SECURITY ATLAS / EVALUATION BRIEF FortiSASE Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/fortinet-fortisase/ THE ATLAS TAKE FortiSASE belongs on the evaluation list for teams extending Fortinet-oriented operations to remote internet and private application access. Its appeal should be tested in the actual client and private-connectivity architecture, rather than inferred from an existing FortiGate deployment. Atlas would make policy-update behavior a visible acceptance criterion: administrators need to know when a changed rule affects a connected user. The scoped baseline includes Secure Internet Access and Secure Private Access, while branch networking, SaaS APIs and browser capabilities need their own requirements and commercial confirmation. SCOPE The scored scope selects Secure Internet Access and Secure Private Access for managed remote users, with the required FortiClient and SPA connectivity. Branch SD-WAN, optional SaaS API features and browser isolation receive no credit in this baseline. WORTH A LOOK WHEN Fortinet-oriented teams with managed endpoints and an explicit private-application connectivity design. THINK TWICE WHEN The rollout assumes cloud and on-premises policies have identical application timing and prerequisites. IMPLEMENTATION 1. Fix the connection design Record the user client, connection mode, identity provider and private-access component versions. 2. Test effective policy timing Change a safe restriction during an active lab session and document any reconnect required. 3. Design diagnostic ownership Join client, cloud policy and private-application evidence; retain a recovery path for mistaken access restrictions. OPERATING REALITY FortiClient rollout, identity integration and private-access connectivity need coordinated ownership. Operators should maintain a release-specific policy test because connection type can affect when changes apply. Cloud logs, client diagnostics and application evidence need to be available together so the help desk can distinguish stale sessions from a wrong rule. COMMERCIAL CONSIDERATIONS Compare the selected FortiSASE package and user scope with required private-access infrastructure. Separate branch, endpoint and optional inspection additions from the scoped remote-user baseline. - User subscriptions and selected package - Private-access infrastructure and regional topology - Client rollout, release maintenance and diagnostics EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Complete a dependency-rich private application workflow Acceptance evidence: Retain connection mode, policy and destination evidence. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Change a test rule during an active session Acceptance evidence: Measure enforcement timing before and after reconnect. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Fail a private-access lab component Acceptance evidence: Verify visible failure, recovery ownership and restored least-privilege access. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - When do policy changes affect already connected agents? - Which SPA connectivity option and versions are required? - Will log rotation remove evidence before the desired investigation window? EVIDENCE GAPS - Atlas has not measured latency, availability or threat-prevention efficacy. - Some public Fortinet docs were available through indexed text only; verify the full current guide before deployment. SOURCES FortiSASE service overview (Product information) https://www.fortinet.com/products/sase FortiSASE private-access architecture (Documentation) https://docs.fortinet.com/document/fortisase/26.1.107/secure-private-access-architecture-guide/891466 FortiSASE policy behavior (Product information) https://docs2.fortinet.com/document/fortisase/latest/mature-administration-guide/525953/policies FortiSASE secure internet access solution brief (Product information) https://www.fortinet.com/content/dam/fortinet/assets/solution-guides/sb-fortisase-remote-internet-access.pdf Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.