What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2025-02-21 compared with 2024-02-26 · 128 added, 75 removed, 130 unchanged (61% of the section changed)

Fortinet is a leader in cybersecurity and the convergence of networking and security.

Fortinet is a leader in cybersecurity, driving the convergence of networking and security.

Our mission is to secure people, devices and data everywhere.

Our integrated platform, the Fortinet Security Fabric, spans secure networking, unified Secure Access Service Edge (“SASE”) and AI-driven security operations to deliver cybersecurity where our customers need it.

As of December 31, 2023, over a half million customers trusted our solutions, including enterprises such as in the financial services, retail and operational technology market verticals, communication and security service providers, government organizations and small and medium-sized businesses.

As a global company headquartered in Sunnyvale, California with a large international customer base, the majority of our research and development is in the United States and Canada with a global footprint of support and centers of excellence around the world.

Our integrated platform, the Fortinet Security Fabric, spans secure networking, unified Secure Access Service Edge (“SASE”) and artificial intelligence (“AI”)-driven security operations (“SecOps”).

As of December 31, 2024, our end-customers were located in over 100 countries and included enterprises across a wide variety of market verticals, including financial services, retail, healthcare and operational technology (“OT”) market verticals, communication and security service providers, and government organizations.

As of December 31, 2024, our customers included approximately 80% of the Fortune 100 companies and approximately 72% of the Global 2000 companies.

We were also ranked #7 in the Forbes Most Trusted Companies list in 2024.

As a global company headquartered in Sunnyvale, California, our research and development is centered in the United States and Canada with a global footprint of support and centers of excellence around the world.

As of December 31, 2024, we held 1,034 U.S.

patents and 1,299 global patents and we are recognized in over 80 enterprise analyst reports demonstrating both our vision and execution across networking and security products.

• Secure Networking —Our Secure Networking solutions focus on the convergence of networking and security via our network firewall and our switches, access points and other secure connectivity solutions.

FortiOS is our networking and security operating system that is consistent across our firewalls and secure connectivity solutions and supports over 30 functions that can be delivered via a physical, virtual, cloud or Software as a Service (“SaaS”) solution.

When delivered via our network firewall appliances, functionality is accelerated through our proprietary Application-Specific Integrated Circuits (“ASIC”) technology.

These proprietary ASICs, combined with off-the-shelf central processing units (“CPUs”) and ASICs, allow our systems to scale, run multiple applications at higher performance, lower power consumption and perform more processor-intensive operations, such as inspecting encrypted traffic, including streaming video.

The Network Firewall solution consists of FortiGate data centers, hyperscale and distributed firewalls, as well as encrypted applications (secure sockets layer (“SSL”) inspection, Virtual Private Network and IPsec connectivity).

Our ability to converge networking and security also enables the ethernet to become an extension of a company’s security infrastructure through FortiSwitch and FortiLink.

Our wireless local area network (“LAN”) solution leverages secure networking to provide secure wireless access for the enterprise LAN edge.

patents and 1,378 global patents and we have been recognized in over 140 enterprise analyst reports demonstrating both our vision and execution across security and networking products.

Our competitive differentiation lies in our core technologies, which together provide performance, security, flexibility and integration across diverse environments.

• FortiOS —FortiOS enables the convergence of security and networking to enforce consistent security policies across form factors and edges.

As the foundation of the Fortinet Security Fabric, FortiOS empowers organizations to unify management and analytics for comprehensive network visibility and control at scale.

To further validate our strategy, FortiOS has been recognized across five Gartner Magic Quadrants, including Firewall, Software-Defined Wide-Area Network (“SD-WAN”), Security Service Edge (“SSE”), SASE Platforms and Wired and Wireless Local Area Network (“LAN”).

• FortiASIC —Our Application-Specific Integrated Circuit (“ASIC”)-based security processing units (“SPUs”) increase the speed, scale, efficiency and value of our solutions while improving user experience, reducing footprint and power requirements.

From branch and campus to data center solutions, SPU-powered Fortinet appliances deliver superior Security Compute Ratings versus industry alternatives.

• FortiCloud —Our organically built global cloud infrastructure, powered by FortiStack which is our secure software as a service (“SaaS”) platform operating as a private cloud service provider and leveraging software and hardware to optimize and secure all layers, provides customers with global reach, flexible connectivity, and cost savings.

