Fortinet (FTNT)

By both methods, the value today (DCF $150 · Multiples $133) is below the market price ($193).

Today — expensive, no margin of safety: at $193 trades ~44.8% above its value discounted to today (~$133); the expected return does not even reach the risk-free rate (4.5%).

At 5 years — Sobrevalorado: the expected total return is negative — the price already discounts a demanding scenario that, if not met, results in a loss.

The bridge: the return at 5 years falls below the risk-free rate (4.5%) — which is why there is not even a discount to today's value. To require a 15% annual return, it would need to be bought at ~$83.

Educational / informational. Does not constitute investment advice.

The inverse approach: instead of projecting growth to obtain the value, the market price ($193) is taken as given and it solves for what annual owner-earnings growth would need to hold for 5 years for the present value —at the method's rate (4.5%, no-growth terminal)— to equal that price. It is the disconfirmation test: the expectations the price already pays for, contrasted against the method's projection.

The price discounts growth (21.6%/year) above our base case (15.0%/year) → it is priced for a demanding scenario and leaves little cushion against a slowdown.

That growth implies ~$6.7 bn of owner earnings in year 5 (vs ~$5 bn of our base case). It recalculates if the DCF assumptions are edited.

Year-by-year projection of the selected scenario. From each year, two versions of the flow are derived: growth FCF (operating flow − total capex, the cash surplus) and maintenance FCF (the owner earnings: what the business yields if it only sustains its capacity). Cash accumulates the retained surplus —what is not returned as dividend or buyback—, so that EV falls and multiples compress going forward. The valuation is done on NOPAT. In edit mode, revenue, margins, capex, and exit multiples can be adjusted.

Year 0 = TTM to Jun-2026 (US$7.527bn of revenue). Year 1 starts from the raised guidance in the 8-K of 29-Jul-2026 (+19% year-over-year revenue, US$8.02-8.18bn) rather than from the trajectory — the two coincide almost exactly (TTM +18.8%), so there is no under-start to correct. The year-1 operating margin (~33%) is derived from both anchors in the release: the guided non-GAAP operating margin (35-37%) net of stock-based compensation and intangible amortization, not from revenue alone. Growth decays geometrically and smoothly to ~10.5% in year 5 (the quality compounder band 8-15%), reflecting that the firewall refresh cycle now accelerating the business (product +52% year over year in the second quarter) normalizes toward the structural growth of the cybersecurity category. Buybacks are modeled with `sharesPath` (not `accumulateCash`): the net share reduction has been running at ~3%/year, funded entirely with free cash flow (TTM buybacks of US$2.86bn represent ~92% of real FCF of US$3.12bn, with no debt involved). The exit multiple (23× NOPAT in the base case) sits in the middle of the enterprise software band (20-30×): the moat is real but narrow —differentiation through a proprietary ASIC and a unified platform— against competitors of equal or greater scale (Palo Alto Networks, Cisco, CrowdStrike, Microsoft, Zscaler).

Today's elevated multiple is the price of growth: if the business grows, the entry point cheapens on its own going forward (the metric grows while EV stays roughly flat). The exit multiple at 3 years is higher than the terminal at 5 years —at 3 years there is more growth still ahead—, so the value curve shows whether value creation is concentrated in the early or the later years. The required return is applied to the base scenario.

They are valued separately, with their own rationale, and are not incorporated into the base or the verdict (they are excess return). When assigning them value — in Editmode —, the total with optionalities updates live, without moving the base.

The verdict, the base CAGR, and the margin of safety are always calculated on the base; optionalities do not alter them (with optionalities at $0 they do not move).

Each card fixes a required annual return and answers: if the business is worth $166 in 5 years, what is the maximum that can be paid today to obtain that return? Since it now trades at $193, the margin of safety is how much cheaper the market is than that maximum. The three thresholds: 4% covers inflation (the floor), 10% is the long-term average return, and 15% is the level of a great investment.

With a target price of $166 in 5 years and a required return of 4.5% annually, the maximum to pay today is $133. Against the current market price ($193), the margin of safety is -44.8% (trades above the maximum → a premium is paid) and the total return at that price would be -3.0% annually.

• Multiple vs. the archetype band. 23x NOPAT in the base case, at the midpoint of the enterprise-software band (20-30x), reflecting a real but narrow moat.
• Reacceleration already priced in. The market already prices in the recent reacceleration.
• Margin of safety today. The market price exceeds the maximum price that results from discounting the flow at the risk-free rate with floor: there is no margin of safety at the current price.
• Expected annual return (base case). The expected annual return at the market price is -3%, well below the method's return bar (10-15%).
• Dividend. Fortinet does not pay a dividend; all capital return is via buybacks.
• Sensitivity to the terminal multiple. The bull case (28x NOPAT, sustained growth) and the bear case (17x NOPAT, competition erodes margins) show a wide dispersion of possible outcomes.

