FTNT's upside surprise may reflect rising OT cybersecurity demand, but spillover to other vendors still needs validation

Overview

This report centers on the upside surprise in Fortinet's Q1'26 results and asks whether it is a signal that OT cybersecurity demand is improving and may spread to other cybersecurity vendors. Fortinet's revenue was 6.9% above the midpoint of guidance, materially above the normal 2% to 3% beat range. The report argues that, aside from about 1 percentage point driven by pass-through of hardware memory costs, the remaining upside was tied to demand for firewall appliances that support operational technology infrastructure. Drivers cited include Middle East tensions, state-sponsored hacking, European OT regulation, and US government pressure on companies with OT infrastructure to improve their cybersecurity posture.

Core views

The core view is that FTNT's strong performance is a positive signal for OT cybersecurity demand, but the most visible transmission path is first to firewall appliances rather than to the entire cybersecurity software complex. Fortinet and Palo Alto are seen as OT cybersecurity leaders, and Palo Alto may have a tens-of-millions-of-dollars incremental opportunity, but the benefit is less certain because European regulation is landing more directly and Fortinet has a higher Europe revenue mix. SentinelOne and CrowdStrike have relevant exposure through endpoint, IoT/IIoT, and unmanaged-device security; Zscaler entered OT/IoT security through its Airgap acquisition; Cloudflare also emphasizes IT/OT convergence, but its Q1 results did not highlight OT as a clear tailwind. The report concludes by watching whether the next earnings prints from Palo Alto, SentinelOne, CrowdStrike, and Zscaler show additional incremental upside.

Analysis framework

The report uses an event-driven and peer-mapping framework: it first decomposes the source of Fortinet's revenue beat, then maps OT cybersecurity demand by product form factor to firewall, endpoint, IoT/IIoT, SASE/SSE, and edge-security vendors. It then combines regional regulatory intensity, company revenue geography exposure, product fit, and existing acquisition or partnership links to judge likely beneficiaries.

Methodology notes

• Peer comparisonValuation and rating comparison of covered cybersecurity companies

  Compare FTNT, PANW, S, ZS, and NET using ratings, target prices, closing prices, TTM relative performance, adjusted EPS, and P/E.

  The table shows that as of May 13, 2026, FTNT and NET were Market-Perform, while PANW, S, and ZS were Outperform; the report did not change ratings or target prices based on this industry observation.

• Valuation methodDCF and average forward P/Sales comparable multiple method

  Target prices are derived from DCF and the average of forward 5- to 8-quarter P/Sales comparable multiples.

  FTNT target price is $92, PANW target price is $209, S target price is $19, ZS target price is $228, and NET target price is $136; DCF assumptions include 10% to 12% WACC and 3% terminal growth, while P/Sales multiples are selected using a Cloud SaaS or Rule-of-40 framework.

• Theme mappingOT cybersecurity demand transmission analysis

  Starting from OT regulation, geopolitical security events, and government pressure, assess the likelihood that demand spreads from firewall appliances to endpoint, SASE/SSE, and IoT/IIoT security.

  The report believes the evidence for firewall appliances is the most direct, while it remains uncertain whether other product lines will see visible revenue uplift.

Asset mapping & comparison

Structured mapping from thesis to named assets (strengths, weaknesses, peers, risks).

• Fortinet Inc (FTNT.US)

  Core trigger company; Q1'26 upside earnings surprise is used as the main evidence of rising OT security demand.

  Strengths

  OT cybersecurity leader; directly benefits from firewall appliance demand; the model implies incremental demand can last for several quarters and even extend into next year.

  Weaknesses

  Part of the beat came from memory price pass-through; the hardware-plus-software model may face pressure as the market shifts toward pure software; the current target price is below the closing price.

  Comparison

  Together with Palo Alto, it sits in Gartner's top OT Network Security tier, but Fortinet has a higher Europe revenue mix and may therefore be more directly driven by European OT regulation.

  Risks

  High customer penetration, platform competition, uncertainty around the durability of firewall demand, and the possibility that customers prefer best-of-breed solutions.

• Palo Alto Networks Inc (PANW.US)

  Potential firewall appliance beneficiary; the report watches whether its upcoming results show OT demand.

  Strengths

  A leader alongside Fortinet in OT Network Security; firewall appliances may receive additional strength; rated Outperform.

  Weaknesses

  Europe revenue is lower than Fortinet's, so the regulatory benefit may be less pronounced; OT demand may not show up clearly in NGS ARR.

  Comparison

  Its product position is close to Fortinet's, but regional revenue mix and revenue recognition paths may weaken a one-for-one extrapolation.

  Risks

  Hardware firewall churn, billings and cash flow quality, platform competition, rich valuation, and slowing recent billings growth.

• SentinelOne Inc (S.US)

  A potential spillover beneficiary in endpoint and IoT/IIoT security.

  Strengths

  The Singularity platform can protect unmanaged connected devices that cannot run traditional security agents, such as industrial control systems, cameras, and building automation systems; rated Outperform and target price is above the closing price.

  Weaknesses

  The benefit is less direct than for firewall appliances; it still needs to prove that OT/IoT demand can translate into visible revenue.

