The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Fortinet’s second-quarter 2025 results were not a simple business failure. Revenue reached $1.63 billion, up 14% year over year, while recurring-revenue businesses continued to grow. But shares fell 16.5% in after-hours trading to $80.60 after management said it was already roughly 40% to 50% through the firewall upgrade cycle expected to support 2026 demand. That disclosure made investors question whether the replacement opportunity would be as large or last as long as previously expected.
The central issue is therefore not whether Fortinet is still growing. It is whether a potentially temporary firewall-refresh tailwind has been pulled forward—and whether SASE and security-operations products can replace that hardware-driven growth over time.
As an Amazon Associate I earn from qualifying purchases.
Why Fortinet stock fell after its second-quarter results
The sell-off followed Fortinet’s earnings report and call for the quarter ended June 30, 2025. The company reported $1.63 billion in revenue, representing 14% year-over-year growth. On that headline measure, the quarter was healthy.
The market focused instead on forward expectations. Fortinet’s chief financial officer, Christiane Ohlgart, said the company was approximately 40% to 50% through the firewall upgrade cycle associated with 2026 by the end of the second quarter. CRN reported that Fortinet shares fell 16.5% after hours to $80.60 at the time of its coverage.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
That reaction reflected a gap between reported performance and investor expectations. Fortinet had been viewed as a beneficiary of an unusually important firewall replacement cycle. If much of that demand had already occurred, analysts had to reconsider how much revenue remained for 2025 and 2026.
The stock decline does not, by itself, prove that Fortinet’s operating business was deteriorating. The immediate trigger was weaker-than-expected forward guidance combined with concern that the expected catalyst was becoming less powerful. CRN’s account of the earnings call describes the analyst questions and management’s response.
What a firewall refresh cycle means
Enterprise and branch firewalls are not purchased only when a company adds a new site. Organizations periodically replace them because hardware reaches end-of-support or end-of-life, traffic volumes rise, newer security features become necessary, or network architectures change.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A replacement can also be part of a broader modernization project. A customer might consolidate separate networking and security appliances, add secure SD-WAN, support hybrid work, or move some access controls toward software-defined networking and SASE.
For Fortinet, the investment thesis was that a large installed base of FortiGate appliances would create a substantial replacement opportunity during 2025 and 2026. That opportunity is different from underlying demand. Refresh demand replaces existing equipment; underlying demand comes from new customers, new sites, greater capacity, or broader security spending.
A company can therefore report strong total revenue while investors worry that the replacement component is approaching a peak. If the refresh fades, the remaining business must carry more of the growth burden.
Why “40% to 50% complete” alarmed investors
The statement was not a declaration that all firewall demand had ended, nor did it necessarily mean that 40% to 50% of the related revenue had already been recognized. It was an estimate of how far the relevant upgrade activity had progressed. Nevertheless, investors interpreted it as evidence that the opportunity could be front-loaded.
Several explanations are possible:
- Pull-forward: Customers may have upgraded earlier than expected, leaving less demand for later periods.
- A smaller remaining cohort: The number of eligible devices still awaiting replacement may be lower than analysts modeled.
- Different product mix: Customers may replace equipment with lower-cost or lower-capacity models, or consolidate several appliances into fewer systems.
- Excess capacity: Customers may use spare capacity from earlier purchases instead of buying immediately.
- Delayed replacement: End-of-support does not force an immediate purchase. Some customers may continue operating equipment, accept additional risk, use third-party support, or wait for a broader architecture change.
Ohlgart said some replacement demand could be met with excess capacity from prior years. She also said smaller-firewall replacement schedules are harder for Fortinet to predict because the company has less visibility into lower-end deployments. That makes the estimate inherently less precise, particularly across branches and smaller sites.
Rank #2
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
Why 14% revenue growth was not enough
Fourteen-percent growth would ordinarily be viewed as a solid result for a large cybersecurity company. Markets, however, price stocks on the difference between results and expectations—not on the growth rate in isolation.
Investors had been looking for evidence that the refresh cohort would produce stronger firewall revenue and potentially allow Fortinet to raise expectations. Instead, the company’s outlook suggested that the cycle might not provide as much incremental upside as anticipated.
Analysts also challenged the quality of the growth. Goldman Sachs analyst Gabriela Borges questioned why Fortinet was not seeing more upside from the expected replacement cohort. KeyBanc’s Eric Heath questioned whether underlying product revenue appeared flat to negative in recent quarters when refresh activity was excluded. CEO Ken Xie rejected the characterization that product revenue had been negative.
The available reporting does not establish that Fortinet’s firewall business was in outright decline. The more defensible conclusion is that analysts questioned whether non-refresh product demand was weakening, while management disputed the strongest version of that interpretation.
