What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2022-02-25 compared with 2021-02-19 · 154 added, 128 removed, 164 unchanged (63% of the section changed)

Fortinet is a global leader in cybersecurity solutions provided to a wide variety of organizations, including enterprises, communication service providers, government organizations and small businesses.

Our cybersecurity solutions are designed to provide broad visibility and segmentation of the digital attack surface through our integrated Fortinet Security Fabric platform, which features automated protection, detection and response.

Fortinet is a global leader in cybersecurity and networking solutions for organizations, including enterprises, communication service providers, security service providers, government organizations and small businesses.

The focus areas of our business consist of:

• Security-Driven Networking —We derive a majority of product sales from our FortiGate network security appliances.

Our FortiGate network security appliances include a broad set of built-in security and networking features and functionalities, including firewall, next-generation firewall, secure web gateway, secure sockets layer (“SSL”) inspection, software-defined wide area network (“SD-WAN”), intrusion prevention system (“IPS”), sandboxing, data leak prevention, virtual private network (“VPN”), switch and wireless controller and wide area network (“WAN”) edge.

• Convergence / Security-Driven Networking —Our Security-Driven Networking solutions enable the convergence of networking and security across all edges to provide next-generation firewall (“NGFW”), software-defined wide area network (“SD-WAN”), LAN Edge (Wi-Fi and switch) and secure access service edge (“SASE”).

Traditional networking lacks awareness of content, applications, users, devices, location and more.

A security-driven networking approach converges networking and security into a single, accelerated solution.

A specially designed operating system and security processors work in concert to greatly improve network performance and security posture while decreasing footprint and power consumption.

We derive a majority of product sales from our FortiGate network security appliances.

FortiGate network security appliances include a broad set of built-in security and networking features and functionalities, including firewall, next-generation firewall, secure web gateway, secure sockets layer (“SSL”) inspection, software-defined wide area network (“SD-WAN”), intrusion prevention system (“IPS”), sandboxing, data leak prevention, virtual private network (“VPN”), switch and wireless controller and wide area network (“WAN”) edge.

Our network security appliances are managed by our FortiOS network operating system, which provides the foundation for FortiGate security functions.

We enhance the performance of our network security appliances from branch to data center by designing and implementing security processing units (“SPUs”) technology within our appliances, enabling us to add security and network functionality with minimal impact to network throughput performance.

• Infrastructure Security —The Fortinet Security Fabric platform extends beyond the network to cover other attack vectors.

Other infrastructure solutions covered include teleworker and remote security solutions such as FortiAuthenticator, FortiClient and FortiToken, as well as Secure Access (Wi-Fi and switch).

• Dynamic Cloud Security —We help customers connect securely to and across their individual, hybrid and multi-cloud environments by offering security through our virtual firewall and other software products and through integrated capabilities with major cloud platforms.

Our public and private cloud security solutions, including virtual appliances and hosted solutions, extend the core capabilities of the Fortinet Security Fabric platform in and across cloud environments, delivering security that follows their applications and data.

Along with our secure Wi-Fi access points and switches, Fortinet helps organizations secure their networks across campuses, branches and work from anywhere (“WFA”) deployments.

• Zero Trust Access —Our Zero Trust Access solutions enable customers to know and control who and what is on their network, in addition to providing security for WFA.

Zero Trust Access solutions include FortiNAC, FortiAuthenticator, FortiClient/EDR and FortiToken.

Our network access control solutions provide visibility, control and automated event responses in order to secure internet of things (“IoT”) and operational technology (“OT”) devices.

• Adaptive Cloud Security —We help customers connect securely to and across their individual, hybrid cloud, multi-cloud and virtualized data center environments by offering security through our virtual firewall and other software products and through integrated capabilities with major cloud platforms.

Our public and private cloud security solutions, including virtual appliances and hosted solutions, extend the core capabilities of the Fortinet Security Fabric cybersecurity mesh platform in and across cloud environments, delivering security that follows their applications and data.

Our Secure SD-WAN for multi-cloud solution automates deployment of an overlay network across different cloud networks and offers visibility, control and centralized management that integrates functionality across multiple cloud environments.

Our cloud security portfolio also includes securing applications, including email and web.

Fortinet cloud security offerings are available for deployment in major public and private cloud environments, including Amazon Web Services, Microsoft Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, IBM Cloud and VMWare Cloud.

Fortinet cloud security offerings are available for deployment in major public and private cloud environments, including Alibaba Cloud, Amazon Web Services, Google Cloud, IBM Cloud, Microsoft Azure, Oracle Cloud and VMWare Cloud.

We also offer managed IPS and web application firewall (“WAF”) rules delivered by FortiGuard Labs as an overlay service to native security offerings offered by Amazon Web Services.

• Endpoint Protection, Internet of Things (“IoT”) and Operational Technology (“OT”) Security —We protect end-customers from advanced threats that target their devices and the data that reside on them through our advanced endpoint solutions that provide core endpoint protection, advanced threat protection, incident monitoring, and response.

Additionally, the proliferation of IoT and OT devices has generated new opportunities for us to grow our business.

We offer network access control solutions that provide visibility, control and automated event responses in order to secure IoT devices.

• AI-Driven Security Operations —We develop and provide Artificial Intelligence (“AI”) driven security operations solutions, including FortiGuard and other security subscription services, endpoint detection and response, and our security orchestration, automation and response (“SOAR”) capabilities and solutions, that can be applied across the entire Fortinet Security Fabric platform.

These solutions deliver intelligence and insights.

In addition to our security solutions, our customers may purchase FortiGuard and other security subscription services to receive threat intelligence updates and protection updates delivered by FortiGuard Labs, FortiCare technical support services and the support of Technical Account Managers, Resident Engineers and professional service consultants for implementations or training services.

• AI-Driven Security Operations —We develop and provide a range of products and services that enable the security operations center (“SOC”) teams to identify, investigate and remediate potential incidents in which cybercriminals bypass prevention-oriented controls.

