What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2023-02-24 compared with 2022-02-25 · 158 added, 122 removed, 196 unchanged (59% of the section changed)

1 unchanged sentence

The focus areas of our business consist of:

• Convergence / Security-Driven Networking —Our Security-Driven Networking solutions enable the convergence of networking and security across all edges to provide next-generation firewall (“NGFW”), software-defined wide area network (“SD-WAN”), LAN Edge (Wi-Fi and switch) and secure access service edge (“SASE”).

• Secure Networking —Our Secure Networking solutions enable the convergence of networking and security across all edges to provide next-generation firewall (“NGFW”), software-defined wide area network (“SD-WAN”), LAN Edge (Wi-Fi and switch) and secure access service edge (“SASE”).

Traditional networking lacks awareness of content, applications, users, devices, location and more.

A security-driven networking approach converges networking and security into a single, accelerated solution.

A specially designed operating system and security processors work in concert to greatly improve network performance and security posture while decreasing footprint and power consumption.

We derive a majority of product sales from our FortiGate network security appliances.

FortiGate network security appliances include a broad set of built-in security and networking features and functionalities, including firewall, next-generation firewall, secure web gateway, secure sockets layer (“SSL”) inspection, software-defined wide area network (“SD-WAN”), intrusion prevention system (“IPS”), sandboxing, data leak prevention, virtual private network (“VPN”), switch and wireless controller and wide area network (“WAN”) edge.

Our network security appliances are managed by our FortiOS network operating system, which provides the foundation for FortiGate security functions.

We enhance the performance of our network security appliances from branch to data center by designing and implementing security processing units (“SPUs”) technology within our appliances, enabling us to add security and network functionality with minimal impact to network throughput performance.

A secure networking approach converges networking and security into a single, accelerated solution.

A specially designed operating system and security processors work in concert to improve network performance and security posture while decreasing footprint and power consumption.

We derive a majority of product sales from our Core Platform (previously referred to as FortiGate) network security appliances.

Core Platform network security appliances include a broad set of built-in security and networking features and functionalities, including firewall, next-generation firewall, secure web gateway, secure sockets layer (“SSL”) inspection, SD-WAN, intrusion prevention system (“IPS”), sandboxing, data leak prevention, virtual private network (“VPN”), switch and wireless controller and wide area network (“WAN”) edge.

Our network security appliances are managed by our FortiOS network operating system, which provides the foundation for Core Platform security functions.

We enhance the performance of our network security appliances from branch to data center by designing and implementing Application-Specific Integrated Circuits (“ASIC”) technology within our appliances, enabling us to add security and network functionality with minimal impact to network throughput performance.

Along with our secure Wi-Fi access points and switches, Fortinet helps organizations secure their networks across campuses, branches and work from anywhere (“WFA”) deployments.

For the Japanese market, we also offer high performance network switches marketed under Alaxala Networks Corporation for data center switching.

FortiOS supports many more secure networking markets and applications than just firewall.

These include:

• Network Firewall (“NFW”)

• Software-Defined Wide Area Network (“SD-WAN”)

• Secure LAN/WLAN (Wi-Fi and Switch) (SD-Branch/Campus)

• Secure Access Service Edge (“SASE”)

• Universal Zero Trust Network Access (“ZTNA”)

• Encryption Applications (SSL Inspection, Virtual Private Network (“VPN”), and IPsec Connectivity)

Further each security application has number of customer use cases.

For example, Network Firewall has the following use cases:

• Data Center Perimeter NGFW

• North–South Internal Segmentation Firewall

• Distributed Network Edge Firewall

• East–West Micro Segmentation Firewall

• Virtual Firewall (“VM”)

• Cloud Native Firewall (“CNF”)

• Firewall as a Service (“FWaaS”)

• Containerized Firewall

• Endpoint Firewall

• SMB Firewall

• Home Firewall

• Zero Trust Access —Our Zero Trust Access solutions enable customers to know and control who and what is on their network, in addition to providing security for WFA.

Zero Trust Access solutions include FortiNAC, FortiAuthenticator, FortiClient/EDR and FortiToken.

Our network access control solutions provide visibility, control and automated event responses in order to secure internet of things (“IoT”) and operational technology (“OT”) devices.

• Adaptive Cloud Security —We help customers connect securely to and across their individual, hybrid cloud, multi-cloud and virtualized data center environments by offering security through our virtual firewall and other software products and through integrated capabilities with major cloud platforms.

Our public and private cloud security solutions, including virtual appliances and hosted solutions, extend the core capabilities of the Fortinet Security Fabric cybersecurity mesh platform in and across cloud environments, delivering security that follows their applications and data.

Zero Trust Access solutions include FortiNAC,

Table o f Contents

FortiAuthenticator, FortiClient/EDR and FortiToken.

Our network access control solutions provide visibility, control and automated event responses in order to secure internet of things (“IoT”) and OT devices.

• Cloud Security —We help customers connect securely to and across their individual, hybrid-cloud, multi-cloud and virtualized data center environments by offering security through our virtual firewall and other software products and through integrated capabilities with major cloud platforms.

Our public and private cloud security solutions, including virtual appliances and hosted solutions, extend the core capabilities of Fortinet’s cybersecurity mesh architecture (“Fortinet Security Fabric”) in and across cloud environments, delivering security that follows their applications and data.

