1) Organizations that require a pure cloud-delivered security edge for remote users (SSE-first)
- If the primary use case is securing roaming users and SaaS access rather than deploying hub/firewall infrastructure, dedicated FWaaS/SSE vendors may be more directly aligned.
2) Organizations that cannot tolerate firmware churn risk
- If the organization requires very conservative change control or LTS-like release guarantees, consider architectures or vendors that support stricter versioning and longer-term maintenance trains.
3) Organizations where support experience is the top purchasing criterion and previous TAC outcomes have been poor
- If historical TAC or support results cannot be mitigated via an elevated support contract or managed services, consider alternatives.
4) Organizations needing simple licensing and predictable renewals
- Consumption licensing and Fortinet’s bundle model can complicate forecasting; organizations sensitive to licensing complexity should evaluate contract protections carefully.
5) Organizations that require on-premises hardware control for regulatory or sovereignty reasons
- FGaaS is hosted by Fortinet-managed data centers; organizations requiring customer-controlled facilities will likely prefer on-premises appliances or sovereign-cloud arrangements.
1) Limited FGaaS-specific public review coverage
- Most public reviews relate to FortiGate appliances and virtual appliances rather than FGaaS. This makes it harder to validate portal maturity, billing and points governance, and incident handling for the hosted model.
2) Licensing complexity and entitlement drift risk
- Community feedback and reviewer accounts indicate frustration when cloud features or log retention are moved between tiers. Buyers should secure contractual feature entitlements, notice periods for changes, and clear renewal terms.
3) Support variability and escalation concerns
- Reviewer snippets describe variability in TAC responsiveness. For FGaaS, verify SLA-backed support response times, escalation paths, maintenance windows, and outage communication processes.
4) Security posture depends on configuration and exposure
- Public reporting has highlighted campaigns targeting internet-exposed FortiGate devices. Regardless of delivery model, enforce MFA for remote access, credential hygiene, prompt patching, and minimal exposure of management interfaces.