Fortinet (FTNT) Q2 2025: SASE and SecOps Billings Jump 21% and 31%, Driving Platform Upsell Momentum

2025-08-06 | By EarningsIQ Research

Fortinet’s Q2 2025 results highlight accelerating traction in unified SASE and SecOps, with billings growth outpacing legacy firewall upgrades and fueling a more diversified revenue base. The company’s platform approach is winning large enterprise deals, while infrastructure investments and channel incentives are strategically aligned for long-term value capture. Management’s raised billings outlook signals confidence, but investors must parse the evolving service mix and the real impact of the ongoing firewall refresh cycle on future growth composition.

Summary

• Large Enterprise Upsell: Fortinet’s integrated platform is driving record $1M+ deals and cross-sell velocity.
• SASE and SecOps Acceleration: Unified SASE and SecOps billings now comprise over a third of total billings, outgrowing core firewall.
• Post-Refresh Growth Levers: Platform expansion and AI-driven security position Fortinet beyond the current hardware upgrade cycle.

Performance Analysis

Fortinet delivered double-digit growth across billings and revenue, with total billings up 15% and revenue up 14% year-over-year, outpacing guidance on both fronts. The core driver was a surge in large enterprise activity, as deals over $1 million increased more than 50% in value, reflecting the company’s success in winning complex, multi-product deployments. Notably, Unified SASE (Secure Access Service Edge, cloud-delivered security platform) billings grew 21% and SecOps (Security Operations, automation and AI-driven security management) billings grew 31%, now representing 24% and 11% of total billings, respectively.

Product revenue, led by upgrade buying and operational technology (OT, industrial and infrastructure security), rose 13%, while service revenue climbed 14%. EMEA led geographic growth at 18%, while Americas and APAC each grew 11%. Gross margin improved 10 basis points to 81.6%, with operating margin at 33.1%, reflecting disciplined cost control despite continued investment in infrastructure and sales headcount. Free cash flow generation remained robust, supporting $401 million in share repurchases this quarter.

• Enterprise Expansion: $1M+ deal value up 51%, underlining platform consolidation wins.
• Recurring Revenue Mix: Unified SASE ARR up 22% to $1.15B, SecOps ARR up 35% to $463M.
• Infrastructure Investment: $168M spent this quarter, supporting FortiCloud and new SaaS services.

Current RPO (Remaining Performance Obligations, a proxy for future revenue) grew 15% to $3.45B, indicating a durable pipeline as platform adoption deepens. The firewall refresh cycle remains a contributor but is increasingly overshadowed by SaaS and security operations growth.

Executive Commentary

Strategic Positioning

1. Platform-Led Upsell and Customer Journey

Fortinet’s platform approach—anchored by FortiGate firewall, SD-WAN (software-defined networking), and FortiSASE—enables cross-sell and upsell across its customer base. Over 90% of SASE customers originated from the firewall base, with more than half leveraging SD-WAN. This journey supports a higher average deal value and stronger long-term customer retention, as enterprises consolidate networking and security under a unified operating system.

2. SASE and SecOps as Growth Engines

Unified SASE and SecOps are now the fastest-growing segments, together accounting for 35% of billings, with SASE customer count up 65% and SecOps ARR surging 35%. Fortinet’s integrated SASE firewall and native cloud services differentiate the offering, while sovereign SASE (localized, carrier-driven SASE) is emerging as a key competitive moat, particularly in regulated and data-sensitive industries.

3. Infrastructure and AI Investment

Ongoing infrastructure build-out—$2 billion cumulative investment—underpins Fortinet’s ability to deliver SaaS, cloud, and AI-driven services at scale, with a footprint spanning 5 million square feet globally. AI innovation, with over 500 patents, is increasingly embedded in both product (AI Protect, AI Assist) and operations (AIOps), driving both product differentiation and operational leverage.

4. Channel and Go-to-Market Alignment

Channel incentives and direct sales investments are tightly aligned to multi-product and platform adoption, rewarding partners for cross-sell and new product introduction. This has supported robust SMB and enterprise expansion, with over 6,900 new customers added and strong growth in the financial services vertical.

