What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2024-02-26 compared with 2023-02-24 · 78 added, 227 removed, 127 unchanged (71% of the section changed)

Fortinet is a global leader in cybersecurity and networking solutions for organizations, including enterprises, communication service providers, security service providers, government organizations and small businesses.

The focus areas of our business consist of:

• Secure Networking —Our Secure Networking solutions enable the convergence of networking and security across all edges to provide next-generation firewall (“NGFW”), software-defined wide area network (“SD-WAN”), LAN Edge (Wi-Fi and switch) and secure access service edge (“SASE”).

Traditional networking lacks awareness of content, applications, users, devices, location and more.

A secure networking approach converges networking and security into a single, accelerated solution.

A specially designed operating system and security processors work in concert to improve network performance and security posture while decreasing footprint and power consumption.

We derive a majority of product sales from our Core Platform (previously referred to as FortiGate) network security appliances.

Core Platform network security appliances include a broad set of built-in security and networking features and functionalities, including firewall, next-generation firewall, secure web gateway, secure sockets layer (“SSL”) inspection, SD-WAN, intrusion prevention system (“IPS”), sandboxing, data leak prevention, virtual private network (“VPN”), switch and wireless controller and wide area network (“WAN”) edge.

Our network security appliances are managed by our FortiOS network operating system, which provides the foundation for Core Platform security functions.

We enhance the performance of our network security appliances from branch to data center by designing and implementing Application-Specific Integrated Circuits (“ASIC”) technology within our appliances, enabling us to add security and network functionality with minimal impact to network throughput performance.

Along with our secure Wi-Fi access points and switches, Fortinet helps organizations secure their networks across campuses, branches and work from anywhere (“WFA”) deployments.

For the Japanese market, we also offer high performance network switches marketed under Alaxala Networks Corporation for data center switching.

FortiOS supports many more secure networking markets and applications than just firewall.

These include:

• Network Firewall (“NFW”)

• Software-Defined Wide Area Network (“SD-WAN”)

• Secure LAN/WLAN (Wi-Fi and Switch) (SD-Branch/Campus)

• Secure Access Service Edge (“SASE”)

• Universal Zero Trust Network Access (“ZTNA”)

• Encryption Applications (SSL Inspection, Virtual Private Network (“VPN”), and IPsec Connectivity)

Further each security application has number of customer use cases.

For example, Network Firewall has the following use cases:

• Data Center Perimeter NGFW

• North–South Internal Segmentation Firewall

• Distributed Network Edge Firewall

• East–West Micro Segmentation Firewall

• Virtual Firewall (“VM”)

• Cloud Native Firewall (“CNF”)

• Firewall as a Service (“FWaaS”)

• Containerized Firewall

• Endpoint Firewall

• SMB Firewall

• Home Firewall

• Zero Trust Access —Our Zero Trust Access solutions enable customers to know and control who and what is on their network, in addition to providing security for WFA.

Zero Trust Access solutions include FortiNAC,

Table o f Contents

FortiAuthenticator, FortiClient/EDR and FortiToken.

Our network access control solutions provide visibility, control and automated event responses in order to secure internet of things (“IoT”) and OT devices.

• Cloud Security —We help customers connect securely to and across their individual, hybrid-cloud, multi-cloud and virtualized data center environments by offering security through our virtual firewall and other software products and through integrated capabilities with major cloud platforms.

Our public and private cloud security solutions, including virtual appliances and hosted solutions, extend the core capabilities of Fortinet’s cybersecurity mesh architecture (“Fortinet Security Fabric”) in and across cloud environments, delivering security that follows their applications and data.

Our solutions include network security, web application firewall and application programming interface (“API”) protection, cloud-native security and workload protection.

Our Secure SD-WAN for multi-cloud solution automates deployment of an overlay network across different cloud networks and offers visibility, control and centralized management that integrates functionality across multiple cloud environments.

Our cloud security portfolio also includes securing applications in all environments in which they can be deployed, including physical and virtual data centers, cloud and edge compute instances.

Fortinet cloud security offerings are available for deployment in major public and private cloud environments, including Amazon Web Services, Google Cloud, IBM Cloud, Microsoft Azure, Oracle Cloud and VMWare Cloud.

We also offer managed web application firewall (“WAF”) rules delivered by FortiGuard Labs as an overlay service to native security offerings offered by Amazon Web Services.

• AI-Driven Security Operations —We develop and provide a range of products and services that enable the security operations center (“SOC”) teams to identify, investigate and remediate potential incidents in which cybercriminals bypass prevention-oriented controls.

Given the breadth of the attack surface to monitor, as well as the volume and sophistication of cyber threats, artificial intelligence (“AI”) is a key part of these offerings, which include:

FortiGuard and other security subscription services, endpoint security with endpoint detection and response (“EDR”), a range of breach-protection technologies plus our security information and event management (“SIEM”) and security orchestration, automation and response (“SOAR”), all of which can be applied across the Fortinet Security Fabric.

These solutions automatically deliver security intelligence and insights that help organizations to protect against and respond to threats through integration with Fortinet and third-party solutions.