• FortiAI —Our AI innovations encompass generative AI (“GenAI”), big data AI for threat intelligence to process and analyze trillions of events using AI/Machine Learning (“ML”), network operations AI for self-healing networks and automated network orchestration, automation and response, and AI for Large Language Model (“LLM”) leakage to protection against data leakage into LLMs.

Our GenAI assists security teams to make better decisions, rapidly respond to threats and save time on even the most complex tasks.

FortiAI is seamlessly integrated into the user experience of several of our products, including FortiAnalyzer, FortiSIEM and FortiSOAR, to help optimize threat investigation and response, Security information and event management (“SIEM”) queries, Security, orchestration, automation, and response (“SOAR”) playbook creation, among other functions.

• FortiEndpoint —FortiEndpoint converges secure connectivity, endpoint protection and advanced capabilities like endpoint detection and response and extended detection and response (“XDR”), into a single agent.

It simplifies management and enhances visibility while reducing costs and complexity.

The solution gives IT teams the visibility and control they need, while security teams benefit from automated threat detection and response.

This minimizes the need for manual intervention and provides faster remediation of threats across all environments.

• OT Security —The Fortinet Security Fabric enables security for converged IT/OT ecosystems.

It also provides an OT Security Platform with features and products to extend Security Fabric capabilities to OT networks in factories, plants, remote locations and ships.

To help alleviate security risks across the organization, we have continued to enhance our OT Security Platform offerings.

These innovations range from edge products to Network Operations Center (“NOC”) and Security Operations Center (“SOC”) tools and services to provide effective and efficient networking and cybersecurity performance and operation.

These competitive differentiators allow us to provide Chief Information Officer (“CIO”)s, Chief Information Security Officer (“CISO”)s, Chief Technology Officer (“CTO”)s, and their organizations with an integrated AI-driven cybersecurity platform with over 50 products across three solution pillars.

• Secure Networking —Our Secure Networking solutions focus on the convergence of networking and security via FortiOS, our networking and security operating system that is the foundation of our Fortinet Security Fabric platform and supports over 30 functions that can be delivered via a physical, virtual, cloud or software as a SaaS solution.

When delivered through our network firewall appliances, functionality is accelerated through our proprietary ASIC technology.

These proprietary ASICs, allow our systems to scale, run multiple applications at higher performance, lower power consumption and perform more processor-intensive operations, such as inspecting encrypted traffic, including streaming video.

Our network firewall offerings consist of a FortiGate data center, hyperscale and distributed firewalls, as well as encrypted applications (secure sockets layer (“SSL”) inspection, virtual private network and Internet Protocol Security (“IPsec”) connectivity).

Our ability to converge networking and security also enables the ethernet to become an extension of our customers’ security infrastructure through FortiSwitch and FortiLink.

Our wireless LAN solution leverages secure networking to provide secure wireless access for the enterprise LAN edge.

FortiExtender secures 5G/LTE and remote ethernet extenders to connect and secure any branch environment.

The Secure Connectivity solution includes FortiSwitch Secure Ethernet Switches, FortiAP Wireless Local Area Network Access Points and FortiExtender 5G Connectivity Gateways, among other products.

• Unified Secure Access Service Edge (SASE) —As applications move to the cloud and work from anywhere becomes established, cloud delivery is needed to enable secure access to applications on any cloud.

The Fortinet Unified SASE solution is a single-vendor SASE solution that includes Firewall, SD-WAN, Secure Web Gateway, Cloud Access Services Broker, Data Loss Prevention, Zero Trust Network Access and cloud security, including Web Application Firewalls, Virtualized Firewalls and Cloud-Native Firewalls, among other products.

These functions are delivered through our FortiOS operating systems, which can deploy the full SASE stack through the cloud or on our ASIC-driven appliances.

All functions can be managed through a unified management console.

• Security Operations (SecOps) —Fortinet’s Security Operations solutions comply with the National Institute of Standards and Technology (“NIST”) cybersecurity framework of identify, protect, detect, respond and recover, and are delivered as a platform that automates detection and response to accelerate discovery and remediation.

The SecOps solution includes FortiAI generative AI assistant, FortiSIEM Security Information and Event Management, FortiSOAR Security Orchestration, Automation and Response, FortiEDR Endpoint Detection and Response, FortiXDR Extended Detection and Response, FortiMDR Managed Detection and Response Service, FortiNDR Network Detection and Response, FortiRecon Digital Risk Protection, FortiDeceptor Deception technology, FortiGuard SoCaaS, FortiSandbox Sandboxing Services and FortiGuard Incident Response Services, among other products.