Our solutions include network security, web application firewall and application programming interface (“API”) protection, cloud-native security and workload protection.

Our Secure SD-WAN for multi-cloud solution automates deployment of an overlay network across different cloud networks and offers visibility, control and centralized management that integrates functionality across multiple cloud environments.

Our cloud security portfolio also includes securing applications, including email and web.

Fortinet cloud security offerings are available for deployment in major public and private cloud environments, including Alibaba Cloud, Amazon Web Services, Google Cloud, IBM Cloud, Microsoft Azure, Oracle Cloud and VMWare Cloud.

We also offer managed IPS and web application firewall (“WAF”) rules delivered by FortiGuard Labs as an overlay service to native security offerings offered by Amazon Web Services.

Our cloud security portfolio also includes securing applications in all environments in which they can be deployed, including physical and virtual data centers, cloud and edge compute instances.

Fortinet cloud security offerings are available for deployment in major public and private cloud environments, including Amazon Web Services, Google Cloud, IBM Cloud, Microsoft Azure, Oracle Cloud and VMWare Cloud.

We also offer managed web application firewall (“WAF”) rules delivered by FortiGuard Labs as an overlay service to native security offerings offered by Amazon Web Services.

• AI-Driven Security Operations —We develop and provide a range of products and services that enable the security operations center (“SOC”) teams to identify, investigate and remediate potential incidents in which cybercriminals bypass prevention-oriented controls.

Given the breadth of the attack surface to monitor, as well as the volume and sophistication of cyber threats, artificial intelligence (“AI”) is a key part of these offerings, which include:

FortiGuard and other security subscription services, endpoint security with endpoint detection and response (“EDR”), a range of breach-protection technologies plus our security information and event management (“SIEM”) and security orchestration, automation and response (“SOAR”), all of which can be applied across the Fortinet Security Fabric cybersecurity mesh platform.

These solutions automatically deliver security intelligence and insights that help organizations to protect against and respond to threats through integration with Fortinet and third-party solutions.

• Security as a Service —Our customers purchase our FortiGuard security subscription services as an add-on to products and solutions across the Fortinet Security Fabric to receive threat intelligence and protection updates.

FortiGuard services are designed to provide protection for users and applications, including offerings for IPS, web, video and domain name system (“DNS”) filtering, audio/visual (“AV”) and cloud sandbox along with IoT and OT Security.

FortiGuard security services are provided from our FortiGuard Labs and cloud-delivered to provide real-time unified protection across network endpoint and cloud.

• Support and Professional Services —Fortinet offers technical support, FortiOS updates, and extended product warranty through our FortiCare support services.

In addition to our technical support services, we offer a range of advanced services, including premium support, professional services and expedited warranty replacement.

Our professional service offerings include resident engineers and professional service consultants for implementations or trainings.

• FortiGuard Security Services —FortiGuard security services counter threats in real time with AI-powered, coordinated protection.

All of our security services are natively integrated into the Fortinet Security Fabric.

This enables fast detection and enforcement across the entire attack surface.

Risk is continually assessed and the Security Fabric automatically adjusts to counter the latest known and unknown threats in real time.

It is able to close security gaps with context-aware, consistent security policies for users and applications in hybrid deployments across the network, endpoints and clouds.

• Support and Professional Services —FortiCare Technical Support Service is a per-device support service, which provides customers access to experts to ensure efficient and effective operations and maintenance of their Fortinet capabilities.

Global technical support is offered 24x7 with flexible add-ons, including enhanced service level agreements (“SLAs”) and premium hardware replacement through in-country depots.

Organizations have the flexibility to procure different levels of service for different devices based on their availability needs.

We offer three per-device support options tailored to the needs of our enterprise customers:

FortiCare Premium, FortiCare Elite and FortiCare Essential.

The newly launched FortiCare Elite service provides 15-minute response times for key product families.

During our year ended December 31, 2022, we generated total revenue of $4.42 billion and net income of $857.3 million.

See Part II, Item 8 of this Annual Report on Form 10-K for more information on our consolidated balance sheets as of December 31, 2021 and 2020 and our consolidated statements of income, comprehensive income, equity, and cash flows for each of the three years ended December 31, 2021, 2020 and 2019.

See Part II, Item 8 of this Annual Report on Form 10-K for more information on our consolidated balance sheets as of December 31, 2022 and 2021 and our consolidated statements of income, comprehensive income, equity (deficit), and cash flows for each of the three years ended December 31, 2022, 2021 and 2020.

We were incorporated in Delaware in November 2000.

2 unchanged sentences

Cybersecurity has traditionally been deployed one solution at a time and not designed to work well with other deployed solutions while also increasing management complexity.

A Fortinet Security Fabric cybersecurity mesh platform approach consolidates point products into a platform, allowing for much tighter integration, increased automation and a more rapid, coordinated, and effective response to threats across the network.

A Fortinet Security Fabric approach consolidates point products into a platform, allowing for much tighter integration, increased automation and a more rapid, coordinated and effective response to threats across the network.

The Fortinet Security Fabric has an open architecture designed to integrate Fortinet solutions and third-party solutions.

Our product offerings consist of our FortiGate network security products and our non-FortiGate products, which are offered in a broad range of form factors spanning physical appliances, virtual appliances, software and cloud-hosted services.