Given the breadth of the attack surface to monitor, as well as the volume and sophistication of cyber threats, artificial intelligence (“AI”) is a key part of these offerings, which include:

FortiGuard and other security subscription services, endpoint security with endpoint detection and response (“EDR”), a range of breach-protection technologies plus our security information and event management (“SIEM”) and security orchestration, automation and response (“SOAR”), all of which can be applied across the Fortinet Security Fabric cybersecurity mesh platform.

These solutions automatically deliver security intelligence and insights that help organizations to protect against and respond to threats through integration with Fortinet and third-party solutions.

• Security as a Service —Our customers purchase our FortiGuard security subscription services as an add-on to products and solutions across the Fortinet Security Fabric to receive threat intelligence and protection updates.

FortiGuard services are designed to provide protection for users and applications, including offerings for IPS, web, video and domain name system (“DNS”) filtering, audio/visual (“AV”) and cloud sandbox along with IoT and OT Security.

FortiGuard security services are provided from our FortiGuard Labs and cloud-delivered to provide real-time unified protection across network endpoint and cloud.

• Support and Professional Services —Fortinet offers technical support, FortiOS updates, and extended product warranty through our FortiCare support services.

In addition to our technical support services, we offer a range of advanced services, including premium support, professional services and expedited warranty replacement.

Our professional service offerings include resident engineers and professional service consultants for implementations or trainings.

During our year ended December 31, 2021, we generated total revenue of $3.34 billion and net income of $606.8 million.

See Part II, Item 8 of this Annual Report on Form 10-K for more information on our consolidated balance sheets as of December 31, 2020 and 2019 and our consolidated statements of income, comprehensive income, stockholders’ equity, and cash flows for each of the three years ended December 31, 2020, 2019 and 2018.

See Part II, Item 8 of this Annual Report on Form 10-K for more information on our consolidated balance sheets as of December 31, 2021 and 2020 and our consolidated statements of income, comprehensive income, equity, and cash flows for each of the three years ended December 31, 2021, 2020 and 2019.

We were incorporated in Delaware in November 2000.

Our principal executive office is located at 899 Kifer Road, Sunnyvale, California 94086 and our telephone number at that location is (408) 235-7700.

Technology and Architecture

The Fortinet Security Fabric platform helps organizations secure their environments and reduce their security and network complexities.

The Fortinet Security Fabric platform has an open architecture designed to connect Fortinet solutions and third-party solutions into a single ecosystem, enabling integration and automation.

Our product offerings consist of our FortiGate network security product family and our non-FortiGate products.

Our FortiGate hardware and software licenses are sold with a set of security services in addition to networking features and are run using our proprietary FortiOS operating system.

Our security services are enabled by FortiGuard Labs, which provides threat research and artificial intelligence capabilities from a cloud network to deliver protection services to each FortiGate appliance and virtual machine that is registered by the end-customer.

All these are combined to form the Fortinet Security Fabric platform, which is an approach to security that ties discrete security solutions together into an integrated whole.

Consolidation of Technology and Architecture

Cybersecurity has traditionally been deployed one solution at a time and not designed to work well with other deployed solutions while also increasing management complexity.

A Fortinet Security Fabric cybersecurity mesh platform approach consolidates point products into a platform, allowing for much tighter integration, increased automation and a more rapid, coordinated, and effective response to threats across the network.

The Fortinet Security Fabric has an open architecture designed to integrate Fortinet solutions and third-party solutions.

Our product offerings consist of our FortiGate network security products and our non-FortiGate products, which are offered in a broad range of form factors spanning physical appliances, virtual appliances, software and cloud-hosted services.

This enables Fortinet to protect customers across all edges and deployment scenarios including users, devices, networks, cloud, and virtual data center.

Our cloud- and hosted- products and services include sandboxing, endpoint detection and response (“EDR”), email security, web application and API security, and cloud networking security as well as Fortinet Security Fabric management and analytics.

Additionally, we offer cloud-delivered and hosted-security services.

Our FortiGuard security services are enabled by FortiGuard Labs, which provides threat research and artificial intelligence capabilities from a cloud network to deliver protection through FortiGate appliance and virtual machine as well as Fortinet Security Fabric products that are registered by the end-customer.

All these are combined to form the Fortinet Security Fabric cybersecurity mesh platform, which is an approach to security that consolidates discrete security solutions together into an integrated offering.

This integrated approach to security extends across both Fortinet developed solutions and a broad ecosystem of technology partner solutions and technologies.

Our proprietary SPUs are application-specific integrated circuits (“ASICs”) that include (i) the content processor (“SPU CP”), (ii) the network processor (“SPU NP”) and (iii) the system-on-a-chip (“SPU SoC”).

Each successive generation of SPU adds network speed and the capacity to perform security functions.

Our SPUs are designed to enhance the security processing capabilities implemented in software by accelerating computationally intensive tasks such as firewall policy enforcement, SD-WAN, network address translation, IPS, threat detection and encryption.

The use of SPUs allows our appliances to deliver security functionality with minimal impact to network throughput performance, which we believe delivers a lower total cost of ownership (“TCO”) to our customers.

As the security needs of our end-customers increase, we believe that our TCO and our SPUs will give our products a competitive advantage against other architectural approaches.

Our SPUs are embedded in our physical FortiGate appliances and are designed to enhance the security processing capabilities of our operating system by accelerating computationally intensive tasks such as firewall policy enforcement, SD-WAN, network address translation, IPS, threat detection and encryption while also converging security capabilities with networking functionality.

We also provide virtualized security processing units (“vSPUs”) across our FortiGate virtual appliances.

The use of SPUs allows our appliances to consolidate security functionality and converge security with a minimal impact to network throughput performance, which we believe delivers a lower total cost of ownership (“TCO”) to our customers.

As the security needs and technologies of our end-customers increase, we believe our TCO-driven SPU approach give our products a competitive advantage against other architectural approaches.

Entry-level FortiGate products often use the SPU SoC to provide the necessary acceleration at this level.

