FortiSASE list pricing starts at roughly $90 per user per year for the Standard tier in the 50-499 user band, but a 200-user mid-market organisation will pay closer to $210-250 per user per year once FortiToken, FortiClient EMS, compute region fees and bandwidth add-ons are factored in. The variable that makes or breaks the budget is not the tier you choose but the number of add-on SKUs required to reach functional parity with a single-vendor SASE platform.
Fortinet does not publish a public FortiSASE price list. Partner portals show list prices, but actual quotes vary by 20-30% depending on the distributor, your Fortinet certification tier and the deal registration discount applied. If you have asked three partners for a FortiSASE quote and received three different numbers, you are not doing anything wrong. The pricing structure is genuinely complex, and this post maps it out so you can benchmark what lands on your desk.
This is not a feature comparison. For architecture, OT support and sovereignty analysis, see the broader FortiSASE comparison. This post focuses on one question: what does FortiSASE actually cost for a 200-user European mid-market organisation over three years?
What does FortiSASE actually cost in 2026?
FortiSASE pricing in 2026 is structured around three tiers: Standard, Advanced and Comprehensive. Each tier targets a different operational profile, from basic web security to full SOC integration with global redundancy. The per-user list price ranges from $90 to $350 per year in the 50-499 user band, with volume discounts kicking in at 500 and 2,000 users.
| Tier | Included capabilities | Per user/year (50-499 band) | Per user/year (500-1,999 band) | Minimum users | Key limitation |
|---|---|---|---|---|---|
| Standard | FWaaS, SWG, Universal ZTNA, basic CASB, antivirus, DNS security, web filtering | ~$90 (£78) | ~$80 (£69) | 50 | No SOC/NOC integrations, limited log retention |
| Advanced | Standard + SOC/NOC integration tools, extended monitoring | ~$117 (£101) | ~$104 (£90) | 50 | No public cloud PoP delivery |
| Comprehensive | Advanced + public cloud infrastructure PoPs, global redundancy | ~$350 (£304) | ~$310 (£271) | 50 | 200% premium over Advanced for infrastructure guarantees |
These figures are drawn from UK G-Cloud framework pricing (2024-2026) and aggregated partner portal data. Your actual quote will differ based on deal registration discounts, multi-year commitments and distributor margin.
The gap between Standard and Comprehensive is not linear. Moving from Standard to Advanced costs roughly 30% more. Moving from Advanced to Comprehensive costs nearly 200% more. That jump reflects the shift from Fortinet’s own PoP infrastructure to public cloud delivery with SLA-backed redundancy, a cost structure that hits mid-market budgets disproportionately hard.
For comparison, a 10,000-user enterprise pays approximately $54.60 per user per year for Advanced, nearly half the mid-market rate. Fortinet’s volume discounting is aggressive: the difference between the 50-499 band and the 10,000+ band is 53% on the Advanced tier. This means mid-market organisations subsidise their own pricing disadvantage, paying premium rates without the negotiating leverage that comes with enterprise-scale deals.
The licence stack you actually need
The tier price is the starting point, not the finish line. A functionally complete FortiSASE deployment for a 200-user organisation typically requires additional licences that are not included in the base subscription.
| Component | What it covers | Included in base tier? | Estimated additional cost (200 users/year) |
|---|---|---|---|
| FortiSASE Advanced | Base platform licence | Yes (this is the tier) | $23,400 (200 x $117) |
| FortiToken Cloud / FortiIdentity Cloud | MFA for all users | No (separate SKU) | ~$17,700 ($88.50/user for 500-user band) |
| FortiClient EMS (cloud-hosted) | Endpoint agent management, device posture, ZTNA tagging | Partial (basic agent included; full EMS management is separate) | ~$5,000-$8,000 ($25-$40/user) |
| FortiAnalyzer / FortiCloud SOCaaS | Extended log retention beyond 7-30 days (NIS2 typically requires 180+ days) | No | ~$4,000-$8,000 depending on retention period |
| Dedicated public IPs | Fixed egress IPs for SaaS whitelisting | No (£4,337/year for 4 IPs) | ~$5,500 |
| Bandwidth add-on | Extra 25 Mbps blocks above 1.5 Mbps/user default | No (£867/year per 25 Mbps block) | ~$1,100-$3,300 (1-3 blocks) |
| Compute region add-on | Access to optimised EU PoP infrastructure | No (£8,673/year for Standard/Advanced) | ~$11,000 |
Platforms like Jimber bundle ZTNA, SWG, FWaaS, SD-WAN, device posture checks and logging into a single per-user licence with no bandwidth surcharges or region fees. That bundling difference is not a feature comparison point. It is a procurement simplification that changes how you model three-year costs.
The MFA line item deserves attention. FortiToken Cloud pricing for the 500-user band (the smallest band covering a 200-user deployment) runs approximately $88.50 per user per year based on 2025-2026 partner documentation. That single add-on nearly doubles the effective per-user cost of the Standard tier.
