What Is FortiSASE? Fortinet's SASE, Explained Without the Datasheet Gloss

FortiSASE is the answer Fortinet gives when a FortiGate customer asks how to protect people who no longer sit behind the FortiGate. It is a logical extension of one of the most widely deployed firewall families in the world, and for a Fortinet shop it can look like the path of least resistance. Before you take that path, it helps to know exactly what FortiSASE is and what it inherits from the firewall. If you are already comparing vendors, our FortiSASE vs Zscaler comparison covers the head-to-head. This post starts one step earlier.

The short answer

FortiSASE is Fortinet's cloud-delivered secure access service edge platform. It runs FortiOS, the same operating system as FortiGate firewalls, in Fortinet's security points of presence, and it steers user traffic there through the FortiClient agent, thin-edge devices like FortiAP, branch tunnels, or a PAC file. From those PoPs it provides secure web gateway, firewall as a service, ZTNA, CASB, DLP, and remote browser isolation. In other words, FortiSASE is a FortiGate delivered as a service. That is a real strength if your network is already Fortinet, and it is also the limitation: it inherits the gateway model, so a remote user's traffic has to be steered into a Fortinet PoP before it can be inspected. dope.security takes a different approach, inspecting traffic on the device and sending it direct.

That is a testable claim. Put a laptop on hotel Wi-Fi, connect FortiClient, and trace where a request to your SaaS apps goes before it reaches them.

What is FortiSASE?

Fortinet's datasheet describes FortiSASE as a single-vendor SASE built on a common operating system and a unified agent. The capabilities it lists fall into four use cases.

• Secure Internet Access. Secure web gateway, firewall as a service, advanced threat protection, and real-time SSL inspection including TLS 1.3, for managed and unmanaged devices.
• Secure Private Access. ZTNA and SD-WAN integration for reaching applications in the data center and cloud.
• Secure SaaS Access. Inline CASB, API-based CASB, SSPM, and DLP for cloud applications.
• Secure Remote Location. Protection for sites where no agent can be installed, using FortiAP access points or FortiBranchSASE devices as the on-ramp.

Fortinet also lists remote browser isolation, a Secure Browser extension for Chrome and Edge, and digital experience monitoring. The licensing model is per user, with a minimum order of 50 users, and FortiFlex entitlements can be applied. Dedicated public IPs require an additional license.

How FortiSASE works

Fortinet's architecture guide is direct about the model. Remote users, whether they connect with an agent, agentlessly, through a thin edge, or from a branch, establish secure connections to FortiSASE security PoPs, and those PoPs enforce the organization's policies. Getting traffic there is called steering, and FortiSASE supports several methods.

• FortiClient agent. The recommended option for corporate-managed devices, carrying all traffic types to the PoP.
• Thin edge and branch devices. FortiAP, FortiExtender, FortiBranchSASE, FortiGate Secure Edge, and Branch On-Ramp tunnels for sites and devices where an agent is not practical.
• Agentless proxy. A PAC file or proxy settings for devices like Chromebooks, covering web traffic only.

The datasheet also states that the FortiSASE secure web gateway relies on the FortiOS explicit web proxy, captive portal, and authentication features. That lineage is the whole story in one sentence. FortiSASE is proven firewall and proxy technology, moved from your rack into Fortinet's cloud. If you want the background on how that proxy model behaves, read forward proxies explained.

The agent does a lot

FortiClient is the other half of the design. Fortinet positions it as a single SASE agent that bundles endpoint protection, ZTNA, SSE traffic redirection, CASB, digital experience monitoring, sandboxing, vulnerability management, and USB device control. That consolidation is appealing on paper. In practice it means one agent carries a lot of responsibilities, and every one of them is another set of profiles to manage. We compare how the major clients behave in what GlobalProtect actually is and what the Zscaler Client Connector does.

Does FortiSASE add latency?

Fortinet advertises a 99.999% SLA with a latency guarantee for security inspection, backed by hundreds of security PoPs. That is a serious commitment, and it is worth reading carefully. A latency guarantee for inspection covers the time spent in the PoP. It does not remove the trip to the PoP and back, which every steered request still takes.

Measured cloud-proxy latency typically runs 40 to 80 milliseconds near a point of presence and 150 to 400 milliseconds when users are far from one, and a modern SaaS page chains dozens of requests. A large PoP footprint shrinks the typical detour, and it cannot make it zero. The math is in the latency math behind cloud proxy SWGs, and the operational trade-offs of tunneling are in split tunnel vs full tunnel.

How much is the detour costing you? Run the Fly-Direct Speed Test to measure your real round-trip latency and compare a cloud PoP detour with inspection on the device. See how dope.security's Fly-Direct Secure Web Gateway removes the stopover, or book a 20-minute demo to see it live.

The takeaway: more PoPs make the detour shorter, while on-device inspection removes it.

What FortiSASE does well

Credit where it is due. FortiSASE is a strong fit in the right environment.

• Fortinet-standardized networks. If your branches run FortiGate and Fortinet SD-WAN, FortiSASE shares an operating system, policy concepts, and management plane with what you already know.
• Thin-edge coverage. Fortinet says it is the only SASE vendor to integrate SASE with wireless access points. For micro-branches with no firewall, turning a FortiAP into the on-ramp is genuinely useful.
• Security depth from FortiGuard. Antivirus, IPS, sandboxing, DNS filtering, and web filtering all draw on Fortinet's threat intelligence, and the firewall-as-a-service engine matches FortiGate efficacy.
• Accessible entry point. Per-user licensing with a 50-user minimum lowers the barrier for smaller teams.

Where FortiSASE falls short in 2026

The documented limits are specific, and most trace back to the tunnel-and-gateway heritage.

Documented limitations worth planning for

Fortinet's own FortiSASE release notes list several limitations that matter for a mixed, remote workforce.

• IPv4 only through the tunnel. The release notes state that FortiClient blocks IPv6 traffic and only IPv4 traffic traverses the FortiSASE tunnel.
• No SWG mode on iOS. SWG mode is not supported on iOS devices.
• Policy changes wait for reconnects. For SSL VPN remote users, changes to an existing Internet Access or Private Access policy take effect only after the users reconnect to FortiSASE.
• A bundled, locked-down endpoint cloud. The FortiSASE subscription includes its own FortiClient Cloud instance, which you cannot configure directly, and you cannot apply a FortiSASE subscription to an existing FortiClient Cloud instance.
• Agentless is web only. The PAC-file path for unmanaged devices covers HTTP and HTTPS traffic, not everything else.
• Older FortiGate hardware left out. For agent-based ZTNA, the release notes state that FortiSASE does not support older FortiGate D series models configured as ZTNA application gateways, which matters for teams hoping to reuse existing appliances.

DLP is pattern-first

FortiSASE DLP draws on thousands of predefined data patterns from FortiGuard and supports exact data matching and indexed document fingerprinting. That is effective for structured, known data like card numbers and fingerprinted files. It is harder to apply to unstructured content, such as a paragraph of strategy or a block of source code pasted into an AI prompt.

AI governance sits across several features

Fortinet lists GenAI usage among the controls in its Secure Browser extension, alongside inline CASB and DLP elsewhere in the platform. That spreads AI governance across a browser extension, the PoP, and policy in several places. The hard AI test is still the same: allow the corporate ChatGPT workspace, block personal ChatGPT on the same domain, and inspect what is in the prompt. We walk through it in how to block personal ChatGPT while keeping the corporate account.

FortiSASE vs dope.security: the head-to-head

Both platforms protect users off the corporate network. They put the inspection point in different places. Here is the comparison, line by line.

