What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-02-21 compared with 2024-02-26 · 267 added, 250 removed, 729 unchanged (41% of the section changed)

9 unchanged sentences

Our operating results have historically varied from period to period, and we expect that they will continue to do so as a result of a number of factors, many of which are outside of our control or may be difficult to predict, including:

• economic conditions, including macroeconomic and regional economic challenges resulting, for example, from a recession or other economic downturn, increased inflation or possible stagflation in certain geographies, rising interest rates, the war in Ukraine, the Israel-Hamas war, tensions between China and Taiwan, or other factors;

• sales strategy, productivity and execution, and our ability to attract and retain new end-customers or sell additional products and services to our existing end-customers, including customer demand for platform solutions like ours versus point solutions;

• economic conditions, including macroeconomic and regional economic challenges resulting, for example, from a recession, tariffs or other economic downturn, increased inflation or possible stagflation in certain geographies, changing interest rates, the war in Ukraine, tensions between China and Taiwan, or other factors;

• policy changes and uncertainty with respect to immigration laws, trade policy and tariffs, including increased tariffs applicable to countries where we manufacture our products, foreign imports and tax laws related to international commerce;

• sales strategy, productivity, retention and execution, and our ability to attract and retain new end-customers or sell additional products and services to our existing end-customers, including customer demand for platform solutions like ours versus point solutions;

• our ability to successfully anticipate market changes related to cloud-based solutions and to sell, support and meet service level agreements related to cloud-based solutions;

• component shortages, including chips and other components, and product inventory shortages, including those caused by factors outside of our control, such as epidemics and pandemics, supply chain disruptions, inflation and other cost increases, international trade disputes or tariffs, natural disasters, health emergencies, power outages, civil unrest, labor disruption, international conflicts, terrorism, wars, such as the war in Ukraine and the Israel-Hamas war, and critical infrastructure attacks;

• inventory management, including future inventory purchase order commitments;

• the level of demand for our products and services, which may render forecasts inaccurate, increase backlog or future inventory purchase order commitments and lead to price decreases;

• based on supply chain shortages, including component and other shortages, our backlog has fluctuated over past quarters and any decrease in growth or negative growth of in-quarter billings and revenue may not be reflected by our aggregate billings and revenue.

As we have fulfilled, shipped and billed during a quarter to satisfy backlog, this has increased our aggregate billings and revenue during any particular quarter, and as the supply chain challenges normalize, the growth comparisons versus prior quarters where backlog contributed more to billings have become more challenging and may become increasingly challenging;

• inventory management, including future inventory purchase commitments;

• the level of demand for our products and services, which may render forecasts inaccurate, increase backlog or future inventory purchase commitments and lead to price decreases;

• our backlog may fluctuate over quarters.

If we experience supply chain shortages and cannot fulfill orders or if customers cancel or delay delivery of orders, our backlog may be affected, which will negatively impact our aggregate backlog to billings conversion and revenue in such quarter.

A reduction to backlog increases our aggregate billings and revenue during the quarter when delivered;

• as the supply chain challenges normalize, our product revenue growth rate may be lower versus prior quarters where delivery from backlog contributed more to billings.

For fiscal year 2024, the comparably lower backlog contribution to billings resulted in decreased year-over-year quarterly growth rates;

• supplier cost increases and any lack of market acceptance of our price increases designed to help offset any supplier cost increases;

• the effects of our reduction of operations in Russia;

• the timing of channel partner and end-customer orders and our reliance on a concentration of shipments at the end of each quarter;

• the impact to our business, the global economy, disruption of global supply chains and creation of significant volatility and disruption of the financial markets due to factors such as increased inflation or possible stagflation in certain geographies, increasing or decreasing interest rates, the war in Ukraine and the Israel-Hamas war and other factors;

• any actual or perceived vulnerabilities in our products or services, and any actual or perceived breach of our network or our customers’ networks;

• the timing of channel partner and end-customer orders and our reliance on a concentration of shipments at the end of each quarter or changes in shipping terms;

• the impact to our business, the global economy, disruption of global supply chains and creation of significant volatility and disruption of the financial markets due to factors such as increased inflation or possible stagflation in certain geographies, changing interest rates, the war in Ukraine and other factors;

• defects or vulnerabilities, including critical vulnerabilities, in our products or services, as well as reputational harm from the failure or misuse of our products or services, and any actual or perceived defects or vulnerabilities, including critical vulnerabilities, in our products or services, failure of our products or services to detect or prevent a security incident or to cause a disruption to operations, failure of our customers to implement preventative actions such as updates to one of our deployed solutions or failure to help secure our customers;

• compromising of our internal enterprise IT networks, our operational networks, our research and development networks, our back-end labs and cloud stacks hosted in our data centers or PoPs, colocation vendors or public cloud providers, and resulting harm to public perception of our products and services;

• the timing of shipments, which may depend on factors such as inventory levels, logistics, manufacturing or shipping delays, our ability to ship products on schedule and our ability to accurately forecast inventory requirements and our suppliers’ ability to deliver components and finished goods;

• increased expenses, unforeseen liabilities or write-downs and any negative impact on results of operations from any acquisition or equity investment consummated, as well as accounting risks, integration risks related to product plans and products and risks of negative impact by such acquisitions and equity investments on our financial results;

• increased expenses, unforeseen liabilities or write-downs and any negative impact on results of operations from any acquisition or equity investment, as well as accounting risks, integration risks related to product plans and products and risks of negative impact by such acquisitions and equity investments on our financial results;

• investors’ expectations of our performance relating to environmental, social and governance (“ESG”) and commitment to carbon neutrality;

• certain customer agreements which contain service-level agreements, under which we guarantee specified availability of our platform and solutions;

• data security requirements that may be inconsistently enforced in certain jurisdictions;

• inconsistent and evolving data and other security requirements and enforcement across certain jurisdictions;

• impairments as a result of certain events or changes in circumstances;

• the mix of products sold and the mix of revenue between products and services, as well as the degree to which products and services are bundled and sold together for a package price;

• the purchasing practices and budgeting cycles of our channel partners and end-customers, including the effect of the end of product lifecycles or refresh cycles;

• any decreases in demand by channel partners or end-customers, including any such decreases caused by factors outside of our control such as natural disasters and health emergencies, including earthquakes, droughts, fires, power outages, typhoons, floods, pandemics or epidemics and manmade events such as civil unrest, labor disruption, international trade disputes, international conflicts, terrorism, wars, such as the war in Ukraine and the Israel-Hamas war, and critical infrastructure attacks;

• the purchasing practices and budgeting cycles of our channel partners and end-customers, including the effect of the end of product lifecycles, refresh cycles or price decreases;

• the effectiveness of our sales organization, generally or in a particular geographic region, including the time it takes to hire sales personnel, the timing of hiring and our ability to hire and retain effective sales personnel, our efforts to align our sales capacity and productivity with market demand and any negative impact to our sales and the effectiveness of our sales team based on changes to sales compensation or to our sales compensation plan;

• sales productivity and sales execution risk related to effectively selling to all segments of the market, including enterprise and small- and medium-sized businesses, government organizations and service providers, and to selling our broad security product and services portfolio, including, among other execution risks, risks associated with the complexity and distraction in selling to all segments, increased competition and unpredictability of timing to close larger enterprise and large organization deals, and the risk that our sales representatives do not effectively sell products and services;

• execution risk associated with our efforts to capture the opportunities related to our identified growth drivers, such as risk associated with our ability to capitalize on the convergence of networking and security, vendor consolidation of various cyber security solutions, SD-WAN, infrastructure security, security operations, SASE and other cloud security solutions, endpoint protection, and IoT and OT security opportunities;

SASE and other cloud security solutions, endpoint protection, IoT and OT security opportunities and product refresh cycles;

• the seasonal buying patterns of our end-customers;

• the timing and level of our investments in sales and marketing, and the impact of such investments on our operating expenses, operating margin and the productivity, capacity, tenure and effectiveness of execution of our sales and marketing teams;

• the timing of revenue recognition for our sales, including any impacts resulting from extension of payment terms to distributors and fluctuations in backlog levels, which could result in more variability and less predictability in our quarter-to-quarter revenue and operating results;

• the timing of revenue recognition for our sales, including any impacts resulting from extension of payment terms and fluctuations in backlog levels, which could result in more variability and less predictability in our quarter-to-quarter revenue and operating results;

• the level of perceived threats to network security, which may fluctuate from period to period;

10 unchanged sentences

• litigation, litigation fees and costs, settlements, judgments and other equitable and legal relief granted related to litigation;

• the impact of cloud-based security solutions on our billings, revenue, operating margins and free cash flow;

• the impact of cloud-based and hosted security solutions on our billings, revenue, operating margins and free cash flow;

• decisions by potential end-customers to purchase network security solutions from newer technology providers, from larger, more established security vendors or from their primary network equipment vendors;

• price competition and increased competitiveness in our market, including the competitive pressure caused by product refresh cycles;

• price competition and increased competitiveness in our market, including the competitive pressure caused by product refresh cycles and inventory levels;

• our ability to both increase revenue and manage and control operating expenses in order to maintain or improve our operating margins;

3 unchanged sentences

• changes in circumstances and challenges in business conditions, including decreased demand, which may negatively impact our channel partners’ ability to sell the current inventory they hold and negatively impact their future purchases of products from us;

• increased demand for cloud-based services and the uncertainty associated with transitioning to providing such services;

• increased demand for cloud-based and hosted services and the uncertainty associated with transitioning to providing such services;

• potential shift or migration from physical appliances that deliver on-premises network security to cloud and SaaS-based security services;

2 unchanged sentences

• insolvency, credit or other difficulties confronting our key suppliers and channel partners, which could affect their ability to purchase or pay for products and services and which could disrupt our supply or distribution chain;

• political, economic and social instability, including geo-political instability and uncertainty, such as that caused by the war in Ukraine, the Israel-Hamas war, tensions between China and Taiwan, and any disruption or negative impact on our ability to sell to, ship product to and support customers in certain regions based on trade restrictions, embargoes and export control law restrictions;

• political, economic and social instability, including geo-political instability and uncertainty, such as that caused by the war in Ukraine, tensions between China and Taiwan, and any disruption or negative impact on our ability to sell to, ship product to and support customers in certain regions based on trade restrictions, embargoes and export control law restrictions;

• general economic conditions, both in domestic and foreign markets;

7 unchanged sentences

Accordingly, in the event of revenue shortfalls, we are generally unable to mitigate the negative impact on margins in the short term.

Adverse economic conditions, such as a possible recession and possible impacts of inflation or stagflation, increasing or decreasing interest rates, reduced information technology spending, including firewall and other security spending, or any economic downturn or recession, may adversely impact our business.

Adverse economic conditions, such as a possible recession and possible impacts of inflation or stagflation, tariffs or other trade disruptions, changing interest rates, reduced information technology spending, including firewall and other security spending, or any economic downturn or recession, may adversely impact our business.

Our business depends on the overall demand for information technology and on the economic health of our current and prospective customers.

In addition, the purchase of our products is often discretionary and may involve a significant commitment of capital and other resources.

Weak global and regional economic conditions and spending environments, based on a downturn in the economy, a possible recession and the effects of ongoing or increased inflation or possible stagflation in certain geographies, increasing or decreasing interest rates, geopolitical instability and uncertainty, a reduction in information technology spending regardless of macroeconomic conditions, the effects of epidemics and pandemics and the impact of the war in Ukraine and the Israel-Hamas war each could have a material adverse impacts on our financial condition and results of operations and our business, including resulting in longer sales cycles, lower prices for our products and services, increased component costs, higher default rates among our channel partners, reduced unit sales, lower prices and slower or declining growth.

These can negatively impact our business by putting downward pressure on growth if we are unable to achieve the increases in product prices necessary to appropriately offset the additional costs in a manner sufficient to maintain margins.

