Loading
Hello and welcome to Fortinet 's First Quarter 2025 Earnings Conference Call. At this time, all participants are in a listen only mode. After the speaker's presentation, we will conduct a question-and-answer session. Please be advised that this call is being recorded. I would now like to hand the call over to Aaron Ovadia, Senior Director of Investor Relations. Please go ahead.
Thank you and good afternoon everyone. This is Aaron Ovadia, Senior Director of Investor Relations at Fortinet. I am pleased to welcome everyone to our call to discuss Fortinet's financial results for the first quarter of 2025. Joining me on today's call are Ken Xie, Fortinet's Founder, Chairman and CEO; Keith Jensen, our CFO; Christiane Ohlgart, our CAO and Sales Operations Leader; and John Whittle, our COO. As a reminder, Keith will be stepping down from the CFO role on May 15th, and Christiane will take over as our next CFO.
Ken will begin our call today by providing a high level perspective on our business. Keith will then review our financial result for the first quarter of 2025, and Christiane will provide a forward looking view, including guidance for the second quarter and updating the full year. We will then open the call for questions. During the Q&A session, we ask that you please limit yourself to one question and one follow-up question to allow others to participate.
Before we begin, I'd like to remind everyone that on today's call we will be making forward-looking statements, and these forward-looking statements are subject to risks and uncertainties, which could cause actual results to differ materially from those projected. Please refer to our to our SEC filings, in particular their risk factors in our most recent Form 10K and Form 10Q for more information. All forward-looking statements reflect our opinions only as of the date of this presentation, and we undertake no obligation and specifically disclaim any obligation to update forward-looking statements.
Also, all references to financial metrics that we make on today's call are non-GAAP unless otherwise stated. Our GAAP results and GAAP to non-GAAP reconciliations are located in our earnings press release, and in the presentation that accompany today's remarks, both of which are posted on our investor relations website. As a reminder, this is a live call. It will be available for replay via webcast on our investor relations website.
The prepared remarks will also be posted on the quarterly earnings section of our IR website following today's call. Lastly, all references to growth on a year-over-year basis unless noted otherwise. I will now turn the call over to Ken.
Thank you Aaron, and thank you to everyone for joining our call. We are pleased with our strong performance in the first quarter, successfully balancing growth and profitability, including building a revenue growth of 14%, record first quarter operation margin of 34%. Record free cash flow of 783 million, a margin of 51%, and strong growth in secure operations and unified SASE with security service age building growth of over 110%, which drove our unified SASE building growth to 18%, accounting for 25% of our business. So, Fortinet leadership in innovation and a long-term investment is evident in our market position as the number one deployed firewall vendor worldwide, a market leader in SD-WAN and OT security, and with our strong SASE strategy and growth, we are confident we'll be number one in this space as well.
The strong momentum behind our unified SASE pillar [indiscernible] customer place on our single OS platform. The typical SASE journey begins with the customer initial purchase of Fortinet industry leading ASIC based FortiGate firewall powered by FortiOS. From there, the majority of a large enterprise customer expand into SD-WAN before progressing into a FortiSASE solution. This expansion task continue to grow a 73% of large enterprise customers have now adopt our SD-WAN solution and have either begin or well positioned to transition to FortiSASE; with our FortiSASE penetration among large enterprise increasing nearly 10% quarter-over-quarter to 11%.
We remain the only vendor to have organically developed all of the core SASE capability within a single operation system for the OS including next-gen firewall, SD-WAN, DDNA, Secure Web Gateway, CASB, and DLP technologies. This native integration of networking and security reduce the complexity and operation cost while enhancing user experience and ensuring secure across both on-premise and cloud environments. In addition to our traditional SASE offering, we also offer sovereign SASE, our tailored solution for large enterprise and service providers that require full on-premise or in-country control of their data.
With sovereign SASE, customers can deploy FortiSASE with their own data centers ensuring that all data is processed is crucially through customer owned or country specific locations to meet compliance requirement by country or industry regulations. This approach accelerate performance through our FortiASIC technology and is well suited for highly regulated sectors such as finance, government, and healthcare. AI driven secure operation building increased by 29%, accounting for 10% of our business as customers continue to consolidate multiple security vendors on our integrate and AI enhanced Forti Fabric solution.
Looking ahead, in addition to SASE and secure op, we expect OT security and AI to be key growth drivers over the next 5 years. In OT security, a rapidly expanding market driven by a surge in connected device. Fortinet is recognized as the only leader in the Westland advisory report supported by over a decade of strategic investment and specialized solution position us for continued growth. We also continue to invest in our AI capabilities, which we began developing more than 15 years ago, and now hold over 500 issued and pending AI patents, more than any other competitors.
