Platform profile
FortiSASE review: SASE on one operating system
Short answer
Fortinet states FortiSASE uses one operating system, client and data lake, and Unified SASE joins it with Secure SD-WAN under one policy engine and management plane. It describes the most deployment variants in this set, including a sovereign option. It scores 7.10 and ranks 3 of 6; DLP and remote browser isolation are not in the component list we read.
By The Transit Desk · Best SASE Platforms · Published
Desk research from each vendor's own public pages.
Score on our weights
Rank 3 of 6 on our published weights
What does Fortinet offer as a SASE platform?
Source: Fortinet FortiSASE
| What is offered | FortiSASE and Fortinet Unified SASE (FortiSASE with Secure SD-WAN on FortiOS) |
|---|---|
| Architecture, as the vendor describes it | Fortinet states Unified SASE "merges FortiSASE with Fortinet Secure SD-WAN to create a single, integrated platform", "Built on a single OS, policy engine, and management plane". Single-pass wording is not used on these pages. Source: Fortinet Unified SASE |
| Network, as the vendor states it | Fortinet states "a global network of 200+ PoPs. With Fortinet-owned infrastructure and native security at each location, traffic is inspected locally", with AWS, Google Cloud and Oracle Cloud integration extending coverage. A private backbone between PoPs is not described on the page. Source: Fortinet FortiSASE |
| Management and policy | Fortinet states "Unified management, end-to-end DEM, and consistent security policy enforcement" on premises and in the cloud. Source: Fortinet FortiSASE |
| Vulnerability response | Fortinet's trust page states PSIRT disclosure aligned with ISO/IEC 30111:2019 and ISO/IEC 29147. A time-to-protect record for FortiSASE is not published on the pages we read. Source: Fortinet trust |
| Certifications listed | Fortinet's trust page states security aligned with the ISO/IEC 27000 series and NIST 800-53. Specific FortiSASE certifications such as SOC 2 or FedRAMP are not stated in the trust page text we read. Source: Fortinet trust |
| AI security | Fortinet states FortiAI discovers AI applications in use and "blocks unauthorized prompts". FortiAIGate checks "prompts, outputs, and agent tool calls" and catches prompt injection, jailbreaks and data leaks in MCP tool traffic; it is described as self-hosted, with data and logs on the customer's infrastructure. Source: Fortinet FortiAIGate |
| Deployment options | Fortinet describes agent-based and agentless options, microbranches and thin edges, native SD-WAN integrations and a "FortiSASE Sovereign" option deployed "by end users in their own data centers". Source: Fortinet FortiSASE |
| Assistant in the console | FortiAI-Assist, an embedded assistant that uses natural language and voice-to-text, as Fortinet describes it. Source: Fortinet FortiAI-Assist |
| Analyst placement, as the vendor states it | Fortinet's page describes it as a Challenger in the 2026 Gartner Magic Quadrant for SASE Platforms. Source: Fortinet FortiSASE |
| Published pricing | Not published No SASE price list on the pages we read. Pricing is not scored. |
Which SASE components does Fortinet list?
- 1. SD-WAN: Listed
- 2. SWG: Listed
- 3. CASB: Listed
- 4. ZTNA: Listed
- 5. FWaaS: Listed
- 6. DLP: Not listed
- 7. RBI: Not listed
- 8. DEM: Listed
- SD-WAN (Software-defined WAN): Listed. Secure SD-WAN.
Source: Fortinet FortiSASE
- SWG (Secure web gateway): Listed. SWG.
Source: Fortinet FortiSASE
- CASB (Cloud access security broker): Listed. CASB.
Source: Fortinet FortiSASE
- ZTNA (Zero trust network access): Listed. ZTNA.
Source: Fortinet FortiSASE
- FWaaS (Firewall as a service): Listed. FWaaS.
Source: Fortinet FortiSASE
- DLP (Data loss prevention): Not listed
- RBI (Remote browser isolation): Not listed Fortinet lists a secure browser; remote browser isolation is not named on the page.
Source: Fortinet FortiSASE
- DEM (Digital experience monitoring): Listed. End-to-end DEM.
Source: Fortinet FortiSASE
What figures does Fortinet publish about itself?
Fortinet counts PoPs on Fortinet-owned infrastructure and extends coverage through public clouds. This figure is on a different basis from other vendors' figures, so we do not rank it against them.
