Keith Jensen
Chief Financial Officer at Fortinet
Thank you, Ken, and good afternoon, everyone. Let's start with the key highlights from the first quarter. As Ken mentioned, we continue to manage the business through the macro uncertainty and successfully drove operating margin to a first quarter record of 28.5%, exceeding the high end of the guidance range by 200 basis points. Free cash flow of $609 million represents a 45% free cash flow margin benefiting from strong Q4 2023 billings and their subsequent collection in Q1 of 2024. Billings of $1.41 billion and revenue of $1.35 billion were within their respective guidance ranges. Looking at billings in more detail, while unified SASE and SecOps delivered strong billings growth, total billings declined 6% as expected. The billings performance was driven by the difficult year-earlier comparison, created by the backlog contribution to billings that occurred in last year's first quarter. Total bookings were down just slightly.
Unified SASE and SecOps had outstanding growth across a variety of benchmarks in the first quarter. In addition, we saw significant progress from our investments in unified SASE and SecOps. These include cross-selling into our large installed base. Existing customers delivered over 90% of SecOps in unified SASE billings. On an even more targeted basis, existing SD-WAN customers delivered 81% of unified SASE billings. Larger enterprises are proving to be our largest customer segment with large and mid-enterprises representing 78% and 84% of SecOps and unified SASE billings, respectively.
Even with increasing scale, both pillars have strong pipeline growth, 30% for SecOps and over 45% for unified SASE. More importantly, within SAS, the SSE pipeline growth is over 150%. Our investment in SASE is being recognized by third-party agencies. We recently recorded the Trifecta where Gartner SASE Magic Quadrants, SSE, SDWAN and single vendor SASE. As Ken noted with last months addition to SSE, Fortinet now appears in five network security Gartner Magic Quadrants, again, all running on a single operating system. With the SASE Magic Quadrant Trifecta, customers have shown increased interest in learning more about our unique SASE platform that runs on the one operating system with one unified agent, one management system, and one data lake.
To offer an example of customer interest at our Accelerate conference early last month, the SASE demo booth was our most active as customers surveyed SASE's new features and functions including end-to-end digital experience monitoring, remote browser isolation, advanced data loss prevention and third-party SD-WAN connectivity. As a second example, nearly 25% of the Accelerate attendees who joined our CMO for the SASE breakout session, the attendee number for this breakout session would have been even higher if it wasn't for the fire marshals regulations that forced us to turn away customers and partners who are eager to hear more about the SASE offering.
And to offer one final example, the customer partner of SASE Fast Track training program at Fortinet, which launched in January is already umber two most attended technical training session, trending only a single vendor SASE partner, SD-WAN. We're committed to driving more effective security solutions worldwide and welcome greater partnership with our industry peers. The new third-party SD-WAN connectivity technology is designed to support consolidation not only on Fortinet, but with Fortinet. In terms of scale, we continue to open new Google and Fortinet PoPs in sync with our customers' expanding footprint and driving the deployment scale demanded by large enterprises. And a quick update on that seven-figure 300,000 seat education deal that we mentioned last quarter, the full production environment was activated in March, and we are on track to have their 300,000-plus seats on board to start the new school year.
To expand on Ken's earlier comment on today's AI-related announcement, Fortinet Gen AI assistant follows our FortiAI launch last year, by supporting and guiding SOC and NOC teams as they configure and manage changes to their network and investigate and remediate threats. Its intuitive interface allows individuals to engage using 30 different natural languages, bridging the industry's skill shortage. I encourage everyone to visit fortinet.com to learn more about the Gen AI system. Rounding out our billings commentary, SMB was a top-performing customer segment. International emerging was our best-performing geography, and our three largest industry verticals continue to be worldwide government, service providers, and financial services. Service provider and worldwide government experienced the highest growth, while retail and financial services were a bit more challenged.
As noted in our prior call, the six eight-figure deals in Q4 2023 pushed our average contract term in DSO to elevated levels. The average contract term in the first quarter was 27 months, down just under one month year-over-year and three and a half months quarter-over-quarter. DSO decreased 12 days year-over-year and 23 days quarter-over-quarter to 66 days. Turning to revenue and margins. Total revenue grew 7% to $1.35 billion, driven by service revenue growth. Service revenue of $944 million grew 24%, accounting for 70% of total revenue and a revenue mix shift to services of 10 points. Service revenue growth was led by over 30% growth from unified SASE and SecOps. Product revenue decreased 18% as expected, to $409 million coming off a challenging 35% year earlier compare impacted by backlog fulfillment in the prior year.
Software license revenue increased 20% and represented a mid to high teens mix of product revenue. Total net product bookings were down just slightly. Combined revenue from software licenses and software services such as cloud and SaaS security options, increased 29% and represented an annual revenue run rate approaching $750 million. Total gross margin of 78.1% was up 180 basis points and exceeded the high end of our guidance range, benefiting from the mix shift to higher-margin service revenues. Service gross margins of 87.9% were up 200 basis points as service revenue outpaced labor cost increases and benefited from the mix shift towards higher-margin FortiGuard security subscriptions. Product gross margin of 55.7% as we -- pressured as we saw challenges related to inventory levels and the transition to a more normalized demand environment. Operating margin of 28.5% and was 200 basis points above the high end of our guidance range, reflecting the strong gross margins and prudent cost management.
Looking at the statement of cash flows summarized on Slide 16 and 17. Free cash flow was $609 million. Adjusted free cash flow, which excludes real estate investments, was $821 million, representing a 61% adjusted free cash flow margin. Infrastructure investments totaled $222 million, including $212 million of real estate investments. Cash taxes in the quarter were $31 million. And while we did not repurchase shares in Q1, share buybacks have totaled $5.3 billion over the past four-plus years and the remaining buyback authorization is $1 billion. Now I'd like to share a few significant wins in the first quarter. I'll start with the one figure-figure deal in the quarter, a competitive displacement and new logo win. This large U.S. financial institution selected Fortinet as part of their data center update and consolidation projects. Key to this win included our experience in this highly regulated, customer data sensitive industry and our ability to lower the total cost of ownership and exceed their low latency performance requirements.
Similar to other large financial institutions separating from their incumbent, this customer is expanding their Fortinet footprint by adding our SD-WAN solution and planning to consolidate additional technologies. Next, in the competitive seven-figure win, a hospitality company that serves over 5 million guests annually, updated their various Fortinet solutions, including their FortiGate firewall footprint and Fortinet solutions. Keys to expanding our relationship included our price to performance advantage on the firewalls and the next solutions proven ability to discover and lock down devices that attempt to join their network, together with the operational simplicity, and integration of a dozen different Fortinet solutions the customer uses. In another seven-figure deal, a hotel and restaurant chain purchased our SD-WAN solution for 800 locations as well as our data center FortiGates for centralized management and enhanced security. The solution from our network security pillar included firewalls, switches and access points as well as a variety of software products. The SD-WAN solutions bring improved efficiency and security over their branches and IoT devices. Key to this win and in other retail opportunities is enabling retailers to deploy, expand and deliver a growing array of in-store digital solutions to support their customers' experience and increase their top line performance.
As these customer wins illustrate, our Security Fabric platform includes each of our security pillars, unified SASE, AI-driven SecOps and secured networking, making it the most integrated most open portfolio of products in the industry backed by one operating system, FortiOS; one unified agent, FortiClient, one management console or a FortiManager; one data lake FortiAnalyzer and open APIs and integration with over 500 competitor and other third-party products. This integration allows customers to consolidate security solutions, thereby reducing operational costs, while increasing security effectiveness.
Moving to guidance. As a reminder, our first quarter and full year outlook, which are summarized on Slides 21 and 22, and are subject to disclaimers regarding forward-looking information that Peter provided at the beginning of the call. For the second quarter, we expect billings in the range of $1.490 billion to $1.550 billion, which at the midpoint represents a decline of 1%. Revenue in the range of $1.375 billion to $1.435 billion, which at the midpoint represents growth of 9%. Non-GAAP gross margin of 76.5% to 77.5%, non-GAAP operating margin of 25.75% to 26.75%. Non-GAAP earnings per share of $0.39 to $0.41, which assumes a share count of between $775 million and $785 million. Capital expenditures of $30 million to $40 million; a non-GAAP tax rate of 17% and cash taxes of $240 million to $270 million. Before updating the full year guidance, I'd like to elaborate on the backlog headwinds easing in the second half of 2024 and share what we believe we are starting to see as early signs that the firewall digestion cycle is nearing completion. First, the billings headwind from last year's backlog drawdown is over $150 million in 2024. And gradually diminishes throughout the year with no headwind in the fourth quarter.
And second, we're looking for early signs of a more normalized firewall market. One metric we watch is the average days to register security service contracts, as shown on Slide 19. In 2022, we noted that the user registered has increased about 50%, which was consistent with customers buying and stocking behaviors at the time. More recently, this metric decreased by about 25% from SP and is now consistent with late 2021 levels. It is on a pace to return to normal levels in the second half of 2024. A reasonable read-through of the data is that customers are completing the inventory digestion process and are on the path to a more normalized firewall buying behavior.
And with that, for the year, we expect billings in the range of $6.400 billion to $6.600 billion. Revenue in the range of $5.745 billion to $5.845 billion, which at the midpoint represents growth of 9%. Service revenue in the range of $3.940 billion to $3.990 billion, which at the midpoint represents growth of 17%. Non-GAAP gross margin of 76.5% to 78%, non-GAAP operating margin of 26.5% to 28%. Non-GAAP earnings per share of $1.73 to $1.79, which assumes a share count of between $780 million and $790 million. Capital expenditures of $350 million to $400 million, a non-GAAP tax rate of 17% and cash taxes of between $500 million and $550 million. I look forward to updating you on our progress in the coming quarters.
And I'll now hand the call back over to Peter to begin the Q&A session. Peter Salkowski Thank you, Keith. As a reminder, during the Q&A session, we ask that you please limit yourself to one question and one follow-up question to allow others to participate. Operator, please open the line for questions.
