Fortinet FortiGate 401F OT Security Service, 3-Year (FC-10-0401F-159-02-36)

Most industrial facilities running Fortinet firewalls start with a standard FortiGuard bundle covering web filtering, IPS, and antimalware. That coverage protects the IT side. When OT devices enter the picture — PLCs, RTUs, SCADA hosts, historians, engineering workstations — the attack surface changes. Industrial protocols, vendor-specific firmware, and devices that cannot be patched on a regular schedule all require a different detection and mitigation model. The FortiGuard OT Security Service (FC-10-0401F-159-02-36) is the add-on that extends the FortiGate 401F into that environment.

What this service activates on the FortiGate 401F

The three-year subscription enables three distinct FortiGuard capabilities that run inline on the FG-401F:

• OT Device Detection: continuously updated OT device signature packages let the FortiGate identify and classify industrial endpoints by type, manufacturer, and firmware version on any monitored segment, populating the Security Fabric asset inventory with OT-specific metadata.
• OT Vulnerability Correlation and Virtual Patching: the service cross-references detected OT assets against the FortiGuard Labs OT CVE database and pushes targeted IPS virtual patches to the FortiGate, blocking exploitation of known vulnerabilities at the network layer without requiring the OT endpoint to be updated or taken offline.
• OT Application Control and IPS: extended IPS signatures and Application Control rule sets for industrial protocols, including Modbus, DNP3, EtherNet/IP, PROFINET, IEC 61850, and others, detect unauthorized commands and anomalous traffic patterns at the protocol level and enforce policy inline.

The FortiGate 401F is well-matched to this workload. Its Fortinet NP7 and CP9 ASICs handle 12 Gbps IPS throughput and 9 Gbps Threat Protection, so OT traffic inspection runs without latency penalty on time-sensitive industrial communications. The FG-401F also includes 2x 480 GB onboard SSD storage, which supports local log retention, a requirement in OT environments that restrict log data from leaving the plant network.

Who needs this subscription

The OT Security Service suits organizations where the FortiGate 401F acts as a segmentation boundary between plant-floor or field networks and the corporate LAN:

• Manufacturing facilities, utilities, oil and gas operations, and water treatment plants deploying the FG-401F as the IT/OT perimeter firewall.
• Organizations subject to IEC 62443, NERC CIP, or NIST SP 800-82 that need active OT asset visibility, CVE correlation, and documented virtual patching controls.
• Teams managing OT devices on long patch cycles — two, five, or even ten years between firmware updates — where virtual patching at the network layer is the only practical CVE mitigation between scheduled maintenance windows.
• Security operations teams that want the FortiGate to enumerate and classify every OT device on the segment rather than discovering them only when they cause an incident.

Activation and delivery

This is a software-only subscription. No hardware ships. After purchase, DataCenter360.ca delivers a Fortinet contract registration code electronically, typically within one business day. You register the code in the FortiCare portal under your FG-401F serial number, and signature updates begin flowing from FortiGuard Labs automatically through the appliance’s existing FortiGuard update path.

The OT Security Service can be activated on a new appliance on day one, or added mid-lifecycle using a co-term order aligned to your existing FortiCare or bundle expiry. Contact DataCenter360.ca for a co-term quotation, which adjusts the price to cover only the remaining contract period.

OT Security versus the Enterprise bundle

The FortiGuard OT Security Service (code 159) is an à-la-carte subscription not included in the ATP, UTP, or Enterprise Protection bundles. The Enterprise bundle covers the full IT threat surface, but OT device detection, OT vulnerability correlation, and OT protocol signatures are outside its scope. Organizations already running the Enterprise bundle on the FG-401F and then adding OT connectivity can add this SKU independently on top of the existing contract. The two subscriptions do not overlap: the bundle handles the IT perimeter, and OT Security handles the industrial layer.

Buying from DataCenter360.ca

DataCenter360.ca is an authorized Fortinet Select Partner. The OT Security Service for the FortiGate 401F ships electronically at a competitive price, with orders typically processed within one business day. The 3-year term (FC-10-0401F-159-02-36) is listed here; 1-year and 5-year options are also available in the catalog. If you need a co-term quote, volume pricing, or a FortiCare-generated registration for an existing device, use the quote form and reference your FG-401F serial number.