Our Secure Connectivity solution includes FortiSwitch secure ethernet switches, FortiAP wireless local area network access points and FortiExtender 5G connectivity gateways.

• Unified Secure Access Service Edge (SASE) —As applications move to the cloud and hybrid workforce is now the norm, enabling secure access for users with zero trust framework becomes important.

The Fortinet Unified SASE solution includes a single-vendor SASE solution that includes firewall, SD-WAN, secure web gateway, cloud access services broker, Data Loss Prevention (“DLP”) and zero trust network access to deliver flexible secure access for all users.

We are one of the few vendors to deliver consistent convergence and AI-powered security across Secure SD-WAN and SSE to enable a single-vendor SASE framework with a cloud-centric architecture powered by FortiOS.

Our global and scalable cloud network includes 150+ points of presence to deliver the seamless secure access experience.

Given this, we are well positioned to support customers expanding from SD-WAN to a single-vendor SASE platform.

Additionally, we offer a full suite of comprehensive, integrated cloud security solutions that enable customers to secure their applications from code to cloud.

Our solutions include application security that includes our web application firewalls, cloud network security with virtualized firewalls and cloud-native firewalls, cloud-native application protection and code security.

We deliver a holistic approach to cloud security, offering a single unified platform for cloud security and secure Continuous Integration/Continuous Delivery (“CI/CD”) application development needs, consolidating protection across multiple disparate tools, including coding, deploying, and running applications across hybrid and multi-clouds, and delivering AI-driven security across integrated solutions with visibility and context across hybrid and multi-cloud.

Additionally, we also offer flexible consumption licensing programs that enable organizations to dynamically optimize their cloud security needs and investments as well as readily meet their cloud minimum spend commitment obligations with Cloud Service Providers.

• AI-Driven Security Operations (SecOps) —Our AI-Driven SecOps portfolio provides a comprehensive suite of cybersecurity solutions that identify, protect, detect, respond and recover from threats, all integrated within the Fortinet Security Fabric.

At the core is FortiAnalyzer, which serves as the central SOC platform with its unified data lake that provides built-in SIEM, SOAR, XDR and threat intelligence, enabling centralized visibility, analytics and automation with complete control.

FortiSIEM delivers robust security information and event management for more advanced SOC requirements, while FortiSOAR enables automated orchestration and playbook-driven response.

This solution set also includes FortiEDR, FortiXDR, FortiNDR, FortiSandbox, FortiDeceptor, FortiDLP and FortiRecon, helping organizations achieve defense in depth, ensuring attackers face multiple layers of detection and mitigation across endpoints, networks, and applications.

To bolster their security posture, organizations contending with staff shortages can tap into FortiGuard services, including SOC-as-a-Service (“SOCaaS”), Managed detection and response (“MDR”), Security Posture Assessment and Incident Response.

Finally, FortiAI generative AI assistance streamlines operations, helping security teams stay ahead of an ever-evolving threat landscape.

FortiGuard Labs is our cybersecurity threat intelligence and research organization comprised of experienced threat hunters, researchers, analysts, engineers and data scientists who develop and utilize machine learning and AI technologies to provide timely protection updates and actionable threat intelligence for the benefit of our customers.

FortiGuard Security Services are a suite of AI-powered security capabilities that are natively integrated as part of the Fortinet Security Fabric to deliver coordinated detection and enforcement across the entire attack surface.

Using millions of global network sensors, FortiGuard Labs monitors the worldwide attack surface and employs AI to mine that data for new threats.

FortiGuard and Other Security Services are a suite of AI-powered security capabilities that are natively integrated as part of the Fortinet Security Fabric to deliver coordinated detection and enforcement across the entire attack surface.

The portfolio consists of FortiGuard application security services, content security services, device security services, NOC/SOC security services and web security services.

FortiCare Technical Support Service is a per-device support service, which provides customers access to experts to ensure efficient and effective operations and maintenance of their Fortinet capabilities.

Global technical support is offered 24x7 with flexible add-ons, including enhanced Service Level Agreements (“SLAs”) and premium hardware replacement through in-

country depots.