TCO for a 200-user organisation over three years
This calculation models a Belgian mid-market organisation on the Advanced tier with SOC integration needs, NIS2-compliant log retention, EU compute region access and MFA for all users.
| Component | Year 1 | Year 2 | Year 3 (incl. ~10% renewal uplift) |
|---|---|---|---|
| FortiSASE Advanced (200 users) | $23,400 | $23,400 | $25,740 |
| FortiToken Cloud (MFA) | $17,700 | $17,700 | $19,470 |
| FortiClient EMS (cloud) | $6,000 | $6,000 | $6,600 |
| FortiAnalyzer (180-day retention) | $6,000 | $6,000 | $6,600 |
| Compute region (EU) | $11,000 | $11,000 | $12,100 |
| Dedicated IPs (4-pack) | $5,500 | $5,500 | $6,050 |
| Bandwidth (2x 25 Mbps blocks) | $2,200 | $2,200 | $2,420 |
| Professional services (onboarding) | $15,000 | – | – |
| Annual total | $86,800 | $71,800 | $78,980 |
| 3-year TCO | $237,580 | ||
| Per user/month (3-year average) | ~$33 |
For comparison, a single-vendor SASE platform with all-inclusive per-user pricing changes the calculation fundamentally. Jimber’s transparent pricing model, for example, bundles ZTNA, SWG, FWaaS, SD-WAN and device posture into one licence without bandwidth fees, compute region surcharges or separate MFA costs. Industry benchmarks from the seven-criteria SASE vendor evaluation framework place full SASE platform licensing between roughly $14 and $22 per user per month for mid-market deployments. A Belgian wealth manager cut security costs by 58% after consolidating from a fragmented stack to a unified SASE platform.
| Metric | FortiSASE (Advanced + add-ons) | Single-vendor SASE (bundled) |
|---|---|---|
| 3-year TCO (200 users) | ~$237,580 | ~$100,800-$158,400 ($14-$22/user/month) |
| SKUs on the invoice | 7-10 | 1 |
| Bandwidth surcharges | Yes (1.5 Mbps/user default) | Typically no |
| Separate MFA licence | Yes (FortiToken) | Included or IdP-integrated |
| Year-3 renewal risk | 10-15% uplift common | Flat or contractually capped |
| NIS2-compliant log retention | Requires FortiAnalyzer add-on | Included in base platform |
The professional services line deserves context. Partners across Belgium and the Netherlands, including certified integrators working through distributors like Exclusive Networks and Westcon-Comstor, typically charge between EUR 1,200 and EUR 1,800 per day for FortiGate-to-FortiSASE migration work. A 200-user deployment with three sites, AD integration and policy migration runs 8-12 consultant days. That figure is not unique to Fortinet, but it sits on top of an already complex invoice rather than being absorbed into a simpler engagement model.
The FortiSASE TCO is not unreasonable compared to Zscaler (which typically starts higher for equivalent scope) or Palo Alto Prisma Access (which adds credit-based complexity for logging and storage). Cato Networks falls in between, with socket-based site pricing that penalises organisations with many locations but fewer users per site. But FortiSASE is materially more expensive than what the initial tier pricing suggests, and materially more expensive than single-vendor platforms purpose-built for the mid-market where all components ship in one licence.
Where FortiSASE pricing surprises FortiGate customers
Five pricing patterns consistently catch FortiGate customers off guard, based on partner feedback, G2 reviews and Gartner Peer Insights commentary from 2025-2026.
Bandwidth throttling at 1.5 Mbps per user. The default allocation sounds theoretical until a team of 200 runs concurrent video calls, cloud backups and SaaS syncs through a 300 Mbps aggregate ceiling. For context, a single Microsoft Teams video call consumes 1.2-1.5 Mbps. One user on a video call can saturate their entire allocation, leaving nothing for simultaneous SaaS traffic or file syncs. Partners report that most mid-market deployments need at least one additional 25 Mbps block within the first quarter. Fortinet does not position this as a hard cap in sales presentations, but it functions as one in production.
Renewal uplifts after year one. Initial deal registration discounts of 20-25% are common. Those discounts shrink or disappear at renewal. Partners across the Benelux report effective price increases of 10-15% at year two, with some customers seeing 25-30% jumps when switching from an introductory deal to standard renewal terms. Negotiating a contractual renewal cap before signing is non-optional.
The MFA cost that doubles your effective price. FortiToken Cloud is technically optional if you use a third-party IdP for MFA. In practice, achieving seamless FortiClient integration, posture-based ZTNA tagging and single sign-on across FortiSASE and FortiGate requires Fortinet’s own identity stack. The $88.50/user/year price tag is invisible in tier comparisons but dominates the invoice.
Agentless device coverage gaps. FortiSASE’s agentless mode (SWG-only access for unmanaged devices) provides limited security compared to the full agent experience. Organisations with contractors, BYOD users or IoT/OT devices often discover that covering those endpoints properly requires additional FortiClient licences or separate FortiNAC deployments. For organisations with industrial environments, this gap is structural. Jimber addresses it with NIAC inline isolation hardware that enforces per-device policies without requiring agents.