• FortiGuard Security Services —FortiGuard security services counter threats in real time with AI-powered, coordinated protection.

All of our security services are natively integrated into the Fortinet Security Fabric.

This enables fast detection and enforcement across the entire attack surface.

Risk is continually assessed and the Security Fabric automatically adjusts to counter the latest known and unknown threats in real time.

It is able to close security gaps with context-aware, consistent security policies for users and applications in hybrid deployments across the network, endpoints and clouds.

• Support and Professional Services —FortiCare Technical Support Service is a per-device support service, which provides customers access to experts to ensure efficient and effective operations and maintenance of their Fortinet capabilities.

Global technical support is offered 24x7 with flexible add-ons, including enhanced service level agreements (“SLAs”) and premium hardware replacement through in-country depots.

Fortinet is a leader in cybersecurity and the convergence of networking and security.

Our mission is to secure people, devices and data everywhere.

Our integrated platform, the Fortinet Security Fabric, spans secure networking, unified Secure Access Service Edge (“SASE”) and AI-driven security operations to deliver cybersecurity where our customers need it.

As of December 31, 2023, over a half million customers trusted our solutions, including enterprises such as in the financial services, retail and operational technology market verticals, communication and security service providers, government organizations and small and medium-sized businesses.

As a global company headquartered in Sunnyvale, California with a large international customer base, the majority of our research and development is in the United States and Canada with a global footprint of support and centers of excellence around the world.

As of December 31, 2023, we held 957 U.S.

patents and 1,299 global patents and we are recognized in over 80 enterprise analyst reports demonstrating both our vision and execution across networking and security products.

• Secure Networking —Our Secure Networking solutions focus on the convergence of networking and security via our network firewall and our switches, access points and other secure connectivity solutions.

FortiOS is our networking and security operating system that is consistent across our firewalls and secure connectivity solutions and supports over 30 functions that can be delivered via a physical, virtual, cloud or Software as a Service (“SaaS”) solution.

When delivered via our network firewall appliances, functionality is accelerated through our proprietary Application-Specific Integrated Circuits (“ASIC”) technology.

These proprietary ASICs, combined with off-the-shelf central processing units (“CPUs”) and ASICs, allow our systems to scale, run multiple applications at higher performance, lower power consumption and perform more processor-intensive operations, such as inspecting encrypted traffic, including streaming video.

The Network Firewall solution consists of FortiGate data centers, hyperscale and distributed firewalls, as well as encrypted applications (secure sockets layer (“SSL”) inspection, Virtual Private Network and IPsec connectivity).

Our ability to converge networking and security also enables the ethernet to become an extension of a company’s security infrastructure through FortiSwitch and FortiLink.

Our wireless local area network (“LAN”) solution leverages secure networking to provide secure wireless access for the enterprise LAN edge.

FortiExtender secures 5G/LTE and remote ethernet extenders to connect and secure any branch environment.

The Secure Connectivity solution includes FortiSwitch Secure Ethernet Switches, FortiAP Wireless Local Area Network Access Points and FortiExtender 5G Connectivity Gateways, among other products.

• Unified Secure Access Service Edge (SASE) —As applications move to the cloud and work from anywhere becomes established, cloud delivery is needed to enable secure access to applications on any cloud.

The Fortinet Unified SASE solution is a single-vendor SASE solution that includes Firewall, SD-WAN, Secure Web Gateway, Cloud Access Services Broker, Data Loss Prevention, Zero Trust Network Access and cloud security, including Web Application Firewalls, Virtualized Firewalls and Cloud-Native Firewalls, among other products.

These functions are delivered through our FortiOS operating systems, which can deploy the full SASE stack through the cloud or on our ASIC-driven appliances.

All functions can be managed through a unified management console.

• Security Operations (SecOps) —Fortinet’s Security Operations solutions comply with the National Institute of Standards and Technology (“NIST”) cybersecurity framework of identify, protect, detect, respond and recover, and are delivered as a platform that automates detection and response to accelerate discovery and remediation.

The SecOps solution includes FortiAI generative AI assistant, FortiSIEM Security Information and Event Management, FortiSOAR Security Orchestration, Automation and Response, FortiEDR Endpoint Detection and Response, FortiXDR Extended Detection and Response, FortiMDR Managed Detection and Response Service, FortiNDR Network Detection and Response, FortiRecon Digital Risk Protection, FortiDeceptor Deception technology, FortiGuard SoCaaS, FortiSandbox Sandboxing Services and FortiGuard Incident Response Services, among other products.

FortiGuard Labs is our cybersecurity threat intelligence and research organization comprised of experienced threat hunters, researchers, analysts, engineers and data scientists who develop and utilize machine learning and AI technologies to provide timely protection updates and actionable threat intelligence for the benefit of our customers.

FortiGuard Security Services are a suite of AI-powered security capabilities that are natively integrated as part of the Fortinet Security Fabric to deliver coordinated detection and enforcement across the entire attack surface.

The portfolio consists of FortiGuard application security services, content security services, device security services, NOC/SOC security services and web security services.

FortiCare Technical Support Service is a per-device support service, which provides customers access to experts to ensure efficient and effective operations and maintenance of their Fortinet capabilities.

