Fortinet Inc (FTNT) 2018 Q1 法說會逐字稿

Good day, ladies and gentlemen, and welcome to the Fortinet First Quarter 2018 Earnings Conference Call.

(Operator Instructions) As a reminder, this conference call is being recorded.

I would now like to turn the conference over to Mr. Peter Salkowski, Vice President of Investor Relations.

Sir, you may begin.

Thank you, Tikia.

Good afternoon, everyone.

This is Peter Salkowski, Vice President, Investor Relations at Fortinet.

I'm pleased to welcome you to our call to discuss Fortinet's financial results for the first quarter of 2018.

Speakers on today's call are Ken Xie, Fortinet's Founder, Chairman and CEO; and Keith Jensen, our CFO.

This is a live call that is available for replay via webcast on our Investor Relations website.

Ken will begin our call today by providing a high-level perspective on our business.

Keith will then follow with our financial and operating results, and conclude by providing our forward guidance outlook before opening up the call for questions.

(Operator Instructions)

Before we begin, I'd like to remind you that on today's call, we will be making forward-looking statements.

These forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially from those projected in these statements.

Please refer to our SEC filings, in particular, the results -- risk factors in our most recent Form 10-K and Form 10-Q for more information.

All forward-looking statements reflect our opinions only as of the date of this presentation and we undertake no obligation, and specifically disclaim any obligation, to update forward-looking statements.

Also, all references to financial metrics that we make on today's call are non-GAAP, unless otherwise stated.

Our GAAP results and GAAP to non-GAAP reconciliations can be found in our earnings press release and in the presentation that accompany today's remarks, both of which are posted on our Investor Relations website.

As for the presentation, the last slide summarizes the impact of the accounting change to ASC 606 with regards to the first quarter results.

Lastly, all references to growth are on a year-over-year basis unless otherwise noted.

I will now turn the call over to Ken.

Thanks, Peter, and thank you for everyone, for joining today's call to discuss our first quarter 2018 result.

Once again, we demonstrate our market leadership by our strong first quarter performance.

In the quarter, billings were up 15% to $463 million and revenue was up 17% to $399 million, both above the high end of our guidance.

We continue to invest to fuel our above-market growth, especially in sales and marketing, while remaining focused on improving profitability.

During the quarter, we hosted our first-ever Financial Analyst Day, together with Accelerate, our global partner and customer conference.

The event provided us with a forum to review the strong performance of our financial model as well as highlight our significant opportunities for growth with our Security Fabric architecture.

The feedback we received from both analysts and investors were extremely positive.

An important message we conveyed during the Financial Analyst Day was the evolution of network security in this period of digital transformation.

Fortinet pioneered and leads the current generation of UTM and next-gen firewall network security and is pioneering and leading the new generation of network security, which we refer to as the Third Generation.

The Third Generation on network security, which is the Security Fabric, is in the early stage and delivers integrated protection and detection across an entire digital attack surface.

We expect that this evolution will drive growth within our installed base and also with new customers.

In the first quarter, our core FortiGate network security business account for 3/4 of the billings.

This market-leading network security business is driven by our unmatched security functionality and performance of our highly differentiated FortiASIC technology, security processing unit, SPU.

Developing customized ASIC to enhance application performance is a growing trend among leading technology companies such as Nvidia with its GPU, and Google with its TPU ASIC.

FortiOS 6.0 was released in Q1 and is the most widely deployed network security operating system in the market.

It is the central building block for the latest evolution of Fortinet Security Fabric, as well as applications such as IoT, SD-WAN and hybrid cloud security.

Billings for our non-FortiGate part of our Fabric grow faster than our FortiGate business, and accounted for 1/4 of our billings.

The Fortinet Security Fabric delivers a broad and widely integrated and automated security solution for enterprises worldwide, offering huge opportunity for growth.

Additionally, cloud security continues to be a faster-growing part of our business.

We work with all of the major cloud providers and we'll continue to expand our Fabric offering for multi-cloud environments.

As of Q1, the Security Fabric is fully available within AWS environments.

During the quarter, we announced 11 new Fabric-Ready partners, including Arista, IBM, McAfee, ServiceNow and VMware.

To date, Fortinet has 43 Fabric-Ready partners, which further expands our Security Fabric across the hybrid cloud.

The transition into the Third Generation of network security is expected to drive our growth, as well as market share gains in the next few years.

We continue to balance investment to make sure Fortinet remains a technology and market leader while improving our operation margin as we work towards our goal of achieving our long-term operation margin target of 25% by 2022.

Now before I turn the call over for a review of our first quarter financial results, I would like to congratulate Keith Jensen for being appointed by our Board of Directors to be our Chief Financial Officer.

Congratulations, Keith.

I will now turn the call over to you for a close look on our first quarter performance and our second quarter and full year guidance.

Thank you, Ken.

I look forward to working with you and the entire Fortinet team.

I also appreciate the support of the board and the Fortinet executive team.

Now turning to the quarter.

I'm very pleased with our first quarter results.

Revenues, margins and earnings per share all performed well.

We posted strong year-over-year billings growth and we repurchased over $100 million of stock.

Security remains a growing industry, and we are well-positioned to outpace the market.