1 unchanged sentence

The high-end FortiGate products use multiple CPUs, SPU CPs and SPU NPs.

Our proprietary FortiOS operating system provides the foundation for the operation of all FortiGate network security appliances, whether physical, virtual, private- or public-cloud based.

We make regular updates to FortiOS available through our FortiCare support services.

We have made updates to our FortiOS 7.0, as we aim to create a platform that will cover data centers, clouds, edge computing endpoints and networks.

Fortinet Security Fabric is powered by FortiOS.

The security and networking capabilities of the Fortinet Security Fabric platform are controlled through FortiOS.

The core kernel functions to the security processing feature sets work together to provide a highly integrated solution.

FortiOS, its associated security and networking functions and products that run or are integrated with FortiOS are combined to form the Fortinet Security Fabric cybersecurity mesh platform.

This approach to security ties discrete security solutions together into an integrated offering.

Our proprietary FortiOS operating system provides the foundation for the operation of FortiGate network security appliances, whether physical, virtual, private- or public-cloud based.

We make regular enhancements and other updates to FortiOS available through our FortiCare support services.

The convergence of security and networking capabilities provided by the Fortinet Security Fabric cybersecurity mesh platform are powered and controlled through FortiOS.

FortiOS provides (i) multiple layers of security, including a hardened kernel layer providing protection for the FortiGate system, (ii) a network security layer, providing security for end-customers’ network infrastructures and (iii) application content protection, providing security for end-customers’ workstations and applications.

FortiOS directs the operations of processors and SPUs and provides system management functions such as command line, graphical user interfaces, multiple network and security topology views.

Key high-level functions and capabilities of FortiOS include:

• enablement for the Fortinet Security Fabric platform architecture;

• optionality to configure FortiGate appliances into different security environments, such as our Internal Network Firewall, Next-Generation Firewall and Data Center Firewall;

• configuration of the physical aspects of the appliance, such as ports, onboard Wi-Fi and switching;

• extension of the Fortinet Security Fabric platform through direct management of FortiSwitch and FortiAP devices;

• network functions such as routing and deployment modes (network routing, transparent, sniffer, etc.);

• the ability to deploy and orchestrate SD-WAN instances;

• implementation of security updates from our FortiGuard distribution network, delivering FortiGuard security subscription services and intelligence, such as IPS, antivirus and application control;

• native integrations with major cloud provider platforms;

• real-time reporting and logging.

FortiOS also enables advanced, integrated routing and switching, allowing end-customers to deploy FortiGate devices within a wide variety of networks, as well as providing a direct replacement solution option for legacy switching and routing equipment.

FortiOS implements a suite of commonly used standards-based routing protocols as well as network address translation technologies, allowing the FortiGate appliance to integrate and operate in a wide variety of network environments.

Additional features include virtual domain capabilities, which can provide support for multiple customers on a single device or FortiOS instance.

FortiOS also provides capabilities for the logging of traffic for forensic analysis purposes, which are particularly important for regulatory compliance initiatives such as payment card industry data security standards.

Additional features include virtual domain capabilities, which can provide support for multiple customers on a single device or FortiOS instance in support of service provider and managed security service provider (“MSSP”) deployments.

FortiOS also provides capabilities for the logging of traffic for forensic analysis purposes.

FortiOS is designed to help control network traffic in order to optimize performance by including functionality such as packet classification, queue disciplines, policy enforcement, congestion management, WAN optimization and caching.

These features enable administrators to set the appropriate configurations and policies that meet their infrastructure needs.

Our core product offerings consist of our FortiGate product family and our non-FortiGate products, all of which may be purchased to complement commercial and enterprise deployments.

Our FortiGate hardware and software licenses are sold with a set of broad security services.

These security services are enabled by FortiGuard Labs, which provides extensive threat research and artificial intelligence capabilities from a global cloud network to deliver protection services to each FortiGate appliance that is registered by the end-customer.

Our non-FortiGate products span the full range of our customers’ core security needs and include the Fortinet Security Fabric platform, email security, cloud security, endpoint protection and other products.

FortiGate offers a broad set of security and networking functions, including firewall, intrusion prevention, anti-malware, VPN, application control, web filtering, anti-spam and WAN acceleration.

Our core product offerings consist of our FortiGate firewall product family and our non-FortiGate products which may be purchased to integrate and expand security architectures.

Our non-FortiGate products include the Fortinet Security Fabric cybersecurity mesh platform, email security, cloud security, endpoint protection and other products.

Our FortiGate hardware and software licenses are sold with a set of FortiGate broad security services.

These security services are enabled by FortiGuard Labs, which provides threat research and artificial intelligence capabilities from a global cloud network to deliver protection services.

FortiGate converges a broad set of security and networking functions, including firewall, intrusion prevention, anti-malware, VPN, application control, web filtering, anti-spam and WAN acceleration.

FortiGate is available as a hardware appliance or as a virtual appliance.

All FortiGate appliances run on FortiOS.

FortiGate platforms can be centrally managed through both embedded web-based and command line interfaces, as well as through FortiManager, which provides a central management architecture for FortiGate appliances and the Fortinet Security Fabric platform.

By combining multiple network security functions in our purpose-built security platform, FortiGate appliances provide broad, high-quality protection capabilities and deployment flexibility while reducing the operational burden and costs associated with managing multiple point products.

With over 35 models in the FortiGate product line, FortiGate is designed to address security requirements for small- to medium-sized businesses, large enterprises and government organizations worldwide.

Typically, all FortiGate hardware appliances include our SPUs to accelerate content and network security features implemented within FortiOS.

Most FortiGate hardware appliances include one of our SPUs to accelerate content and network security features implemented within FortiOS.

The significant differences between each model are the performance and scalability targets each model is designed to meet, while the security features and associated services offered are common throughout all models.

1 unchanged sentence

The FortiGate-100 through -900 series models are designed for perimeter deployment in medium-sized to large enterprise networks.

The FortiGate-1000 through -7000 series models deliver high performance and scalable network security functionality for perimeter, data center and core deployment in large enterprises.