Weak global and regional economic conditions and spending environments, based on a downturn in the economy, a possible recession and the effects of ongoing or increased inflation or possible stagflation in certain geographies, tariffs or other trade disruptions, changing interest rates, geopolitical instability and uncertainty, a reduction in information technology spending regardless of macroeconomic conditions, the effects of epidemics and pandemics and the impact of the war in Ukraine could have a material adverse impacts on our financial condition and results of operations and our business, including resulting in longer sales cycles, lower prices for our products and services, increased component costs, higher default rates among our channel partners, reduced unit sales, lower prices and slower or declining growth.

These can negatively impact our business by putting downward pressure on growth if we are unable to achieve the increases in

product prices necessary to appropriately offset the additional costs in a manner sufficient to maintain margins.

Any of these impacts may materially and adversely affect our business, financial condition, results of operations and liquidity.

The existence of inflation in certain economies has resulted in, and may continue to result in, increasing or decreasing interest rates and capital costs, increased component or shipping costs, increased costs of labor, weakening exchange rates and other similar effects.

The existence of inflation in certain economies has resulted in, and may continue to result in, changing interest rates and capital costs, increased component or shipping costs, increased costs of labor, weakening exchange rates and other similar effects.

Although we take measures to mitigate risks such as those associated with inflation, the mitigating measures may not be effective or their impact may not offset the increased cost of inflation in a timely manner.

Inflation, an economic downturn, a recession and any other economic challenges may also adversely impact spending patterns by our distributors, resellers and end-customers.

Any efforts to withdraw from or materially modify international trade agreements, change tax provisions related to global manufacturing and sales or impose new tariffs, economic sanctions or related legislation, could adversely affect our financial condition and results of operations.

Our business benefits directly and indirectly from free trade agreements, and we also rely on various corporate tax provisions related to international commerce, as we develop, market and sell our products and services globally.

Efforts to withdraw from or materially modify international trade agreements, or to change corporate tax policy related to international commerce, could adversely affect our financial condition and results of operations as could the continuing uncertainty regarding whether such actions will be taken.

Moreover, efforts to implement changes related to export or import regulations (including the imposition of new border taxes or tariffs on foreign imports), trade barriers, economic sanctions and other related policies could harm our results of operations.

For example, in recent years, the United States has imposed additional import tariffs on certain goods from different countries.

As a result, other countries imposed retaliatory tariffs on goods exported from the United States and both the United States and foreign countries have threatened to alter or leave current trade agreements.

While we do not currently expect these tariffs to have a significant effect on our raw material and product import costs, if the United States expands increased tariffs, or retaliatory trade measures are taken by other countries in response to the tariffs, the cost of our products could increase, our operations could be disrupted or we could be required to raise our prices, which may result in the loss of customers and harm to our reputation and operating performance.

Any modification in these areas, any shift in the enforcement or scope of existing regulations or any change in the countries, governments, persons or technologies targeted by such regulations, could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential end-customers with international operations and could result in increased costs.

Any decreased use of our products or limitation on our ability to export or sell our products would likely adversely affect our business, financial condition and results of operations.

Our billings, revenue and free cash flow growth may slow or may not continue, and our operating margins may decline.

We may experience slowing growth or a decrease in billings, revenue, operating margin and free cash flow for a number of reasons, including a slowdown in demand for our products or services, a shift in demand from products to services, decrease in services revenue growth, increased competition, execution challenges including sales execution challenges and lack of optimal sales productivity, worldwide or regional economic challenges based on inflation or possible stagflation, a regional recession or a recession in the global economy, rising interest rates, the war in Ukraine and the Israel-Hamas war, a decrease in the growth of our overall market or softness in demand in certain geographies or industry verticals, such as the service provider industry, changes in our strategic opportunities, execution risks, lower sales productivity and our failure for any reason to continue to capitalize on sales and growth opportunities due to other risks identified in the risk factors described in this periodic report.

We may experience slowing growth or a decrease in billings, revenue, operating margin and free cash flow for a number of reasons, including a slowdown in pipeline growth or for demand for our products or services generally, a shift in demand from products to services, decrease in services revenue growth, increased competition, execution challenges including sales execution challenges and lack of optimal sales productivity, worldwide or regional economic challenges based on inflation or possible stagflation, a regional recession or a recession in the global economy, changing interest rates, the war in Ukraine, a decrease in the growth of our overall market or softness in demand in certain geographies or industry verticals, such as the service provider industry, changes in our strategic opportunities, execution risks, lower sales productivity and our failure for any reason to continue to capitalize on sales and growth opportunities due to other risks identified in the risk factors described in this periodic report.

Our expenses as a percentage of total revenue may be higher than expected if our revenue is lower than expected.

2 unchanged sentences

As a result, any failure by us to maintain profitability and margins and continue our billings, revenue and free cash flow growth could cause the price of our common stock to materially decline.

Our real estate investments, including construction or acquisition of new data centers, data center expansions or office buildings, could involve significant risks to our business.

In order to sustain our growth in certain of our existing and new markets, we may expand existing data centers, lease new facilities or acquire suitable land, with or without structures, to build new data centers or office buildings.

These projects

expose us to risks which could have an adverse effect on our results of operations and financial condition.

The current global supply chain and inflation issues have exacerbated many of these construction risks and created additional risks for our business.

Our real estate investments, including construction, acquisition or leasing of new data centers, data center expansions or office buildings, could involve significant risks to our business.

In order to sustain our growth in certain of our existing and new markets, we may acquire or expand existing data centers, lease new facilities or acquire suitable land, with or without structures, to build new data centers or office buildings.

These projects expose us to risks which could have an adverse effect on our results of operations and financial condition.

current global supply chain and inflation issues have exacerbated many of these construction risks and created additional risks for our business.

Some of the risks associated with construction projects include:

4 unchanged sentences

• labor availability, labor disputes and work stoppages with contractors, subcontractors and other third parties;

• unanticipated environmental issues and geological problems;

• unanticipated environmental or regulatory issues and geological problems;

• delays related to permitting and approvals to open from public agencies and utility companies;

• unexpected lack of power access;

• failure or inability for any reason to meet customer requirements;

• investor expectations regarding ESG;

• unexpected lack of power access or unexpected increases in power needs;

• failure or inability for any reason to meet customer requirements and service level agreements, and any resulting penalties or liabilities related thereto;

• investor expectations regarding sustainability;

• delays in site readiness leading to our failure to meet commitments made to customers;

37 unchanged sentences

We may also become increasingly dependent on a more limited number of channel partners, as consolidation increases the relative proportion of our business for which each channel partner is responsible, which may magnify the risks described in the preceding paragraphs.

Six distributor customers accounted for 70% and 69% of our total net accounts receivable in the aggregate as of December 31, 2023 and 2022, respectively.

Segment Information in Part II, Item 8 of this Annual Report on Form 10-K for distributor customers that accounted for 10% or more of our revenue or net accounts receivable.

Six distributor customers who purchase directly from us accounted for 69% and 70% of our total net accounts receivable in the aggregate as of December 31, 2024 and 2023, respectively.

Segment Information in Part II, Item 8 of this Annual Report on Form 10-K for distributor customers accounted for 10% or more of our revenue or net accounts receivable.

Our largest distributors may experience financial difficulties, face liquidity risk or other financial challenges, which may harm our ability to collect on our accounts receivable.

We provide channel partners with specific programs to assist them with selling our products and incentivize them to sell our products, but there can be no assurance that these programs will be effective.

We provide channel partners with specific programs to assist them with selling our products but there can be no assurance that these programs will be effective.

In addition, our channel partners may be unsuccessful in marketing, selling and supporting our products and services and may purchase more inventory than they can sell.

13 unchanged sentences

If we fail to optimize our channel partner model or fail to manage existing sales channels, our business will be seriously harmed.

Reliance on a concentration of shipments at the end of the quarter could cause our billings and revenue to fall below expected levels.

Reliance on a concentration of shipments at the end of the quarter or changes in shipping terms could cause our billings and revenue to fall below expected levels.

As a result of customer buying patterns and the efforts of our sales force and channel partners to meet or exceed quarterly quotas, we have historically received a substantial portion of each quarter’s sales orders and generated a substantial portion of each quarter’s billings and revenue during the last two weeks of the quarter.

8 unchanged sentences

• our logistics partners’ failure or inability to ship products prior to quarter-end to fulfill purchase orders received near the end of the quarter;

• disruption in manufacturing or shipping based on power outages, system failures, labor disputes or constraints, excessive demand, natural disasters or widespread public health problems including pandemics and epidemics;

• disruption in manufacturing or shipping based on power outages, system failures, labor disputes or constraints, excessive demand, natural disasters, geopolitical matters or widespread public health problems including pandemics and epidemics;

• our failure to accurately forecast our inventory requirements and to appropriately manage inventory to meet demand;

2 unchanged sentences

• any delays in shipments due to trade compliance requirements, labor disputes or logistics changes at shipping ports, airline strikes, severe weather or otherwise.

We rely significantly on revenue from FortiGuard and other security subscription and FortiCare technical support services, and revenue from these services may decline or fluctuate.

Because we recognize revenue from these services over the term of the relevant service period, downturns or upturns in sales of FortiGuard and other security subscription and FortiCare technical support services are not immediately reflected in full in our operating results.

Our FortiGuard and other security subscription and FortiCare technical support services revenue has historically accounted for a significant percentage of our total revenue.

Revenue from the sale of new, or from the renewal of existing, FortiGuard and other security subscription and FortiCare technical support service contracts may decline and fluctuate as a result of a number of factors, including fluctuations in purchases of secure networking, unified SASE and security operations, changes in the sales mix between products and services, end-customers’ level of satisfaction with our products and services, the prices of our products and services, the prices of products and services offered by our competitors, reductions in our customers’ spending levels and the timing of revenue recognition with respect to these arrangements.

If our sales of new, or renewals of existing, FortiGuard and other security subscription and FortiCare technical support service contracts decline, our revenue and revenue growth may decline and our business could suffer.

In addition, in the event significant customers require payment

terms for FortiGuard and other security subscription and FortiCare technical support services in arrears or for shorter periods of time than annually, such as monthly or quarterly, this may negatively impact our billings and revenue.

Furthermore, we recognize FortiGuard and other security subscription and FortiCare technical support services revenue ratably over the term of the service period, which is typically from one to five years.

As a result, much of the FortiGuard and other security subscription and FortiCare technical support services revenue we report each quarter is the recognition of deferred revenue from FortiGuard and other security subscription and FortiCare technical support services contracts entered into during previous quarters or years.

Consequently, a decline in new or renewed FortiGuard and other security subscription and FortiCare technical support services contracts in any one quarter will not be fully reflected in revenue in that quarter but will negatively affect our revenue in future quarters.

We rely significantly on revenue from FortiGuard and other security subscriptions and FortiCare technical support services, and revenue from these services may decline or fluctuate.

Because we recognize revenue from these services over the term of the relevant service period, downturns or upturns in sales of FortiGuard and other security subscriptions and FortiCare technical support services are not immediately reflected in full in our operating results.

Our FortiGuard and other security subscriptions and FortiCare technical support services revenue has historically accounted for a significant percentage of our total revenue.

Revenue from the sale of new, or from the renewal of existing, FortiGuard and other security subscriptions and FortiCare technical support service contracts may decline and fluctuate as a result of a number of factors, including fluctuations and changes in the mix of our sales from secure networking, unified SASE and security operations between products and services, end-customers’ level of satisfaction with our products and services, the prices of our products and services, the prices of products and services offered by our competitors, reductions in our customers’ spending levels and the timing of revenue recognition with respect to such sales.

If our sales of new, or renewals of existing, FortiGuard and other security subscriptions and FortiCare technical support service contracts decline, our revenue and revenue growth may decrease and our business could suffer.