With our AI technology now integrated into a dozen products, new AI capabilities like FortiAI Assist for automating security task, FortiAI protect for advanced threat detection, and FortiAI secure AI for protecting AI infrastructure. Today, we announced the FortiGate 700G series, a high performance firewall for mid-size business and distributed enterprise, powered by our FortiASIC technology, which deliver a 5 to 10x performance advantage over our competitors and FortiOS, the only operation system recognized across 5 secure networking Gartner Magic Quadrants. This approach significantly lower total cost of ownership and complexity while reducing energy consumption and drive Fortinet's continuous strong growth and market share gain in secure networking.
I would like to thank our employees, customers, partners, and suppliers worldwide for their continued support and hard work. I will not turn a call over to Keith and Christiane.
Thank you, Ken. Thank you, Erin. Welcome Christane, and good afternoon everyone. Let's start with the key financial highlights from the first quarter before handing the call off to Christiane for a more detailed and forward looking view.
We delivered strong performance and top line results that approach the high end of our guidance range together with record first quarter operating margin of 34%. Total revenue grew 14%, driven by strong product and service revenues with product revenue growth of 12%. In addition, new logos increased 14% to over 6300, driven by continued worldwide investments in our channel partners. Looking at our financial results in more detail, total buildings grew 14% to 1.6 billion, driven by 18% growth in unified SASE and 29% growth in AI-driven SecOps.
Unified SASE and SecOps now account for 25% and 10% of total billings respectively, up 1 point each. RPO grew 12% to 6.5 billion, while current RPO grew over 15% to 3.4 billion. Unified SASE and SecOps ARR increased 26% and 30% respectively, reaching a combined ARR of 1.6 billion. Turning to revenue and margins, total revenue grew 14% to 1.54 billion.
Product revenue increased 12% to 459 million, driven by growth in both hardware and software solutions. FortiGate hardware revenue grew in the mid-teens, outpacing total product revenue growth driven by strong performance and low-end and high-end models, and supported by early mover large enterprise customers upgrading their firewall infrastructure. Software license revenue grew in the mid-teens and represented a high-teens percentage of total product revenue, driven by on-prem time-based software license growth of over 30%. Service revenue of 1.08 billion grew 14% to 70% of total revenue.
Security subscriptions revenue increased 16% while support and related service revenues increased 12%. Service billings grew 14%, our highest growth rate in the past 5 quarters. Total gross margin increased 380 basis points to 81.9% and exceeded the high end of the guidance range by 90 basis points. Product gross margin of 67.7% increased 1200 basis points as inventory-related charges normalized from the highly elevated levels we saw in the first half of 2024. This added approximately 1300 basis points to product growth margin, and approximately 400 basis points to total gross margin.
Service gross margin of 87.8% was down just 10 basis points as we successfully absorbed increased costs associated with the expansion of hosted security solutions. Operating margin increased 570 basis points to a first quarter record of 34.2%. It was 320 basis points above the high end of our guidance range, reflecting the strong gross margin, and FX tailwind of around 100 basis points and cost efficiencies in the business. Looking to the same in the cash flow summarized on Slides 18 and 19, free cash flow tends to be seasonally strong in the first quarter.
It was a record $783 million while free cash flow margin was 51%, up 6 points. Adjusted free cash flow was 839 million, representing a margin of 54%. Infrastructure investments were 67 million, down 155 million due to a lower level of real estate investment. Cash taxes were 27 million.
Average contract term was 27 months, roughly flat year-over-year and down 2 months, quarter-over-quarter. And while we did not repurchase shares during the first quarter, we did repurchase approximately 4.6 million shares for a total of $401 million during the month of April. The remaining share buyback authorization as of today is approximately 1.6 billion. I'll now turn the call over to Christiane to share a few significant wins from the first quarter, as well as our more forward looking view, including business conditions in the second quarter and full-year guidance.
Thank you Keith. As Ken mentioned earlier, the noteworthy headline in this uncertain macroeconomic environment is that customer adoption of our solutions is accelerating. This momentum is driven by 2 key factors. One, our decades-long innovation leadership, and two, our competitively differentiated dedication to putting the customer first.
Together this creates a powerful network effect with some of the most discerning organizations rapidly adopting Fortinet solution at scale. This is exemplified by Fortinet being the number one solution at firewall as well as a leader in SD-WAN and OT security. Also, our leading SASE strategy is driving strong growth, reinforcing our confidence in becoming the number one player in the SASE market. Building on this momentum, our SSE solution is gaining strong traction fueled by continued success in up-selling SSE to our large SD-WAN customer base.
With both ARR and billings growth at over 100%, we believe FortiSASE is the fastest growing SSE solution at scale in the market. As shown on Slide 7, the typical FortiSASE journey begins with a customer purchasing our market leading FortiGate firewall, followed by an expansion to SD-WAN and then onto our single vendor SASE solution. Our adoption of SD-WAN and SSE continues to grow with our large enterprise expansion penetration rates increasing to 73% and 11% respectively, with the SSE penetration rate growth increasing nearly 10% quarter-over-quarter. In addition, a second customer buying journey illustrates the growing convergence of security and networking.