FortiCare Technical Support Service is a per-device technical support service, which provides customers access to experts to ensure efficient and effective operations and maintenance of their Fortinet capabilities.

Global technical support is offered 24x7 with flexible add-ons, including enhanced service-level agreements (“SLAs”) and priority hardware replacement through in-country and local depots.

Organizations have the flexibility to procure different levels of service for different devices based on their availability needs.

We offer three per-device support options tailored to the needs of our enterprise customers:

FortiCare Premium, FortiCare Elite and FortiCare Essential.

The FortiCare Elite service aims to provide 15-minute response times for key product families.

We also offer training services to our end-customers and channel partners through our training team and authorized training partners.

We have also implemented a training certification program, Network Security Expert (“NSE”), to help ensure an understanding of our products and services.

Since 2020, Fortinet has also offered a number of free online training courses to help address prevalent industry-wide cybersecurity skills gaps and shortages.

FortiCare Elite, FortiCare Premium and FortiCare Essential.

The FortiCare Elite service aims to provide a 15-minute response time for key product families.

In addition to FortiCare device level services, Advanced Support service options are available per account.

These services are available for regional account support in three options:

Core, Pro and Pro Plus, and can be globalized at the Pro and Pro Plus levels.

Advanced Support brings support directly to each account, helping account holders to make their operations more effective and to plan and manage their solution lifecycle.

Additionally, we are committed to addressing the cybersecurity skills shortage through training and certification programs for customers, partners and employees.

The Fortinet Training Institute’s ecosystem of public and private partnerships around the world extend to industry, academia, government and nonprofits to ensure we are reaching and increasing access of our cybersecurity certifications and training to all populations.

The Fortinet Training Institute has issued over one million certifications to date.

During the year ended December 31, 2024, we generated total revenue of $5.96 billion and net income of $1.75 billion.

5 unchanged sentences

Modern networks are increasingly complex, spanning many edges as well as a mix of cloud and on-premises deployments.

Fortinet was founded with the mission of providing a converged networking and security approach that empowers organizations to adopt new technologies without worrying about how it would impact their ability to manage and secure their environments.

We were founded with the mission of providing a converged networking and security approach that empowers organizations to adopt new technologies without worrying about how it would impact their ability to manage and secure their environments.

The escalating threat landscape has resulted in a significant increase in the demand for secure networking solutions.

4 unchanged sentences

The concept of an integrated cybersecurity platform that converges networking and security and consolidates point products is what guides how we design our products and advise our customers and partners .

As organizations continue to modernize their cybersecurity infrastructure, we anticipate a significant firewall refresh and upgrade cycle in the coming years.

Given our platform approach, this refresh presents a strategic opportunity to expand our footprint within existing customer environments.

By leveraging our integrated security and networking capabilities, we can drive opportunities across our broader portfolio, including LAN, SD-WAN, SASE, Cloud-Native Application Protection Platform ( “ CNAPP ” ) and SecOps solutions.

With a unified management console, we enable consistent security policies, simplified operations, and an improved user experience across on-premises, cloud, and hybrid deployments.

This approach strengthens security effectiveness and helps reduce complexity and total cost of ownership.

Our end-customers are located in over 100 countries and include small, medium and large enterprises and government organizations across a wide range of industries, including financial services, government, manufacturing, retail, technology, education, healthcare and telecommunications.

An end-customer deployment may involve as few as one or as many as dozens of different types of integrated products and services from across our broad portfolio that spans secure networking, unified SASE, and security operations.

Customers may also access our products via the cloud through certain cloud providers such as Amazon Web Services, Microsoft Azure and Google Cloud.

Often, our customers also purchase our FortiGuard security subscription services and FortiCare technical support services.

Refer to Note 16 Segment Information in Part II, Item 8 of this Annual Report on Form 10-K for distributor customers that accounted for 10% or more of our revenue or net accounts receivable.

Depending on the solution or form factor purchased, customers may also access our products via the cloud through our data centers and PoPs, third-party colocations and cloud providers such as Amazon Web Services, Microsoft Azure and Google Cloud.

Often, our customers also purchase our FortiGuard and other security subscription services and FortiCare technical support services.

Refer to Note 16 Segment Information in Part II, Item 8 of this Annual Report on Form 10-K for distributor customers accounted for 10% or more of our revenue or net accounts receivable.

Sales and Marketing

1 unchanged sentence

We sell to distributors that sell to resellers and to service providers and managed security service providers (“MSSPs”), who, in turn, sell products and/or services to end-customers.

In certain cases, we sell directly to large service providers and major systems integrators.

We work with many technology distributors, including Arrow Electronics, Inc., Exclusive, Ingram Micro and TD Synnex (formerly Tech Data Corporation and Synnex Corporation, separately).

In addition, we provide our cloud-based subscription offerings through Fortinet-owned data centers, as well as data centers operated under co-location arrangements globally, and via public cloud providers.

In certain cases, we sell directly to large service providers, major systems integrators and large end users.

We work with many technology distributors, including Arrow Electronics, Inc., Exclusive, Ingram Micro, and TD Synnex.

In addition, we provide our cloud-based subscription offerings through Fortinet-owned data centers and PoPs, as well as data centers operated under colocation arrangements globally, and via public cloud providers.

We support our channel partners with a dedicated team of experienced channel account managers, sales professionals and sales engineers who provide business planning, joint marketing strategy, pre-sales and operational sales support.

3 unchanged sentences

Our marketing strategy is focused on building our brand, driving thought leadership with emphasis on the criticality of cybersecurity platform adoption and the convergence of security and networking as well as driving end-customer demand for our security solutions.

We use a combination of internal marketing professionals and a network of regional and global channel partners.

We use a combination of internal marketing professionals and our network of regional and global channel partners.

Our internal marketing organization is responsible for messaging, branding, demand generation, product marketing, channel marketing, partner incentives and promotions, event marketing, digital marketing, communications, analyst relations, public relations, and sales enablement.

2 unchanged sentences

We outsource the manufacturing of our security appliance products to a variety of contract manufacturers and original design manufacturers.

Our current manufacturing partners include ADLINK Technology, Inc.

(“ADLINK”), IBASE Technology, Inc.

Our current manufacturing partners include Accton Technology (“Accton”), IBASE Technology, Inc.

(“IBASE”), Micro-Star International Co.

9 unchanged sentences

The components included in our products are sourced from various suppliers by us or, more frequently, by our contract manufacturers.

Some of the components important to our business, including certain CPUs from Intel Corporation (“Intel”) and Advanced Micro Devices, Inc.

Some of the components important to our business, including certain Central Processing Units (“CPUs”) from Intel Corporation (“Intel”) and Advanced Micro Devices, Inc.

(“AMD”), network and wireless chips from Broadcom Inc.

5 unchanged sentences

We have no long-term contracts related to the manufacturing of our ASICs or other components that guarantee any capacity or pricing terms.

Our supply chain plays a critical role in providing safety for our customers and protection for our brand.

Supply chain security management begins with the establishing control of a qualified supplier base, which provides qualified and trusted components for use in design, development, manufacturing and post-sale product support.

Our Trusted Supplier Program (“TSP”) was developed in accordance with the requirements defined in National Institute of Standards and Technology Special Publications (“NIST SP”) 800-161 Supply Chain Risk Management Practices for Federal Information Systems and Organizations and other directives as periodically established by the U.S.

government for

securing the Information and Communication Technology Services supply chain, in response to increasing customer demand for transparency in the security of the hardware, firmware and software that is included in our products and to comply with U.S.

government directives.

We conduct a thorough security assessment of our key TSP partners to ensure they satisfactorily comply with applicable controls established by NIST SP 800-161, and work side by side with them to remediate gaps and monitor their security posture.

Research and Development

1 unchanged sentence

Our development strategy is to identify features, products and systems for both software and hardware that are, or are expected to be, important to our end-customers.

Our success in designing, developing, manufacturing and selling new or enhanced products will depend on a variety of factors, including identification of market demand for new products or new features, components selection, timely implementation of product design and development, product performance, quality, ease of use, costs of development, bill of materials, effective manufacturing and assembly processes and sales and marketing.

Our success in designing, developing, manufacturing and selling new or enhanced products will depend on a variety of factors, including identification of market demand for new products or new features, components selection, timely implementation of product design and development, product performance, quality, ease of use, costs of development, bill of materials, delivery models, effective manufacturing and assembly processes and sales and marketing.

Fortinet Secure Product Development Life Cycle

We recognize that supply chain security is an increasingly important dimension of cybersecurity and enterprise risk management.

