Part IThe Story
The Founder Who Was Not on the Call
At 6:00 a.m. Pacific time on Monday, February 9, 2004, two companies headquartered in Sunnyvale, California, opened a conference line to tell Wall Street that one of them was buying the other. Juniper Networks would acquire NetScreen Technologies in a stock-for-stock merger. Each NetScreen share would become 1.404 shares of Juniper. At Juniper's closing price the previous Friday, $29.47, the deal came to roughly $4 billion. Scott Kriens, Juniper's chairman and chief executive, called it a "game-changing day." Robert Thomas, NetScreen's president and CEO, a former Sun Microsystems general manager who had run intercontinental operations for Sun's software business before arriving at NetScreen in 1998, said his executives were "almost delirious." NetScreen's 900 employees would join Juniper's 1,600 in a new security products group. The joint press release supplied two dial-in numbers, two web addresses for the replay, and a reservation code, 21185509, for anyone who missed the call.
It did not mention Ken Xie.
Eight years earlier, in a garage in Palo Alto, working nights and weekends away from a day job at a company called Healtheon, Xie had built the device at the center of that transaction: a firewall and virtual private network appliance that did its work not in software running on a general-purpose computer but in a custom chip, an application-specific integrated circuit, etched to do one thing quickly. He had turned the device into NetScreen. He had been its chief executive until Thomas arrived and its chief technology officer afterward, and in 2000 he had walked away. On the morning his first great idea sold for $4 billion, Xie was a few miles down the same suburban grid, running a three-year-old company that sold, in effect, the next version of the box. Fortinet had raised $13 million in private money by early 2003. It had started distributing through Canadian partners two months earlier, in December 2003. That same February it began selling in the United Kingdom.
I have not found any record of what he said that morning, or whether he listened. The silence fits. Across three companies and more than three decades, Xie has given hundreds of interviews and almost none of them contain a sentence that reveals a feeling about anything other than packets, chips, and the market for both. He speaks about cybersecurity in the flat, declarative English of an engineer who learned the language as a working tool. He compares firewalls to airport security. He predicts market sizes. He is occasionally wrong about timing and almost never wrong about direction.
Four years after the Juniper deal, in April 2008, he told a British trade magazine: "In one or two years Fortinet will take over Juniper and be number two behind Cisco." It took longer than that. In February 2019, the Bloomberg Billionaires Index reported that Fortinet's $13 billion valuation now exceeded Juniper's. The company Xie left had been absorbed into a larger one. The company he started next had grown larger than both.
Silicon Valley has a sanctioned arc for founders, and it bends toward the exit: you build, you sell, you become an investor or a philanthropist or a man with opinions on podcasts. Xie sold once, and not quite in person. Then he stayed. Fortinet has had exactly one chief executive since October 2000, and the man in that job has spent a quarter century doing the thing he was doing in the Palo Alto garage: putting security into hardware, and arguing that the box still matters long after much of the industry decided it didn't.
By the Numbers
The Fortinet Fortress
$4BJuniper's all-stock price for NetScreen, the company Xie co-founded and left in 2000
$6.80BFortinet revenue in fiscal 2025
$1.85BFortinet net income in fiscal 2025
52,972,372Fortinet shares held directly by Xie, per an August 2026 Form 4
17.2M+Fortinet units shipped as of June 30, 2026
1,448Global patents held by Fortinet as of June 30, 2026
3Network security companies Xie has founded: SIS, NetScreen, Fortinet
A Tall Boy in a House of Professors
He was born in Beijing in 1963, which means he was a small child when the Cultural Revolution emptied China's universities and a teenager when they reopened. His parents were both professors at Tsinghua University, the country's foremost engineering school. They had a plan for him. He had another.
"My dream was to ... compete for a spot on the Olympic team," Xie told Investor's Business Daily decades later. The sport was volleyball. He grew to six feet five inches, a height that tends to settle such questions early, and for a while it must have seemed that it would. His parents, he said, "hoped that I would follow in their" footsteps, and the sentence, in the version that survives, trails off exactly where the outcome becomes obvious. He followed them. He earned a bachelor's and then a master's degree in electrical engineering at Tsinghua, the institution where they taught.
There is a detail from a 2004 CRN questionnaire, the kind of lightning-round sidebar trade magazines used to run beside executive profiles, that tells you more than the degrees do. First paying job: TV repairman. A young man in Beijing, opening the backs of television sets, tracing the fault along a circuit someone else had designed, and closing the case back up. A box that is supposed to deliver a signal, and the man who makes sure it does. The same sidebar records that he preferred Google to Yahoo, carried a BlackBerry, used Microsoft Outlook more than any other application, and, asked whether he favored carbs or no carbs, answered: "I eat anything." Asked about Bush or Kerry, six months before the 2004 election and six years after he had become an American citizen, he said: "Still undecided."
He went to Stanford for a second master's in electrical engineering. In the Tsinghua directory he had been Xie Qing, 谢青. In Palo Alto he became Ken. The renaming was neither unusual nor dramatic; it was the kind of practical adjustment an engineer makes to reduce friction in a system. He would rename things all his life, his companies most of all, without much ceremony. What persisted beneath the names was the work.
He became a U.S. citizen in 1998. By then he had already started two companies.
Software, Then Silicon
The first one, he would later suggest, happened more or less by accident. In 1993, while still a Stanford graduate student, Xie founded Systems Integration Solutions, which everyone called SIS. Network security at the time meant firewalls written as software that ran on personal computers and servers, and SIS made them. The business was real and viable. It was also small, and it stayed small for a reason Xie has returned to in interviews ever since: he passed on venture capital. Other firewall makers did not. Check Point Software Technologies, the Israeli company that became the defining software-firewall vendor of the 1990s, took the money and grew. By 2019, Check Point's chief executive, Gil Shwed, held a stake worth $2.9 billion.
Xie did not make that mistake twice. He did, however, extract from SIS the insight that would define the next thirty years of his career. Software firewalls running on general-purpose machines were slow, and they would only get slower as networks got faster. The bottleneck was the processor. If you wanted security to keep pace with bandwidth, you had to move the security into the hardware itself.