This enables Fortinet to protect customers across all edges and deployment scenarios including users, devices, networks, cloud, and virtual data center.

Our cloud- and hosted- products and services include sandboxing, endpoint detection and response (“EDR”), email security, web application and API security, and cloud networking security as well as Fortinet Security Fabric management and analytics.

Table o f Contents

Our product offerings consist of our Core Platform network security products and our Enhanced Platform Technology (previously referred to as Platform Extension) products, which are offered in a broad range of form factors spanning physical appliances, virtual appliances, software and cloud-hosted services.

This enables us to protect customers across all edges and deployment scenarios including users, devices, networks, cloud and virtual data center.

Our cloud- and hosted- products and services include sandboxing, EDR, email security, web application and API security, cloud networking security and cloud-native protection as well as Fortinet Security Fabric management and analytics.

Additionally, we offer cloud-delivered and hosted-security services.

Our FortiGuard security services are enabled by FortiGuard Labs, which provides threat research and artificial intelligence capabilities from a cloud network to deliver protection through FortiGate appliance and virtual machine as well as Fortinet Security Fabric products that are registered by the end-customer.

All these are combined to form the Fortinet Security Fabric cybersecurity mesh platform, which is an approach to security that consolidates discrete security solutions together into an integrated offering.

Our FortiGuard security services are enabled by FortiGuard Labs, which provides threat research and artificial intelligence capabilities from a cloud network to deliver protection through Core Platform appliance and virtual machine as well as Fortinet Security Fabric products that are registered by the end-customer.

All these are combined to form the Fortinet Security Fabric, which is an approach to security that consolidates discrete security solutions together into an integrated offering.

This integrated approach to security extends across both Fortinet-developed solutions and a broad ecosystem of technology partner solutions and technologies.

Our proprietary SPUs are application-specific integrated circuits (“ASICs”) that include (i) the content processor (“SPU CP”), (ii) the network processor (“SPU NP”) and (iii) the system-on-a-chip (“SPU SoC”).

Our SPUs are embedded in our physical FortiGate appliances and are designed to enhance the security processing capabilities of our operating system by accelerating computationally intensive tasks such as firewall policy enforcement, SD-WAN, network address translation, IPS, threat detection and encryption while also converging security capabilities with networking functionality.

We also provide virtualized security processing units (“vSPUs”) across our FortiGate virtual appliances.

The use of SPUs allows our appliances to consolidate security functionality and converge security with a minimal impact to network throughput performance, which we believe delivers a lower total cost of ownership (“TCO”) to our customers.

As the security needs and technologies of our end-customers increase, we believe our TCO-driven SPU approach give our products a competitive advantage against other architectural approaches.

Entry-level FortiGate products often use the SPU SoC to provide the necessary acceleration at this level.

Mid-range FortiGate products use a central processing unit (“CPU”) and include the SPU NP and SPU CP hardware acceleration.

The high-end FortiGate products use multiple CPUs, SPU CPs and SPU NPs.

FortiOS, its associated security and networking functions and products that run or are integrated with FortiOS are combined to form the Fortinet Security Fabric cybersecurity mesh platform.

Our proprietary FortiASIC technology family consists of three processors.

First, a Network Processor Generation 7, FortiNP 7 (“NP 7”), which accelerates the processing of firewall traffic and offloads this function from the central processing unit (“CPU”).

Second, a Content Processor Generation 9, FortiCP (“CP 9”), helps the CPU with deep packets inspection functions, such as intrusion prevention and antivirus.

Multiple NP7s and CP 9s can be placed in larger firewalls to provide more scale.

Third, the central CPU, network processing and content processing functions are all brought together in a single ASIC called the Security Processor Generation 5.

These Fortinet Proprietary ASICs, along with off-the-shelf CPU/ASICs, allow our systems to scale from the smallest branch to a hyperscale cloud and run multiple applications at high performance.

The use of ASICs allows our appliances to consolidate security functionality and converge security with a minimal impact to network throughput performance, which we believe delivers a lower total cost of ownership (“TCO”) to our customers.

As the security needs and technologies of our end-customers increase, we believe our TCO-driven ASIC approach give our products a competitive advantage against other architectural approaches.

FortiOS, its associated security and networking functions and products that run or are integrated with FortiOS are combined to form the Fortinet Security Fabric.

This approach to security ties discrete security solutions together into an integrated offering.

Our proprietary FortiOS operating system provides the foundation for the operation of FortiGate network security appliances, whether physical, virtual, private- or public-cloud based.

Our proprietary FortiOS operating system provides the foundation for the operation of Core Platform network security appliances, whether physical, virtual, private- or public-cloud based.

We make regular enhancements and other updates to FortiOS available through our FortiCare support services.

The convergence of security and networking capabilities provided by the Fortinet Security Fabric cybersecurity mesh platform are powered and controlled through FortiOS.

FortiOS provides (i) multiple layers of security, including a hardened kernel layer providing protection for the FortiGate system, (ii) a network security layer, providing security for end-customers’ network infrastructures and (iii) application content protection, providing security for end-customers’ workstations and applications.

FortiOS directs the operations of processors and SPUs and provides system management functions such as command line, graphical user interfaces, multiple network and security topology views.

