Global Tool Radar

Security & Privacy / Zero Trust Network Access (ZTNA) Software

Fortinet FortiSASE ZTNA Review, Pricing, Pros & Cons

Fortinet FortiSASE provides agent-based and agentless zero trust access to private applications through its Secure Private Access capabilities, with identity, device context, application policy, and continuous posture checks.

Research by Global Tool Radar Research SystemEvidence checked: Aug 12, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Visit product websiteChoose similar tools to compare

Buying snapshot

Quick buying snapshot

A compact view of who this tool fits, what it costs, and what to confirm before choosing it.

Best for
  • Your organization already uses FortiGate hubs and wants cloud-delivered private access with consistent Fortinet policy and inspection: FortiSASE SPA connects security PoPs to supported FortiGate SD-WAN, NGFW, or data-center firewall hubs and applies identity and device context to explicit applications.
  • You need both managed-client access and browser-only access for contractors or unmanaged devices: All three subscriptions include agent-based ZTNA, while Advanced and Comprehensive include agentless HTTPS access through a browser and bookmark portal.
More buying conditions
  • You want dynamic private-access policy based on endpoint posture: FortiClient evaluates endpoint criteria and FortiSASE dynamically assigns posture tags that can drive private-access policy.
Not for
  • You need a standalone ZTNA-only subscription: Fortinet packages ZTNA within broader FortiSASE Standard, Advanced, and Comprehensive user subscriptions rather than publishing a separate ZTNA plan.
  • You require public self-service prices or fully disclosed contract terms before contacting sales: The current ordering guide publishes subscription names and SKUs but no numeric prices, currency, payment timing, commitment duration, or renewal terms.
More buying conditions
  • Your core deployment has fewer than 50 remote users: The current core FortiSASE user subscriptions have a published minimum order of 50 users; smaller starter bundles are separate routes and outside this profile.
  • You need agentless access to non-HTTPS private applications: FortiSASE agentless ZTNA is documented for private web applications that support HTTPS; broad protocol access requires the managed-client SPA or agent-based ZTNA path.
Pricing
  • Quote-based user subscriptions in Standard, Advanced, and Comprehensive editions, with traditional term entitlements or an alternative FortiFlex route
  • Standard · Requires quote · per user · custom quote · minimum 50 users · FortiSASE remote-user purchase with a 50-user minimum order
Free or trial access
  • No permanent free FortiSASE plan or time-limited FortiSASE ZTNA trial is publicly stated. The interactive tour and product demonstrations are not plans. A documented 90-day DEM trial is limited to the adjacent digital-experience feature and is not a FortiSASE ZTNA trial.

Product scope

Product functionality and purchase scope

This profile evaluates the private-application access capabilities delivered within the current FortiSASE cloud service. FortiSASE calls the broader private-connectivity use case Secure Private Access and provides both agent-based ZTNA and, in higher subscriptions, agentless browser ZTNA. ZTNA is a capability inside FortiSASE rather than a separate standalone plan.

Product checked: Aug 12, 2026

Functionality reviewed
  • FortiSASE Standard remote-user subscription with agent-based ZTNA
  • FortiSASE Advanced remote-user subscription with agent-based and agentless ZTNA
  • FortiSASE Comprehensive remote-user subscription with agent-based and agentless ZTNA
  • Secure Private Access connectivity from FortiSASE security PoPs to supported FortiGate hubs
  • Identity, device context, security-posture tags, explicit-application policy, and private-access logging
Non-target functionality excluded from scoring
  • FortiSASE Secure Internet Access, Secure Web Gateway, Firewall-as-a-Service, Secure SaaS Access, CASB, DLP, SSPM, remote browser isolation, and the wider SSE feature set except where a current subscription boundary must be explained
  • Standalone FortiClient and FortiClient EMS subscriptions
  • On-premises FortiGate Universal ZTNA and FortiGate ZTNA access proxy deployments outside FortiSASE management
  • FortiGate Secure Private Access hub licenses and the SD-WAN Service Bundle
  • Fortinet Secure SD-WAN, Branch On-Ramp, Thin Edge, FortiAP, FortiExtender, and FortiBranchSASE offers
  • FortiSASE Sovereign, the mainland China offering, promotional SASE expansion bundles, and starter kits
  • FortiSASE deployment, training, custom onboarding, professional, managed, and support services beyond entitlements included with the core subscriptions
Purchase paths