Global technical support is offered 24x7 with flexible add-ons, including enhanced Service Level Agreements (“SLAs”) and premium hardware replacement through in-

country depots.

Organizations have the flexibility to procure different levels of service for different devices based on their availability needs.

1 unchanged sentence

FortiCare Premium, FortiCare Elite and FortiCare Essential.

The newly launched FortiCare Elite service provides 15-minute response times for key product families.

During our year ended December 31, 2022, we generated total revenue of $4.42 billion and net income of $857.3 million.

The FortiCare Elite service aims to provide 15-minute response times for key product families.

We also offer training services to our end-customers and channel partners through our training team and authorized training partners.

We have also implemented a training certification program, Network Security Expert (“NSE”), to help ensure an understanding of our products and services.

Since 2020, Fortinet has also offered a number of free online training courses to help address prevalent industry-wide cybersecurity skills gaps and shortages.

During the year ended December 31, 2023, we generated total revenue of $5.30 billion and net income of $1.15 billion.

See Part II, Item 8 of this Annual Report on Form 10-K for more information on our consolidated balance sheets as of December 31, 2023 and 2022 and our consolidated statements of income, comprehensive income, equity (deficit), and cash flows for each of the three years ended December 31, 2023, 2022 and 2021.

1 unchanged sentence

Our principal executive office is located at 909 Kifer Road, Sunnyvale, California 94086 and our telephone number at that location is (408) 235-7700.

Consolidation of Technology and Architecture

Cybersecurity has traditionally been deployed one solution at a time and not designed to work well with other deployed solutions while also increasing management complexity.

A Fortinet Security Fabric approach consolidates point products into a platform, allowing for much tighter integration, increased automation and a more rapid, coordinated and effective response to threats across the network.

The Fortinet Security Fabric has an open architecture designed to integrate Fortinet solutions and third-party solutions.

Table o f Contents

Our product offerings consist of our Core Platform network security products and our Enhanced Platform Technology (previously referred to as Platform Extension) products, which are offered in a broad range of form factors spanning physical appliances, virtual appliances, software and cloud-hosted services.

This enables us to protect customers across all edges and deployment scenarios including users, devices, networks, cloud and virtual data center.

Our cloud- and hosted- products and services include sandboxing, EDR, email security, web application and API security, cloud networking security and cloud-native protection as well as Fortinet Security Fabric management and analytics.

Additionally, we offer cloud-delivered and hosted-security services.

Our FortiGuard security services are enabled by FortiGuard Labs, which provides threat research and artificial intelligence capabilities from a cloud network to deliver protection through Core Platform appliance and virtual machine as well as Fortinet Security Fabric products that are registered by the end-customer.

All these are combined to form the Fortinet Security Fabric, which is an approach to security that consolidates discrete security solutions together into an integrated offering.

This integrated approach to security extends across both Fortinet-developed solutions and a broad ecosystem of technology partner solutions and technologies.

Our proprietary FortiASIC technology family consists of three processors.

First, a Network Processor Generation 7, FortiNP 7 (“NP 7”), which accelerates the processing of firewall traffic and offloads this function from the central processing unit (“CPU”).

Second, a Content Processor Generation 9, FortiCP (“CP 9”), helps the CPU with deep packets inspection functions, such as intrusion prevention and antivirus.

Multiple NP7s and CP 9s can be placed in larger firewalls to provide more scale.

Third, the central CPU, network processing and content processing functions are all brought together in a single ASIC called the Security Processor Generation 5.

These Fortinet Proprietary ASICs, along with off-the-shelf CPU/ASICs, allow our systems to scale from the smallest branch to a hyperscale cloud and run multiple applications at high performance.

The use of ASICs allows our appliances to consolidate security functionality and converge security with a minimal impact to network throughput performance, which we believe delivers a lower total cost of ownership (“TCO”) to our customers.

As the security needs and technologies of our end-customers increase, we believe our TCO-driven ASIC approach give our products a competitive advantage against other architectural approaches.

FortiOS, its associated security and networking functions and products that run or are integrated with FortiOS are combined to form the Fortinet Security Fabric.

This approach to security ties discrete security solutions together into an integrated offering.

Our proprietary FortiOS operating system provides the foundation for the operation of Core Platform network security appliances, whether physical, virtual, private- or public-cloud based.

We make regular enhancements and other updates to FortiOS available through our FortiCare support services.

The convergence of security and networking capabilities provided by the Fortinet Security Fabric are powered and controlled through FortiOS.

FortiOS provides (i) multiple layers of security, including a hardened kernel layer providing protection for the Core Platform system, (ii) a network security layer, providing security for end-customers’ network infrastructures and (iii) application content protection, providing security for end-customers’ workstations and applications.

FortiOS directs the operations of processors and ASICs and provides system management functions such as command line, graphical user interfaces, multiple network and security topology views.

FortiOS also enables advanced, integrated routing and switching, allowing end-customers to deploy Core Platform devices within a wide variety of networks, as well as providing a direct replacement solution option for legacy switching and routing equipment.