In addition, in the event significant customers require payment terms for

FortiGuard and other security subscriptions and FortiCare technical support services in arrears or for shorter periods of time than annually, such as monthly or quarterly, this may negatively impact our billings and revenue.

Furthermore, we recognize FortiGuard and other security subscriptions and FortiCare technical support services revenue ratably over the term of the service period, which is typically from one to five years.

As a result, much of the FortiGuard and other security subscriptions and FortiCare technical support services revenue we report each quarter is the recognition of deferred revenue from FortiGuard and other security subscriptions and FortiCare technical support service contracts entered into during previous quarters or years.

Consequently, a decline in new or renewed FortiGuard and other security subscriptions and FortiCare technical support service contracts in any one quarter will not be fully reflected in revenue in that quarter but will negatively affect our revenue in future quarters.

Accordingly, the effect of significant downturns in sales of new, or renewals of existing, FortiGuard and other security subscriptions and FortiCare technical support services is not reflected in full in our statements of income until future periods.

Our FortiGuard and other security subscription and FortiCare technical support services revenue also makes it difficult for us to rapidly increase our revenue through additional service sales in any period, as revenue from new and renewal support services contracts must be recognized over the applicable service term.

Our FortiGuard and other security subscriptions and FortiCare technical support services revenue also makes it difficult for us to rapidly increase our revenue through additional service sales in any period, as revenue from new and renewal support services contracts must be recognized over the applicable service term.

We face intense competition in our market and we may not maintain or improve our competitive position.

The market for network security products is intensely competitive and dynamic, and we expect competition to continue to intensify.

We face many competitors across the different cybersecurity markets.

Our competitors include companies such as Check Point, Cisco, CrowdStrike, F5 Networks, HPE, Huawei, Juniper, Microsoft, Netskope, Palo Alto Networks, SonicWALL, Sophos, and Zscaler.

Some of our existing and potential competitors enjoy competitive advantages such as:

• greater name recognition and/or longer operating histories;

• larger sales and marketing budgets and resources;

• broader distribution and established relationships with distribution partners and end-customers;

• access to larger customer bases;

• greater customer support resources;

• greater expertise in certain single point solutions;

• greater resources to make acquisitions;

• stronger U.S.

government relationships;

• lower labor and development costs;

• substantially greater financial, technical and other resources.

In addition, certain of our larger competitors have broader product offerings, and leverage their relationships based on other products or incorporate functionality into existing products in a manner that discourages customers from purchasing our products.

These larger competitors often have broader product lines and market focus, and are in a better position to withstand any significant reduction in capital spending by end-customers in these markets.

Therefore, these competitors will not be as susceptible to downturns in a particular market.

Also, many of our smaller competitors that specialize in providing protection from a single type of security threat are often able to deliver these specialized security products to the market more quickly than we can.

Conditions in our markets could change rapidly and significantly as a result of technological advancements or continuing market consolidation.

Our competitors and potential competitors may also be able to develop products or services, and leverage new business models, that are equal or superior to ours, achieve greater market acceptance of their products and services, disrupt our markets, and increase sales by utilizing different distribution channels than we do.

For example, certain of our competitors are focusing on delivering security services from the cloud which include cloud-based security providers, such as CrowdStrike and Zscaler.

In addition, current or potential competitors may be acquired by third parties with greater available resources, and new competitors may arise pursuant to acquisitions of network security companies or divisions.

As a result of such acquisitions, competition in our market may continue to increase and our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of acquisition or other opportunities more readily, or develop and expand their product and service offerings more quickly than we do.

In addition, our competitors may bundle products and services competitive with ours with other products and services.

Customers may accept these bundled

products and services rather than separately purchasing our products and services.

As our customers refresh the security products bought in prior years, they may seek to consolidate vendors, which may result in current customers choosing to purchase products from our competitors on an ongoing basis.

Due to budget constraints or economic downturns, organizations may be more willing to incrementally add solutions to their existing network security infrastructure from competitors than to replace it with our solutions.

These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer customer orders, reduced revenue and gross margins and loss of market share.

If we are unable to hire, retain and motivate qualified personnel, our business will suffer.

2 unchanged sentences

From time to time, we experience turnover in our management-level personnel.

For example, in December 2023, our Chief Revenue Officer announced his upcoming retirement after 19 years at Fortinet.

For example, in February 2025, our Chief Financial Officer, Keith Jensen, announced his upcoming retirement after 11 years at Fortinet.

None of our key employees has an employment agreement for a specific term, and any of our employees may terminate their employment at any time.

27 unchanged sentences

We are also subject to a number of risks typically associated with international sales and operations, including:

• disruption in the supply chain or in manufacturing or shipping, or decreases in demand by channel partners or end-customers, including any such disruption or decreases caused by factors outside of our control such as natural disasters and health emergencies, including earthquakes, droughts, fires, power outages, typhoons, floods, pandemics or epidemics and manmade events such as civil unrest, labor disruption, international trade disputes, international conflicts, terrorism, wars or other foreign conflicts, such as the war in Ukraine and the Israel-Hamas war or tensions between China and Taiwan, and critical infrastructure attacks;

• disruption in the supply chain or in manufacturing or shipping, or decreases in demand by channel partners or end-customers, including any such disruption or decreases caused by factors outside of our control such as natural disasters and health emergencies, including earthquakes, droughts, fires, power outages, typhoons, floods, pandemics or epidemics and manmade events such as civil unrest, labor disruption, international trade disputes, international conflicts, terrorism, wars or other foreign conflicts, such as the war in Ukraine or tensions between China and Taiwan, and critical infrastructure attacks;

• fluctuations in foreign currency exchange rates or a strengthening of the U.S.

1 unchanged sentence

dollar, and the impact such fluctuations may have on the actual prices that our partners and customers are willing to pay for our products and services;

• economic or political instability in foreign markets, such as any economic or political instability caused by economic downturns and wars or other foreign conflicts, such as the war in Ukraine and the Israel-Hamas war, tensions between China and Taiwan and any expansions thereof;

• instability in the global banking system;

• political instability, changes in trade agreements and conflicts such as the war in Ukraine, tensions between China and Taiwan and any expansions thereof, could adversely affect our business and financial performance;

• economic instability in foreign markets, such as any economic instability caused by economic downturns or recessions, could adversely affect our business and financial performance;

• greater difficulty in enforcing contracts and accounts receivable collection, including longer collection periods;

2 unchanged sentences

• difficulties and costs of staffing and managing foreign operations;

• the uncertainty of protection for Intellectual Property (“IP”) rights in some countries;

• the uncertainty of protection for IP rights in some countries;

• costs of compliance with foreign policies, laws and regulations and the risks and costs of non-compliance with such policies, laws and regulations;

2 unchanged sentences

or other foreign laws and regulations for foreign operations, including the U.S.

Foreign Corrupt Practices Act, the United Kingdom Bribery Act 2010, the General Data Protection Regulation (the “GDPR”), import and

export control laws, trade laws and regulations, tariffs and retaliatory measures, trade barriers and economic sanctions;

Foreign Corrupt Practices Act, the United Kingdom Bribery Act 2010, the General Data Protection Regulation (the “GDPR”), the Digital Operational Resilience Act (“DORA”), import and export control laws, trade laws and regulations, tariffs and retaliatory measures, trade barriers and economic sanctions;

• other regulatory or contractual limitations on our ability to sell our products in certain foreign markets, and the risks and costs of non-compliance;

• heightened risks of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales or sales-related arrangements, such as sales “side agreements” to allow return rights, that could disrupt the sales team through terminations of employment or otherwise, and may adversely impact financial results as compared to those already reported or forecasted and result in restatements of financial statements and irregularities in financial statements;

• heightened risks of unfair or corrupt business practices in certain geographies that could disrupt the sales team through terminations of employment or otherwise, and may adversely impact financial results as compared to those already reported or forecasted and result in restatements of financial statements and irregularities in financial statements;

• our ability to effectively implement and maintain adequate internal controls to properly manage our international sales and operations;

34 unchanged sentences

Furthermore, service providers and MSSPs represent our largest industry vertical and consolidation or continued changes in buying behavior by larger customers within this industry could negatively impact our business.

Large- and medium-sized businesses, service providers and MSSPs and government organizations typically have longer implementation cycles, require greater product functionality and scalability, expect a broader range of services, including design, implementation and post go-live services, demand that vendors take on a larger share of risks, require acceptance provisions that can lead to a delay in revenue recognition and expect greater payment flexibility from vendors.

Large- and medium-sized businesses, service providers and MSSPs and government organizations typically have longer implementation cycles, require greater product functionality and scalability, expect a broader range of services, including design, implementation and post go-live services, demand that vendors take on a larger share of risks, and expect greater payment flexibility from vendors.

In addition, large- and medium-sized businesses, service providers and government organizations may require that our products and services be sold differently from how we offer our products and services, which could negatively impact our operating results.

11 unchanged sentences

If our sales employees do not become fully productive on the timelines that we have projected, our revenue may not increase at anticipated levels and our ability to achieve long-term projections may be negatively impacted.

effectively sell our unified SASE and security operations technology solutions, our business, operating results and prospects may be adversely affected.

If we are unable to hire and train sufficient numbers of effective sales personnel, the sales personnel are not successful in obtaining new end-customers or increasing sales to our existing customer base or sales personnel do not effectively sell our extended security products, our business, operating results and prospects may be adversely affected.

If we do not hire properly qualified and effective sales employees and organize our sales team effectively to capture the opportunities in the various customer segments we are targeting, our growth and ability to effectively support growth may be harmed.

1 unchanged sentence

If we are not able to align our sales capacity and market demand, or if the productivity of our sales organization decreases, our operating results and financial condition could be harmed.

We periodically implement new sales compensation plans, which may change the method, amount and timing for sales-based compensation for our sales personnel.

If we are not successful in implementing new sales compensation plans, or members of our sales team react negatively to such new plans, this may negatively impact our ability to execute and grow sales and we may be unable to hire, retain and motivate qualified sales personnel.

Unless we continue to develop better market awareness of our company and our products, and to improve lead generation and sales enablement, our revenue may not continue to grow.

2 unchanged sentences

If our investments in additional sales personnel or our marketing programs are not successful in continuing to create market awareness of our company and products or increasing lead generation, in growing billings for our broad product suite or if we experience turnover and disruption in our sales and marketing teams, we may not be able to achieve sustained growth, and our business, financial condition and results of operations may be adversely affected.

Some of our sales are to government organizations, which subjects us to a number of regulatory requirements, challenges and risks.

Some of our sales are to government organizations, which subjects us to a number of regulatory requirements, their own supply chain constraints and contractual requirements, challenges and risks.

Sales to U.S.

4 unchanged sentences

• funding authorizations and requirements unique to government agencies, with funding or purchasing reductions or delays adversely affecting public sector demand for our products;

• geopolitical matters, including tariff and trade disputes, government shutdowns, impact of the war in Ukraine and the Israel-Hamas war, tensions between China and Taiwan and trade protectionism and other political dynamics that may adversely affect our ability to sell in certain locations or obtain the requisite permits and clearances required for certain purchases by government organizations of our products and services.

In addition, if we do not have certain certifications, this may restrict our ability to sell to certain government customers until we have obtained certain certifications and we may not obtain the certifications in a timely manner or at all.

• geopolitical matters, including tariff and trade disputes, government shutdowns, impact of the war in Ukraine, tensions between China and Taiwan and trade protectionism and other political dynamics that may adversely affect our ability to sell in certain locations or obtain the requisite permits and clearances required for certain purchases by government organizations of our products and services.

In addition, if we do not have certain certifications, this may restrict our ability to sell to certain customers until we have obtained certain certifications and we may not obtain the certifications in a timely manner or at all.

For example, certain of our competitors may have decided to become certified under the U.S.

Federal Risk and Authorization Management Program (“FedRAMP”), and until the time that we also certify under FedRAMP, we risk losing sales for government deals to certified competitors for deals where FedRAMP certification is a requirement.