Pricing checked: Aug 12, 2026

  • FortiFlex: FortiFlex is a flexible entitlement route for the same Standard, Advanced, and Comprehensive FortiSASE user subscriptions. It does not create duplicate plan editions, and no public point rate is retained here.

Pricing plans

Fortinet FortiSASE ZTNA pricing table

Pricing checked: Aug 12, 2026

Official factConfidence 97%2 linked sources

All three current remote-user subscriptions include agent-based ZTNA and allow up to three devices per user. Advanced and Comprehensive add agentless ZTNA. Core user subscriptions have a published minimum order of 50 users, but numeric prices, currency, billing cadence, payment timing, commitment duration, renewal terms, and implementation amounts require a Fortinet or partner quote. FortiGate SPA hubs require separate licensing, and FortiGate Secure Private Access requires the SD-WAN Service Bundle.

Official pricing page
PlanPriceKey differencesBest for
StandardFortiSASE Standard remote-user subscriptionSupporting pricing evidence
  • Requires quote · per user · custom quote · minimum 50 users · FortiSASE remote-user purchase with a 50-user minimum order
  • Fortinet cloud security locations: Fortinet-operated cloud locations; Public cloud security locations are not listed for Standard.
  • Included security locations: 4 locations; Up to the published allowance selected during activation.
Organizations with at least 50 remote users that need managed-client ZTNA and can use Fortinet cloud security locations without agentless browser access.
AdvancedFortiSASE Advanced remote-user subscriptionSupporting pricing evidence
  • Requires quote · per user · custom quote · minimum 50 users · FortiSASE remote-user purchase with a 50-user minimum order
  • Fortinet and public cloud security locations: Fortinet-operated and public-cloud locations; Location availability is selected during activation.
  • Included security locations: 4 locations; Up to the published allowance selected during activation.
Organizations needing both managed-client and browser-only ZTNA, Fortinet and public cloud locations, digital experience monitoring, and assisted onboarding.
ComprehensiveFortiSASE Comprehensive remote-user subscriptionSupporting pricing evidence
  • Requires quote · per user · custom quote · minimum 50 users · FortiSASE remote-user purchase with a 50-user minimum order
  • Fortinet and public cloud security locations: Fortinet-operated and public-cloud locations; Exact included locations depend on subscription size and activation.
  • Locations for subscriptions under 200 users: 1-2 locations; Applies only when the Comprehensive subscription has fewer than 200 users.
Large or globally distributed organizations needing both ZTNA modes and eligibility for the Global Add-On across all current and future FortiSASE security PoPs.

Plan upgrade triggers

Verified plan boundaries that can change the required edition.

Standard Advanced

The deployment needs agentless browser ZTNA for unmanaged or temporary-worker devices, public cloud security locations, digital experience monitoring, or assisted onboarding.

Supporting pricing evidence
Advanced Comprehensive

The deployment needs eligibility for the FortiSASE Global Add-On covering all existing security PoPs and future locations.

Supporting pricing evidence
What is included, connected, or sold separately

Product scope

What is included, connected, or sold separately

Material capabilities are separated by their verified relationship to the target product.

Access to all current and future FortiSASE security PoPsAdd-on

The ordering matrix reserves Global Security PoP Coverage as an add-on for Comprehensive.

Plan: Standard: Unavailable · Advanced: Unavailable · Comprehensive: Optional add-onFortiSASE Global Add-On
Official source
Deep security inspection for private-application accessIncluded capability

The current data sheet explicitly places deep security inspection in the Secure Private Access use case.

Official source
Managed-client ZTNA for private applicationsIncluded capability

The ordering matrix includes ZTNA in all three current remote-user subscriptions.

