Fortinet Fell 24% Over a $40 Million Service Cut. The Number That Matters Is 2027 Hardware

October 31, 2026 · Fortinet, Inc. (FTNT)

profitmonk

Summary

• Fortinet beat its own guidance on every line on 28 October and raised full-year revenue and earnings. It also trimmed 2026 service revenue guidance by $40M at the midpoint, and the stock fell 24.4% in a week.
• The line the market sold moves my 2028 model least. The gap between cautious and management-indicated service growth is about $0.17B of 2028 revenue.
• The real swing is 2027 hardware revenue. Jefferies models 2% product growth. If Fortinet only keeps pace with the 13.4% firewall market growth Gartner forecasts (in a blog summary I could not check against Gartner), 2027 earnings reach $3.99 a share.
• My 2028 base case is $4.47 a share of non-GAAP earnings, 2.4% above consensus. My forecast sits close to the street's, so the opportunity is in the price.
• At $136.08 the stock trades at 30.4 times that 2028 figure, and a little under 33 times the 2028 earnings in my Jefferies-based low case. Calling it cheap assumes the 37% operating margin holds as memory costs rise.

The Quarter Fortinet Beat and Still Lost a Quarter of Its Value

On the evening of 28 October, Ken Xie opened Fortinet's third-quarter call with good news. The founder and chief executive told listeners that "we have raised our 2026 billing guidance for the third time this year." Revenue rose 20.5% to $2.08B, and full-year guidance went up for revenue, billings, operating margin and earnings.

One line went the other way. Fortinet cut its 2026 service revenue guide by $40M at the midpoint, to $5.15B to $5.17B. Service is the recurring subscription and support business, the highest-margin part of the company, and it was the number investors had been watching.

Raymond James' Adam Tindle put the problem to chief financial officer Christiane Ohlgart within half an hour. "People are going to say, you told us that it was going to accelerate in the second half of this year," he said. Ohlgart replied: "I haven't used the word acceleration. I've used the word improved growth rates."

The next day The Motley Fool's headline read "This Cybersecurity Stock Just Had Its Worst Day in Years." By the close on 30 October the shares stood at $136.08, down 24.4% over five sessions, while the S&P 500 ETF barely moved.

The brokers followed. MarketBeat and TipRanks reported that Bank of America downgraded the stock to Neutral and that at least thirteen other firms cut their targets, from Wells Fargo at $115 to TD Cowen at $190. My argument is that the market sold the wrong line, and that the line which matters is priced for a worse outcome than the evidence supports.

A Sunnyvale Firewall Maker That Designs Its Own Chips

Fortinet sells firewalls and the security services that run on them. Brothers Ken and Michael Xie founded it in Sunnyvale, California in 2000, after Ken had built NetScreen, an earlier firewall company that Juniper bought in 2004 for roughly $4B.

Its core product is the FortiGate, a physical box that sits where a company's network meets the internet, or where one part of a network meets another. Every FortiGate runs FortiOS, a single operating system used across the product line, on chips Fortinet designs itself and calls FortiASIC security processing units. An ASIC is a chip built for one task, here inspecting network traffic.

The scale is large for a security company. The annual report counts 15,109 employees at the end of 2025 and customers in more than 100 countries. Xie claims Fortinet now ships "over half of the global unit deployment" of network security devices, a company figure I could not verify independently.

Fortinet earned $1.85B of net income on $6.80B of revenue in 2025, and at $136.08 it is worth about $99.8B.

Two-Thirds of Revenue Arrives Every Year Whether or Not a Box Ships

Fortinet's XBRL filing data indicates a single reportable segment, which I could not confirm in the filing itself. The split that decides its value is between hardware and the services attached to it. The annual report shows both growing in 2025, at very different margins.

FY2025 against FY2024	FY2025 revenue	FY2024 revenue	Change	Gross margin 2025 / 2024
Product	$2.22B (33%)	$1.91B (32%)	+16%	67.3% / 65.8%
Service	$4.58B (67%)	$4.05B (68%)	+13%	86.8% / 87.5%
Total	$6.80B	$5.96B	+14%	80.5% / 80.6%

Product revenue is mostly FortiGate hardware plus term licences, and in 2026 it has taken off. It rose 52% in the second quarter and 37% in the third, to $765M.