Federal Risk and Authorization Management Program (“FedRAMP”), and until the time that we also certify under FedRAMP, we risk losing deals to certified competitors for deals where FedRAMP certification is a requirement.

The rules and regulations applicable to sales to government organizations may also negatively impact sales to other organizations.

3 unchanged sentences

Any such penalties could adversely impact our results of operations in a material way.

Further, any refusal to grant certain certifications or clearances by one government agency, or any decision by one government agency that our products do not meet certain standards, may

reduce business opportunities and cause reputational harm and cause concern with other government agencies, governments and businesses and cause them to not buy our products and services and/or lead to a decrease in demand for our products generally.

Further, any refusal to grant certain certifications or clearances by one government agency, or any decision by one government agency that our products do not meet certain standards, may reduce business opportunities and cause reputational harm and cause concern with other government agencies, governments and businesses and cause them to not buy our products and services and/or lead to a decrease in demand for our products generally.

Finally, some governments, including the U.S.

federal government, may require certain products to be manufactured in, and services to be provided from, certain identified countries which may be high-cost locations.

We may not manufacture all products or provide all services in locations that meet such requirements and consequently our products and services may not be eligible for certain government purchases.

Risks Related to Our Industry, Customers, Products and Services

We face intense competition in our market and we may not maintain or improve our competitive position.

The market for network security products is intensely competitive and dynamic, and we expect competition to continue to intensify.

We face many competitors across the different cybersecurity markets.

Our competitors include companies such as Aruba, Check Point, Cisco, CrowdStrike, F5 Networks, Huawei, Juniper, Palo Alto Networks, SonicWALL, Sophos, VMware and Zscaler.

Some of our existing and potential competitors enjoy competitive advantages such as:

• greater name recognition and/or longer operating histories;

• larger sales and marketing budgets and resources;

• broader distribution and established relationships with distribution partners and end-customers;

• access to larger customer bases;

• greater customer support resources;

• greater resources to make acquisitions;

• stronger U.S.

government relationships;

• lower labor and development costs;

• substantially greater financial, technical and other resources.

These larger competitors often have broader product lines and market focus, and are in a better position to withstand any significant reduction in capital spending by end-customers in these markets.

Therefore, these competitors will not be as susceptible to downturns in a particular market.

Conditions in our markets could change rapidly and significantly as a result of technological advancements or continuing market consolidation.

For example, certain of our competitors are focusing on delivering security services from the cloud which include cloud-based security providers, such as CrowdStrike and Zscaler.

In addition, our competitors may bundle products and services competitive with ours with other products and services.

Customers may accept these bundled products and services rather than separately purchasing our products and services.

Due to budget constraints or economic downturns, organizations may be more willing to incrementally add solutions to their existing network security infrastructure from competitors than to

replace it with our solutions.

These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer customer orders, reduced revenue and gross margins and loss of market share.

We may not manufacture all

products or provide all services in locations that meet such requirements and consequently our products and services may not be eligible for certain government purchases.

Risks Related to Our Products and Services, Industry and Customers

Actual, possible or perceived defects, errors or vulnerabilities , including critical vulnerabilities, in our products or services, the failure of our products or services to detect or prevent a security incident or the misuse of our products could harm our and our customers’ operational results and reputation.

Our products and services are complex, and they have contained and may contain defects, errors or vulnerabilities that are not detected until after their commercial release and deployment by our customers.

Defects, errors or vulnerabilities may impede or block network traffic, cause our products or services to be vulnerable to electronic break-ins, cause them to fail to help secure our customers or cause our products or services to allow unauthorized access to our customers’ networks, or an unintended disruption to our customers’ operations.

Additionally, any perception that our products have vulnerabilities, whether or not accurate, and any actual vulnerabilities may harm our operational results and reputation, more significantly as compared to other companies in other industries.

Following a review in accordance with our publicly available Product Security Incident Response Team policy, our Product Security Incident Response Team publicly posts on our FortiGuard Labs website known product vulnerabilities, including critical vulnerabilities, and methods for customers to mitigate the risk of vulnerabilities.

For example, we recently discovered, and subsequently released to customers an advisory update and patch for, a critical vulnerability in our FortiManager product.

We are subject to various risks due to the FortiManager vulnerability, including reputational harm, adverse impacts to customer relationships, potential litigation, and additional regulatory scrutiny, which could negatively impact our business, operating results and financial condition.

There can be no assurance that posts on our FortiGuard Labs website, including with respect to the recently announced FortiManager vulnerability, will be sufficiently timely, accurate or complete or that those customers will see such posts or take steps to mitigate the risk of vulnerabilities, and certain customers may be negatively impacted.

Our products are also susceptible to errors, defects, logic flaws, vulnerabilities and inserted vulnerabilities that may arise in, or be included in our products in, different stages of our supply chain, manufacturing and shipment processes, and a threat actor’s exploitation of these weaknesses may be difficult to anticipate, prevent, and detect.

If we are unable to maintain an effective supply chain security risk management and products security program or we inadvertently release a product or an update to a product with a defect in it, then the security and integrity of our products and the updates to those products that our customers receive could be exploited by third parties or insiders, or our solutions or updates thereto could cause an unintended disruption to our customers’ operations.

Different customers deploy and use our products in different ways, and certain deployments and usages may subject our products to adverse conditions that may negatively impact the effectiveness and useful lifetime of our products.

Further, customers may choose not to apply patches in a timely manner for business or operational reasons, or may neglect to upgrade at all and may run unpatched or unsupported devices against our guidance and industry best practice.

Such lack of action to remediate known product vulnerabilities in the customer environment could negatively impact their own security posture, increasing the likelihood of exploitation and negatively impacting our reputation.

Our networks and products, including cloud-based technology, could be targeted by attacks specifically designed to disrupt our business and harm our operational results and reputation.

We cannot ensure that our products will prevent all adverse security events or not cause disruptions to our customers’ operations.

Because the techniques used by malicious adversaries to access or sabotage networks change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques.

In addition, defects or errors in our FortiGuard and other security subscriptions or FortiCare updates or our Fortinet appliances and operating systems could result in a failure of our FortiGuard and other security subscription services to effectively or correctly update end-customers’ Fortinet appliances and cloud-based products and thereby leave customers vulnerable to attacks or to disruptions in operations.

Furthermore, our solutions may also fail to detect or prevent viruses, worms, ransomware attacks or similar threats due to a number of reasons such as the evolving nature of such threats and the continual emergence of new threats that we may fail to anticipate or add to our FortiGuard databases in time to protect our end-customers’ networks.

Our data centers and networks and those of our hosting vendors and cloud service providers may also experience technical failures and downtime, and may fail to distribute appropriate updates, or fail to meet the increased requirements of our customer base.

Any such technical failure, downtime or failures in general may temporarily or permanently expose our end-customers’ networks, leaving their networks unprotected against the latest security threats.

An actual, possible or perceived security incident or infection of the network of one of our end-customers or a disruption to their operations, regardless of whether the incident is attributable to the failure of our products or services to prevent or detect the security incident or be the cause of such disruption, or any actual or perceived security risk in our supply chain, could adversely affect the market’s perception of our security products and services, cause customers and customer

prospects not to buy from us and, in some instances, subject us to potential liability that is not contractually limited.

We may not be able to correct any security flaws or vulnerabilities promptly, or at all.

Our products may also be misused or misconfigured by end-customers or third parties who obtain access to our products.

For example, our products could be used to censor private access to certain information on the internet.

Such use of our products for censorship could result in negative press coverage and negatively affect our reputation, even if we take reasonable measures to prevent any improper shipment of our products or if our products are provided by an unauthorized third party.

Any actual, possible or perceived defects, errors or vulnerabilities, including critical vulnerabilities, in our products, or misuse of our products, could result in:

• the expenditure of significant financial and product development resources in efforts to analyze, correct, eliminate or work around errors or defects or to address and eliminate vulnerabilities;

• the loss of existing or potential end-customers or channel partners;

• delayed or lost revenue;

• delay or failure to attain market acceptance;

• negative publicity and harm to our reputation;

• disclosure requirements, litigation, regulatory inquiries or investigations that may be costly and harm our reputation and, in some instances, subject us to potential liability that is not contractually limited.

If our internal enterprise IT networks, on which we conduct internal business and interface externally, our operational networks, through which we connect to customers, vendors and partners systems and provide services, or our research and development networks, our back-end labs and cloud stacks hosted in our data centers or PoPs, colocation vendors or public cloud providers, through which we research, develop and host products and services, are compromised, public perception of our products and services may be harmed, our customers may be breached and harmed, we may become subject to liability, and our business, operating results and stock price may be adversely impacted.

Our success depends on the market’s confidence in our ability to provide effective network security protection.

Despite our efforts and processes to prevent breaches of our internal networks, systems and websites, whether in our owned data centers, cloud providers or colocations, we are still vulnerable to computer viruses, break-ins, phishing attacks, ransomware attacks, attempts to overload our servers with denial-of-service, vulnerabilities in vendor hardware and software that we leverage, advanced persistent threats from sophisticated actors and other cyber-attacks and similar disruptions from unauthorized access to our internal networks, systems or websites, whether in our owned data centers, cloud providers or colocations.

Our security measures may also be breached due to employee error, malfeasance or otherwise, which breaches may be more difficult to detect than outsider threats, and the existing programs and trainings we have in place to prevent such insider threats may not be effective or sufficient.

Third parties may also attempt to fraudulently induce our employees to transfer funds or disclose information in order to gain access to our networks and confidential information.

Third parties may also send our customers or others malware or malicious emails that falsely indicate that we are the source, potentially causing lost confidence in us and reputational harm.

We cannot guarantee that the measures we have taken to protect our networks, systems and websites, whether in our owned data centers, cloud providers or colocations, will provide adequate security.

Moreover, because we provide network security products, we may be a more attractive target for attacks by computer hackers and any security breaches and other security incidents involving us may result in more harm to our reputation and brand than companies that do not sell network security solutions.

Hackers and malicious parties may be able to develop and deploy viruses, worms, ransomware and other malicious software programs that attack our products and customers, that impersonate our update servers in an effort to access customer networks and negatively impact customers, or otherwise exploit any security vulnerabilities of our products, or attempt to fraudulently induce our employees, customers or others to disclose passwords or other sensitive information or unwittingly provide access to our internal networks, systems or data.

Moreover, the threat landscape continues to evolve as a result of new technologies, including AI, and malicious parties may use AI to help attack our solutions, systems, and our customers.

For example, from time to time, we have discovered that unauthorized parties have targeted us using sophisticated techniques, including by stealing technical data and attempting to steal private encryption keys, in an effort to both impersonate our products and threat intelligence update services and possibly attempt other attack methodologies.

Using these techniques, these unauthorized parties have tried, and may in the future try, to gain access to certain of our and our customers’ systems.

For example, recently, an individual gained unauthorized access to a limited number of files stored on our instance of a third-party cloud-based shared file drive, which included limited data related to a small percentage of our customers.

We do not currently believe that this incident was material as a result of our assessment of various factors, including, but not limited to, because (i) our operations, products, and services have not been impacted, and (ii) we have identified no evidence of additional access to any other of our resources.

As a result, we have not experienced, and do not currently believe that the incident is reasonably likely to have a material impact to our financial condition, operating results or business.

However, we remain subject to various

risks due to the incident and its impact, including reputational harm, adverse impacts to customer relationships, potential litigation, and additional regulatory scrutiny.

We have also, for example, discovered that unauthorized parties have targeted vulnerabilities, including critical vulnerabilities, in our product software and infrastructure in an effort to gain entry into our customers’ networks.

In addition, in general threat actors use dark web forums to sell organizations’ stolen credentials.

If threat actors sell valid credentials used by our customers to access our services, it is possible that unauthorized third parties may use such stolen credentials to try to gain access to our services.