It too starts with our FortiGate firewalls and expands to our switches and access points. The key to this expansion is FortiOS, FortiLink technology, which enables seamless management of our switches and access points through our unified operating system. Our increased penetration rates show the success of this strategy. Now, I'd like to review some deals that showcase our SASE adoption and customer expansion.
In an 8-figure displacement deal, an international government purchased our SD-WAN solution as well as our FortiSASE solution to secure the hybrid workforce of 6000 users. This customer chose Fortinet for its ability to deliver flexible and consistent security enforcement, ensuring secure access to both on-premises and cloud applications while maintaining a seamless user experience. By harnessing the power of our FortiOS, we delivered superior performance over the competition, reduced total cost of ownership, and effectively consolidated multiple security functions into a single integrated platform.
In another SASE win, we replaced the incumbent vendor at an international education provider, which chose FortiSASE for their 40,000 users. The decision to transition to FortiSASE was driven by ongoing performance challenges with their previous SASE vendor. Keys to this win included FortiSASE’s ease of use, seamless integration with the Fortinet Security Fabric, and proven scalability across their SD-WAN sites. Based on the success from their proof of concept, this customer will benefit from improved performance, consistent security for users everywhere, and greater operational efficiency.
In a 7-figure deal, a large multinational manufacturing company selected our SD-WAN and multiple SecOp solutions. Fortinet displaced the legacy SD-WAN provider by demonstrating how FortiOS simplifies operations, reduces total cost of ownership, and unifies security and networking functions on a single platform. The integrated nature of FortiOS also enabled seamless alignment with the company's existing Fortinet security infrastructure, establishing a strong foundation for future projects. Lastly, a Fortune-500 company signed an eight figure deal that spans all 3 of our pillars.
Over the past 3 years they've expanded their FortiGate installed base by more than 80%, driven by our world class support for their data centers and branch locations, as well as the automation and seamless integration enabled by our FortiOS operating system. Rounding out the billing's commentary, larger enterprise was our top performing customer segment with growth of around 30%. The number of deals greater than 1 million were up 30%, including 3 eight-figure deals this quarter, up from 1 during the same period last year. EMEA was our best performing geography driven by mid-teens growth from international emerging.
Among our top 5 verticals, financial services and worldwide government led the way with growth of over 20%. Before moving on to guidance, I'd like to spend a few minutes discussing the current U.S tariff situation. The U.S. tariff situation landscape is evolving rapidly, and our comments on this call reflect the information currently available to us. Despite the current geopolitical uncertainties, demand for our cyber-security solutions remains strong.
Our pipeline continues to grow, and we are not seeing signs of near-term erosion. Additionally, our close rates remain robust, and sales cycles are tracking within our normal historical range. For the second quarter, we do not expect U.S. tariffs to have a meaningful impact on our operating margin, as only a few components are subject to tariff charges. Should tariffs increase in the future, we expect any resulting impact on our operating margin to be limited to hardware sales to U.S. customers.
As long as our international hardware sales do not flow through the U.S., they are not subject to U.S. import tariffs. Moving on to guidance, as a reminder, our second quarter and full-year outlook, which are summarized on Slides 21 and 22, are subject to the disclaimers regarding forward-looking information that Aaron provided at the beginning of the call. While our business remained strong and we outperformed on the top line in the first quarter with continued confidence in our ability to execute, we recognize that our customers' investment decisions can be influenced by the broader economic outlook.
As a result, we are maintaining our full-year buildings and revenue guidance ranges to account for potential top line risks associated with the evolving geopolitical environment. Regarding the record firewall upgrade cycle that we've spoken about previously, we continue to expect the firewall upgrade cycle to gain momentum in both purchasing and planning activities in the second half of 2025. Looking at the bottom line, the U.S. dollar weakened more than anticipated from early February when we first issued our 2025 guidance. As a result, we expect an operating margin headwind of approximately 120 basis points to the second quarter and approximately 90 basis points to the full year, which is factored into today's outlook.
Despite the FX headwinds, we are raising the midpoint of our full-year operating margin guidance as a result of our first quarter outperformance and expected efficiencies in the business. Our continued business momentum and strong execution gives us confidence that we are on track to achieve the rule of 45 for the sixth consecutive year. For the second quarter we expect billings in the range of 1.685 billion to 1.765 billion, which at the midpoint represents growth of 12%. Revenue in the range of 1.59 billion to 1.65 billion, which at the midpoint represents growth of 13%.
Non-GAAP gross margins of 80% to 81%, non-GAAP operating margins of 31.5% to 32.5%. Non-GAAP earnings per share of $0.58 to $0.60, which assumes a share count between 773 million and 777 million. Infrastructure investments of 180 million to 200 million, a non-GAAP tax rate of 18%, and cash taxes of 230 million to 255 million. For the full year, we expect billings in the range of 7.2 billion to 7.4 billion, which at the midpoint represents growth of 12%.