"The first company we all used the software to do the firewall," he told CRN years later, in his characteristic compressed syntax. "My second company [NetScreen] I felt we needed to do better, so I started using not only the software but also complementing it with dedicated hardware, including the dedicated system and dedicated chip."
That is the whole story of the Palo Alto garage, told by the man who lived it, in two sentences that contain no garage. In 1996, on his own time, away from his day job at Healtheon, Xie built a firewall and VPN appliance around a custom ASIC. It performed stateful packet inspection at speeds no one else had achieved. In 1997, with two co-founders, Yan Ke and Feng Deng, he used it to form NetScreen Technologies.
What followed was a fast, conventional, wildly successful venture-backed sprint. Xie served as chief executive until 1998, when the board brought in Robert Thomas from Sun, and Xie moved to chief technology officer. NetScreen built the NetScreen-1000, the first firewall to run at gigabit speed. Its systems ran on proprietary chips it named GigaScreen and GigaScreen-II and on an operating system called ScreenOS. Feng Deng would later take the title of chief strategy officer. In 2003, NetScreen hired Anson Chen, a twelve-year Cisco veteran, to run research and development. By then Xie was gone.
He left in 2000. The record does not say why, and Xie has never offered a dramatic account. He had been chief executive and was no longer; he had a new idea about where security was going; the company he had founded was being professionally managed toward an IPO. He went to found what one encyclopedia entry describes, with unintended bluntness, as "a competing ASIC-based firewall company."
NetScreen went public without him, on December 11, 2001, in the bleakest December technology markets had seen in a decade. Goldman Sachs led the offering: 10 million shares at $16 each, $160 million gross, $148.8 million to the company after the underwriters' $1.12 per share. The prospectus's inside cover described "a broad family of high performance, centrally managed, ASIC-based network security systems," and depicted a NetScreen-1000 and a NetScreen-500 floating across a cloud labeled half "Service Provider Network" and half "Internet." The idea from the garage had become an illustration.
In 2002 NetScreen bought a small intrusion-prevention startup called OneSecure for $45 million in stock. OneSecure's co-founders were Rakesh Loonkar and an Israeli engineer named Nir Zuk, who had been one of Check Point's first employees. Hold on to that name. In November 2003 NetScreen paid $265 million in stock and cash for Neoteris, a maker of SSL VPNs. Three months after that came the 6:00 a.m. call, and NetScreen's ticker, NSCN, began its short walk toward extinction. The Juniper deal closed on April 16, 2004.
There is a coda, and it is strange. In December 2015, Juniper announced that it had found "unauthorized code" in ScreenOS, the operating system that still ran on the NetScreen line. Someone had inserted a root password backdoor and altered a constant in the Dual_EC_DRBG random number generator in a way that would let whoever held the corresponding key passively decrypt VPN traffic. The code had been present since 2012. The box Xie had invented to guard the door had, a decade after his departure, been quietly fitted with someone else's key.
Two Brothers and a Name That Kept Changing
Michael Xie is the younger brother, and his résumé reads like a parallel route to the same destination. He earned a bachelor's and a master's degree in automobile engineering at Tsinghua, then crossed not to California but to Canada, where he took a master's in electrical and computer engineering at the University of Manitoba. He worked as a senior software engineer at Milkyway Networks, a network security company, then as software director and architect at NetScreen, then as vice president of engineering at ServGate Technologies. Where Ken is the founder who talks about markets, Michael is the founder who talks about code, when he talks at all. The trade press would later give him the awards that go to engineers: a Top Technology Innovator nod from VARBusiness in 2004, a CRN Tech Innovator Award in 2009. In 2006 Ernst & Young named both brothers Northern California Entrepreneurs of the Year, together, as if the judges could not quite separate them.
In October 2000 the brothers incorporated a company called Appligation, Inc. In December it became ApSecure. Later it became Fortinet, compressed from the phrase "Fortified Networks." The naming history is preserved, of all places, in a 2012 Syngress technical manual, UTM Security with Fortinet: Mastering FortiOS, a book otherwise devoted to configuration screens and policy syntax, which is about right. Ken became chief executive and president. Michael became vice president of engineering and chief technology officer and joined the board in February 2001. The division of labor has barely moved since. In November 2013 Michael took the president title from his brother; that is the most significant reorganization of the founding team in twenty-five years.
The idea behind ApSecure was, in retrospect, almost obvious, and Xie arrived at it by noticing what his own invention failed to do. NetScreen's firewalls were superb at deciding which connections to allow. But viruses and worms did not need to break through the firewall. They arrived inside traffic the firewall had already permitted — an email attachment, a web download, a file passed through an approved port.
"We found most of our malware comes from permitted connections," Xie said, "so basically the firewall cannot stop the virus, so we have to look inside the connection for the bad content."
Most of the danger comes through the doors you have opened. Xie meant it as a statement about network traffic. It would turn out to describe a good deal more.
The brothers launched the first FortiGate products in May 2002. Xie called the device an "anti-virus firewall," a name that has the charm of a product described by its engineer rather than its marketer. FortiGate combined firewall, VPN, antivirus scanning, and eventually intrusion prevention, web filtering, and anti-spam in a single appliance, accelerated, like NetScreen before it, by custom chips. The industry would come to call the category unified threat management, UTM, and later the next-generation firewall. Xie called it, more simply, the second generation of network security.
The company grew the way hardware companies grow when the product is cheaper and faster than the competition's: through resellers. Fortinet established its first channel program in October 2003. Distribution started in Canada that December and in the United Kingdom in February 2004. By 2004 it had offices in Asia, Europe, and North America. In October of that year, CRN profiled Xie, reporting that he had "nearly quadrupled Fortinet's size" and was making plans for an initial public offering early the next year. The plans would wait five years.
— Ken Xie, to CRN, October 2004At the end of the day, customers really only want to have to go one vendor to solve all of their security needs.
The same profile contains the most revealing exchange of his public career. The reporter asked whether the integrated firewall appliance, the thing that had made him rich once and would make him far richer again, counted as a technological innovation.
"I don't know," Xie said. "But it sure makes sense."
What a Fortress Is For
A firewall is a policy engine. It permits and denies according to rules, and the rules belong to whoever owns the box. This is the point that the early Fortinet years made, in three separate disputes over roughly eighteen months, with a clarity the company might have preferred to avoid.
