How does Fortinet make money?

Fortinet, Inc. – Business Breakdown

The Essentials

Fortinet is presented in the filings as a pure-play cybersecurity vendor built around the convergence of networking and security. Its operating model is anchored by the Fortinet Security Fabric, an integrated platform spanning secure networking, unified SASE, and AI-driven security operations. The company’s economic profile is notable for its strong recurring component: service revenue accounted for 69.5% of total revenue in the nine months ended September 30, 2025, underscoring a business increasingly shaped by subscriptions, support, and threat-intelligence services rather than one-time hardware sales.

From a financial standpoint, Fortinet combines high gross margins of 80.8% with exceptional net margins of 42.5%, reflecting a business with meaningful pricing power and disciplined operating execution. The balance sheet is also a strategic asset: the company reported $3.4 billion of total liquidity and a net cash position, giving management considerable flexibility across R&D, M&A, and capital returns. In parallel, the board expanded the share repurchase authorization to $9.25 billion, signaling confidence in intrinsic value and a willingness to return capital aggressively.

Business Model & Revenue Drivers

Fortinet generates value through a layered cybersecurity platform that monetizes both upfront product deployment and ongoing service relationships. The filings indicate the following core revenue engines:

• Product Revenue

  • Includes hardware appliances and software.
  • Grew 12.4% year over year in the first nine months of 2025.
  • Remains central to customer acquisition and platform penetration, particularly through secure networking deployments.

• Service Revenue

  • Includes subscriptions, support, and threat intelligence.
  • Grew 14.2% year over year and represented the majority of revenue.
  • This is the company’s most structurally attractive stream, as it supports predictability, retention, and customer lifetime value.

• Secure Networking

  • The primary product cluster, including FortiGate firewalls, FortiSwitch, FortiAP, FortiExtender, and FortiOS.
  • This is the foundational layer of the Security Fabric and appears to be the main entry point into customer accounts.

• Unified SASE

  • A single-vendor platform combining firewall, SD-WAN, secure web gateway, CASB, DLP, and ZTNA.
  • Strategically important because it expands Fortinet beyond perimeter security into cloud-delivered networking and access control.

• AI-Driven Security Operations

  • Includes FortiAnalyzer, FortiEDR, FortiXDR, FortiNDR, FortiSandbox, FortiDeceptor, FortiDLP, and FortiRecon.
  • This segment is positioned around SOC consolidation and automation, with recurring revenue potential and higher strategic relevance over time.

• FortiGuard & Security Services

  • Covers application, content, device, and NOC/SOC security services.
  • Embedded into the Security Fabric to improve coordinated detection and enforcement.

• FortiCare & Training

  • Technical support and certification/training programs.
  • These offerings reinforce retention and ecosystem stickiness, while also supporting customer enablement.

Strategic Edge & Market Positioning

Fortinet’s competitive position is best characterized as a moderate moat with meaningful execution dependence, rather than a wide, durable moat.

Economic Moat

• Switching costs: The strongest structural element. The Security Fabric is deeply integrated across firewall, SASE, endpoint, and SOC workflows, which raises migration friction for customers already embedded in the platform.
• Proprietary technology: FortiASIC provides a real performance advantage through custom silicon, improving security processing efficiency relative to software-only approaches.
• Recurring service base: The high service mix suggests customer retention and operational embeddedness, which supports durability.

Execution Advantage

• R&D cadence: The company is actively advancing GenAI, network operations AI, and LLM leakage protection.
• Go-to-market execution: The filings point to a channel-led model that appears effective in scaling revenue.
• Customer stickiness: The service-heavy mix implies strong retention, but this is better viewed as execution quality than an unassailable moat.

Assessment Fortinet’s moat is real but not impregnable. The filings suggest that its advantages are rooted primarily in integration depth and custom silicon, but these are being challenged by platform consolidation from larger peers and by the broader shift toward cloud-native security architectures. The company is therefore best viewed as a well-executed cybersecurity platform with moderate structural defensibility, not a wide-moat franchise.

Outlook & Innovation Pipeline

Over the next three years, the filings point to a strategy centered on platform expansion, cloud transition, and AI-enabled security automation.

• Security Fabric expansion

  • Management appears focused on deepening adoption of the integrated platform to increase switching costs and cross-sell density.

• Cloud and SaaS transition

  • Fortinet is investing in cloud-native delivery through FortiCloud and flexible consumption models.
  • This is strategically important as enterprise workloads continue migrating away from appliance-centric architectures.

• AI-driven SecOps

  • The company is prioritizing GenAI integration, big-data threat analysis, and SOC automation.
  • FortiAnalyzer is positioned as a central platform for SIEM, SOAR, XDR, and threat intelligence convergence.

• Network operations AI

  • The roadmap includes self-healing networks and automated orchestration, which could improve uptime and reduce manual intervention.

• LLM leakage protection

  • This is an early-stage but strategically relevant initiative aimed at emerging enterprise risks tied to large language model adoption.

• FortiASIC development

  • Continued investment in custom silicon remains a key differentiator, supporting performance and efficiency across the platform.

• Geographic and vertical expansion

  • The filings also point to growth opportunities in OT security, healthcare, financial services, and emerging markets, which may help diversify the revenue base.

Overall, the innovation pipeline suggests a company trying to preserve relevance through continuous product reinvention, while shifting its mix toward higher-quality recurring revenue and broader platform monetization.