Our product portfolio, geographic diversity and our mission to deliver the most innovative and highest-performing network Security Fabric in the industry places us in a strong leadership position.

We remain committed to achieving above-industry growth, improving profitability and as Ken mentioned, achieving our non-GAAP operating margin goal of 25% by 2022.

Now for our first quarter results, starting with revenue.

Revenue grew 17% to $399 million, driven by service revenue growth of 25% to $256 million.

As a reminder, we provide 2 subscription-based services attached to most of our product sales.

Our traditional support offering, FortiCare, generated first quarter revenue of $110 million, up 35%.

And our security subscription offering, FortiGuard, generated revenue of $137 million, up 20%.

Consistent with my commentary at the Analyst Day regarding predictability, existing deferred revenue accounted for 60% of our first quarter revenue.

In the first quarter, deferred revenue itself grew to $1.4 billion, up 27%.

Our mix of short-term and long-term deferred revenue was consistent quarter-over-quarter at 59% current and 41% long-term.

In the first quarter, product revenue was $143 million versus $135 million in the year-earlier period.

Product revenue in the first quarter of 2018 included a $5.7 million benefit from the change to 606 accounting.

We expect a similar to smaller impact to revenue throughout the rest of 2018.

The average contract length decreased sequentially 1 month to 25 months in the first quarter.

FortiGate unit shipments increased 20% year-over-year.

As you can see on Slides 5 and 6, we remain a geographically diversified business.

First quarter revenue for the Americas represented 44% of our business and grew 20%.

EMEA represented 36% of our business and grew 15%.

APAC represented 20% of our business and grew 16%.

Now turning to billings.

First quarter billings of $463 million grew 15%, a solid growth despite a difficult year-earlier comp due to an 8-figure deal in the first quarter of 2017.

We saw continued growth in both enterprise and UTM service bundles during the quarter.

The Security Fabric and cloud continued to outpace our growth.

The Security Fabric, which is the largest component of our non-FortiGate offerings, benefited from customers' recognition of its value, performance and comprehensive security coverage.

Our enterprise successes in the quarter included a mid-7-figure renewal and cross-sell deal with a major U.S. technology company.

The cross-sell component was a competitive displacement using our Advanced Threat Protection element of the Security Fabric, providing stronger integration and effectiveness against an existing point solution.

Further, our licensing model provided the customer with the ongoing choice of appliance or cloud deployments.

Regarding cloud billings, while the billings are relatively small versus the rest of the business, we experienced triple-digit growth in both on-demand cloud consumption and bring-your-own license.

Across our cloud partners, AWS continues to be the leader, with contributions coming from Azure.

Oracle, Google and IBM, each came online with initial billings during the first quarter.

Bring-your-own license growth was fueled by 5- and 6-figure engagements across the major cloud providers, along with a 7-figure cloud engagement with a large enterprise U.S. retailer.

Let's now turn to the breakdown of our billings across our top 5 verticals in mid-enterprise and enterprise markets.

Service providers accounted for 20% of billings, followed by government at 14%, financial services at 11%, retail at 9% and education at 7%.

The billings breakdown by vertical as well as the percentage of billings coming from the top 5 verticals, is consistent with the average of the last 10 quarters.

On a geographic basis, billings in the Americas grew 11%, EMEA billings grew 21% and APAC billings were up 13%.

The number of deals over $50,000 grew 20%, illustrating the continued strength of our network security business among small and medium-sized enterprise.

Meanwhile, the number of deals over $1 million were up 21%, demonstrating growth in our enterprise business.

Looking at our top 25 customer billings, which were all over $1 million, we saw a pattern similar to prior quarters.

These billings showed a predictable balance across business verticals and geographies, with a slight uptick in the Americas.

The top 2 deals were mid-7-figure deals in the EMEA carrier group.

In the first quarter, we saw customer billings weighted towards renewals, in line with our seasonal pattern.

Returning to the income statement.

Our first quarter gross margin was up year-over-year from 74.5% to 76.7% or 2.1 points.

Our product gross margin was consistent with the prior year at about 60%, while gross -- services gross margin expanded 1.6 points to 86%.

Our gross margin remains strong due to the mix shift in our revenue to higher-margin, more predictable subscription services, providing a tailwind to longer-term gross margins.

Excluding a benefit of $11.7 million from the new accounting standards and how it impacted commissions, total first quarter operating expenses were up 17% to $247 million.

The increase in operating expenses was driven by a $7 million headwind from FX and a 16.8% increase in sales and marketing.

Hiring in the fourth quarter of 2017 and the first quarter of 2018 was a significant driver of the increased operating expenses.

Since September 30, 2017, the headcount for sales and marketing has increased 12%.

As we have mentioned previously, we continue investing in sales capacity in order to fuel growth.

However, our goal remains a balanced growth, with near term -- to balance it with near-term and long-term profit goals.

That said, we are now entering a phase of more normalized headcount activity.

Including a benefit of approximately 390 basis points associated with the 606 accounting change, the first quarter operating margin was 17.7%, up 510 basis points year-over-year.

Excluding the 390 basis point benefit, the first quarter operating margin would have been 13.8%.

This is 130 basis points higher than the midpoint of our 12% to 13% guidance range under the old accounting rules.

The upside in operating margin is due to strong gross margin performance, resulting from slightly better-than-expected revenue growth and the mix shift discussed a moment ago.

Please refer to the last slide in the earnings deck.

We've posted -- where we posted on our Investor Relations website this afternoon, a line by line comparison between our non-GAAP results and our non-GAAP results excluding the impact of 606.

For the remainder of 2018, we now expect the operating margin benefit on -- from 606 to be around 250 basis points.

Net income for the first quarter was $57 million or $0.33 per share, based on approximately 172 million diluted shares.

Excluding the full 606 benefit, our first quarter earnings per share would have been $0.26 versus our guidance of $0.21 to $0.22, with the upside attributable to better-than-expected margin performance.

As expected, the annualized non-GAAP tax rate was 24%.

Slides 8 and 9 review our balance sheet and provide more information for your reference on our cash flow.

We ended the quarter with a strong balance sheet, including $1.4 billion in cash and investments.

During the quarter, we repatriated $130 million of overseas cash.

We expect to be able to repatriate an additional $150 million over the remainder of 2018.

We ended the first quarter with inventory of $80 million.

Inventory turns were 2.4x, up from 1.6x in the year-earlier period and above our average of approximately 2.2x.

Cash from operations was $140 million, representing growth of 8%.

Free cash flow in the first quarter was $128 million, up 10%.

Capital expenditures in the first quarter were $12 million.

Second quarter capital expenditures should be between $25 million and $30 million.

Construction of our new headquarters is expected to start in the third quarter.

We estimate 2018 spending on this project to be approximately $20 million to $30 million, occurring mostly in the second half of the year.

Capital expenditures for all of 2018 are expected to be $85 million to $100 million.

In the first quarter, we returned $115.5 million to our shareholders through the repurchase of 2.5 million shares of Fortinet stock.

As of March 31, 2018, approximately $327 million remained in share repurchase authorization for the plan that expires in January 2019.

We believe share repurchase is a good method for returning value to our shareholders and expect to continue this practice.

Now turning to guidance.

First, I'd like to remind everyone of the forward-looking disclaimer Peter presented at the start of the call and how it applies to the guidance specifically that I'm about to provide.

In the second quarter guidance including the benefit of 606, we expect: Billings in the range of $485 million to $495 million; revenue in the range of $420 million to $430 million; non-GAAP gross margin of 75% to 76%; non-GAAP operating margins of 18.5% to 19%.

This guidance includes an operating margin benefit of [250] basis points (corrected by company after the call) from 606.

Non-GAAP earnings per share of $0.34 to $0.36, which again includes a benefit of $0.05 from 606 and assumes a share count of 173 million to 175 million.

For 2018, the full year, including the benefit of 606, we expect: Billings in the range of $2,040,000,000 to $2,065,000,000; revenue in the range of $1,715,000,000 to $1,735,000,000; non-GAAP gross margin of 75% to 76%; non-GAAP operating margin of 20.2% to 20.7%.

This includes an operating margin benefit of 250 basis points from 606.

Non-GAAP tax rate still at 24%; non-GAAP earnings per share of $1.51 to $1.55, which includes a benefit of $0.19 from ASC 606 and assumes a share count of 175 million to 177 million.

Slide 12 in the earnings slide deck I referenced a moment ago, contains a summary of our guidance for the second quarter and for the full year.

And with that, I'll now hand the call back to Peter.

Thank you, Keith.

We are ready to open the call for questions.

(Operator Instructions)

(Operator Instructions) Our first question comes from Shaul Eyal of Oppenheimer.

Congrats on the strong performance and guidance.

Congrats, Keith, on the promotion.

Great work across the board when even excluding the 606 impact.

Great work on deferred revenue, up nicely year-over-year.

My question is on EMEA, another set of strong results.

In your case, is it GDPR specifically or is it the ongoing good execution, demand environment, pricing, all of the above?

How would you characterize that?

Shaul, it's Ken.

Good question, I think it's a combination of both.

We obviously have a strong team in EMEA and also GDPR also helped.

And compared to some other regions, the EMEA team is pretty long-term stable, they keep on doing quite well.

And our next question comes from the line of Fatima Boolani of UBS.

A quick one for Ken.

Ken, 2017 marked a year in which you saw a sort of divergent strength in the carrier vertical, where international was strong, domestic was weak.

I was wondering what sort of trends you're seeing in 2018.

And then a quick follow-up for Keith around large deal.

In your prepared remarks, you mentioned a ton of large deal momentum, both on the new product side as well as renewal side.

Can you help us walk through sort of how you discount large deal and large deal momentum in your guidance?

Okay, I think the carrier service provider space, [you see] stabilized, starting to recover, but not quite as the -- like, not quite there yet.

Especially in international, they're a little bit ahead of America here in the U.S. And also, kind of little bit related to the previous question Shaul asked, because our top 2 deals come from the Europe service provider carrier space, that's also kind of helped in both on the Europe -- the carrier space a lot.

But if you compare to year-over-year, it's pretty much, on a percentage-wise, pretty much flat.

So I say it's still a lot of opportunity.

And also, we launched a new product at the high end, more targeted at the carrier, the big service provider, the big enterprise account, which also takes some time, because it tends to be long sales cycle.

That's also kind of where we say, we need some time to ramp up.

Fatima, good question.

To really get to the quick of it, we look at large deals -- we split large deals between the U.S. and the rest of the world.

There's a larger population oftentimes in the U.S. as compared to the rest of the world.

And so we want to kind of bifurcate that when we look at our forecasting and guidance-setting process.

We look at our historical rates of number of deals, the dollar value associated with those deals and our historical close rates, and then we have conversations with the key salespeople that are involved to get a sense of where we should be with our expected close rates in the current quarter as we set our guidance.

Our next question comes from Sterling Auty of JPMorgan.

Just want to make -- want a little help reconciling, I think, Keith, you mentioned unit volumes were up 20%, yet billings up 15%.

How much of the difference was mix, which you talked about?

How much was duration?

And were there any other factors to bridge the 2 growth rates?

I think the -- we're very pleased with the 20% growth in our unit shipments, right?

That provides a footprint for us to continue to sell services, so first and foremost, that's very, very attractive.

I think when you look at the mix year-over-year, what we did not have was the large, high-end deal in the first quarter of 2018 that we had in the first quarter of 2017.

And so when you look at the mix between high-end, low-end and mid-range, we saw more low-end in the quarter than we did a year ago.

I say that's the one single deal, 8-digit, 1 year ago, pretty much all high-end.

Also, in the last few quarters, we launched 6000, 7000 the new 7000, which also take a little bit long time to sell, because there's a bigger kind of carrier.

And that also contributed to some of the high-end percentage a little bit lower.

But we do see that it's a very competitive product, which we feel with confidence we'll be keeping -- gaining share also at the high end later.

Makes sense.

And then, Keith, one more, just working capital impact on cash flow in the quarter.

I think cash from operations may have been down or flattish year-over-year.

What was happening in working capital?

And what should we expect as we look to the full year on the cash from operations side?

We don't typically model to free cash flow or operating cash flow.

My recollection was it was up slightly, 8%, on operating cash flow year-over-year, so we feel good about that.

I think I've spoken previously that some of the large drivers, in addition to obviously, earnings, monitoring inventory changes, deferred revenue, et cetera, are among the large drivers as you go forward and model it.

Our next question comes from Gabriela Borges of Goldman Sachs.

Keith, on the outlook for the full year, you mentioned the elevated hiring in 4Q and 1Q.

Just curious how you're thinking about the productivity of those folks ramping, and how you're incorporating that and thinking about what that could mean for guidance in the second half?

The follow-up is for Ken on SD-WAN technology.

What we tend to see with communications technology is that they take multiple years to ramp.

So the question is, are you starting to see SD-WAN come up in more conversations?

And how does your solution compare to something like a Zscaler or a Cisco, when you think about the competitive environment?

Gabriela, thank you very much for the question.

I think the -- we would expect, and we're modeling seasonality in the current year that's not inconsistent with what we've seen in earlier years, I think that's one part of your question.

The second part, I think, was productivity and I would say I feel very comfortable with the required productivity level, based upon the current headcount and the net headcount planning, as we go forward for the rest of the year.

For the question related to SD-WAN, the other cloud-related player and also like Cisco, we have SD-WAN fully integrated into the FortiOS, which we have a one box that offer both the security, the SD-WAN, the other, like WiFi access, the other network function, access function like WiFi, all these things.

It's different than the other vendors.

They have to use multiple box.

Because today's SD-WAN offering, they don't have a processing power, don't have computing power, to do any security in there.

So that's a huge advantage for the customer.

And also, it's different compared with some cloud provider, which SD-WAN is really -- the benefits more come from the branch office, a lot of the big deployment for the service provider.

And that's where it's a huge benefit, if they can integrate together with the security function with other network and access function together.

So that we see a lot of advantage and a lot of interest, a lot of trial from the field.

So we do believe we're leading this space and we will benefit a lot from this well-integrated and automated approach.

Our next question comes from Keith Bachman of Bank of Montréal.

Keith, congratulations on the appointment.

I had 2, and I'll just ask them at once.

First, Keith, for you.

You indicated that the 606 benefit, the revs, which is in the -- thank you very much for the helpful chart -- was about $6 million or a little bit over, all-in.

I think you said it was less going forward, but I just want to see if you can clarify, pursuant to the top line guidance that you provided for '18, what the benefit is.

Again, you've been very helpful in providing the operating income and EPS, but just want a little bit of granularity on the top line.

The second, Ken, is for you.

When we gathered in Vegas a few months ago, you were talking about operating -- the margins post this year and you were going to take some investor feedback on the dilemma or challenge or opportunity of pursuing more market share versus the margins.

And I just wanted to see if you had any additional comments pursuant to any feedback you might have gotten.

My take from the call, you sounded positive on certainly reaching the milestone that you've established for 2022 of 25%, but I just wanted to see if you want to offer any follow-up color.

Keith, thank you for your comments.

So don't want to give too much of accounting granularity, but 2 things that impact us really on the revenue line for 606.

One is time-based software licenses revenue, and that's the kind of small item that we continue to see benefit from for the rest of the year.

The second change was how we recognize revenue in the U.S. market.