FortiOS implements a suite of commonly used standards-based routing protocols as well as network address translation technologies, allowing the Core Platform appliance to integrate and operate in a wide variety of network environments.

Additional features include virtual domain capabilities, which can provide support for multiple customers on a single device or FortiOS instance in support of service provider and managed security service provider (“MSSP”) deployments.

FortiOS also provides traffic-logging capabilities for forensic analysis purposes.

FortiOS is designed to help control network traffic in order to optimize performance by including functionality such as packet classification, queue disciplines, policy enforcement, congestion management, WAN optimization and caching.

Our core product offerings consist of our Core Platform firewall product family and our Enhanced Platform Technology products, which may be purchased to integrate and expand security architectures.

Our Enhanced Platform Technology products include the Fortinet Security Fabric, email security, cloud security, endpoint protection and other products.

Our Core Platform hardware and software licenses are sold with a set of Core Platform broad security services.

Table o f Contents

security services are enabled by FortiGuard Labs, which provides threat research and artificial intelligence capabilities from a global cloud network to deliver protection services.

Core Platform

Core Platform converges a broad set of security and networking functions, including firewall, intrusion prevention, anti-malware, VPN, application control, web filtering, anti-spam and WAN acceleration.

Core Platform is available as a hardware appliance or as a virtual appliance.

All Core Platform appliances run on FortiOS.

Core Platform platforms can be centrally managed through both embedded web-based and command line interfaces, as well as through FortiManager, which provides a central management architecture for Core Platform appliances and the Fortinet Security Fabric.

With over 35 models in the Core Platform product line, Core Platform is designed to address security requirements for small- to medium-sized businesses, large enterprises and government organizations worldwide.

Most Core Platform hardware appliances include one of our ASICs to accelerate content and network security features implemented within FortiOS.

The significant differences between each model are the performance and scalability targets each model is designed to meet, while the security features and associated services offered are common throughout all models.

The FortiGate-20 through -90 series models are designed for perimeter protection for small- to medium-sized businesses and enterprises with distributed offices.

The FortiGate-100 through -900 series models are designed for perimeter deployment in medium-sized to large enterprise networks.

The FortiGate-1000 through -7000 series models deliver high performance and scalable network security functionality for perimeter, data center and hyper-scale data centers, and core deployment in large enterprises.

In addition to networking security features, all FortiGate models and form factors also deliver secure SD-WAN capabilities.

Fortinet also offers FortiGate Rugged models for OT applications where ruggedized appliances are needed.

We also incorporate additional technologies within Core Platform appliances that differentiate our solutions, including data leak protection, traffic optimization, SSL inspection, threat vulnerability management and wireless controller technology.

In addition to these built-in features, we offer a full range of wireless access points and controllers, complementing Core Platform appliances with the flexibility of wireless local area network access.

Fortinet Security Fabric and Enhanced Platform Technology Products

As part of the Fortinet Security Fabric, we offer products that provide network security, endpoint security, cloud security, web-based application security, identity and access management, sandbox protection and email security.

The integration of devices using open standards, common operating systems, and unified management platforms enables the sharing and correlation of real-time threat intelligence.

The following Fortinet products can operate as part of the Fortinet Security Fabric:

• FortiAnalyzer —Our FortiAnalyzer family of products provides centralized network logging, analyzing and reporting solutions that securely aggregate content and log data from our Core Platform devices, other Fortinet products and third-party devices.

• FortiAP —Our FortiAP product family provides secure wireless networking solutions.

FortiAPs allow a variety of management options, including from the cloud and directly from our Core Platform firewall product.

FortiAPs create a scalable and secure access layer for connecting wireless devices such as computers, laptops, cell phones and tablets, as well as IoT devices.

• FortiClient —Our FortiClient provides advanced endpoint protection with pattern-based anti-malware, behavior-based exploit protection, web-filtering and an application firewall.

FortiClient integrates with FortiSandbox to detect zero-day threats and custom malware.

FortiClient also provides secure remote access with built-in VPN, single-sign-on and two-factor authentication for added security.

• FortiEDR/XDR —Our FortiEDR/XDR is an endpoint protection solution that provides both machine-learning anti-malware protection and remediation.

FortiEDR/XDR supports broad OS coverage workstations, servers, and virtual machines, including legacy operating and embedded systems.

• FortiGate VM — FortiGate VM is our network firewall virtual appliance that extends the Fortinet Security Fabric through the cloud on-ramp into the cloud, enabling customers to achieve converged security and networking capabilities networking within the cloud and between clouds and hybrid clouds.

FortiGate VM is powered by the same FortiOS that runs FortiGate appliances to deliver consistent security across data centers

Table o f Contents

and the cloud.

FortiGate VM is also powered by Fortinet virtualized Application-Specific Integrated Circuits (“vASICs”) to deliver accelerated security and performance with minimal impact to performance.

Our cloud networking solution enables better, more secure application experiences for users and branch offices by providing for encrypted data transports, granular segmentation and application-layer protection against advanced threats, and seamless overlay network with uniform policies across multi-clouds.

FortiGate VM is available for all major cloud providers, hypervisors and software-defined network (“SDN”) platforms.

