Fortinet is one of the largest cybersecurity companies in the world, but understanding how Fortinet makes money requires looking beyond the headline revenue number. The company operates across hardware appliances, software subscriptions, and security services, and each segment contributes differently to growth and profitability. Breaking down Fortinet's revenue streams gives investors a clearer picture of where the business is heading and how it stacks up against peers like Palo Alto Networks and CrowdStrike.
Key takeaways
- Fortinet's business model combines hardware appliance sales with recurring software subscriptions and security services, creating a blended revenue profile that balances upfront revenue with long-term contracts.
- The company's FortiGate firewall platform is the anchor product, but subscription and services revenue has been growing as a share of total revenue over time.
- Fortinet's integrated approach (building its own chips and operating system) gives it a cost structure advantage that most competitors don't have.
- Comparing Fortinet's revenue mix to CrowdStrike or Palo Alto helps clarify why these stocks trade at different valuations despite all being "cybersecurity companies."
How does Fortinet make money? The two main revenue buckets
Fortinet reports revenue in two broad categories: product revenue and service revenue. Product revenue comes primarily from selling FortiGate network security appliances, which are physical and virtual firewall devices. Service revenue includes two components: FortiGuard security subscriptions (threat intelligence, antivirus, web filtering, and other security updates) and FortiCare technical support contracts.
Here's the thing about Fortinet's revenue streams: the product side tends to be lumpier and more cyclical because it depends on enterprises buying or upgrading hardware. The service side is more predictable because once a customer installs a FortiGate appliance, they typically subscribe to FortiGuard and FortiCare for ongoing protection and support. That recurring revenue base has been growing as a percentage of total revenue for years, which matters for valuation.
Recurring revenue: Revenue that a company can expect to receive on a regular, ongoing basis, typically from subscriptions or service contracts. For investors evaluating Fortinet, the mix of recurring versus one-time revenue affects how predictable future cash flows are.
The Fortinet business model: Why building your own chips matters
Most cybersecurity companies are pure software businesses. Fortinet is not. The company designs its own custom chips called ASICs (Application-Specific Integrated Circuits) and runs its own proprietary operating system, FortiOS. This vertical integration is unusual in the industry and has real financial implications.
By designing its own silicon, Fortinet can deliver higher performance at lower price points than competitors who rely on generic processors. That translates into strong gross margins on the hardware side, which is rare. Typically, hardware margins are thin. Fortinet's approach lets the company sell appliances profitably while undercutting competitors on price-performance, which helps it win deals in the mid-market and with cost-conscious enterprises.
The trade-off is that this model requires ongoing R&D investment in chip design and manufacturing relationships. But the payoff shows up in gross margin percentages that are competitive with software-only peers, even though Fortinet ships physical boxes. If you want to dig into Fortinet's financials yourself, the FTNT research page on Rallies.ai is a good starting point.
What are Fortinet's biggest revenue segments?
Let's break this down more specifically. Fortinet's revenue segments can be understood in layers:
- FortiGate appliance sales (product revenue): Physical and virtual firewalls sold to enterprises, service providers, and government agencies. This is the entry point for most customer relationships.
- FortiGuard security subscriptions: Ongoing threat intelligence and security services that run on top of FortiGate hardware. Think antivirus, intrusion prevention, web filtering, and sandboxing. These subscriptions renew annually or on multi-year terms.
- FortiCare support contracts: Technical support, firmware updates, and hardware replacement services. Another recurring revenue stream tied to the installed base.
- Adjacent products and platforms: Fortinet has expanded into adjacent areas like SD-WAN, cloud security, secure access service edge (SASE), endpoint protection, and security operations (SecOps). Many of these are sold as additional subscriptions layered onto existing customer relationships.
The installed base dynamic is worth paying attention to. Every FortiGate appliance sold creates a customer who will likely pay for subscriptions and support for years. As Fortinet's installed base grows, the recurring revenue pool expands, even during periods when hardware sales slow down.
How FTNT makes money compared to CrowdStrike and Palo Alto
Understanding how FTNT makes money is easier when you compare the Fortinet business model to its two most prominent competitors.
CrowdStrike is almost entirely a cloud-native, subscription-based software company. It has no hardware revenue. Its Falcon platform runs in the cloud and charges per endpoint. This gives CrowdStrike very high gross margins and extremely predictable revenue, but it competes in a different part of the cybersecurity market (endpoint and cloud security) than Fortinet's core firewall business.