In May 2004, three months after the Juniper call, Trend Micro filed a complaint alleging that the FortiGate line infringed its U.S. patent on server-based antivirus technology. The International Trade Commission initially ruled against Fortinet. The patents at the center of the case were declared invalid in 2010, after a fight long enough that Network World headlined one column "The Patent That Refuses To Die." Fortinet survived it. Patent litigation is the tax every successful hardware company pays.
The second dispute was more embarrassing. FortiOS, the operating system on the FortiGate, contained code licensed under the GNU General Public License, which requires anyone who distributes the code to make their source available. In 2005 the gpl-violations.org project said it had found evidence that Fortinet was using Linux kernel code without honoring those terms and had used cryptographic tools to conceal the fact. In April 2005 a court in Munich issued a preliminary injunction against Fortinet's UK subsidiary. The dispute ended a month later when Fortinet agreed to make the source code available on request. The episode has the quality of a parable. A company whose entire business was hiding things inside encrypted tunnels had been caught hiding something inside its own.
The third dispute was not legal, and it was not settled.
On May 16, 2004, The New Light of Myanmar, the state newspaper of Burma's military government, ran an item under the headline "Prime Minister attends ceremony to introduce Fortinet Antivirus Firewall." Photographs on the government's website showed a Fortinet executive presenting a gift to the prime minister. In October 2005, the OpenNet Initiative, an academic consortium that studied internet censorship, published a country study concluding that the junta, then under U.S. sanctions for human rights abuses, was using Fortinet's FortiGuard web-filtering service to block material critical of the regime. The New York Times covered it under the headline "Study Says Software Makers Supply Tools to Censor Web." Fortinet said its products were sold through third-party resellers and that it respected U.S. embargoes. The company promised to investigate. The photographs of the ceremony remained.
FortiGuard's filtering service was designed to block, in the words of a contemporaneous description, "undesirable web sites such as pornography, gambling, and other illegal or unwanted content." Unwanted is a word that depends entirely on who is doing the wanting. To an American corporate IT department, unwanted content was a gambling site on an employee's lunch break. To a general in Naypyidaw, it was a dissident's blog. The box did not know the difference. It was never designed to.
None of this slowed the company. In 2005 Fortinet created FortiGuard Labs, the internal research group that writes the signatures the boxes use to recognize threats; by 2013 Xie said its researchers were issuing 250,000 new signatures a day. Fortinet's 2005 revenue passed $150 million, and the company was cash-flow positive. By the fourth quarter of 2006 it had more than 900 employees. The fortress was getting bigger, and it was learning that walls have two sides.
Cash-Rich and in No Hurry
In August 2007 Fortinet sent an offer letter to a man named Ken Goldman. The letter, later filed with the Securities and Exchange Commission, offered him the role of vice president and chief financial officer, "reporting to Ken Xie, President and Chief Executive Officer," at an annual base salary of $300,000, a quarterly bonus of up to 30 percent, and an option to buy 600,000 shares, vesting monthly over 48 months. He was to start on or before September 10.
Goldman was the kind of hire a company makes when it intends to go public and wants the market to believe its numbers. He had served on the primary advisory group of the Financial Accounting Standards Board from 1999 to 2003. He would stay at Fortinet until October 2012, leave to become CFO of Yahoo through its long twilight, later run a family office management company called Hillspire, and, in October 2020, return to Fortinet's board. His career rhymes with Xie's in one respect: he came back to the place where the work was.
And yet, with the CFO in place, Xie did not go public. In April 2008 he explained why, in a pre-conference briefing with SC Magazine's UK edition that reads, in hindsight, as a compact statement of his entire philosophy. "The business is cash rich so there is no need for cash," he said. "There are some benefits to being a public company but there are also disadvantages. Many recent IPOs are currently below offer price."
In the same conversation he said that of Fortinet's 1,000 employees, 500 were engineers. "That's the biggest ratio of engineers of any security company." He said that "innovation slows down once companies get too big." He took a shot at Cisco, which, he said, "has bought more than 10 different companies in the last 15 years but has never been able to integrate products." He predicted that unified threat management would take over the traditional firewall market and become "a $2 billion market by 2010." He made his prediction about overtaking Juniper. He said Fortinet was targeting 30 to 50 percent annual growth.
What he was describing was a company that had internalized the lesson of SIS without discarding the lesson of NetScreen. It had taken venture money; one contemporaneous account counted roughly $100 million across five rounds from Acorn Campus, DEFTA Partners, DCM, Fortunetech Partners, Forval Creative, Meritech Capital Partners, and Redpoint Ventures. But it would go to the public markets on its own schedule, with its own profits.
Fortinet turned profitable in the third quarter of 2008, as Lehman Brothers collapsed and the global financial system froze. That year it bought the intellectual property of IPLocks, a database security company. In August 2009 it bought the intellectual property and other assets of Woven Systems, an Ethernet switching company. Not the companies. The ideas inside them.
On August 7, 2009, the board executed a Change of Control Severance Agreement with Ken Xie. Its recitals explained that the board "recognizes that such consideration can be a distraction to Executive and can cause Executive to consider alternative employment opportunities," and that the company wished to assure "the continued dedication and objectivity of Executive." It is standard language, lawyer's boilerplate repeated in a thousand IPO filings. Applied to this particular executive, it is mildly comic. Nothing in the preceding decade suggested Xie was looking for alternative employment.
Fortinet went public on the Nasdaq in November 2009 under the ticker FTNT. By the end of the first day of trading it had raised $156 million. Reuters called it the fourth-best U.S. debut of the year. CRN's annual survey of resellers that year ranked Fortinet first in network security hardware, up from seventh in 2007. IDC estimated that Fortinet held more than 15 percent of the unified threat management market. In 2010 revenue reached $324 million, and IDC ranked Fortinet first in UTM.
In December 2009, a month after the offering, Xie put about half a million dollars of newly public stock into a private foundation. It is the kind of detail that disappears into a footnote for fifteen years and then becomes the most consequential financial decision in a man's life. We will come back to it.
