripwire — checked and passed. FTNT is common stock, $0.001 par value, NASDAQ-listed (10-Q cover). The $168.29 price is not par-like; beta is 1.09; there is no dividend at all, which rules out a fixed-income-like instrument; volume was 5.85M shares (~$985M of turnover); and the 52-week band of $74.39 to $168.29 is a 126% range. This is common equity.

9. Technicals

• Price $168.29, up 3.11% on the day and the highest close in the six-year series: tech.hi52 equals tech.last, pct_from_hi is 0.00%, and max_dd_from_peak is 0.00%. There is no drawdown.
• +126.2% above the 52-week low of $74.39. Position within the annual range: 100th percentile.
• Moving averages, both far below: +11.4% above a 50-day of $151.11; +66.1% above a 200-day of $101.37. The 200-day is the more striking number — this stock has gone from $101 to $168 in under a year of average price.
• RSI 55.2 and MACD +2.99 — both mild for the price action, discussed in Section 8.
• Relative performance, and it is extraordinary: 3-month +88.6% vs SPY +7.6% and QQQ +7.7%; 6-month +107.0% vs SPY +11.1% and QQQ +15.7%; 12-month +72.9% vs SPY +24.3% and QQQ +30.8%. Fortinet outperformed the S&P by 96 points over six months.
• Sentiment, and this is the disconnect: 29 buy, 33 hold, 6 sell across 68 analysts, vendor consensus label "Hold". Consensus target $151.31 — 10.1% BELOW spot. Median $164 — 2.6% below spot. High $203 (+20.6%), low $83 (−50.7%).

What the technical picture does to the entry. A stock that has outrun every published price target is in one of two states: the targets are about to be raised, or the stock is about to come back to them. Both happen; neither is predictable; and there is no company-specific event for 92 days to resolve it. What is certain is that there is no valuation and no chart support beneath this price — the first is the 50-day average 10.2% lower, the second the 200-day 39.8% lower. Buying at an all-time high, at 45x forward earnings, with the consensus target 10% below, three months before the next data point, is not an entry with an edge in it.

10. Insiders — a director-vesting cycle and a Form 3, and nothing else

The eight most recent insider transactions in the file are:

Every transaction is a restricted-stock-unit conversion at a zero price — the annual non-employee director equity vest, three directors, same day, same 650-share tranche. There are zero open-market purchases and zero open-market sales in the file. A Form 3 from Derek T. Kan on 2026-06-18 records a new insider taking up a position; the file does not disclose the role. Two Form 5 filings from Ming Hsieh, dated 2023-12-31 and filed 2026-06-12, are late-reported year-end statements with zero securities transacted.

This is a neutral signal and is reported as neutral. No officer — including founder-chief-executive Ken Xie — appears in the last eight transactions, so the file supports no inference about management's view of the price.

What does support an inference is the company's own buying, covered in Section 5: 6.1 million shares at an average of $76.68 between 1 January and 25 February 2026. That is corporate rather than personal, and it is the single most informative capital-allocation datum in this file.

11. Verdict, kill-criteria and flip conditions

Watch.

What is genuinely excellent, and we want to say it before the objection: an 80.2% gross margin with product gross margin of 69.8% on physically manufactured hardware, which is a direct consequence of designing the silicon; a 33.7% GAAP operating margin; $3.573B of net cash against $496.9M of 2.2% debt not due until 2031, with Moody's upgrading to A3; free cash flow of $2.226B in FY2025 at a 32.7% margin and $965.6M in the June quarter at 47.2%; billings up 33%; deferred revenue of $7.68B growing 16.9%; five consecutive beats of increasing size; a 32.8% return on invested capital; and a board that bought 6.1 million of its own shares at $76.68 five months before the stock printed $168.29.

What we are declining to pay for: 45.0x the FY2027 consensus for consensus EPS growth of 9.4%, a PEG of 4.8; a stock at its highest close ever, with zero drawdown, 126% above its 52-week low, where the street's consensus target of $151.31 and median of $164 are both BELOW the price and the grade split is 33 hold against 29 buy; an acceleration that is hardware — product +52%, service +14%, security subscriptions +13% — with the company itself guiding to a flat sequential September quarter; a knowledge-base lane of one three-month-old tactical claim at conviction 45; and no company-specific event for 92 days.

