Fortinet: An Investment Analysis Through a Long-Term Business Owner's Lens

Hunting ten-year five-baggers among great growth stocks — pressing the upside question: "Can it get much bigger?"

• QHow high is its market ceiling? Is it enlarging an existing pie, or creating an entirely new market?6/10

  A

  Bottom line: Fortinet has a high enough ceiling, but it is essentially enlarging an existing pie and expanding into adjacent categories, rather than creating an entirely new market from scratch. Cybersecurity is an existing market worth hundreds of billions of dollars a year, and AI plus cloud migration continue to make that market thicker. Fortinet's growth comes from taking share within that pie and expanding single-customer wallet share from “firewall” to “SASE + security operations.” This is a structural long runway, but it is not a disruptive opening of brand-new territory.

  The absolute scale of the ceiling is real. Cybersecurity is a corporate “continuous defense budget,” not discretionary spending. The report cites IBM 2025 Cost of a Data Breach, which gives an average global breach cost of about $4.40 million, and Verizon 2026 DBIR, whose findings show that phishing, stolen credentials, and vulnerability exploitation remain major intrusion paths. That means the demand base does not depend on a single macro cycle. Fortinet itself places the business into three frameworks, Secure Networking, Unified SASE, and AI-driven SecOps. Its customers span more than 100 countries and finance/retail/healthcare/OT/government. This is a market with enough customers and enough duration. The pie itself is not too small.

  But we need to separate “enlarging the pie” from “creating a new market.” Most of Fortinet's revenue still comes from the established convergence of networking and security. In 2025, product revenue was about $2.218 billion and service revenue was about $4.581 billion, with services at 67% of revenue. Its growth engine is share gain in an already formed and highly crowded market. The competitors listed directly in the report's 10-K include Palo Alto Networks, CrowdStrike, Zscaler, Check Point, Cisco, and Microsoft. That proves Fortinet is not staking out empty land. It is taking business from rivals in a red ocean through cost/performance and platform integration. The parts that can truly count as “creating incremental demand” are emerging niches such as OT security and AI-driven SecOps. Fortinet Q1 2026 results show OT billings grew more than 70% year over year, Unified SASE grew 31%, and AI-driven security operations grew 23%. These make the cybersecurity pie thicker in new forms, but they are still reallocations of existing security budgets, not the creation of an industry that did not exist before.

  From a Baillie Gifford lens, the real determinant of upside is whether Fortinet can keep raising single-customer wallet share. A customer that has already deployed FortiGate may later buy SASE, add SecOps, and renew subscriptions. Each customer's LTV still has meaningful room to expand. That is the core source of ceiling for a platform company. So the ceiling is not low, but this is a long-runway opportunity to keep lifting share and wallet share in a huge existing market, not an explosive opportunity to define a new category and enjoy an uncontested blue ocean. That has to be acknowledged honestly; it should not be dressed up as disruption just to fit a growth narrative.

  Jun 11, 2026
• QCan its revenue at least double over the next five years? Will growth be driven mainly by volume, price, or new businesses?6/10

  A

  Bottom line: doubling revenue over the next five years, which requires about a 15% CAGR, is challenging but within reach, not a certainty. The drivers are a combination of volume as the main engine, price as a secondary contributor, and new businesses (SASE/SecOps/OT) providing marginal acceleration. But the current growth also includes a meaningful firewall hardware refresh-cycle benefit, so today's high growth should not be extrapolated straight out for ten years.

  Start with the math required for doubling: doubling in five years is about a 14.9% CAGR. Fortinet's 2025 revenue was about $6.800 billion (+14%), and 2026 full-year guidance was raised to $7.71–$7.87 billion, or roughly 15% year over year. In other words, the midpoint of company guidance sits right on the threshold for a five-year double. That means doubling is not remote, but it requires holding that pace for five years, which is precisely the biggest uncertainty.

  How to break down the growth structure:

  First, volume is the main engine, but it is currently amplified by the refresh cycle. Fortinet Q1 2026 product revenue was $645 million, up 41%, mainly from demand for higher-performance FortiGate and AI infrastructure upgrades. Total billings were $2.1 billion, up 31%, including Secure Networking +32%, OT +70%, SASE +31%, and SecOps +23%. The report repeatedly warns that the firewall hardware refresh cycle may pull forward demand from future years. So 40%+ growth on the product side has some cyclical borrowing in it and cannot be extrapolated linearly. This is the key variable in whether the double is delivered.

  Second, price is a support. The company disclosed in Q1 2026 that recent price increases made a “low-single-digit” positive contribution to product revenue. That shows Fortinet has some pricing power, but price is not the main growth driver. It mostly adds at the margin.

