{
  "@context": "https://orbyd.app/schemas/dossier.v1.json",
  "ticker": "FTNT",
  "name": "Fortinet, Inc.",
  "url": "https://orbyd.app/dossiers/FTNT/",
  "json_url": "https://orbyd.app/dossiers/FTNT.json",
  "status": "DORMANT",
  "current_conviction": "MEDIUM",
  "graded_conviction": null,
  "archetype": {
    "code": "a3",
    "n": 3
  },
  "current_thesis": "Q2 landed early (2026-07-29) and resolved up: revenue $2.047B vs ~$1.89B consensus, product revenue +52% YoY, FY26 guide raised to $8.020–8.180B and EPS to $3.41–3.47. But twelve desks lifted targets on 2026-07-30 with zero rating upgrades, the 44-analyst mean of $159.51 sits under the $161.95 close, and the 07-30 gap to $169.26 was sold to $154.25. Narrative MATURING; nothing company-dated until the Q3 print.",
  "invalidation_trigger": "A weekly close below $150 loses the rising 50-day line and the 2026-07-21 to 2026-07-28 closing band, putting price back under the June all-time high of $151.97; secondary break if the 2026-07-15 high of $170.35 goes unreclaimed while CIBR/HACK/BUG lose their 2026 highs into the late-August PANW and CRWD prints.",
  "catalyst_date": "2026-08-12",
  "outcome": "OPEN",
  "outcome_date": null,
  "invalidation_fired": null,
  "themes": [
    "cybersecurity",
    "ai-datacenter-infrastructure"
  ],
  "tags": [],
  "sources": [],
  "notes": [
    "Fortinet pays no dividend; capital return is buybacks only - $972.8M repurchased in H1 2026 covering 12.5M shares, alongside $500M of senior notes repaid.",
    "CEO Ken Xie sells under a Rule 10b5-1 plan adopted 2024-12-09, so recurring Form 4 prints are pre-arranged and their timing carries no signal about his current view.",
    "Founder concentration is extreme: after the 2026-06-02 Form 4, Ken Xie held 52,972,372 shares directly plus 4,848,774 indirectly through his spouse.",
    "Fortinet guides billings alongside revenue and the buy side trades the billings line: FY26 billings guide $9.350-9.550B, total deferred revenue $7.68B at 2026-06-30.",
    "Management flagged price increases with an approximately high-single-digit impact on H2 2026 billings, so part of the raised second-half guide is price rather than units.",
    "FortiBleed is a credential-harvesting campaign against exposed device configurations rather than a patchable CVE; no vendor fix retires it, so it can resurface in headlines."
  ],
  "body_markdown": "## Current Thesis\n\nThe binary this coverage had pencilled in for ~2026-08-12 arrived two weeks early and resolved upward. Fortinet reported Q2 2026 after the close on 2026-07-29: revenue $2.047B (+26% YoY) against a Street consensus near $1.89B, product revenue $773M (+52% YoY, versus roughly +41% in Q1 2026), billings $2.372B (+33% YoY), non-GAAP EPS $0.90 against $0.75 expected. The FY2026 revenue guide moved from $7.710–7.870B to $8.020–8.180B and the non-GAAP EPS guide from $3.10–3.16 to $3.41–3.47, against $3.16 consensus. Non-GAAP operating margin printed a record 38.0%, up 490bps YoY, on Q2 free cash flow of $966M.\n\nThat re-bases what is being bought. Through the 2026-07-12 update the argument rested on momentum, product headlines and an unresolved print; it now rests on a filed set of numbers and a guide lifted at both ends. The unresolved half is price. On 2026-07-30 the shares opened $164.00, traded to $169.26 and closed $154.25 on 10.67M shares — the heaviest session of July, and the best fundamental news of the year ending below where it opened. 2026-07-31 repaired most of it (+4.99% to $161.95), but the 2026-07-15 intraday high of $170.35 still stands, and after twelve target raises on 2026-07-30 the 44-analyst mean target of $159.51 remains below the last close. The numbers re-accelerated; the ratings did not move.\n\n## Bull Case\n\n- **The Q2 beat was wide across the P&L** (2026-07-29): revenue $2.047B (+26% YoY) vs ~$1.89B consensus, non-GAAP EPS $0.90 vs $0.75, billings $2.372B (+33% YoY), GAAP diluted EPS $0.82 (+44% YoY).\n- **Product revenue re-accelerated to +52% YoY** ($773M in Q2) from roughly +41% in Q1 2026 — the hardware line that carries the AI-datacenter refresh and OT arguments got faster three quarters into the cycle.\n- **Guide raised at both ends** (2026-07-29): FY26 revenue $8.020–8.180B (~19% growth) from $7.710–7.870B against $7.81B consensus; non-GAAP EPS $3.41–3.47 from $3.10–3.16; billings $9.350–9.550B; non-GAAP operating margin 35–37%. Q3 guide of $2.010–2.100B revenue and $0.83–0.87 EPS both sit above the Street's $1.95B / $0.76.