Palo Alto Networks is the closest comparison. Like Fortinet, Palo Alto started as a next-generation firewall company selling hardware appliances. Over time, Palo Alto has aggressively shifted toward software and cloud-delivered security (Prisma Cloud, Cortex). Palo Alto's product revenue has been declining as a share of total revenue while its subscription and support revenue grows.
Fortinet sits somewhere between these two. It still generates meaningful hardware revenue, but its subscription and services revenue has been taking a larger share over time. The question for investors is how fast that transition happens and what it means for margins. Pure software models typically command higher valuations because of their margin profiles and revenue predictability.
Net revenue retention rate: A metric that measures how much revenue a company keeps and expands from its existing customer base over time, after accounting for churn and downgrades. Comparing this metric across cybersecurity companies helps you gauge who's best at growing within their installed base.
What's driving Fortinet's growth?
Several factors contribute to Fortinet's revenue growth trajectory. Not all of them are obvious from the top-line number.
The firewall refresh cycle
Enterprises typically replace firewall hardware every three to five years. Fortinet has a large installed base, and as those appliances age, customers either upgrade to newer FortiGate models or switch vendors. Refresh cycles create periodic spikes in product revenue. Between refresh cycles, growth leans more heavily on subscriptions.
Platform consolidation
Fortinet has been pushing what it calls the "Fortinet Security Fabric," which is an integrated platform that ties together firewalls, switches, access points, endpoint agents, and cloud security under a single management console. The pitch to customers is: buy more of your security from one vendor, reduce complexity, and lower costs. When this works, it increases the average revenue per customer.
SD-WAN and SASE expansion
Fortinet has become one of the top SD-WAN vendors globally, largely because its FortiGate appliances already sit at branch offices and can run SD-WAN functionality without additional hardware. This has opened a new revenue stream and a new competitive angle against both traditional WAN vendors and cloud-first SASE players.
Geographic and market expansion
Fortinet has historically been strong in the mid-market and with smaller enterprises. The company has been investing in moving upmarket to win larger enterprise and service provider deals, which tend to carry higher contract values. Geographic expansion into Asia-Pacific, EMEA, and Latin America also contributes to growth.
If you want to explore how Fortinet compares to other cybersecurity stocks on specific financial metrics, the Rallies.ai Vibe Screener lets you filter and compare companies side by side.
How to evaluate Fortinet's revenue mix as an investor
When you're researching how Fortinet makes money, pay attention to a few specific things in their financial reports:
- Service revenue as a percentage of total revenue. A rising percentage suggests the business is becoming more recurring and predictable. This is generally viewed favorably by the market.
- Billings growth versus revenue growth. Fortinet reports billings, which include amounts billed for multi-year contracts upfront. Billings growth can be a leading indicator of future revenue, especially for subscription businesses.
- Gross margin trends. Watch whether gross margins expand as the revenue mix shifts toward services. Hardware typically carries lower margins than software subscriptions.
- Free cash flow margins. Fortinet has historically generated strong free cash flow relative to revenue. This partly reflects the upfront billing on multi-year contracts, which creates favorable working capital dynamics.
Billings: The total value invoiced to customers in a period, including upfront payments on multi-year deals. For subscription-heavy companies like Fortinet, billings growth can signal future revenue trends before they show up in GAAP revenue.
Investors sometimes focus too much on product revenue trends without understanding that a slowdown in hardware sales might coincide with an acceleration in higher-margin subscription revenue. The business model is shifting, and looking at any single line item in isolation can be misleading. For a broader look at how to analyze cybersecurity stocks, the stock analysis guides on Rallies.ai offer frameworks that apply across the sector.
Risks to the Fortinet business model
No business model analysis is complete without looking at what could go wrong. A few risks worth considering:
- Cloud migration pressure: As enterprises move workloads to the cloud, the need for on-premises firewall appliances could decline. Fortinet is investing in cloud security, but competitors like Palo Alto and Zscaler have a head start in certain cloud-native segments.
- Platform competition: Both Palo Alto and CrowdStrike are aggressively building platform plays that compete with Fortinet's Security Fabric strategy. If customers consolidate around a competitor's platform, Fortinet could lose cross-sell opportunities.