FortiOS also enables advanced, integrated routing and switching, allowing end-customers to deploy FortiGate devices within a wide variety of networks, as well as providing a direct replacement solution option for legacy switching and routing equipment.

FortiOS implements a suite of commonly used standards-based routing protocols as well as network address translation technologies, allowing the FortiGate appliance to integrate and operate in a wide variety of network environments.

The convergence of security and networking capabilities provided by the Fortinet Security Fabric are powered and controlled through FortiOS.

FortiOS provides (i) multiple layers of security, including a hardened kernel layer providing protection for the Core Platform system, (ii) a network security layer, providing security for end-customers’ network infrastructures and (iii) application content protection, providing security for end-customers’ workstations and applications.

FortiOS directs the operations of processors and ASICs and provides system management functions such as command line, graphical user interfaces, multiple network and security topology views.

FortiOS also enables advanced, integrated routing and switching, allowing end-customers to deploy Core Platform devices within a wide variety of networks, as well as providing a direct replacement solution option for legacy switching and routing equipment.

FortiOS implements a suite of commonly used standards-based routing protocols as well as network address translation technologies, allowing the Core Platform appliance to integrate and operate in a wide variety of network environments.

Additional features include virtual domain capabilities, which can provide support for multiple customers on a single device or FortiOS instance in support of service provider and managed security service provider (“MSSP”) deployments.

FortiOS also provides capabilities for the logging of traffic for forensic analysis purposes.

FortiOS also provides traffic-logging capabilities for forensic analysis purposes.

FortiOS is designed to help control network traffic in order to optimize performance by including functionality such as packet classification, queue disciplines, policy enforcement, congestion management, WAN optimization and caching.

Our core product offerings consist of our FortiGate firewall product family and our non-FortiGate products which may be purchased to integrate and expand security architectures.

Our non-FortiGate products include the Fortinet Security Fabric cybersecurity mesh platform, email security, cloud security, endpoint protection and other products.

Our FortiGate hardware and software licenses are sold with a set of FortiGate broad security services.

These security services are enabled by FortiGuard Labs, which provides threat research and artificial intelligence capabilities from a global cloud network to deliver protection services.

FortiGate converges a broad set of security and networking functions, including firewall, intrusion prevention, anti-malware, VPN, application control, web filtering, anti-spam and WAN acceleration.

FortiGate is available as a hardware appliance or as a virtual appliance.

All FortiGate appliances run on FortiOS.

FortiGate platforms can be centrally managed through both embedded web-based and command line interfaces, as well as through FortiManager, which provides a central management architecture for FortiGate appliances and the Fortinet Security Fabric cybersecurity mesh platform.

With over 35 models in the FortiGate product line, FortiGate is designed to address security requirements for small- to medium-sized businesses, large enterprises and government organizations worldwide.

Most FortiGate hardware appliances include one of our SPUs to accelerate content and network security features implemented within FortiOS.

Our core product offerings consist of our Core Platform firewall product family and our Enhanced Platform Technology products, which may be purchased to integrate and expand security architectures.

Our Enhanced Platform Technology products include the Fortinet Security Fabric, email security, cloud security, endpoint protection and other products.

Our Core Platform hardware and software licenses are sold with a set of Core Platform broad security services.

Table o f Contents

security services are enabled by FortiGuard Labs, which provides threat research and artificial intelligence capabilities from a global cloud network to deliver protection services.

Core Platform

Core Platform converges a broad set of security and networking functions, including firewall, intrusion prevention, anti-malware, VPN, application control, web filtering, anti-spam and WAN acceleration.

Core Platform is available as a hardware appliance or as a virtual appliance.

All Core Platform appliances run on FortiOS.

Core Platform platforms can be centrally managed through both embedded web-based and command line interfaces, as well as through FortiManager, which provides a central management architecture for Core Platform appliances and the Fortinet Security Fabric.

With over 35 models in the Core Platform product line, Core Platform is designed to address security requirements for small- to medium-sized businesses, large enterprises and government organizations worldwide.

Most Core Platform hardware appliances include one of our ASICs to accelerate content and network security features implemented within FortiOS.

The significant differences between each model are the performance and scalability targets each model is designed to meet, while the security features and associated services offered are common throughout all models.

4 unchanged sentences

Fortinet also offers FortiGate Rugged models for OT applications where ruggedized appliances are needed.

We also incorporate additional technologies within FortiGate appliances that differentiate our solutions, including data leak protection, traffic optimization, SSL inspection, threat vulnerability management and wireless controller technology.

In addition to these in-built features, we offer a full range of wireless access points and controllers, complementing FortiGate appliances with the flexibility of wireless local area network access.

Fortinet Security Fabric Cybersecurity Mesh Platform and Non-FortiGate Products

As part of the Fortinet Security Fabric cybersecurity mesh platform, we offer products that provide network security, endpoint security, cloud security, web-based application security, identity and access management, sandbox protection and

email security.

We also incorporate additional technologies within Core Platform appliances that differentiate our solutions, including data leak protection, traffic optimization, SSL inspection, threat vulnerability management and wireless controller technology.

In addition to these built-in features, we offer a full range of wireless access points and controllers, complementing Core Platform appliances with the flexibility of wireless local area network access.

Fortinet Security Fabric and Enhanced Platform Technology Products

As part of the Fortinet Security Fabric, we offer products that provide network security, endpoint security, cloud security, web-based application security, identity and access management, sandbox protection and email security.