Plan: Standard: Included · Advanced: Included · Comprehensive: Included
Official source
REST API and Fortinet analytics integrationsIncluded capability

The plan matrix includes REST API in all three subscriptions, and the data sheet documents integrations with FortiAnalyzer, FortiSIEM, FortiMonitor, FortiIsolator, and FortiPAM.

Official source
Unified endpoint agent for ZTNA and posture signalsIncluded capability

FortiClient supplies managed access, user and device context, and posture-tag results; standalone FortiClient and EMS subscriptions are outside this profile.

FortiClient
Official source
Private-access path integration with Fortinet Secure SD-WANNative integration

Secure SD-WAN is an adjacent Fortinet product and connectivity path, not a FortiSASE ZTNA plan.

Fortinet Secure SD-WAN
Official source
Browser-only HTTPS access to private web applicationsPlan-dependent capability

Agentless access is limited to Advanced and Comprehensive and requires an HTTPS private web application behind a licensed FortiGate SPA hub.

Plan: Standard: Unavailable · Advanced: Included · Comprehensive: Included
Official source
End-to-end digital experience monitoringPlan-dependent capability

The current plan matrix includes DEM in Advanced and Comprehensive; a temporary Standard DEM trial does not change the core plan state.

Plan: Standard: Unavailable · Advanced: Included · Comprehensive: IncludedFortiSASE Digital Experience Monitoring
Official source
Secure Browser protection for agent and agentless usersPlan-dependent capability

Secure Browser is a broader FortiSASE protection capability and is not the same as agentless ZTNA.

Plan: Standard: Unavailable · Advanced: Included · Comprehensive: IncludedFortiSASE Secure Browser
Official source
FortiGate hub connectivity for Secure Private AccessSeparate product

A separate license is required per FortiGate SPA hub, and FortiGate Secure Private Access requires the SD-WAN Service Bundle.

Plan: Standard: Optional add-on · Advanced: Optional add-on · Comprehensive: Optional add-onFortiGate SPA license and SD-WAN Service Bundle
Official source
Optional Fortinet identity-as-a-serviceSeparate product

The ordering guide lists FortiIdentity Cloud separately with its own user bands and SKUs.

FortiIdentity Cloud
Official source
How the score is calculated

Scoring method

How the score is calculated

The score uses the category-specific buying dimensions below and their displayed weights.

This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.

Evidence confidence
85%
AI claim confidence
98%
Required-field evidence status
100%
Evidence freshness
54%
Field traceability
100%
Model agreement
92%
Why this confidence level
  • Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
  • Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
  • 8 of 8 weighted claims have evidence links.
  • 8 A1 documentary official sources and 3 A2 official product sources are linked.
  • 0 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
  • 4 weighted claims are past the review window.
  • No blocking evidence conflict was identified.
Least-privilege access20%
84

Enforces explicit identity and device-context policies for private applications with continuous posture checks to restrict unauthorized access, though agentless pathways are confined to HTTPS.

Identity and device trust17%
84

Standardizes trust via user certificate, identity, and continuous posture checks with dynamic tagging, requiring the FortiClient agent for full client context.

Application coverage15%
72

Agent-based ZTNA handles private application protocols across data centers and clouds, but agentless access is restricted solely to qualifying HTTPS web applications in the Advanced and Comprehensive plans.

User experience and performance14%
68

Performance depends on proximity to cloud locations, where Standard and Advanced allow 4 locations, but Comprehensive subscriptions under 200 users are limited to 1-2 locations.

Security and resilience13%
80

Builds resilience through deep security inspection for Secure Private Access traffic, though system scale is bounded by a published maximum of 12 SPA hubs.

Administration and integrations11%
77

Integrates with Fortinet security components and supports REST APIs, but requires configuring and licensing separate FortiGate private-access hub components and the SD-WAN Service Bundle.

Support and total cost10%
55

Quote-based pricing, separate licensing for FortiGate SPA hubs, the required SD-WAN Service Bundle, and the 50-user minimum order reduce cost transparency before sales engagement. The score is not lower because the fact set does include a clear commercial structure, but it does leave total cost and support scope dependent on the quote.