Revenue in the range of 6.65 billion to 6.85 billion, which at the midpoint represents growth of 13%. Service revenue in the range of 4.575 billion to 4.725 billion, which at the midpoint represents growth of 15%. Non-GAAP gross margins of 79% to 81%, non-GAAP operating margins of 31.5% to 33.5%. Non-GAAP earnings per share of $2.43 to $2.49, which assumes a share count of between 769 million and 779 million.
Infrastructure investments of 380 million to 430 million, non-GAAP tax rate of 18%, and cash taxes of between 525 million and 575 million. I will now hand the call back over to Aaron to begin the Q&A session.
Thank you, Christiane. As a reminder, during the Q&A session, we ask that you please limit yourself to one question and one follow-up question to allow others to participate. Operator, please open the line for questions.
[Operator Instructions] Our first question will come from Brian Essex with JP Morgan. Please unmute your line and ask your question.
Hi, good afternoon. Can you hear me okay?
Yes.
Great, great. Yeah, thanks for taking the question and congrats on the results for the quarter. I guess maybe for Keith -- or Christiane, could you unpack the dynamics behind the maintenance and services revenue? Just trying to understand it's a segment that I think we were expecting to kind of accelerate, it declined sequentially.
So, just trying to understand some of the puts and takes behind that and how you expect that to, I guess grow throughout the rest of the year, so kind of like level set expectations.
So, I think there are a couple of aspects that you touched on. One is the quarter-over-quarter slight decline is really affected by the Q4 having 2 more days than Q1, and that affects the daily rate going into revenue. Of course, we would have expected a slightly better acceleration, but there's a little bit more time that we need to grow our acquired entities and their revenue streams, so that's impacting Q1 service revenue predominantly.
Is there a dynamic there between FortiGuard and FortiCare that we need to think about?
I would say current RPO is still strong, so I mean we have confidence in the growth.
Yes, and also the FortiGate growth above the building growth, which will drive future service revenue, so we see the FortiGate building growth actually couple points above [indiscernible] growth average, so we see it's a pretty good sign, plus we start to add more service on top of the FortiOS and that's also what drive the future service revenue.
Great, great. Thank you Christiane and Keith, thank you so much.
Our next question will come from Tal Liani with Bank of America. Please unmute your line and ask your question. Tal Liani, you are free to unmute your line and ask your question.
Here we go, can you hear me?
Yes, please.
Okay, thank you. We spoke about -- in earlier quarters, we spoke about end of service, coming, bringing demand forward, even in the last quarter you said that demand is going to come this next [4 or 5] [ph] quarters is going to come this year instead of next year. So, the question I have is why is -- why are we seeing some lightness in the guidance for the next quarter? Why don't we see the demand coming forward to the next quarter?
Can you just speak about the drivers? I just compare your numbers, your guidance to the consensus, and I'm trying to understand why don't I see already strength, especially ahead of tariff increase that is going to increase the prices -- likely increase the prices for everyone.
I don't think we -- like we mentioned in the tariff, I don't think we plan to changing the price in the current condition. On the other side, there's still some uncertainty. So, we try to be kind of a little bit careful. But we do see, the customer like the solution we have and just some kind of geopoliticals and also some other part, just increase some kind of uncertainty, so we try to be careful; probably, Christiane you know this better.
So I would say, we saw good close rates and a good linearity in Q2 in April. So, it gives us confidence, but we also are tied a little bit by the expectations that we get from our sales teams. So, we see good momentum, but sales is hesitant with all the things that are going on to go up in their expectations for us. And so, I think that's where we'd rather be careful with the guidance and then hopefully are going to meet our numbers.
Got it, thank you.
Our next question comes from Gabriela Borges with Goldman Sachs. Please unmute your line and ask your question.
Hey, good afternoon and thank you. Maybe Christiane, I'll pick up right where you left off on sales being hesitant. Clearly, we're all seeing similar headlines as you are. Maybe just tell us specifically what are some of the conversations that sales is having from customers.
What are the reasons they're hesitant to commit to purchasing Fortinet and how are you thinking about maybe some of that hesitancy getting resolved? Is it maybe when we run into the lead time situation for the end of life or how do you think about that flowing through over the next few quarters?
We had a number of events in Q2, and we get really good feedback, so I think it's going to resolve. We have good channel activity. We have good channel programs, and I think some of you may have seen that in channel checks also that they are positive about Fortinet's programs. So, I think it just needs to, with all the macro news that are coming in every day and don't turn out as bad as they are.
There is hesitancy because until the PO is in, it can get delayed. Yeah, we are positive. I mean, I think you saw it from my comments. We haven't seen delays yet, but we don't know what happens over the next 2 months right, or the rest of the year.
That's fair. Thank you.
Our next question will come from Keith Weiss from Morgan Stanley. Please unmute your line and ask your question.
Thank you for taking the question. Maybe carrying on with that line of thought, if you will. What gives you guys confidence that you're still going to be able to perform to like the stronger second half pickup? I get there's a product cycle going on and people have to start preparing for end of life.
But is there no risk there of potentially people kind of sweating the asset or pushing it out? I guess that's just the question of, like where do you stand confident that the second half will be stronger? And how much of that second half strength is implied in the guide right now?