Each margin over sales, year by year: historical (solid line) → projection (dotted).

• ✓ ROIC exceeds the cost of capital (~10%)
• ✓ CFROIC backs up the ROIC (128%, cash vs. accruals)
• ✓ Healthy balance sheet (low corporate debt)
• ✓ Durable competitive moat (multiple advantages)

• Cash generation. TTM FCF of US$3.12bn on US$7.53bn of revenue (FCF margin ~41%), with high cash conversion.
• Negative invested capital. Cash and investments exceed equity plus debt, a working-capital superpower partly funded by deferred revenue.
• Reinvestment runway. TTM capex (US$0.28bn, ~3.7% of revenue) is modest relative to FCF; the company reinvests in data centers and points of presence for its SASE cloud.
• Stock-based compensation. Stock-based compensation equals ~9.5% of TTM FCF, a moderate level that the buyback more than offsets in terms of net dilution.
• Quality of deferred revenue. 71% of FY2025 service revenue came from the prior deferred balance, giving real visibility into future revenue already under contract.
• Non-recurring gains. The bargain-purchase gains on Linksys (US$39.9M) and Lacework (US$106.3M) are non-operating items worth normalizing when reading GAAP earnings.

Annual levels from the official filing (10-K); the % over each bar is the year-over-year (YoY) growth vs the prior year.

Fortinet does not report separate operating segments: it only disaggregates by revenue type (product vs. service) and geography. Deferred revenue is the highest-signal leading indicator — contracted, not extrapolated — and its 12% growth in FY2025 anticipates the service-revenue acceleration already showing up in recent growth. Share buybacks are the almost exclusive channel for returning capital (there is no dividend): funded entirely from free cash flow, with no leverage, and materially stepped up in TTM after the FY2024 pause around the Lacework integration. The reduction in diluted shares (~3% year-over-year in TTM, accelerating) is material to per-share value and is modeled explicitly with a declining share path rather than accumulating cash.

The % are the annual (year-over-year) growth: each year —historical and projected— vs the prior one; the TTM (trailing 12m) vs the TTM of a year ago, to avoid overlapping windows. The historicals are exact figures from the official filings; the projected years come from the year-by-year model (the intermediate years without their own series are interpolated between the anchors). The projected columns (+1y…+5y) are 12-month windows counted from the TTM close (30-jun-2026): the projection starts from the most recently reported data, not the fiscal year. The projected base is realistic and unbiased — the risk discount is applied at the end, via the required return. The rationale for each metric is in the (i).

• Revenue trajectory. Growth went from +20.1% (FY2023) to +12.3% (FY2024) and back up to +14.2% (FY2025) and +18.8% (TTM): a clear reacceleration, not a monotonic slowdown.
• Company guidance. FY2026 guidance was raised to +19% year-over-year after the second quarter, in line with the TTM pace.
• Product/service mix. Product grew +52% year-over-year in the second quarter of 2026, a direct signal of the hardware renewal cycle.
• Leading indicator (deferred revenue). Deferred revenue grew 12% in FY2025, anticipating the service-revenue acceleration of the coming quarters.
• Geographic diversification. All three regions (Americas, EMEA, APAC) grow at double digits, with no dependence on a single geography to sustain consolidated growth.
• Penetration ceiling. With more than half a million customers and 50+ products, much of future growth depends on cross-selling into the installed base rather than on new logos.

• Recurrence and predictability. 67% of FY2025 revenue is recurring service (subscription and support), recognized on a deferred basis over one-to-five-year contracts.
• Product differentiation. Proprietary silicon (FortiASIC) differentiates it from pure-software solutions, though the market has multiple capable vendors.
• Pricing power. Gross margin holds steady around 80% despite intense competition, a signal of moderate pricing power.
• Operating leverage. GAAP operating margin went from 23.4% (FY2023) to 32.4% (TTM); sales and marketing spend grows slower than service revenue.
• Behavior in recessions. Cybersecurity spending is more resilient than overall IT capex, but the product (hardware) business is more cyclical than the service business.
• Channel concentration. A single distributor concentrates 32% of net accounts receivable; six distributors concentrate 67%.
• Installed-base renewal cycle. The company anticipates a significant firewall renewal cycle in the coming years, with cross-selling of SASE and SecOps.

Not all debt is equal: only the structural needs refinancing; the rest is operational (self-liquidating).

Structural debt is what is exposed to the contraction phase of the cycle; operational debt (leases, matched funding) self-liquidates with the business.

• ✓Leverage (net debt / EBITDA)Net cash $4 bn
• ✓Interest coverage (EBIT / interest)135.7x
• –Liquidity (current ratio)no data
• ✓Cash quality (CFROIC vs ROIC)CFROIC backs 128% of ROIC
• ✓Value creation (ROIC − 10% bar)+86pp
• ✓Malinvestment test (capex vs incremental ROIC)Capex/D&A 1.8x
• ✓Float / working capitalFrees up cash $0.5 bn (float / negative WC)
• !Dilution (SBC % of revenue + shares)SBC 3.9% of revenue

A traffic-light interpreted by the method (not generic): float (negative WC) adds up, capex is judged by incremental ROIC (malinvestment test), and a lender is not subjected to corporate solvency. The (i) shows the derivation of each number.

