FTNT 10-K & 10-Q changes, risk factors and insider trading

•adverse economic conditions, including macroeconomic and regional economic challenges resulting, for example, from a recession, tariffstariffs, disruptions of global supply chains or other economic downturn, increased inflation or possible stagflation in certain geographies, changing interest rates, the war in Ukraine, tensions between China and Taiwan, conflicts in the Middle East or other factors;

•sales strategy, productivity, retentionhiring and retention, and execution, and our ability to attract and retain new end-customers or sell additional products and services to our existing end-customers, including customer demand for platform solutions like ours versus point solutions;

•component shortages, including chips and other components, and product inventory shortages, including those caused by factors outside of our control, such as epidemicsinternational andtrade pandemics,disputes or tariffs, labor or supply chain disruptions, inflation and other cost increases, international trade disputes or tariffs, natural disasters, health emergencies, power outages, civil unrest, labor disruption, international conflicts, terrorism, wars, such as the war in UkraineUkraine, tensions between China and Taiwan, conflicts in the Middle East, critical infrastructure attacksattacks, natural disasters, health emergencies, epidemics and pandemics, power outages and civil unrest;

•supplier or regulatory cost increases and any lack of market acceptance of our price increases designed to help offset any supplier or regulatory cost increases;

•the impact to our business, the global economy, disruption of global supply chains and creation of significant volatility and disruption of the financial markets due to factors such as tariffs and policy disputes, increased inflation or possible stagflation in certain geographies, changing interest rates, the war in UkraineUkraine, tensions between China and Taiwan, conflicts in the Middle East and other factors;

•defects or vulnerabilities, including critical vulnerabilities, in our products or services, as well as reputational harm from the failure or misuse of our products or services, and any actual or perceived defects or vulnerabilities, including critical vulnerabilities, in our products or services, failure of our products or services to detect or prevent a security incident or to cause a disruption to operations, failure of our customers to implement preventative actions such as updates to one of our deployed solutions or failure to help secure our customers;

•increased expenses, unforeseen liabilities or write-downs and any negative impact on results of operations from any acquisition or equity investment, as well as accounting risks, integration risks related to product plans and products and risks of negative impact by such acquisitions and equity investments on our financial results;

•investors’ expectations of our operational performance relating to environmental,our socialsustainability and governance (“ESG”) and commitment to carbon neutralitycommitments;

•any decreases in demand by channel partners or end-customers, including any such decreases caused by factors outside of our control such as natural disasters and health emergencies, including earthquakes, droughts, fires, power outages, typhoons, floods, pandemics or epidemics and manmade events such as civil unrest, labor disruption, international trade disputes,disputes or tariffs, labor or supply chain disruptions, inflation and other cost increases, international conflicts, terrorism, wars, such as the war in UkraineUkraine, tensions between China and Taiwan, conflicts in the Middle East, critical infrastructure attacksattacks, natural disasters, health emergencies, epidemics and pandemics, power outages and civil unrest;

•execution risk associated with our efforts to capture the opportunities related to our identified growth drivers, such as risk associated with our ability to capitalize on the convergence of networking and security, vendor consolidation of various cyber security solutions, SD-WAN, infrastructure security, security operations, SASE and other cloud security solutions, endpoint protection, IoT and OT security opportunities and product refresh cycles;

•the deferral of orders from distributors, resellers or end-customers in anticipation of new products or product enhancements announced by us or our competitors, price decreases or changes in our registration policies, or the acceleration of orders in response to our announced or expected price list increasesincreases, including those related to tariffs;

•increases or decreases in our billings, revenue and expenses caused by fluctuations in foreign currency exchange rates or a strengtheningweakening of the U.S. dollar, as a significant portion of our expenses isare incurred and paid in currencies other than the U.S. dollar, and the impact such fluctuations may havenegatively on the actual prices thataffect our partnersfinancial condition and customersresults areof willing to pay for our products and servicesoperations;

•the impact of cloud-based and hosted security solutionssolutions, including increased demand for such services and uncertainty associated with transition to providing such services, on our billings, revenue, operating margins and free cash flow;

•political, economic and social instability, including geo-political instability and uncertainty, such as that caused by the war in Ukraine, tensions between China and Taiwan, conflicts in the Middle East, and any disruption or negative impact on our ability to sell to, ship product to and support customers in certain regions based on trade restrictions, embargoes and export control law restrictions;

•legislative or regulatory changes, such as with respect to privacy, information and cybersecurity, exports, the environment, regional component bans, and requirements for local manufacture.manufacturing.

Our business depends on the overall demand for information technology and on the economic health of our current and prospective customers. In addition, the purchase of our products is often discretionary and may involve a significant commitment of capital and other resources. Weak global and regional economic conditions and spending environments, based on a downturn in the economy, a possible recession and the effects of ongoing or increased inflation or possible stagflation in certain geographies, tariffs or other trade disruptions, changing interest rates, geopolitical instability and uncertainty, a reduction in information technology spending regardless of macroeconomic conditions, the effects of epidemics and pandemics and the impact of the war in UkraineUkraine, tensions between China and Taiwan or conflicts in the Middle East could have a material adverse impacts on our financial condition and results of operations and our business, including resulting in longer sales cycles, lower prices for our products and services, increased component costs, higher default rates among our channel partners, reduced unit sales, lower prices and slower or declining growth. These can negatively impact our business by putting downward pressure on growth if we are unable to achieve the increases in

unit sales, lower prices and slower or declining growth. These can negatively impact our business by putting downward pressure on growth if we are unable to achieve the increases in product prices necessary to appropriately offset the additional costs in a manner sufficient to maintain margins. Any of these impacts may materially and adversely affect our business, financial condition, results of operations and liquidity.

OurGiven business benefits directly and indirectly from free trade agreements, and we also rely on various corporate tax provisions related tothe international commerce,nature as we develop, market and sellof our productsoperations, and services globally. Effortsefforts to withdraw from or materially modify international trade agreements, or to change corporate tax policy related to international commerce, could adversely affect our financial condition and results of operations as could the continuing uncertainty regarding whether such actions will be taken.

Moreover, efforts to implement changes related to export or import regulations (including the imposition of new or increases in border taxes or tariff rates, changes in customs or tariffs classifications or modifications to tariff exemptions on foreign imports), trade barriers, economic sanctions and other related policies could harm our results of operations. For example, in recent years, the United States has imposed additional import tariffs on certain goods from different countries. As a result, other countries imposed retaliatory tariffs on goods exported from the United States and both the United States and foreign countries have threatened to alter or leave current trade agreements. While we do not currently expect these tariffs to have a significant effect on our raw material and product import costs, if the United States expands increased tariffs, changes in customs or tariffs classifications or modifications to tariff exemptions or if retaliatory trade measures are taken by other countries in response to the U.S. tariffs, the cost of our products could increase, our operations could be disrupted or we could be required to raise our prices, which may result in the loss of customers and harm to our reputation and operating performance. U.S. tariffs, and any new or additional retaliatory tariffs that may be imposed by foreign countries, may also adversely affect our customers and, consequently, demand for our products. We are monitoring this evolving situation and there can be no assurance that we will be able to mitigate the impacts of any trade measures on our business, which could adversely impact our business, operating results, financial condition, and our stock price.

Any modification in these areas, any shift in the enforcement or scope of existing regulations or any change in the countries, governments,administrations, persons or technologies targeted by such regulations, could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential end-customers with international operations and could result in increased costs. Any decreased use of our products or limitation on our ability to export or sell our products would likely adversely affect our business, financial condition and results of operations.

We may experience slowing growth or a decrease in billings, revenue, operating margin and free cash flow for a number of reasons, including a slowdown in pipeline growth or for demand for our products or services generally, a shift in demand from products to services, decrease in services revenue growth, increased competition, execution challenges including sales execution challenges and lack of optimal sales productivity, worldwide or regional economic challenges based on inflation or possible stagflation, a regional recession or a recession in the global economy, changing interest rates, theas wara inresult Ukraine,of regional conflicts, a decrease in the growth of our overall market or softness in demand in certain geographies or industry verticals, such as the service provider industry, changes in our strategic opportunities, execution risks, lower sales productivity and our failure for any reason to continue to capitalize on sales and growth opportunities due to other risks identified in the risk factors described in this periodic report. Our expenses as a percentage of total revenue may be higher than expected if our revenue is lower than expected. If our investments in sales and marketing and other functional areas do not result in expected billings and revenue growth, we may experience margin declines. In addition, we may not be able to sustain our historical profitability levels in future periods if we fail to increase billings, revenue or deferred revenue, and do not appropriately manage our cost structure, free cash flow, or encounter unanticipated liabilities. As a result, any failure by us to maintain profitability and margins and continue our billings, revenue and free cash flow growth could cause the price of our common stock to materially decline.

Our real estate investments, including construction, acquisitionacquisition, development or leasing of new data centers, data center expansions or office buildings, could involve significant risks to our business.

In order to sustain our growth in certain of our existing and new markets, we may acquire or expand existing data centers, lease new facilities or acquire suitable land, with or without structures, to build new data centers or office buildings. These projects expose us to risks which could have an adverse effect on our results of operations and financial condition. The current global supply chain and inflation issues have exacerbated many of these construction risks and created additional risks for our business. Some of the risks associated with construction projects include:

•unexpected lack of power access or unexpected increases in power needs or connectivity;

Our future performance depends on the continued services and continuing contributions of our senior management to execute on our business plan and to identify and pursue new opportunities and product innovations. The loss of services of members of senior management, particularly Ken Xie, our Co-Founder, Chief Executive Officer and Chairman, or Michael Xie, our Co-Founder, President and Chief Technology Officer, or of any of our senior sales leaders or functional area leaders, could significantly delay or prevent the achievement of our development and strategic objectives. The loss of the services or the distraction of our senior management for any reason could adversely affect our business, financial condition and results of operations.

A significant portion of our sales isare generated through a limited number of distributors, and substantially all of our revenue is from sales by our channel partners, including distributors and resellers. We depend on our channel partners to generate a significant portion of our sales opportunities and to manage our sales process. To the extent our channel partners are unsuccessful in selling our products, or if we are unable to enter into arrangements with and retain a sufficient number of high-quality channel partners in each of the regions in which we sell products, we are unable to keep them motivated to sell our products, or our channel partners shift focus to other vendors and/or our competitors, our ability to sell our products and operating results may be harmed. The termination of our relationship with any significant channel partner may adversely impact our sales and operating results. If we change our partner strategy, such as if we start engaging in more sales directly with customers, and if we terminate partners or partners terminate or reduce selling on our behalf based on changes in our strategy or for any other reason, this could harm our results.