• FortiMail —Our FortiMail product family provides secure email gateway solutions.

FortiMail utilizes the technologies and security services from FortiGuard Labs to deliver protection against threats that use email as an attack vector.

FortiMail also integrates data protection capabilities to avoid data loss.

• FortiManager —Our FortiManager family of products provides a central and scalable management solution for our Core Platform products, including software updates, configuration, policy settings and security updates.

FortiManager facilitates the coordination of policy-based provisioning, device configuration and operating system revision management, as well as network security monitoring and device control.

• FortiSandbox —Our FortiSandbox technology delivers proactive detection and mitigation with the ability to generate a directly actionable protection capability.

Available in both hardware and cloud-based form, the FortiSandbox subjects suspicious code to a set of multi-layer protection techniques, culminating in execution within an operating system, allowing real-time behavioral analysis to be performed in a secure environment.

When malicious code is identified, a signature can be generated locally for distribution across the Fortinet Security Fabric.

• FortiSwitch —Our FortiSwitch product family provides secure switching solutions that can be deployed in traditional network switching designs with Layer 2 or Layer 3 access control features.

FortiSwitch creates a scalable and secure access layer for customers to connect their end devices, such as computers and laptops, as well as to expand the field of IoT devices.

• FortiToken —Our FortiToken allows organizations to implement two-factor authentication to better safeguard systems, assets and data.

With two-factor authentication, a password is used along with a security token and authentication server to provide seamless yet highly secured access between users and applications.

Authorized employees can access company resources safely using a variety of devices, ranging from laptops to mobile phones.

• FortiWeb —Our FortiWeb product family provides web application firewall solutions, including internet protocol (“IP”) reputation and anti-botnet security, distributed denial-of-service protection, protocol validation, application attack signatures and deep learning AI to protect applications against a wide range of threats.

The products listed above are available in multiple form factors, such as hardware, virtual machine, cloud or software-as-a-service (“SaaS”), except for FortiSwitch, FortiAP and FortiExtender, which are available as hardware appliances only and FortiGate VM and FortiEDR/XDR which are available as virtual solutions only.

FortiGuard Security Subscription Services

Security requirements are dynamic due to the constantly changing nature of threats.

Our FortiGuard security subscription services are designed to deliver threat detection and prevention capabilities to end-customers worldwide as threats evolve.

Our FortiGuard Labs global threat research team identifies emerging threats, collects threat samples, and replicates, reviews, characterizes and collates attack data through the use of AI, automation and original research.

Based on this research, we develop updates for virus signatures, attack definitions, scanning engines and other security solution components to distribute to end-customers.

FortiGuard functionality varies depending on the Core Platform and Enhanced Platform Technology products, and will typically include one or more of the following functions:

application control, antivirus, intrusion prevention, web filtering, anti-spam, VPN functions, email image analysis, vulnerability management, database functions, web functions, advanced threat protection, sandboxing and domain and IP reputation services.

End-customers purchase FortiGuard security subscription services in advance, typically with terms of one to five years.

We provide FortiGuard security subscription services 24 hours a day, seven days a week.

Table o f Contents

FortiCare Technical Support Services

Our FortiCare support services portfolio includes technical support, FortiOS updates and extended product warranty.

For our standard technical support, our channel partners may provide first-level support to the end-customer.

We also provide first-level support to our end-customers, as well as second- and third-level support as appropriate.

We also provide knowledge management tools and customer self-help portals to help augment our support capabilities in an efficient and scalable manner.

We deliver technical support to partners and end-customers 24 hours a day, seven days a week, through regional technical support centers.

In addition to our technical support services, we offer a range of advanced services, including premium support, professional services and expedited warranty replacement.

Service Bundles

We also sell FortiGuard and FortiCare services as bundles, consolidating security services into packages that are appropriate for different use cases or end-customers.

• Advanced Threat Protection —Our Advanced Threat Protection bundle includes antivirus, data sanitation sandbox, intrusion prevention, virus outbreak protection, mobile security, application control, IP reputation and anti-botnet security, along with FortiCare support services.

• Unified Threat Protection —Our Unified Threat Protection bundle includes the Advanced Threat Protection security services noted above, as well as intrusion prevention, virus outbreak protection, web filtering and FortiCare support services.

• Enterprise Protection —Our Enterprise Protection bundle includes the Unified Threat Protection services noted above, as well as industrial control systems, security rating, along with enhanced FortiCare support services.

• Small Medium Business —Our Small Medium Business bundle includes the Unified Threat Protection services noted above, as well as FortiGate Cloud which provides cloud-based management, reporting, and analytics for Core Platforms along with enhanced FortiCare support services.

Professional Services

We offer professional services to end-customers including technical account managers (“TAMs”), resident engineers (“REs”) and professional service consultants, security architects for implementations and remote, cloud-based incident response (“IR”).

TAMs and REs are dedicated support engineers available to help identify and eliminate issues before problems arise.

Each TAM and RE acts as a single point of contact and customer advocate within Fortinet, offering a deep understanding of our customers’ businesses and security requirements.

Our professional services consultants and security architects help to formulate customer-specific security strategies, develop roadmaps for securing digital initiatives and design product deployments.