Service revenue is FortiGuard, the threat-intelligence subscriptions that keep each box current, plus FortiCare support. It is recognised gradually over contracts of one to five years, which is why it moves slowly: third-quarter service revenue grew 12.7%, to $1.31B.

This year Fortinet also regrouped its billings. SASE Firewall, about 90% of the total, grew 31% in the quarter, while the security-operations software that makes up the rest grew 15%. Because the groupings changed, comparisons with 2025 by product family no longer line up.

How a Hardware-Anchored Security Company Is Measured

Investors trade Fortinet on four numbers, and each tells a different part of the hardware-then-service story.

Metric	Latest	Context
Billings growth	29% in Q3	33% in Q2; 16% for all of 2025
Service revenue growth	12.7% in Q3	12.7% to 13.7% over the four quarters I can see
Short-term deferred revenue	$3.96B, up 14.5%	"highest growth rate in 5 quarters"
Free cash flow	$865M in Q3, a 41.6% margin	Nine months up 74%, to $2.84B

Billings are everything invoiced in the period, including multi-year contracts that turn into revenue later, so they run ahead of revenue in a boom. Short-term deferred revenue is contracted service due to be recognised within a year, and management names it as its own leading indicator for service revenue. Ohlgart said the first quarter of 2026 "marked the trough" for service growth, and the deferred line is the evidence she points to.

Cash generation is the strongest of the four. Software investors add revenue growth to free cash flow margin and call the result the Rule of 40, and Fortinet scores about 62. The peer comparison is less flattering than it looks: Check Point's subscriptions grew 12% in its second quarter, roughly Fortinet's service pace, while its product revenue fell 14%.

What Changed: AI Turned a Hardware Hangover Into a Pricing Year

Three years ago Fortinet was working through a hangover from the pandemic hardware boom. As late as August 2025 the stock fell about 22% to 26% after the company said its refresh of FortiGates reaching end of support was only partly done, MarketWatch and Morningstar reported.

In 2026 two things arrived at once. AI became both a threat customers had to defend against and a workload that needed protecting, and AI data-centre construction caused a global memory chip shortage that let Fortinet raise prices. Investor relations head Anthony Luscri said at the close of the call that the price increases "had around a 10 percentage point impact" on billings growth, so billings grew about 19% before price.

Management did not see the profit side coming. The February 10-K expected no meaningful gross margin hit from tariffs and warned, "we expect our operating margin to decrease compared to 2025," as Fortinet hired sellers and built data centres. Instead the non-GAAP operating margin guide now stands at 36.5% to 37.5%, and the billings guide has risen $1.14B since February.

The Demand Story: Firewalls Are Where AI Gets Policed

Fortinet's demand case rests on three claims, and management made each in its own words on the call. Ohlgart said "AI, SASE and network upgrades and expansions are key growth drivers as customers prepare for new threat environments." Xie called the firewall "a centralized point of in-line enforcement" for AI systems. He also pitched an on-premise sovereign version of SASE, short for secure access service edge, which combines networking and security policy into one service, to European and public-sector buyers.

The customer examples were unnamed but specific. "An AI company developing frontier models" placed a seven-figure expansion order, standardising on Fortinet's high-end data-centre firewalls after deploying them in its first AI data centre last year.

Two eight-figure deals came from older industries. A large transportation company chose Fortinet in a competitive win for its operational technology network, meaning the control systems that run physical equipment. A large U.S. retailer signed to standardise 1,500 stores.

Chief operating officer John Whittle added a prospect: "I just talked to a retailer who's considering rolling out our solution to 4,000 stores around the country." Nothing is signed there, so I give it no weight in the model.

The aggregate numbers back the anecdotes. The value of deals over $1M rose 51%, with "outsized contribution from our U.S. large enterprise business," and operational technology billings grew nearly 40%. Asked about the fourth quarter so far, Xie said: "The demand is still very strong, and we don't see any slowdown."

Outside forecasts point the same way, though I hold them more loosely. The Software Strategies blog's summary of Gartner's September 2026 forecast says Gartner raised its 2027 firewall equipment growth estimate to 13.4% from 7.8%. The same summary says Gartner expects at least 20% of government, financial and defence customers to upgrade firewalls in 2027. I have not seen the Gartner document itself.

Contracted revenue gives the story a floor. Remaining performance obligations, the value of signed contracts not yet recognised, stood at $7.98B at the end of September, and $3.98B of that is due within twelve months.