The integration of devices using open standards, common operating systems, and unified management platforms enables the sharing and correlation of real-time threat intelligence.

The following Fortinet products can operate as part of the Fortinet Security Fabric cybersecurity mesh platform:

• FortiAnalyzer —Our FortiAnalyzer family of products provides centralized network logging, analyzing and reporting solutions that securely aggregate content and log data from our FortiGate devices, other Fortinet products and third-party devices to enable network logging, analysis and reporting.

The following Fortinet products can operate as part of the Fortinet Security Fabric:

• FortiAnalyzer —Our FortiAnalyzer family of products provides centralized network logging, analyzing and reporting solutions that securely aggregate content and log data from our Core Platform devices, other Fortinet products and third-party devices.

• FortiAP —Our FortiAP product family provides secure wireless networking solutions.

FortiAPs allow a variety of management options including from the cloud and directly from our FortiGate firewall product.

FortiAPs allow a variety of management options, including from the cloud and directly from our Core Platform firewall product.

FortiAPs create a scalable and secure access layer for connecting wireless devices such as computers, laptops, cell phones and tablets, as well as IoT devices.

4 unchanged sentences

FortiEDR/XDR supports broad OS coverage workstations, servers, and virtual machines, including legacy operating and embedded systems.

• FortiGate-VM — FortiGate-VM extends the Fortinet Security Fabric through the cloud on-ramp into the cloud, enabling customers to achieve security-driven networking within the cloud and between clouds and hybrid clouds.

FortiGate-VM is powered by Fortinet vSPUs to deliver accelerated security and performance with minimal impact to performance.

• FortiGate VM — FortiGate VM is our network firewall virtual appliance that extends the Fortinet Security Fabric through the cloud on-ramp into the cloud, enabling customers to achieve converged security and networking capabilities networking within the cloud and between clouds and hybrid clouds.

FortiGate VM is powered by the same FortiOS that runs FortiGate appliances to deliver consistent security across data centers

Table o f Contents

and the cloud.

FortiGate VM is also powered by Fortinet virtualized Application-Specific Integrated Circuits (“vASICs”) to deliver accelerated security and performance with minimal impact to performance.

Our cloud networking solution enables better, more secure application experiences for users and branch offices by providing for encrypted data transports, granular segmentation and application-layer protection against advanced threats, and seamless overlay network with uniform policies across multi-clouds.

3 unchanged sentences

FortiMail also integrates data protection capabilities to avoid data loss.

• FortiManager —Our FortiManager family of products provides a central and scalable management solution for our FortiGate products, including software updates, configuration, policy settings and security updates.

• FortiManager —Our FortiManager family of products provides a central and scalable management solution for our Core Platform products, including software updates, configuration, policy settings and security updates.

FortiManager facilitates the coordination of policy-based provisioning, device configuration and operating system revision management, as well as network security monitoring and device control.

1 unchanged sentence

Available in both hardware and cloud-based form, the FortiSandbox subjects suspicious code to a set of multi-layer protection techniques, culminating in execution within an operating system, allowing real-time behavioral analysis to be performed in a secure environment.

When malicious code is identified, a signature can be generated locally for distribution across the Fortinet Security Fabric cybersecurity mesh platform.

When malicious code is identified, a signature can be generated locally for distribution across the Fortinet Security Fabric.

• FortiSwitch —Our FortiSwitch product family provides secure switching solutions that can be deployed in traditional network switching designs with Layer 2 or Layer 3 access control features.

5 unchanged sentences

The products listed above are available in multiple form factors, such as hardware, virtual machine, cloud or software-as-a-service (“SaaS”), except for FortiSwitch, FortiAP and FortiExtender, which are available as hardware appliances only and FortiGate VM and FortiEDR/XDR which are available as virtual solutions only.

In the third quarter of 2021, we closed an acquisition of 75% of equity interests in Alaxala Networks Corporation (“Alaxala”), a privately held network hardware equipment company in Japan, to help address the increasing need for secure switches integrated with FortiGate firewalls and Security Fabric functionality, and, over time, to innovate and rebrand certain of Alaxala’s switches to offer a broader suite of secure switches globally.

In the first quarter of 2021, we acquired ShieldX Networks Inc.

(“ShieldX”), a provider of a security platform focusing on protecting multi-cloud data centers from the risk of lateral movement that can lead to attacks such as ransomware, data loss and service disruption.

FortiGuard Security Subscription Services

3 unchanged sentences

Based on this research, we develop updates for virus signatures, attack definitions, scanning engines and other security solution components to distribute to end-customers.

FortiGuard functionality varies depending on the FortiGate and non-FortiGate products, and will typically include one or more of the following functions:

FortiGuard functionality varies depending on the Core Platform and Enhanced Platform Technology products, and will typically include one or more of the following functions:

application control, antivirus, intrusion prevention, web filtering, anti-spam, VPN functions, email image analysis, vulnerability management, database functions, web functions, advanced threat protection, sandboxing and domain and IP reputation services.

1 unchanged sentence

We provide FortiGuard security subscription services 24 hours a day, seven days a week.