The distinction that matters. We are not questioning the quality of this business, and nothing above should be read that way. Fortinet earns better margins on hardware than most software companies earn on software, funds itself from customer prepayments, carries no financial risk, and is run by people who demonstrably know what their own stock is worth. Our objection is that the market has taken a replacement cycle and paid a compounding multiple for it, and the segment table — 62% of revenue growing 13.7% — says which one this is. When our own base sits 9.7% below the price, lands within a dollar of a street consensus that is itself below the price, and the knowledge base contributes one stale tactical observation, the honest answer is Watch.

Pre-registered KILL criteria — what would take this to Avoid:

• Product revenue growth below 30% in the September quarter (against 52% in June), which would mark the refresh cresting while the multiple still assumes it running.
• Service revenue growth below 13%, which would mean the annuity is decelerating at the same time the cycle rolls over — the compound failure.
• Billings below the $2.250B guide floor, breaking the one metric that has consistently led the revenue line higher.
• Non-GAAP operating margin below 35% on hardware-mix dilution, contradicting the full-year guide.
• Any disruption at Distributor A, which is 28% of revenue and 32% of net accounts receivable.
• A break below the 50-day average of $151.11 on volume without a fundamental cause, which would confirm the move as a crowd event rather than a re-rating.

Pre-registered FLIP conditions — what would take this to Buy — Tactical:

• Price below approximately $125 (roughly 29.5x FY2028E, 33.4x FY2027E) with no deterioration in billings or deferred revenue. At $125 the base case is +21.6% and the risk/reward inverts cleanly. That is 25.7% below today's close and above the 200-day average.
• Service revenue growth accelerating above 17% in the 2026-11-04 print — the single cleanest evidence that the hardware cycle is converting into annuity, which is the whole bull case and the only thing that would justify the current multiple.
• FY2027 guidance in February above roughly $9.5B of revenue, materially above the current $9.002B consensus, which would mean the refresh is not a one-year event.
• The street's consensus target moving decisively above the price, which would resolve the current inversion in the direction of the fundamentals rather than the price.
• Genuine name-level knowledge-base conviction appearing — a claim about Fortinet's architecture, share gains or the refresh cycle, rather than a two-month rotation note. At present there is none.

Where FTNT fits in the Synthos Framework Portfolio. The cybersecurity / infrastructure-software sleeve, at 0% today with a 1.5-2% target on a fill near $125 or on service revenue accelerating above 17%. Batch overlap note: there is no other security name in this batch, so the position competes with NOW and SNOW for the enterprise-software allocation rather than with a direct peer — and on the specific axis of how much of the growth recurs, Fortinet's 62%-recurring, 13.7%-growing service line is a materially different animal from a pure subscription model. Logged as a tracked Synthos call (Watch) as of 2026-08-04 at $168.29.

Single biggest risk: the refresh ends and the multiple does not follow it down gently. At $168.29 the market pays 45.0x calendar-2027 consensus for a company whose 2027 consensus EPS growth is 9.4% and whose recurring revenue is compounding at 13.7%. The gap between the 26% headline and the 14% annuity is the entire re-rating. If the September and December quarters show product growth decelerating from 52% toward the twenties — which is what management's own flat sequential guide implies — the market will be looking at a low-teens compounder priced at 45x, at an all-time high, with a consensus target already 10% below and a low target at half the price. There is nothing in the valuation to absorb that, and the first support on the chart is 10% down and the second is 40% down.