  Third, new businesses provide structural acceleration. Service revenue in 2025 was $4.581 billion, +13%, forming a stable base through the hardware cycle. The high growth in Unified SASE, AI-driven SecOps, and OT (23%–70%) shows Fortinet is migrating single-customer wallet share from “selling boxes” toward “selling platform subscriptions.” If this portion keeps scaling, it can take over after the hardware cycle fades and hold overall growth in the double digits.

  The honest bear case: the report's strongest counterargument goes straight to the point: “Fortinet may simply be an extremely well-performing company during a firewall refresh cycle; once the cycle benefit passes, product revenue growth may fall to the low-to-mid single digits.” If the hardware refresh collapses after 2026–2027 and SASE/SecOps cross-selling fails to fully fill the gap, a five-year double will not happen, and actual growth may slide toward the high single digits. The report's own DCF neutral case assumes only 8% growth for the first ten years, and the conservative case only 5%.

  Overall judgment: a five-year double is a target that works only in a neutral-to-optimistic case. It requires a smooth transition in the hardware refresh cycle, meaning no collapse, sustained scaling of SASE/SecOps/OT to take over, and moderate price increases, all at the same time. The current 15% guidance midpoint shows the ticket is within reach, but it includes cyclical benefit. Treating it as certain perpetual double-digit growth would be too optimistic. Volume is the main force, price is secondary, and new businesses are the swing factor in whether growth can hold.

  Jun 11, 2026
• QAfter five years, what will take over as the next growth engine? Does this “second curve” exist today?5/10

  A

  Bottom line: Fortinet's “second curve” already exists today and is producing meaningful growth in the financials. It is the combination of Unified SASE + AI-driven SecOps + OT security, businesses that move from “selling hardware” toward “selling platform subscriptions.” But for now they are still extensions of the first curve, firewall/network security, and are not yet large enough to carry the company independently or proven to fully take over after the hardware cycle fades.

  Why the second curve is “already present” rather than a slide-deck promise: Fortinet Q1 2026 results disclosed billings growth by business line, Unified SASE +31%, AI-driven security operations +23%, and OT over 70%. These are clearly above the company's overall 15% growth midpoint, showing that these areas are not PPT concepts but real businesses already deployed with customers and contributing billings in hard dollars. The report places them under Secure Networking, Unified SASE, and AI-driven SecOps, and notes that all reuse the same FortiOS and FortiASIC foundation. That means the second curve shares platform and channels with the first curve, with low marginal customer-acquisition cost. It is a new business growing out of the same platform, exactly the kind of second-curve shape with built-in compounding that Baillie Gifford tends to prefer.

  Its quality today still needs an honest discount:

  First, it looks more like an extension of the first curve than an independent new pole. A customer buying SASE is often an existing FortiGate customer upgrading wallet share. OT security also sits on Fortinet's existing network-security equipment channel. So this curve's “regenerative” quality still depends on the customer base of the first curve, and it has not yet proven it can break away from the firewall base and independently open a new customer pool.

  Second, it has not yet been stress-tested by a cycle. The report's core concern is that the hardware refresh cycle may pull forward demand from future years. The real test of the second curve will come when the hardware cycle fades and product revenue growth drops from the current +41% back to the low-to-mid single digits: can SASE/SecOps/OT hold up overall growth? That moment has not arrived, so the ability to take over remains an assumption rather than a fact.

  Third, the arena is a red ocean, and taking over means taking food from strong rivals. The report states clearly that in more software- and cloud-oriented battles such as SSE/SASE, endpoint, and security operations, Palo Alto, CrowdStrike, Zscaler, and others are closing in, and copying single-point capabilities such as SSE, endpoint, or XDR is “not that hard.” In other words, the segments where the second curve sits are precisely where Fortinet's moat is relatively thinnest and competitors' firepower is strongest. This is not a free ride; it is a hard fight.

  Overall judgment: the second curve is real today and growing impressively, which is the key reason Fortinet deserves more long-term attention than a pure hardware vendor. But at this stage it is a high-growth extension of the first curve, not an independent growth pole proven through a cycle, and it sits in the red-ocean part of the business where the moat is thinnest. Whether it can truly take over depends on whether SASE/SecOps/OT have scaled enough to provide an independent floor when the hardware cycle fades. That is the verification point to watch over the next 2–3 years. Giving it full marks as a “validated second curve” is still premature.