Score76
Pricing modelQuote-based user subscriptions in Standard, Advanced, and Comprehensive editions, with traditional term entitlements or an alternative FortiFlex route
Use casecloud-delivered zero trust access to private applications
Company sizeEnterprise, Mid-market
Structured tags

Fortinet FortiSASE ZTNA tag profile

Company size
  • Enterprise
  • Mid-market
Key features

Fortinet FortiSASE ZTNA core capabilities

  • Agent-based ZTNA included in Standard, Advanced, and Comprehensive
  • Agentless HTTPS ZTNA in Advanced and Comprehensive
  • Identity and device-context policy for explicit private applications
  • Continuous endpoint posture reassessment and dynamic posture tags
  • Reverse-proxy application gateways for authorized and compliant users
  • Private application connectivity across data centers and private or public cloud tenants
Detailed strengths and purchase cautions
Pros

Why it is worth considering

  • Provides agent-based access with continuous posture checks and dynamic endpoint tagging using the FortiClient agent across three devices per user.
  • Advanced and Comprehensive tiers extend connectivity to public-cloud and Fortinet-operated security locations for more flexible access paths.
  • Enables browser-only agentless access for qualifying HTTPS private web applications via Advanced and Comprehensive plans without requiring full client agents.
Cons

What to confirm before buying

  • Requires separate licensing for FortiGate SPA hubs and the SD-WAN Service Bundle to route private-application traffic.
  • Agentless access is confined strictly to HTTPS applications, leaving other private protocols dependent on the agent-based client.
  • Total cost of ownership is opaque, with no publicly stated numeric prices and a mandatory 50-user minimum order.
Cross-model buying perspectives

Multi-AI review

Cross-model buying perspectives

Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.

AI assessment updated: Sep 22, 2026

Score comparisonGPTGeminixAIRange
Least-privilege access8685806
Identity and device trust8882817
Application coverage7770707
User experience and performance73725815
Security and resilience8480777
Administration and integrations8178738
Support and total cost5260528
ztna private app access control8485787
ztna user device context8980829
ztna application onboarding manageability74756411
ztna user connectivity experience7678717
ztna visibility troubleshooting8280766
Where models differ
  • User experience and performance: 58–73 (15-point range)
  • ztna application onboarding manageability: 64–75 (11-point range)
  • ztna user device context: 80–89 (9-point range)
GPTAI-assisted buyer perspective79

FortiSASE ZTNA fits buyers that want ZTNA inside a broader FortiSASE remote-user subscription, with managed-client access in Standard and browser-only access added in Advanced or Comprehensive for qualifying HTTPS private web apps. It is a better fit when the buyer can meet the 50-user minimum and can accept quote-based pricing, FortiGate-based private-access hub requirements, and plan-specific cloud-location limits.

Review confidence
79/100
Model details
Strengths
  • The subscription includes agent-based ZTNA in Standard, Advanced, and Comprehensive, which supports managed-client private application access without requiring a separate ZTNA-only SKU.
  • Advanced and Comprehensive add agentless HTTPS ZTNA, which supports browser-only private web application access for users that cannot or should not use the client agent.
  • The product supports identity and device-context policy, continuous endpoint posture reassessment, dynamic posture tags, and reverse-proxy application gateways, which gives security teams multiple controls around private-app access policy.
  • Centralized logging, reporting, management, and REST APIs support operational oversight and integration into admin workflows.
Cautions
  • The core remote-user subscriptions have a published minimum order of 50 users, so smaller deployments do not match the commercial entry point.
  • Public numeric prices, billing cadence, payment timing, commitment duration, and renewal terms are not published, so budget planning requires a quote.
  • Standard does not include agentless ZTNA, so buyers needing browser-only private-application access need Advanced or Comprehensive.
  • FortiGate SPA hubs require separate licensing and the SD-WAN Service Bundle, which adds a separate purchase and operating dependency for private access hubs.
GeminiAI-assisted buyer perspective77

Fortinet FortiSASE ZTNA provides managed-client and agentless private application access with posture-based security, but requires existing FortiGate architecture and a minimum 50-user commitment.