I mean the second half strength is implied in the guide, because we have harder comparisons to meet, right, as in the second half as well. What gives us confidence? We have a number of products that have been released, the next generation. And our products provide, I think, significant improvement of total cost of ownership and security compared to what customers bought 8, 9, 10 years ago.
And we see the activity going on, especially in the enterprise. I think we mentioned in our prepared remarks that FortiGates grew faster than the rest of product revenue, which I think is a testament to the strength that we are seeing. The same is true for OT. And so I think -- we are confident, probably in this room more so maybe than sales when they talk to customers and need to put a commit on their pipeline.
Yes, -- we kind of measured growth in 3 different pillars. So, if you look at the secure network and that is the traditional area, we are very strong. We are the only one -- ASIC technology solution, single FortiOS. So, we continue gaining market share even we're already number 1 leader there.
And then the unified SASE, we also believe we are like top 3, top 2 player and then also grow faster than any other player, and we'll be the leader. And so each of these -- also the Secure Op, which will grow like 29%, also probably faster than most other players of a similar size. So, that's where each -- we're keeping gaining market share. Just we're not quite sure the overall market growth later this year and next year will be -- continue to hold up for whatever some forecast.
So that's where -- we do believe with the technology we have, the unique advantage we have for each pillar will drive us keeping gaining market share; but, overall market condition kind of has a little bit uncertainty there. I know a lot of people talk about security little bit more sticky and more resistant compared to some other, but they do have some impact. So, we try to be careful, but at the same time we're hoping to over-achieve all this guidance.
Got it, that makes sense. Thank you.
Thank you Keith.
Our next question will come from Shaul Eyal with TD Cowen. Please unmute your line and ask your question.
Thank you, good afternoon everybody and congrats on solid set of results considering the growing macro. The number of 8-digit transactions has been on the rise over the past few quarters. When we unpack those transactions, and I know they could differ from one another, are they representative of the entire Fortinet platform stack? Do they include SD-WAN and SASE?
What's driving those large transactions predominantly from a product perspective?
So, a significant driver for these large transactions is SD-WAN deployments and enterprises. And so typically that's the starting point, but then as we mentioned, the customers are buying into the fabric and are buying additional solutions in addition to SD-WAN.
Our next question will come from Rob Owens with Piper Sandler. Please unmute your line and ask your question.
Great, thank you very much. To follow on with Shaul's question there just around these large deals. Were they considered in the pipeline as you looked at the first quarter? I know back in the fourth quarter, on some of the larger transactions, you did talk about some potential pull-forward relative to the end of life.
So, curious if this was a similar experience with the larger transactions or was it more wall-to-wall SD-WAN deployment or global SD-WAN deployment like you spoke to? Just some more color would be great.
So no, these were transactions that were in the pipeline and closed as expected. So, I think this is where our remarks came in. We do not see deals pushing out yet, but these deals also closed before the end of March mostly.
Alright, thank you.
Our next question comes from Eric Heath with KeyBanc. Please unmute your line and ask your question.
This is [indiscernible] on for Eric Heath. During your prepared remarks, you talked about how tariffs would impact hardware sales to U.S. customers. Are you able to quantify that impact to margin from tariffs? And also, could you talk through some steps you might be taking to evolve your supply chain to mitigate those impacts?
So, we did not mention that we have impact from tariffs in Q1, right? So, we don't expect any impact from tariffs in Q1 or significant impacts in Q2, because only very few of our products are subject to tariffs. And then it's only a small portion that actually gets imported into the U.S. for U.S. customers.
Yes. The other part is really because we design from ASIC chip to the system to all the OS and the service. We'll be able to relocate where we can manufacture, that's also -- because we also tend to have a little bit more inventory than some other company. So, that also gave us some buffer. So far, we don't see the impact of tariff yet.
Thank you.
Our next question will come from Saket Kalia with Barclays. Please unmute your line and ask your question.
Hey guys, thanks for taking my questions here. Christiane, maybe for you just to stay on that topic but just from a different angle. Can you just talk about whether there was any changing behavior from channel partners this quarter ahead of tariffs? I think some industries out there saw just some earlier purchasing ahead of potential price increases. Did Fortinet see any of that this quarter?
We've got questions about whether we will increase our prices, but we did not see specific acceleration of deals.
And Saket, maybe I'll just kind of fill in some of the -- to build on what Christiane just said and understanding, one, really are tariffs impacting our business today. And the first place that you'll see there would be in cash flow, right? You won't see it in the income statement because of how COGS is recognized for GAAP purposes for several quarters. So, you really should just kind of assume there really isn't an impact on tariffs in that regard.
I think the other thing that you're probing at as a group is, did we see pull-forward as we saw in other industries? And the answer to that is no, not really. And again, because in our business model and with our pricing advantage, that's really not under the gun. We're not raising prices immediately if we would add tariffs, because it will not hit our P&L for an extended period of time, if that helps.