Is the firewall business declining?
There are three different questions that should not be confused:
- Is Fortinet still selling firewall products? Yes. The quarter included substantial revenue and the company continues to position its firewall installed base as strategically important.
- Is firewall demand growing as quickly as investors expected? That is what the earnings-call debate called into question.
- Is the long-term appliance model structurally broken? The evidence provided does not prove that. Customers still need network security, but they may buy it through larger appliances, cloud-delivered services, integrated platforms, or a mixture of all three.
Replacement is also not necessarily one-for-one. Several branch appliances could be consolidated into a larger system, some functions could move to cloud-delivered security, or a customer could attach more subscriptions and services to a new deployment. Those choices affect Fortinet’s product revenue, recurring revenue, margins, and sales timing differently.
Can SASE and security operations offset slower hardware growth?
Fortinet highlighted faster-growing businesses as part of its answer. SASE annual recurring revenue increased 22% year over year, while security-operations ARR increased 35%. Those rates exceeded total company revenue growth and support management’s argument that Fortinet is becoming more than a firewall vendor.
Free tools Windows power users keep installed
One-click scans. No signup required.
But a growth rate is not the same as a replacement for revenue. To determine whether these businesses can offset a maturing hardware cycle, investors need to know their absolute scale, profitability, sales-cycle length, customer mix, and degree of attachment to existing Fortinet deployments.
Rank #3
- APPLIANCE ONLY: Hardware unit sold without a service subscription — security services, firmware updates and support are NOT included and must be purchased separately to activate protection.
- PERFORMANCE: Up to 3.5 Gbps firewall inspection, 1.5 Gbps threat prevention and 1.6 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- THREAT PROTECTION: SonicOS 8 delivers intrusion prevention, gateway anti-malware, application control, TLS/SSL decryption, Capture ATP multi-engine sandboxing (RTDMI) and reputation-based content & DNS filtering with an active service subscription.
- BUILT FOR GROWING SMALL BUSINESS: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
A SASE sale to an existing Fortinet customer may be an efficient cross-sell. A sale to a new customer competing against cloud-native providers may require more marketing, channel investment, and implementation support. Hardware, subscriptions, and services also have different revenue-recognition patterns. ARR can grow before the associated revenue is fully recognized, while a hardware purchase may be recorded more quickly.
Fortinet’s opportunity is to turn its branch-firewall and SD-WAN footprint into broader cloud-security adoption. Its Unified SASE offering is aimed at that transition. The risk is that SASE grows quickly but remains too small—or less profitable—to compensate immediately for a slowdown in appliance sales.
Management’s response: focus on infrastructure, not just refresh
CEO Ken Xie argued that investors had placed too much emphasis on the refresh cycle. His broader message was that customers are upgrading to new security infrastructure, including Fortinet’s “new SASE firewall,” which he described as different from a traditional next-generation firewall and capable of producing both product and service revenue.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsStrategically, that is a reasonable reframing. A customer modernization project can create opportunities for higher-capacity hardware, subscriptions, SD-WAN, SASE, and security-operations products. It also gives Fortinet a way to participate if the customer wants to keep some appliances while shifting selected functions to the cloud.
It does not fully answer the near-term investment question. Investors still need to estimate how much firewall revenue remains in the current cycle, when it will be recognized, and whether the newer businesses are large enough to support the company’s guidance after the refresh contribution moderates.
Three ways to interpret the refresh disclosure
1. The cycle was pulled forward
Under this interpretation, customers upgraded earlier than expected, perhaps because of end-of-support deadlines, security concerns, or budget availability. Fortinet could still benefit from the cycle, but much of the upside would arrive sooner and leave a softer comparison period afterward.
2. The cycle is only partly complete
The 40% to 50% estimate may cover a defined subset of the opportunity rather than the entire economic potential. Meaningful demand could remain among larger customers, smaller branches, or deployments that require additional planning. In this case, the market may have reacted too aggressively to an incomplete picture.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →3. Investors overestimated the opportunity
Analysts may have assumed that every eligible appliance would be replaced promptly and at a similar or higher value. In reality, customers can delay, consolidate, reuse excess capacity, choose lower-cost equipment, or move some functions to cloud services. That would make the total opportunity smaller than the original market narrative suggested.
Rank #4
- Extensive Connectivity Options: The FortiGate 60F is designed with 10 GE RJ45 ports, including 2 WAN ports, 1 DMZ port, and 7 internal ports, offering broad flexibility and high-density connections for diverse enterprise networking needs.
- Superior Performance for Secure Networks: Features powerful system-on-a-chip acceleration to deliver top-tier security with 1.4 Gbps IPS throughput and 700 Mbps threat protection throughput, ensuring effective defense against advanced threats.