  Jun 11, 2026
• QWhat is its core competitive advantage? Will this moat widen or narrow over the next three to five years?6/10

  A

  Bottom line: Fortinet's moat is real and composite, combining technology architecture, switching costs, cost/performance, channel, and threat intelligence. But it is not a network-effect or licensed moat that widens while the company does nothing. Over the next three to five years, it is likely to stay stable to slightly wider, with clear divergence by battlefield: strengthening in hardware/network convergence, but facing erosion pressure in newer, more software-oriented arenas such as cloud-native security, SASE, and endpoint.

  The real sources of the moat, with the report listing five categories and their substance assessed one by one:

  First and hardest: switching costs plus platform integration. Once customers deploy FortiGate, FortiAnalyzer, FortiManager, subscriptions, and support, and manage policy uniformly on FortiOS, replacing the full platform is costly. The financial evidence for this moat is deferred revenue: Fortinet Q1 2026 total deferred revenue reached $7.351 billion ($3.726 billion short-term + $3.625 billion long-term). The report also discloses that “90% of service revenue recognized in Q1 2026 was already in deferred revenue at year-end 2025.” This structure of locking in revenue first and recognizing it later is quantitative evidence of switching costs and stickiness.

  Second, cost/performance advantage. The company develops FortiASIC/SPU in house and emphasizes higher performance, lower power consumption, and smaller footprint. In high-throughput, high-value network-security hardware, this is real differentiation. It also underpins the “higher-performance FortiGate demand” behind Q1 2026 product revenue surging 41%, and it shows directly in a 2025 product gross margin of about 67.3%. Hardware with nearly 70% gross margin is itself evidence of pricing power/cost advantage.

  Third, fourth, and fifth: channel, threat intelligence (FortiGuard Labs global sensors + AI), and direct-procurement/manufacturing execution when supply is tight. These are real advantages, but they are relatively catch-up-able over time and do not form absolute barriers.

  Why the answer is “slightly wider,” not “much wider,” and why it has to be viewed by battlefield:

  The strengthening side: in network and security convergence, Fortinet's home field, platform integration + ASIC cost advantage + deferred-revenue stickiness are reinforcing one another. Rivals would need years of investment and billions of dollars of capital to replicate a global hardware-software-subscription-support integrated system. This part of the moat is widening.

  The pressured side, which must be stated honestly: the report makes clear that in more software- and cloud-oriented platform battles such as cloud-native security, endpoint, and security operations, Palo Alto, CrowdStrike, Zscaler, and others are closing in, and “copying a single-point capability such as SSE, endpoint, or XDR is not that hard.” More importantly, there is a structural migration risk in the industry. If enterprise security budgets keep moving from “on-premise network perimeter” to “cloud and proxy-based architectures,” Fortinet's hardware-firewall advantage could shift from asset to burden. That means the moat's width depends heavily on whether Fortinet can successfully extend the stickiness of its home field into new cloud/software battlefields.

  The moat type also needs definition. The report deliberately does not define it as a “network-effect” or “regulatory-license” moat. Those are the strongest moats that can truly widen on their own. Fortinet has a composite moat of technology architecture + channel + switching costs + cost performance. Its strength is real, but the ceiling is limited, and rivals can chip away point by point.

  Overall judgment: the moat is real, composite, and supported by hard evidence in deferred revenue and high product gross margin. Over the next three to five years it should slightly widen in the network-convergence home field. But it is not unbreakable. In new cloud-native/SASE/endpoint battlefields, it faces point-by-point pressure from PANW/CRWD/ZS and structural erosion as budgets migrate to the cloud. The conclusion is stable to slightly wider, but battlefield-specific and not a walkover. It should not be inflated into an unassailable super-moat.

  Jun 11, 2026
• QIf the core business is disrupted, does it have the genes for self-reinvention? How does it treat mistakes and bad news?5/10

  A

  Bottom line: Fortinet has the underlying genes for self-reinvention. It has a real record of evolving from a hardware firewall vendor into a platform + subscription cash machine, and long-tenured founders also provide the willingness to make long-term bets. But its record on handling “bad news” has a blemish: a securities class action related to the “2026 firewall refresh cycle” points directly to possible disclosure issues in management's communication with the market. That is a deduction that cannot be ignored when assessing its error-correction culture.

  Start with the positive evidence for self-reinvention. Fortinet is not a company stuck in a single product form. The report's data show that it has evolved from a “growth security-appliance vendor” into a “platform + subscription compound cash machine.” In 2025, services already accounted for 67% of revenue, and deferred revenue reached $7.116 billion, exceeding that year's $6.7996 billion of revenue. This business-model migration is itself a successful self-reinvention. The company did not sit on firewall hardware and harvest old profits; it actively moved its center of gravity toward high-margin, predictable subscription revenue. At the same time, it continues to extend into new forms such as Unified SASE (Q1 2026 +31%), AI-driven SecOps, and OT (+70%). That shows its evolution in response to potential disruption of the core business is ongoing, not stalled. The underlying support is a unified FortiOS and internally developed FortiASIC. This self-owned architecture gives it the ability to adapt quickly when the paradigm shifts, rather than being constrained by outside suppliers.

