Fortinet sells cybersecurity products and services to businesses, governments, and service providers in over 100 countries. The core product is FortiGate, a network firewall that blocks attacks and controls traffic. Customers who buy a FortiGate appliance almost always add on FortiGuard security subscriptions and FortiCare technical support contracts, which they pay for every year for one to five years. That recurring subscription income is the engine of the business. Hardware gets a customer in the door. The subscriptions keep money flowing in long after the sale. The diagram below traces where the money goes.
How Fortinet Makes Money
flowchart LR
A["End Customers
100+ countries"] -->|"Purchase"| B["Distributors & Resellers"]
B -->|"Order & Deploy"| C["Hardware Products
2.2B revenue"]
C --> D["Fortinet Security Fabric
Converged Platform"]
D --> E["Security Subscriptions
2.6B revenue"]
E --> F["Technical Support
1.9B revenue"]
E --> G["Operating Cash Flow
2.6B/year"]
F --> G
G --> H["R&D Investment
New Products & Features"]
H --> D
A -->|"Deploy & Subscribe"| E
A -->|"Support Contracts"| F
Five years of financial data tell a consistent story. Revenue has grown every single year, from $3.3 billion in 2021 to $6.8 billion in 2025. That is more than a doubling in four years. The business has not had to sacrifice profitability to achieve that growth.
Total Revenue 2021 to 2025
Revenue in billions of dollars. Source: XBRL financials.
Gross margin tells you how much money is left after paying the direct cost of making and delivering a product. A high gross margin means a company keeps most of what it charges. Fortinet's gross margin has not just held steady, it has improved. In 2021 it was 76.6%. By 2025 it had climbed to 80.5%. That jump happened because service revenue, which carries higher margins than hardware, has grown faster than hardware sales. More subscriptions, better margins.
Margin improvement over four years, driven by growing service revenue mix.
Free cash flow is the cash left over after the company pays for its buildings, equipment, and day-to-day costs. It is a hard number to fake. Fortinet generated $1.2 billion in free cash flow in 2021 and $2.2 billion in 2025. The company also carries more cash than debt. Net debt was negative $1.5 billion at the end of 2025, meaning cash and investments exceeded borrowings by that amount. That is a comfortable financial position.
$7.1B
Deferred revenue as of December 31, 2025, future revenue already invoiced and waiting to be recognized
What is deferred revenue?
When a customer pays upfront for a one-year or three-year subscription, Fortinet collects the cash right away but cannot count it all as revenue on day one. Instead, it spreads the recognition over the life of the contract. The amount sitting in 'deferred revenue' is money already collected that will flow into reported revenue in future quarters. A growing deferred revenue balance means future revenue is already locked in.
The $7.1 billion deferred revenue balance at the end of 2025 is essentially a backlog of future income. It grew 12% from the prior year. That figure provides a floor under near-term revenue even if new sales slow down. The company also reported $7.55 billion in total billings for 2025, which exceeded reported revenue, meaning customers are committing to pay more than the company has yet recognized.
2023
crisis
Fortinet's own devices were targeted by attackers
In 2023, a Chinese state-sponsored group carried out a cyberattack on Fortinet's FortiGuard devices. In 2024, a hacker claimed to have stolen 440 gigabytes of Fortinet files. For a company whose entire value proposition is protecting other organizations from exactly these kinds of attacks, being breached is a reputational problem as much as an operational one. These incidents are now part of the public record that customers and partners must weigh.
Beyond the security incidents, there are several specific risks documented in Fortinet's own filings. The first is channel concentration. One distributor alone accounts for 32% of total accounts receivable. Six distributors together represent 67% of receivables. If any of those relationships broke down, the revenue impact could be immediate and significant. The second risk is timing. A large portion of each quarter's sales happens in the final two weeks. Any shipping delay or logistics failure in that window could cause Fortinet to miss recognizing millions of dollars of expected revenue for that quarter.