Provenance & disclosures

• Traceability: exactly 1 tagged knowledge-base claim names Fortinet (raw entity hits 1, text-only hits naming Fortinet 0 additional, discarded for collision 28; breadth 1, net conviction positive-negligible). Source: jordi_visser (2026-05-09, bullish, conviction 45, horizon "fact", speaker: jordi_visser, speaker_role: independent, entities DDOG and FTNT) — a two-month sector-rotation observation whose stated window has expired and which says nothing about Fortinet's business. A supplementary sector sweep on cybersecurity, cyber security, firewall and SASE across all 51,928 claims returned 33 text hits, of which 5 are used as labelled sector-level context and 28 are discarded: national-censorship uses of "firewall" (China AI regulation, stablecoin distribution), crypto and custody security (Bitcoin key management, North Korean protocol theft), AI-safety claims carrying no market view, and 2 records in the quarantine_misattributed bucket excluded by policy. Of the 5 usable sector claims, ONE — Nikesh Arora, 2026-06-08, all_in — is the chief executive of Palo Alto Networks, a direct competitor named in Fortinet's 10-K; it is treated as management voice, excluded from the conviction pool and quoted at half weight with that disclosure attached. A further usable claim (jordi_visser, 2026-02-15) cuts against the sector and is included for that reason. A concentration sensitivity test was run because compound_and_friends supplies 2 of the 5 usable claims (40%): removing that channel leaves Dan Ives, the half-weighted competitor chief executive, and the dissenting volatility claim, and the sector reading is unchanged. An AI-model codename appearing inside one quoted claim, and two AI-laboratory names plus one model name appearing in Fortinet's own 2026-07-29 press release, are redacted throughout per house rules; the redaction is disclosed here rather than performed silently. All quotes are verbatim from the stored claim text.
• Data as-of: most recent filing-verified financials 2026-06-30, from the 10-Q filed 2026-07-30 (income statement, balance sheet, cash flow, revenue disaggregation, deferred revenue, remaining performance obligations, billings reconciliation and debt notes), corroborated by the 8-K of 2026-07-29 whose Exhibit 99.1 press release was fully extracted and supplies the guidance table · annual statements FY2025 ended 2025-12-31 from inc_a/bal_a/cf_a, corroborated by the 10-K filed 2026-02-25 · estimates 2026-08-04 · prices 2026-08-04, quote timestamp 1785873601 = 2026-08-04T20:00:01Z ($168.29, +3.11%; 50-DMA $151.11; 200-DMA $101.37; RSI 55.2; MACD +2.99) · knowledge-base claims 2026-08-04. Fiscal note: Fortinet's fiscal year is the calendar year. All figures come from the Synthos vendor data file for FTNT or from the SEC filings in the FTNT archive; no figure comes from memory, recall or external retrieval.
• Filing archive contents: 10-K filed 2026-02-25 (fiscal 2025); 10-Q filed 2026-05-08 (March 2026 quarter); 10-Q filed 2026-07-30 (June 2026 quarter); 8-K filed 2026-05-06 (Q1 2026 results, Exhibit 99.1 press release fully extracted, 32,386 characters); 8-K filed 2026-06-16; 8-K filed 2026-07-29 (Q2 2026 results, Exhibit 99.1 press release fully extracted, 31,906 characters, containing the complete Q3 and FY2026 guidance table). This is an unusually complete archive — both earnings 8-Ks carry the actual press release rather than a cover page, which is not the case for most names in this batch and materially improved the quality of this dive.
• Where the filings contradicted or corrected the vendor (detailed in Section 8): km_ttm.enterpriseValueTTM rebuilt from $121.039B to $119.904B after establishing that the vendor's $2,438M deduction is cash of $2,934.9M less long-term debt of $496.9M and therefore omits $1,134.7M of short-term investments and $399.1M of long-term investments disclosed in the 10-Q, with net cash restated from $2.438B to $3.573B and every EV multiple recomputed; est.ebitdaAvg and est.ebitAvg rejected in full as fixed-ratio fabrications at exactly 52.55% and 50.72% of revenue in every forward year, against actual FY2025 margins of 36.2% and 30.6%; the FY2029 and FY2030 estimate rows rejected in full for showing EPS and net income falling while revenue rises; inc_a depreciationAndAmortization of $152.0M for FY2025 rejected