The Rival Who Came Through NetScreen's Door
Nir Zuk, the Israeli engineer who had been one of Check Point's first employees and who sold OneSecure to NetScreen in 2002, did not stay at Juniper long. He co-founded Palo Alto Networks, which launched a next-generation firewall that classified traffic by application rather than port and sold it with an aggressiveness Fortinet had never attempted. The man who came out of the company that took the venture money Xie refused, and who passed through the company Xie founded and left, became the founder of the rival that would define Xie's second decade.
By January 2014 the pressure was showing. At Fortinet's Global Partner Conference, Xie told resellers that Palo Alto Networks and FireEye, whose chief executive Dave DeWalt was spending heavily to market a malware sandbox, had pulled ahead in mindshare. He did not blame the market. He blamed himself.
"We didn't invest in sales and marketing, and that is making us relatively slow versus the aggressive marketing that they have," he said. He pledged to raise marketing spending by 50 percent. Eighty-five percent of sales still came from FortiGate appliances. He set a goal of $1 billion in revenue by 2015. An analyst, Eric Ogren, put the competitive situation less diplomatically: "Fortinet is way behind on sandboxing." Fortinet's response, FortiSandbox, was in what Xie called the "early stages."
Two months later, in March 2014, Fortinet and Palo Alto Networks jointly founded the Cyber Threat Alliance, a nonprofit for sharing threat intelligence across rival vendors. McAfee and Symantec joined later. Xie sits on its board. It is a peculiar arrangement only if you think of competition the way consumer-software companies do. In security, the adversary is not the vendor across the trade-show floor. Two companies that spent their marketing budgets savaging each other's firewall benchmarks could still agree that ransomware gangs were the larger problem. In 2015 the alliance published a white paper on the CryptoWall ransomware, estimating that its operators had collected $325 million from victims.
The market Xie described in those years was always in generations. "Fortinet is my third network security company," he told CRN, laying out the taxonomy. The first generation, connection security, asked who could get in. The second, content and application security, looked inside the permitted connections. The third, which he began promoting around 2016 under the name Security Fabric, tried to protect data wherever it lived: in the cloud, on mobile devices, on the industrial and consumer gadgets the industry called the internet of things. He explained it, as he often does, by analogy to air travel. The first generation is a ticket that lets you board. The second is a ticket plus luggage through the X-ray. The third is a world in which "they have probably already looked at your background before you even bought a ticket and might also look at your social media, family or background connections."
He does not appear to have found the last image unsettling. It is the logic of security taken to its conclusion.
— Ken Xie, keynote at Fortinet Accelerate 19, OrlandoSecurity is no longer a moat protecting a castle and fortress, but more like a system in a human body.
He said that in 2019, to nearly 4,000 attendees in Orlando, a man whose company was named for fortification announcing the death of the fortress metaphor. The castle had become a body. The perimeter had dissolved into the bloodstream. "Nowadays the data no longer sits inside a company," he had told a SiliconANGLE interviewer a year earlier. "They go to the mobile device, they go to the cloud, they go to the 'internet of things.' It's everywhere."
The strategic answer, characteristically, was more hardware. At Accelerate 19 he unveiled what Fortinet called the industry's first SD-WAN ASIC and 300 new features in FortiOS. He announced that Fortinet had taken the second-largest share of the firewall market in the fourth quarter of 2018, behind only Palo Alto Networks. He predicted that "edge computing will start eating the cloud going forward," arguing that 70 to 80 percent of data generated at the edge would never reach a data center, and that while the cloud was good at detecting threats, the edge was better at preventing them. Gartner counted 21,000 Fortinet WAN edge customers in 2019, which one trade publication summarized as Fortinet leapfrogging Cisco.
He kept saying he would not buy his way forward. In September 2018 the Australian Financial Review reported that he had criticized Cisco and Juniper for trying to acquire their way to dominance. The record is more complicated, and more interesting, than the rhetoric. Fortinet bought Coyote Point, a maker of load balancers, in 2013; Meru Networks, a Wi-Fi company, in 2015; AccelOps, a security analytics vendor, for $28 million in 2016; Bradford Networks and ZoneFox in 2018; enSilo and CyberSponse in 2019; OPAQ Networks and Panopta in 2020; ShieldX and Sken.ai in 2021; Lacework, a former cloud-security unicorn, and Next DLP in 2024; an Indian high-density Wi-Fi company called Everest in 2025. What it never did was buy a large competitor and attempt to stitch two operating systems together. The acquisitions were folded, one after another, into FortiOS, the single operating system that runs across the company's appliances, virtual machines, and cloud services. "This convergence is over 20 years in the making," John Maddison, Fortinet's chief marketing officer, said in May 2022, "and made possible by custom ASICs, integrated security services, and FortiOS, a single organically developed operating system."
Organically developed is the phrase that matters. Xie buys parts. He does not buy architectures.
Although I Come From China
In July 2011 Xie gave an interview to the South China Morning Post that contained one of the very few sentences in his public record with any trace of personal friction in it.
— Ken Xie, to the South China Morning Post, July 2011Although I come from China, this market is dominated by local players. Our business in China remains relatively small.
The paper's headline was blunter: "Mainland-born IT whiz finds China favours its locals." Fortinet had more than 100,000 corporate customers worldwide by then. In the country of the founder's birth, it was a foreign vendor like any other, shut out of a market that preferred domestic suppliers for reasons that were partly commercial and largely political.
The geography of his company has been quietly shaped by that politics in both directions. By 2014 Fortinet had four research and development centers in Asia, along with others in the United States, Canada, and France, and opened a lab in Singapore that August. A decade later, the company's corporate page makes a point of saying that "the vast majority of Fortinet's R&D is based in North America." That sentence is doing work. In 2017 Fortinet created Fortinet Federal, a standalone subsidiary to build products for government agencies, and hired Philip Quade, a former senior cyber official at the National Security Agency, as chief information security officer.
In April 2019, Fortinet paid $545,000 to settle a whistleblower lawsuit under the False Claims Act alleging that it had sold intentionally mislabeled Chinese-made equipment to U.S. government end users. The company called it an "isolated incident." In May 2023, Microsoft and the intelligence agencies of the Five Eyes alliance disclosed that a Chinese state-sponsored hacking group had been compromising critical infrastructure across the United States and Guam, and that Fortinet devices were among those it exploited to get in. In March 2022, after Russia invaded Ukraine, Fortinet stopped all sales, support, and professional services in Russia. It was not a hard decision commercially. It was a statement about which side of which wall the company stood on.
