Fortinet FortiSASE: unified SASE / SSE for the hybrid workforce

FortiSASE is Fortinet's cloud-delivered Secure Access Service Edge platform, converging Secure Web Gateway, Firewall-as-a-Service, Universal ZTNA, dual-mode CASB, DLP and cloud-delivered SD-WAN into a single-vendor Unified SASE architecture built on FortiOS and FortiGuard AI/ML threat intelligence.

Standard covers core Secure Internet, SaaS and Private Access from Fortinet Cloud PoPs. Advanced adds Secure Browser, Fortinet + Public Cloud PoPs, Digital Experience Monitoring, FortiGuard Forensics and assisted on-boarding. Comprehensive adds Agentless ZTNA and SOC-as-a-Service integration, and is the only tier eligible for the Global Security PoP add-on.

FortiSASE has a 50-user minimum order quantity — the industry's lowest. If you have an F-series or G-series FortiGate (60G and above), the FortiGate SD-WAN Service Bundle lets you start with as few as 5 users.

Tenant-level data transfer is calculated by adding up the entitlement across all purchased contracts — roughly 250GB per user. For example, a 100-user subscription entitles about 25TB of data transfer globally. Add stackable Data Transfer blocks if you need more.

No — all components in an account must use the same tier, except the Region add-on, which can be mixed into a Comprehensive subscription. Use separate accounts if you need different tiers for different parts of your organization.

Dedicated Public IPs give your FortiSASE traffic a fixed egress IP for IP reputation and geo-location services with source IP anchoring. The add-on requires a subscription with a minimum of 500 users. Each Security PoP supports up to 5 dedicated egress IPs, 4 of which can be used for source IP anchoring.

Yes. Branch On-Ramp connects existing FortiGate or third-party IPsec devices to a FortiSASE Security PoP, and SASE points of presence join natively with existing FortiGate NGFW, SD-WAN or Data Center Firewall deployments — no need to re-architect routing. FortiManager 7.4.4+ can also manage FortiSASE as a single device.

FortiSASE is software, so there is nothing to ship — licenses are delivered electronically worldwide as an Authorized Fortinet Select Partner, usually within hours of purchase. FortiSASE is SOC 2 Type II certified and backed by a 99.999% SLA with a latency guarantee for security inspection.

SSE (Security Service Edge) is the security half — Secure Web Gateway, Universal ZTNA, CASB, FWaaS and DLP delivered from the cloud. SASE (Secure Access Service Edge) is SSE plus the networking half: cloud-delivered SD-WAN and optimized connectivity. FortiSASE delivers both in one platform, so you get consistent security and a fast user experience from the same console rather than buying SSE and SD-WAN separately.

Yes — FortiSASE Universal ZTNA replaces broad, implicit VPN access with explicit, per-application access that is verified on every session with continuous device-posture checks, which is both more secure and a better user experience than a traditional VPN. The same FortiClient agent still supports VPN during the transition, so you can migrate from VPN to ZTNA at your own pace without swapping agents.

No. FortiSASE is the cloud-delivered SASE platform (the Security PoPs, policy engine and management console). FortiClient is the lightweight unified agent that connects an endpoint to FortiSASE for ZTNA, traffic redirection and endpoint protection. A FortiSASE user subscription includes the FortiClient SASE agent entitlement, and agentless access is available for BYOD and Chromebooks.