in favour of the cash-flow statement's $336.3M, a 55% understatement caused by depreciation charged into cost of revenue; book-equity metrics (P/B 79.84x, ROE 187.9%) rejected as lenses in favour of ROIC of 32.8%; the vendor peer set discarded as market-cap-matched rather than business-matched, with the 10-K's own twelve-name competitor list used instead; quote.yearHigh/yearLow rejected in favour of tech.hi52/lo52. Where vendor and filing AGREED — worth recording: seg_prod sums to $6,799.6M for FY2025, matching reported revenue to the dollar across all three disaggregated lines; seg_geo sums to $6,799.6M with the Americas home market present; inc_q June-2026 revenue, gross profit and operating income match the 10-Q income statement exactly; dividendPerShareTTM of zero is correct; the earn_cal non-GAAP basis is consistent across all five reported rows. The 8-K scan for corporate actions postdating the statements returned NOTHING — verified clean, and stated as a positive finding rather than an absence.
• Basis note: analyst estimates and earn_cal actuals are non-GAAP; reported diluted EPS is GAAP. Trailing non-GAAP EPS is $3.27 (the sum of four earn_cal actuals) against trailing GAAP diluted of $2.84 — a 15.1% gap driven principally by stock-based compensation of $279.5M in FY2025 (4.9% of revenue). The company's guidance is explicitly non-GAAP and excludes stock-based compensation, acquired-intangible amortisation, a gain on intellectual-property matters and a non-GAAP tax adjustment; the 8-K states plainly that it does not reconcile the guidance to GAAP. Forward multiples in this dive use consensus non-GAAP EPS; the trailing multiple is shown on both bases (51.5x non-GAAP, 59.3x GAAP diluted). A reader should note that 4.9% of revenue in stock compensation is a real cost being excluded from the multiple everyone quotes.
• Estimate coverage: 26 analysts on FY2026 revenue and 21 on FY2026 EPS; 33 and 25 on FY2027 — the best-covered forward year and the one the valuation leans on; 23 and 9 on FY2028; 11 and 3 on FY2029 and FY2030, both of which are rejected outright as internally inconsistent. The FY2028 EPS row, on which the fair-value anchors rest, carries nine analysts, and that thinness is disclosed. The FY2028 EPS dispersion — low $3.614, mean $4.240, high $5.384, a 49% spread from low to high — is itself the most honest available measure of how unresolved the refresh-durability question is.
• Peer note: the vendor peer set (Autodesk, CoreWeave, Infosys, Motorola Solutions, Strategy Inc, Synopsys, Seagate, TE Connectivity) contains no security company at all and is discarded. The 10-K's own competitor list — Check Point, Cisco, CrowdStrike, F5 Networks, Hewlett-Packard Enterprise, Huawei, Microsoft, Netskope, Palo Alto Networks, SonicWALL, Sophos, Zscaler — is used as the competitive frame instead. No peer multiples are supplied in the file, so no peer-multiple comparison is drawn.
• Fair-value caveat: the $101 / $152 / $240 anchors are multiples of the FY2028 consensus non-GAAP EPS distribution — 28x the low of $3.614, 35.8x the mean of $4.240, and 44.6x the high of $5.384 — cross-checked against the better-covered FY2027E of $3.743 (25 analysts). Stated arithmetic, not a discounted cash flow. The base is sensitivity-disclosed: 32x gives $136, 40x gives $170, which is essentially the current price. The bear case assumes de-rating to a level the stock actually traded at five months ago; the bull case assumes today's multiple roughly held and the earnings distribution's high end delivered.
• Timing: second-quarter 2026 results were released 2026-07-29, six days before this dive, so the full first half is reflected in the data and in the guidance. The next print is 2026-11-04, 92 days away — there is no near-term company-specific catalyst, which is an explicit input to the Watch verdict. 2026-08-04 was a strong day for the stock (+3.11%) inside a broadly higher market; no company-specific news for that date appears in this file.
• Accessibility note: no information in this dive is conveyed by colour. All emphasis is carried by bold text, table structure and explicit labelling.
• Not investment advice. Independent research, educational and informational only, never personalised. No recommendation to buy, sell or hold any security is made to any person.
• Version: 2026-08-04-full.