\n- **Cash conversion stepped up**: Q2 operating cash flow $1.043B, free cash flow $966M, record 38.0% non-GAAP operating margin; H1 2026 buybacks of $972.8M covering 12.5M shares, plus $500M of senior notes repaid.\n- **Demand breadth on the 2026-07-29 call**: Secure Networking +34%, Unified SASE +35%, AI-driven Security Operations +25%, OT billings +55%; management cited an eight-figure AI data-center win and a seven-figure OT contract with a utility, and put \"SASE firewall\" quarterly billings at $2B.\n- **The price stack moved up**: 2026-07-30 raises included BTIG $186→$203 (Buy), Rosenblatt $195 (Buy), Barclays $170→$190, Citi $185, RBC $185, Cantor $185, Piper $175, Stifel $175. TD Cowen carried $215 (Buy) into the print; the high target on the tape is $220.\n\n## Bear Case\n\n- **Twelve targets went up on 2026-07-30 and no rating went with them.** Citi, Cantor, Piper and Susquehanna stayed Neutral, RBC Sector Perform, Barclays and Morgan Stanley Equal-Weight, Stifel Hold, Evercore In-Line, Wells Fargo Underweight. Consensus across 44 analysts is Hold.\n- **Price sits above the mean target.** $159.51 mean and $165 median against the $161.95 close (2026-07-31). Morgan Stanley's raised target is $136 and Wells Fargo's is $135, both below spot; the low on the tape is $86.\n- **The beat was sold.** 2026-07-30 open $164.00, high $169.26, close $154.25 on 10.67M shares against a ~4–5M July norm. Marking targets to a price the market rejected on the day is catch-up, and it left the buyer of the news underwater intraday.\n- **The multiple carries the risk**: trailing P/E 57.23, forward P/E 46.21, 15.79x sales, $118.82B market cap (2026-08-01) on a guide of ~19% revenue growth.\n- **Part of the second-half raise is price.** Management flagged price increases with an approximately high-single-digit impact on H2 2026 billings on the 2026-07-29 call — a lever that can pull orders into Q3 and leave a harder 2027 compare.\n- **FortiBleed is unresolved and unpatchable.** Credentials were harvested from ~86,644 unique FortiGate devices across 194 countries — roughly half of internet-facing Fortinet firewalls — with verified working admin credentials estimated at 30,000–75,000 devices; CISA issued a hardening alert 2026-06-18 and the campaign has run since at least February 2026. No numbers were hit through Q2 and the 2026-07-29 call did not address it. The exposure is configuration and credential hygiene, so no vendor patch retires it.\n- **Retail-system coverage keeps arriving**: Zacks Tech Innovators buy 2026-07-31, IBD SwingTrader buys 2026-05-29 and 2026-06-25, and \"$100/$1,000 invested X years ago\" pieces on 2026-05-13, 2026-05-28 and 2026-06-30.\n\n## Setup & Price Structure\n\n- **Last close** $161.95 (2026-07-31, +4.99% on the session). **52-week range** $70.12–$170.35; the intraday all-time high $170.35 was set 2026-07-15, the highest daily close was $166.83 on 2026-07-14. **Market cap** $118.82B, **shares outstanding** 733.71M.\n- **Moving averages** (2026-08-01): 50-day $149.67, 200-day $100.54. Price is above both. The 52-week price change of +59.23% and the distance to the 200-day show how much of this structure was built in 2026.\n- **The July base**: after the 2026-07-15 high, daily closes compressed into $149.98–$158.10 between 2026-07-21 and 2026-07-28, and 2026-07-29 traded down to $143.77 intraday before the release. That band, plus the June all-time high of $151.97 the July advance converted into support, is the shelf the post-print rally is standing on.\n- **The overhead**: $169.26 (2026-07-30 rejection high) and $170.35 (2026-07-15 high). Neither has been closed above; the highest close since is $161.95.\n- **Narrative life-cycle: MATURING.** Dating it — the theme went mainstream in May 2026 (cyber ETFs at record highs 2026-05-21, the 2026-05-20 CNBC segment naming FTNT, PANW and CRWD together), coverage broadened to 44 analysts with a Hold consensus, and the 2026-07-29 print refreshed the fundamental clock without producing a single rating upgrade. Well known, still working, flow moderating rather than expanding. That is a step back from the SATURATED label carried on 2026-07-12: the print supplied genuinely new information, which a saturated narrative does not get.