- Enhanced SSL Inspection and SD-WAN Capabilities: Utilizes purpose-built security processor technology to provide the industry's highest SSL inspection performance and robust SD-WAN functionality for secure, high-speed network operations.
- Simple and Effective Management: Comes equipped with a user-friendly management console that supports comprehensive network automation and visibility, alongside Zero Touch Integration with Fortinet's Security Fabric for streamlined deployment.
- Advanced Security Features: Leverages continuous threat intelligence from AI-powered FortiGuard Labs, identifying and mitigating both known and unknown threats, enhancing security across all network traffic, whether encrypted or not.
Later results would need to distinguish these possibilities. The disclosure alone does not prove which one is correct.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Fortinet’s competitive position
Fortinet competes across overlapping markets rather than one narrowly defined category: network firewalls, secure SD-WAN, SASE, zero-trust access, security operations, and cloud or hybrid-network security.
CRN reported that Gartner placed Fortinet in the Leaders category of its 2025 SASE Magic Quadrant, after Fortinet was in the Challengers category in 2024. The cited strengths included competitive pricing and strong SD-WAN and branch-firewall incumbency. That recognition may help Fortinet’s sales credibility, but it is not a revenue forecast or proof of future market-share gains.
The competitive models differ:
- Palo Alto Networks combines next-generation firewalls with cloud security and SASE through a broad platform strategy. Its advantage is portfolio breadth; the trade-off can be platform complexity and a larger transformation project.
- Zscaler emphasizes a cloud-native, zero-trust access model that can reduce reliance on traditional network perimeters. That may appeal to distributed workforces but is not a direct substitute for every on-premises firewall use case.
- Cato Networks offers a cloud-delivered SASE approach combining networking and security. It can suit organizations seeking managed cloud connectivity, while buyers needing extensive appliance customization may prefer another model.
- Netskope is associated with security-service-edge, SASE, and data-security capabilities, particularly for organizations prioritizing cloud and data controls.
- Cisco can benefit from customers that want networking and security procurement consolidated within an existing Cisco environment.
- Check Point remains an established network-security competitor with a substantial customer base and a conventional firewall-led foundation.
The investment question is not simply which vendor has the best firewall. It is which business model captures customer spending when a modernization project replaces appliance-only security with a combination of hardware, cloud services, access controls, and security operations.
What investors should watch next
The next results should be judged against the refresh-cycle concern, not only against the prior quarter’s revenue. Useful indicators include:
- Product revenue: Is it accelerating, stabilizing, or weakening after separating out refresh-related demand?
- Billings and deferred revenue: These can provide evidence about future subscription and support revenue, although timing differences must be considered.
- SASE ARR and security-operations ARR: Growth matters, but so do absolute scale, customer additions, renewal behavior, and cross-selling.
- Remaining refresh commentary: Management should clarify whether the 40% to 50% estimate refers to a specific device cohort, geography, customer segment, or broader cycle.
- Product mix: Are customers buying larger systems and more subscriptions, lower-cost replacements, or fewer appliances because of cloud substitution?
- Margins: Hardware, subscriptions, and services can carry different gross-margin profiles and selling costs.
- Guidance: Revisions to full-year or next-year expectations would indicate whether management views the issue as timing-related or structural.
- Evidence of cross-selling: The transition thesis becomes more credible if firewall customers are adopting SASE and security-operations products at scale.
What the sell-off means for investors and customers
For investors, the sell-off represented a reset in the expected value and duration of Fortinet’s firewall-refresh catalyst. It was not conclusive evidence that the company’s business was broken. The key test is whether the core firewall franchise can remain resilient while newer recurring-revenue products become large and profitable enough to support growth.
For customers, a refresh is not automatically a reason to buy the same vendor again. Organizations should reassess whether they need higher-capacity appliances, cloud-delivered security, zero-trust access, managed services, or a combination. Fortinet’s FortiGate product family may fit organizations seeking integrated firewall, SD-WAN, branch security, and Fortinet ecosystem controls. A cloud-first buyer may instead evaluate offerings from Palo Alto Networks, Zscaler, Cato, Netskope, Cisco, or Check Point.
Enterprise pricing is generally quote-based and depends on sites, users, throughput, hardware models, subscriptions, support terms, bandwidth, contract length, and professional services. Buyers should request a complete multiyear bill of materials rather than compare only the initial appliance price.
Most importantly, product fit and stock performance are separate questions. A sharp decline in Fortinet shares does not make the platform automatically attractive for every organization, just as strong product growth would not by itself make the stock a good purchase at any valuation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