- Hardware cyclicality: Because Fortinet still depends meaningfully on appliance sales, the company's quarterly results can be more volatile than pure-play software peers. Refresh cycles create boom-and-bust patterns in product revenue.
- Pricing pressure: Fortinet's value proposition partly rests on offering competitive pricing. If competitors match Fortinet's price-performance or if Fortinet's ASIC advantage narrows, margins could compress.
These are factors to research, not reasons to avoid the stock. Every business model has vulnerabilities, and knowing them is part of doing your own homework.
Try it yourself
Want to run this kind of analysis on your own? Copy any of these prompts and paste them into the Rallies AI Research Assistant:
- Break down how Fortinet makes money — what are their main revenue streams, how does their business model work, and what's driving their growth compared to other cybersecurity companies like Palo Alto or CrowdStrike?
- Break down how Fortinet makes money — what are their biggest revenue streams and what's growing fastest?
- Compare Fortinet's gross margins and revenue mix to Palo Alto Networks and CrowdStrike. Which business model looks most durable?
Frequently asked questions
What are Fortinet's main revenue streams?
Fortinet generates revenue from two primary categories: product revenue (mostly FortiGate firewall appliance sales) and service revenue (FortiGuard security subscriptions and FortiCare technical support contracts). Service revenue is the larger and faster-growing portion of the business, driven by the expanding installed base of FortiGate devices that require ongoing subscriptions.
How does the Fortinet business model differ from CrowdStrike's?
Fortinet sells both hardware appliances and software subscriptions, while CrowdStrike is a cloud-native, software-only platform. Fortinet designs its own chips and ships physical devices, giving it a cost structure advantage in network security. CrowdStrike focuses on endpoint and cloud workload protection with a pure subscription model. They compete in overlapping but distinct parts of the cybersecurity market.
Is Fortinet a hardware or software company?
Fortinet is both, but the mix is shifting toward software and services over time. The company still designs and sells physical firewall appliances, which differentiates it from pure software peers. However, subscription and support revenue has been growing as a share of total revenue, making Fortinet's financial profile increasingly resemble a software business with a hardware component.
How does FTNT make money from SD-WAN?
Fortinet integrates SD-WAN functionality into its FortiGate appliances, so customers can use the same device for both firewall and SD-WAN purposes without buying separate hardware. This generates revenue through appliance sales and associated subscription services. It also helps Fortinet win deals against traditional WAN vendors and positions the company in the growing SASE market.
What is Fortinet's competitive advantage?
Fortinet's main competitive advantage is its vertical integration. The company designs custom ASIC chips and its own operating system (FortiOS), which allows it to deliver higher network security performance at lower price points than competitors using off-the-shelf components. This drives strong gross margins on hardware and helps Fortinet compete aggressively on price-performance in the firewall market.
How does Fortinet's revenue mix affect its valuation?
Investors generally assign higher valuation multiples to recurring software revenue than to hardware revenue because subscriptions are more predictable and carry higher margins. As Fortinet's service revenue grows as a percentage of total revenue, the market may reward the stock with a higher multiple over time. Tracking this mix shift is one of the more useful exercises when evaluating FTNT. You can explore valuation comparisons across cybersecurity stocks using the thematic portfolios on Rallies.ai.
Bottom line
Understanding how Fortinet makes money comes down to seeing the interplay between hardware appliance sales and a growing base of recurring subscription and support revenue. The company's custom chip design gives it an unusual cost advantage, and its platform expansion into SD-WAN, SASE, and cloud security opens new growth paths. But the hardware component adds cyclicality that pure software competitors don't face.
If you're researching Fortinet or comparing it to other cybersecurity companies, focus on the revenue mix shift, billings trends, and margin trajectory rather than any single quarter's numbers. For more frameworks on analyzing individual stocks, explore the stock analysis resource hub on Rallies.ai.
Disclaimer: This article is for educational and informational purposes only. It does not constitute investment advice, financial advice, trading advice, or any other type of advice. Rallies.ai does not recommend that any security, portfolio of securities, transaction, or investment strategy is suitable for any specific person. All investments involve risk, including the possible loss of principal. Past performance does not guarantee future results. Before making any investment decision, consult with a qualified financial advisor and conduct your own research.
Written by Gav Blaxberg, CEO of WOLF Financial and Co-Founder of Rallies.ai.