These and other hacking efforts against us and our customers may be ongoing and may happen in the future.

Although we take numerous measures and implement multiple layers of security to protect our networks, we cannot guarantee that our security products, processes and services will secure against all threats.

Further, we cannot be sure that third parties have not been, or will not in the future be, successful in improperly accessing our systems and our customers’ systems, which could negatively impact us and our customers.

An actual breach could significantly harm us and our customers, and an actual or perceived breach, or any other actual or perceived data security incident, threat or vulnerability, that involves our supply chains, networks, systems or websites and/or our customers’ supply chains, networks, systems or websites could adversely affect the market perception of our products and services and investor confidence in our company.

Any breach of our networks, systems or websites could impair our ability to operate our business, including our ability to provide FortiGuard and other security subscriptions and FortiCare technical support services to our end-customers, lead to interruptions or system slowdowns, cause loss of critical data or lead to the unauthorized disclosure or use of confidential, proprietary or sensitive information.

We could also be subject to liability and litigation and reputational harm and our channel partners and end-customers may be harmed, lose confidence in us and decrease or cease using our products and services.

Any breach of our internal networks, systems or websites could have an adverse effect on our business, operating results and stock price.

In addition, there has been a general increase in phishing attempts and spam emails as well as social engineering attempts from hackers, and many of our employees continue to work remotely which may pose additional data security risks in the event remote work environments are not as secure as office environments.

Any security incident could negatively impact our reputation and results of operations.

Managing inventory of our products and product components is complex.

We order components from third-party manufacturers based on our forecasts of future demand and targeted inventory levels, which exposes us to the risk of both product shortages, which may result in lost sales and higher expenses, and excess inventory, which may require us to sell our products at discounts and lead to write-offs.

We order components from third-party manufacturers based on our forecasts of future demand and targeted inventory levels, which exposes us to the risk of product shortages, which may result in lost sales, higher expenses and excess inventory, which may require us to sell our products at discounts and lead to inventory charges or write-offs.

Managing our inventory is complex, especially in times of supply chain disruption.

1 unchanged sentence

Our channel partners also may adjust their orders in response to the supply of our products and the products of our competitors that are available to them and in response to seasonal fluctuations in end-customer demand.

If we cannot manufacture and ship our products due to, for example, global chip shortages, excessive demand on contract manufacturers capacity, natural disasters and health emergencies such as earthquakes, fires, power outages, typhoons, floods, cyber events, pandemics and epidemics or manmade events such as civil unrest, labor disruption, international trade disputes, international conflicts, terrorism, wars or other foreign conflicts, such as the war in Ukraine and the Israel-Hamas war or tensions between China and Taiwan, and critical infrastructure attacks, our business and financial results could be materially and adversely impacted.

If we cannot manufacture and ship our products due to, for example, global chip shortages, excessive demand on contract manufacturers capacity, natural disasters and health emergencies such as earthquakes, fires, power outages, typhoons, floods, health pandemics and epidemics or manmade events such as civil unrest, labor disruption, cyber events, international trade disputes, international conflicts, terrorism, wars or other foreign conflicts, such as the war in Ukraine or tensions between China and Taiwan, and critical infrastructure attacks, our business and financial results could be materially and adversely impacted.

The conflicts in the Middle East highlights potential risks associated with geopolitical instability in the region, including disruption to shipping routes, longer lead times for components and products, increased insurance costs for vessels passing through conflict zones, potential increased costs for shipping and products, and potential delays and interruptions in the supply chain.

1 unchanged sentence

In response to component shortages in previous periods, we increased our purchase order commitments.

Our suppliers may require us to accept or pay for components and finished goods regardless of our level of sales in a particular period, which may negatively impact our operating results and financial condition.

Our suppliers have in some instances and may in the future require us to accept or pay for components and finished goods regardless of our level of sales in a particular period, which may negatively or unpredictably impact our operating results and financial condition.

For additional information and a further discussion of impacts and risks related to our purchase commitments with our suppliers, refer to Note 12.

1 unchanged sentence

Inventory management remains an area of focus as we balance the need to maintain inventory levels that are sufficient to ensure competitive lead times against the risk of inventory obsolescence because of rapidly changing technology, product transitions, customer requirements or excess inventory levels.

If we ultimately determine that we have excess inventory, we may have to reduce our prices and write-down inventory, which in turn could result in lower gross margins.

Alternatively, insufficient inventory levels may lead to shortages that result in delayed billings and revenue or loss of sales opportunities altogether as potential end-customers turn to competitors’ products that are readily available.

If we ultimately determine that we have excess inventory, we may have to reduce our prices, which may result in inventory charges and/or write-down of inventory, which in turn could result in lower gross margins.

For example, we have in the past experienced inventory shortages and excesses due to the variance in demand for certain products from forecasted amounts.

6 unchanged sentences

Our new products, services or enhancements could fail to attain sufficient market acceptance for many reasons, including:

• actual or perceived defects, vulnerabilities, errors or failures;

• delays in releasing our new products, services or enhancements to the market;

4 unchanged sentences

• inability to protect against new types of attacks or techniques used by hackers;

• actual or perceived defects, vulnerabilities, errors or failures;

• negative publicity about their performance or effectiveness;

8 unchanged sentences

Moreover, many of our end-customers operate in markets characterized by rapidly changing technologies and business plans, which require them to add numerous network access points and adapt increasingly complex networks, incorporating a variety of hardware, software applications, operating systems and networking protocols.

In addition, computer hackers and others who try to attack networks employ increasingly sophisticated techniques to gain access to and attack systems and networks.

In addition, computer hackers and others who try to attack networks employ increasingly

sophisticated techniques to gain access to and attack systems and networks.

The technology in our products is especially complex because of the requirements to effectively identify and respond to new and increasingly sophisticated methods of attack, while minimizing the impact on network performance.

10 unchanged sentences

There is also a risk that we are slower to offer these solutions than competitors.

The risks are compounded by the uncertainty concerning the future success of any of our particular subscription

cloud-based business models and the future demand for our subscription cloud-based models by customers.

The risks are compounded by the uncertainty concerning the future success of any of our particular subscription cloud-based business models and the future demand for our subscription cloud-based models by customers.

Additionally, if we are unable to meet the demand to provide our services effectively through a subscription cloud-based model, we may lose customers to competitors.

11 unchanged sentences

Furthermore, even if the functionality offered by network infrastructure providers is more limited than our products, a significant number of customers may elect to accept such limited functionality in lieu of adding appliances from an additional vendor such as us.

Many organizations have invested substantial personnel and financial resources to design and operate their networks and have established deep relationships with other providers of networking products, which may make them reluctant to add new components to their networks, particularly from other vendors such as us.

Many organizations have invested substantial personnel and financial resources to design and operate their networks and have

established deep relationships with other providers of networking products, which may make them reluctant to add new components to their networks, particularly from other vendors such as us.

In addition, an organization’s existing vendors or new vendors with a broad product offering may be able to offer concessions that we are not able to match because we currently offer only network security products and have fewer resources than many of our competitors.

If organizations are reluctant to add additional network infrastructure from new vendors or otherwise decide to work with their existing vendors, our business, financial condition and results of operations will be adversely affected.

Because we depend on several third-party manufacturers to build our products, we are susceptible to manufacturing delays that could prevent us from shipping customer orders on time, if at all, and may result in the loss of sales and customers, and third-party manufacturing cost increases could result in lower gross margins and free cash flow.

We outsource the manufacturing of our security appliance products to contract manufacturing partners and original design manufacturing partners, including manufacturers with facilities located in Taiwan and other countries outside the United States such as ADLINK, IBASE, Micro-Star, Senao and Wistron.

Because we depend on several third-party manufacturers to build our products, we are susceptible to manufacturing delays that could prevent us from shipping customer orders on time, if at all, and may result in the loss of sales and customers, additional third-party manufacturing cost increases and changes in the geopolitical environment could result in lower gross margins and free cash flow.

Our reliance on our third-party manufacturers reduces our control over the manufacturing process, exposing us to risks, including reduced control over quality assurance, costs, supply and timing and possible tariffs.

Any manufacturing disruption related to our third-party manufacturers or their component suppliers for any reason, including global chip shortages, natural disasters and health emergencies such as earthquakes, fires, power outages, typhoons, floods, health pandemics and epidemics and manmade events such as civil unrest, labor disruption, cyber events, international trade disputes, international conflicts, terrorism, wars, such as the war in Ukraine and the Israel-Hamas war, and critical infrastructure attacks, could impair our ability to fulfill orders.

Any manufacturing disruption related to our third-party manufacturers or their component suppliers for any reason, including global chip shortages, natural disasters and health emergencies such as earthquakes, fires, power outages, typhoons, floods, health pandemics and epidemics and manmade events such as civil unrest, labor disruption, cyber events, international trade disputes, international conflicts, terrorism, wars or other foreign conflicts, such as the war in Ukraine or tensions between China and Taiwan, and critical infrastructure attacks, could impair our ability to fulfill orders.

If we are unable to manage our relationships with these third-party manufacturers effectively, or if these third-party manufacturers experience delays, increased manufacturing lead-times, disruptions, capacity constraints or quality control problems in their manufacturing operations, or fail to meet our future requirements for timely delivery, our ability to ship products to our customers could be impaired and our business would be seriously harmed.

Further, certain components for our products come from Taiwan and approximately 95%

of our hardware is manufactured in Taiwan.

Further, certain components for our products come from Taiwan and approximately 88% of our hardware is manufactured in Taiwan.

Any increase in tensions between China and Taiwan, including threats of military actions or escalation of military activities, could adversely affect our manufacturing operations in Taiwan.

15 unchanged sentences

As a result of the passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (“Dodd-Frank”), the Securities and Exchange Commission (the “SEC”) adopted disclosure requirements for public companies whose products contain conflict minerals that are necessary to the functionality or production of such products.

Under these rules, we are required to obtain sourcing data from suppliers, perform supply chain due diligence, and file annually with the SEC a specialized disclosure report on Form SD covering the prior calendar year.

Under these rules, we are required to obtain sourcing data

from suppliers, perform supply chain due diligence, and file annually with the SEC a specialized disclosure report on Form SD covering the prior calendar year.

We have incurred and expect to incur additional costs to comply with the rules, including costs related to efforts to determine the origin, source and chain of custody of the conflict minerals used in our products and the adoption of conflict minerals-related governance policies, processes and controls.

8 unchanged sentences

We also may face shortages in the supply of the capacitors and resistors that are used in the manufacturing of our products, which may persist for an indefinite period of time.

The introduction by component suppliers of new versions of their products, particularly if not anticipated by us or our contract manufacturers, could

require us to expend significant resources to incorporate these new components into our products.

The introduction by component suppliers of new versions of their products, particularly if not anticipated by us or our contract manufacturers, could require us to expend significant resources to incorporate these new components into our products.

In addition, if these suppliers were to discontinue production of a necessary part or component, we would be required to expend significant resources and time in locating and integrating replacement parts or components from another vendor.

Qualifying additional suppliers for limited source parts or components can be time-consuming and expensive.

Although we have increased our purchase order commitments to support long-term customer demand, if we are unable to obtain sufficient quantities of any of these components on commercially reasonable terms or in a timely manner, or if we are unable to obtain alternative sources for these components, shipments of our products could be delayed or halted entirely or we may be required to redesign our products.

If we are unable to obtain sufficient quantities of any of these components on commercially reasonable terms or in a timely manner, or if we are unable to obtain alternative sources for these components, shipments of our products could be delayed or halted entirely or we may be required to redesign our products.

Any of these events could result in a cancellation of orders, lost sales, reduced gross margins or damage to our end customer relationships, which would adversely impact our business, financial condition, results of operations and prospects.

Additionally, if actual demand does not directly match with our demand forecasts, due to our purchase order commitments, we could be required to accept or pay for components and finished goods.