They work closely with end-customers to implement our products according to design, utilizing network analysis tools, traffic simulation software and scripts.

Fortinet also offers remote, cloud-based IR and monitoring services to help customers identify, remediate and understand compromises.

This service leverages our FortiEDR capabilities either as part of a premium FortiEDR subscription for continuous monitoring or alternatively, can be deployed to help deliver IR services on a per incident basis.

Training Services

We offer training services to our end-customers and channel partners through our training team and authorized training partners.

We have also implemented a training certification program, Network Security Expert, to help ensure an understanding of our products and services.

Since 2020, Fortinet also offers a number of free online training courses to help address prevalent industry-wide cybersecurity skills gaps and shortages.

Table o f Contents

We typically sell our security solutions to distributors that sell to networking security focused resellers and to service providers and MSSPs, who, in turn, sell products and/or services to end-customers.

At times, we also sell directly to large service providers and major systems integrators who may sell to our end-customers or use our products and services to provide hosted solutions to other enterprises.

Our end-customers are lo cated in over 100 countries and include small, medium and large enterprises and government organizations across a wide range of industries, including education, financial services, government, healthcare, manufacturing, retail, technology and telecommunications.

An end-customer deployment may involve as few as one or as many as thousands of appliances as well as other Fortinet Security Fabric products.

Customers may also access our products via the cloud through certain cloud providers such as Amazon Web Services, Google Cloud, IBM Cloud, Microsoft Azure and Oracle Cloud.

Industry Background:

The Trends Driving the Need for a Platform Approach

Modern networks are increasingly complex, spanning many edges as well as a mix of cloud and on-premises deployments.

Fortinet was founded with the mission of providing a converged networking and security approach that empowers organizations to adopt new technologies without worrying about how it would impact their ability to manage and secure their environments.

The escalating threat landscape has resulted in a significant increase in the demand for secure networking solutions.

In fact, we believe the demand for secure networking will overtake the pure networking market by 2030.

At the same time, businesses contend with an escalating threat landscape, a cybersecurity skills shortage, and siloed security tools that do not work well together.

They need to consolidate point products to gain better visibility and faster threat response times.

A platform approach –what we call the Fortinet Security Fabric–has emerged to address these challenges and support enterprises in reducing complexity and improving risk mitigation.

The concept of an integrated cybersecurity platform that converges networking and security and consolidates point products is what guides how we design our products and advise our customers and partners .

Our end-customers are located in over 100 countries and include small, medium and large enterprises and government organizations across a wide range of industries, including financial services, government, manufacturing, retail, technology, education, healthcare and telecommunications.

An end-customer deployment may involve as few as one or as many as dozens of different types of integrated products and services from across our broad portfolio that spans secure networking, unified SASE, and security operations.

Customers may also access our products via the cloud through certain cloud providers such as Amazon Web Services, Microsoft Azure and Google Cloud.

Often, our customers also purchase our FortiGuard security subscription services and FortiCare technical support services.

Refer to Note 16.

Segment Information in Part II, Item 8 of this Annual Report on Form 10-K for distributor customers that accounted for 10% or more of our revenue or net accounts receivable.

Refer to Note 16 Segment Information in Part II, Item 8 of this Annual Report on Form 10-K for distributor customers that accounted for 10% or more of our revenue or net accounts receivable.

Sales and Marketing

We primarily sell our products and services through a two-tier distribution model.

We sell to distributors that sell to resellers and to service providers and MSSPs, who, in turn, sell products and/or services to end-customers.

We sell to distributors that sell to resellers and to service providers and managed security service providers (“MSSPs”), who, in turn, sell products and/or services to end-customers.

In certain cases, we sell directly to large service providers and major systems integrators.

We work with many technology distributors, including Arrow Electronics, Inc., Exclusive, Ingram Micro and TD Synnex (formerly Tech Data Corporation and Synnex Corporation, separately).

In addition, we provide our cloud-based subscription offerings through Fortinet-owned data centers, as well as data centers operated under co-location arrangements globally, and via public cloud providers.

We support our channel partners with a dedicated team of experienced channel account managers, sales professionals and sales engineers who provide business planning, joint marketing strategy, pre-sales and operational sales support.

6 unchanged sentences

We focus our resources on campaigns, programs, and activities that can be leveraged by partners worldwide to extend our marketing reach, such as sales tools and collateral, product awards and technical certifications, media engagement, training, regional seminars and conferences, webinars, and various other demand-generation activities.

In 2022, we continued to invest in sales and marketing resources, particularly in the enterprise market where we believe there is an opportunity to expand our business.

We intend to continue to make investments in sales and marketing resources, which are critical to support our growth.

Manufacturing and Suppliers

15 unchanged sentences

(“AMD”), network and wireless chips from Broadcom Inc.

(“Broadcom”), Marvell Technology

Table o f Contents

(“Broadcom”), Marvell Technology Group Ltd.

(“Marvell”), Qualcomm Incorporated (“Qualcomm”) and Intel and memory devices from Intel, Micron Technology (“Micron”), ADATA Technology Co., Ltd.