We are committed to implementing a comprehensive approach to protecting the security and integrity of our products throughout the product design, development, manufacturing, delivery and support processes.

We manage a coordinated program across our engineering, manufacturing, technical services teams, together with our suppliers and channel partners, to ensure the security of our supply chain.

• We develop our own Network Processors, Content Processors and System-on-Chip Application-Specific Integrated Circuits technology in house.

• Our research and development is conducted primarily in the United States and Canada.

We do not perform source code development or internal research and development in Russia or China.

• We operate a Trusted Supplier Program with a rigorous selection and qualification of manufacturing partners, adhering to National Institute of Standards and Technology (“NIST”) 800-161.

• We implement technical measures to prevent malware and rogue components that could compromise functionality.

• We provide technical support from dedicated Fortinet regional centers.

• We leverage application of secure development best practices (including NIST 800-53, NIST 800-160, NIST 800-218, US Executive Order 14028, and UK Telecoms Security Act).

• We conduct regular patch release cycles and operate a notification service to support and encourage customers to apply security patches.

We pursue and maintain a broad portfolio of product and information security certifications available at the Fortinet Trust Site.

Intellectual Property

We rely primarily on patent, trademark, copyright and trade secrets laws, confidentiality procedures and contractual provisions to protect our technology.

We periodically have discussions with third parties regarding licensing Fortinet’s intellectual property (“IP”) and have sometimes taken legal action against competitors to protect our IP, and as a result third parties have paid us fees in return for licenses or covenants-not-to-sue related to Fortinet IP.

We periodically have discussions with third parties regarding licensing our intellectual property (“IP”) and have sometimes taken legal action against competitors to protect our IP, and as a result third parties have paid us fees in return for licenses or covenants-not-to-sue related to Fortinet IP.

As of December 31, 2024, we had 1,034 U.S.

and foreign-issued patents and 252 pending U.S.

and 1,378 global patents and 451 pending U.S.

and foreign patent applications.

1 unchanged sentence

Despite our efforts to protect our rights in our technology, unauthorized parties may attempt to copy aspects of our products or obtain and use information and technology that we regard as proprietary.

We generally enter into confidentiality agreements with our employees, consultants, vendors and customers, and generally limit access to and distribution of our proprietary information.

We generally enter into confidentiality

agreements with our employees, consultants, vendors and customers, and generally limit access to and distribution of our proprietary information.

However, we cannot provide assurance that the steps we take will prevent misappropriation of our technology.

In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as the laws

of the United States, and many foreign countries do not enforce these laws as diligently as government agencies and private parties in the United States.

In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as the laws of the United States, and many foreign countries do not enforce these laws as diligently as government agencies and private parties in the United States.

Our industry is characterized by the existence of a large number of patents and frequent claims and related litigation regarding patent and other IP rights.

4 unchanged sentences

Government Regulation

We are subject to regulation by various federal, state, regional, local and foreign governmental agencies, including agencies responsible for monitoring and enforcing employment and labor laws, workplace safety, security, product safety, product labeling, environmental laws, consumer protection laws, anti-bribery laws, data privacy laws, import and export controls, federal securities laws and tax laws and regulations.

Many of the laws and regulations that are or may be applicable to our business are changing or being tested in courts and could be interpreted in ways that could adversely impact our business.

We are subject to regulation by various federal, state, regional, local and foreign governmental agencies, including agencies responsible for monitoring and enforcing employment and labor laws, workplace safety, security and security certifications, product safety, product labeling, environmental laws, consumer protection laws, anti-bribery laws, data privacy laws, import and export controls and tariffs, securities laws and tax laws and regulations.

Many of the laws and regulations that are or may be applicable to our business are changing or being tested in courts and could be interpreted in ways that could adversely impact our business and additional laws and regulations applicable to our business may be enacted.

In addition, the application and interpretation of these laws and regulations often are uncertain, particularly in the industry in which we operate.

15 unchanged sentences

• other competitive differentiators.

Among others, our competitors include Aruba Networks, Inc.

(“Aruba”), Check Point Software Technologies Ltd.

Among others, our competitors include Check Point Software Technologies Ltd.

(“Check Point”), Cisco Systems, Inc.

1 unchanged sentence

(“CrowdStrike”), F5 Networks, Inc.

(“F5 Networks”), Huawei Technologies Co., Ltd.