Yes, that does help. Super helpful. If I can sneak in a follow-up maybe for Ken just to zoom out a little bit from the tariff discussion. Kind of -- it was great to see the unified SaaS business just continue to scale.
Can you just talk about -- and there were some great deals that were called out in the prepared remarks. Can you just talk about what solutions you're typically replacing at these customers? I mean, is it primarily VPN hardware? Or is it secure web gateways?
Or is it other solutions that FortiSASE is able to replace?
I think we see both replacing some traditional, old like VPN, but also replace some other SASE player competitor, because we talked about for a few quarters, we have like 3 key differentiation in SASE. First off, SASE is integrated into the single OS platform, which none other player has that. So that was very easy for the traditional customer, which we are the number one in the firewall space. Over half the global deployment, they can easily add a SASE service, add SD-WAN service to their current but, their current OS there.
So, that's probably over 90% growth come from this. And then the second also differentiation kind of also our early strategy. We try to work with a lot of carrier service provider. And then since they are more -- little bit slow, so we decided to do ourself like 18 months ago.
Now, we still see the service provider and also a lot of bigger enterprise customer, especially finance service, health care. They still want to do their own private SASE, sovereign SASE. So their interest got higher and higher. So we started working with them.
They started to see the real deployment of sovereign SASE, which we can have built their SASE solution in their own data center. Just a few pass can give them all the solution they need, something like [100,000, 10,000 ] [ph] customer, their user there. And then the third one, really the global infrastructure we build out with a lot of our own kind of secure technology also give us ost advantage and also give us more secure solution than some other SASE player. So that I see both the traditional VPN replacement and also like in Christiane's remark, we also replaced a few SASE player.
That's a lot of -- it's a big enterprise area. So, we see like the traditional one, probably more penetrated into the small SMB area, some mid-enterprise, which they also see the SASE give them some kind of ZTN solution. But in the big enterprise, we're certainly replacing a lot of other SASE player.
Very helpful, thanks guys.
Thank you.
Our next question will come from Patrick Colville with Scotiabank. Please unmute your line and ask your question.
Hi, thank you so much for taking my question. I guess I want to just go back to Keith and Christiane about the service revenue down-dip sequentially. I mean, Christiane, you mentioned this was because of 2 fewer days in fiscal first quarter versus 4Q. And I presume part of that is the leap year.
But we didn't see this dynamic 4 years ago or 8 years ago. So I guess, what was different now? And how good an explanation would be that this is customers refreshing appliances and then adding new subscriptions? They're just refreshing their [indiscernible] subscriptions that causing this dynamic?
Patrick, I'm going to jump in because some of that was historical in nature. So I guess -- so we actually did have the same conversation in 2021, I believe it was, coming off of a leap year as well because -- when you're doing year-over-year accounts, right, that was the unusual thing. It does seem that I forgot about that sometime in the last 3.5 years that bites me in the [indiscernible]. And then from Q4 to Q1, you do just have the natural decline of 2 days, 2 days to 92 days, call it, 2%, which I think is what Christiane was talking about.
And then you were going down a path of customers refreshing on the service revenue. It wasn't clear. You were cutting out a little bit, but maybe a comment I'll offer, and Christiane can correct me, is that the conversation about the guidance-setting process and what we're seeing about pull-forward and such, look, I think in this environment where the guide ends up as a bit of an observer to the guidance and not a participant. I think it was prudent in terms of not passing through the beat, if you will.
I think that when you -- the conversations that Christiane is making reference to with channel partners and end users, if you compare where they are today on the upgrade cycle versus where they were 6 months ago, it's night and day and with our own sales team. I mean this is -- you're getting it in the channel checks, you're getting it in the surveys. It's real. We're picking up in the account plans as well.
We are not seeing any signs to this point. Customers suggesting they're going to change their design architecture, that has not come up or we've lost a deal because we're going to a SASE solution that they did. I think that the team here would move them in that direction of our own product. Similarly, you're not seeing competitive displacements against us.
So, I think those are the considerations that went into the guidance-setting process, but I'll let Christiane come back and make sure I haven't committed her to something, she doesn't want to be committed to.
No. I mean, Keith is right, there are a lot of factors why we guided the way we guided from what we can see and what we get from the sales teams, right? Also, don't forget that each fiscal year, you start rolling out new channel program. And it takes a little bit of time until you see how these are picked up, right?
So, we expect service acceleration through our channel programs and we expect improvement. But from a quarter-over-quarter perspective and from a growth rate, we were not there where we wanted to be. And partially, it's also due to a little bit more churn on some acquired customers.
Okay, very helpful. Thank you so much for that both Keith and Christiane.
Our next question will come from Shrenik Kothari with Baird. Please unmute your line and ask your question.
Thanks. Can you guys hear me all right?
Yes.
Great. So, Keith and Christiane, you mentioned that EMEA was your best-performing geo with mid-teens growth and partner like momentum there, clearly a tailwind. And you also made it clear that tariffs pull-forwards are not really a dynamic. So just curious, what is driving strength out there?