4 unchanged sentences

Research and Development

We focus our research and development efforts on developing new hardware and software products and services, and adding new features to existing products and services.

We focus our research and development efforts on developing new hardware and software products and services, and adding new features to existing products, services and operating systems.

Our development strategy is to identify features, products and systems for both software and hardware that are, or are expected to be, important to our end-customers.

10 unchanged sentences

However, we cannot provide assurance that the steps we take will prevent misappropriation of our technology.

In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as the laws of the United States, and many foreign countries do not enforce these laws as diligently as government agencies and private parties in the United States.

In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as the laws

of the United States, and many foreign countries do not enforce these laws as diligently as government agencies and private parties in the United States.

Our industry is characterized by the existence of a large number of patents and frequent claims and related litigation regarding patent and other IP rights.

4 unchanged sentences

Government Regulation

We are subject to regulation by various federal, state, regional, local and foreign governmental agencies, including agencies responsible for monitoring and enforcing employment and labor laws, workplace safety, product safety, product labeling, environmental laws, consumer protection laws, anti-bribery laws, data privacy laws, import and export controls, federal securities laws and tax laws and regulations.

We are subject to regulation by various federal, state, regional, local and foreign governmental agencies, including agencies responsible for monitoring and enforcing employment and labor laws, workplace safety, security, product safety, product labeling, environmental laws, consumer protection laws, anti-bribery laws, data privacy laws, import and export controls, federal securities laws and tax laws and regulations.

Many of the laws and regulations that are or may be applicable to our business are changing or being tested in courts and could be interpreted in ways that could adversely impact our business.

2 unchanged sentences

We continue to monitor existing and pending laws and regulations and while the impact of regulatory changes cannot be predicted with certainty, we do not currently expect compliance to have a material adverse effect.

Table o f Contents

For information regarding seasonality in our sales, see the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Seasonality, Cyclicality and Quarterly Revenue Trends” in Part II, Item 7 of this Annual Report on Form 10-K.

3 unchanged sentences

• addition and integration of new networking and security features and technological expertise;

• compliance with industry standards and certifications;

• compliance with industry standards and security and other certifications;

• price of products and services and total cost of ownership;

6 unchanged sentences

• other competitive differentiators.

Among others, our competitors include Arista Networks, Inc.(“Arista”), Aruba Networks, Inc.(“Aruba”), Barracuda Networks, Inc.

(“Barracuda”), Check Point Software Technologies Ltd.

Among others, our competitors include Aruba Networks, Inc.

(“Aruba”), Check Point Software Technologies Ltd.

(“Check Point”), Cisco Systems, Inc.

5 unchanged sentences

(“Palo Alto Networks”), SonicWALL, Inc.

(“SonicWALL”), Sophos Group Plc (“Sophos”), Trend Micro Incorporated (“Trend Micro”), VMware, Inc.

(“SonicWALL”), Sophos Group Plc (“Sophos”), VMware, Inc.

(“VMware”) and Zscaler, Inc.

1 unchanged sentence

Several competitors are significantly larger, have greater financial, technical, marketing, distribution, customer support and other resources, are more established than we are, and have significantly better brand recognition.

Some of these larger competitors have substantially broader product offerings and leverage their relationships based on other products or incorporate functionality into existing products in a manner that discourages users from purchasing our products.

Some of these larger competitors have substantially broader product offerings and leverage their relationships based on other products or incorporate

functionality into existing products in a manner that discourages users from purchasing our products.

Based in part on these competitive pressures, we may lower prices or attempt to add incremental features and functionalities to our products.

11 unchanged sentences

Our compensation programs for our employees include base pay, incentive compensation, opportunities for equity ownership where local statutes allow and employee benefits that promote well-being across different aspects of our employees’ lives, which may include health and welfare insurance, retirement benefits and paid time off.

Table o f Contents

As a global company, much of our success is rooted in the diversity of our teams and our commitment to diversity, equity and inclusion (“DEI”).

7 unchanged sentences

In addition, our Chief Executive Officer regularly communicates the importance of Fortinet’s core values of openness, teamwork and innovation.

We are committed to providing our employees a safe and healthy work environment.

We sponsor a global wellness program designed to enhance physical, financial and mental wellbeing for all our employees around the world.

Throughout the year, we encourage healthy behaviors through communications, educational sessions, wellness challenges and other incentives.

None of our U.S.

3 unchanged sentences

Environmental, Social and Governance

We are committed to responsible environmental, social and governance (“ESG”) practices.

This commitment starts with the Social Responsibility Committee of our board of directors providing oversight of our Corporate Social Responsibility (“CSR”) strategy, initiatives and execution related to ESG matters.

We are committed to responsible environmental, social and governance (“ESG”) practices and having a positive impact on the sustainability of our society and planet.

Fortinet is a member of the Dow Jones Sustainability Indices — World and North America, for the second consecutive year.

Our approach to ESG is based on a strong corporate governance structure, starting with the Social Responsibility Committee of our board of directors, which provides oversight of our Corporate Social Responsibility (“CSR”) strategy, initiatives and execution related to ESG matters.