We provide channel partners with specific programs to assist them with selling our products but there can be no assurance that these programs will be effective. In addition, our channel partners may be unsuccessful in marketing, selling and supporting our products and services and may purchase more inventory than they can sell. Our channel partners generally do not have minimum purchase requirements. Some of our channel partners may have insufficient financial resources to withstand changes and challenges in business conditions. Moreover, many of our channel partners are privately held, including some of our largest partners, and we may not have sufficient information to assess their financial condition. If our channel partners’ financial condition or operations weaken, their ability to sell our products and services could be negatively impacted. Our channel partners may also market, sell and support products and services that are competitive with ours, and may devote more resources to the marketing, sales and support of such products, or may decide to cease selling our products and services altogether in favor of a competitor’s products and services. They may also have incentives to promote our competitors’ products to the detriment of our own, or they may cease selling our products altogether. We cannot ensure that we will retain these channel partners or that we will be able to secure additional or replacement partners or that existing channel partners will continue to perform. The loss of one or more of our significant channel partners or the failure to obtain and ship a number of large orders each quarter through them could harm our operating results.

Any new sales channel partner will require extensive training and may take several months or more to achieve productivity. Our channel partner sales structure could subject us to lawsuits, potential liability and reputational harm if, for example, any of our channel partners misrepresent the functionality of our products or services to end-customers, our service provider customers suffer a cyber event impacting end-users, or our channel partners violate laws or our corporate policies. Additionally, if our channel partners experience issues such as cyberattacks or other operational disruptions, it could negatively impact our ability to receive orders from them and, among other things, may adversely affect our billings and revenue. We depend on our global channel partners to comply with applicable legal and regulatory requirements. To the extent that they fail to do so, that could have a material adverse effect on our business, operating results and financial condition. If we fail to optimize our channel partner model or fail to manage existing sales channels, our business will be seriously harmed.

Our FortiGuard and other security subscriptions and FortiCare technical support services revenue has historically accounted for a significant percentage of our total revenue. Revenue from the sale of new, or from the renewal of existing, FortiGuard and other security subscriptions and FortiCare technical support service contracts may decline and fluctuate as a result of a number of factors, including fluctuations and changes in the mix of our sales from secure networking, unified SASE and security operations between products and services, end-customers’ level of satisfaction with our products and services, the prices of our products and services, the prices of products and services offered by our competitors, reductions in our customers’ spending levels and the timing of revenue recognition with respect to such sales. If our sales of new, or renewals of existing, FortiGuard and other security subscriptions and FortiCare technical support service contracts decline, our revenue and revenue growth may decrease and our business could suffer. In addition, in the event significant customers require payment terms for FortiGuard and other security subscriptions and FortiCare technical support services in arrears or for shorter periods of time than annually, such as monthly or quarterly, this may negatively impact our billings and revenue. Furthermore, we recognize FortiGuard and other security subscriptions and FortiCare technical support services revenue ratably over the term of the service period, which is typically from one to five years. As a result, much of the FortiGuard and other security subscriptions and FortiCare technical support services revenue we report each quarter is the recognition of deferred revenue from FortiGuard and other security subscriptions and FortiCare technical support service contracts entered into during previous quarters or years. Consequently, a decline in new or renewed FortiGuard and other security subscriptions and FortiCare technical support service contracts in any one quarter will not be fully reflected in revenue in that quarter but will negatively affect our revenue in future quarters. Accordingly, the effect of significant downturns in sales of new, or renewals of existing, FortiGuard and other security subscriptions and FortiCare technical support services is not reflected in full in our statements of income until future periods. Our FortiGuard and other security subscriptions and FortiCare technical support services revenue also makes it difficult for us to rapidly increase our revenue through additional service sales in any period, as revenue from new and renewal support services contracts must be recognized over the applicable service term.

The market for network security products is intensely competitive and dynamic, and we expect competition to continue to intensify. We face many competitors across the different cybersecurity markets. Our competitors include companies such as Check Point, Cisco, CrowdStrike, F5 Networks, HPE, Huawei, Juniper, Microsoft, Netskope, Palo Alto Networks, SonicWALL, Sophos, and Zscaler.

Some of our existing and potential competitors enjoycompetitors’ competitive advantages such asinclude:

In addition, certain of our larger competitors may have broader product offerings, and leverage their relationships based on other products or incorporate functionality into existing products in a manner that discourages customers from purchasing our products. These larger competitors often have broader product lines and market focus, and are in a better position to withstand any significant reduction in capital spending by end-customers in these markets. Therefore, these competitors will not be as susceptible to downturns in a particular market. Also, many of our smaller competitors that specialize in providing protection from a single type of security threat are often able to deliver these specialized security products to the market more quickly than we can.

Conditions in our markets could change rapidly and significantly as a result of technological advancements or continuing market consolidation. Our competitors and potential competitors may also be able to develop products or services, and leverage new business models, that are equal or superior to ours, achieve greater market acceptance of their products and services, disrupt our markets, and increase sales by utilizing different distribution channels than we do. For example, certain of our competitors are focusing on delivering security services from the cloud which include cloud-based security providers, such as CrowdStrike and Zscaler. In addition, current or potential competitors may be acquired by third parties with greater available resources, and new competitors may arise pursuant to acquisitions of network security companies or divisions. As a result of such acquisitions, competition in our market may continue to increase and our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of acquisition or other opportunities more readily, or develop and expand their product and service offerings more quickly than we do. In addition, our competitors may bundle products and services competitive with ours with other products and services. Customers may accept these bundled products and services rather than separately purchasing our products and services. As our customers refresh the security products bought in prior years, they may seek to consolidate vendors, which may result in current customers choosing to purchase products from our competitors on an ongoing basis. Due to budget constraints or economic downturns, organizations may be more willing to incrementally add solutions to their existing network security infrastructure from competitors than to replace it with our solutions. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer customer orders, reduced revenue and gross margins and loss of market share.

Our future success depends, in part, on our ability to continue to attract and retain highly skilled personnel. The loss of the services of any of our key personnel, the inability to attract or retain qualified personnel, any failure to have in place and execute an effective succession plan for key executives or delays in hiring required personnel, particularly in engineering, sales and marketing, may seriously harm our business, financial condition and results of operations. From time to time, we experience turnover in our management-level personnel. For example, in FebruaryMay 2025, our former Chief Financial Officer, Keith Jensen, announced his upcoming retirementretired after 11 years at Fortinet. None of our key employees hashave an employment agreement for a specific term, and any of our employees may terminate their employment at any time. Our ability to continue to attract and retain highly skilled personnel will be critical to our future success.

Competition for highly skilled personnel is frequently intense, especially for qualified sales, support and engineering employees in network security and especially in the locations where we have a substantial presence and need for highly skilled personnel, such as the San Francisco Bay Area and the Vancouver, CanadaCanada, area. We may not be successful in attracting, assimilating or retaining qualified personnel to fulfill our current or future needs. In addition, to the extent we hire personnel from competitors, we may be subject to allegations that they have been improperly solicited or divulged proprietary or other confidential information. Changes in immigration laws, including changes to the rules regarding H1-B visas, may also harm our ability to attract personnel from other countries. Our inability to hire properly qualified and effective sales, support and engineering employees could harm our growth and our ability to effectively support growth.

If we are unable to generate sufficient cash flow from operations in the future to service our debt, we may be required, among other things, to seek additional financing in the debt or equity markets, refinance or restructure all or a portion of our indebtedness, sell selected assets or reduce or delay planned capital, operating or investment expenditures. Such measures may not be sufficient to enable us to service our debt.

•disruption in the supply chain or in manufacturing or shipping, or decreases in demand by channel partners or end-customers, including any such disruption or decreases caused by factors outside of our control such as natural disasters and health emergencies, including earthquakes, droughts, fires, power outages, typhoons, floods, pandemics or epidemics and manmade events such as civil unrest, labor disruption, international trade disputes,disputes or tariffs, labor or supply chain disruptions, inflation and other cost increases, international conflicts, terrorism, wars or other foreign conflicts,wars, such as the war in Ukraine orUkraine, tensions between China and Taiwan, andconflicts in the Middle East, critical infrastructure attacksattacks, natural disasters, health emergencies, epidemics and pandemics, power outages and civil unrest;

•fluctuations in foreign currency exchange rates or a strengtheningweakening of the U.S. dollar, as a significant portion of our expenses isare incurred and paid in currencies other than the U.S. dollar, and the impact such fluctuations may havenegatively on the actual prices thataffect our partnersfinancial condition and customersresults areof willing to pay for our products and servicesoperations;

•political instability, changes in trade agreementsagreements, tariffs and conflicts such as the war in Ukraine, tensions between China and TaiwanTaiwan, conflicts in the Middle East and any expansions thereof, could adversely affect our business and financial performance;

•costs of complying with, and the risks, reputational damage and other costs of non-compliance with, U.S. or other foreign laws and regulations for foreign operations, including the U.S. Foreign Corrupt Practices Act, the United Kingdom Bribery Act 2010, the General Data Protection Regulation (the “GDPR”), the Digital Operational Resilience Act (“DORA”), the EU Data Act, import and export control laws, trade laws and regulations, tariffs and retaliatory measures, trade barriers and economic sanctions;

An important part of our growth strategy is to increase sales of our products to large- and medium-sized businesses, service providers and government organizations. While we have increased sales in recent periods to large- and medium-sized businesses, our sales volume varies by quarter and there is a risk as to our level of success selling to these target customers. Such sales involve unique sales skillsets, processes and structures, are often more complex and feature a longer contract term and may be at higher discount levels. We also have experienced uneven traction selling to certain government organizations and service providers and MSSPs, and there can be no assurance that we will be successful selling to these customers. Sales to these organizations involve risks that may not be present, or that are present to a lesser extent, with sales to smaller entities. These risks include:

Although we have a channel sales model, sales in our industry are complex and members of our sales organization often engage in direct interaction with our prospective end-customers, particularly for larger deals involving larger end-customers. Therefore, we continue to be substantially dependent on our sales organization to obtain new end-customers and sell additional products and services to our existing end-customers. There is significant competition for sales personnel with the skills and technical knowledge that we require, including experienced enterprise sales employees and others. Our ability to grow our revenue depends, in large part, on our success in recruiting, training and retaining sufficient numbers of sales personnel to support our growth and on the effectiveness of our sales strategy, sales execution, and sales personnel selling successfully in different contexts, each of which has its own different complexities, approaches and competitive landscapes, such as managing and growing the channel business for sales to small businesses and more actively selling to the end-customer for sales to larger organizations. New hires require substantial training and may take significant time before they achieve full productivity. Our recent hires and planned hires may not become productive as quickly as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals in the markets where we do business or plan to do business. Furthermore, hiring sales personnel in new countries requires additional setup and upfront costs that we may not recover if the sales personnel fail to achieve full productivity. If our sales employees do not become fully productive on the timelines that we have projected, our revenue may not increase at anticipated levels and our ability to achieve long-term projections may be negatively impacted. If we are unable to hire and train sufficient numbers of effective sales personnel, the sales personnel are not successful in obtaining new end-customers or increasing sales to our existing customer base or sales personnel do not effectively sell our extended security products, our business, operating results and prospects may be adversely affected. If we do not hire properly qualified and effective sales employees and organize our sales team effectively to capture the opportunities in the various customer segments we are targeting, our growth and ability to effectively support growth may be harmed.