  The founder factor provides the willingness to reinvent. Ken Xie has led the company since 2000, and Michael Xie has served as CTO for a long time. Together they beneficially own about 17.6% (Ken Xie personally owns about 7.86% and is the largest individual shareholder, while the Xie brothers control about 15% of voting power). Founders with high ownership and long tenure are usually more willing to sacrifice short-term profit for the industry shape five to ten years out and to bet on new directions. That is the “patient capital” temperament needed for self-reinvention.

  But on “how it treats mistakes and bad news,” the record has a real blemish and must be stated honestly. According to the report and verified public court records, Fortinet faced securities class actions in 2025–2026 related to the “2026 firewall refresh cycle.” Two class actions were filed in September 2025 (case no. 3:25-cv-08037) and October in the U.S. District Court for the Northern District of California, consolidated as In re Fortinet, Inc. Securities Litigation. The class period runs from November 8, 2024 to August 6, 2025. A consolidated amended complaint was filed on April 24, 2026, asserting claims under Exchange Act Sections 10(b), 20(a), and 20A, alleging the company made misleading statements about business prospects tied to the refresh cycle. The company says the claims lack merit and will defend itself vigorously. Regardless of the final merits, the case itself shows that when communicating a key expectation such as the “refresh cycle,” management's communication with the market at least triggered a major dispute and share-price volatility. That is real-world evidence of the report's repeated warning that communication missteps can compress multiples quickly. A company with a truly mature error-correction culture should try to avoid falling into this kind of disclosure controversy.

  Overall judgment: Fortinet has delivered a real answer on self-reinvention. The successful shift from selling boxes to selling platform subscriptions, plus founders willing to bet long term, is a core asset that makes it worth long-term tracking. But on the dimension of candidly handling bad news, the ongoing refresh-cycle securities litigation is an unresolved deduction and a reminder that its disclosure discipline still needs verification. The reinvention genes are present; error-correction transparency remains to be proven. Both must be counted honestly.

  Jun 11, 2026
• QDoes management, especially the founders, have a long-term view and deep alignment with the company? Are they willing to sacrifice current profits for five to ten years from now?7/10

  A

  Bottom line: yes. Fortinet's two founders have stayed in place for a long time, own large stakes, and are deeply aligned with the company. Capital allocation, especially buybacks at low prices, shows rare discipline, making this one of its most defensible positive factors. But “willingness to sacrifice current profits for five to ten years out” appears more in sustained heavy R&D and capitalization of infrastructure than in the subscription-company pattern of deliberately depressing short-term profits for growth. Executive incentives also lean on non-GAAP measures. Both points should be retained honestly.

  The alignment is real and deep. Ken Xie has served as CEO and director since 2000, while Michael Xie has long served as president/CTO and director. As of March 31, 2026, Ken Xie beneficially owned about 72.189 million shares (9.8%), Michael Xie about 67.975 million shares (9.3%), and all current directors and executives together beneficially owned about 17.6% (third-party ownership data also show Ken Xie as the largest individual shareholder and the Xie brothers controlling about 15% of voting power). The founders have a very large portion of personal net worth tied to their own stock and have led the company for more than twenty years. This structure tightly aligns “management” with “shareholders.” The report judges that it “significantly improves alignment between management and shareholders,” and I agree.

  The strongest evidence of long-term orientation is capital-allocation discipline, especially the price sensitivity of buybacks. The report discloses that the company has been repurchasing shares since 2016. By the end of 2025, it had repurchased 267.3 million shares at a cost of $8.51 billion. In Q1 2026 it repurchased 10.60 million shares at an average price of about $77.69 per share, and after quarter-end through the 10-Q filing it repurchased another 1.90 million shares at about $77.95 per share. Compared with the reference-date price of $129.46 and the current price of about $136.70, those buybacks were clearly executed far below market price. That is rare discipline: repurchasing based on intrinsic value rather than to dress up EPS. It reduced diluted weighted shares from 838.3 million in 2020 to 764.6 million in 2025, and then to about 734 million shares at the end of Q1 2026, genuinely increasing per-share value. The board also recently raised the repurchase authorization by $1 billion, bringing cumulative authorization to $10.25 billion, effective through February 2027. On M&A, it has done Lacework, Linksys, and others, which the report describes as showing “no obvious value destruction so far.” The main line remains organic R&D rather than buying stories. That is another sign of long-termism.