\n- **Crowding and positioning observables**: price above a rising 50-day of $149.67; short interest 14.49M shares, 2.35% of float (2026-08-01), so there is no squeeze fuel in the structure; the company itself repurchased $972.8M of stock in H1 2026.\n- **No company catalyst inside 30 days.** The Q2 10-Q was filed 2026-07-30. The next Fortinet-specific dated event is the Q3 2026 print, early November 2026 (est.).\n\n## Catalyst Calendar (next 30 days)\n\n- **~2026-08-24 (est.) — Palo Alto Networks FQ4 2026 results.** Date unconfirmed; sources place it between 2026-08-17 and 2026-08-24. The nearest read-across on enterprise firewall and platform demand, and the first check on whether Fortinet's +33% billings was company-specific or sector-wide.\n- **~2026-08-26 (est.) — CrowdStrike FQ2 2027 results.** Date unconfirmed; historical pattern places it 2026-08-26 to 2026-08-28. Second sector datapoint into the same window.\n- **Nothing company-dated.** Between 2026-08-01 and 2026-08-31 there is no scheduled Fortinet event that resolves anything in this thesis — no print, no filing (the Q2 10-Q went in 2026-07-30), no guided investor day. The next one is Q3 2026 results, early November 2026 (est.).\n\n## What Would Change Our Mind\n\nThe unfinished business is 2026-07-30. A 26% revenue beat and a raised full-year guide bought an open at $164.00, a run to $169.26 and a $154.25 close on the heaviest volume of the month. Until $170.35 is taken out on a closing basis, that session stands as the market's price on the best news available, and the $159.51 mean target says the desks that raised numbers still value the shares below where they trade.\n\nThe gradeable break is a weekly close below $150. That level does three things at once: it loses the rising 50-day, which stood at $149.67 on 2026-08-01; it cuts through the 2026-07-21 to 2026-07-28 closing band of $149.98–$158.10; and it puts price back under the June all-time high of $151.97 that the July advance turned into support. Below there, the next structural reference is the early-June breakout shelf in the low $130s.\n\nTwo secondary conditions would end the leg without that close. First, the theme flipping to SATURATED — CIBR, HACK or BUG breaking their 2026 highs while FTNT prints successive lower highs into the late-August PANW and CRWD reports. Second, FortiBleed converting from a headline into a disclosed commercial event: an 8-K, a named government or critical-infrastructure loss, or management trimming the $5.180–5.220B FY26 service-revenue line at the Q3 print.\n\nWhat would strengthen the case: a weekly close above $170.35 on volume exceeding the 10.67M shares traded 2026-07-30, and at least one desk moving from Hold to Buy instead of only lifting a target.\n\n## Correlation Notes\n\n- **Sector beta dominates.** FTNT trades inside the CIBR/HACK/BUG complex alongside PANW and CRWD; the 2026-05-20 CNBC segment grouped the three explicitly and the trio has moved as one book since cyber ETFs were framed at record highs on 2026-05-21. Five-year beta 1.06.\n- **The August read-across runs one way.** Fortinet reported first (2026-07-29), so PANW (~2026-08-24 est.) and CRWD (~2026-08-26 est.) will be read against its +33% billings. A soft guide from either re-rates the group's multiple with no new Fortinet information.\n- **The AI-datacenter linkage now has a dollar figure attached**: an eight-figure AI data-center win cited on the 2026-07-29 call and product revenue +52% YoY. That ties the product line to enterprise and hyperscaler buildout spending, and to the same capex-digestion risk the networking names carry.\n- **Index flow is reflexive.** CIBR, the largest fund in the complex, was reported at ~$14.4B with a 32% year-to-date return in June 2026 coverage and is market-cap weighted, so FTNT's own appreciation raises its weight — amplifying moves in both directions.\n- **Positioning is not the driver.** At 2.35% of float short (2026-08-01), moves here come from fundamental flow and index weight, with no meaningful short base to squeeze.",
  "first_seen": "2026-05-19",
  "last_analyzed": "2026-08-01T09:16:25+00:00",
  "last_synthesized": "2026-08-01",
  "last_update_source": "watchlist_research",
  "license": "Content © orbyd. Cite the canonical URL."
}