•macroeconomic, geopolitical factors and other disruption on our manufacturing or sales, including the transition in administrations, tariffs or other trade disruptions, public health issues, wars, natural disasters and economic growth;

•government regulation, tariffsregulation and other policies;

•drivers of long-term growth and operating leverage, such as pricing of our products and services, sales productivity, pipeline and capacity, functionality, value and technology improvements in our product and service offerings;

•our ability to successfully anticipate market changes, including those related to cloud-based and AI solutions and to sell, support and meet service level agreements related to cloud-based solutions;

•trends in revenue, cost of revenue and gross margin, including expectations regarding product revenue, service revenue and inventory related charges;

•trends in our operating expense,expenses, including sales and marketing expense,expenses, research and development expense,expenses, general and administrative expense, and expectations regarding these expenses;

•expected impact of plans and strategy for the acceleration of our data center footprint and our points of presencePoP deployment;

•expectations regarding spending related to real estate assets, acquisitions and development, including data centers and points of presence, office building and warehouse investments, as well as other capital expenditures and to the impact on free cash flow and expenses;

•expansionsexpansions, development, improvements, operating, subleasing and other changes to our real property holdings and developmentactivities;

Fortinet is a leader in cybersecurity, driving the convergence of networking and security. Our mission is to secure people, devices and data everywhere. Our integrated platform, the Fortinet Security Fabric, spans secure networking, unified SASE and AI-driven security operations. As of December 31, 2024,2025, our end-customers were located in over 100 countries and included enterprises across a wide variety of market verticals, including financial services, retail, healthcare and operational technology market verticals, communication and security service providers, and government organizations. As of December 31, 2024, our customers included approximately 80% of the Fortune 100 companies and approximately 72% of the Global 2000 companies. We were also ranked #7 in the Forbes Most Trusted Companies list in 2024. As a global company headquartered in Sunnyvale, California, our research and development is centered in the United States and Canada with a global footprint of support and centers of excellence around the world. As of December 31, 2024,2025, we held 1,0341,064 U.S. patents and 1,378a total of 1,405 global patentspatents, andincluding we321 AI-related patents. We have been recognized in over 140 enterprise analyst reports demonstrating both our vision and execution across security and networking products.

•FortiOS—FortiOSOur unified operating system enables the convergence of securitynetworking and networkingAI-powered security to enforce consistent security policies across all form factors and edges. As the foundationfoundational engine of the Fortinet Security Fabric, FortiOS empowers organizations to unify management and analyticsanalytics, for comprehensiveproviding network visibility and control at scale. ToFortiOS furtherincludes validateadvanced ourencryption strategy,and other security technologies designed to address evolving cybersecurity threats, including emerging quantum-resistant cryptographic capabilities.

•FortiASIC—Our ASIC-based SPUs increase the speed, scale, efficiency and value of our solutions while improving user experience, reducing footprint and power requirements. From branch and campus to data center solutions, SPU-powered Fortinet appliances deliver superior Security Compute Ratings versus industry alternatives.

•FortiCloud—Our organically built global cloud infrastructure,infrastructure provides customers with global reach, flexible connectivity and cost savings. FortiCloud is our private cloud SaaS platform, powered by FortiStack, which is our secure SaaS platform operating as a private cloud service provider and leveraging software and hardware to optimize and secure all layers, provides customers with global reach, flexible connectivity, and cost savings.layers.

•FortiEndpoint—FortiEndpoint converges secure connectivity, endpoint protection and advanced capabilities like endpoint detection and response and XDR,ZTNA, into a single agent. It simplifies management and enhances visibility while reducing costs and complexity. The solution gives IT teams the visibility and control they need, while security teams benefit from automated threat detection and response. This minimizes the need for manual intervention and provides faster remediation of threats across all environments.

These competitive differentiators allow us to provide CIOs, CISOs, CTOs,networking and theirsecurity organizationsprofessionals with ana integratedcyber AI-driven cybersecuritysecurity platform withcomprised of over 50 products across three solution pillars.pillars:

•Secure Networking—Our Secure Networking solutions focus on the convergence of networking and security via FortiOS, our networking and security operating system that is the foundation of our Fortinet Security Fabric platform and supports overa 30broad range of functions that can be delivered via a physical, virtual, cloud or SaaS solution.solutions. When delivered through our network firewall appliances, functionality is accelerated through our proprietary ASIC technology. These proprietary ASICs, allow our systems to scale, run multiple applications at higher performance, lower power consumption and perform more processor-intensive operations, such as inspecting encrypted traffic, including streaming video. Our network firewall offerings consist of a FortiGateFortiGate, which can be deployed at branch, campus, data center, hyperscaleinternal segmentation, private and distributedpublic firewalls,cloud to enable hybrid mesh firewall solutions, as well as encrypted applications (SSL inspection, virtual private network and IPsec connectivity). Our ability to converge networking and security also enables the ethernet to become an extension of our customers’ security infrastructure through FortiSwitch and FortiLink. Our wireless LAN solution leverages secure networking to provide secure wireless access for the enterprise LAN edge. FortiExtender secures 5G/LTE and remote ethernet extenders to connect and secure any branch environment. Our Secure Connectivity solution includes FortiSwitch secure ethernet switches, FortiAP wireless local area network access points and FortiExtender 5G connectivity gateways.gateways and NAC for securing IoT devices.

•Unified Secure Access Service Edge (SASE)—As applications move to the cloud and hybrid workforce is now the norm, enabling secure access for users with zero trust framework becomes important. The Fortinet Unified SASE solution includes a single-vendor SASE solution that includes firewall, SD-WAN, secure web gateway, cloud access services broker, DLPDLP, DEM, RBI and zero trust network accessZTNA to deliver flexible secure access for all users. We are one of the few vendors to deliver consistent convergence and AI-powered security across Secure SD-WAN and SSE to enable a single-vendor SASE framework with a cloud-centric architecture powered by FortiOS. Our global and scalable cloud network includes 150+over points190 of presencePoPs to deliver thea seamless secure access experience. GivenLeveraging this,this global infrastructure, we believe we are well positioned to support customers expanding from SD-WAN to a single-vendor SASE platform. We also allow our customers to deploy our FortiSASE as Sovereign SASE, which provides control over the technology elements needed for a SASE solution. FortiSASE Sovereign delivers full SASE capabilities within infrastructure environments that organizations control, including on-premises, in private data centers or trusted colocation environments. Additionally, we offer a full suite of comprehensive, integrated cloud security solutions that enable customers to secure their applications from code to cloud. Our solutions include application security that includes our web application firewalls, cloud network security with virtualized firewalls and cloud-native firewalls, cloud-native application protection and code security. We deliver a holistic approach to cloud security, offering a single unified platform for cloud security and secure CI/CD application development needs, consolidating protection across multiple disparate tools, including coding, deploying, and running applications across hybrid and multi-clouds, and delivering AI-driven security across integrated solutions

with visibilityprotection and contextcode security. We deliver a holistic approach to cloud security, offering a single unified platform, consolidating protection across multiple disparate tools, including coding, deploying, and running applications across hybrid and multi-cloud.multi-clouds. Additionally, we also offer flexible consumption licensing programs that enable organizations to dynamically optimize their cloud security needs and investments as well as readily meet their cloud minimum spend commitment obligations with Cloud Service Providers. We continue to develop all the core SASE capabilities in a single operating system, FortiOS, including Next-Gen Firewall, SD-WAN, ZTNA, secure web gateway, cloud access security broker and DLP. This native integration of our Next-Gen Firewall, SD-WAN and SASE has become the New-Generation SASE Firewall.

•AI-Driven Security Operations (SecOps)—Our AI-Driven SecOps portfolio provides a comprehensive suite of cybersecurity solutions that identify, protect, detect, respond and recover from threats, all integrated within the Fortinet Security Fabric. At the core is FortiAnalyzer, which serves as the central SOC platform with its unified data lake that provides: built-in SIEM, SOAR, XDR and threat intelligence, enabling centralized visibility, analytics and automation with complete control. FortiSIEM delivers robust security information and event management for more advanced SOC requirements, while FortiSOAR enables automated orchestration and playbook-driven response. This solution set also includes FortiEDR, FortiXDR,FortiEndpoint, FortiNDR, FortiSandbox, FortiDeceptor, FortiDLP and FortiRecon, helping organizations achieve defense in depth, ensuring attackers face multiple layers of detection and mitigation across endpoints, networks, and applications. To bolster their security posture, organizations contending with staff shortages can tap into FortiGuard services, including SOCaaS, MDR, Security Posture Assessment and Incident Response. Finally, FortiAI generative AI assistance streamlines operations, helping security teams stay ahead of an ever-evolving threat landscape.

FortiGuard Labs is our cybersecurity threat intelligence and research organization comprised of experienced threat hunters, researchers, analysts, engineers and data scientists who develop and utilize machine learningML and AI technologies to provide timely protection updates and actionable threat intelligence for the benefit of our customers. Using millions of global network sensors, FortiGuard Labs monitors the worldwide attack surface and employs AI to mine that data for new threats.

FortiCare Technical Support Service is a per-device technical support service, which provides customers access to experts to ensure efficient and effective operations and maintenance of their Fortinet capabilities.solution. Global technical support is offered 24x7 with flexible add-ons, including enhanced SLAs and priority hardware replacement through in-country and local depots. Organizations have the flexibility to procure different levels of service for different devicessolutions based on their availability needs. We offer three per-device support options tailored to the needs of our enterprise customers: FortiCare Elite, FortiCare Premium and FortiCare Essential. The FortiCare Elite service aims to provide a 15-minute response time for key product families.

In addition to FortiCare devicesolution levelbased services, Advanced Support service options are available per account. These services are available for regional account support in three options: Core, Pro and Pro Plus, and can be globalizedavailable or provided on a global basis at the Pro and Pro Plus levels. Advanced Support brings support directly to each account, helping account holders to make their operations more effective and to plan and manage their solution lifecycle.