  “Willingness to sacrifice near-term profit for the long term” needs honest layering. Fortinet does not look like a subscription software company that deliberately suppresses margins to buy scale. In fact, its GAAP operating margin is already 30%+, and Q1 2026 was about 31%. It is growing while earning high profits. The “sacrifice” it makes for the long term appears mainly in two areas: continued high-intensity R&D to maintain the FortiOS/FortiASIC technology lead, and capitalization of operating infrastructure. The report discloses $255.8 million of real estate purchases across the U.S., Canada, Germany, the Netherlands, and the U.K. in 2025, plus expansion of data centers/PoPs. This weighs on near-term free cash flow and raises capital-expenditure intensity, but it is aimed at long-term platform capability. That shows a willingness to invest for the long term, though not to the degree of growth companies willing to run losses for years. For more conservative investors, that is actually positive.

  Deductions to retain: in governance, Ken Xie is both chairman and CEO. Although there is a Lead Independent Director, most directors are independent, and a clawback policy exists, a very strong founder can slightly weaken external checks. In incentives, 2025 executive bonuses were mainly tied to revenue/billings/operating profit, with weights of 35/35/30. But operating income here is a non-GAAP measure that adds back stock-based compensation, interest, and foreign exchange, while stock-based compensation is a real economic cost. That makes incentives more favorable to “non-GAAP operating performance,” a blemish on the alignment spectrum.

  Overall judgment: on the Baillie Gifford dimension of founder long-termism plus alignment, Fortinet scores highly. More than twenty years of founder leadership, 17.6% beneficial ownership, and disciplined low-price buybacks are substantial. The reservations are the combined chairman/CEO role, which weakens checks somewhat, and bonuses based on non-GAAP measures. Overall, management is trustworthy and aligned with shareholders, but its market-communication quality still needs ongoing verification, as shown by the securities litigation.

  Jun 11, 2026
• QIf it disappeared tomorrow, how much would customers miss it? Is its growth sustainable and not dependent on harming society or regulation?6/10

  A

  Bottom line: if Fortinet disappeared tomorrow, customers would miss it a lot. It protects a critical security function and is deeply embedded in customers' network architecture and operating processes, making migration costly and its indispensability high. Its growth model is also healthy and sustainable: it is built on real security needs and high-margin subscriptions, does not depend on social harm or regulatory arbitrage, and instead sits with the tailwind of regulation and compliance. But its indispensability is a high-switching-cost type, not a sole-supplier monopoly where the lights go out immediately. That distinction matters.

  How high is indispensability? High, but it is “painful to replace,” not “impossible to replace.” Fortinet sells cybersecurity. If an enterprise loses firewall, SASE, threat intelligence, and security operations, it is exposed to a continuous attack surface. The report cites IBM 2025 Cost of a Data Breach, with an average global breach cost of about $4.40 million, and Verizon 2026 DBIR, whose conclusions show phishing/stolen credentials/vulnerability exploitation remain major intrusion paths. This is a continuous defense budget, not a discretionary line item that can be cut. The deeper point is embeddedness. Customers manage FortiGate, FortiAnalyzer, FortiManager, subscriptions, and support uniformly through FortiOS. Operations teams' skills, processes, and alert systems are built around it. The financial evidence for that depth of integration is Q1 2026 total deferred revenue of $7.351 billion and the report's disclosure that “90% of recognized service revenue was already in deferred revenue at the prior year-end.” So if Fortinet disappeared, customers would not just be “buying a replacement”; they would need to rebuild the architecture, migrate policies, and retrain teams. They would miss it very much.

  But the nature of “missing it” needs honest definition. Fortinet is not the sole supplier of social-infrastructure grade. The report lists many alternatives in the 10-K: Palo Alto, CrowdStrike, Zscaler, Check Point, Cisco, Microsoft, and others can provide similar capabilities. In other words, its indispensability comes from high switching costs + deep integration, not from “no one else can replace it and everything stops if it disappears.” That is materially different from the institutional sole-source indispensability of grids or payment clearing. Customers would suffer and miss it, but they could eventually migrate. That is why the report classifies the moat as composite rather than network-effect/license-based. It should not be inflated into an irreplaceable necessity monopoly.

