Fortinet, Inc. (FTNT) Risk Factors

Recent key developments

Concrete developments — dated events, named agreements and instruments, legal proceedings — that Fortinet, Inc. surfaced in its latest filing.

• As of June 30, 2026, $496.9 million of indebtedness outstanding under the Senior Notes, with potential repurchase obligations upon certain change of control and credit rating downgrades.June 30, 2026
• One distributor accounted for 26% of total net accounts receivable as of June 30, 2026.June 30, 2026
• Six distributor customers accounted for 64% of total net accounts receivable as of June 30, 2026.June 30, 2026
• During the six months ended June 30, 2026, the closing price of common stock ranged from $75.23 to $155.42 per share.six months ended June 30, 2026
• In January 2026, the board approved a $1.0 billion increase in the authorized stock repurchase amount, bringing the aggregate to $10.25 billion through February 28, 2027; $765.8 million remained available as of June 30, 2026.January 2026
• Approximately 82% of hardware was manufactured in Taiwan during the three months ended June 30, 2026.three months ended June 30, 2026
• Global press reports indicate the Chinese government may have instructed domestic companies not to use cybersecurity products from U.S. or Israel-based companies, including us and certain competitors.
• The FortiGuard Labs website publicly posts known product vulnerabilities, including recently announced FortiManager vulnerability.
• We have several ongoing patent lawsuits, and certain companies have sent demand letters proposing patent licensing or demanding indemnification.
• The SEC recently adopted cybersecurity risk management and disclosure rules requiring disclosure of cybersecurity incidents and risk management.
• The EU Data Act went into effect in 2024 imposing data and cloud service interoperability and switching obligations.2024
• The EU's Network and Information Security Directive II was adopted in 2023 with implementing legislation in member states by October 2024.2023
• DORA became effective in January 2025, imposing requirements on financial sector entities and their third-party cloud service providers.January 2025
• The California Consumer Privacy Act became effective on January 1, 2020 and was expanded by the California Privacy Rights Act in 2023.2023
• In July 2020, the European Court of Justice invalidated the EU-U.S. Privacy Shield Framework for GDPR data transfers; we participate in the EU-U.S. Data Privacy Framework but it may be similarly challenged.July 2020
• Ongoing tax audits in the United Kingdom, Canada, Germany, and several other foreign jurisdictions focusing on profit allocation among legal entities.
• Known competitors include Check Point Software Technologies Ltd., Cisco Systems, Inc., CrowdStrike Holdings, Inc., F5 Networks, Inc., Hewlett-Packard Enterprise, Huawei Technologies Co., Ltd., Microsoft Corporation, Netskope Inc., Palo Alto Networks, Inc., SonicWALL, Inc., Sophos Group Plc, and Zscaler, Inc.
• Cloud-based security providers such as CrowdStrike and Zscaler are focusing on delivering security services from the cloud.
• Cisco offers network security features that compete with our products.
• Proprietary ASICs are built by contract manufacturers including Renesas and Toshiba America using foundries operated by TSMC or Renesas on a purchase-order basis.
• Our products incorporate encryption technology subject to U.S. export controls, with sanctions and trade restrictions against Russia and Belarus.
• We are subject to the EU RoHS Directive, EU Packaging and Packaging Waste Regulation 2025/40, EU REACH Regulation (EC 1907/2006), and EU WEEE Directive; similar laws exist or are pending in China, South Korea, Taiwan, Japan, Norway, Saudi Arabia, and the UAE.
• New EU energy efficiency laws for data centers will require sourcing specific data centers or retrofitting existing ones to meet power usage effectiveness and water usage regulations.