Additionally, if actual demand does not directly match with our demand forecasts, due to our purchase order commitments, we in some instances have been required to and may in the future be required to accept or pay for components and finished goods.

This may result in us discounting our products or excess or obsolete inventory, which we would be required to write down to its estimated realizable value, which in turn could result in lower gross margins.

10 unchanged sentences

Any interruption or delay in the supply of any of these parts or components, or the inability to obtain these parts or components from alternate sources at acceptable prices and within a reasonable amount of time, would harm our ability to meet our scheduled product deliveries to our distributors, resellers and end-customers.

This could harm our relationships with our channel partners and end-customers and could cause delays in shipment of our products and adversely affect our results of operations.

This could harm our relationships with our channel partners

and end-customers and could cause delays in shipment of our products and adversely affect our results of operations.

In addition, increased component costs could result in lower gross margins.

8 unchanged sentences

Competition continues to increase in the market segments in which we participate, and we expect competition to further increase in the future, thereby leading to increased pricing pressures.

Larger competitors with more diverse product offerings may reduce the price of products and services that compete with ours in order to promote the sale of other products or services or may bundle them with other products or

Additionally, although we price our products and services worldwide in U.S.

dollars, currency fluctuations in certain countries and regions have in the past, and may in the future, negatively impact actual prices that partners and customers are willing to pay in those countries and regions.

Additionally, while our U.S distribution agreements contain price protections, our international distribution agreements do not contain such protections.

Furthermore, we anticipate that the sales prices and gross profits for our products or services will decrease over product life cycles.

We cannot ensure that we will be successful in developing and introducing new offerings with enhanced functionality on a timely basis, or that our product and service offerings, if introduced, will enable us to maintain our prices, gross profits and operating margin at levels that will allow us to maintain profitability.

Actual, possible or perceived defects, errors or vulnerabilities in our products or services, the failure of our products or services to detect or prevent a security incident, or the misuse of our products could harm our operational results and reputation.

There can be no assurance, however, that such posts will be sufficiently timely, accurate or complete or that those customers will take steps to mitigate the risk of vulnerabilities, and certain customers may be negatively impacted.

Additionally, any perception that our products have vulnerabilities, whether or not accurate, and any actual vulnerabilities may harm our operational results and rep utation, more significantly as compared to certain other companies in other industries because we are a security company.

If we are unable to maintain an effective supply chain security risk management and products security program, then the security and integrity of our products and the updates to those products that our customers receive could be exploited by third parties or insiders.

Our networks and products, including cloud-based technology, could be targeted by attacks specifically designed to disrupt our business and harm our operational results and reputation.

We cannot ensure that our products will prevent all adverse security events.

In addition, defects or errors in our FortiGuard and other security subscription or FortiCare updates or our Fortinet appliances and operating systems could result in a failure of our FortiGuard and other security subscription services to effectively or correctly update end-customers’ Fortinet appliances and cloud-based products and thereby leave customers vulnerable to attacks.

An actual, possible or perceived security incident or infection of the network of one of our end-customers, regardless of whether the incident is attributable to the failure of our products or services to prevent or detect the security incident, or any actual or perceived security risk in our supply chain, could adversely affect the market’s perception of our security products and services, cause customers and customer prospects not to buy from us and, in some instances, subject us to potential liability that is not contractually limited.

We may not be able to correct any security flaws or vulnerabilities promptly, or at all.

Our products may also be misused or misconfigured by end-customers or third parties who obtain access to our products.

For example, our products could be used to censor private access to certain information on the internet.

Any actual, possible or perceived defects, errors or vulnerabilities in our products, or misuse of our products, could result in:

• the expenditure of significant financial and product development resources in efforts to analyze, correct, eliminate or work around errors or defects or to address and eliminate vulnerabilities;

• the loss of existing or potential end-customers or channel partners;

• delayed or lost revenue;

• delay or failure to attain market acceptance;

• negative publicity and harm to our reputation;

Our uniform resource locator (“URL”) database for our web filtering service may fail to keep pace with the rapid growth of URLs and may not categorize websites in accordance with our end-customers ’ expectations.

13 unchanged sentences

Any failure to effectively categorize and filter websites according to our end-customers’ and channel partners’ expectations could impair the growth of our business.

False detection of vulnerabilities, viruses or security incidents or false identification of spam or spyware could adversely affect our business.

False positive detection of legitimate non-malicious files as viruses or malware or false identification of legitimate emails as spam, could adversely affect our business.

Our FortiGuard and other security subscription services may falsely detect, report and act on viruses or other threats that do not actually exist.

This risk is heightened by the inclusion of a “heuristics” feature in our products, which attempts to identify viruses and other threats not based on any known signatures but based on characteristics or anomalies that may indicate that a particular item is a threat.

When our end-customers enable the heuristics feature in our products, the risk of falsely identifying viruses and other threats significantly increases.

This risk is heightened by the inclusion of heuristics, ML or AI features in our products, which attempt to identify viruses and other threats not based on any known signatures but based on characteristics or anomalies that may indicate that a particular item is a threat.

With these features in our products, the risk of falsely identifying viruses and other threats significantly increases.

These false positives, while typical in the industry, may impair the perceived reliability of our products and may therefore adversely impact market acceptance of our products.

21 unchanged sentences

The sale and support of our products also entail the risk of product liability claims.

We maintain insurance to protect against certain claims associated with the use of our products, but our insurance coverage may not adequately cover any claim asserted against us, if at all, and in some instances may subject us to potential liability that is not contractually limited.

maintain insurance to protect against certain claims associated with the use of our products, but our insurance coverage may not adequately cover any claim asserted against us, if at all, and in some instances may subject us to potential liability that is not contractually limited.

In addition, even claims that ultimately are unsuccessful could result in our expenditure of funds in litigation and divert management’s time and other resources.

2 unchanged sentences

If we are unable to meet these commitments, this could negatively impact our business.

We rely on public cloud providers, such as Amazon Web Services, Microsoft Azure and Google Cloud, co-location providers, such as Equinix, and our own data centers and points of presence (“PoPs”), and any availability interruption in any of these cloud solutions could result in us not meeting our service-level commitments to our customers.

In some cases, we may not have a contractual right with our public cloud or co-location providers that compensates us for any losses due to availability interruptions in our cloud-based subscription services.

We rely on public cloud providers, such as Amazon Web Services, Microsoft Azure and Google Cloud colocation providers, such as Equinix, and our own data centers and PoPs, and any availability interruption in any of these cloud solutions could result in us not meeting our service-level commitments to our customers.

In some cases, we may not have a contractual right with our public cloud or colocation providers that compensates us for any losses due to availability interruptions in our cloud-based subscription services.

Further, any failure to meet our service-level commitments could damage our reputation and adoption of our cloud-based subscription services, and we could face loss of revenue from reduced future subscriptions and reduced sales and face additional costs associated with any failure to meet service-level agreements.

1 unchanged sentence

Risks Related to our Systems and Technology

If our internal enterprise IT networks, on which we conduct internal business and interface externally, our operational networks, through which we connect to customers, vendors and partners systems and provide services, or our research and development networks, our back-end labs and cloud stacks hosted in our data centers, colocation vendors or public cloud providers, through which we research, develop and host products and services, are compromised, public perception of our products and services may be harmed, our customers may be breached and harmed, we may become subject to liability, and our business, operating results and stock price may be adversely impacted.

Our success depends on the market’s confidence in our ability to provide effective network security protection.

Despite our efforts and processes to prevent breaches of our internal networks, systems and websites, we are still vulnerable to computer viruses, break-ins, phishing attacks, ransomware attacks, attempts to overload our servers with denial-of-service, vulnerabilities in vendor hardware and software that we leverage, advanced persistent threats from sophisticated actors and other cyber-attacks and similar disruptions from unauthorized access to our internal networks, systems or websites.

Third parties may also attempt to fraudulently induce our employees to transfer funds or disclose information in order to gain access to our networks and confidential information.

Third parties may also send our customers or others malware or malicious emails that falsely indicate that we are the source, potentially causing lost confidence in us and reputational harm.

We cannot guarantee that the measures we have taken to protect our networks, systems and websites will provide adequate security.

Moreover, the threat landscape continues to evolve as a result of new technologies, including artificial intelligence (“AI”), and malicious parties may use AI to help attack our solutions, systems, and our customers.

Using these techniques, these unauthorized parties have tried, and may in the future try, to gain access to certain of our and our customers’ systems.

We have also, for example, discovered that unauthorized parties have targeted vulnerabilities in our product software and infrastructure in an effort to gain entry into our customers’ networks.

In addition, in general threat actors use dark web forums to sell organizations’ stolen credentials.

These and other hacking efforts against us and our customers may be ongoing and may happen in the future.

F urther, we cannot be sure that third parties have not been, or will not in the future be, successful in improperly accessing our systems and our customers’ systems, which could negatively impact us and our customers.

Any breach of our networks, systems or websites could impair our ability to operate our business, including our ability to provide FortiGuard and other security subscription and FortiCare technical support services to our end-customers, lead to interruptions or system slowdowns, cause loss of critical data or lead to the unauthorized disclosure or use of confidential, proprietary or sensitive information.

Any breach of our internal networks, systems or websites could have an adverse effect on our business, operating results and stock price.

Any security incident could negatively impact our reputation and results of operations.

If we do not appropriately manage any future growth, including through the expansion of our real estate facilities, or are unable to improve our systems, processes and controls, our operating results will be negatively affected.

1 unchanged sentence

In addition, we have been slow to adopt and implement certain automated functions, which could have a negative impact on our business.

For example, our order processing relies on both manual data entry of customer purchase orders received through email and electronic data interchange (EDI).

For example, our order processing relies on both manual data entry of customer purchase orders received through email and electronic data interchange.

Due to the use of manual processes and the fact that we may receive a large amount of our orders in the last few weeks of any given quarter, an interruption in our email service or other systems could result in delayed order fulfillment and decreased billings and revenue for that quarter.

4 unchanged sentences

Moreover, the failure of our systems and processes could undermine our ability to provide accurate, timely and reliable reports on our financial and operating results and could impact the effectiveness of our internal control over financial reporting.

In addition, our systems, processes and controls may not prevent or detect all errors, omissions, malfeasance or fraud, such as corruption and improper “side agreements” that may impact revenue recognition or result in financial liability.

In addition, our existing systems, processes, and controls may not prevent or detect all errors, omissions, or fraud.

Our productivity and the quality of our products and services may also be adversely affected if we do not integrate and train our new employees quickly and effectively.

14 unchanged sentences

AI presents new risks and challenges that may affect our business.

We have made, and expect to continue to make investments to integrate AI and machine learning technology into our solutions.

We have made, and expect to continue to make investments to integrate AI and machine learning technology into our solutions, as evidenced by our acquisition of Lacework.

AI presents risks, challenges, and potentially unintended consequences that could impact our ability to effectively use of AI successfully in our business.

Given the nature of AI technology, we face an evolving regulatory landscape and significant competition from other companies.

Our AI efforts may not be successful and our competitors may incorporate AI into their products more quickly or more successfully than us, which

could impair our ability to compete effectively and adversely affect our financial results.

Our AI efforts may not be successful and our competitors may incorporate AI into their products more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our financial results.

Data practices by us or others that result in controversy could also impair the acceptance of AI solutions.

2 unchanged sentences

Our AI-related initiatives may result in new or enhanced governmental or regulatory scrutiny, including regarding the use of AI in our solutions and the marketing of products using AI, litigation, customer reporting or documentation requirements, ethical or social concerns, or other complications.

For example, AI technologies, including generative AI, may create content that appears correct but is factually inaccurate or flawed, or contains copyrighted or other protected material, and if our customers or others use this flawed content to their detriment, we may be exposed to brand or reputational harm, competitive harm, or legal liability.

