FortiGate subscriptions and FortiGuard bundles are designed to help you rethink how you protect your full attack surface – from the network and web traffic to SaaS apps, data, and IoT/OT devices.

They focus on a broad set of threats, including:

• Ransomware and malware (known and unknown)
• Zero-day threats and previously unseen attacks
• Emerging AI-based threats, including promptware and data exfiltration attempts

Key capabilities you get through the bundles include:

• Network & file security: IPS monitors traffic and uses AI/ML for real-time detection and virtual patching, while antimalware provides multilayered protection with threat intelligence and heuristic AV.
• Web & DNS security: URL and DNS filtering block malicious sites and web-based threats, check email links, and enforce internet use policies. IP reputation and anti-botnet services help stop C2 traffic and DDoS from known sources.
• Data & SaaS security: Network DLP gives visibility into data in transit and helps prevent data loss. Inline CASB secures SaaS usage with granular control over access, usage, and data.
• Attack surface visibility & compliance: The Attack Surface Security Service continuously monitors your Fortinet Security Fabric, scores your security posture, and provides remediation guidance. It also discovers and segments IoT devices to reduce risk.
• Zero-day protection: All NGFWs support zero-day protection. Inline Malware Prevention (ILMPS) can be included via the Enterprise bundle or a la carte, delivering sub-second verdicts on unknown files and zero-day threats.

On top of threat prevention, these services also support real-time NOC and SOC operations, helping your team investigate faster with tools like a built-in MITRE ATT&CK matrix and cloud-based analytics.

In short, FortiGate subscriptions and FortiGuard bundles help you reimagine your security stack as an integrated service layer that covers prevention, visibility, and response across network, web, data, SaaS, IoT, and OT.

Fortinet organizes FortiGuard services into curated bundles so you can match coverage to your risk profile and budget, instead of buying everything a la carte.

The three primary bundles are:

• ENT (Enterprise) bundle
  Designed for organizations that want comprehensive attack surface security. It includes core network, web, DNS, data, SaaS, and advanced zero-day capabilities like Inline Malware Prevention (ILMPS), plus services that enhance NOC/SOC operations and posture management.
• UTP (Unified Threat Protection) bundle
  Focused on essential web and network defense. It includes core elements like IPS, antimalware, application control, URL/DNS filtering, and cloud-based sandboxing for zero-day detection. It’s a good fit when you need strong perimeter and web security without the full Enterprise feature set.
• ATP (Advanced Threat Protection) bundle
  Positioned as a first line of defense against advanced threats. It includes zero-day threat detection via cloud-based sandbox services and core threat prevention, making it suitable when your priority is to strengthen malware and zero-day defenses.

How to decide:

1. Map your attack surface – Use the “attack surface pyramid” concept: identify which layers (network, web, SaaS, data, IoT/OT) matter most to your business.
2. Align to risk and compliance – If you have strict compliance requirements or a broad digital footprint, the ENT bundle usually aligns better because it includes posture scoring, remediation guidance, and broader coverage.
3. Start with core controls – If you’re primarily focused on web and network threats, UTP can be a pragmatic starting point.
4. Prioritize advanced threat defense – If zero-day and advanced malware are your top concerns, ATP plus sandboxing may be the right fit.

All bundles include FortiCare Premium Technical Support (24x7x365), and you can always add individual services a la carte if you need to fine-tune coverage.

The commercial model is designed to be straightforward and flexible. You can think of it in three steps: new order, renew, and add-on.

1. New orders

When you’re deploying a new FortiGate, you typically choose one of these options:

• Hardware + bundle: Purchase the FortiGate appliance together with a bundle (e.g., Enterprise, UTP, ATP). This gives you FortiCare support and FortiGuard services in a single SKU.
• Hardware only: Buy the device a la carte and then add FortiCare and the specific FortiGuard services or bundles you want.

2. Renewing services

When your contract is nearing expiration, you can:

• Renew as a bundle (e.g., Enterprise bundle renewal), or
• Renew individual services a la carte if you want to adjust coverage.

Renewals are applied to the device under your FortiCare account, and service periods are extended based on the contract you purchase. If you use a FortiCare quote ID generated by a distributor, renewal services are automatically registered to the correct serial number.

3. Adding services to an existing unit

If you already own a FortiGate and want to expand capabilities (for example, adding web security, OT security, or AI-based Inline Malware Prevention), you can:

• Purchase additional bundles (where applicable), or
• Add specific services a la carte such as FortiGate Cloud, FortiAnalyzer Cloud, Managed FortiGate, SOC-as-a-service, OT Security, or Web Security.

Many customers choose to align end dates so that all services on a device renew together, simplifying contract management.

For certain models (e.g., FortiGate 60F), Fortinet also offers predefined hardware-and-service SKUs (such as “FG-60F plus Enterprise Bundle” or “FG-60F plus UTP Bundle”) to streamline ordering. You can then add options like FortiDeploy for zero-touch provisioning or FortiAnalyzer Cloud storage top-ups as needed.