(“F5 Networks”), Hewlett-Packard Enterprise (“HPE”), Huawei Technologies Co., Ltd.

(“Huawei”), Juniper Networks, Inc.

(“Juniper”), Palo Alto Networks, Inc.

(“Juniper”), Microsoft Corporation (“Microsoft”), Netskope Inc.

(“Netskope”), Palo Alto Networks, Inc.

(“Palo Alto Networks”), SonicWALL, Inc.

(“SonicWALL”), Sophos Group Plc (“Sophos”), VMware, Inc.

(“VMware”) and Zscaler, Inc.

(“SonicWALL”), Sophos Group Plc (“Sophos”) and Zscaler, Inc.

We believe we compete favorably based on our products’ security performance, throughput, reliability, breadth and ability to work together, our ability to add and integrate new networking and security features and our technological expertise.

Several competitors are significantly larger, have greater financial, technical, marketing, distribution, customer support and other resources, are more established than we are, and have significantly better brand recognition.

Some of these larger competitors have substantially broader product offerings and leverage their relationships based on other products or incorporate

functionality into existing products in a manner that discourages users from purchasing our products.

Some of these larger competitors have substantially broader product offerings and leverage their relationships based on other products or incorporate functionality into existing products in a manner that discourages users from purchasing our products.

Other, often smaller competitors, may intensely focus on a small group of point solutions and be positioned as a leader in discrete technologies that we compete with.

Based in part on these competitive pressures, we may lower prices or attempt to add incremental features and functionalities to our products.

Conditions in our markets could change rapidly and significantly as a result of technological advancements, market consolidation, supply chain constraints, price list or discount changes or inflation.

Conditions in our markets could change rapidly and significantly as a result of technological advancements, market consolidation or de-consolidation, supply chain constraints, price list or discount changes or inflation.

The development and market acceptance of alternative technologies could decrease the demand for our products or render them obsolete.

4 unchanged sentences

Human Capital Management

As of December 31, 2023, our total headcount was 13,568 employees, approximately 30% of whom were employed in the United States and approximately 70% of whom were employed outside of the United States.

As of December 31, 2024, our total headcount was 14,138 employees, approximately 30% of whom were employed in the United States, approximately 20% of whom were employed in Canada and approximately 50% of whom were employed outside of the United States and Canada.

We do not own any manufacturing or research and development activities in China.

Our employees are the foundation of our innovation and cybersecurity leadership for the benefit of our customers.

2 unchanged sentences

Our compensation programs for our employees include base pay, incentive compensation, opportunities for equity ownership where local statutes allow and employee benefits that promote well-being across different aspects of our employees’ lives, which may include health and welfare insurance, retirement benefits and paid time off.

As a global company, much of our success is rooted in the diversity of our teams and our commitment to diversity, equity and inclusion (“DEI”).

As a global company, we value diversity and inclusion across our workforce.

Such commitment starts at the top, with a highly skilled and diverse board of directors.

As of December 31, 2024 , women represented 40% of the members of our board of directors, and approximately 50% o f our board of directors was from underrepresented communities.

We value diversity at all levels and continue to focus on enhancing our DEI initiatives across our workforce.

We are also committed to community engagement and social responsibility with regards to our employees and beyond, and our board of directors has active oversight of such initiatives.

2 unchanged sentences

We reinforce our ethical “tone at the top” through clear policies including our Code of Business Conduct and Ethics, regular compliance training for our employees, quarterly meetings of our cross-functional Ethics Committee, clear messaging from our executives, enforcement of company policies and oversight by our board of directors.

In addition, our Chief Executive Officer regularly communicates the importance of Fortinet’s core values of openness, teamwork and innovation.

In addition, our Chief Executive Officer regularly communicates the importance of our core values of openness, teamwork and innovation.

None of our U.S.

2 unchanged sentences

We have not experienced any work stoppages, and we consider our relations with our employees to be good.

Environmental, Social and Governance

We are committed to responsible environmental, social and governance (“ESG”) practices and having a positive impact on the sustainability of our society and planet.

Fortinet is a member of the Dow Jones Sustainability Indices — World and North America, for the second consecutive year.

Our approach to ESG is based on a strong corporate governance structure, starting with the Social Responsibility Committee of our board of directors, which provides oversight of our Corporate Social Responsibility (“CSR”) strategy, initiatives and execution related to ESG matters.

