Why Fortinet Stock Plunged More Than 20% Today

Fortinet shares fell 22% to their lowest level in nearly five months despite the company raising its full-year forecast for the third time this year. Q3 revenue rose 20% year over year and billings increased 29% to $2.3 billion, but services revenue grew 13% and management trimmed its full-year services forecast by less than 1% at the midpoint. Fortinet also raised its full-year earnings forecast and expanded its buyback program by $1.2 billion; concern about slowing service growth weighed on other cybersecurity stocks.

Analysis

The key issue is earnings quality, not the full-year revenue headline: product-led upgrades can support current sales while recurring-service growth—and therefore the durability of the installed-base monetization story—lags. Billings are a useful leading indicator, but they do not establish that new hardware cohorts are attaching to services or that renewals remain strong. If upgrades are pulling demand forward, today’s product strength could leave a tougher comparison base without an equivalent recurring-revenue payoff.

Near term, the sharp reset after a large rally may already price in some execution disappointment; the larger risk is another quarter of service deceleration, which would challenge the multiple investors assign to recurring revenue. Over 1–3 months, track service growth, renewal/attach indicators, and whether billings convert into recognized revenue. Over 6–18 months, bundled security platforms from Palo Alto Networks, Cisco, and other competitors could make standalone firewall upgrades less valuable if customers consolidate vendors; that is a risk to test, not a conclusion from this quarter.

Contrarian case: a hardware refresh can precede service revenue, so one soft service-growth print need not signal lost customers. The buyback may support demand at the margin, but does not repair recurring growth. Avoid treating the buyback or raised top-line outlook as proof of service momentum.

Key Decisions for Investors

• Do not chase the immediate selloff. Keep FTNT underweight versus a diversified cybersecurity exposure until the next report clarifies whether service growth is stabilizing; use the interval to monitor service revenue and renewal/attach disclosures.
• For a relative-value expression, consider a modest short FTNT against a diversified basket including Palo Alto Networks and Cisco, rather than a broad short of cybersecurity. Reduce or close it if FTNT services reaccelerate and billings convert without evidence of weaker renewals; the basket hedge limits sector-beta risk.
• Treat another sequential slowdown in services, or weaker evidence of billings converting to recurring revenue, as confirmation to maintain the underweight. Reacceleration in services alongside healthy conversion would falsify the bearish thesis and argue for covering the relative short.