Xie belongs to the Committee of 100, the organization of prominent Chinese Americans. His foundation has made grants to Tsinghua. He has also, through the same foundation, given $10,000 in 2019 to Students for Fair Admissions, the group whose lawsuit against Harvard ended race-conscious admissions at most American universities in 2023. He has never, so far as the record shows, explained that grant. It sits in the foundation's tax filings, a small number among large ones, saying whatever it says.
None of this resolves into a political identity, and it probably should not be forced to. The man who designs perimeters has spent his life on both sides of one: born in Beijing, educated twice over at a Chinese university and once at an American one, citizen of the United States since 1998, building equipment that American agencies buy, Chinese state hackers exploit, and Chinese buyers largely pass over. His explanation of security in the age of mobile and cloud computing, that the data no longer sits inside a company, could stand as a description of the people who write it.
The Foundation and the House in Cupertino
The money arrived slowly and then all at once, which is the only way equity in a company that compounds for twenty years ever arrives.
In February 2019, Bloomberg reported that Xie, then 56, was Fortinet's largest individual shareholder, with a 7.4 percent stake worth about $1 billion, and had collected more than $40 million selling shares over the years. Michael held 7.1 percent, almost half of it through family trusts, and had collected more than $70 million. In September 2020 Ken joined the Forbes 400. That December, Fortune named him one of its Businesspeople of the Year, noting that Fortinet's stock had returned 190 percent over the previous three years, that revenue was growing 19 percent a year "with no long-term debt," and that the company counted Alibaba, Autodesk, Siemens, Volkswagen, and 70 percent of the Fortune 100 among its customers. Fortune called him "a classic Silicon Valley success story." The adjective is generous. Few classic Silicon Valley success stories involve staying in the same chair for twenty years.
An August 2026 Form 4 filing listed 52,972,372 Fortinet shares held directly by Xie, at a reported price of $164.49, which the filing service estimated at roughly $8.7 billion. Forbes puts the brothers' combined fortune above $10 billion.
The half-million dollars of stock Xie put into his foundation in December 2009 had become, by the mid-2020s, the $1.1 billion Xie Foundation, co-led by Michael, who became co-president the year after it was formed. It has no website and no social media presence. Its giving is concentrated almost to the point of singularity: between 2022 and 2024 it paid out $98 million, and $85 million of that, about 87 percent, went to Stanford. Smaller grants went to Harvard ($2.5 million in 2024), the private Pinewood School in Los Altos ($2.5 million), UC Berkeley, UC Santa Cruz, and the KISS Institute for Practical Robotics ($225,000 in 2024). Outside education, the largest beneficiary was the Monterey Peninsula Foundation, which runs charity golf events, at $1.9 million in 2022 and $1 million in 2023, followed by the American Junior Golf Association.
In July 2023, ProPublica published an investigation into how the ultrawealthy use private foundations. The Xie Foundation was one of its examples. Since 2009, the outlet reported, Xie had taken more than $30 million in income tax deductions by contributing Fortinet shares to the foundation. In 2017, the foundation spent $3 million on a house in Cupertino, California, in which Xie and his then-girlfriend lived. In January 2020, the house was transferred from the foundation to an LLC.
Xie lives in Los Altos Hills. His daughter, Jaime Xie, became a fashion influencer and a cast member of Bling Empire, the Netflix reality series about wealthy Asian Americans in Los Angeles. Business Insider called her "the tech heiress forging her own path." It is a small, almost too-neat inversion: the father whose public persona consists of earnings calls and firewall throughput figures, the daughter whose life is lived on camera. The fortress-builder's child walked out the front door and into the most transparent medium ever devised.
Xie himself appears in the outside world mainly as a director and an occasional investor. He has sat on the board of TeleNav since July 2012. In February 2022 he participated in a Series B round for Musely, a skincare startup. He was elected to the National Academy of Engineering in 2013, one of the few honors in his biography that seems to have been awarded for the thing he actually cares about.
Seventy-Four Thousand Doors
Every security vendor's installed base is also an attack surface, and the larger the installed base, the more attractive it becomes. Fortinet's corporate materials say FortiGate holds more than half the world's network firewall market by units, and that the company had shipped more than 17.2 million units as of June 30, 2026. Each one is a door. Each door has a lock. Each lock has a key, and somewhere, someone has written that key on a sticky note, or reused it, or never changed it from the default.
In September 2021, nearly 500,000 login names and passwords for Fortinet VPN devices appeared on a hacking forum. They had been scraped from devices still vulnerable to a flaw catalogued in 2018. In September 2024, someone calling themselves "Fortibitch" claimed to have stolen 440 gigabytes of data from a Fortinet SharePoint server; the company confirmed a breach involving "limited data related to a small number of Fortinet customers." In January 2025, configuration files and credentials for more than 15,000 FortiGate devices were leaked, apparently harvested through a 2022 vulnerability. In November 2025, a critical flaw in the FortiWeb web application firewall, rated 9.1 out of 10, let attackers combine a path traversal bug with an authentication bypass and take full control of the device.
In June 2026, a security researcher named Volodymyr "Bob" Diachenko reported that he had gained access to an attacker's infrastructure holding credentials for about 74,000 internet-facing FortiGate firewalls and VPN gateways in 194 countries, tied to 21,632 domains. Researchers called it FortiBleed. A Russian-speaking, financially motivated group had sprayed FortiGate login pages with password combinations, intercepted SSL VPN authentication hashes, cracked them on a cluster of 45 GPUs, and then used the recovered passwords to move into victims' internal networks, including their Active Directory systems. Hudson Rock said the victims included a Turkish defense contractor working with NATO, from which classified documents had been taken. SOCRadar raised the count of affected devices to 86,644 and linked the infrastructure to the Lynx and INC ransomware groups. America's Cybersecurity and Infrastructure Security Agency, Britain's National Cyber Security Centre, and the Australian Cyber Security Centre all issued advisories.