Table o f Contents

FortiCare Technical Support Services

10 unchanged sentences

• Enterprise Protection —Our Enterprise Protection bundle includes the Unified Threat Protection services noted above, as well as industrial control systems, security rating, along with enhanced FortiCare support services.

• Small Medium Business – Our Small Medium Business bundle includes the Unified Threat Protection services noted above, as well as FortiGate Cloud which provides cloud-based management, reporting, and analytics for FortiGates along with enhanced FortiCare support services.

• Small Medium Business —Our Small Medium Business bundle includes the Unified Threat Protection services noted above, as well as FortiGate Cloud which provides cloud-based management, reporting, and analytics for Core Platforms along with enhanced FortiCare support services.

Professional Services

10 unchanged sentences

Since 2020, Fortinet also offers a number of free online training courses to help address prevalent industry-wide cybersecurity skills gaps and shortages.

We typically sell our security solutions to distributors that sell to networking security focused resellers and to service providers and managed security service providers (“MSSPs”), who, in turn, sell products and/or services to end-customers.

Table o f Contents

We typically sell our security solutions to distributors that sell to networking security focused resellers and to service providers and MSSPs, who, in turn, sell products and/or services to end-customers.

At times, we also sell directly to large service providers and major systems integrators who may sell to our end-customers or use our products and services to provide hosted solutions to other enterprises.

Our end-customers are lo cated in over 100 countries and include small, medium and large enterprises and government organizations across a wide range of industries, including telecommunications, government, financial services, retail, technology, education, manufacturing and healthcare.

An end-customer deployment may involve as few as one or as many as thousands of appliances as well as other Fortinet Security Fabric cybersecurity mesh platform products.

Customers may also access our products via the cloud through certain cloud providers such as Alibaba Cloud, Amazon Web Services, Google Cloud, IBM Cloud, Microsoft Azure and Oracle Cloud.

Our end-customers are lo cated in over 100 countries and include small, medium and large enterprises and government organizations across a wide range of industries, including education, financial services, government, healthcare, manufacturing, retail, technology and telecommunications.

An end-customer deployment may involve as few as one or as many as thousands of appliances as well as other Fortinet Security Fabric products.

Customers may also access our products via the cloud through certain cloud providers such as Amazon Web Services, Google Cloud, IBM Cloud, Microsoft Azure and Oracle Cloud.

Often, our customers also purchase our FortiGuard security subscription services and FortiCare technical support services.

During 2021, Exclusive Networks Group (“Exclusive”) and Ingram Micro Inc.

(“Ingram Micro”) accounted for 31% and 12% of total revenue, respectively.

During 2020, Exclusive and Ingram Micro accounted for 30% and 10% of total revenue, respectively.

During 2019, Exclusive and Ingram Micro accounted for 31% and 11% of total revenue, respectively.

Refer to Note 16.

Segment Information in Part II, Item 8 of this Annual Report on Form 10-K for distributor customers that accounted for 10% or more of our revenue or net accounts receivable.

Sales and Marketing

24 unchanged sentences

We believe that outsourcing our manufacturing and a substantial portion of our logistics enables us to focus resources on our core competencies.

Our proprietary SPUs, which are key to the performance of our appliances, are built by contract manufacturers including Toshiba America Electronic Components, Inc.

(“Toshiba”) and Renesas Electronics America, Inc.

Our proprietary ASICs, which are key to the performance of our appliances, are built by contract manufacturers including Toshiba America Electronic Components, Inc.

(“Toshiba America”) and Renesas Electronics America, Inc.

These contract manufacturers use foundries in Taiwan and Japan operated by either Taiwan Semiconductor Manufacturing Company Limited (“TSMC”) or by the contract manufacturer itself.

The components included in our products are sourced from various suppliers by us or, more frequently, by our contract manufacturers.

Some of the components important to our business, including certain CPUs from Intel Corporation (“Intel”), network chips from Broadcom Inc.

(“Broadcom”), Marvell Technology Group Ltd.

(“Marvell”) and Intel, and memory devices from Intel, ADATA Technology Co., Ltd.

(“ADATA”), OCZ Technology Group, Inc., Samsung Electronics Co., Ltd.

Some of the components important to our business, including certain CPUs from Intel Corporation (“Intel”) and Advanced Micro Devices, Inc.

(“AMD”), network and wireless chips from Broadcom Inc.

(“Broadcom”), Marvell Technology

Table o f Contents

(“Marvell”), Qualcomm Incorporated (“Qualcomm”) and Intel and memory devices from Intel, Micron Technology (“Micron”), ADATA Technology Co., Ltd.

(“ADATA”), Toshiba Corporation (“Toshiba”), Samsung Electronics Co., Ltd.

(“Samsung”), and Western Digital Technologies, Inc.

13 unchanged sentences

Despite our efforts to protect our rights in our technology, unauthorized parties may attempt to copy aspects of our products or obtain and use information and technology that we regard as proprietary.

We generally enter into confidentiality agreements with our employees, consultants, vendors and customers, and generally limit access to and distribution of our

proprietary information.

We generally enter into confidentiality agreements with our employees, consultants, vendors and customers, and generally limit access to and distribution of our proprietary information.

However, we cannot provide assurance that the steps we take will prevent misappropriation of our technology.

9 unchanged sentences

In addition, the application and interpretation of these laws and regulations often are uncertain, particularly in the industry in which we operate.