5. Firewall Refresh and Post-Cycle Growth

Management estimates 40-50% completion of the 2026 firewall refresh cohort, but emphasizes that the impact is modest relative to overall business scale. The focus is on leveraging upgrade discussions to drive broader platform upsell—particularly SASE and SecOps—rather than relying on hardware replacement as a primary growth lever.

Key Considerations

Fortinet’s Q2 performance underscores a strategic pivot from legacy hardware cycles to cloud and platform-driven growth. Investors should weigh these dynamics as the business mix evolves:

Key Considerations:

• SASE and SecOps Outpacing Core Firewall: These segments are now central to growth, with rising ARR and customer adoption.
• Platform Stickiness Drives Upsell: Integrated OS and cross-product journeys deepen customer lock-in and expand wallet share.
• Infrastructure Investment Fuels Scale: Proprietary infrastructure supports SaaS, cost advantage, and data sovereignty—key for regulated verticals.
• Service Revenue Mix Shift: Service revenue growth lags product, reflecting both deferred COVID-era revenue recognition and evolving attach rates; investors must parse the sustainability of this mix.
• Channel and Direct Sales Execution: Go-to-market alignment is critical as Fortinet targets larger, more complex deals and multi-product adoption.

Risks

Fortinet faces potential risks from macroeconomic uncertainty, evolving customer refresh cycles, and competitive encroachment in SASE and cloud security. Service revenue growth is decelerating as deferred COVID-era contracts roll off, and future growth will depend on successful upsell and platform expansion. Infrastructure investment, while a strategic advantage, could pressure margins if SaaS adoption underperforms expectations or if competitive pricing intensifies. Regulatory shifts, particularly around data sovereignty, could also impact the pace and profitability of sovereign SASE deployments.

Forward Outlook

For Q3 2025, Fortinet guided to:

• Billings of $1.76B to $1.84B (midpoint +14% YoY)
• Revenue of $1.67B to $1.73B (midpoint +13% YoY)
• Non-GAAP gross margin of 80% to 81%
• Non-GAAP operating margin of 32.5% to 33.5%

For full-year 2025, management raised the midpoint of billings guidance by $100M to $7.4B and maintained total revenue guidance, shifting $50M from service to product revenue:

• Billings: $7.325B to $7.475B
• Revenue: $6.675B to $6.825B
• Service revenue: $4.55B to $4.65B
• Non-GAAP operating margin: 32% to 33.5%

Management cited a robust pipeline, strong sales confidence, and ongoing upgrade activity as drivers for the raised outlook, with particular emphasis on continued SASE and SecOps momentum.

• Platform adoption and large deal momentum are expected to continue.
• Service revenue conversion will lag product billings, reflecting mix shift and timing.

Takeaways

Fortinet’s Q2 2025 results highlight a business in active transition:

• Growth Now Led by SASE and SecOps: Platform expansion and recurring revenue streams are overtaking legacy hardware refreshes as the primary growth engines.
• Margin and Cash Flow Remain Strong: Despite heavy infrastructure investment, disciplined cost management supports healthy profitability and capital return.
• Investors Should Watch Service Mix and Post-Refresh Trajectory: The sustainability of growth will hinge on continued SaaS and security operations adoption as hardware upgrade tailwinds fade.

Conclusion

Fortinet’s Q2 results confirm the company’s evolution into a platform-centric, cloud-driven security provider, with SASE and SecOps now at the forefront of growth. The raised billings outlook and robust customer expansion underscore strategic execution, but investors should monitor the service revenue mix and the durability of platform adoption as the business moves beyond the hardware refresh cycle.

Industry Read-Through

Fortinet’s rapid SASE and SecOps adoption signals a broader industry shift toward integrated, cloud-delivered security platforms. Competitors relying on point products or legacy hardware will face mounting pressure as customers prioritize unified operating systems and cross-product journeys. The growing importance of sovereign SASE, particularly in regulated markets, suggests that localized, carrier-driven solutions will become a key battleground. AI integration and proprietary infrastructure investment are emerging as differentiators, raising the bar for both incumbents and disruptors in cybersecurity. Investors should expect continued consolidation of networking and security spend, with platform providers poised to capture disproportionate share as enterprise security architectures modernize.

FTNT Technology Cybersecurity SaaS SASE Platform AI Infrastructure