The FortiGate-1000 through -7000 series models deliver high performance and scalable network security functionality for perimeter, data center and hyper scale data centers, and core deployment in large enterprises.

In addition to networking security features, all FortiGate models and form factors also deliver secure SD-WAN capabilities.

Fortinet also offers FortiGate Rugged models for OT applications where ruggedized appliances are needed.

We also incorporate additional technologies within FortiGate appliances that differentiate our solutions, including data leak protection, traffic optimization, SSL inspection, threat vulnerability management and wireless controller technology.

In addition to these in-built features, we offer a full range of wireless access points and controllers, complementing FortiGate appliances with the flexibility of wireless local area network access.

Fortinet Security Fabric Platform and Non-FortiGate Products

As part of the Fortinet Security Fabric platform, we offer products that provide network security, endpoint security, cloud security, web-based application security, identity and access management, sandbox protection and email security.

Fortinet Security Fabric Cybersecurity Mesh Platform and Non-FortiGate Products

As part of the Fortinet Security Fabric cybersecurity mesh platform, we offer products that provide network security, endpoint security, cloud security, web-based application security, identity and access management, sandbox protection and

email security.

The integration of devices using open standards, common operating systems, and unified management platforms enables the sharing and correlation of real-time threat intelligence.

The following Fortinet products can operate as part of the Fortinet Security Fabric platform:

• FortiSwitch —Our FortiSwitch product family provides secure switching solutions that can be deployed in traditional network switching designs with Layer 2 or Layer 3 access control features.

FortiSwitch creates a scalable and secure access layer for customers to connect their end devices, such as computers and laptops, as well as to expand the field of IoT devices.

The following Fortinet products can operate as part of the Fortinet Security Fabric cybersecurity mesh platform:

• FortiAnalyzer —Our FortiAnalyzer family of products provides centralized network logging, analyzing and reporting solutions that securely aggregate content and log data from our FortiGate devices, other Fortinet products and third-party devices to enable network logging, analysis and reporting.

• FortiAP —Our FortiAP product family provides secure wireless networking solutions.

1 unchanged sentence

FortiAPs create a scalable and secure access layer for connecting wireless devices such as computers, laptops, cell phones and tablets, as well as IoT devices.

• FortiClient —Our FortiClient provides advanced endpoint protection with pattern-based anti-malware, behavior-based exploit protection, web-filtering and an application firewall.

FortiClient integrates with FortiSandbox to detect zero-day threats and custom malware.

FortiClient also provides secure remote access with built-in VPN, single-sign-on and two-factor authentication for added security.

• FortiEDR/XDR —Our FortiEDR/XDR is an endpoint protection solution that provides both machine-learning anti-malware protection and remediation.

FortiEDR/XDR supports broad OS coverage workstations, servers, and virtual machines, including legacy operating and embedded systems.

• FortiGate-VM — FortiGate-VM extends the Fortinet Security Fabric through the cloud on-ramp into the cloud, enabling customers to achieve security-driven networking within the cloud and between clouds and hybrid clouds.

FortiGate-VM is powered by Fortinet vSPU (virtual Security Processing Unit) to deliver accelerated security and performance with minimal impact to performance.

FortiGate-VM is powered by Fortinet vSPUs to deliver accelerated security and performance with minimal impact to performance.

Our cloud networking solution enables better, more secure application experiences for users and branch offices by providing for encrypted data transports, granular segmentation and application-layer protection against advanced threats, and seamless overlay network with uniform policies across multi-clouds.

FortiGate-VM is available for all major cloud providers, hypervisors and software-defined network (“SDN”) platforms.

• FortiManager —Our FortiManager family of products provides a central and scalable management solution for our FortiGate products, including software updates, configuration, policy settings and security updates.

FortiManager facilitates the coordination of policy-based provisioning, device configuration and operating system revision management, as well as network security monitoring and device control.

• FortiWeb —Our FortiWeb product family provides web application firewall solutions, including internet protocol (“IP”) reputation and anti-botnet security, distributed denial-of-service protection, protocol validation, application attack signatures and deep learning AI to protect applications against a wide range of threats.

• FortiMail —Our FortiMail product family provides secure email gateway solutions.

1 unchanged sentence

FortiMail also integrates data protection capabilities to avoid data loss.

FortiManager facilitates the coordination of policy-based provisioning, device configuration and operating system revision management, as well as network security monitoring and device control.

• FortiSandbox —Our FortiSandbox technology delivers proactive detection and mitigation with the ability to generate a directly actionable protection capability.

Available in both hardware and cloud-based form, the FortiSandbox subjects suspicious code to a set of multi-layer protection techniques, culminating in execution within an operating system, allowing real-time behavioral analysis to be performed in a secure environment.

When malicious code is identified, a signature can be generated locally for distribution across the Fortinet Security Fabric platform.

• FortiClient —Our FortiClient provides advanced endpoint protection with pattern-based anti-malware, behavior-based exploit protection, web-filtering and an application firewall.

FortiClient integrates with FortiSandbox to detect zero-day threats and custom malware.

FortiClient also provides secure remote access with built-in VPN, single-sign-on and two-factor authentication for added security.

When malicious code is identified, a signature can be generated locally for distribution across the Fortinet Security Fabric cybersecurity mesh platform.

• FortiSwitch —Our FortiSwitch product family provides secure switching solutions that can be deployed in traditional network switching designs with Layer 2 or Layer 3 access control features.

FortiSwitch creates a scalable and secure access layer for customers to connect their end devices, such as computers and laptops, as well as to expand the field of IoT devices.

• FortiToken —Our FortiToken allows organizations to implement two-factor authentication to better safeguard systems, assets and data.

1 unchanged sentence

Authorized employees can access company resources safely using a variety of devices, ranging from laptops to mobile phones.

• FortiEDR/XDR —Our FortiEDR/XDR is an endpoint protection solution that provides both comprehensive machine-learning anti-malware execution and real-time post-infection protection.