Why does end-of-quarter shipping matter so much?
Fortinet can only count a hardware sale as revenue once the product ships and control passes to the customer. If a shipment misses the last day of a quarter, that revenue moves to the next quarter. Because so many deals close in the final two weeks, a single logistics problem can shift a meaningful chunk of reported revenue.
A third risk involves tariffs and trade policy. About 87% of Fortinet's hardware is manufactured in Taiwan. New tariffs or trade restrictions could raise the cost of making and importing those products into the United States. Fortinet has said it is implementing price increases to offset higher hardware costs, but the company itself notes those increases may not be sufficient or timely, and could reduce customer demand.
87%
Share of Fortinet hardware manufactured in Taiwan, creating concentrated tariff exposure
There is also a structural quirk in the subscription model that matters. Because FortiGuard and FortiCare revenue is recognized slowly over contract terms of one to five years, a slowdown in new or renewed contracts does not show up as a revenue drop right away. The deferred revenue balance masks a slowdown for several quarters. That makes the business look more stable than it may actually be in any given moment, and makes early warning signs harder to read.
Fortinet flagged a global shortage of memory chips in its 2025 filing, driven by the rapid build-out of artificial intelligence infrastructure worldwide. Memory chips are a component in some of its products. This is an external pressure the company cannot control.
The Bet
Fortinet's financial model works if customers keep treating cybersecurity as a non-negotiable, recurring expense rather than a discretionary purchase they can cut or delay. The subscription structure means revenue looks predictable today because of contracts signed in prior years. But the next layer of growth depends on customers renewing those contracts at similar or higher rates, and on new customers adding subscriptions on top of hardware purchases. If renewal rates slip, or if price increases from tariff-driven cost pressures push customers toward cheaper competitors like Check Point, Cisco, or Palo Alto Networks, the deferred revenue buffer shrinks and future reported revenue falls with it. The whole model runs on the assumption that the attach rate of subscriptions to hardware, and the renewal of those subscriptions, stays strong.
Open question
Fortinet's numbers look healthy today. Revenue is growing, margins improved to 80.5%, free cash flow reached $2.2 billion, and $7.1 billion in deferred revenue sits on the balance sheet as future income. But the company itself warned that operating margins are expected to decline in 2026 as it spends more on sales, data centers, and product development. At the same time, tariff-driven hardware cost increases could compress product margins if price increases do not stick. Can Fortinet keep subscription renewal rates high enough, and absorb rising hardware costs cleanly enough, to grow earnings even as it increases spending in 2026 and beyond?
Compiled · 10-K · FY2025
Channel Partner Concentration
The company depends heavily on a small number of distributors for most of its sales. One distributor alone accounts for 32% of total accounts receivable, and six distributors together represent 67% of receivables. If any major distributor fails to pay, goes out of business, or stops selling the company's products, revenue could drop significantly.
End-of-Quarter Revenue Recognition
A large portion of each quarter's sales happens in the last two weeks, depending on logistics partners to ship products before quarter-end. Any delay in shipping, system failures, or logistics problems could prevent the company from recognizing millions of dollars in expected revenue for that quarter.
FortiGuard and Support Services Revenue
The company recognizes revenue from security subscriptions and support services over one to five years. A decline in new or renewal contracts will not show up as a revenue drop until future quarters, making it hard to quickly increase revenue and hard to respond to slowdowns.
International Trade and Tariffs
The company manufactures products internationally and faces risks from tariffs, trade disputes, and export controls. New tariffs or trade restrictions could significantly increase product costs, force price increases that customers won't accept, or prevent sales to certain countries.
Data Center Construction and Real Estate
The company is building or expanding data centers to support growth. Construction projects face risks including delays, supply chain shortages for equipment, unexpected costs, environmental issues, and difficulty meeting customer commitments. If projects fail or cost far more than expected, financial results could suffer.
10-K Item 1A · Risk Factors