  Comparison

  Compared with FTNT and PANW, it enters OT security more from the endpoint and unmanaged-device side rather than the traditional network firewall path.

  Risks

  Cloud growth correlation, execution risk from management turnover, enterprise sales execution risk, traction outside the core endpoint product set, and platform competition.

• CrowdStrike Holdings Inc (CRWD.US)

  A potential beneficiary with OT/IoT capabilities and partnership ties.

  Strengths

  The report notes its recently announced OT/IoT capabilities and historical collaboration with partners such as Dragos.

  Weaknesses

  The report does not provide a rating, target price, or table data for this name; the magnitude of the benefit still needs to be validated in later results.

  Comparison

  Similar to SentinelOne in leaning toward endpoint and IoT/IIoT exposure, but the report provides less quantitative disclosure.

  Risks

  The translation path from OT demand is uncertain, so later results and management commentary need to be monitored.

• Zscaler Inc (ZS.US)

  A candidate beneficiary through the SASE/SSE route to OT/IoT security.

  Strengths

  It acquired Airgap Technologies in 2024 to move closer to OT/IoT security; it offers an alternative to physical firewall appliances; rated Outperform with a target price well above the closing price.

  Weaknesses

  The report is unsure whether there will be meaningful upside outside firewall appliances; implementation and coverage effectiveness still need validation.

  Comparison

  Relative to FTNT and PANW's appliance-firewall route, Zscaler is more oriented toward zero trust, SASE/SSE, and software-defined network segmentation.

  Risks

  Cloud growth correlation, competition from single-vendor SASE and cloud-native SSE alternatives, premium pricing, and customers' preference for integrated cybersecurity stacks.

• Cloudflare Inc (NET.US)

  An indirect beneficiary through IT/OT convergence and edge security.

  Strengths

  The report says Cloudflare promotes a similar approach and has partnerships such as Brixio deploying IT/OT converged cybersecurity solutions.

  Weaknesses

  The OT tailwind appears modest and was not a prominent topic in Q1 results; the rating is Market-Perform and the target price is below the closing price.

  Comparison

  Relative to Zscaler and firewall vendors, Cloudflare is more focused on edge networking, CDN, and security platform expansion.

  Risks

  Cloud growth correlation, execution risk in the sales model transition, lower visibility into consumption-based revenue, validation of Act II/III product demand, hyperscaler encroachment into core CDN and security expansion businesses, and high valuation.

Key data

• FTNT Q1'26 revenue beat+6.9% vs. guidance midpointThe report says this was the largest revenue upside surprise since the 2021 COVID demand bubble; the normal beat is usually 2% to 3%.
• Memory price pass-through impactAbout 1 percentage pointThe report believes this explains part of the revenue beat, but several additional percentage points still need to be explained by incremental demand.
• FTNT rating/target price/closeM / $92 / $117.69The table date is May 13, 2026; the implied target price is below the closing price.
• PANW rating/target price/closeO / $209 / $227.79The report suggests that OT firewall appliance demand may create some extra strength, but it may not materially affect NGS ARR.
• S rating/target price/closeO / $19 / $16.08SentinelOne is discussed as a company that can cover unmanaged, connected IoT/IIoT devices through the Singularity platform.
• ZS rating/target price/closeO / $228 / $152.43Zscaler strengthened its OT/IoT security entry point through the 2024 acquisition of Airgap Technologies.
• NET rating/target price/closeM / $136 / $192.62Cloudflare mentions IT/OT convergence partnerships, but the report says OT was not discussed as a major tailwind in Q1.

Impact & implications

For investors, FTNT's beat looks more like a window into structural change in cybersecurity demand than proof of a broad sector-wide upward revision. The most direct beneficiaries remain vendors with OT cybersecurity and firewall appliance advantages; endpoint, SASE/SSE, and edge-security companies need to validate demand transmission through subsequent results, management commentary, and order signals. Because the report did not raise models, ratings, or target prices, the near-term trading takeaway is more of an earnings-watchlist call than a formal re-rating conclusion.

Risks

• OT cybersecurity demand may be concentrated mainly in firewall appliances and may not broadly spread to endpoint, SASE/SSE, or edge-security vendors.
• Part of Fortinet's upside was driven by hardware memory price pass-through and should not be treated as pure demand growth.
• European regulation is more direct while US regulation is lighter, so regional differences may create uneven benefits across vendors.
• Cybersecurity vendors broadly face macro risk, intensifying competition, platform integration pressure, high valuations, and customer budget volatility.
• The report did not change models, ratings, or target prices, which suggests the evidence is still insufficient to support a formal upward revision.

What to watch

• Palo Alto's upcoming quarter, especially firewall appliance revenue and management commentary on OT demand.
• Whether SentinelOne, CrowdStrike, and Zscaler mention incremental demand from OT, IoT, IIoT, or government-led initiatives on their earnings calls.
• The pace of European OT compliance regulation and US enterprise security budget responses after hacker incidents such as the Stryker case.
• Whether FTNT's excess demand can last for several quarters and extend into the following year.
• Whether products outside firewall appliances, such as SASE/SSE, endpoint, and edge security, start to show quantifiable orders, ARR, or revenue contribution.