Fortinet's response was technically precise. The activity, the company said, did not involve a new vulnerability. It came from credentials reused after earlier incidents and from brute-force attacks against devices with weak passwords and no multi-factor authentication.
That is true. It is also, almost word for word, the threat Xie described in 2002 when he explained why the firewall was not enough. The attackers did not break through the wall. They came in through permitted connections, carrying valid keys.
The financial markets have a different set of worries. In October 2023, Harvard Business School published a case study titled "Fortinet: Cybersecurity Pioneer Ken Xie Considers the Long Game." It describes Xie facing a stock downgrade despite strong financials, with advisors pushing him to emphasize Fortinet's cloud capabilities to compete with Palo Alto Networks' cloud narrative, and Xie weighing that advice against his long-held conviction that custom hardware gives Fortinet an advantage. In October 2025, Paragon Intel, which sells executive analysis to hedge funds, concluded that while Xie's "proven financial discipline and product innovation are assets, his communication on key cycles and strategic alignment with cloud trends introduce execution risks." It asked whether his "career-defining success with a hardware-centric playbook" limited his ability to lead a pivot to cloud-native architectures, and pointed to "the failed FortiCNP product" as an example of capital misallocation.
These are fair questions, and they are also the questions that have been asked of Xie in some form since 2014, when Palo Alto and FireEye were outspending him on marketing and the analysts were saying he was "way behind." He has answered them, mostly, with revenue. Fortinet reported $6.80 billion in revenue for 2025 and $1.85 billion in net income. Billings for the second quarter of 2026 were $2.37 billion. On November 18, 2024, fifteen years to the week after the IPO, the company rang the Nasdaq opening bell and held an analyst day in New York. "Innovation has been in our DNA since our inception more than 20 years ago," Xie said in the announcement, a sentence that sounds like corporate prose because it is corporate prose, and also because he has been saying some version of it, unchanged, since he told a British magazine in 2008 that companies cannot innovate by acquisition.
In the spring of 2026 he took the stage at Accelerate26 in Las Vegas to explain, again, where cybersecurity was headed. He was 62 or 63. He had now been chief executive of the same company for more than half his life.
Each year, as the law requires, the chief executive of a public company signs a certification attached to the annual report, swearing that he has reviewed it and that, based on his knowledge, it contains no untrue statement of a material fact. Fortinet's first, dated March 5, 2010, is signed above the title "President, Chief Executive Officer and Director." The one attached to the report for fiscal 2025 is dated February 24, 2026. The language is nearly identical. The title has changed to "Chief Executive Officer and Chairman." The signature has not.
/s/ Ken Xie
Part IIThe Playbook
What follows are twelve principles drawn from Ken Xie's three companies and twenty-five years running the last one. They are not an argument that his way is the only way; the record above contains enough controversy, vulnerability, and analyst skepticism to complicate any such claim. They are an attempt to name what has actually worked, repeatedly, for a founder who chose staying over selling and silicon over software, and to note where the same choices created costs.
The principles
- 1.Move the bottleneck into silicon.
- 2.Name the generation before the market does.
- 3.Inspect what you've already permitted.
- 4.Found again with everything the last company taught you.
- 5.Let profits set the IPO date.
- 6.Treat the engineering ratio as strategy.
- 7.Buy parts, never architectures.
- 8.Confess underinvestment out loud, with a number attached.
- 9.Cooperate with your fiercest rival on the commons.
- 10.Manufacture your market's labor supply.
- 11.Explain with analogies a CFO can repeat.
- 12.Your installed base is your attack surface.
Principle 1
Move the bottleneck into silicon
Xie's career turns on a single technical observation made in the early 1990s: software firewalls running on general-purpose processors would fall further behind as networks got faster. Instead of optimizing the software, he changed the substrate. The 1996 garage prototype used a custom ASIC; NetScreen built its business on GigaScreen chips; Fortinet built FortiGate on custom security processors and, in 2019, introduced what it called the industry's first SD-WAN ASIC. In 2026 the company still describes itself as the only security vendor that designs its own security processing units.
The principle is not "always build hardware." It is to find the place where a performance limit is structural rather than incidental, and attack the structure. Competitors who stayed in software could iterate faster, but they inherited the ceiling of whatever chip they ran on. Xie traded agility for a cost and performance advantage that compounds with every generation of chip, and that a software-only rival cannot copy by hiring more programmers.
The cost is real. The 2023 Harvard case and the 2025 Paragon analysis both frame his hardware conviction as a potential liability in a cloud-first market. A structural advantage is also a structural commitment.
Tactic: Identify the one performance constraint in your market that every competitor treats as fixed, and ask what it would cost to own the layer beneath it.
Principle 2
Name the generation before the market does
Xie talks about network security in generations, and the habit is strategic, not decorative. First generation: connection security, the firewall and VPN, which was SIS and NetScreen. Second generation: content and application security, which was the FortiGate "anti-virus firewall" of 2002. Third generation: infrastructure security across cloud, mobile, and IoT, which was the Security Fabric launched in 2016. Each of his companies maps to a generation, and each time he founded or refocused the company before the category had a widely accepted name.
The taxonomy does two things. Internally, it tells engineers what the next product must do that the last one could not. Externally, it lets him place competitors on a ladder where they are always one rung down. When he told CRN that most of the market was still competing at "the first level," he was not describing the market; he was framing it.
G
Xie's Three Generations of Network Security
How Xie has described the evolution of the market, and where each of his companies sat.
| Generation | Core question | Xie's air-travel analogy | His company |
|---|---|---|---|
| First Connection security | Who can get in? | A ticket lets you board. | SIS (software), NetScreen (ASIC) |
| Second Content & application | What are they carrying? | Ticket plus luggage through the X-ray. | Fortinet / FortiGate, 2002 |
| Third Infrastructure | Where is the data, wherever it lives? | Background checked before you buy the ticket. | Fortinet Security Fabric, 2016 |
Tactic: Write down the three generations of your category in plain language, place yourself and each competitor on the ladder, and build only for the rung above where the market currently stands.
Principle 3
Inspect what you've already permitted
The founding insight of Fortinet was a critique of Xie's own previous product. NetScreen's firewalls decided which connections to allow. Malware, he realized, arrived inside the connections that had been allowed. "We found most of our malware comes from permitted connections," he said. The response was to look inside the traffic, not just at its address.
