What Is FortiSASE? Fortinet SASE, Explained for 2026

FortiSASE is Fortinet's answer when a FortiGate customer asks how to protect people who no longer sit behind the FortiGate. It extends one of the most widely deployed firewall families in the world into the cloud, and for a Fortinet shop it can look like the path of least resistance. Before you take that path into 2027, it helps to know exactly what FortiSASE is, what changed in 2026, and what Fortinet SASE inherits from the firewall.

Already comparing vendors? Our FortiSASE vs Zscaler comparison covers the head-to-head. This post starts one step earlier.

The short answer

FortiSASE is Fortinet's cloud-delivered secure access service edge (SASE) platform. It runs FortiOS, the same operating system as FortiGate firewalls, in Fortinet security points of presence (PoPs). It steers user traffic there through the FortiClient agent, thin-edge devices like FortiAP and FortiExtender, branch tunnels, or a PAC file. From those PoPs it delivers secure web gateway, firewall as a service, ZTNA, CASB, DLP, and remote browser isolation.

In other words, FortiSASE is a FortiGate delivered as a service. That is a real strength if your network is already Fortinet. It is also the limitation: a remote user's traffic has to be steered into a Fortinet PoP before it can be inspected. dope.security takes a different approach and inspects traffic on the device.

What is FortiSASE, and what does Fortinet SASE include?

Fortinet groups FortiSASE into four use cases:

• Secure Internet Access. Secure web gateway, firewall as a service, threat protection, and SSL inspection, for managed and unmanaged devices.
• Secure Private Access. ZTNA and SD-WAN integration for reaching apps in the data center and cloud.
• Secure SaaS Access. Inline and API-based CASB, SSPM, and DLP for cloud applications.
• Secure Remote Location. Protection for small sites where you cannot install an agent, using FortiAP access points or FortiBranchSASE devices as the on-ramp.

Licensing is per user, sold in user bands, and Fortinet's admin guide ties the number of security PoPs you can use to your license tier and user band. Check the current ordering guide for what your tier includes, since some capabilities, like dedicated public IPs, cost extra.

How FortiSASE works

Fortinet's architecture is direct about the model. Remote users, whether they connect with an agent, agentlessly, through a thin edge, or from a branch, establish secure connections to FortiSASE PoPs, and the PoPs enforce policy. Fortinet calls getting traffic there "steering."

• FortiClient agent. The recommended option for corporate-managed devices. It carries all traffic types to the PoP.
• Thin edge and branch devices. FortiAP, FortiExtender, FortiBranchSASE, and FortiGate tunnels for sites where an agent is not practical.
• Agentless proxy. A PAC file or proxy settings for devices like Chromebooks. This covers web traffic only.

That lineage is the whole story in one sentence. FortiSASE is proven firewall and proxy technology, moved from your rack into Fortinet's cloud. For background on the proxy model, read forward proxies explained.

The agent does a lot

FortiClient is the other half of the design. Fortinet positions it as one agent that bundles endpoint protection, ZTNA, traffic redirection, CASB, digital experience monitoring, sandboxing, vulnerability management, and USB control. That consolidation looks good on paper. In practice, one agent carries many jobs, and each is another set of profiles to manage.

What changed in Fortinet SASE in 2026

Four changes matter if you are evaluating FortiSASE now.

FortiOS 8.0 brought real AI controls

Fortinet introduced FortiOS 8.0 on March 10, 2026, at its Accelerate conference. The release adds shadow AI visibility in FortiView, AI-aware application control that allows approved generative AI tools while blocking risky actions, visibility into Model Context Protocol (MCP) and agent-to-agent traffic, and DLP with optical character recognition. Credit where it is due: that is a meaningful step up from where Fortinet AI governance sat a year earlier.

SASE Outpost and sovereign options

Fortinet also announced FortiSASE Outpost, which lets a FortiGate, starting with the new 1200G series, act as a local SASE point of presence inside a customer-controlled environment. Pair that with Fortinet's sovereign SASE options and the message is clear: Fortinet wants inspection to happen wherever your compliance team says it must. Notice where that still is, though. It is a gateway, whether Fortinet runs it or you do.

Steady feature releases

Recent FortiSASE releases added an inspect-or-block action for QUIC traffic, SCIM user provisioning from Entra ID and Okta, and bandwidth policies for internet and private access traffic.

And a Gartner step back

In the 2026 Gartner Magic Quadrant for SASE Platforms, SDxCentral reports that Fortinet moved from the Leaders quadrant to Challengers, one year after first reaching Leader. Gartner cited delayed feature enhancements, below-average customer experience, and the frequent patching that comes with a large firewall installed base being a constant target for attackers.

Does FortiSASE add latency?

A big PoP footprint shrinks the typical detour. It cannot make the detour zero. Every steered request still travels to a PoP, gets inspected, and travels on.

Measured cloud-proxy latency typically runs 40 to 80 milliseconds near a point of presence and 150 to 400 milliseconds when users are far from one, and a modern SaaS page chains dozens of requests. The math is in the latency math behind cloud proxy SWGs, and the operational trade-offs of tunneling are in split tunnel vs full tunnel.

How much is the detour costing you? Run the Fly-Direct Speed Test on this page to measure your real round-trip latency and compare a cloud PoP detour with inspection on the device. Can't run it? Book a 20-minute demo and we will run it with you.

The takeaway: more PoPs make the detour shorter. On-device inspection removes it.