Previously, we are on a sell-in basis -- pardon me, sell-through basis.

And we are now on a sell-in basis.

And so that change probably lifted revenue about $4 million in the quarter.

And I would not expect that onetime change, even in small numbers, I would not expect to see that onetime type change again in future quarters.

That's why I'm guiding a lower impact on the revenue line going forward.

Okay, that $4 million was part of the $6 million, Keith?

Yes.

Like I said, I kind of repeat the target of 25% margin by 2022 in my script there.

But also, we see the market opportunity, I think it's probably the next 1 to 2 years, you will see some refreshing cycle come up.

And we do believe -- we're kind of in the last couple of quarters, we had additional hiring effort and catch up the hiring shortfall we had in early part of last year.

And so we do add sales capacity, but at the same time, we also want to improve the productivity and also make sure we also make sure the efficiency is also there.

So that's where we try to balance around these 2. So the end goal is the same.

We may try to leave a little bit room on the way to reach there, but as we also depend on the market condition, the product launching and the other things we're doing within the company, but the goal is the same.

We want to reach 25% operating margin in the next 3 years.

But it's also, we still try to balance among both the growth and also the profitability, the margin.

Our next question comes from Melissa Franchi of Morgan Stanley.

Ken, you mentioned 20% unit growth, but I'm just wondering if you could characterize to what extent is that coming from the refresh of your existing base or is there a greenfield opportunity?

And then when the customer refreshes an appliance, is there any way to think about the additional spend that they are spending with Fortinet, either through a bigger appliance or spending additional around the services?

I think the high end is, take a little bit more time to close the deal, because we launched the high-end 6000, 7000, in the last few quarters.

So that's where the percentage come from, high end a little bit lower, but the total unit growth, 20% above the billing growth of 15%.

A lot come from -- the help come from whether -- I think we're starting to have the SD-WAN function in 5.6, which is the FortiOS we launched almost 2 years ago.

And then the FortiOS 6.0, keep on enhancing that, that's also drive a lot of branch office deployment, of other interest from the field.

So that's where helping drive a lot of, like SMB, some low-end unit growing in there.

But we do believe the high end will keep coming back, after maybe a couple of quarters, once the customer like fully evaluate the benefit of the high-end unit, and also, sometimes the carrier service provider and the big account also take a little bit long time to close the deal.

So the units is more driven by the low-end side, it's above average.

Okay.

And then just one quick follow-up for Keith.

I just wanted to hear your views on continued return of cash now that you're repatriating cash throughout 2018, and how investors should think about the use of cash across buybacks versus potential M&A?

Thanks, Melissa.

I think we've talked before that in Q1, we said we thought we'd be aggressive in our buyback approach.

And you should expect to -- I would offer the same commentary, that I expect Q2, as we move through the year, to be consistent with Q1, if that's what you're looking for.

I think our overall strategy...

So just balancing relative to M&A.

Yes, I think we continue to have a history of looking at tuck-ins as we build out the Fabric.

I don't sense a change in that in the last couple of months.

We continue to be very, very proud with our organic approach to building out our fully-integrated product suite.

We continue to believe that there is significant benefit from that methodology and we're very happy with it.

Yes, also, for the unit growth, like we have, based on IDC data, we almost have 30% of total global deployment.

And in some regions, countries like APAC, we almost have more than half of the deployment is really the Fortinet product.

And we do expect to keep gaining share.

I hope in a few years, we can have a global, more than half, more than 50% of global deployments really are FortiGate products.

And that's also been driven by the new ASIC come out later this year and also the new FortiOS 6.0, which also add a lot of function, with SD-WAN helping driving the additional growth.

Our next question comes from Saket Kalia of Barclays.

Maybe just to start with you, Keith.

Can you just talk a little bit about the cloud security part of the business?

I think you said it's the fastest-growing part of the business, but can you talk about how much of that was maybe coming from new customers versus existing?

Don't know -- so we would have probably 3 key elements to the cloud, when we talk about cloud, we would talk about on-demand or pay-as-you-go, as we call it.

We would talk about BYOL, and we would also talk about on-prem or hybrid clouds.

I don't know -- obviously, the on-demand, I don't -- I couldn't speak to it, was it source of new customers or existing customers.

And I really don't have color in terms of new logos versus existing logos, on BYOL or hybrid or on-prem.

Overall, I would say, we're very -- I'm very, very excited about the cloud opportunity, particularly with them all coming online now.

Understand they have somewhat different models sometimes.

You may have some that are more focused on on-demand; others that are maybe focused on leveraging their current customer or client base in more of a BYOL model.

But there's a lot of exciting things happening in the cloud for us.

Yes, Keith, mentioned in the earnings script, cloud is triple-digit growth.

But also besides cloud, we also lead and see strong growth potential in the IoT OT space.

So we demonstrate, [I would say], connected cloud security and a lot of IoT OT security also.

We're starting to see a lot of potential going forward.

Yes, I would probably just come back to the one example we gave in my text earlier.

It was an existing customer, but we also used that opportunity to displace a competitor and we would call it a hybrid cloud type of a situation.

The total universe remains small, but that was very noticeable and very positive for us.

I also mentioned in the AWS, we offered a full Fabric in the cloud environment.