We believe we are in compliance with current laws and regulations and do not expect continued compliance to have a material impact on our capital expenditures, earnings, or competitive position.

We believe we take reasonable steps designed to ensure we are in compliance with current laws and regulations and do not expect continued compliance to have a material impact on our capital expenditures, earnings, or competitive position.

We continue to monitor existing and pending laws and regulations and while the impact of regulatory changes cannot be predicted with certainty, we do not currently expect compliance to have a material adverse effect.

Table o f Contents

For information regarding seasonality in our sales, see the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Seasonality, Cyclicality and Quarterly Revenue Trends” in Part II, Item 7 of this Annual Report on Form 10-K.

The markets for our products are extremely competitive and are characterized by rapid technological change.

The principal competitive factors in our markets include the following:

The principal competitive factors in our markets include:

• product security performance, throughput, features, effectiveness, interoperability and reliability;

9 unchanged sentences

• other competitive differentiators.

Among others, our competitors include Barracuda Networks, Inc.

Among others, our competitors include Arista Networks, Inc.(“Arista”), Aruba Networks, Inc.(“Aruba”), Barracuda Networks, Inc.

(“Barracuda”), Check Point Software Technologies Ltd.

2 unchanged sentences

(“CrowdStrike”), F5 Networks, Inc.

(“F5 Networks”), Forcepoint LLC (“Forcepoint”), Imperva, Inc.

(“Imperva”), Juniper Networks, Inc.

(“Juniper”), Mandiant, Inc.

(“Mandiant”), McAfee, LLC (“McAfee”), Palo Alto Networks, Inc.

(“Palo Alto Networks”), Proofpoint, Inc.

(“Proofpoint”), SonicWALL, Inc.

(“SonicWALL”), Sophos Group Plc (“Sophos”), Trend Micro Incorporated (“Trend Micro”) and Zscaler, Inc.

(“F5 Networks”), Huawei Technologies Co., Ltd.

(“Huawei”), Juniper Networks, Inc.

(“Juniper”), Palo Alto Networks, Inc.

(“Palo Alto Networks”), SonicWALL, Inc.

(“SonicWALL”), Sophos Group Plc (“Sophos”), Trend Micro Incorporated (“Trend Micro”), VMware, Inc.

(“VMware”) and Zscaler, Inc.

We believe we compete favorably based on our products’ security performance, throughput, reliability, breadth and ability to work together, our ability to add and integrate new networking and security features and our technological expertise.

14 unchanged sentences

Our compensation programs for our employees include base pay, incentive compensation, opportunities for equity ownership where local statutes allow and employee benefits that promote well-being across different aspects of our employees’ lives, which may include health and welfare insurance, retirement benefits and paid time off.

As a global company, much of our success is rooted in the diversity of our teams and our commitment to diversity, equity and inclusion.

Table o f Contents

As a global company, much of our success is rooted in the diversity of our teams and our commitment to diversity, equity and inclusion (“DEI”).

Such commitment starts at the top, with a highly skilled and diverse board of directors.

As of December 31, 2021, women represented one-third of the members of our board of directors, and approximately 56% of our board of directors was from underrepresented communities as defined by California’s Assembly Bill 979.

We value diversity at all levels and continue to focus on enhancing our diversity, equity and inclusion initiatives across our workforce.

As of December 31, 2022 , women represented 25% of the members of our board of directors, and approximately 50% o f our board of directors was from underrepresented communities.

We value diversity at all levels and continue to focus on enhancing our DEI initiatives across our workforce.

We are also committed to community engagement and social responsibility with regards to our employees and beyond, and our board of directors has active oversight of such initiatives.

6 unchanged sentences

Throughout the year, we encourage healthy behaviors through communications, educational sessions, wellness challenges and other incentives.

Early in the COVID-19 pandemic, our Chief Executive Officer committed to having no COVID-related layoffs, and, throughout the pandemic, not only have we kept that promise, we have continued hiring at a fast pace and have continued to help support our employees and their families through this challenging time.

During the pandemic, we have taken a flexible approach to help our employees manage their work and personal responsibilities, with a focus on employee wellbeing, health and safety.

None of our U.S.

8 unchanged sentences

Environmental.

We recognize climate change is a global crisis and are committed to doing our part to reduce negative environmental impact by setting clear goals, engaging in coalitions and collaborating across our value chain.

We have engaged with a consultancy to measure our Scope 1 and Scope 2 emissions and developed reduction plans based on science-based targets pathways.

We also have begun to conduct an inventory of our Scope 3 emissions to look at the decarbonization of our broader value chain.

Those actions align with our roadmap on helping do our part to mitigate climate change, with the aim of implementing a framework that aligns with the Task Force on Climate Related Financial Disclosures (“TCFD”).

In November 2021, we publicly committed to a target of carbon neutrality on our Scope 1 and Scope 2 emissions by 2030 and announcing the completion of our new, net-zero building on our Sunnyvale headquarters campus, which was designed to be LEED-Gold certified.

As discussed above, we prioritized the health and safety of our employees during the COVID-19 pandemic.

Through ou r Global Supplier Code of Conduct and Contract Manufacturer agreement, we continued to reach across our supply chain to communicate our expectations regarding human rights, labor standards, business practices and workplace health and safety conditions.