Additionally, we are committed to addressing the cybersecurity skills shortage through training and certification programs for customers, partners and employees. The Fortinet Training Institute’s ecosystem of public and private partnerships around the world extend to industry, academia, government and nonprofits to ensure we are reaching and increasing access of our cybersecurity certifications and training to all populations. The Fortinet Training Institute has issued overapproximately onetwo million certifications to date.

•ServiceTotal revenue was $4.05$6.80 billion in 2024,2025, an increase of 20%14% compared to $3.38$5.96 billion in 2023.2024.

•OperatingProduct incomerevenue was $1.80$2.22 billion in 2024,2025, an increase of 45%16% compared to $1.24$1.91 billion in 2023.2024.

•OperatingService marginrevenue was 30.3%$4.58 billion in 2024,2025, an increase of 6.9 percentage points13% compared to 23.4%$4.05 billion in 2023.2024.

•CashTotal flowsgross fromprofit operatingwas activities were $2.26$5.47 billion in 2024,2025, an increase of $322.6 million, or 17%,14% compared to 2023.$4.80 billion in 2024.

On a geographic basis, revenueRevenue continues to be diversified globally, which remains a key strength of our business. In 2024,2025, the Americas region, the Europe, Middle East and Africa (“EMEA”) region and the Asia Pacific (“APAC”) region contributed 41%,40%, 40%42% and 19%18% of our total revenue, respectively, and increased 12%,11%, 16%18% and 6%13% compared to 2023,2024, respectively.

Service revenue grew 20%13% in 20242025 compared to 2023,2024, primarily driven by the strength of our security subscription revenue, which grew 22%14% in 20242025 compared to 2023.2024. The increase was primarily due to the recognition of service revenue from our growing deferred revenue balance related to FortiGuard and other security subscriptions delivered to on-premise and cloud-based environments and strength in unified SASE and SecOps. We expect our service revenue to continue to grow in 2025, with growth opportunities that include unified SASE and SecOps offerings as well as the year over year increase in current deferred revenue. While service revenue is expected to grow in 2025, we anticipate that the growth rates will continue to slow down in 2025 due to slowing short term deferred revenue growth over the past several quarters.2026.

Our billings were diversified on a geographic basis. In 2024,2025, seven countries represented approximately 50% of our billings and the remaining approximately 50% in the aggregate were from over 100 countries that each individually contributed less than 3% of our billings.

Operating expenses as a percentage of revenue decreased approximately 3.00.5 percentage points in 20242025 compared to 2023,2024, mainly because our revenue growth outpaced our personnel costs.costs growth. Headcount increased 4%7% to 14,13815,109 employees as of December 31, 2024,2025, up from 13,56814,138 as of December 31, 2023. We expect our operating expenses as a percentage of revenue to increase for full year 2025 compared to full year 2024 as we expand our workforce organically and through acquisitions.2024.

Impact of Macroeconomic and Geopolitical and Supply Chain Developments

•execution risk associated with our efforts to capture the opportunities related to our identified growth drivers, such as risk associated with our ability to capitalize on the convergence of networking and security, vendor consolidation of various cyber securitycybersecurity solutions, SD-WAN, infrastructure security, security operations, SASE and other cloud security solutions, endpoint protection, IoT and OT security opportunities and product refresh cycles;

sales execution challenges and lack of optimal sales productivity, worldwide or regional economic challenges based on inflation or possible stagflation, a regional recession or a recession in the global economy, changing interest rates, as a result of regional conflicts, a decrease in the growth of our overall market or softness in demand in certain geographies or industry verticals, such as the service provider industry, changes in our strategic opportunities, execution risks, decreased hardware unit sales growth likely due to a reduced refresh opportunity, lower sales productivity and our failure for any reason to continue to capitalize on sales and growth opportunities due to other risks identified in the risk factors described in this periodic report. Our expenses as a percentage of total revenue may be higher than expected if our revenue is lower than expected. If our investments in sales and marketing and other functional areas do not result in expected billings and revenue growth, we may experience margin declines. In addition, we may not be able to sustain our historical profitability levels in future periods if we fail to increase billings, revenue or deferred revenue, and do not appropriately manage our cost structure, free cash flow, or encounter unanticipated liabilities. As a result, any failure by us to maintain profitability and margins and continue our billings, revenue and free cash flow growth could cause the price of our common stock to materially decline.

We rely on third-party channel partners for substantially all of our revenue. If our partners fail to perform, our ability to sell our products and services will be limited, and if we fail to optimize our channel partner model going forward, our operating results may be harmed. Additionally, a small number of distributors represents a large percentage of our revenue and accounts receivable, and one distributor accounted for 28%26% of our total net accounts receivable as of MarchJune 31,30, 2026.

Six distributor customers who purchase directly from us accounted for 66%64% of our total net accounts receivable in the aggregate as of MarchJune 31,30, 2026. See Note 13. Segment Information in Part I, Item 1 of this Quarterly Report on Form 10-Q for distributor customers accounted for 10% or more of our revenue or net accounts receivable. Our largest distributors may experience financial difficulties, face liquidity risk or other financial challenges, which may harm our ability to collect on our accounts receivable.

In addition, certain of our larger competitors may have broader product offerings, and leverage their relationships based on other products or incorporate functionality into existing products in a manner that discourages customers from purchasing our products. These larger competitors often have broader product lines and market focus, and are in a better position to withstand any significant reduction in capital spending by end-customers in these markets. Therefore, these competitors will not be as susceptible to downturns in a particular market.market, and AI companies may compete more with us. Also, many of our smaller competitors that specialize in providing protection from a single type of security threat are often able to deliver these specialized security products to the market more quickly than we can.

As of MarchJune 31,30, 2026, we had an aggregate of $496.8$496.9 million of indebtedness outstanding under our Senior Notes. Under the agreements governing our indebtedness, we are permitted to incur additional debt. This debt, and any debt that we may incur in the future, may adversely affect our financial condition and future financial results by, among other things:

•funding authorizations and requirements unique to government agencies, with funding or purchasing reductions or delays adversely affecting public sector demand for our products. Our business operations, contract awards, and revenue streams are subject to governmental actions, which may introduce risks to our financial performance and strategic growth. In addition, these actions could eliminate or reduce the operations of an agency that we work with, terminate employees with whom we have business relations with or cancel or modify a contract with us. Any failure to comply with these actions, shifts in federal procurement strategies, or budgetary reductions imposed by the agency could adversely impact our financial results, competitive positioning, and overall business operations; and

Following a review in accordance with our publicly available Product Security Incident Response Team policy, our Product Security Incident Response Team publicly posts on our FortiGuard Labs website known product vulnerabilities, including critical vulnerabilities, and methods for customers to mitigate the risk of vulnerabilities. For example, we recently discovered, and subsequently released to customers an advisory update and patch for, a critical vulnerability in our FortiManager product. We are subject to various risks due to the FortiManager vulnerability, including reputational harm, adverse impacts to customer relationships, potential litigation, and additional regulatory scrutiny, which could negatively impact our business, operating results and financial condition. There can be no assurance that posts on our FortiGuard Labs website, including with respect to the recently announced FortiManager vulnerability, will be sufficiently timely, accurate or complete or that those customers will see such posts or take steps to mitigate the risk of vulnerabilities, and certain customers may be negatively impacted.

Our products are also susceptible to errors, defects, logic flaws, vulnerabilities and inserted vulnerabilities that may arise in, or be included in our products in, different stages of our supply chain, manufacturing and shipment processes, and a threat actor’s exploitation of these weaknesses may be difficult to anticipate, prevent, and detect.detect, and threat actors may leverage AI tools to exploit product errors, defects, logic flaws, and vulnerabilities. If we are unable to maintain an effective supply chain security risk management and products security program or we inadvertently release a product or an update to a product with a defect in it, then the security and integrity of our products and the updates to those products that our customers receive could be exploited by third parties or insiders, or our solutions or updates thereto could cause an unintended disruption to our customers’ operations. Different customers deploy and use our products in different ways, and certain deployments and usages may subject our products to adverse conditions that may negatively impact the effectiveness and useful lifetime of our products. Further, customers may choose not to apply patches in a timely manner for business or operational reasons, or may neglect to upgrade at all and may run unpatched or unsupported devices against our guidance and industry best practice. Such lack of action to remediate known product vulnerabilities in the customer environment could negatively impact their own security posture, increasing the likelihood of exploitation and negatively impacting our reputation. Our networks and products, including cloud-based technology, could be targeted by attacks specifically designed to disrupt our business and harm our operational results and reputation.

An actual, possible or perceived security incident or infection of the network of one of our end-customers or a disruption to their operations, regardless of whether the incident is attributable to the failure of our products or services to prevent or detect the security incident or be the cause of such disruption, or any actual or perceived security risk in our supply chain, could adversely affect the market’s perception of our security products and services, cause customers and customer prospects not to buy from us and, in some instances, subject us to potential liability that is not contractually limited. We may not be able to correct any security flaws or vulnerabilities promptly, or at all. Our products may also be misused or misconfigured by end-customers or third parties who obtain access to our products. For example, our products could be used to censor private access to certain information on the internet. Such use of our products for censorship could result in negative press coverage and negatively affect our reputation, even if we take reasonable measures to prevent any improper shipment of

Our success depends on the market’s confidence in our ability to provide effective network security protection. Despite our efforts and processes to prevent breaches of our internal networks, systems and websites, whether in our owned data centers, cloud providers or colocations, we are still vulnerable to computer viruses, break-ins, phishing attacks, AI tool attacks, ransomware attacks, attempts to overload our servers with denial-of-service, vulnerabilities in vendor hardware and software that we leverage, advanced persistent threats from sophisticated actors and other cyberattacks and similar disruptions from unauthorized access to our internal networks, systems or websites, whether in our owned data centers, cloud providers or colocations. Our security measures may also be breached due to employee error, malfeasance or otherwise, which breaches may be more difficult to detect than outsider threats, and the existing programs and trainings we have in place to prevent such insider threats may not be effective or sufficient. Third parties may also attempt to fraudulently induce our employees to transfer funds or disclose information in order to gain access to our networks and confidential information. Third parties may also send our customers or others malware or malicious emails that falsely indicate that we are the source, potentially causing lost confidence in us and reputational harm. We cannot guarantee that the measures we have taken to protect our networks, systems and websites, whether in our owned data centers, cloud providers or colocations, will provide adequate security. Moreover, because we provide network security products, we may be a more attractive target for attacks by computer hackers and any security breaches and other security incidents involving us may result in more harm to our reputation and brand than companies that do not sell network security solutions. Hackers and malicious parties may be able to develop and deploy viruses, worms, ransomware and other malicious software programs that attack our products and customers, that impersonate our update servers in an effort to access customer networks and negatively impact customers, or otherwise exploit any security vulnerabilities of our products, or attempt to fraudulently induce our employees, customers or others to disclose passwords or other sensitive information or unwittingly provide access to our internal networks, systems or data. Moreover, the threat landscape continues to evolve as a result of new technologies, including AI, and malicious parties may use AI to help attack our solutions, systems, and our customers.