That is not only the network security, but also from like email, from the web, on the log analysis, for all the management.

So there's a lot of Fabric approach in the cloud environment.

I think that we have the most broad solution, and that's really the Fabric approach also doing well in the cloud environment.

Ken, that's actually a great segue for my follow-up for you.

I know that we said the non-FortiGate business is still about 25% of total, but could you just talk about your conversations with customers, and just anecdotally, how willing are they to consolidate perhaps some of their security vendors and adopt other parts of the Fabric outside of FortiGate?

I think so far, we're leading, gaining share based on the most come from FortiGate, but then the advantage we have, with all the other part of Fabric integrated together, that has huge advantage.

Because the #1 issue customers are facing today, is really the management cost is very high, and on the big enterprise, on average, they have to deal with 20 to 30 different security vendors and most of them don't even connect or talk to each other, which makes the Fabric, what we call the infrastructure security defense is very difficult.

If you cannot integrate, you cannot automate a defense, you cannot make all these different part infrastructure working together to defend attacks.

So that's the huge advantage of the Fabric.

Not only just our own product, but also the Fabric-Ready Program.

I mentioned we have 43 Fabric-Ready partner.

That also makes sure each -- all different part of the infrastructure can talk to each other, so FortiGate have the -- Fortinet products have all the API to integrate with other different partners also.

So this approach, we see huge advantage, and the lower management cost make it more secure, more automated to defense.

So that's where the enterprise likes it a lot.

So we do see it as a huge potential going forward, both within our own product, which we tend to build from the beginning to integrate, automate together, and also working with our partner product.

So it grows faster than the FortiGate, and also, it's a huge opportunity to upsell, cross-sell our installation base.

Like I mentioned, we have almost 30% global deployment on the unit base, which also give us a huge base to potentially grow from the current base and then the new opportunity, mostly come from enterprise.

We also see a lot of potential there.

Our next question comes from Gray Powell of Deutsche Bank.

Maybe just at the industry level, how do you feel about the pace of appliance or product revenue growth in 2018 versus 2017?

I feel the market condition probably improving a little bit and like I mentioned, every 4, 5 years, the refresh cycle come up.

The last refresh cycle came from like 2013, '14.

And at that time, mostly come from the, we call it the current generation, UTM next-gen firewall replacing the traditional firewall.

And now we see the new refresh come in.

Or rather, say this is the new generation using the infrastructure Fabric approach, which connect from the network side to the endpoint, to the cloud, to the access, to the application, like email, web together, to defend, replacing just the network security only.

So that's where we feel this is a new trend, and it just started and may take a few years to even for some -- both the customer partner to realize the benefit of this infrastructure protection approach.

But I do believe this is quite an opportunity to refresh, to accelerate some of the growth, both in the appliance and also in the cloud environment, because the Fabric do include the cloud, which is a part of the infrastructure.

So that's in addition to the traditional appliance, which is also needed in a lot of CP environment and also in a lot of branch office, also in the high quota data center.

I was just -- [you asked about that] 20% unit shipment growth year-over-year and I think we've been talking about that for a couple of quarters now in our calls.

I'm excited about the shipment growth and I don't feel concerned about whether it shows up in product or services, longer term.

We just want to continue to have our footprint with our customers and the opportunity to continue to add more services to them.

Got it.

And then, you actually hit on my follow-up, which is, I mean, 2014, it was a really good year for you guys after the Target breach.

Are you starting to see that refresh activity hitting now?

Or should we expect that coming in the next, call it, 6, 12, 18 months?

This special -- customers are starting evaluating.

It's not like last time, they rush to buy because a few bigger case make a lot of customers concerned.

But this time, because every 4, 5 years, the hardware tend to get too slow and then lack of the additional performance or function.

So the customers starting to do some evaluation, but they're not like last time, they're like more rushed to buy upgrade, but this time, they probably may take some time.

But also, the Fabric approach, they all like it.

They're also starting to evaluate whether the network part can work with the other part of infrastructure.

So that's where probably the sales cycle take a little bit longer.

Not like last time, the news drives some of the decision, but this time, they're pretty carefully evaluate and see what's the true benefit.

But definitely, the hardware, just like any other networking gear or server, after a few years, they need to be upgraded.

Our next question comes from Walter Piccard (sic) [Pritchard] of Citi.

Just a question on Q2 margins.

It looks like you are guiding them down year-over-year relative to, if I look at it ex 606.

And I'm just wondering if we think about where the additional spending is going?

And I guess maybe kind of longer term, where you think you have the most leverage between sales and marketing and R&D on driving top line growth by spending?

I don't know that we think we're guiding down sequentially on margins from...

I'm sorry, just year-over-year, it looks like the margins are lower this year than -- the guidance is for lower margins in Q2 than they were last year, if I adjust for 606.

Yes, I think a lot of things were happening in last year's number, right?

I think if you look at Q1 to Q2, OpEx by itself, the total OpEx last year was down $4 million from Q1 to Q2.

I've got the headwind coming in of FX, impacted the quarter as well.

So I think looking at the quarter, where it went up last year, 5.5 points from Q1 to Q2, and trying to match that again this quarter is a little rough, right?

So I think I look more at the sequential margin, is probably more applicable as we try to get to a smoother glide path.