The Constraint Is Memory, and Fortinet's Buffer Has Run Out

Fortinet designs its chips but manufactures nothing itself, so its 2026 growth depends on the cost and timing of other companies' supply. About 87% of its hardware is built in Taiwan by contract manufacturers including Accton, Wistron and Micro-Star. Its ASICs are made by Toshiba and Renesas in Taiwanese and Japanese foundries run by TSMC or the contract manufacturer.

The annual report is blunt about how thin that supply chain is: "Our individual product lines are generally manufactured by only one manufacturing partner." It also says Fortinet has no long-term contracts guaranteeing capacity or pricing for its ASICs or other components.

Memory is the input that matters most this year. The annual report says Fortinet is "currently experiencing, and may continue to experience, constraints on the availability of memory chips," which it buys from Micron, Samsung, Western Digital and others. The filing attributes the shortage to the rapid global build-out of AI infrastructure. The Register reported in January that Wedbush expected memory prices to roughly double year on year by mid-2026, after rising about 50% in 2025.

For half a year Fortinet had an edge. Xie said that "in the normal year, we keep about 6 months on-hand inventory," which let it ship parts bought at old prices while list prices rose. That buffer is gone: "starting from Q3, we more treated as a normal now," he said. "So the on-hand inventory advantage kind of starting to disappear."

Fortinet now sources at market prices like everyone else, and Xie said "we do see the lead time get longer." When Stifel's Adam Borg asked whether Fortinet was supply-constrained or simply paying more for new inventory, Xie answered: "I'd say a little bit both."

The quarter shows the cost. Product gross margin fell to 64.4% from 67.7% a year earlier, which the 10-Q attributes to memory costs and inventory reserves, partly offset by price rises.

The balance sheet carries more of it forward. Inventory has risen 48% since December, and raw materials have doubled, so parts bought at today's prices will flow into cost of goods in coming quarters.

The fix is slow because Fortinet does not control memory supply, and its stated policy is to hold gross margin constant: "If our costs go higher, will increase accordingly. If our costs get lower, we also will decrease accordingly." Xie said prices have "probably stabilized, but not improved yet." Ohlgart named the limit: "You can only increase the prices so much... We are trading a balance between increase of price and gaining market share."

Xie argues the squeeze favours Fortinet. "With our own ASIC chip, with our kind of manufacturer managed by ourselves... we feel we have more advantage in this supply chain issue compared to most other competitors," he said. That is his claim, and I found no third-party evidence either way. Installation capacity looks fine: Ohlgart said "I've not really heard that there is a shortage in the ability to roll out."

The sources give no memory price forecast for 2027 or 2028, so I can only sketch the supply paths. If costs keep outrunning price, product margin falls below the third quarter's 64.4%. If prices stay where they are, the constant-margin policy holds product margin near its second-half level. If memory eases, prices fall under the same policy and the 10-point price boost to billings reverses. In each case the squeeze lands on margin and delivery timing, and nothing in the sources caps unit volume.

What It Is Worth: Consensus Is Close, and the Fight Is Over 2027

I built 2028 from Fortinet's own 2026 guidance and growth rates taken from named sources, with no estimates of my own. The starting points are $5.16B of service revenue, the guide's midpoint, and about $3.01B of product revenue, the remainder of the revenue midpoint.

Service is the easier line. Management said on the call that 2027 service revenue should grow "at a higher rate compared to 2026," using short-term deferred revenue as its guide. So I take this year's 13% as the floor and the deferred line's 14.5% as the base, and the gap between them is only $0.17B of revenue by 2028.

Product decides the answer. TipRanks reported that Jefferies analyst Joseph Gallo cut his 2027 product growth estimate to 2%, arguing the third quarter pulled demand forward, and that becomes my low case. My base case lets product grow with Gartner's firewall market, as the blog summary reports it, which assumes Fortinet only holds share. My high case uses the 16% market growth rate Xie cited on the call.

Earnings follow from the guided 37% non-GAAP operating margin, last year's interest income, the guided 18% tax rate and the guided share count, with no further buybacks.

FY2028 case	Product growth 2027 / 2028	Service growth	Product revenue	Service revenue	Total revenue	Non-GAAP EPS
Low (Jefferies)	2% / 2%	13%	$3.13B	$6.59B	$9.72B	$4.15
Base (Gartner market)	13.4% / 9.3%	14.5%	$3.73B	$6.76B	$10.50B	$4.47
High (Xie's 16% market rate)	16% / 16%	14.5%	$4.05B	$6.76B	$10.82B	$4.60
Consensus					$10.10B	$4.37

On 2028 I largely agree with the street. My base case sits 4% above consensus on revenue and 2.4% above on earnings.