  Is the growth model sustainable, and does it harm society or regulation, the implicit Baillie Gifford question on social/regulatory sustainability? On this side, Fortinet is almost exemplary. First, the money is earned “cleanly.” It sells defensive security capability, helping enterprises, governments, healthcare, OT, and financial institutions resist attacks. The social value is positive, and there is no business-model risk of making money by harming users or exploiting regulatory loopholes, unlike some companies built on data abuse or regulatory arbitrage. Second, regulation is a tailwind rather than a headwind. Data protection, compliance disclosure, and critical-infrastructure security rules will only get stricter, thickening Fortinet's demand base rather than threatening it. Third, growth comes from real and repeatable customer renewals and platform penetration. Service revenue accounted for 67% in 2025 and grew +13%. It is not driven by one-off demand borrowing or by damaging customer interests.

  The one point to place under “sustainability”: the report repeatedly notes channel concentration risk. Three distributors accounted for 28%/15%/12% of revenue, and six direct-procurement distributors accounted for 66%–67% of receivables. This is an operating fragility, but it is a volatility amplifier rather than a social/regulatory sustainability problem. It does not change the legitimacy of the growth model itself.

  Overall judgment: customers would miss Fortinet a great deal. It protects the security lifeline, is deeply embedded, and is expensive to switch away from. Its indispensability is real, but it is “painful to replace,” not “the only necessity.” Its growth model is healthy, sustainable, and aligned with regulatory tailwinds, and does not depend on social harm or regulatory arbitrage. That is a clear positive on the legitimacy dimension for a long-term holding. The honest boundary is that its indispensability is based on high switching costs, not institutional monopoly, and that boundary must be respected.

  Jun 11, 2026
• QHow are the unit economics of this business, including gross margin and incremental returns? Do they improve or deteriorate with scale? Where does the money it earns go?8/10

  A

  Bottom line: Fortinet's unit economics are excellent and improve with scale. High gross margins, with total gross margin around 80%, strong incremental returns, and a deferred-revenue plus negative-working-capital structure mean free cash flow has long exceeded net income. At its core, this is a capital-light cash machine. The money it earns mainly goes to buybacks at low prices, the largest use, sustained R&D, and capitalization of infrastructure. The honest discount is that it is not pure SaaS. True maintenance capex is higher than for cloud software companies, and conventional ROE/ROIC are distorted by buybacks to the point of losing meaning.

  Gross-margin structure and scale effects: the unit-economic base is very strong. The report's data show 2025 product gross margin of about 67.3%, service gross margin of about 86.8%, and total gross margin of about 80.5%; in Q1 2026, product gross margin was about 67.7% and service gross margin about 87.0%. More importantly, the structure improved. Total gross margin recovered from 75.4% in 2022 to about 80.5%–80.6% in 2024–2025, and operating margin rose from 23.4% in 2023 to 30%+ in 2024–2025 and about 31% in Q1 2026. This shows that as scale grows and the revenue mix shifts toward high-margin services (67% of revenue in 2025), unit economics improve rather than deteriorate. That is the classic platform-company pattern: the larger the scale, the sweeter the incremental dollar.

  Incremental returns and cash conversion: this is Fortinet's brightest area. For years, free cash flow has exceeded net income. In 2025, net income was about $1.853 billion, operating cash flow $2.591 billion, and free cash flow $2.212 billion. On a TTM basis through 2026Q1, net income was about $1.955 billion, operating cash flow about $2.804 billion, and free cash flow about $2.436 billion. Looking only at Q1 2026, operating cash flow reached a record $1.077 billion and free cash flow was $1.006 billion. FCF/net income has long run at 110%–200%. The root cause is two “cash engines” inside the unit economics. First is deferred revenue: customers are billed before performance obligations are fulfilled, and Q1 2026 deferred revenue was $7.351 billion, effectively a large amount of interest-free financing. Second is negative working capital, which lets growth itself release cash. The report therefore judges that ROA has risen from low double digits to nearly 20%. That is real capital efficiency, not an accounting illusion.

  Where does the money go? Capital allocation is key to the “reinvestment quality” of unit economics:

  First destination: buybacks at low prices, the largest use. By the end of 2025, the company had repurchased 267.3 million shares at a cost of $8.51 billion. In Q1 2026, it repurchased shares at an average price of about $77.69 per share, far below the current share price of about $136.70, reducing diluted shares to about 734 million at the end of Q1 2026 and genuinely increasing per-share value.

  Second destination: R&D and infrastructure. It continues investing to maintain the lead in FortiOS/FortiASIC, and capitalizes operating infrastructure, including $255.8 million of real estate purchases in 2025 and expansion of data centers/PoPs.