Our senior leadership sponsors the integration of CSR priorities throughout our business operations.

In addition, our CSR team, along with our internal cross-functional employee CSR Committee, engage with internal and external stakeholders to lead CSR execution, communications and disclosure.

Environmental.

Corporate Sustainability

We are committed to responsible corporate sustainability practices and having a positive impact on the sustainability of our society and planet.

We are a member of the Dow Jones Sustainability Indices — World and North America, for the second consecutive year.

Our approach to corporate sustainability is based on a strong corporate governance structure, starting with the Governance and Social Responsibility Committee (the “GSR Committee”) of our board of directors, which provides oversight of our Corporate Social Responsibility (“CSR”) strategy, initiatives and execution related to corporate sustainability matters.

Our senior leadership sponsors the integration of CSR priorities via a CSR Committee, comprised of cross-functional team of senior leaders that drives CSR initiatives and functionality across the company including engaging with internal and external stakeholders to lead CSR execution, communications and disclosure via an annual Sustainability Report.

We recognize that environmental considerations such as climate change, resource scarcity and the energy crisis are top priorities for the future of our planet.

We are committed to helping address climate change impacts and minimizing the environmental footprint of our solutions, operations and our broader value chain.

We are engaged on a

decarbonization path to reach net zero for our Scope 1 and Scope 2 emissions by 2030, and formally signed on to the Science-Based Target Initiative commitment in September 2022.

We have completed our validation process and have been approved by the Science Based Targets Initiatives for a near-term target.

We are engaged on a decarbonization path to reach zero emissions for our Scope 1 and Scope 2 emissions by 2030.

In 2023, we obtained the ISO14001 certification for our largest company-owned warehouse in Union City, California, and have continued to be a leader on energy efficiency with the launch of our SP5 ASIC and our FortiGate-90G model.

1 unchanged sentence

We also disclosed for the first time our Scope 3 emissions, across all 12 relevant categories, as part of our annual reporting on sustainability.

We are committed to building an inclusive, equitable and diverse workforce within our organization and across the security industry to help empower individuals to reach their full potential.

We are committed to empower individuals within our organization and across the security industry to reach their full potential.

We continue to focus on skilling, upskilling and reskilling individuals and are on track to reach our goal of training one million people in cybersecurity by 2026 with over 630,000 individuals trained as of the end of 2024.

1 unchanged sentence

We offered our Security Awareness Curriculum at no cost to primary and secondary schools across the same countries.

We continued to expand partnerships with educational institutions and now have over 650 Authorized Academic Partners in 99 countries or territories across the world.

Internally, we continue to foster a culture of diversity and inclusion through our DEI Council, which meets quarterly, Employee Resource Groups and various campaigns and activities that engage our broader workforce.

We are involved in over 700 education partnerships across more than 100 countries and participates in public-private partnerships, including the World Economic Forum’s Cybersecurity Talent Framework.

Our approach to responsible business is based on strong corporate governance practices that aim to ensure accountability while meeting our responsibilities across our value chain, starting with our employees.

Our board of directors regularly reviews our governance practices.

Our board of directors regularly reviews our governance practices and in 2024 we formed our GSR committee which combined our Governance Committee with the Social Responsibility Committee to GSR Committee.

Our Codes of Conduct apply to employees, partners and suppliers, and we have compliance trainings and controls in place.

1 unchanged sentence

Available Information

Our web site is located at https://www.fortinet.com, and our investor relations web site is located at https://investor.fortinet.com.

Our website is located at https://www.fortinet.com, and our investor relations website is located at https://investor.fortinet.com.

The information posted on our website is not incorporated by reference into this Annual Report on Form 10-K.

Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to reports filed or furnished pursuant to Sections 13(a) and 15(d) of the Securities Act of 1933, as amended (the “Securities Act”), are available free of charge on our investor relations web site as soon as reasonably practicable after we electronically file such material with, or furnish it to, the Securities and Exchange Commission (the “SEC”).

Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to reports filed or furnished pursuant to Sections 13(a) and 15(d) of the Securities Act of 1933, as amended (the “Securities Act”), are available free of charge on our investor relations website as soon as reasonably practicable after we electronically file such material with, or furnish it to, the Securities and Exchange Commission (the “SEC”).

You may also access all of our public filings through the SEC’s website at https://www.sec.gov.

3 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business