• Cash position. Cash, equivalents and short- and long-term investments total more than US$4,400 million.
• Debt. Only US$497 million of long-term debt, with no current portion after the US$500 million repayment in the first half of 2026.
• Credit rating. Moody's raised the senior unsecured notes rating to A3 from Baa1, the highest of any publicly traded cybersecurity company.
• Liquidity. Current assets (US$6.21bn) comfortably exceed current liabilities (US$4.84bn), even with US$3.84bn of current deferred revenue included in liabilities.

Who owns the shares — the alignment and whether there is a controlling shareholder.

• Skin in the game. Co-founders Ken Xie (CEO/Chairman) and Michael Xie (President/CTO) hold a combined stake of close to 19% of the equity.
• Capital allocation. Capital is returned almost entirely via buybacks funded from the company's own cash flow, with no debt; ~92% of TTM FCF went to buybacks.
• M&A. The Lacework and Linksys acquisitions were recorded with bargain-purchase gains, a signal of price discipline in the transactions.
• Stability of the executive team. The CFO retired in May 2025 after 11 years at the company, introducing a change in the senior finance team to watch.
• Transparency in communication. The company reports detailed GAAP/non-GAAP reconciliations and quarterly and annual guidance with specific ranges.

• The market extended the multiple after the strong second quarter (product +52% year-over-year) and the guidance raise to +19% for the year, anticipating that the firewall renewal cycle holds up for several years
• Moody's credit-rating upgrade (to A3, the highest of any publicly traded cybersecurity company) and the aggressive buyback reinforce the quality narrative
• There is no motivated seller and no missing buyer: broad analyst coverage, with no restructuring or missed guidance to explain a discount
• The reacceleration is already broadly priced in

No clear source of discount (missing buyers / motivated sellers) is identified because, at the current price, there is no discount to explain: the market already pays for the continuation of the renewal cycle and the margin improvement. With the expected annual return barely positive at the market price, Overvalued — the risk is not in finding a reason for the discount, but in whether future execution can sustain what is already priced in.

The annual return (CAGR at 5 years) in each scenario, with the total period return below — the margin of safety made visual: upside range wide, downside range narrow.

Even in the bear scenario, the return holds at -16%/year (-59% total): the margin of safety protects the downside. The bull (+5%/year, +28% total) exceeds it comfortably — a favorable asymmetry, with a narrow downside range and a wide upside range.

• Distribution channel concentration. A single distributor represents 32% of net accounts receivable; a financial problem at that distributor would hit in a concentrated way.
• Competition from much larger rivals. Check Point, Cisco, CrowdStrike, Microsoft, Palo Alto Networks and Zscaler compete with greater financial resources or stronger brand recognition in niches.
• Concentration of shipments at quarter-end. A substantial portion of orders are billed in the final two weeks of each quarter; a logistics delay can prevent billing a material amount.
• Deferred recognition masks demand deterioration. A drop in new sales or renewals does not show up immediately in reported results, appearing with a lag of several quarters.
• Geographic concentration of manufacturing. ~87% of hardware is manufactured in Taiwan, with exposure to China-Taiwan tensions, tariffs, and single- or limited-source suppliers.
• Price already demanding. The price leaves little margin of safety; any negative deviation from the raised guidance could punish the multiple.
• Sensitivity to corporate IT spending. A general IT budget tightening would hit hardware capex (product) first, the line accelerating growth the most today.

Each thinker's analytical framework applied to our data.

• Buffett / Graham Quality + margin of safety

  A narrow moat and ROIC 96% above the 10% bar, but the price sits above value (no margin) → great business, expensive.

• Peter Lynch Growth at a reasonable price (GARP)

  A fast grower growing 15% at a multiple/growth of 4.7 → expensive for its growth.

• Joel Greenblatt Cheap and high-return (Magic Formula)

  Earnings yield 2% (EBIT/EV) + ROIC 96% → falls outside the Magic Formula.

• Howard Marks Perception vs reality + cycle

  The price discounts 22% vs our 15%: priced for perfection, no favorable mispricing.

• Seth Klarman Capital protection (bear scenario)

  Bear-scenario floor -16%/yr over 5y (material loss) → risk of permanent capital loss.

• Pat Dorsey Moat strength (Five Rules)

  A narrow moat, stable; sources: switching costs, efficient scale, intangibles, cost advantage → partially passes the Five Rules.

• Aswath Damodaran Expectations implied by the price

  The price demands 22% growth, far above our 15% — heroic assumptions.