For example, from time to time, we have discovered that unauthorized parties have targeted us using sophisticated techniques, including by stealing technical data and attempting to steal private encryption keys, in an effort to both impersonate our products and threat intelligence update services and possibly attempt other attack methodologies. Using these techniques, these unauthorized parties have tried, and may in the future try, to gain access to certain of our and our customers’ systems. We have also, for example, discovered that unauthorized parties have targeted vulnerabilities, including critical vulnerabilities, in our product software and infrastructure in an effort to gain entry into our customers’ networks. In addition, in general threat actors use dark web forums to sell organizations’ stolen credentials. If threat actors sell valid credentials used by our customers to access our services, it is possible that unauthorized third parties may use such stolen credentials to try to gain access to our services. These and other hacking efforts against us and our customers may be ongoing and may happen in the future.

Although we take numerous measures and implement multiple layers of security to protect our networks, we cannot guarantee that our security products, processes and services will secure against all threats. Further, we cannot be sure that third parties have not been, or will not in the future be, successful in improperly accessing our systems and our customers’ systems, which could negatively impact us and our customers. An actual breach could significantly harm us and our customers, and an actual or perceived breach, or any other actual or perceived data security incident, threat or vulnerability, that involves our supply chains, networks, systems or websites and/or our customers’ supply chains, networks, systems or websites could adversely affect the market perception of our products and services and investor confidence in our company. Any breach of our networks, systems or websites could impair our ability to operate our business, including our ability to provide FortiGuard and other security subscriptions and FortiCare technical support services to our end-customers, lead to interruptions or system slowdowns, cause loss of critical data or lead to the unauthorized disclosure or use of confidential, proprietary or sensitive information. We could also be subject to liability and litigation and reputational harm and our channel partners and end-customers may be harmed, lose confidence in us and decrease or cease using our products and services. Any breach of our internal networks, systems or websites could have an adverse effect on our business, operating results and stock price.

Managing our inventory is complex, especially in times of supply chain disruption. Our channel partners may increase orders during periods of product shortages, cancel orders or not place orders commensurate with our expectations if their inventory is too high, return products or take advantage of price protection (if any is available to the particular partner) or delay orders in anticipation of new products, and accurately forecasting inventory requirements and demand can be challenging. Our channel partners also may adjust their orders in response to the supply of our products and the products of our competitors that are available to them and in response to seasonal fluctuations in end-customer demand. If we cannot manufacture and ship our products due to, for example, global chip shortages, excessive demand on contract manufacturersmanufacturers’ capacity, natural disasters and health emergencies such as earthquakes, fires, power outages, typhoons, floods, health pandemics and epidemics or manmade events such as civil unrest, strikes or other labor disruptions, tariffs, cyber events, international trade disputes, international conflicts, terrorism, wars or other foreign conflicts, such as the war in Ukraine, tensions between China and Taiwan or conflicts in the Middle East, and critical infrastructure attacks, our business and financial results could be materially and adversely impacted. Conflicts in the Middle East highlightshighlight potential risks associated with geopolitical instability in the region, including disruption to shipping routes, longer lead times for components and products, increased insurance costs for vessels passing through conflict zones, potential increased costs for shipping and products, and potential delays and interruptions in the supply chain. We may face challenges in sourcing materials, fulfilling orders and managing logistics efficiently, which could ultimately affect our operations, financial performance and overall business continuity. For example, as a result of the rapid global build-out of AI infrastructure, there is currently a global shortage of memory chips, which are a component in certain of our products. As a result, we are currently experiencing, and may continue to experience, constraints on the availability of memory chips. If we are unable to obtain sufficient quantities of memory chips on commercially reasonable terms, we have experienced, and may continue to experience, delays in the production and delivery of our products and increased costs to source available memory chips, any of which could harm our business, financial condition and results of operations. To mitigate increased hardware costs resulting from these shortages, we are implementing price increases, which may negatively impact demand for our products and may not be sufficient or timely to offset rising input costs, potentially resulting in margin compression and adversely affecting our business, financial condition and results of operations.

In response to ongoing supply chain constraints and elevated lead times for certain components, including memory chips, we have increased our inventory purchase commitments. As during prior periods of supply chain disruption, including the COVID-19 pandemic, these expanded commitments may require us to accept or pay for components and finished goods regardless of our level of sales in a particular period, and may not align with actual end-customer demand at the time of delivery. If demand for our products softens, customer requirements shift, technology transitions occur more rapidly than anticipated, our product roadmap changes, or our forecasts otherwise prove inaccurate, we could be left with excess or obsolete inventory or non-cancelable purchase obligations in excess of our needs. Any of the foregoing could result in inventory write-write-downs or write-offs, charges for excess inventory, losses on purchase commitments, increased storage and logistics costs, the need to sell products at discounted prices, and compression of our gross margins, any of which could negatively or unpredictably impact our operating results, financial condition, and cash flows. For additional information and a further discussion of impacts and risks related to our purchase commitments with our suppliers, refer to Note 10. Commitments and Contingencies in Part I, Item 1 of this Quarterly Report on Form 10-Q.

If our new products, services or enhancements do not achieve adequate acceptance in the market, our competitive position will be impaired, our revenue will be diminished and the effect on our operating results may be particularly acute because of the significant research, development, marketing, sales and other expenses we incurred in connection with the new product, service or enhancement.

We outsource the manufacturing of our security appliance products to contract manufacturing partners and original design manufacturing partners, including manufacturers with facilities located in TaiwanTaiwan, Vietnam and other countries outside the United States such as Accton, IBASE, Micro-Star, Senao and Wistron. Our reliance on our third-party manufacturers reduces our control over the manufacturing process, exposing us to risks, including reduced control over quality assurance, costs, supply and timing and possible tariffs. Any manufacturing disruption related to our third-party manufacturers or their component suppliers for any reason, including global chip shortages, natural disasters and health emergencies such as earthquakes, fires, power outages, typhoons, floods, health pandemics and epidemics and manmade events such as civil unrest, strikes or other labor disruptions, cyber events, international trade disputes, tariffs, international conflicts, terrorism, wars or other foreign conflicts, such as the war in Ukraine, tensions between China and Taiwan or conflicts in the Middle East, and critical infrastructure attacks, could impair our ability to fulfill orders. If we are unable to manage our relationships with these third-party manufacturers effectively, or if these third-party manufacturers experience delays, increased manufacturing lead-times, disruptions, capacity constraints or quality control problems in their manufacturing operations, or fail to meet our future requirements for timely delivery, our ability to ship products to our customers could be impaired and our business would be seriously harmed. Further, certain components for our products come from Taiwan, and approximately 76%82% of our hardware was manufactured in Taiwan during the three months ended MarchJune 31,30, 2026, a decrease from prior periods as a result of our ongoing supply chain diversification efforts.2026. Any increase in tensions between China and Taiwan, including threats of military actions or escalation of military activities, could adversely affect our manufacturing operations in Taiwan, which, given the large percentage of our hardware that is manufactured in Taiwan, could have significant impacts on our business and operations. Any new restrictions that negatively impact our ability to receive supply of hardware components from Taiwan would negatively impact our business and financial results.

Our proprietary ASIC, which are key to the performance of our appliances, are built by contract manufacturers including Renesas and Toshiba America. These contract manufacturers use foundries operated by TSMC or Renesas on a purchase-order basis, and these foundries do not guarantee their capacity and could delay orders or increase their pricing. Accordingly, the foundries are not obligated to continue to fulfill our supply requirements, and due to the long lead time that a new foundry would require, we could suffer inventory shortages of our ASIC as well as increased costs. In addition to our proprietary ASIC, we also purchase off-the-shelf ASICs or integrated circuits from vendors for which we have experienced, and may continue to experience, long lead times. Our suppliers may also prioritize orders by other companies that order higher volumes or more profitable products. If any of these manufacturers materially delays its supply of ASICs or specific product models to us, or requires us to find an alternate supplier and we are not able to do so on a timely and reasonable basis, or if these foundries materially increase their prices for fabrication of our ASICs, our business would be harmed.

The sales prices for our products and services may decline for a variety of reasons or our product mix may change, resulting in lower growth and margins based on a number of factors, including competitive pricing pressures, discounts or promotional programs we offer, a change in our mix of products and services and anticipation of the introduction of new products and services. We have recently conducted such price decreases. Competition continues to increase in the market segments in which we participate, and we expect competition to further increase in the future, thereby leading to increased pricing pressures. Larger competitors with more diverse product offerings may reduce the price of products and services that compete with ours in order to promote the sale of other products or services or may bundle them with other products or services. Additionally, although we price our products and services worldwide in U.S. dollars, currency fluctuations in certain countries and regions have in the past, and may in the future, negatively impact actual prices that partners and customers are willing to pay in those countries and regions. Additionally, while our U.SU.S. distribution agreements contain price protections, our international distribution agreements do not contain such protections. Furthermore, we anticipate that the sales prices and gross profits for our products or services will decrease over product life cycles. We cannot ensure that we will be successful in developing and introducing new offerings with enhanced functionality on a timely basis, or that our product and service offerings, if introduced, will enable us to maintain our prices, gross profits and operating margin at levels that will allow us to maintain profitability.

The success of our web filtering service depends on the breadth and accuracy of our URL database. Although our URL database currently catalogs millions of unique URLs, it contains only a portion of the URLs for all of the websites that are available on the internet. In addition, the total number of URLs and software applications is growing rapidly, and we expect this rapid growth to continue in the future. Accordingly, we must identify and categorize content for our security risk categories at an extremely rapid rate. Our database and technologies may not be able to keep pace with the growth in the number of websites,

available on the internet. In addition, the total number of URLs and software applications is growing rapidly, and we expect this rapid growth to continue in the future. Accordingly, we must identify and categorize content for our security risk categories at an extremely rapid rate. Our database and technologies may not be able to keep pace with the growth in the number of websites, especially the growing amount of content utilizing foreign languages and the increasing sophistication of malicious code and the delivery mechanisms associated with spyware, phishing and other hazards associated with the internet. Further, the ongoing evolution of the internet and computing environments will require us to continually improve the functionality, features and reliability of our web filtering function. Any failure of our databases to keep pace with the rapid growth and technological change of the internet could impair the market acceptance of our products, which in turn could harm our business, financial condition and results of operations.