And just longer term, on where you see the most ability to accelerate the top line through investing?

Is it on the product side?

Or is it on the sales and marketing side?

The sales and marketing we started adding capacity in the last couple of quarters, if you look at Q2 last year, the sales headcount capacity actually is down compared to Q1.

So that's, actually, limit our potential growth.

So in the last 2, 3 quarters, we started to accelerate hiring headcount -- hiring rate, which is starting normalize now.

But on the other side, we also start improving the productivity and try to improve it, both on the top line and the bottom line.

(Operator Instructions) Our next question comes from Gregg Moskowitz of Cowen and Company.

Keith, I'll add my congratulations on a well-deserved promotion.

Actually, I have a couple very quick ones.

For you, Keith, wondering if you're still factoring in a slightly longer average duration in 2018, or if that's changed in one direction or another?

And then just for Ken, I realize that it's still somewhat early, but what are you hearing from customers in regards to the threat intelligence service that you've announced?

Gregg, it's Keith.

Thanks for that comment, and I think we've talked before that we experienced -- we've modeled out a small uptick in term throughout the year.

I'd probably pull back just a little bit from that, probably -- feeling we've had good conversations about term internally, like the results we've seen recently in our numbers, all the right people are focused on it.

I wouldn't say it's a big shift, but I'm certainly not extending the term, let's put it that way, in the models.

Yes, I think threat intelligence is always a big value-added to our customer, because we have the biggest deployment globally, and help us collect a lot of available information.

And also, we have one of the biggest team and the best team in the industry.

And also, working with some other partner in the CTA, Cyber Threat Alliance, which also cooperate and share some intelligence information.

So we feel this is pretty valuable, good intelligent information service, a lot of our customer service providers can benefit.

But it's still in the very early stage.

We try to see what's the best way to share with some of the partner and the customer.

Our next question comes from Brad Zelnick of Crédit Suisse.

Ken, I think it's fair to say there's a lot of conversation, if not even debate, amongst investors trying to appreciate the impacts of cloud and the opportunities.

And hearing triple-digit growth, both in BYOL and on-demand in cloud, very, very compelling.

And I was particularly intrigued to hear you speak about the 7-figure large retail deal that you took down in the quarter.

And I was hoping perhaps you can just provide a little bit more color as an example.

I'm assuming a transaction that large is an existing customer, and if you can just perhaps talk a little bit about the architecture, the use case in cloud, what it is that they're moving to cloud, and then ultimately, what is their total spend with you today versus might have what been in the past, I think that will be helpful to us.

Brad, this is Keith.

I'm just going to jump in front of Ken a little bit on this.

So the first point is that's a new logo for us, that's not an existing customer.

Yes, so we're very excited about that and we did some economics on the back of the envelope of what it would have been if it had been an appliance sale.

It's actually bigger as a software deal than it is as a hardware deal.

So I'll hand that back over to Ken.

Yes, like I said, it's really, they also consider this as part of the whole infrastructure approach, and that's actually -- but we have a very strong offering in the cloud environment also.

And especially, the very broad, like I mentioned, we have the most broad cloud offering, not just network security, but also cover all different kind of application, from the sandbox, and the e-mail, the web, the management and all the analysis.

So that's because we're the strongest player in the cloud space and also matched well in the Fabric approach.

So we're the only vendor that can offer this infrastructure Fabric approach in the cloud environment.

That's also driven the winning of some of the key customers.

If I could, just a very quick housekeeping question for Keith.

On duration, I heard the answer to Gregg's question about the full year, but can you remind us, even just a year ago in Q1, I don't think I have it in my model, was that 23 months on billing duration a year ago?

I think sequentially, duration is down 1 month; year-over-year it was up 1 month.

Yes, that's probably like making the product revenue a few percent lower, if it's the same length.

Our next question comes from Rob Owens of KeyBanc.

I want to touch on something you said earlier with regard to the change in rev rec from sell-through to sell-in and is that the balance of the delta in product?

And is that persistent throughout this year?

And not to get into the accounting side of it, but I'm curious what drives that change, effectively?

The rule is certainly consistent throughout the year, but I don't anticipate -- we don't typically keep a lot of inventory in the channel.

You can go back and check the Ks and the Qs.

We have a mid-single-digit number of weeks that we like to keep in the channel of inventory, that's certainly not a large number.

So what you saw in the first quarter was really just bringing the U.S. up to where the international distributors have been.

To the extent that the U.S. has continued growth throughout 2018, there will likely be some uplift in that.

But I don't see us making significant changes in how much inventory we keep in the channel at the moment.

And you're talking growth in partners or you're talking growth in kind of sell-through, when you mentioned growth in the U.S.?

I mean, shipments and revenue growth, whether it's with the -- I mean, the -- I'm not quite sure I follow the question.

So if you're now recognizing revenue on sell-in growth in partners is going to afford you more opportunity to sell into a broader base.

So I guess I'm trying to understand the velocity side of the equation more so.

We sell to distributors who then sell on to resellers, and we have a fairly short list of distributors in the U.S. to sell into.

Our next question comes from Andrew Nowinski of Piper Jaffray.

Just wanted to ask a quick question on the competitive landscape.