  The honest limits: the unit economics are strong, but there are two warnings against misreading them. First, this is not pure SaaS. The report emphasizes 2025 capex of $364.8 million, including meaningful real estate/data center/PoP investment. True maintenance capex is higher than for typical cloud software companies, so it should not be imagined as a purely software capital-light model. Second, book return metrics are distorted. Large buybacks depressed shareholder equity, even producing negative GAAP equity in 2022. Looking only at ROE/ROIC gives exaggerated figures with limited economic meaning. The report is right to focus instead on cash returns, deferred-revenue-driven capital-light features, and per-share value growth.

  Overall judgment: Fortinet's unit economics are a high-scoring item in the Baillie Gifford framework. Total gross margin of 80%, operating margin of 30%+, FCF above net income for years, unit economics that improve with scale, and cash mainly used for low-price buybacks and R&D all support per-share intrinsic value. The boundary to respect is that it is a capital-light but not pure-SaaS cash machine, and traditional ROE/ROIC should not be cited mechanically. Cash returns and per-share value growth are the right measures.

  Jun 11, 2026
• QWhat conditions must all hold for it to rise fivefold in ten years? Are those conditions realistic? What expectations are embedded in today's share price?3/10

  A

  Bottom line: for Fortinet to rise fivefold in ten years, about 17.5% annualized, three demanding conditions must hold at the same time: high growth, sustained margins, and no valuation compression. Given that its valuation has already been pushed to historical highs, the realism is low. Today's share price not only leaves no room for fivefold upside; it already embeds an optimistic expectation that high-quality growth will persist for a long time, leaving a negative margin of safety. This is the question where the report most needs cold water.

  First translate “fivefold” into conditions. A fivefold gain over ten years is about a 17.5% annualized market-cap compound rate. If the valuation multiple stays unchanged, Owner Earnings/free cash flow also need to compound at roughly 17.5% for ten years. But the report's baseline facts are that Fortinet's 2026 full-year revenue guidance implies about 15% year-over-year growth, and that includes firewall refresh-cycle benefit. The report explicitly does not extrapolate this high growth rate fully for 10 years; even the optimistic DCF case assumes only 10% growth over the first ten years. In other words, achieving a fivefold return requires growth materially above the company's guidance midpoint and the report's optimistic assumption. That is the first hard threshold.

  The conditions required for fivefold upside, none of which can be missing:

  First, revenue/Owner Earnings must sustain roughly 15%+ compound growth over the long term. That requires the hardware refresh cycle to transition smoothly without collapse, and new businesses such as Unified SASE (Q1 2026 +31%), AI-driven SecOps (+23%), and OT (+70%) to keep scaling and truly take over after hardware rolls over.

  Second, margins must not deteriorate. Product/service gross margins of about 67%/87% and a 30%+ operating margin must hold under price competition and bundling pressure from PANW, CRWD, and ZS.

  Third, and hardest, the valuation multiple must not compress. This is precisely the most unfavorable part. On the report's reference date, FTNT already traded at about 39.5 times TTM free cash flow and about 44.7 times conservative Owner Earnings. For a fivefold return over ten years, the market would still need to grant the same or even a higher multiple ten years later. Multiple expansion from historical highs is a low-probability event.

  What expectations are embedded in today's price, the core Baillie Gifford Q9 question, which must be quantified: the share price embeds optimistic pricing that high-quality growth will persist, not any undervaluation. There are three layers of evidence. First, the report's reference-date price of $129.46 was already “near or even above the top end of the optimistic case,” about $114 with an optimistic range of $110–$130, versus a conservative intrinsic value of only $50–$65 and fair value of $75–$95. Second, more seriously, the price kept rising: FTNT set an all-time high of $150.07 on June 4, 2026, and was about $136.70 on June 10, with market cap about $10.14 billion, after rising more than 80% at one point year to date. That means the current price has reached or even exceeded the top end of the report's optimistic case, with the market treating that optimistic case as the base case. Third, the starting owner-earnings yield is only about 2.2%–2.5%, clearly below the 10-year Treasury yield of about 4.57%. You have to believe it can compound that 2%–3% starting point into sufficiently high long-term returns to justify buying today.

  The honest bear case is consistent with the conclusion. The report's strongest counterargument says that if the refresh-cycle benefit passes and product revenue falls to the low-to-mid single digits, stable service revenue still may not support a valuation near 40 times FCF. In that case, investors will have bought “a high-quality asset at a high price, with returns mainly dragged down by multiple compression.” The report even gives a worst case: if the market reprices it from a high-quality growth stock into an ordinary mature security company, a long-term 30%–50% share-price drawdown is “not unimaginable.”