The adoption of AI in internal processes presents an opportunity to bolster decision making, productivity and customer satisfaction, but the new technology poses risks. AI can be exploited by hackers and malicious actors to develop advanced cyberattacks, bypass security measures, and exploit system vulnerabilities including potentially identifying weaknesses in our systems before we become aware of or can remediate them. The use of AI involves handling large amounts of data. If the security measures around the usage of AI are insufficient, there’s risk of data breaches, leading to unauthorized access to sensitive information. Failure to comply with data protection regulations (such as GDPR or the California Consumer Privacy Act (the “CCPA”) and DORA) can result in legal consequences. The intellectual property risks associated with AI include uncertainties around the ownership of AI-generated works, potential infringement of existing patents and copyrights, unauthorized use of third-party data, and exposure of proprietary algorithms or trade secrets. Dependence on AI systems or AI vendors means that any downtime or outages can disrupt business operations. Usage of our confidential data to train AI models by us or our vendors could result in legal risk, especially if it involves customer data. Other risks that have been observed in AI models and documentation,documentation include risks related to bias, discrimination, job displacements and violating human rights.

Our proprietary rights may be difficult to enforce and we may be subject to claims by others that we infringe their proprietyproprietary technology.

Selling our solutions to governments, both within the U.SU.S. and internationally, whether directly or through channel partners, also subjects us to certain regulatory and contractual requirements, government permit and clearance requirements and other risks. Failure to comply with these requirements or to obtain and maintain government permits and clearances required to do certain business, by either us or our channel partners, could subject us to investigations, fines, suspension, limitations on business or debarment from doing business with such governments, as well as other penalties, damages and reputational harms, which could have an adverse effect on our business, operating results, financial condition and prospects. Any violations of regulatory and contractual requirements could result in us being suspended or debarred from future government contracting. Any of these outcomes could have an adverse effect on our revenue, operating results, financial condition and prospects.

The market price of our common stock may be subject to wide fluctuations in response to, among other things, the risk factors described in this periodic report, news about us and our financial results, news about our competitors and their results, and other factors such as rumors or fluctuations in the valuation of companies perceived by investors to be comparable to us. For example, during the threesix months ended MarchJune 31,30, 2026, the closing price of our common stock ranged from $75.23 to $87.82$155.42 per share.

In the past, many companies that have experienced volatility in the market price of their stock have been subject to securities class action litigation. We currently are, and may be in the future, the target of this type of litigation in the future.litigation. Securities litigation against us could result in substantial costs and divert our management’s attention from other business concerns, which could seriously harm our business.

In January 2026, our board of directors approved a $1.0 billion increase in the authorized stock repurchase amount under the Repurchase Program, bringing the aggregate amount authorized to be repurchased to $10.25 billion of our outstanding common stock through February 28, 2027. As of MarchJune 31,30, 2026, approximately $911.7$765.8 million remained available for future share repurchases. Share repurchases under the Repurchase Program could affect the price of our common stock, increase stock price volatility and diminish our cash reserves. In addition, an announcement of the reduction, suspension or termination of the Repurchase Program could result in a decrease in the trading price of our common stock. Moreover, our stock price could decline, resulting in repurchases made at non-optimal prices. Our failure to repurchase our stock at optimal prices may be perceived by investors as an inefficient use of our cash and cash equivalents, which could result in litigation that may have an adverse effect on our business, operating results and financial condition. In addition, while our board of directors carefully considers various alternative uses of our cash and cash equivalents in determining whether to authorize stock repurchases, there can be no assurance that the decision by our board of directors to repurchase stock would result in the most effective uses of our cash and cash equivalents, and there may be alternative uses of our cash and cash equivalents that would be more effective, such as investing in growing our business organically or through acquisitions.

Economic uncertainty in various global markets caused by political instability and conflict, such as the war in Ukraine, tensions between China and Taiwan or conflicts in the Middle East has resulted, and may continue to result in weakened demand for our products and services and difficulty in forecasting our financial results and managing inventory levels. Geopolitical developments impacting government spending and international trade, including potential government shutdowns and trade disputes and tariffs may negatively impact markets and cause weaker macroeconomic conditions. The effects of these events may continue due to potential U.S. government shutdowns, the transition in administrations, changingchanges in the U.S. government’s trade policy and the United States’ ongoing trade disputes with Russia, China and other countries, including the United States’ tariffs, and any new or additional retaliatory tariffs from foreign countries. For example, global press reports have indicated that the Chinese government may have instructed domestic companies in certain industries not to use cybersecurity products manufactured by the companies based in the United States or Israel, including us and certain of our competitors. The continuing effect of any or all of these events could adversely impact demand for our products, harm our operations and weaken our financial results.

In addition to historical information, this Quarterly Report on Form 10-Q contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities and Exchange Act of 1934, as amended (the “Exchange Act”). These statements include, among other things, statements concerning our expectations regarding:

•macroeconomic, geopolitical factors and other disruptiondisruptions onto our manufacturing or sales, including tariffs or other trade disruptions, public health issues, wars, natural disasters and economic growth;

Fortinet is a leader in cybersecurity, driving the convergence of networking and security. Our mission is to secure people, devices and data everywhere. Our integrated platform, the Fortinet Security Fabric, spans secure networking, unified Secure Access Service Edge (“SASE”) and AI-driven security operations (“SecOps”). As of MarchJune 31,30, 2026, our end-customers were located in over 100 countries and included enterprises across a wide variety of market verticals, including financial services, retail, healthcare and operational technology (“OT”) market verticals, communication and security service providers, and government organizations. As a global company headquartered in Sunnyvale, California, our research and development is centered in the United States and Canada with a global footprint of support and centers of excellence around the world. As of MarchJune 31,30, 2026, we held 1,0931,115 U.S. patents and a total of 1,4301,448 global patents.

Security Fabric, FortiOS empowers organizations to unify management and analytics, providing network visibility and control at scale. FortiOS includes advanced encryptionencryption, quantum safe tools, and other security technologies designed to address evolving cybersecurity threats, including emerging quantum-resistant cryptographic capabilities.

•FortiAI—FortiAI providesbrings aAI dual-layeredand defenseagentic acrosscapabilities to products within the Fortinet Security FabricFabric. through the AI for Security and Security for AI framework. Within AI for Security, FortiAI-Assist uses generativeGenerative and agentic AI to support Network Operations Center (“NOC”) and Security Operations Center (“SOC”) teams in monitoring, analysis and response activities across enterprise environments.environments, Securityincluding automating operational workflows and assisting security personnel with analysis and response activities. AI within our firewalls allows for AIimproved comprisesdefense ofagainst FortiAI-Protect and FortiAI-SecureAI. FortiAI-Protect utilizes AI/Machine Learnings (“ML”) to addressevolving, AI-driven threats and zero-day attacks,attacks. andAI supportfocused features enable our customers to improve their governance over generative AI (“GenAI”) applications,applications FortiAI-SecureAIby providing visibility into AI application usage and helping organizations govern and control the flow of data across public and private AI applications. Products such as FortiAIGate focus on protecting an organization’s AI infrastructure, including large language models (“LLMs”) and Application Programming Interface, supporting the secure deployment and operation of enterprise AI and LLM environments while preventing data leakage into and out of LLMs. FortiAIFortinet’s protectsAI offerings protect the AI ecosystem, infrastructure, models, workloads, data and supply chains, while leveraging unified AI intelligence across the Fortinet Security Fabric to defend against threats.

These competitive differentiators provide networking and security professionals with a cyber securitycybersecurity platform comprised of over 50 products across three solution pillars:

•Secure Networking—Our Secure Networking solutions focus on the convergence of networking and security via FortiOS, our networking and security operating system that is the foundation of our Fortinet Security Fabric platform and supports a broad range of functions that can be delivered via a physical, virtual, cloud or SaaS solutions. When delivered through our network firewall appliances, functionality is accelerated through our proprietary ASIC technology. These proprietary ASICs,ASICs allow our systems to scale, run multiple applications at higher performance, lower power consumption and perform more processor-intensive operations, such as inspecting encrypted traffic, including streaming video. Our network firewall offerings consist of a FortiGate, which can be deployed at branch, campus, data center, internal segmentation, private and public cloud to enable hybrid mesh firewall solutions, as well as encrypted applications (secure sockets layer inspection, virtual private network and Internet Protocol Security connectivity). Our ability to converge networking and security also enables theethernet ethernetor Wi-Fi to become an extension of our customers’ security infrastructure through FortiLink and FortiSwitch and FortiLink.FortiAP. FortiExtender secures 5G/LTE and remote ethernet extenders to connect and secure any branch environment. Our Secure Connectivity solution includes FortiSwitch secure ethernet switches, FortiAP wireless local area network access points and FortiExtender 5G connectivity gateways and Network Access Control for securing Internet of Things (“IoT”) devices.

•Unified Secure Access Service Edge (SASE)—AsWith applications move toin the cloud and hybridemployees workforceworking isfrom nowanywhere, theorganizations norm,need enablingto secure access for users witheverywhere zerothrough trusta frameworkZero becomesTrust important.model. The FortinetFortinet’s Unified SASE solutionoffering includesbrings a single-vendor SASE solution that includestogether firewall, SD-WAN, secure web gateway, cloud access servicessecurity broker, Datadata Lossloss Preventionprevention (“DLP”), Digitaldigital Experienceexperience Monitoringmonitoring and ZTNA toin delivera flexiblesingle secureplatform for user access foracross allbranch, users.campus, Weremote, areand onecloud ofenvironments. theIt few vendors to deliverprovides consistent convergence and AI-powered securityintegration across Securesecure SD-WAN and SSESecurity toService enableEdge, ausing single-vendorFortiOS SASEas frameworkthe withcommon aoperating cloud-centric architecture powered by FortiOS. Our globalsystem and scalablepolicy framework. Fortinet’s cloud network includes overmore than 200 PoPs, supporting global access and inspection. The rise of AI use paired with work from anywhere leaves businesses vulnerable to AI tool abuse with sensitive data leakage. AI visibility and control is built into FortiOS, allowing SASE PoPs to delivergive a seamless secure access experience. Leveraging this global infrastructure, we believe we are well positioned to support customers expanding from SD-WAN to a single-vendor SASE platform. We also allow our customers to deploy our FortiSASE as Sovereign SASE, which providescompanies control over AI usage and data exfiltration regardless of where the technologyuser elementsis. neededThe forplatform aalso supports sovereign SASE solution.deployments, FortiSASEallowing Sovereignorganizations deliversto fullrun SASE capabilities withinin infrastructure environments that organizationsthey control, including on-premises,on-premises inenvironments, private data centerscenters, orand trusted colocation environments.facilities. Additionally,This weenables offerlocal ainspection, fulldata suiteresidency, ofand jurisdiction-specific control where required. Fortinet also provides integrated cloud security solutionscapabilities thatfor enable customers to secure theirprotecting applications fromand codeworkloads toacross cloud. Our solutions includethe application securitylifecycle, that includesincluding web application firewalls, cloud network security with virtualized firewallsvirtual and cloud-native firewalls, cloud-native application protectionprotection, and code security. WeThese delivercapabilities ahelp holisticorganizations approach to cloud security, offering a single unified platform, consolidating protection across multiple disparate tools, including coding, deploying, and runningsecure applications across hybrid and multi-clouds.multi-cloud Additionally,environments wethrough alsoa offercommon flexibleplatform rather than multiple disconnected tools. Flexible consumption and licensing programsmodels thatsupport enabledifferent organizationscloud deployment and procurement models. Fortinet continues to dynamicallybuild optimize their cloud security needs and investments as well as readily meet their cloud minimum spend commitment obligations with Cloud Service Providers. We continue to develop all theout core SASE capabilities in a single operating system, FortiOS, —including Next-Gennext-generation Firewall,firewall, Secure SD-WAN, Universal ZTNA, secure web gateway, cloud access security brokerbroker, and DLP.DLP—within FortiOS. This nativeprovides integrationa ofcommon ouroperating Next-Genmodel Firewall,across SD-WANnetworking and security functions and forms the basis for convergence between firewall, SD-WAN, and SASE has become the New-Generation SASE Firewall.services.