It automatically detects and defuses potential threats in real time even on already infected hosts.

With automated EDR/XDR functions for threat hunting and incident response, FortiEDR/XDR eliminates the breach response time gap, dwell time, and alert fatigue.

Additionally, it protects systems and supports broad OS coverage workstations, servers, and virtual machines, including legacy operating and embedded systems.

All of the products listed above are available in multiple form factors, such as hardware, virtual machine, cloud or software-as-a-service (“SaaS”), except for FortiSwitch, FortiAP and FortiExtender, which are available as hardware appliances only and FortiGate-VM and FortiEDR/XDR which are available as virtual solutions only.

In the fourth quarter of 2020, we acquired Panopta Holdings LLC (“Panopta”), a privately held SaaS company providing a platform for monitoring the health and performance of network and information technology (“IT”) infrastructure.

We expect that the integration of Panopta technology into our Fortinet Fabric Security platform through FortiMonitor will provide comprehensive network and security operations management solution for enterprises or service providers.

In the third quarter of 2020, we acquired OPAQ Networks, Inc.

(“OPAQ”), a privately held Secure Access Service Edge (“SASE”) cloud provider, to further enhance the Fortinet Security Fabric platform by helping advance our development of zero-trust network access SASE cloud solutions.

The products listed above are available in multiple form factors, such as hardware, virtual machine, cloud or software-as-a-service (“SaaS”), except for FortiSwitch, FortiAP and FortiExtender, which are available as hardware appliances only and FortiGate-VM and FortiEDR/XDR which are available as virtual solutions only.

In the third quarter of 2021, we closed an acquisition of 75% of equity interests in Alaxala Networks Corporation (“Alaxala”), a privately held network hardware equipment company in Japan, to help address the increasing need for secure switches integrated with FortiGate firewalls and Security Fabric functionality, and, over time, to innovate and rebrand certain of Alaxala’s switches to offer a broader suite of secure switches globally.

In the first quarter of 2021, we acquired ShieldX Networks Inc.

(“ShieldX”), a provider of a security platform focusing on protecting multi-cloud data centers from the risk of lateral movement that can lead to attacks such as ransomware, data loss and service disruption.

FortiGuard Security Subscription Services

Security requirements are dynamic due to the constantly changing nature of threats.

Our FortiGuard security subscription services are designed to quickly deliver new threat detection and prevention capabilities to end-customers worldwide as new threats evolve.

Our FortiGuard security subscription services are designed to deliver threat detection and prevention capabilities to end-customers worldwide as threats evolve.

Our FortiGuard Labs global threat research team identifies emerging threats, collects threat samples, and replicates, reviews, characterizes and collates attack data through the use of AI, automation and original research.

Based on this research, we develop updates for virus signatures, attack definitions, scanning engines and other security solution components to distribute to end-customers.

FortiGuard functionality varies depending on which FortiGate and non-FortiGate products the end-customer is using, but will typically include one or more of the following functions:

FortiGuard functionality varies depending on the FortiGate and non-FortiGate products, and will typically include one or more of the following functions:

application control, antivirus, intrusion prevention, web filtering, anti-spam, VPN functions, email image analysis, vulnerability management, database functions, web functions, advanced threat protection, sandboxing and domain and IP reputation services.

2 unchanged sentences

FortiCare Technical Support Services

Our FortiCare support services portfolio includes technical support and extended product warranty.

Our FortiCare support services portfolio includes technical support, FortiOS updates and extended product warranty.

For our standard technical support, our channel partners may provide first-level support to the end-customer.

1 unchanged sentence

We also provide knowledge management tools and customer self-help portals to help augment our support capabilities in an efficient and scalable manner.

We deliver technical support to partners and end-customers 24 hours a day, seven days a week, through worldwide regional technical support centers.

In addition to our technical support services, we offer a range of advanced services, including premium support, professional services and replacement parts delivery.

We deliver technical support to partners and end-customers 24 hours a day, seven days a week, through regional technical support centers.

In addition to our technical support services, we offer a range of advanced services, including premium support, professional services and expedited warranty replacement.

Service Bundles

We also sell FortiGuard and FortiCare services as bundles, consolidating security services into packages that would be typical for certain types of end-customer.

• Unified Threat Protection —Our Unified Threat Protection bundle includes antispam, antivirus, data sanitation, sandbox, application control, intrusion prevention, virus outbreak protection and web filtering, along with FortiCare support services.

• Enterprise Protection —Our Enterprise Protection bundle includes application control, intrusion prevention, web filtering, sandbox, antivirus, mobile security, IP reputation and anti-botnet security, antispam, cloud access security broker (“CASB”), industrial control systems, security rating, virus outbreak protection and data sanitation, along with FortiCare support services.

• Advanced Threat Protection —Our Advanced Threat Protection bundle includes application control, antivirus, IP reputation and anti-botnet security, mobile security, data sanitation, sandbox, intrusion prevention and virus outbreak protection, along with FortiCare support services.

• 360 Protection —Our 360 Protection bundle includes application control, intrusion prevention, web filtering, sandbox, antivirus, mobile security, IP reputation and anti-botnet security, antispam, CASB, industrial control systems, security rating, virus outbreak protection and data sanitation, along with enhanced FortiCare support services and operational services such as SD-WAN orchestration and cloud-based management and visibility of the Fortinet Security Fabric platform.

We also sell FortiGuard and FortiCare services as bundles, consolidating security services into packages that are appropriate for different use cases or end-customers.

• Advanced Threat Protection —Our Advanced Threat Protection bundle includes antivirus, data sanitation sandbox, intrusion prevention, virus outbreak protection, mobile security, application control, IP reputation and anti-botnet security, along with FortiCare support services.

• Unified Threat Protection —Our Unified Threat Protection bundle includes the Advanced Threat Protection security services noted above, as well as intrusion prevention, virus outbreak protection, web filtering and FortiCare support services.

• Enterprise Protection —Our Enterprise Protection bundle includes the Unified Threat Protection services noted above, as well as industrial control systems, security rating, along with enhanced FortiCare support services.