Review confidence
77/100
Model details
Strengths
  • Provides agent-based access with continuous posture checks and dynamic endpoint tagging using the FortiClient agent across three devices per user.
  • Advanced and Comprehensive tiers extend connectivity to public-cloud and Fortinet-operated security locations for more flexible access paths.
  • Enables browser-only agentless access for qualifying HTTPS private web applications via Advanced and Comprehensive plans without requiring full client agents.
Cautions
  • Requires separate licensing for FortiGate SPA hubs and the SD-WAN Service Bundle to route private-application traffic.
  • Agentless access is confined strictly to HTTPS applications, leaving other private protocols dependent on the agent-based client.
  • Total cost of ownership is opaque, with no publicly stated numeric prices and a mandatory 50-user minimum order.
xAIAI-assisted buyer perspective72

FortiSASE ZTNA fits mid-market and enterprise buyers with at least 50 remote users who already run or will license FortiGate SPA hubs and need identity-plus-posture private-app access, with agentless browser access available only on Advanced or Comprehensive.

Review confidence
72/100
Model details
Strengths
  • All three remote-user editions include agent-based ZTNA with identity and device-context policy plus continuous endpoint posture reassessment and dynamic posture tags for explicit private applications.
  • Advanced and Comprehensive add agentless browser-only ZTNA for qualifying HTTPS private web applications that use SAML and an existing SPA service connection, supporting mixed managed-device and contractor access patterns.
  • Private-application connectivity can span data centers and private or public cloud tenants through reverse-proxy application gateways for authorized and compliant users, with deep security inspection on Secure Private Access traffic.
  • Centralized logging, reporting, management, and REST APIs support operational visibility and Fortinet-oriented security integrations for private-access traffic.
Cautions
  • No standalone FortiSASE ZTNA SKU exists
  • ZTNA is packaged inside Standard, Advanced, or Comprehensive remote-user subscriptions that require a quote and a published 50-user minimum order.
  • Agentless ZTNA is absent from Standard and is limited to qualifying HTTPS web applications rather than every private protocol, so browser-only needs force an Advanced or Comprehensive selection.
  • SPA hubs or ZTNA gateways based on supported FortiGate deployments are required and carry separate licensing plus the SD-WAN Service Bundle outside the core user subscriptions.

Research transparency

How this page was researched

A compact record of the evidence used, what was not tested, and which conclusions still need verification.

Official sources
11
Broad product review sources
0
Marketplace and app-store sources
0
Editorial sources
0
Latest evidence check
Aug 12, 2026
Research basis

Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.

Conflict handling

No unresolved evidence conflict is currently recorded.

View research methodology
Verified findingsNo permanent free FortiSASE plan or time-limited FortiSASE ZTNA trial is publicly stated. The interactive tour and product demonstrations are not plans. A documented 90-day DEM trial is limited to the adjacent digital-experience feature and is not a FortiSASE ZTNA trial.
  • Quote-based user subscriptions in Standard, Advanced, and Comprehensive editions, with traditional term entitlements or an alternative FortiFlex route
  • Agent-based ZTNA included in Standard, Advanced, and Comprehensive Agentless HTTPS ZTNA in Advanced and Comprehensive Identity and device-context policy for explicit private applications Continuous endpoint posture reassessment and dynamic posture tags Reverse-proxy application gateways for authorized and compliant users Private application connectivity across data centers and private or public cloud tenants Deep security inspection for Secure Private Access traffic Centralized logging, reporting, management, and REST APIs
  • Requires quote
  • All three current remote-user subscriptions include agent-based ZTNA and allow up to three devices per user. Advanced and Comprehensive add agentless ZTNA. Core user subscriptions have a published minimum order of 50 users, but numeric prices, currency, billing cadence, payment timing, commitment duration, renewal terms, and implementation amounts require a Fortinet or partner quote. FortiGate SPA hubs require separate licensing, and FortiGate Secure Private Access requires the SD-WAN Service Bundle.
Verification notes and unresolved itemsThe exact evaluated scope is FortiSASE Secure Private Access and ZTNA, while the current purchasable editions are broader FortiSASE user subscriptions.
  • The May 2026 ordering guide directly establishes the Standard, Advanced, and Comprehensive matrix, a 50-user starting band, and separate FortiGate SPA dependencies.
  • Fortinet publishes no current numeric plan amount, currency, billing cadence, payment timing, commitment duration, renewal term, or implementation amount, so all three plans remain quote-based and no cost calculation is returned.
  • FortiFlex is retained only as an offer-free alternative acquisition route because no public point rate was verified.
  • FortiSASE Sovereign, the China offering, SD-WAN starter and expansion bundles, branch and thin-edge subscriptions, standalone FortiClient, FortiGate ZTNA, Secure Internet Access, Secure SaaS Access, CASB, DLP, SSPM, RBI, and professional or managed services are excluded from the exact target scope.
Sources checked