• Where inspection happens. FortiSASE inspects traffic in Fortinet security PoPs after FortiClient or another steering method sends it there. dope.security inspects traffic on the device with an on-device SSL inspection proxy.
• Network path. FortiSASE routes steered traffic through the nearest Fortinet PoP. dope.security flies direct to the destination, with up to 4x performance over legacy proxy SWGs.
• Policy updates. Fortinet documents that SSL VPN users pick up changed policies only after reconnecting. dope.security pushes policy from dope.console in real time, down to individual users and groups.
• Agent scope. FortiClient bundles EPP, ZTNA, CASB, DEM, sandboxing, vulnerability management, and USB control. The dope.security agent focuses on web security, AI governance, and DLP, is Mac native and Windows, and uses less than 100 MB of RAM.
• Personal vs corporate AI accounts. dope.security Cloud Application Control restricts ChatGPT, Claude, Google, and Microsoft 365 to corporate tenants and blocks personal logins on the same domain.
• DLP approach. FortiSASE DLP relies on predefined patterns and fingerprinting. Dopamine DLP intercepts file uploads and AI prompts and classifies them with large language models through zero-retention OpenAI APIs, covering ChatGPT, Claude, Perplexity, Abacus, and Copilot.
• Console. Both offer a single console. dope.security runs SWG, CASB Neural, and Dopamine DLP under one dope.console built from scratch.

For the wider field, see our FortiSASE alternatives guide and our roundup of SASE vendors in 2026. If you are still sorting out the categories, SASE vs SSE architecture explains where each one draws the line.

Do you need FortiSASE, or just the SSE piece?

If you are rebuilding the WAN with Fortinet SD-WAN and want one vendor for branch networking and security, FortiSASE is a coherent choice, and you should evaluate it seriously. If the problem is protecting laptops that work from anywhere, and you keep a FortiGate or FortiClient VPN for private applications, you may not need SASE at all. You need a secure web gateway, AI controls, and DLP that follow the device.

That split is common. Many teams keep their existing VPN client for private access and run dope.security alongside it for internet-bound traffic. We explain how in how dope.security works hand in hand with FortiClient and other VPNs. Rollout is fast: Outreach Health secured 99% of its devices within one week and cut web access tickets by 70% in 90 days.

The bottom line on FortiSASE

Put simply: FortiSASE is the FortiGate you already trust, delivered from Fortinet's cloud, which makes it a natural fit for Fortinet networks and means every remote user still pays the trip to a PoP. If you want web security, AI tenant control, and DLP to run on the laptop and send traffic straight to its destination, that is what dope.security was built to do. Explore the Fly-Direct Secure Web Gateway or book a 20-minute demo and we will run the personal ChatGPT test live.

Frequently Asked Questions

What is FortiSASE used for?

FortiSASE secures remote users, branches, and devices by steering their traffic to Fortinet security points of presence for inspection. It covers secure internet access, secure private access through ZTNA, SaaS security through CASB and DLP, and thin-edge locations using FortiAP or FortiBranchSASE devices. It runs FortiOS, the same operating system as FortiGate firewalls.

Is FortiSASE the same as FortiClient?

No. FortiSASE is the cloud service that inspects and enforces policy in Fortinet PoPs. FortiClient is the endpoint agent that steers traffic to FortiSASE and also provides endpoint protection, ZTNA, and other functions. A FortiSASE subscription includes its own FortiClient Cloud instance for licensing and provisioning endpoints.

Does FortiSASE support IPv6?

Fortinet's FortiSASE release notes list a limitation that FortiClient blocks IPv6 traffic and only IPv4 traffic traverses the FortiSASE tunnel. Teams with IPv6 requirements should validate their use cases before rollout. dope.security inspects traffic on the device rather than tunneling it to a PoP.

How is FortiSASE licensed?

Fortinet describes FortiSASE licensing as user-based, with a minimum order of 50 users, and supports FortiFlex entitlements. Some capabilities, such as dedicated public IP addresses, require an additional license. Check the ordering guide for which features your tier includes.

Can FortiSASE block personal ChatGPT accounts?

Fortinet lists GenAI usage controls in its Secure Browser extension and offers inline CASB and DLP in the platform, so validate the exact corporate-versus-personal tenant policy you need in a proof of concept. dope.security Cloud Application Control blocks personal ChatGPT, Claude, Google, and Microsoft 365 logins on the device while allowing corporate tenants, and Dopamine DLP inspects prompts before they leave.

What is the best FortiSASE alternative?

For organizations whose main goal is protecting laptops that work anywhere, rather than rebuilding the WAN, dope.security is a strong alternative. It runs an on-device SSL inspection proxy with no PoPs in the data path, Cloud Application Control for AI tenants, and Dopamine DLP, all under one console, and it can run alongside FortiClient VPN for private access.