We are also committed to building an inclusive, equitable and diverse workforce within our organization and across the security industry, to help empower individuals to reach their full potential.

In line with that commitment, we are focused on diversity, equity and inclusion as part of our mission to close the cybersecurity skills gap.

Last year, we formalized our Education Outreach Program, which focuses on partnerships across the industry, academia, government and nonprofits to ensure we are helping train women, veterans and other under-represented groups.

To support the creation of a cybersecurity-aware society, we published a children’s book designed to further increase cyber awareness among children and extended our free cybersecurity training courses empowering over 100,000 people from over 200 countries and territories to learn from our cyber-security training courses in 2021.

We also made a public pledge to train one million people in cybersecurity by 2026.

Our culture is defined by our commitment to ethics and integrity.

We stress the importance of ethical business practices in multiple ways, such as through our Code of Business Conduct and Ethics, regular compliance training programs and ongoing communications.

Reinforcing the importance of our ESG contributions, our board of directors established its Social Responsibility Committee to oversee our objectives, strategy and execution relating to sustainability and CSR, including ESG matters.

As part of our regular engagement with our stockholders and our commitment to ESG, including our regular review of our corporate governance structure and evaluation of recent trends in corporate governance, we have evolved our corporate governance practices over time and have, since becoming a public company, implemented the following measures, among others:

We recognize that environmental considerations such as climate change, resource scarcity and the energy crisis are top priorities for the future of our planet.

We are committed to helping address climate change impacts and minimizing the environmental footprint of our solutions, operations and our broader value chain.

We have engaged with a consultancy to measure our Scope 1 and Scope 2 emissions and to further engage on our path to carbon neutrality in alignment with the Paris Agreement we formally signed on to the Science-Based Target Initiative commitment in September 2022.

We implemented an Environmental Management Systems platform to track our energy, water and waste impact, and engaged on the ISO14001 certification process for our company-owned warehouse in Union City, California.

We began aligning our climate strategy and disclosures to the Task Force on Climate Related Financial Disclosures framework and submitted our Carbon Disclosure Project report.

We continue to combine innovation with environmental sustainability to reduce the use of energy, cooling and space required for our solutions, thereby helping our customers minimize power consumption and greenhouse gas emissions.

We are committed to building an inclusive, equitable and diverse workforce within our organization and across the security industry to help empower individuals to reach their full potential.

We continue to focus on skilling, upskilling and reskilling individuals to reach our goal of training one million people in cybersecurity by 2026.

At the 2022 White House National Cyber Workforce and Education Summit, we announced the expansion of our existing free training offerings, focusing on schools.

We introduced an enhanced enterprise-grade Security Awareness and Training service to help Information Technology (“IT”), security and compliance leaders build a cyber-aware culture within their organizations.

We continued to expand partnerships with educational institutions and now count over 500 Authorized Academic Partners.

Our Education Outreach Program focuses on creating cyber career pathways for underrepresented populations, including women, veterans and disadvantaged individuals.

In total, we trained over 210,000 people through our various initiatives in 2022.

Internally, we pursue our progress on DEI and have established organizational governance by forming a global DEI Organizing Committee and DEI Council to provide a shared direction and commitment to recruiting and valuing a diverse workforce, fostering a culture of teamwork and openness, and building a more inclusive workplace.

Table o f Contents

Our approach to responsible business is based on strong corporate governance practices that aim to ensure accountability while meeting our responsibilities across our value chain.

Our board of directors frequently reviews our governance practices to ensure that they are appropriate and reflect our company’s maturity.

To promote ethical business practices, we have adopted policies related to proper business conduct and ethics that apply to employees, partners and suppliers, and we have compliance trainings and controls in place.

In 2022, we expanded the human rights language in our compliance and business ethics training and updated our supplier and partner codes of conduct to reference our environmental and human rights policies.

As part of our engagement with stockholders and our commitment to ESG, we regularly evaluate our corporate governance structure and practices, and have implemented the following measures, among others:

majority voting standard for uncontested elections of directors, allowing stockholders to call special meetings of our stockholders, declassification of our board of directors, proxy access and stock ownership guidelines with respect to our non-employee directors.

2 unchanged sentences

The information posted on our website is not incorporated by reference into this Annual Report on Form 10-K.

Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to reports filed or furnished pursuant to Sections 13(a) and 15(d) of the Securities Act, are available free of charge on our investor relations web site as soon as reasonably practicable after we electronically file such material with, or furnish it to, the SEC.

Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to reports filed or furnished pursuant to Sections 13(a) and 15(d) of the Securities Act of 1933, as amended (the “Securities Act”), are available free of charge on our investor relations web site as soon as reasonably practicable after we electronically file such material with, or furnish it to, the Securities and Exchange Commission (the “SEC”).

You may also access all of our public filings through the SEC’s website at https://www.sec.gov.

We webcast our earnings calls and certain events we participate in or host with members of the investment community on our investor relations web site.

Additionally, we provide notifications of news or announcements regarding our financial performance, including SEC filings, investor events and press and earnings releases, as part of our investor relations web site.

The contents of these web sites are not intended to be incorporated by reference into this report or in any other report or document we file.

We webcast our earnings calls and certain events we participate in or host with members of the investment community on our investor relations website.

The contents of these websites are not intended to be incorporated by reference into this report or in any other report or document we file.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business