FortiGuard Labs is our cybersecurity threat intelligence and research organization comprised of experienced threat hunters, researchers, analysts, engineers and data scientists who develop and utilize Machine Learning (“ML”) and AI technologies to provide timely protection updates and actionable threat intelligence for the benefit of our customers. Using millions of global network sensors, FortiGuard Labs monitors the worldwide attack surface and employs AI to mine that data for new threats.

In addition to FortiCare solution basedsolution-based services, Advanced Support service options are available per account. These services are available for regional account support in three options: Core, Pro and Pro Plus, and can be available or provided on

Additionally, we are committed to addressing the cybersecurity skills shortage through training and certification programs for customers, partners and employees. The Fortinet Training Institute’s ecosystem of public and private partnerships around the world extendextends to industry, academia, government and nonprofits to ensure we are reaching and increasing access of our cybersecurity certifications and training to all populations. The Fortinet Training Institute has issued approximately two million certifications to date.

•Total revenue was $1.85$2.05 billion and $3.90 billion during the three and six months ended MarchJune 31,30, 2026, an increase of 20%,26% and 23%, respectively, compared to $1.54$1.63 billion and $3.17 billion in the same periodperiods last year. Product revenue was $645.1$773.0 million and $1.42 billion during the three and six months ended MarchJune 31,30, 2026, an increase of 41%,52% and 46%, respectively, compared to $459.1$508.9 million and $968.0 million in the same periodperiods last year. Service revenue was $1.20$1.27 billion and $2.48 billion during the three and six months ended MarchJune 31,30, 2026, an increase of 11%,14% and 13%, respectively, compared to $1.08$1.12 billion and $2.20 billion in the same periodperiods last year.

•Total gross profit was $1.49$1.64 billion and $3.13 billion during the three and six months ended MarchJune 31,30, 2026, an increase of 19%,25% and 22%, respectively, compared to $1.25$1.32 billion and $2.56 billion in the same periodperiods last year.

•Total gross margin was 80.2% and 80.3% during the three and six months ended MarchJune 31,30, 2026, a decrease of 0.70.5 percentagein points,each period, compared to 81.0%80.7% and 80.8% in the same periodperiods last year.

•Operating income was $580.0$689.3 million and $1.27 billion during the three and six months ended MarchJune 31,30, 2026, an increase of 28%,51% and 39%, respectively, compared to $453.8$458.0 million and $911.8 million in the same periodperiods last year.

•Operating margin was 31.4%33.7% and 32.6% during the three and six months ended MarchJune 31,30, 2026, an increase of 1.95.6 and 3.8 percentage points, respectively, compared to 29.5%28.1% and 28.8% in the same periodperiods last year.

•Cash, cash equivalents, short-term and long-term investments were $3.63$4.47 billion as of MarchJune 31,30, 2026.

•Deferred revenue was $7.35$7.68 billion, including short-term deferred revenue of $3.73$3.84 billion, as of MarchJune 31,30, 2026.

•Cash flows from operating activities were $1.08$2.12 billion during the threesix months ended MarchJune 31,30, 2026, an increase of $213.8$805.5 million, or 25%,61%, compared to the same period last year.

Revenue continues to be diversified globally, which remains a key strength of our business. During the three months ended MarchJune 31,30, 2026, the EMEA region, the Americas region and the APAC region contributed 43%, 39% and 18% of our total revenue, respectively, and revenue grew 31%, 23% and 21% in these regions compared to the same period last year, respectively. During the six months ended June 30, 2026, EMEA, the Americas and APAC regions contributed 42%, 40% and 18% of our total revenue, respectively, and revenue grew 25%,by 17%28%, 20% and 15%18% in these regions compared to the same period last year, respectively.

Product revenue increased 41%52% and 46% during the three and six months ended MarchJune 31,30, 20262026, respectively, compared to the same periodperiods last year.year, primarily driven by hardware revenue growth resulting from higher unit shipments year over year and recent pricing actions. We experienced product revenue growth across our hardware products and software licensing, which mainly benefited from growth in secure networking hardware products and term licenses, including increased demand for higher performance products, deployments related to AI infrastructure, technology upgrades, upsell activity, and expansion into new use cases. Recent pricing changes also contributed a low single digit impact to product revenue growth. We expect our product revenue to continue to grow year over year for the remainder of 2026.2026 compared to the same periods of 2025.

Service revenue growthincreased $153.8 million, or 14% and $277.7 million, or 13%, during the three and six months ended MarchJune 31,30, 20262026, was 11%,respectively, as compared to the same periodperiods last year, primarily driven by the strength of our security subscription revenuerevenue, which increased $85.3 million, or 13% and $156.2 million, or 12%, respectively, and our technical support and other services revenue, which grewincreased 11%$68.5 million, or 14% and 12%,$121.5 million, or 13%, respectively. The increase was primarily due to the recognition of service revenue from our growing deferred revenue balance related to FortiGuard and other security subscriptions delivered to on-premise and cloud-based environments and strength in unified SASE and SecOps, as well as the recognition of revenue from our growing deferred revenue balance related to FortiCare technical support service. We expect our service revenue to continue to grow year over year for the remainder of 2026.

Our billings were diversified on a geographic basis. During the three months ended MarchJune 31,30, 2026, sixseven countries represented approximately 50% of our billings and the remaining approximately 50% in the aggregate were from over 100 countries that each individually contributed less than 3% of our billings.

Total gross margin decreased 0.70.5 percentage points during each of the three and six months ended MarchJune 31,30, 20262026, compared to the same periodperiods last year, primarily drivendue byto a shift in the revenue mix to lower margin product revenue. Revenue mix shifted by 5.1 percentage points from service revenue to lower margin product revenue, as a percentage of total revenue. Our overall gross margin for the full year of 2026 will be impacted by service and product revenue mix and their respective gross margins. While we are implementing price increases to mitigate higher hardware component costs, the impact on our margins will depend on the timing and market acceptance of these adjustments. Our product gross margin may decline iffor thesethe pricingfull actionsyear do2026 notas fullycompared offsetto rising2025 inputprimarily due to continued higher hardware component costs. OurWe also expect service gross margin is expected to remaindecline relatively consistent,slightly for the full year 2026 as compared to 2025, despiteprimarily due to continued expansion of our data center footprint and colocation and cloud hosting capacity to support the growth in our unified SASE and SecOps offerings. We currently do not expect the U.S. tariffs to have a meaningful impact on our gross margin. However, changes in trade policy, including increases in tariff rates, changes in customs or tariffs classifications, or modifications to tariff exemptions, could adversely affect our gross margin in the future, and we expect any resulting impact would primarily relate to our hardware sales to the U.S. customers.

Operating expenses as a percentage of revenue decreased 2.6by 6.0 and 4.4 percentage points during the three and six months ended MarchJune 31,30, 2026, respectively, compared to the same periodperiods last year, mainly because our revenue growth outpaced the growth in our personnel costs growth.costs. Headcount increased to 15,31115,472 employees as of MarchJune 31,30, 2026, a 5%4% increase compared to 14,55614,898 as of MarchJune 31,30, 2025.

Operating margin increased 1.95.6 and 3.8 percentage points during the three and six months ended MarchJune 31,30, 2026, respectively, driven by revenue growth exceeding expense growth, resulting in improved operating leverage.leverage, partially offset by lower total gross margin. For the full year 2026, we expect our operating margin to decreaseincrease slightly compared to 20252025, asbenefiting wefrom continueoperating toleverage makeand strategicmeasured investments. TotalBoth total revenue isand operating expense are expected to increase in 2026 compared to the prior year;year. however,The ourincrease expensesin areexpense is expected to outpace revenue growth, primarily reflectingreflect investments in sales and marketing headcount, product developmentdevelopment, and the continued capital expendituresinvestments in data centers and real estate. WhileWe expect these strategicand other investments are intended to drivesupport long-term revenue growth and market expansion, we anticipate they may result in near-term compression of our operating margins. In addition, we may experience higher operating expenses driven in part by the weakening of the U.S. dollar relative to foreign currencies, as a portion of our expenses are incurred and paid in currencies other than the U.S. dollar.expansion.

We typically sell our security solutions to distributors that sell to networking security focused resellers and to certain service providers and managed security service providers (“MSSPs”), who, in turn, sell to end-customers or use our products and services to provide hosted solutions to other enterprises. At times, we also sell directly to enterprise customers, service providers, systems integrators and large enterprises. We also sell our software licenses and cloud delivered services via differentthird-party cloud service provider platforms, both directly and through our channel partners. Our end-customers are located in over 100 countries and include small, medium and large enterprises and government organizations across a wide range of industries, including financial services, government, healthcare, manufacturing, retail, technology and telecommunications. An end-customer deployment may involve as few as one or as many as thousands of secure networking, unified SASE and security operations technology products or users, depending on the end-customer’s size and security requirements.