I mean I know Ken mentioned about the telco partnerships and tariff shaping demand for sovereign SASE. Just curious if you can elaborate a little bit there. And in APAC, are you also starting to see traction from other modernization initiatives around OT or AI SOC deals as well? And I had a quick follow-up.
So in EMEA, specifically in internationally emerging, you see a lot of strength in OT, right? So there's a lot of opportunity in OT and also in government. We see -- to your question on modernization, we see that in APAC as well. And we had good wins there in government as well as in other areas.
Got it. And just a quick follow-up on the new logos, was pretty solid, 14% year-on-year. Just curious, like how much of SASE, SecOps growth is now -- are now driven by kind of first-time Fortinet customers versus sort of expansion from your existing installed base? Are these newer models landing early in the deals? Or are they still largely dependent on the [indiscernible] FortiGate deployments?
I would say the majority of our new customers are smaller customers, as you can tell by the number of customers. We had some nice large new logos, but most of the smaller customers do start with the FortiGate.
Got it, thanks a lot.
Our next question will come from Brad Zelnick with Deutsche Bank. Please unmute your line and ask your question.
Great, thanks so much. Can you guys hear me? Awesome. Last quarter, I think it was you talked about investments that you're making in various forms of enablement.
So that's a channel and your direct sales would be optimally positioned to capture the refresh opportunity. How is that progressing? And what have you seen over the past few months in terms of your competitors trying to capitalize on this end-of-service event that's coming up?
We don't really see -- I think our competitors are talking about it, but we don't really see competition in our end-of-support cohort.
And then the incentives --
Yes. I mean there are a number of channel incentives to execute on new product combined with more services, right? So -- especially in the lower end of the market, I think the opportunity is huge to expand on SASE and other products. And we have multiproduct incentives with the channel partners.
Thanks for that. If I could maybe just ask one follow-up. I think this is the first quarter where you now have [indiscernible] consolidated. I assume it's not all that material, but is there anything just to call out that we should consider when we think about the trends going forward in terms of contribution and flow-through to the financials?
This is John Whittle. I would say it's immaterial. I don't think there's anything to really factor in there.
And I think in terms of what we -- in the first quarter guide, we provided what we thought the impact would be from the M&As, and I think we were in line with that, if I recall correctly.
Yes. And right now, we are letting them run on their own strategy while we are creating our internal integration play for service providers.
It's still like 1 to 2 years away to co-develop some new product for the consumer leverage some of ASIC technology, some other like [indiscernible] technology. So it's a long-term growth potential, but it's not short term.
Awesome.
Our next question will come from Adam Borg with Stifel. Please unmute your line and ask your question.
Great. Do you hear me okay?
Yes, please.
Great. Just maybe, Christiane, on the upcoming refresh cycle. Any way to talk through some of the assumptions, both in terms of, hey, the number of firewalls we expect to be refreshed, will it be the same or fewer than what they had previously? Obviously, I'm assuming the performance of the models will be greater given these are old models.
And I know you talked about it a few minutes ago, but maybe talk a little bit more about are you expecting any type of shift towards virtual or SASE from physical as part of this refresh.
So what we are seeing so far, the customers that have EOS devices, the smaller customers are buying more. The larger customers who had large FortiGates, it depends on the strategy and it depends on whether they are consolidating on bigger FortiGates or buying pretty much a similar amount of the same next-generation model. So, I don't think on the enterprise side and in the data center appliance, you see one strategy. It depends on customers.
In the MSE and the smaller customer cohort, what we see is that they are buying more of what -- than what they had previously.
Yes. An interesting conversation Christiane was sharing with me right before this call was that one of the challenges in tracking the refresh is not just that they're out there and saying, "Okay, I have 10 products that are going into service." But as she pointed out, they have those 10 plus they're buying for other used cases at the same time. So the deal sizes are getting bigger, but it's a little bit blurrier in terms of how much of that is the old product versus a new used case as you go forward. But I would say that the deal sizes, she's quite pleased with.
That's great. And maybe just --, go ahead.
Sorry. Also on the product side, we're keeping developed new product like the one we announced today, the FortiGate 700G. So, there's a few more come towards later this year and next year. So that's where we try to time in some of the replacement from the product side and then try to make sure the new product is way better than the old one.
So that's where sometime they also try to see -- most of the customers are probably still 1 year away, so they still have some time to evaluate.
That's great. I really appreciate the color there. And maybe just for Ken, a bigger-picture question. In our field work, data security just continues to come up as a really important priority.
I know late last year, I think it was back in August, you guys acquired Next DLP. Love to talk a little bit more about early feedback on that acquisition and how you're thinking about the broader base security opportunity for Fortinet?
Yes. That's a great acquisition technology for the DLP, not only enhance the SASE we had but also can be sold separately to enhance lot of big enterprise the data security, the data leakage side. So, we see it's a work nonproduct and team. And so it's -- I told with you, now it's -- they're kind of -- more kind of looking at how to secure the data.