What FortiSASE does well

FortiSASE is a strong fit in the right environment.

• Fortinet-standardized networks. If your branches run FortiGate and Fortinet SD-WAN, FortiSASE shares an operating system, policy concepts, and management with what you already run.
• Thin-edge coverage. Turning a FortiAP into the on-ramp for a micro-branch with no firewall is useful.
• Threat intelligence depth. Antivirus, IPS, sandboxing, DNS filtering, and web filtering all draw on FortiGuard.
• Flexible deployment. Between cloud PoPs, SASE Outpost, and sovereign options, Fortinet gives regulated buyers several places to put the gateway.

Where FortiSASE falls short

The documented limits are specific, and most trace back to the tunnel-and-gateway heritage.

• IPv4 only through the tunnel. Fortinet's latest FortiSASE release notes state that FortiClient blocks IPv6 traffic and only IPv4 traffic traverses the FortiSASE tunnel.
• Agentless is web only. The PAC-file path for unmanaged devices covers HTTP and HTTPS, not everything else.
• PoP access follows your license. The number of security PoPs available to you depends on license tier and user band, so a small deployment may not get the PoP spread a large one does.
• DLP is pattern-first. FortiSASE DLP uses FortiGuard data patterns, exact data matching, and file fingerprinting. That works well for structured, known data like card numbers. It is harder to apply to unstructured content, such as a paragraph of strategy or a block of source code pasted into an AI prompt.
• Patching load. Gartner's 2026 caution about frequent patching reflects a real operational cost for teams already running FortiGate fleets.

FortiSASE vs dope.security

Both protect users off the corporate network. They put the inspection point in different places.

• Where inspection happens. FortiSASE inspects in Fortinet PoPs (or an Outpost) after FortiClient or another steering method sends traffic there. dope.security runs SSL inspection, URL filtering, Cloud Application Control, and DLP on the device.
• Network path. FortiSASE routes steered traffic through a PoP. dope.security flies direct to the destination, with up to 4x performance over legacy proxy SWGs.
• Policy updates. dope.security pushes policy from dope.console to every endpoint in under a minute, by user or group.
• Agent scope. FortiClient bundles many endpoint functions. The dope.security agent focuses on web security, AI governance, and DLP, is Mac native and Windows, and uses under 100 MB of RAM.
• AI governance. dope.security AI Analytics shows every AI app, who used it, and whether the account was personal or enterprise-licensed. Cloud Application Control allows the corporate ChatGPT, Claude, Google, or Microsoft 365 tenant and blocks the personal login on the same domain.
• DLP approach. Dopamine DLP reads the document instead of matching patterns. Text is extracted on the device and classified by an LLM with zero data retention, covering ChatGPT, Claude, Perplexity, Abacus, and Copilot.

For the wider field, see our FortiSASE alternatives guide and our roundup of SASE vendors.

Do you need FortiSASE, or just the SSE piece?

If you are rebuilding the WAN on Fortinet SD-WAN and want one vendor for branch networking and security, FortiSASE is a coherent choice.

If the problem is protecting laptops that work from anywhere, and you keep a FortiGate or FortiClient VPN for private apps, you may not need SASE at all. You need a secure web gateway, AI controls, and DLP that follow the device. Many teams keep their VPN client for private access and run dope.security alongside it for internet traffic. We explain how in how dope.security works hand in hand with FortiClient and other VPNs. Rollout is fast: Outreach Health secured 99% of its devices within one week and cut web access tickets by 70% in 90 days.

The bottom line on FortiSASE

FortiSASE is the FortiGate you already trust, delivered from Fortinet's cloud. That makes it a natural fit for Fortinet networks, and it means every remote request still pays the trip to a gateway. If you want web security, AI tenant control, and DLP to run on the laptop and send traffic straight to its destination, that is what dope.security was built to do. Explore the Fly-Direct Secure Web Gateway or book a 20-minute demo and we will run the personal ChatGPT test live.

Frequently asked questions

What is FortiSASE used for?

FortiSASE secures remote users, branches, and devices by steering their traffic to Fortinet security PoPs for inspection. It covers secure internet access, private access through ZTNA, SaaS security through CASB and DLP, and thin-edge locations using FortiAP or FortiBranchSASE. It runs FortiOS, the same operating system as FortiGate firewalls.

Is FortiSASE the same as FortiClient?

No. FortiSASE is the cloud service that inspects traffic and enforces policy. FortiClient is the endpoint agent that steers traffic to FortiSASE and also handles endpoint protection, ZTNA, and other functions.

Is Fortinet a Leader in the Gartner SASE Magic Quadrant?

Not in 2026. According to SDxCentral's coverage of the 2026 Gartner Magic Quadrant for SASE Platforms, Fortinet moved from Leader to Challenger, with Gartner citing delayed feature enhancements, below-average customer experience, and frequent patching.

Does FortiSASE support IPv6?

Fortinet's FortiSASE release notes list a limitation: FortiClient blocks IPv6 traffic, and only IPv4 traffic traverses the FortiSASE tunnel. Teams with IPv6 requirements should test before rollout.

What is the best FortiSASE alternative for remote workforces?

If your main goal is protecting laptops that work anywhere, not rebuilding the WAN, dope.security is a strong alternative. It runs SSL inspection on the device with no PoP in the data path, adds AI Analytics, Cloud Application Control, and Dopamine DLP in one console, and can run alongside FortiClient VPN for private access.