Deferred revenue. Our deferred revenue consists of amounts that have been invoiced but that have not yet been recognized as revenue. The majority of our deferred revenue balance consists of the unrecognized portion of service revenue from FortiGuard and other security subscriptions and FortiCare technical support service contracts, which is recognized as revenue ratably over the service term. We monitor our deferred revenue balance, short-term and total deferred revenue growth and the mix of short-term and long-term deferred revenue because deferred revenue represents a significant portion of free cash flow and of revenue to be recognized in future periods. Deferred revenue was $7.35$7.68 billion as of MarchJune 31,30, 2026, an increase of $235.7$559.9 million, or 3%,8%, from December 31, 2025. Short-term deferred revenue was $3.73$3.84 billion as of MarchJune 31,30, 2026, an increase of $90.3$205.8 million, or 2%,6%, from December 31, 2025.

Billings (non-GAAP). We define billings as revenue recognized in accordance with GAAP plus the change in deferred revenue from the beginning to the end of the period less any deferred revenue balances acquired from business combinations during the period. We consider billings to be a useful metric for management and investors because billings drive current and future revenue as well as cash flows. There are a number of limitations related to the use of billings instead of GAAP revenue. First, billings are impacted by the term of security subscription and support agreements and do not provide an indication as to the timing of revenue being recognized from these service contracts. Second, we may calculate billings in a manner that is different from peer companies that report similar financial measures. Management accounts for these limitations by providing specific information regarding GAAP revenue and evaluating billings together with GAAP revenue. Total billings were $2.09$2.37 billion for the three months ended MarchJune 31,30, 2026, an increase of 31%33% compared to $1.60$1.78 billion in the same period last year.

Free cash flow (non-GAAP). We define free cash flow as net cash provided by operating activities minus purchases of property and equipment and excluding any significant non-recurring items, such as proceeds from IP matters.equipment. We believe free cash flow to be a liquidity measure that provides useful information to management and investors about the amount of cash generated by the business that, after capital expenditures and net of proceeds from IP matters,expenditures, can be used for strategic opportunities, including repurchasing outstanding common stock, investing in our business, making strategic acquisitions and strengthening the balance sheet. A limitation of using free cash flow rather than the GAAP measures of cash provided by or used in operating activities, investing activities, and financing activities is that free cash flow does not represent the total increase or decrease in the cash and cash equivalents balance for the period because it excludes cash flows from significant non-recurring items, such as proceeds from IP matters, investing activities other than capital expenditures and cash flows from financing activities. Management accounts for this limitation by providing information about our proceeds from IP matters, our capital expenditures and other investing and financing activities on the condensed consolidated statements of cash flows and under “Liquidity and Capital Resources” and by presenting cash flows from investing and financing activities in our reconciliation of free cash flow. In addition, it is important to note that other companies, including companies in our industry, may not use free cash flow, may calculate free cash flow in a different manner than we do or may use other financial measures to evaluate their performance, all of which could reduce the usefulness of free cash flow as a comparative measure. A reconciliation of net cash provided by operating activities, the most directly comparable financial measure calculated and presented in accordance with GAAP, to free cash flow is provided below:

There were no material changes to our critical accounting policies and estimates as of and for the threesix months ended MarchJune 31,30, 2026, as compared to the critical accounting policies and estimates described in our Annual Report on Form 10-K filed with the SEC on February 25, 2026 (the “Form 10-K”).

Three Months Ended MarchJune 31,30, 2026 and 2025

Total revenue increased $309.9$417.9 million, or 20%,26%, during the three months ended MarchJune 31,30, 2026 compared to the same period last year. We continued to experience geographically diversified revenue, as well as diversification across customer and industry verticals. Revenue from all regions grew, with EMEA contributing the largest portion of the increase on an absolute dollar basis and on a percentage basis.

Product revenue increased $186.0$264.1 million, or 41%,52%, during the three months ended MarchJune 31,30, 2026 compared to the same period last year.year, primarily driven by hardware revenue growth resulting from higher unit shipments year over year, higher average selling prices resulting from customer demand for higher-performing models and recent pricing actions. We experienced product revenue growth across our hardware products and software licensing, mainly driven by growth in secure networking hardware products and term licenses, including increased demand for higher performance products, deployments related to AI infrastructure, technology upgrades, upsell activity, and expansion into new use cases. Recent pricing changes also contributed a low single digit impact to product revenue growth.

Service revenue increased $123.9$153.8 million, or 11%,14%, during the three months ended MarchJune 31,30, 2026 compared to the same period last year. Security subscription revenue increased $70.9$85.3 million, or 11%,13%, and technical support and other services revenue increased $53.0$68.5 million, or 12%,14%, during the three months ended MarchJune 31,30, 2026 compared to the same period last year. The increase was primarily due to the recognition of revenue from our growing deferred revenue balance related to FortiGuard and other security subscriptions delivered to on-premise and cloud-based environments and growth in SaaS solutions, including unified SASE and SecOps, as well as the recognition of revenue from our growing deferred revenue balance related to FortiCare technical support service.

Of the service revenue recognized during the three months ended MarchJune 31,30, 2026 and 2025, 90% was included in the deferred revenue balance as of DecemberMarch 31, 20252026 and 2024,2025, respectively.

Total gross margin decreased 0.70.5 percentage points during the three months ended MarchJune 31,30, 2026 compared to the same period last year, primarily driven by a shift in the revenue mix to lower margin product revenue. Revenue mix shifted by 5.16.5 percentage points from service revenue to product revenue, as a percentage of total revenue.

Product gross margin increased 0.42.4 percentage points during the three months ended MarchJune 31,30, 2026 compared to the same period last year, primarily driven by arecent favorablepricing shift in the product mix to higher margin products,actions, partially offset by reduceda benefitshift fromin netrevenue releasemix ofto inventory related reserveshardware and increased costs of memory chips costs.chips. Cost of product revenue was comprised primarily of third-party contract manufacturers’ costs,costs and costs of materials used in production.

Service gross margin increaseddecreased 0.30.1 percentage points during the three months ended MarchJune 31,30, 2026 compared to the same period last year, primarily driven by service revenue growth outpacing labor costs increase, partially offset by increased costs related to the continued expansion of our data center and cloud services.services, partially offset by service revenue growth outpacing increases in labor costs. Cost of service revenue was comprised primarily of personnel-related costs, replacement and repair costs, cloud services costs from owned data centers, colocation providers and cloud service providers, infrastructure depreciation and related operating costs, software and delivery costs, and facility-related costs.

Research and development expenses increased $15.4$15.5 million, or 8%,7%, during the three months ended MarchJune 31,30, 2026 compared to the same period last year, primarily due to an increase of $16.2$13.5 million in personnel-related costs as a result of increased headcount and compensation rates to support the development of new products and continued enhancements to our existing products and the impact of the recent acquisitions. We expect research and development expenses to increase in absolute dollars year over year during the remainder of 2026 as we continueinvest to investdrive continued innovation in our technology and talent to continue to innovate our products and services.

Sales and marketing expenses increased $93.6$77.1 million, or 17%,13%, during the three months ended MarchJune 31,30, 2026 compared to the same period last year, primarily due to an increase of $73.1$73.4 million in personnel-related costs, an increase of $14.7 million in marketing program and related expenses and unfavorable impact of foreign currency fluctuations.costs. We expect our sales and marketing expenses to increase in absolute dollars year over year during the remainder of 2026 as we continue to invest in our global sales and marketing organization to capture additional market share, and we anticipate that these growth investments may drive sales and marketing expenses to increase at a rate faster than revenue.share.

General and administrative expenses decreasedincreased $1.6$4.2 million, or 3%,7%, during the three months ended MarchJune 31,30, 2026 compared to the same period last year, primarily due to aan decreaseincrease of $2.7$2.1 million in legal related fees and other professional services fees and an increase of $1.5 million in personnel-related costs. We expect our general and administrative expenses to increase in absolute dollars year over year during the remainder of 2026, as we needprimarily to support our growing operations while continuing to leverage scale and efficiencies.

We generated operating income of $580.0$689.3 million during the three months ended MarchJune 31,30, 2026, an increase of $126.2$231.3 million, or 28%,51%, compared to $453.8$458.0 million in the same period last year. Operating margin was 31.4%33.7% during the three months ended MarchJune 31,30, 2026, compared to 29.5%28.1% in the same period last year. The 1.9improvement in operating margin was primarily driven by operating leverage, as revenue growth outpaced the increase in operating expenses, partially offset by lower total gross margin. The 5.6 percentage pointspoint increase in operating margin was primarily due to 1.3,3.6, 0.81.9 and 0.80.6 percentage points decreases in sales and marketing expenses, research and development expense, sales and marketing expenseexpenses and general and administrative expense,expenses, as a percentage of revenue, respectively, partially offset by 0.7a 0.5 percentage pointspoint decrease in gross margin and 0.3 percentage points decrease in gain on intellectual property matters as a percentage of revenue.

Interest income decreased $11.4$11.8 million during the three months ended MarchJune 31,30, 2026 compared to the same period last year, primarily due to lower average interest rates and lower average cash and cash equivalents balances as a result of share repurchases and debt repayment. Interest income varies depending on our average cash, cash equivalents and short-term and long-term investments balances during the period, types and mix of deposits and investments, and interest rates. Interest expense decreased $0.7$1.4 million during the three months ended MarchJune 31,30, 2026 compared to the same period last year.year, primarily due to the repayment of our 2026 Senior Notes at maturity in March 2026. Other income—net increaseddecreased $21.8$18.0 million during the three months ended MarchJune 31,30, 2026 compared to the same period last year, primarily due to a net change of $61.9$10.1 million fromincrease netin foreign currency exchange losses toand a $6.3 million decrease in net gains on marketable equity securities, partially offset by a change of $39.9 million in gain on bargain purchase related to our acquisition of Linksys recognized only in the three months ended March 31, 2025.securities.

Our effective tax rate was 19%16% for the three months ended MarchJune 31,30, 20262026, andcompared 2025.to an effective tax rate of 15% for the same period last year. The provision for income taxes for the three months ended MarchJune 31,30, 2026 was primarily comprised of U.S. federal and state taxes, withholding taxes and foreign taxes totaling $166.6 million, which was favorably affected by a tax benefit of $35.2$33.9 million from the FDDEI deduction and excess tax benefits from stock-based compensation expense of $9.4$17.7 million.

The provision for income taxes for the three months ended MarchJune 31,30, 2025 was primarily comprised of U.S. federal and state taxes, withholding taxes, and foreign taxes totaling $128.5$114.6 million, which includeswas afavorably taxaffected provision of $30.6 million related to the derecognition of deferred tax assets from the business combination with Linksys,by a tax benefit of $25.8$25.1 million from the FDDEI deduction and excess tax benefits from stock-based compensation expense of $36.8$12.4 million.