For example, AI technologies, including generative AI, may create content that appears correct but is factually inaccurate (hallucinations) or flawed, or contains copyrighted or other protected material, and if our customers or others use this flawed content to their detriment, we may be exposed to brand or reputational harm, competitive harm, or legal liability.

If customer data is used to train AI based systems and such data is not adequately anonymized, this may lead to breach of sensitive information and loss of customer trust.

The use of AI also brings ethical issues related to privacy, surveillance and consent of use, as well as potential for bias and discrimination.

Any of the foregoing could adversely affect our business, reputation, or financial results.

The use of AI technology in our IT infrastructure could improve internal process but poses security and privacy risks.

The adoption of AI in internal processes presents an opportunity to bolster decision making, productivity and customer satisfaction, but the new technology poses risks.

AI can be exploited by hackers and malicious actors to develop advanced cyberattacks, bypass security measures, and exploit system vulnerabilities.

The use of AI involves handling large amounts of data.

If the security measures around the usage of AI are insufficient, there’s risk of data breaches, leading to unauthorized access to sensitive information.

Failure to comply with data protection regulations (such as GDPR or the California Consumer Privacy Act (the “CCPA”) and DORA) can result in legal consequences.

The intellectual property risks associated with AI include uncertainties around the ownership of AI-generated works, potential infringement of existing patents and copyrights, unauthorized use of third-party data, and exposure of proprietary algorithms or trade secrets.

Dependence on AI systems or AI vendors means that any downtime or outages can disrupt business operations.

Usage of our confidential data to train the AI models by us or our vendors, could result in legal risk, especially if it involves customer data.

Other risks that have been observed in AI models and documented, include risks related to bias, discrimination, job displacements, and violating human rights.

Risks Related to our Intellectual Property

2 unchanged sentences

Valid patents may not issue from our pending applications, and the claims eventually allowed on any patents may not be sufficiently broad to protect our technology or products.

Any issued patents may be challenged, invalidated or circumvented, and any rights granted under these patents may not actually provide adequate defensive protection or competitive advantages to us.

Any issued patents may be challenged, invalidated or circumvented, and any rights granted under these patents may not actually provide adequate

defensive protection or competitive advantages to us.

Patent applications in the United States are typically not published until at least 18 months after filing, or, in some cases, not at all, and publications of discoveries in industry-related literature lag behind actual discoveries.

11 unchanged sentences

If we are unable to protect our proprietary rights (including aspects of our software and products protected other than by patent rights), we may find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create the innovative products that have enabled us to be successful to date.

Our products contain third-party open-source software components, and failure to comply with the terms of the underlying open-source software licenses could restrict our ability to sell our products.

Our products contain third-party open-source software components, and failure to comply with the terms of the underlying open-source software licenses could restrict our ability to sell our products or result in loss of IP.

Our products contain software modules licensed to us by third-party authors under “open source” licenses, including but not limited to, the GNU Public License, the GNU Lesser Public License, the BSD License, the Apache License, the MIT X License and the Mozilla Public License.

21 unchanged sentences

From time to time, we are subject to lawsuits claiming patent infringement.

We are also subject to other litigation in addition to patent infringement claims, such as employment-related litigation and disputes, as well as general commercial litigation, such as the Alorica litigation, and could become subject to other forms of litigation and disputes, including stockholder litigation.

(“Alorica”) litigation, and could become subject to other forms of litigation and disputes, including stockholder litigation.

If we are unsuccessful in defending any such claims, our operating results and financial condition and results may be materially and adversely affected.

19 unchanged sentences

For both our prior and future acquisitions, we may not be successful in effectively integrating the acquired business, product, technology, IP or sales force into our existing business and operations, and the acquisitions may negatively impact our financial results.

We may have difficulty incorporating acquired technologies, IP or products with our existing product lines, integrating reporting systems and procedures, and maintaining uniform standards, controls, procedures and policies.

For example, we may experience difficulties integrating an acquired company’s ERP or CRM systems, sales support and other processes and systems, with our current systems and processes.

The results of certain businesses that we invest in, such as Linksys, are, or may in the future, be reflected in our operating results, and we depend on these companies to provide us financial information in a timely manner in order to meet our financial reporting requirements.

We may have difficulty incorporating acquired technologies, IP or products with our existing

product lines, integrating reporting systems and procedures, and maintaining uniform standards, controls, development practices, procedures and policies.

For example, we may experience difficulties integrating an acquired company’s ERP or CRM systems, SaaS delivery systems, sales support, cyber risk management and compliance and other processes and systems, with our current systems and processes.

We may also find that the personnel of the companies we acquire do not adequately adhere to our corporate policies and it may take time to bring them in line with our policies and standards.

If we are unable to do so efficiently or effectively, our reputation and business, operating results and financial condition could be adversely impacted.

The results of certain businesses that we invest in are, or may in the future, be reflected in our operating results, and we depend on these companies to provide us financial information in a timely manner in order to meet our financial reporting requirements.

We may experience difficulty in timely obtaining financial information from the companies in which we have invested in order to meet our financial reporting requirements.

Further, we are required to record goodwill and intangible assets that are subject to impairment testing on a regular basis and potential periodic impairment charges, which may adversely affect our financial condition and results of operations.

Our due diligence for acquisitions and investments may fail to identify all of the problems, liabilities or other shortcomings or challenges of an acquired business, product or technology, including issues with IP, product quality or product architecture, regulatory compliance practices, environmental and sustainability compliance practices, revenue recognition or other accounting practices or employee or customer issues.

4 unchanged sentences

Further, completing a potential acquisition or investment and alliance and integrating acquired businesses, products, technologies or IP are challenging to do successfully and could significantly divert management time and resources.

Linksys sells predominantly into the consumer Wi-Fi market, and its sales have declined since our investment.

Because we are accounting for our Linksys investment using the equity method of accounting, we are required to assess the investment for other-than-temporary impairment (“OTTI”) when events or circumstances suggest that the carrying amount of the investment may be impaired.

We have analyzed whether there should be an OTTI of the value of our investment in Linksys and during the three months ended December 31, 2022 we recorded an OTTI charge of $22.2 million.

In evaluating OTTI, we considered factors such as Linksys ’ financial results and operating history, our ability and intent to hold the investment until its fair value recovers, the implied revenue valuation multiples compared to guideline public companies, Linksys’ ability to achieve milestones and any notable operational and strategic changes.

We intend to continue to analyze our investment in Linksys to determine whether any further impairment is appropriate.

If any further decline in fair value is determined to be other-than-temporary, we will adjust the carrying value of the investment to its fair value and record the impairment expense in our consolidated statements of income.

The cost basis of the investment is not adjusted for subsequent recoveries in fair value.

We may experience additional volatility to our statements of operations due to the underlying operating results of Linksys or impairments of our Linksys investment.

This volatility could be material to our results in any given quarter and may cause our stock price to decline.

Failure to comply with laws and regulations applicable to our business could subject us to fines and penalties and could also cause us to lose end-customers or negatively impact our ability to contract.

Our business is subject to regulation by various federal, state, regional, local and foreign governmental agencies, including agencies responsible for monitoring and enforcing employment and labor laws, workplace safety, product safety, product labeling, environmental laws, consumer protection laws, anti-bribery laws, data privacy laws, import and export controls, federal securities laws and tax laws and regulations.

In certain jurisdictions, these regulatory requirements may be

more stringent than in the United States.

In certain jurisdictions, these regulatory requirements may be more stringent than in the United States.

Non-compliance with applicable regulations or requirements could subject us to investigations, sanctions, enforcement actions, disgorgement of profits, fines, damages and civil and criminal penalties or injunctions.

8 unchanged sentences

The Privacy Shield has now been replaced with the EU-U.S.

Data Privacy Framework following certain changes to U.S.

Data Privacy Framework (the “Framework”) following certain changes to U.S.

law intended to address the concerns underlying that court decision with respect to transfers of personal data to the United States.

As of December 2024, we are an active participant in the Framework.

However, there remains a possibility that our business could be negatively impacted by restrictions on transfers of GDPR-regulated personal data (including transfers made by our customers) to other areas we operate.

3 unchanged sentences

Additionally, we may be subject to other legal regimes throughout the world governing data handling, protection and privacy.

For example, in June 2018, California passed the California Consumer Privacy Act (the “CCPA”), which provides new data privacy rights for consumers and new operational requirements for companies and became effective on January 1, 2020.

For example, in June 2018, California passed the CCPA, which provides new data privacy rights for consumers and

new operational requirements for companies and became effective on January 1, 2020.

The CCPA was expanded pursuant to the California Privacy Rights Act, which was passed in 2020 and became effective in 2023.

2 unchanged sentences

For example, our sales cycles may lengthen and face an increased risk of failure as customers take more time to vet our services for compliance with these legal requirements and to negotiate data-related contract terms with us, causing delays or loss of revenue.

Selling our solutions to the U.S.

government, whether directly or through channel partners, also subjects us to certain regulatory and contractual requirements, government permit and clearance requirements and other risks.

government or one of its divisions, as well as other penalties, damages and reputational harms, which could have an adverse effect on our business, operating results, financial condition and prospects.

Selling our solutions to governments, both within the U.S and internationally, whether directly or through channel partners, also subjects us to certain regulatory and contractual requirements, government permit and clearance requirements and other risks.

Failure to comply with these requirements or to obtain and maintain government permits and clearances required to do certain business, by either us or our channel partners, could subject us to investigations, fines, suspension, limitations on business or debarment from doing business with such governments, as well as other penalties, damages and reputational harms, which could have an adverse effect on our business, operating results, financial condition and prospects.

Any violations of regulatory and contractual requirements could result in us being suspended or debarred from future government contracting.

2 unchanged sentences

We may be subject to increased compliance burdens by regulators and customers with respect to our products and services, as well as additional costs to oversee and monitor security risks.

Additionally, this evolving global landscape could impact on our ability to conduct business in certain jurisdictions if the laws, regulation and industry standards in such jurisdictions changed in a manner that is adverse to our business.

Many jurisdictions have enacted laws mandating companies to inform individuals, stockholders, regulatory authorities, and others of security incidents.

21 unchanged sentences

Changes in our products or changes in export and import regulations may create delays in the introduction of our products in international markets, prevent our customers with international operations from deploying our products globally or, in some cases, prevent the export or import of our products to certain countries, governments or persons altogether.

Any change in export or import regulations, economic sanctions or related legislation, shift in the enforcement or scope of existing regulations, or change in the countries, governments, persons or technologies targeted by such regulations, could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers with international operations.

Any decreased use of our products or limitation on our ability to export or sell our products would likely adversely affect our business, financial condition and results of operations.

Efforts to withdraw from or materially modify international trade agreements, to change tax provisions related to global manufacturing and sales or to impose new tariffs, economic sanctions or related legislation, any of which could adversely affect our financial condition and results of operations.

For example, in recent years, the United States has imposed additional import tariffs on certain goods from different countries and on most goods imported from China.

As a result, China and other countries imposed retaliatory tariffs on goods exported from the United States and both the United States and foreign countries have threatened to alter or leave current trade agreements.

Any change in export or import regulations, economic sanctions or related legislation, shift

in the enforcement or scope of existing regulations, or change in the countries, governments, persons or technologies targeted by such regulations, could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers with international operations.

Any decreased use of our products or limitation on our ability to export or sell our products would likely adversely affect our business, financial condition and results of operations.

If we fail to comply with environmental requirements, our business, financial condition, operating results and reputation could be adversely affected.

We are subject to various environmental laws and regulations, including laws governing the hazardous material content of our products, laws relating to our real property and future expansion plans and laws concerning the recycling of Electrical and Electronic Equipment (“EEE”).

The laws and regulations to which we are subject include the EU RoHS Directive, EU Regulation 1907/2006 – Registration, Evaluation, Authorization and Restriction of Chemicals (the “REACH” Regulation) and the EU Waste Electrical and Electronic Equipment Directive (the “WEEE Directive”), as well as the implementing legislation of the EU member states.