• Small Medium Business – Our Small Medium Business bundle includes the Unified Threat Protection services noted above, as well as FortiGate Cloud which provides cloud-based management, reporting, and analytics for FortiGates along with enhanced FortiCare support services.

Professional Services

We offer professional services to end-customers including technical account managers (“TAMs”), resident engineers (“REs”) and professional service consultants and security architects for implementations.

We offer professional services to end-customers including technical account managers (“TAMs”), resident engineers (“REs”) and professional service consultants, security architects for implementations and remote, cloud-based incident response (“IR”).

TAMs and REs are dedicated support engineers available to help identify and eliminate issues before problems arise.

2 unchanged sentences

They work closely with end-customers to implement our products according to design, utilizing network analysis tools, traffic simulation software and scripts.

Fortinet also offers remote, cloud-based IR and monitoring services to help customers identify, remediate and understand compromises.

This service leverages our FortiEDR capabilities either as part of a premium FortiEDR subscription for continuous monitoring or alternatively, can be deployed to help deliver IR services on a per incident basis.

Training Services

We offer training services to our end-customers and channel partners through our training department and authorized training partners.

We offer training services to our end-customers and channel partners through our training team and authorized training partners.

We have also implemented a training certification program, Network Security Expert, to help ensure an understanding of our products and services.

We typically sell our security solutions to distributors that sell to resellers, service providers and managed security service providers (“MSSPs”), who, in turn, sell to end-customers.

At times, we also sell directly to end-customers.

Our end-customers are located in over 80 countries and include small- and medium-sized businesses, large enterprises and government organizations across a wide range of industries, including telecommunications, governments, financial services, retail, technology, education, manufacturing and healthcare.

An end-customer deployment may involve as few as one or as many as thousands of appliances and other Fortinet Security Fabric platform products, depending on the end-customer’s size and security requirements.

Customers may also access our products via the cloud through certain cloud providers such as Amazon Web Services, Microsoft Azure, Google Cloud, Oracle Cloud, Alibaba Cloud and IBM Cloud.

Typically, our customers also purchase our FortiGuard security subscription services and FortiCare technical support services.

Since 2020, Fortinet also offers a number of free online training courses to help address prevalent industry-wide cybersecurity skills gaps and shortages.

We typically sell our security solutions to distributors that sell to networking security focused resellers and to service providers and managed security service providers (“MSSPs”), who, in turn, sell products and/or services to end-customers.

At times, we also sell directly to large service providers and major systems integrators who may sell to our end-customers or use our products and services to provide hosted solutions to other enterprises.

Our end-customers are lo cated in over 100 countries and include small, medium and large enterprises and government organizations across a wide range of industries, including telecommunications, government, financial services, retail, technology, education, manufacturing and healthcare.

An end-customer deployment may involve as few as one or as many as thousands of appliances as well as other Fortinet Security Fabric cybersecurity mesh platform products.

Customers may also access our products via the cloud through certain cloud providers such as Alibaba Cloud, Amazon Web Services, Google Cloud, IBM Cloud, Microsoft Azure and Oracle Cloud.

Often, our customers also purchase our FortiGuard security subscription services and FortiCare technical support services.

During 2021, Exclusive Networks Group (“Exclusive”) and Ingram Micro Inc.

4 unchanged sentences

We primarily sell our products and services through a two-tier distribution model.

We sell to distributors that sell to resellers and to service providers and MSSPs, who, in turn, sell to our end-customers.

We sell to distributors that sell to resellers and to service providers and MSSPs, who, in turn, sell products and/or services to end-customers.

In certain cases, we sell directly to large service providers and major systems integrators.

We work with many technology distributors, including Exclusive, Ingram Micro, Tech Data Corporation, Synnex Corporation and Arrow Electronics, Inc.

We support our channel partners with a dedicated team of experienced channel account managers, sales professionals and sales engineers who provide business planning, joint marketing strategy, and pre-sales and operational sales support.

We work with many technology distributors, including Arrow Electronics, Inc., Exclusive, Ingram Micro and TD Synnex (formerly Tech Data Corporation and Synnex Corporation, separately).

Additionally, our sales teams help drive and support large enterprise and service provider sales through a direct touch model.

1 unchanged sentence

To support our broadly dispersed global channel and end-customer base, we have sales professionals in over 100 countries around the world.

Our marketing strategy is focused on building our brand, driving thought leadership with emphasis on the criticality of cybersecurity platform adoption and driving end-customer demand for our security solutions.

Our marketing strategy is focused on building our brand, driving thought leadership with emphasis on the criticality of cybersecurity platform adoption and the convergence of security and networking as well as driving end-customer demand for our security solutions.

We use a combination of internal marketing professionals and a network of regional and global channel partners.

Our internal marketing organization is responsible for messaging, branding, demand generation, product marketing, packaging support and subscription services into service bundles, channel marketing, partner incentives and promotions, event marketing, digital marketing, communications, analyst relations, public relations and sales enablement.

Our internal marketing organization is responsible for messaging, branding, demand generation, product marketing, channel marketing, partner incentives and promotions, event marketing, digital marketing, communications, analyst relations, public relations and sales enablement.

We focus our resources on campaigns, programs and activities that can be leveraged by partners worldwide to extend our marketing reach, such as sales tools and collateral, product awards and technical certifications, media engagement, training, regional seminars and conferences, webinars and various other demand-generation activities.

26 unchanged sentences

Our development strategy is to identify features, products and systems for both software and hardware that are, or are expected to be, important to our end-customers.

Our success in designing, developing, manufacturing and selling new or enhanced products will depend on a variety of factors, including identification of market demand for new products, product selection, timely implementation of product design and development, product performance, costs of development, bills of materials, effective manufacturing and assembly processes and sales and marketing.

Our success in designing, developing, manufacturing and selling new or enhanced products will depend on a variety of factors, including identification of market demand for new products or new features, components selection, timely implementation of product design and development, product performance, quality, ease of use, costs of development, bill of materials, effective manufacturing and assembly processes and sales and marketing.

Intellectual Property

We rely primarily on patent, trademark, copyright and trade secrets laws, confidentiality procedures and contractual provisions to protect our technology.

We periodically have discussions with third parties regarding licensing Fortinet’s IP and have sometimes taken legal action against competitors to protect our intellectual property (“IP”), and as a result third parties have paid us fees in return for licenses or covenants-not-to-sue related to Fortinet IP.

We periodically have discussions with third parties regarding licensing Fortinet’s intellectual property (“IP”) and have sometimes taken legal action against competitors to protect our IP, and as a result third parties have paid us fees in return for licenses or covenants-not-to-sue related to Fortinet IP.

As of December 31, 2021, we had 1,255 U.S.

3 unchanged sentences

Despite our efforts to protect our rights in our technology, unauthorized parties may attempt to copy aspects of our products or obtain and use information and technology that we regard as proprietary.

We generally enter into confidentiality agreements with our employees, consultants, vendors and customers, and generally limit access to and distribution of our proprietary information.

We generally enter into confidentiality agreements with our employees, consultants, vendors and customers, and generally limit access to and distribution of our

proprietary information.

However, we cannot provide assurance that the steps we take will prevent misappropriation of our technology.

11 unchanged sentences

We continue to monitor existing and pending laws and regulations and while the impact of regulatory changes cannot be predicted with certainty, we do not currently expect compliance to have a material adverse effect.

For information regarding seasonality in our sales, see the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Unaudited Quarterly Results of Operations—Seasonality, Cyclicality and Quarterly Revenue Trends” in Part II, Item 7 of this Annual Report on Form 10-K.

For information regarding seasonality in our sales, see the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Seasonality, Cyclicality and Quarterly Revenue Trends” in Part II, Item 7 of this Annual Report on Form 10-K.

The markets for our products are extremely competitive and are characterized by rapid technological change.

The principal competitive factors in our markets include the following:

• product performance, throughput, features, effectiveness, interoperability and reliability;

• product security performance, throughput, features, effectiveness, interoperability and reliability;

• addition and integration of new networking and security features and technological expertise;

2 unchanged sentences

• brand recognition;

• customer service and support across varied and complex customer segments;

• customer service and support across varied and complex customer segments and use cases;

• sales and distribution capabilities;

8 unchanged sentences

(“CrowdStrike”), F5 Networks, Inc.

(“F5 Networks”), FireEye, Inc.

(“FireEye”), Forcepoint LLC (“Forcepoint”), Imperva, Inc.

(“F5 Networks”), Forcepoint LLC (“Forcepoint”), Imperva, Inc.

(“Imperva”), Juniper Networks, Inc.

(“Juniper”), McAfee, LLC (“McAfee”), Palo Alto Networks, Inc.

(“Juniper”), Mandiant, Inc.

(“Mandiant”), McAfee, LLC (“McAfee”), Palo Alto Networks, Inc.

(“Palo Alto Networks”), Proofpoint, Inc.

(“Proofpoint”), SonicWALL, Inc.

(“SonicWALL”), Sophos Group Plc (“Sophos”), Trend Micro Incorporated (“Trend Micro”) and Zscaler, Inc (“Zscaler”).

We believe we compete favorably based on our products’ performance, throughput, reliability, breadth and ability to work together;

our ability to add and integrate new networking and security features and our technological expertise.

(“SonicWALL”), Sophos Group Plc (“Sophos”), Trend Micro Incorporated (“Trend Micro”) and Zscaler, Inc.

We believe we compete favorably based on our products’ security performance, throughput, reliability, breadth and ability to work together, our ability to add and integrate new networking and security features and our technological expertise.

Several competitors are significantly larger, have greater financial, technical, marketing, distribution, customer support and other resources, are more established than we are, and have significantly better brand recognition.

1 unchanged sentence

Based in part on these competitive pressures, we may lower prices or attempt to add incremental features and functionalities to our products.

Conditions in our markets could change rapidly and significantly as a result of technological advancements or market consolidation.

Conditions in our markets could change rapidly and significantly as a result of technological advancements, market consolidation, supply chain constraints, price list or discount changes or inflation.

The development and market acceptance of alternative technologies could decrease the demand for our products or render them obsolete.

4 unchanged sentences

Human Capital Management

As of December 31, 2020, our total headcount was 8,238 employees, approximately 32% of which were employed in the United States and approximately 68% of which were employed outside of the United States.

We appreciate that our employees are the foundation of our innovation for the benefit of our customers and that there can be a shortage of highly skilled employees for technology companies like ours, and we believe that our success depends largely on our continued ability to attract and retain highly skilled employees with diverse backgrounds and experiences.

We offer fair, competitive compensation and benefits based on a culture of meritocracy.

Our compensation programs for our employees include base pay, opportunities for equity ownership where local statutes allow and employee benefits that promote well-being across different aspects of our employees’ lives, which may include health and welfare insurance, retirement benefits, and paid time off.

As a global company, much of our success is rooted in the diversity of our teams and our commitment to inclusion.

Our commitment to diversity and inclusion starts at the top, with a highly skilled and diverse board of directors.

As of December 31, 2020, women represented one-third of the members of our board of directors, and approximately 55% of our board of directors was from underrepresented communities as defined by California’s AB 979.

We value diversity at all levels and continue to focus on enhancing our diversity and inclusion initiatives across our entire workforce.

We are also committed to social responsibility, and our board of directors and its committees provide active oversight of our corporate social

responsibility initiatives.

Examples of our initiatives include our company matching program for employee charitable contributions and the free security training programs we offer to help with career development for our employees and the general public.

As of December 31, 2021, our total headcount was 10,195 employees, approximately 30% of whom were employed in the United States and approximately 70% of whom were employed outside of the United States.

Our employees are the foundation of our innovation and cybersecurity leadership for the benefit of our customers.