Our senior leadership sponsors the integration of CSR priorities throughout our business operations.

In addition, our Global Head of Sustainability and CSR, along with our internal cross-functional employee CSR Committee, engage with internal and external stakeholders to lead CSR execution, communications and disclosure.

In addition, our CSR team, along with our internal cross-functional employee CSR Committee, engage with internal and external stakeholders to lead CSR execution, communications and disclosure.

Environmental.

1 unchanged sentence

We are committed to helping address climate change impacts and minimizing the environmental footprint of our solutions, operations and our broader value chain.

We have engaged with a consultancy to measure our Scope 1 and Scope 2 emissions and to further engage on our path to carbon neutrality in alignment with the Paris Agreement we formally signed on to the Science-Based Target Initiative commitment in September 2022.

We implemented an Environmental Management Systems platform to track our energy, water and waste impact, and engaged on the ISO14001 certification process for our company-owned warehouse in Union City, California.

We began aligning our climate strategy and disclosures to the Task Force on Climate Related Financial Disclosures framework and submitted our Carbon Disclosure Project report.

We continue to combine innovation with environmental sustainability to reduce the use of energy, cooling and space required for our solutions, thereby helping our customers minimize power consumption and greenhouse gas emissions.

We are engaged on a

decarbonization path to reach net zero for our Scope 1 and Scope 2 emissions by 2030, and formally signed on to the Science-Based Target Initiative commitment in September 2022.

In 2023, we obtained the ISO14001 certification for our largest company-owned warehouse in Union City, California, and have continued to be a leader on energy efficiency with the launch of our SP5 ASIC and our FortiGate-90G model.

We submitted our survey on environment to CDP, which is a not-for-profit charity organization that runs the global disclosure system for companies to manage their environmental impacts.

We also disclosed for the first time our Scope 3 emissions, across all 12 relevant categories, as part of our annual reporting on sustainability.

We are committed to building an inclusive, equitable and diverse workforce within our organization and across the security industry to help empower individuals to reach their full potential.

We continue to focus on skilling, upskilling and reskilling individuals to reach our goal of training one million people in cybersecurity by 2026.

At the 2022 White House National Cyber Workforce and Education Summit, we announced the expansion of our existing free training offerings, focusing on schools.

We introduced an enhanced enterprise-grade Security Awareness and Training service to help Information Technology (“IT”), security and compliance leaders build a cyber-aware culture within their organizations.

We continued to expand partnerships with educational institutions and now count over 500 Authorized Academic Partners.

Our Education Outreach Program focuses on creating cyber career pathways for underrepresented populations, including women, veterans and disadvantaged individuals.

In total, we trained over 210,000 people through our various initiatives in 2022.

Internally, we pursue our progress on DEI and have established organizational governance by forming a global DEI Organizing Committee and DEI Council to provide a shared direction and commitment to recruiting and valuing a diverse workforce, fostering a culture of teamwork and openness, and building a more inclusive workplace.

Table o f Contents

Our approach to responsible business is based on strong corporate governance practices that aim to ensure accountability while meeting our responsibilities across our value chain.

Our board of directors frequently reviews our governance practices to ensure that they are appropriate and reflect our company’s maturity.

To promote ethical business practices, we have adopted policies related to proper business conduct and ethics that apply to employees, partners and suppliers, and we have compliance trainings and controls in place.

In 2022, we expanded the human rights language in our compliance and business ethics training and updated our supplier and partner codes of conduct to reference our environmental and human rights policies.

As part of our engagement with stockholders and our commitment to ESG, we regularly evaluate our corporate governance structure and practices, and have implemented the following measures, among others:

majority voting standard for uncontested elections of directors, allowing stockholders to call special meetings of our stockholders, declassification of our board of directors, proxy access and stock ownership guidelines with respect to our non-employee directors.

We continue to focus on skilling, upskilling and reskilling individuals and are on track to reach our goal of training one million people in cybersecurity by 2026 with over 430,000 individuals trained as of the end of 2023.

As part of our Education Outreach Program, which focuses on creating a more diverse cybersecurity talent pool, we launched the Veterans Program Advisory Council to help build on the Veterans Program's success in providing more cybersecurity training pathways for military veterans across the United States, the United Kingdom, Canada, Australia and New Zealand.

We offered our Security Awareness Curriculum at no cost to primary and secondary schools across the same countries.

We continued to expand partnerships with educational institutions and now have over 650 Authorized Academic Partners in 99 countries or territories across the world.

Internally, we continue to foster a culture of diversity and inclusion through our DEI Council, which meets quarterly, Employee Resource Groups and various campaigns and activities that engage our broader workforce.

Our approach to responsible business is based on strong corporate governance practices that aim to ensure accountability while meeting our responsibilities across our value chain, starting with our employees.

Our board of directors regularly reviews our governance practices.

Our Codes of Conduct apply to employees, partners and suppliers, and we have compliance trainings and controls in place.

In 2023, we established a risk management committee and steering committee to further enhance our anti-corruption program and we employ a thorough screening process for partners and suppliers, including continuous monitoring in high-risk zones, and resolution process for risk mitigation.

Available Information

7 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business