The disagreement is in 2027. On the same method my base case earns $3.99 a share next year. Scotiabank's 2027 estimate, reported by MarketBeat on 7 October before the print, is $3.42, which sits below Fortinet's own 2026 guide and so implies earnings fall next year.

Three assumptions carry the result, and they matter very unequally.

Assumption	Change	Impact
2027 product growth	2% instead of 13.4%	About $0.34B less 2027 revenue
Service growth	One percentage point	About $0.05B of 2027 revenue
Operating margin	37% falls by a fifth, to 29.6%	Base 2028 EPS drops to about $3.62

Service, the line the stock fell on, barely moves the answer. Product is the named fight between Jefferies and me, and margin is the largest single risk because it is where the memory squeeze lands. The full arithmetic, including both anchors and the sensitivities, is in the published research brief.

What the Market Is Paying: About 30 Times 2028 Earnings, and Under 33 Even in the Low Case

The question for a buyer is whether a fair 2028 forecast is already in the price, so I judge the stock on 2028 earnings and compare my cases with consensus for the same year.

2028 non-GAAP EPS basis	EPS	Multiple at $136.08
My base case	$4.47	30.4x
Consensus	$4.37	31.2x
My low case (Jefferies product growth)	$4.15	A little under 33x

On trailing earnings the stock is unremarkable against its own history. At 43.9 times, it sits at the 40th percentile of its ten profitable years, which tells me the sell-off took the multiple back to the middle of its range and no further.

Peers bracket it on very different business models. Palo Alto has no meaningful P/E, so sales are the only common basis with it.

Company	Trailing P/E	Price / sales
Fortinet	43.9x	12.7x
Palo Alto Networks	Not meaningful	26.1x
Check Point	15.4x	5.6x
Qualys	38.6x	11.0x

Fortinet sits between Palo Alto's subscription-heavy growth and Check Point's shrinking hardware line, and the market prices it between them. On trailing free cash flow of about $3.42B the yield is about 3.4%.

On my numbers the stock is fair to modestly cheap. A 30-times multiple on a forecast close to consensus is reasonable for this growth, and the low case still costs under 33 times. My read is that the price already leans toward Jefferies' 2% product year rather than Gartner's market pace. MarketBeat puts post-print price targets at about $148 to $150.

The Competition: Palo Alto Wins on Subscriptions, Fortinet Says It Wins on Cost

Fortinet claims its advantage is cost per unit of security throughput, which it attributes to its own chips. The 10-K says its processors "deliver superior Security Compute Ratings versus industry alternatives," and the company argues it offers "significantly lower total cost of ownership." I found no third-party test of either claim. The independent figure I found is older: IDC gave Palo Alto 22.4% of security appliance revenue in the second quarter of 2024, against 19.2% for Fortinet.

Palo Alto chose the opposite strategy, and the market rewards it with twice Fortinet's sales multiple. Its next-generation security ARR, the annualised value of its recurring contracts, is $9.10B, up 63%. Ohlgart conceded the same trade-off from inside Fortinet: sovereign deals are "a little bit more product heavy compared to cloud solutions."

Zscaler and CrowdStrike deliver security from the cloud, and Fortinet's own 10-K names them on exactly that front, adding that "most of our platform is currently deployed on premise." Zscaler guided ARR growth of 16.6% to 17.4% for fiscal 2027, a slowdown from fiscal 2026. Fortinet says it is the only vendor offering on-premise sovereign SASE alongside cloud SASE, and Ohlgart said sovereignty demand is especially prominent among European enterprises and the public sector.

Cisco is the competitor most likely to blunt a share-gain story. Its firewall orders grew more than 30% for a second straight quarter in its July quarter, which confirms the upgrade cycle is industry-wide. It also means Fortinet's 2026 growth is partly the market's growth, which is why my base case assumes only that Fortinet holds share.

Check Point shows what a firewall incumbent looks like without Fortinet's hardware momentum. Its product revenue fell 14% in the second quarter, and it reports again around 2 November.