As a management principle, this generalizes uncomfortably well. Most organizational risk enters through approved channels: trusted vendors, standing processes, long-tenured relationships, credentials issued years ago. Xie built a company around the idea that the danger is rarely at the gate; it is in what you waved through.
The irony, documented in Part I, is that Fortinet's own worst incidents, from the 500,000 leaked VPN credentials in 2021 to FortiBleed in 2026, followed exactly this pattern. Attackers did not break the wall. They logged in with valid passwords. The principle cuts in every direction, including inward.
Tactic: Once a quarter, audit not the things you have rejected but the things you have approved, starting with the access and assumptions that are oldest.
Principle 4
Found again with everything the last company taught you
Xie's three companies form a single learning curve. SIS taught him that software firewalls hit a performance ceiling and that refusing venture capital let better-funded rivals like Check Point outgrow him. NetScreen applied both lessons: hardware acceleration and aggressive outside funding toward an IPO. It also, apparently, taught him something about control. He handed the CEO role to Robert Thomas in 1998 and left in 2000. At Fortinet, he has never handed it to anyone.
Serial founders are often described as restless. Xie's pattern suggests something different: each founding was a corrected rerun of the last, keeping what worked and amending one or two things. Fortinet's insight about permitted connections came directly from the limits of NetScreen's own product. He did not start over. He started from where he stopped.
X
Three Companies, One Idea
The corrected reruns of a single thesis about where security belongs.
1993
Founds SIS as a Stanford graduate student; software firewalls; passes on venture capital.
1996
Builds an ASIC-based firewall/VPN appliance in a Palo Alto garage while working at Healtheon.
1997
Forms NetScreen with Yan Ke and Feng Deng.
1998
Robert Thomas becomes NetScreen CEO; Xie moves to CTO.
2000
Leaves NetScreen; founds Appligation with Michael Xie in October, renamed ApSecure, then Fortinet.
2001
NetScreen IPO: 10 million shares at $16, led by Goldman Sachs.
2002
FortiGate "anti-virus firewall" launches in May.
2004
Juniper completes ~$4 billion all-stock acquisition of NetScreen.
2009
Fortinet IPO raises $156 million on day one.
2019
Fortinet's $13 billion valuation exceeds Juniper's.
2025
Fortinet revenue reaches $6.80 billion.
Tactic: Before starting anything new, write down the two specific mistakes of your last venture and design the new one so that those two mistakes are structurally impossible.
Principle 5
Let profits set the IPO date
In 2004, CRN reported that Fortinet was planning an IPO early the next year. It went public in November 2009. In between, Xie told SC Magazine in April 2008 that "the business is cash rich so there is no need for cash," and noted that many recent IPOs were trading below their offer price. Fortinet became profitable in the third quarter of 2008, in the middle of a financial crisis, and listed a year later, after hiring a FASB-pedigreed CFO, Ken Goldman, two years in advance.
The sequencing matters. A company that goes public to raise money negotiates from need. A company that goes public after it is profitable negotiates from strength, and can survive a bad market without the IPO. Xie turned the listing into a choice instead of a rescue. By 2020 Fortune was noting that Fortinet was still growing 19 percent a year with no long-term debt.
Tactic: Treat external capital as optional by building to cash-flow breakeven first, then raise or list only when walking away from the deal would cost you nothing.
Principle 6
Treat the engineering ratio as strategy
"Of his 1,000 employees, 500 were engineers," SC Magazine reported in 2008, and Xie added: "That's the biggest ratio of engineers of any security company." He tied it directly to a belief about scale: "Innovation slows down once companies get too big." Small niche players, he said, must "keep innovating and ensure engineering has the upper hand."
The ratio is a signal of where the founder thinks advantage lives. At Fortinet, it lives in organic development: a single operating system, custom chips, and, by mid-2026, 1,448 global patents. The company's own literature claims 1,067 U.S. patents, which it describes as nearly three times more than comparable network security vendors.
The same choice produced a known weakness. In 2014 Xie admitted that underinvesting in sales and marketing had let Palo Alto Networks and FireEye pull ahead. A company that measures itself by engineers can mistake technical superiority for market position.
Tactic: Pick one headcount ratio that encodes your theory of advantage, publish it internally, and review it every year alongside the function it starves.
Principle 7
Buy parts, never architectures
Xie has criticized rivals for trying to buy success since at least 2008, when he said Cisco "has bought more than 10 different companies in the last 15 years but has never been able to integrate products." Yet Fortinet has made more than a dozen acquisitions. The distinction is in what it bought: the intellectual property of IPLocks rather than the company; the assets of Woven Systems; AccelOps for $28 million; a string of small endpoint, analytics, orchestration, and cloud companies. Each was folded into FortiOS, the single operating system Fortinet's CMO called "organically developed."
The lesson is that the danger of acquisition is not buying things; it is buying a second architecture and committing to integrate it. A small purchase that fills a feature gap on your platform compounds. A large purchase that brings its own platform fractures yours.
A
Rhetoric and Record on Acquisitions
What Xie said about buying versus what Fortinet actually bought.
| What Xie said | What Fortinet did |
|---|---|
| 2008: Companies cannot innovate by acquisition; Cisco never integrated its purchases. | 2008–2009: Bought the IP of IPLocks and assets of Woven Systems, not the companies. |
| 2018: Criticized Cisco and Juniper for buying their way to dominance. | 2016–2021: AccelOps ($28M), Bradford, ZoneFox, enSilo, CyberSponse, OPAQ, Panopta, ShieldX, Sken.ai, all folded into the Security Fabric. |
| 2019: Fortinet doesn't need big acquisitions to make a splash. | 2024–2025: Lacework, Next DLP, Everest. Still no large platform merger. |
Tactic: Before any acquisition, require a written plan showing exactly how the target's product will run on your existing core platform within a year; if the plan needs a second platform, walk away.
Principle 8
Confess underinvestment out loud, with a number attached
At Fortinet's January 2014 partner conference, in front of the resellers who carried most of his revenue, Xie said: "We didn't invest in sales and marketing, and that is making us relatively slow versus the aggressive marketing that they have." He then committed to a 50 percent increase in marketing spending and a revenue target of $1 billion by 2015.