  Overall judgment: a fivefold return in ten years requires the demanding triple condition of high growth + sustained margins + no multiple compression, and the third condition, multiple expansion or stability from historical highs, is the least realistic. Today's share price does not leave a margin of safety for fivefold upside; it already sits above the report's optimistic range and embeds an expectation that high-quality growth will continue for a long time. This is a classic good company, bad price. Baillie Gifford values upside imagination, but at this price, the blue-sky imagination has already been paid for in advance, and the odds of fivefold upside are unattractive.

  Jun 11, 2026
• QWhy has the market not realized all this yet? Is it too hard to understand, too easy to dismiss, or too far out? What will become the “narrative inflection point”?3/10

  A

  Bottom line: for Fortinet, this question needs to be reversed. The market has not failed to recognize its quality; it has already recognized it fully, perhaps excessively. Its high quality is clear to investors and already priced into the stock. There is almost no cognitive-arbitrage benefit from the market failing to understand, respect, or look far enough. It is closer to “widely known excellence + widely known high price.” The narrative inflection point is therefore more likely to be downward, through growth slowing or the refresh-cycle thesis being disproven, rather than upward through value re-rating.

  Why “the market has already realized it,” and why the direction of the perception gap is negative: the classic Baillie Gifford Q10 upside comes from underestimation caused by the market not understanding, dismissing, or not looking far enough. Fortinet's reality is the opposite. First, it is not an obscure stock: FTNT hit an all-time high of $150.07 on June 4, 2026, was about $136.70 on June 10, with a market cap of about $10.14 billion, and at one point was up more than 80% year to date. Second, the valuation is a “quality premium,” not a “value discount”: on the report's reference date it was already about 39.5 times TTM free cash flow, about 44.7 times conservative Owner Earnings, and 50.2 times GAAP PE, with the current price even higher. Third, the report explicitly characterizes it as “now more like a quality-premium stock than a value-discount stock” and says “the easiest mistake is to confuse excellence with cheapness.” So there is no perception gap from the market failing to understand or respect it. The market sees its quality clearly and is already willing to pay a high price. This must be stated honestly; an imaginary “undiscovered gem” narrative should not be fabricated.

  The only possible mild difference in perception is relative positioning versus peers. The report notes that PANW FY2026 P/E is about 164 times and CRWD remains GAAP loss-making (FY2026 revenue $4.81 billion, ARR $5.25 billion, +24%). By contrast, Fortinet is a steadier asset with real profitability, strong cash flow, and a net-cash balance sheet, with FY2026 revenue guidance of $7.71–$7.87 billion, +15%. In the “cybersecurity platform” basket, the market may not fully reward Fortinet's combination of lower growth than the most aggressive players but materially stronger profitability and cash-flow quality. But that is a mild relative-valuation difference, far too small to support an absolute-undervaluation thesis, and Fortinet's own valuation is still materially above mature cash cows such as Check Point, with 5% growth and a 40% operating margin.

  What could become the “narrative inflection point,” the implicit Baillie Gifford Q10 question; for Fortinet, the inflection is more likely downward:

  Downward inflection points, which deserve more attention and have higher probability: first, the refresh cycle being disproven. If Q1 2026 product revenue +41% is shown to be pulled-forward demand and then falls to the low-to-mid single digits, the market will immediately question the “growth stock” narrative. Second, securities litigation deepening. If the class action around the “2026 firewall refresh cycle” (class period 2024-11-08 to 2025-08-06) reveals deeper disclosure problems, it would directly damage management credibility and compress the multiple. Third, simultaneous slowing in service/deferred revenue would show platform stickiness is weaker than expected. Any of these could reprice the company from “high-quality growth stock” to “ordinary mature security company,” and the report estimates that a long-term 30%–50% share-price drawdown would “not be unimaginable.”

  Upward inflection points exist but require a higher bar. If SASE/SecOps/OT scaling proves that the second curve can independently take over after the hardware cycle rolls over and keep overall growth in the double digits, the market may be willing to fully re-rate Fortinet from a “cyclical hardware vendor” into a “perpetual platform cash machine.” But at a price already above the optimistic range, much of that upside re-rating has already been prepaid.

  Overall judgment: Fortinet does not fit the classic “market has not realized it yet” perception-gap pattern. Its quality is already fully priced, and the stock has even hit all-time highs above the report's optimistic range. The perception gap leans negative. The only mild disagreement is whether its earnings and cash-flow quality are sufficiently rewarded relative to peers, but that is not enough to support an undervaluation case. The more realistic narrative inflection point is downward: the refresh cycle being disproven, securities litigation deepening, or service revenue slowing. Any one of these could trigger multiple compression. At this price, the odds are asymmetrically tilted toward downside risk rather than undiscovered upside.

  Jun 11, 2026