We understand there is a shortage of highly skilled employees for security companies like ours, and we believe that our success and competitive advantage depends largely on our ability to continue to attract and retain highly skilled employees with diverse backgrounds and experiences.

We believe we offer fair, competitive compensation and benefits, and we encourage a culture of fairness and meritocracy.

Our compensation programs for our employees include base pay, incentive compensation, opportunities for equity ownership where local statutes allow and employee benefits that promote well-being across different aspects of our employees’ lives, which may include health and welfare insurance, retirement benefits and paid time off.

As a global company, much of our success is rooted in the diversity of our teams and our commitment to diversity, equity and inclusion.

Such commitment starts at the top, with a highly skilled and diverse board of directors.

As of December 31, 2021, women represented one-third of the members of our board of directors, and approximately 56% of our board of directors was from underrepresented communities as defined by California’s Assembly Bill 979.

We value diversity at all levels and continue to focus on enhancing our diversity, equity and inclusion initiatives across our workforce.

We are also committed to community engagement and social responsibility with regards to our employees and beyond, and our board of directors has active oversight of such initiatives.

Examples of our initiatives focused on our employees include our company matching program for employee charitable contributions and the free security training programs we offer to help with career development for our employees, in addition to the general public.

Our culture is defined by our commitment to ethics and integrity.

We reinforce our ethical “tone from the top” through clear policies including our Code of Business Conduct and Ethics, regular compliance training for our employees, quarterly meetings of our cross-functional Ethics Committee, clear messaging from our executives, enforcement of company policies and oversight by our board of directors.

We reinforce our ethical “tone at the top” through clear policies including our Code of Business Conduct and Ethics, regular compliance training for our employees, quarterly meetings of our cross-functional Ethics Committee, clear messaging from our executives, enforcement of company policies and oversight by our board of directors.

In addition, our Chief Executive Officer regularly communicates the importance of Fortinet’s core values of openness, teamwork and innovation.

We are committed to providing a safe and healthy work environment for our employees.

We are committed to providing our employees a safe and healthy work environment.

We sponsor a global wellness program designed to enhance physical, financial and mental wellbeing for all our employees around the world.

Throughout the year, we encourage healthy behaviors through communications, educational sessions, wellness challenges and other incentives.

Early in the COVID-19 pandemic, our Chief Executive Officer committed to having no COVID-related layoffs, and, throughout the pandemic, not only have we kept that promise, we have continued hiring at a fast pace and helping support our employees and their families through this challenging time.

Early in the COVID-19 pandemic, our Chief Executive Officer committed to having no COVID-related layoffs, and, throughout the pandemic, not only have we kept that promise, we have continued hiring at a fast pace and have continued to help support our employees and their families through this challenging time.

During the pandemic, we have taken a flexible approach to help our employees manage their work and personal responsibilities, with a focus on employee wellbeing, health and safety.

3 unchanged sentences

We have not experienced any work stoppages, and we consider our relations with our employees to be good.

Environmental, Social and Governance

We are committed to responsible environmental, social and governance (“ESG”) practices.

This commitment starts with the Social Responsibility Committee of our board of directors providing oversight of our Corporate Social Responsibility (“CSR”) strategy, initiatives and execution related to ESG matters.

Our senior leadership sponsors the integration of CSR priorities throughout our business operations.

In addition, our Global Head of Sustainability and CSR, along with our internal cross-functional employee CSR Committee, engage with internal and external stakeholders to lead CSR execution, communications and disclosure.

Environmental.

We recognize climate change is a global crisis and are committed to doing our part to reduce negative environmental impact by setting clear goals, engaging in coalitions and collaborating across our value chain.

We have engaged with a consultancy to measure our Scope 1 and Scope 2 emissions and developed reduction plans based on science-based targets pathways.

We also have begun to conduct an inventory of our Scope 3 emissions to look at the decarbonization of our broader value chain.

Those actions align with our roadmap on helping do our part to mitigate climate change, with the aim of implementing a framework that aligns with the Task Force on Climate Related Financial Disclosures (“TCFD”).

In November 2021, we publicly committed to a target of carbon neutrality on our Scope 1 and Scope 2 emissions by 2030 and announcing the completion of our new, net-zero building on our Sunnyvale headquarters campus, which was designed to be LEED-Gold certified.

As discussed above, we prioritized the health and safety of our employees during the COVID-19 pandemic.

Through ou r Global Supplier Code of Conduct and Contract Manufacturer agreement, we continued to reach across our supply chain to communicate our expectations regarding human rights, labor standards, business practices and workplace health and safety conditions.

We are also committed to building an inclusive, equitable and diverse workforce within our organization and across the security industry, to help empower individuals to reach their full potential.

In line with that commitment, we are focused on diversity, equity and inclusion as part of our mission to close the cybersecurity skills gap.

Last year, we formalized our Education Outreach Program, which focuses on partnerships across the industry, academia, government and nonprofits to ensure we are helping train women, veterans and other under-represented groups.

To support the creation of a cybersecurity-aware society, we published a children’s book designed to further increase cyber awareness among children and extended our free cybersecurity training courses empowering over 100,000 people from over 200 countries and territories to learn from our cyber-security training courses in 2021.

We also made a public pledge to train one million people in cybersecurity by 2026.

Our culture is defined by our commitment to ethics and integrity.

We stress the importance of ethical business practices in multiple ways, such as through our Code of Business Conduct and Ethics, regular compliance training programs and ongoing communications.

Reinforcing the importance of our ESG contributions, our board of directors established its Social Responsibility Committee to oversee our objectives, strategy and execution relating to sustainability and CSR, including ESG matters.

As part of our regular engagement with our stockholders and our commitment to ESG, including our regular review of our corporate governance structure and evaluation of recent trends in corporate governance, we have evolved our corporate governance practices over time and have, since becoming a public company, implemented the following measures, among others:

majority voting standard for uncontested elections of directors, allowing stockholders to call special meetings of our stockholders, declassification of our board of directors, proxy access, and stock ownership guidelines with respect to our non-employee directors.

Available Information

7 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business