Invoice complexity. A single FortiSASE deployment can generate invoices with 5-10 distinct SKUs (base licence, EMS, Token, Analyzer, compute region, bandwidth blocks, dedicated IPs). For finance teams accustomed to per-user pricing, reconciling these line items against budget projections is a recurring source of friction.
When FortiSASE makes economic sense (and when it does not)
FortiSASE is the right commercial choice when three conditions are met simultaneously. You have a substantial existing FortiGate investment across multiple sites, with FortiOS expertise on your team. Your organisation fits the 500+ user band where volume discounts reduce the per-user cost meaningfully. And you already run FortiCloud, FortiAnalyzer and FortiClient EMS, so the add-on costs are partially absorbed.
For the typical 200-user European mid-market organisation, one or more of those conditions is usually absent. The IT team has three to five people, none with deep FortiOS certification. The user count sits in the most expensive band. And the “Fortinet stack” consists of a pair of FortiGate firewalls, not the full Security Fabric.
In that scenario, the economics favour a platform built for the mid-market from the start. Jimber’s per-user pricing with no bandwidth tiers, no compute region fees and no separate MFA licensing produces a three-year TCO that is 40-60% lower than a fully loaded FortiSASE Advanced deployment. The single-console architecture also reduces ongoing operational cost: one policy engine replaces the five separate management interfaces (FortiSASE, FortiClient EMS, FortiToken, FortiAnalyzer, FortiGate) that a mid-market team would otherwise maintain. The SASE architecture guide explains how cloud-native platforms avoid the infrastructure layering that drives FortiSASE’s add-on costs.
Sovereignty adds a second dimension. Fortinet is a US-headquartered company subject to the CLOUD Act, which grants US authorities legal power to compel access to data processed on Fortinet-operated infrastructure, regardless of where the PoP is physically located. For Belgian organisations preparing for NIS2 audits or CyberFundamentals verification, the jurisdictional question creates documentation requirements that go beyond technical controls. Auditors assessing supply chain security under NIS2 Article 21 increasingly treat vendor jurisdiction as a scored criterion. European SASE alternatives that operate under EU jurisdiction eliminate that compliance documentation burden entirely.
If your FortiGate contracts renew within 12 months and your team is already evaluating the SSL VPN deprecation across every vendor, the pricing comparison above should be part of that evaluation. The architectural shift is happening regardless. The question is whether you shift within Fortinet’s ecosystem or outside it.
Frequently asked questions
What is the cheapest FortiSASE tier in 2026?
The Standard tier starts at approximately $90 per user per year in the 50-499 user band, based on 2025-2026 partner portal and UK G-Cloud pricing data. This includes FWaaS, SWG, basic CASB and DNS security but excludes SOC integration, extended logging and MFA.
Does FortiSASE include FortiGate licensing?
No. FortiSASE and FortiGate are separate products with separate licences. A FortiGate firewall requires its own FortiCare subscription and FortiGuard security services. FortiSASE complements or replaces the FortiGate for remote user security, but the licences do not overlap.
Is FortiSASE pricing per user or per bandwidth?
Both. The base licence is per user, but bandwidth is capped at 1.5 Mbps per user by default. Exceeding the aggregate cap requires purchasing additional 25 Mbps blocks at approximately £867 per year each. Compute region access and dedicated IPs are also billed separately.
What does FortiSASE Advanced cost for 200 users?
The base licence is approximately $23,400 per year (200 x $117). With MFA, endpoint management, EU compute region access, dedicated IPs and extended log retention, the all-in annual cost for year one is approximately $86,800, or $434 per user per year including professional services.
Are there hidden costs in FortiSASE beyond the per-user price?
Yes. The most significant are FortiToken Cloud for MFA (~$88.50/user/year), compute region add-ons (~$11,000/year for EU access), FortiClient EMS for device management (~$25-$40/user/year) and bandwidth blocks. These add-ons can double the effective per-user price compared to the base tier alone.
How does FortiSASE renewal pricing work after year one?
Initial deals typically include deal registration discounts of 20-25%. At renewal, those discounts shrink or reset to standard pricing. Partners report effective increases of 10-15% at year two, with some cases reaching 25-30%. Negotiating a contractual price cap before signing the initial agreement is strongly recommended.
What is the cheapest path from FortiGate to full SASE?
If your priority is cost, single-vendor SASE platforms like Jimber that bundle all components into one per-user licence produce the lowest three-year TCO for 200-user organisations. If staying within the Fortinet ecosystem is a priority, FortiSASE Standard with a multi-year commitment and aggressive deal registration delivers the lowest Fortinet-specific starting point, but add-on costs will accumulate.
The pricing data in this post reflects 2025-2026 partner portal figures and UK G-Cloud framework pricing. Your actual costs will vary by region, distributor and negotiation. If you want to see how a single-vendor approach compares for your specific environment, book a demo or read the full FortiSASE vs Jimber architecture comparison for the broader evaluation picture.