Founders rarely admit strategic error publicly, and when they do, they usually blur it into a story about market conditions. Xie named the mistake, named the rivals who exploited it, and attached a specific remedy. For a channel-driven business, the effect was to give partners something to hold him to. An admission without a number is an apology. An admission with a number is a contract.
Tactic: When you get something wrong, say it to the people who depend on you in one sentence, then give them a specific number they can use to check whether you fixed it.
Principle 9
Cooperate with your fiercest rival on the commons
In January 2014 Xie was telling partners that Palo Alto Networks was outmarketing him. In March 2014 Fortinet and Palo Alto Networks jointly founded the Cyber Threat Alliance to share threat intelligence across vendors. McAfee and Symantec joined later; Xie sits on the board. Fortinet later shared intelligence with Interpol to help catch a Nigerian business-email-fraud ringleader in 2015 and joined a NATO data-sharing agreement with Cisco in 2016.
In markets where everyone faces the same external adversary, the threat data itself is a commons. No single vendor sees enough of it, and every vendor's customers benefit when all of them see more. Competing on products while cooperating on intelligence is not a contradiction. It acknowledges that the real enemy is outside the trade-show hall.
Tactic: Identify the one category of information in your industry that every competitor would benefit from pooling, and propose the pool yourself, so that you write its rules.
Principle 10
Manufacture your market's labor supply
Fortinet launched its Network Security Expert certification in 2014, a Network Security Academy in 2016 to supply equipment and curricula to universities, and FortiVet the same year to recruit military veterans. By 2018 Xie said it had certified more than 150,000 experts. In September 2021 the company pledged to train one million people over five years, working, Xie said, with "over 4,500 universities globally."
The public framing is civic: closing a cybersecurity skills gap estimated in the millions of unfilled jobs. The commercial logic is just as clear. Every engineer who learns network security on a FortiGate becomes a future buyer, administrator, or reseller who already knows the interface. Training at scale is distribution disguised as education, and it widens a moat that competitors cannot buy their way across quickly.
Tactic: Build a free certification path for the people who will operate your product five years from now, and measure it by how many of them later specify you in a purchase.
Principle 11
Explain with analogies a CFO can repeat
Xie's public vocabulary is deliberately plain. Network security generations become airport screening. The end of perimeter defense becomes "no longer a moat protecting a castle and fortress, but more like a system in a human body." The cloud-versus-edge debate becomes a simple split: the cloud detects, the edge prevents. When asked in 2004 whether his integrated appliance was a technical innovation, he said: "I don't know. But it sure makes sense."
In an industry drowning in acronyms, an analogy that a non-technical buyer can repeat in a budget meeting is worth more than a benchmark. The Harvard case on Xie's 2023 messaging dilemma, and Paragon Intel's 2025 critique of his communication on cloud strategy, suggest the limits of this approach when the market wants a new story. Plain analogies explain conviction well. They are less good at signaling change.
Tactic: Translate your core strategic claim into a single physical analogy, test it on someone outside your industry, and use it until a customer repeats it back to you unprompted.
Principle 12
Your installed base is your attack surface
The FortiGate line has shipped more than 17.2 million units, and the company claims more than half of global firewall unit share. That reach is Fortinet's moat. It is also why attackers spend so much effort on Fortinet devices: 500,000 leaked VPN credentials in 2021; Chinese state actors exploiting FortiGuard devices in 2023; 15,000 device configurations leaked in 2025; a 9.1-rated FortiWeb flaw that November; and FortiBleed in 2026, with between 74,000 and 86,644 devices compromised through reused and weak credentials.
Fortinet's response to FortiBleed, that no new vulnerability was involved, was accurate and insufficient. At sufficient scale, customer misconfiguration becomes vendor reputation. A dominant installed base turns every weak default, every unpatched old flaw, and every customer who skipped multi-factor authentication into the company's problem. Paragon Intel's first question about Xie was precisely how he balances innovation speed against the quality control needed to prevent "systemic security vulnerabilities."
Tactic: Once your product reaches market leadership, make the secure configuration the default and the insecure one require deliberate effort, because at scale your customers' worst habits become your headlines.
Free playbook
Get The Business Model Playbook
58 business models, one visual page each: how the money flows, the metrics that matter, and who runs it. Free when you join the Faster Than Normal email.
Free. No spam. Unsubscribe anytime.
Part IIIQuotes and Maxims
In their words
— Ken Xie, to CRN, October 2004, asked whether the integrated firewall appliance was a technological innovationI don't know. But it sure makes sense.
— Ken Xie, to SC Magazine, April 2008Innovation slows down once companies get too big. They become slow to react to changes in the marketplace.
— Ken Xie, at Fortinet's Global Partner Conference, January 2014We didn't invest in sales and marketing, and that is making us relatively slow versus the aggressive marketing that they have.
— Ken Xie, to SiliconANGLE's theCUBE, March 2018Nowadays the data no longer sits inside a company. They go to the mobile device, they go to the cloud, they go to the 'internet of things.' It's everywhere.
— Ken Xie, quoted by Bloomberg, 2019It's a space that keeps changing and growing fast, keeping me learning every day. And that I like.
Maxims
- Attack the substrate. When a performance ceiling is structural, stop optimizing above it and build the layer beneath it.
- The danger is in what you approved. Most threats arrive through permitted connections, in networks and in organizations alike.
- Every company is a corrected rerun. Found the next venture by fixing the two specific mistakes of the last one.
- Profitability is negotiating power. Go public when you no longer need to, and the market cannot dictate your terms.
- Hire for your theory of advantage. The ratio of engineers to everyone else is a strategy, not a statistic, and it starves something else.
- Buy features, not platforms. Acquisitions that fold into one operating system compound; acquisitions that bring their own fracture.
- Confess with a number. An admitted mistake paired with a measurable remedy turns an apology into a commitment.
- Pool what no one can own alone. Compete on products, cooperate on intelligence about the shared adversary.
- Train your future customers. Free certification is distribution that looks like public service.
- Scale makes every default yours. At market leadership, the customer's weakest password becomes the vendor's reputation.