What Could Go Wrong: Fortinet's Own List Starts With Unpredictability

Fortinet's 10-K opens its risk factors with this: "Our operating results are likely to vary significantly and be unpredictable." It names component shortages, product mix and "refresh cycles" among the causes. The third factor warns that growth "may slow, and our operating margins may decline," and flags "a shift in demand from products to services."

Two disclosed risks bear directly on this week. The company says it relies "significantly on revenue from FortiGuard and other security subscriptions," the line it just cut. It also warns that "reliance on a concentration of shipments at the end of the quarter" can push billings below expectations, since much of each quarter ships in its last two weeks.

The channel is concentrated too: one distributor held 32% of net receivables at the end of 2025, and six held 67%. The filing also says the Chinese government told domestic companies in certain industries not to use U.S. or Israeli cybersecurity products, "including us."

The risk I rank first is one the filing only hints at, that 2026 was partly a price-and-timing year. Price added about ten points to billings growth. Ohlgart said U.S. customers favour hardware "because it's benefiting customers from the tax perspective to depreciate," and the 10-K mentions orders accelerated ahead of announced price increases. If memory supply loosens and costs fall, Fortinet's own policy says prices fall too, and that price contribution reverses.

The second risk is that service attach is structurally lower. Ohlgart conceded that networking components "have fewer attach rates" and that higher prices bring "a little bit more discounting between hardware and services." She also said "with larger enterprise customers, it is more of an upsell motion," and this year's growth skews to large enterprise. An upsell motion would explain a delay, and short-term deferred revenue growing 14.5% supports that reading.

The third is security reputation. CISA added several Fortinet flaws to its catalogue of known exploited vulnerabilities this year. In June a credential-harvesting campaign known as FortiBleed reached about 74,000 devices, Help Net Security reported, citing CISA. A securities class action over the 2025 refresh statements is also pending.

The assumption most likely to be wrong is my 13.4% product growth in 2027, with the 37% margin next. Even so, the Jefferies case still produces $4.15 of 2028 earnings, and the stock trades at a little under 33 times that.

What I Am Watching

The test is Fortinet's fourth-quarter report in early February 2027, dated 4 February in one analyst calendar and 5 February in another, and not yet confirmed by the company. If Fortinet guides 2027 product revenue growth to low single digits and service growth at or below 13%, the bull case is wrong. Before that, Check Point's results around 2 November will show whether firewall hardware strength is broad or limited to Fortinet and Cisco, and memory contract prices will show which way Fortinet's pricing policy cuts.

Takeaway

Fortinet lost almost a quarter of its value over a $40M trim to the line that moves its 2028 earnings least. The line that matters is 2027 hardware. At 30.4 times my 2028 base case, a forecast close to consensus, the price already leans toward a weak product year. Margin and memory supply could prove me wrong, and February's guide will show which product case is right.

Sources

• Fortinet Q3 2026 earnings release (Form 8-K, Exhibit 99.1), 28 October 2026
• Fortinet Q3 2026 earnings call, 28 October 2026 (Ken Xie, Christiane Ohlgart, John Whittle, Anthony Luscri; analyst Adam Tindle of Raymond James)
• Fortinet Form 10-Q for Q3 2026, filed 30 October 2026
• Fortinet Q2 2026 earnings release (Form 8-K, Exhibit 99.1), July 2026
• Fortinet Form 10-K for fiscal 2025, Items 1, 1A and 7, filed 25 February 2026
• The Motley Fool, "This Cybersecurity Stock Just Had Its Worst Day in Years," 29 October 2026
• Yahoo Finance and Trefis coverage of the 29 October 2026 move
• MarketBeat and TipRanks on analyst rating and target changes, 28 to 31 October 2026, and Scotiabank's estimate, 7 October 2026
• Software Strategies blog analysis of Gartner's September 2026 firewall forecast
• The Register on Wedbush's memory price forecast, 12 January 2026
• MarketWatch and Morningstar on the August 2025 move, 7 August 2025
• IDC security appliance tracker, 5 September 2024
• Cisco fiscal Q4 2026 results, 12 August 2026; Palo Alto Networks fiscal Q4 2026 results, 1 September 2026; Zscaler fiscal 2026 results, 3 September 2026; Check Point Q2 2026 results, July 2026
• Help Net Security on the FortiBleed campaign, 18 June 2026; CISA Known Exploited Vulnerabilities catalogue
• Company filings, reported results, analyst consensus and market price data
• Full working, including the three-case model, both anchors and the sensitivities: research/2026-10-31_FTNT.md