That's also the reason we kind of started pushing some of sovereign SASE, some other -- especially in the finance service area, in the government, in health care. So, the data is super important. So, it's a very good solution there.
And we're seeing that being rolled out at scale at large enterprises, and we just have to accelerate that. But it's working well at scale at large enterprises.
Our next question will come from Junaid Siddiqui with Truist. Please unmute your line and ask your question.
Hi, can you hear me?
Yes.
Yes.
All right. Great. Thank you. Yes, I just had a question on the CNAPP market and the traction that you're seeing in Lacework. One of your competitors has effectively ceded that space to a partner of yours. How do you see that market shaping up? And who are you seeing from a competitive perspective? And how are you differentiating from some of those competitors?
So I think we see opportunity with the Wiz Google development. I think that disrupts the market fairly significantly. And so we see significant opportunity there. We think the Lacework solution is a very good solution.
I think we just have to -- it's a new sales motion for us a bit, and so we need to focus on that. So, it will just take a little bit of time; but, we see it as a good opportunity. Big market, obviously, huge TAM and a lot of disruption in that market. And that solution just got a good rating.
It's a very good solution. We just need to kind of refine the sales approach a bit.
Great, thank you.
Our next question will come from Keith Bachman with BMO. Please unmute your line and ask your question.
Thank you very much. I wanted to ask a little bit about sensitivities. And what I mean by that is, Ken, you highlighted the 3 buckets of spend that Fortinet has: secure networking, unified SASE and SecOps. As you think about over the next number of quarters, is there any comment when you hear feedback from the channel on deal elongation?
Is it more, in fact, on the subscription side than the hardware side with maybe users not wanting to sweat their assets for regulatory reasons or compliance reasons or governance or what have you? And is thereby a risk of some crowding out, if you will, on hardware refreshes that perhaps are ongoing that make may cause some weakness in the unified SASE and/or SecOps? I think SD-WAN, probably not. But just talk about the buckets of spending in terms of sensitivities as we go out over the next number of quarters, whether it be de elongations or what have you.
And Keith, certainly all the best to you.
Thank you.
Yes. It's a good question. I think -- Yes. I mean the industry, like over 30 years, see a few half and done in the economy in the big environment.
So you're -- during the downturn, they tend to slow down some of the infrastructure changing the hardware purchase and then try to more like stretch, whatever the things they have. So, there is some uncertainty right now, I feel, but it's -- on the other side, because the strengths we have, whether in network security or secure networking and also the Unified SASE, SecureOp, so we see that's also the opportunity during the downturn to gain market share quickly, because we feel we are better positioned than the competitor. So even -- the overall market may grow a little bit slow, but also that's our opportunity to gain more market share quickly.
Because in each category, we have pretty unique advantage. Like secure networking is really carry the convergence and also leverage of ASIC and the single OS, the same thing I mentioned earlier about Unified SASE. And you see the SecureOp also grow like 29%. It's all pretty strong growth.
That's how we're continuing to keep invest in the growth and also do some long-term investment to keep in driving the next 5 to 10 years long-term growth. Both benefit the space and benefit the customer and also partner. So, that's where we look at this. But also, like last quarter, we also see probably the billing growth, also the first time better than the last 6, 7 quarter, probably 7 quarter, and especially the FortiGate even grow better.
So that I see is a good sign on the strengths we have, maybe some because we call the upgrade of core refresh. But on the other side, we do see -- some smaller player in the space, whether secure networking, some other one, getting weaker and weaker. So, we do see some take their market share. And some other bigger players starting shifting some of the focus.
And so with us, we feel we have a better product and a better position. That's where -- in all 3 pillars, we do believe we began to share on each pillar of the market share. I'll ask probably, Christiane, in case any?
I would just say, like Ken said, Q1, we felt good about the growth in Q1. The economy, the geopolitical environment was already kind of a bit uncertain. And then also in 2008, 2009, through the financial crisis, we were private at the time, but had good growth through that and then one of the first companies go public after that based on good growth through that crisis as well. So I think, Ken has always focused on never let the opportunities from a good challenge pass you by. And so we'll take -- we'll look at this from an opportunistic standpoint.
I would just add one comment as well. And I think what we heard from our customers at our customer events at RSA, they're -- most of them are going hybrid, right? They will have on-prem devices. They will have some cloud devices.
They will have some public cloud. And I think that's our opportunity, because we play in all markets, and they can leverage the OS. And I think that's the feedback that we got. So, from our perspective, we are well positioned.
Okay, thank you.
This concludes our question-and-answer session. I will now hand it back to Aaron Ovadia for closing remarks.
Thank you. I'd like to thank everyone for joining today's call. We will be attending investor conferences hosted by JPMorgan and Bank of America during the second quarter. The fireside chat webcast link will be posted on the Events & Presentations section of our Investor Relations website. If you have any follow-up questions, please feel free to contact me. Have a great rest of your day.