How does Fortinet score on each criterion?
| Criterion | Weight | Score | Why |
|---|---|---|---|
| Converged architecture | 20% | 8 / 10 | States one operating system, client and data lake, and a single OS, policy engine and management plane across SASE and SD-WAN; single-pass is not stated. Source: Fortinet Unified SASE |
| Global network, as the vendor states it | 15% | 7 / 10 | States 200+ PoPs on Fortinet-owned infrastructure plus public cloud extension; a private backbone between PoPs is not described. Source: Fortinet FortiSASE |
| Component coverage | 10% | 7 / 10 | Lists six of the eight: DLP and remote browser isolation are not named. Source: Fortinet FortiSASE |
| Unified management and policy | 10% | 9 / 10 Tied highest | States unified management and consistent policy on premises and in the cloud, plus the FortiAI-Assist assistant. Source: Fortinet FortiSASE |
| Vulnerability response transparency | 10% | 5 / 10 | Publishes a PSIRT disclosure process aligned with ISO standards, but no time-to-protect record for FortiSASE. Source: Fortinet trust |
| Published compliance certifications | 10% | 4 / 10 | States alignment with the ISO 27000 series and NIST 800-53; specific certifications for FortiSASE are not stated. Source: Fortinet trust |
| AI security inside the platform | 15% | 7 / 10 Tied lowest | FortiAI discovery and prompt blocking, and FortiAIGate inspection of MCP tool traffic, which is described as self-hosted. Source: Fortinet FortiAIGate |
| Deployment options | 10% | 9 / 10 Highest in set | Agent-based and agentless options, thin edges, native SD-WAN integrations and a sovereign option run in the customer's data centers. Source: Fortinet FortiSASE |
Where does Fortinet score well, and where does it score lower?
Scores well
Highest or tied highest in set on: unified management and policy and deployment options.
- Describes agent-based and agentless access, thin edges and a sovereign option run in the customer's own data centers.
- One operating system, policy engine and management plane across FortiSASE and Secure SD-WAN.
- Publishes a PSIRT disclosure process aligned with ISO/IEC 30111 and 29147.
Scores lower
Another platform scores higher on: converged architecture, global network, as the vendor states it, component coverage, vulnerability response transparency, published compliance certifications and AI security inside the platform.
- DLP and remote browser isolation are not in the FortiSASE component list on the page we read.
- Specific certifications for FortiSASE (SOC 2, FedRAMP) are not stated in the trust page text we read.
- FortiAIGate is described as self-hosted rather than as part of the FortiSASE cloud service.
How does Fortinet compare head to head?
- Cato Networks vs FortinetCato Networks 8.70, Fortinet 7.10
- Cisco vs FortinetCisco 5.30, Fortinet 7.10
- Fortinet vs NetskopeFortinet 7.10, Netskope 8.00
- Fortinet vs Palo Alto NetworksFortinet 7.10, Palo Alto Networks 7.05
- Fortinet vs ZscalerFortinet 7.10, Zscaler 6.00
Bottom line
Fortinet's score rests on one operating system and policy engine across SASE and SD-WAN and the deployment choices it describes. Component coverage and the certifications stated on its pages hold its total down. It ranks 3 of 6 on our weights, at 7.10.
Best for: Fortinet firewall and SD-WAN estates that want SASE on the same operating system, including sovereign deployments.
Further reading: SASE roundup: dated announcements on the six vendors' pages, Coding agents and SASE: what vendors say about Claude Code, Cursor and Codex
Frequently asked questions
Does Fortinet list FedRAMP?
FedRAMP is not listed on the pages we read. Fortinet's trust page states security aligned with the ISO/IEC 27000 series and NIST 800-53. Specific FortiSASE certifications such as SOC 2 or FedRAMP are not stated in the trust page text we read.
Does Fortinet describe controls for AI agents and MCP?
Yes. Fortinet states FortiAI discovers AI applications in use and "blocks unauthorized prompts". FortiAIGate checks "prompts, outputs, and agent tool calls" and catches prompt injection, jailbreaks and data leaks in MCP tool traffic; it is described as self-hosted, with data and logs on the customer's infrastructure.
How many SASE components does Fortinet list?
6 of the eight we track: SD-WAN, SWG, CASB, ZTNA, FWaaS and DEM. Not listed on the pages we read: DLP and RBI.