It looks like your product revenue and subscription revenue growth clearly outpaced what Checkpoint reported this quarter.

So I was wondering if you can give us any color on your competitive win rates versus Checkpoint.

And then same thing versus maybe the other enterprise vendors, Palo Alto and Cisco.

I think our advantage over any other competitor is first, on the network security side, we are the only one building our own ASIC chip.

And that's from day 1, when we started the company, even come from my previous company, is this philosophy actually helping driving the performance, additional functionality.

You can see some other bigger company doing the GPU, TPU also, follow similar path now, and it's a huge benefit.

We're keeping gaining share.

No matter which competitor, we feel very comfortable to compete with any one of them.

And then we also offer a much broader approach and the most know these products are also built internally, whether from endpoint, from the management, from the WiFi access, on the web, e-mail, so all this also helping drive the, we call the infrastructure fabric approach, which from day 1, they built together, working together, integrate together, automate together.

So none of our competitor can compete on this broad and automated, integrated approach.

So that's why we keep on gaining from both on the network side and also we call the Fabric infrastructure side.

Yes, I cannot comment on a particular competitor, but I do see we're certainly grow faster, we keep on gaining share.

And with the additional sales and marketing capacity that we started building the last couple of quarters, we feel very confident to keeping gaining share.

Our next question comes from Jayson Noland of Baird.

I wanted to ask on verticals.

They look pretty consistent against '17, with the exception of EDU, which was pretty light year-on-year.

We heard the same sort of thing from CDW earlier this week.

Keith, is that something we should expect to see continue through this year?

No, I don't think there's anything to call out.

I mean, the large deal we had in Q1 of '17 was in EDU, so maybe that's skewing the numbers a little bit.

But I'm not -- I wouldn't say there's a vertical that has me concerned like that.

And then Ken, as a quick follow-up, any customer conversation perspective coming out of RSA that was different this year versus previous years?

RSA is starting to get a lot of noise now, I have to say, but there's no particular, but we do see that the customers like the Fabric approach, and which helping defend all this infrastructure from -- I mean, multiple-layer defense on the infrastructure side.

And also, they are very excited about the new high end we launched, even still in the early ramp-up stage, but we do see a lot of potential will come from both the high end and also the Fabric approach.

Our next question comes from Michael Turits of Raymond James.

It's Michael Turits.

So Keith, congratulations on the appointment and so a question for you.

Thanks for the guide on CapEx this year of $85 million to $100 million.

Can you give us a sense for what that trajectory might be in the next couple of years as you get through the headquarters build?

And also, maybe you can help us in terms of the trajectory from last year going forward on cash taxes, so we try to get our cash flow right.

Yes, the cash taxes, in reverse order, has not changed from the number that I think we had out before, which is about $44 million.

I don't know that we've talked about quarterly cash taxes, I could offer that if you took that $44 million...

Just full year is fine.

Okay, and then we don't guide on free cash flow.

We don't guide long term on free cash flow, but I could offer that the new building will probably be about 175,000 square feet on our existing land that we already own.

We'd like to move in by the end of 2019.

So that's probably enough data that you could probably model how that might roll through.

Our next question comes from Ken Talanian of Evercore ISI.

I was wondering if you could discuss where your pipeline of both service provider and enterprise deals stand today relative to last quarter?

I don't know that we would go to that level of granularity, but I would say that we feel very good about the uptick in the pipeline.

There's a lot of people focused on it, doing a lot of good things, and we're seeing results there.

Carriers specifically, you've got 2 different models.

You have the EMEA and you have the U.S. We see indications in the U.S. that they may be moving a little bit more away from some of their maintenance mode of projects to some new projects, but I think that's very early on.

There's a bit of a pattern in terms of how carrier comes in over the last several years.

It has a lot of year-end activity; Q2, not so much.

Yes, also with the additional investment we made in the marketing, in the sales capacity, that's also helping driving the pipeline, the [upwardness], I think that's all helping to accelerate the growth.

Our next question comes from Patrick Colville of Arete Research.

Can you just help explain how the BYOL, bring-your-own license, works?

And then also, how the economics work for you guys?

So someone brings their own license, yes, how that flows through?

I think the simple response is they would buy the license from us, and then they would take it to the cloud service provider.

Okay, so no change, it's just one for one?

Right.

And that's measured on throughput?

Measured on throughput?

No.

That depends on how different applications and where they deployed.

Sometimes, like when you put something in the cloud, you also need access to that application.

It may increase the need for secure access of that.

So it's really, I'd say it's difficult to say.

It's case by case, vertical by vertical, for how this may impact, or maybe increase the current business there.

Ladies and gentlemen, this concludes today's question-and-answer session.

I would like to turn the conference back over to Peter Salkowski for closing remarks.

Thank you, Tikia.

Again, thanks, everybody, for joining the call.

We will be at the JPMorgan Conference with Ken and Keith on May 16, look forward to seeing a bunch of investors there.

And thank you very much for the call.

Again, as a reminder, we're not having a second call today.

If you have any questions, please feel free to follow up with me.

Have a good day.

Take care.

Ladies and gentlemen, thank you for your participation in today's conference.

This concludes the program.

You may now disconnect.

Everyone, have a great day.