Sources checked

Fortinet FortiSASE ZTNA source links

Contact UsFortinetLevel A2Linked to 4 scored claimsChecked Aug 12, 2026
FortiFlex licensingFortinetLevel A1Linked to 0 scored claimsChecked Aug 12, 2026
Appendix D - Maximum valuesFortinetLevel A1Linked to 0 scored claimsChecked Aug 12, 2026
Security posture tags and tagging rulesFortinetLevel A1Linked to 1 scored claimChecked Aug 12, 2026
Agentless ZTNA prerequisites and considerationsFortinetLevel A1Linked to 5 scored claimsChecked Aug 12, 2026
Agentless ZTNAFortinetLevel A1Linked to 1 scored claimChecked Aug 12, 2026
Agent-based ZTNAFortinetLevel A1Linked to 1 scored claimChecked Aug 12, 2026
What is the FortiSASE Secure Private Access architecture?FortinetLevel A1Linked to 1 scored claimChecked Aug 12, 2026

FAQ

Fortinet FortiSASE ZTNA FAQ

Is FortiSASE ZTNA a standalone product or plan?

No separate FortiSASE ZTNA plan is published. ZTNA is a capability included in the current Standard, Advanced, and Comprehensive FortiSASE remote-user subscriptions.

Which subscriptions include agentless ZTNA?

Advanced and Comprehensive include agentless ZTNA. Standard includes agent-based ZTNA but not agentless ZTNA.

What can agentless ZTNA access?

It provides browser-only access to private web applications that support HTTPS, using SAML authentication and an existing SPA service connection.

Does FortiSASE require FortiClient for ZTNA?

The managed endpoint path uses the FortiClient agent for user, device, posture, certificate, and ZTNA information. Advanced and Comprehensive also support browser-only agentless ZTNA for qualifying HTTPS applications.

Is a FortiGate included for private access?

No. Current documentation requires an SPA hub or ZTNA gateway based on a supported FortiGate deployment. FortiGate SPA hub licensing and the required SD-WAN Service Bundle are separate from the core user subscriptions.

How many devices can each user use?

The current ordering guide includes up to three devices per user across Standard, Advanced, and Comprehensive. Devices can be a combination of agent-based and proxy-based access.

What is the minimum order?

Fortinet publishes a minimum order of 50 users for the core FortiSASE user subscriptions.

Are public prices available?

No current numeric plan amounts are published in the official ordering material. Fortinet directs buyers to sales for product pricing and availability.

Popular comparisons

Common Fortinet FortiSASE ZTNA comparisons

Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.

VS #1
Fortinet FortiSASE ZTNAvsAkamai Enterprise Application Access
76Gap 177

Enterprise / Mid-market

VS #2
Fortinet FortiSASE ZTNAvsZscaler Private Access
76Gap 177

Enterprise / Mid-market

VS #3
Fortinet FortiSASE ZTNAvsCisco Secure Access Zero Trust Network Access
76Gap 379

Enterprise / Mid-market