12 unchanged sentences

This re-engineering and component substitution could result in additional costs to us and/or disrupt our operations or logistics.

As part of the Circular Economy Action Plan, the European Commission amended the EU Waste Framework Directive (“WFD”) to include a number of measures related to waste prevention and recycling, whereby we are responsible for submitting product data to a Substances of Concern In articles as such or in complex objects (Products) (“SCIP”) database containing information on Substances of Very High Concern (“SVHC”) in articles and in complex objects.

The SCIP database is established under the WFD and managed by the European Chemicals Agency (“ECHA”).

The SCIP database is established under the WFD and managed by the European Chemicals Agency.

We have incurred costs in order to comply with this new requirement.

Similar laws and regulations have been passed or are pending in the European Economic Area and the UK.

The EU’s WEEE Directive, which requires electronic goods producers to be responsible for the collection, recycling and treatment of such products.

The EU’s WEEE Directive requires electronic goods producers to be responsible for the collection, recycling and treatment of such products.

Although currently our EU international channel partners are responsible for the requirements of this directive as the importer of record in most of the European countries in which we sell our products, changes in interpretation of the regulations may cause us to incur costs or have additional regulatory requirements in the future to meet in order to comply with this directive, or with any similar laws adopted in other jurisdictions including the United States.

3 unchanged sentences

Investors’ expectations of our performance relating to environmental, social and governance factors may impose additional costs and expose us to new risks.

There is an increasing focus from certain investors, employees, customers and other stakeholders concerning corporate responsibility, specifically related to ESG matters.

There is an evolving focus from certain investors, employees, customers and other stakeholders concerning corporate responsibility, specifically related to ESG matters.

Some investors may use these non-financial performance factors to guide their investment strategies and, in some cases, may choose not to invest in us if they believe our policies and actions relating to corporate responsibility are inadequate.

The growing investor demand for measurement of non-financial performance is addressed by third-party providers of sustainability assessment and ratings on companies.

The criteria by which our corporate

responsibility practices are assessed may change due to the constant evolution of the sustainability landscape, which could result in greater expectations of us and cause us to undertake costly initiatives to satisfy such new criteria.

For example, in 2023, California passed three separate climate bills governing disclosure of greenhouse gas emissions data, climate-related financials risks and details around emissions-related claims and carbon offsets.

The criteria by which our corporate responsibility practices are assessed may change due to the constant evolution of the global sustainability landscape, which could result in greater expectations of us and cause us to undertake costly initiatives to satisfy such new criteria.

For example, under the EU’s Corporate Sustainability Reporting Directive, we will be required to make certain disclosures in 2026 relating to our ESG impacts, risks, and opportunities for 2025.

If we elect not to or are unable to satisfy such new criteria, investors may conclude that our policies and/or actions with respect to corporate social responsibility are inadequate and we may be subject to fines from regulatory authorities.

We may face reputational damage in the event that we do not meet the ESG standards set by various constituencies.

Furthermore, in the event that we communicate certain initiatives and goals regarding ESG matters, such as our commitment to target Net-Zero on Scope 1 and Scope 2 emissions resulting from our owned facilities worldwide by 2030 or our commitment to the Paris Agreement via the Science Based Targets Initiative, we could fail, or be perceived to fail, in our achievement of such initiatives or goals, or we could be criticized for the scope, target and timelines of such initiatives or goals.

Furthermore, in the event that we communicate certain initiatives and goals regarding ESG matters, we could fail, or be perceived to fail, in our achievement of such initiatives or goals, or we could be criticized for the scope, target and timelines of such initiatives or goals.

If we fail to satisfy the expectations of investors, customers, employees, and other stakeholders or our initiatives are not executed as planned, our reputation and business, operating results and financial condition could be adversely impacted.

In addition, the SEC has also proposed a draft rule that requires climate disclosures in financial filings.

To the extent the SEC proposal becomes effective for our company, we will be required to establish additional internal controls, engage additional consultants and incur additional costs related to evaluating, managing and reporting on our environmental impact and climate-related risks and opportunities.

In addition, the SEC adopted a rule that requires climate disclosures in periodic and other filings with the SEC covering fiscal years beginning in 2025, which rule has been stayed pending the completion of a judicial review.

To comply with this SEC rule, if such rule goes into effect in its current form, we will be required to establish additional internal controls, engage additional consultants and incur additional costs related to evaluating, managing and reporting on our environmental impact and climate-related risks and opportunities.

If we fail to implement sufficient oversight or accurately capture and disclose on environmental matters, our reputation, business, operating results and financial condition may be materially adversely affected.

10 unchanged sentences

dollar compared to foreign currencies would negatively affect our expenses and operating results, which are expressed in U.S.

Additionally, fluctuations in the exchange rate of the Canadian dollar may negatively impact our development plans in Burnaby, Canada.

While we are not currently engaged in material hedging activities, we have been hedging currency exposures relating to certain balance sheet accounts through the use of forward exchange contracts.

72 unchanged sentences

Share repurchases under the Repurchase Program could increase the volatility of the trading price of our common stock, could diminish our cash reserves, could occur at non-optimal prices and may not result in the most effective use of our capital.

In February 2023, our board of directors approved an extension of the Repurchase Program to February 29, 2024.

In April 2023 and July 2023, our board of directors approved $1.0 billion and $500.0 million increases in the authorized stock repurchase amount under the Repurchase Program, respectively.

As of December 31, 2023, $529.1 million remained available for future share repurchases under the Repurchase Program.

In January 2024, our board of directors approved a $500.0 million increase in the authorized stock repurchase amount under the Repurchase Program, bringing the aggregate amount authorized to be repurchased to $7.25 billion of our outstanding common stock.

In January 2024 and October 2024, our board of directors approved $500.0 million and $1.0 billion increases in the authorized stock repurchase amount under the Repurchase Program, respectively, and extended the term of the Repurchase Program to February 28, 2026, bringing the aggregate amount authorized to be repurchased to $8.25 billion of our outstanding common stock.

As of February 21, 2025, approximately $2.03 billion remained available for future share repurchases.

In February 2024, our board of directors approved an extension of the Repurchase Program to February 28, 2025.

Share repurchases under the Repurchase Program could affect the price of our common stock, increase stock price volatility and diminish our cash reserves.

14 unchanged sentences

In addition, our amended and restated bylaws provide that unless we consent in writing to the selection of an alternative forum, to the fullest extent permitted by law, the federal district courts of the United States shall be the exclusive forum for the resolution of any complaint asserting a cause of action arising under the Securities Act.

Any person or entity purchasing or otherwise acquiring any interest in any of our securities shall be deemed to have notice of and consented to this provision.

Any person or entity

purchasing or otherwise acquiring any interest in any of our securities shall be deemed to have notice of and consented to this provision.

This provision, as well as provisions providing that certain litigation matters may only be brought against us in state or federal courts in the State of Delaware, may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or any of our directors, officers or other employees, which may discourage lawsuits against us and our directors, officers and other employees.

7 unchanged sentences

General Risks

Global economic uncertainty, an economic downturn, the possibility of a recession, inflation, rising interest rates, weakening product demand caused by political instability, changes in trade agreements and conflicts such as the war in Ukraine and the Israel-Hamas war, could adversely affect our business and financial performance.

Economic uncertainty in various global markets caused by political instability and conflict, such as the war in Ukraine and the Israel-Hamas war, and economic challenges caused by the economic downturn, any resulting recession, inflation or rise in interest rates has resulted, and may continue to result, in weakened demand for our products and services and difficulty in forecasting our financial results and managing inventory levels.

Political instability, changes in trade agreements and conflicts such as the war in Ukraine could adversely affect our business and financial performance.

Economic uncertainty in various global markets caused by political instability and conflict, such as the war in Ukraine has resulted, and may continue to result in weakened demand for our products and services and difficulty in forecasting our financial results and managing inventory levels.

Political developments impacting government spending and international trade, including potential government shutdowns and trade disputes and tariffs may negatively impact markets and cause weaker macroeconomic conditions.

2 unchanged sentences

The continuing effect of any or all of these events could adversely impact demand for our products, harm our operations and weaken our financial results.

In addition, the U.S.

Global economic uncertainty, an economic downturn, the possibility of a recession, inflation, changing interest rates, changes to government spending and regulations, and weakening product demand could adversely affect our business and financial performance.

Economic challenges caused by economic downturn, any resulting recession, inflation or change in interest rates can weaken and harm our financial position.

capital markets have experienced and continue to experience extreme volatility and disruption.

1 unchanged sentence

Further deterioration of the macroeconomic environment and regulatory action may adversely affect our business, operating results and financial condition.

Moreover, there has been recent turmoil in the global banking system.

For example, in March 2023, Silicon Valley Bank (“SVB”) was put into receivership by the Federal Deposit Insurance Corporation and subsequently sold.

Other banks at risk of failure have been subsequently sold, including First Republic Bank in May 2023, and there is concern that more banks could be at risk of the same fate.

Although we only had an immaterial amount of our cash directly at SVB, there is no guarantee that the federal government would guarantee all depositors as they did with SVB depositors in the event of further bank closures.

Continued instability in the global banking system may negatively impact us or our customers, including our customers’ ability to pay for our platform, and adversely impact our business and financial condition.

Moreover, events such as the closure of SVB, in addition to global macroeconomic conditions discussed above, may cause further turbulence and uncertainty in the capital markets and economy.

Our business is subject to the risks of earthquakes, drought, fire, power outages, typhoon, floods, virus outbreaks and other broad health-related challenges, cyber events and other catastrophic events, and to interruption by manmade problems such as civil unrest, war, labor disruption, critical infrastructure attack and terrorism.

1 unchanged sentence

Our corporate headquarters are located in the San Francisco Bay Area, a region known for seismic activity, and our research and development and data center in Burnaby, Canada, from which we deliver to customers our FortiGuard and other security subscription updates, is subject to the risk of flooding and is also in a region known for seismic activity.

Any earthquake in the Bay Area or Burnaby, or flooding in Burnaby, could materially negatively impact our ability to provide products and services, such as FortiCare support and FortiGuard subscription services and could otherwise materially negatively impact our business.

Any earthquake in the Bay Area or Burnaby, or flooding in Burnaby, could materially negatively impact our ability to provide products and services,

such as FortiCare support and FortiGuard subscription services and could otherwise materially negatively impact our business.

In addition, natural disasters could affect our manufacturing vendors, suppliers or logistics providers’ ability to perform services, such as obtaining product components and manufacturing products, or performing or assisting with shipments, on a timely basis, as well as our customers’ ability to order from us and our employees’ ability to perform their duties.

2 unchanged sentences

In the event our or our service providers’ information technology systems or manufacturing or logistics abilities are hindered by any of the events discussed above, shipments could be delayed, resulting in our missing financial targets, such as revenue and shipment targets, for a particular quarter.

In addition, regional instability, international disputes, wars, such as the war in Ukraine and the Israel-Hamas war and any expansion thereof, and other acts of aggression, civil and political unrest, labor disruptions, rebellions, acts of terrorism and other geo-political unrest could cause disruptions in our business or the business of our manufacturers, suppliers, logistics providers, partners or end-customers, or of the economy as a whole.

In addition, regional instability, international disputes, wars, such as the war in Ukraine and any expansion thereof, and other acts of aggression, civil and political unrest, labor disruptions, rebellions, acts of terrorism and other geo-political unrest could cause disruptions in our business or the business of our manufacturers, suppliers, logistics providers, partners or end-customers, or of the economy as a whole.

Given our typical concentration of sales at the end of each quarter, any disruption in the business of our manufacturers, logistics providers, partners or end-customers that impacts sales at the end of our quarter could have a significant adverse impact on our quarterly results.

7 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors