Zenarmor vs Fortinet FortiGate: an honest FortiGate alternative for SMEs

Short answer: choose Zenarmor if you want to pay per user, protect home workers and mobile devices outside the office, reuse existing hardware or virtualisation, and keep reporting on-premises or in a Dutch or German cloud region. Stay with Fortinet FortiGate if you need multi-gigabit inspection on purpose-built hardware, mature SD-WAN or a full Fortinet Security Fabric (FortiSwitch, FortiAP, FortiAnalyzer). For a single small site without remote users, a FortiGate bundle is often cheaper at list price; with hybrid work, several sites and a partner discount, the three-year sum can tip the other way.

Secrotec is an independent ISO 27001 Lead Auditor and the official Zenarmor partner in the Netherlands (listed on Zenarmor's partner directory). We deliver Zenarmor licences and projects across Europe and configure the platform so that it produces the evidence an auditor expects to see. This comparison shows where FortiGate is strong, where Zenarmor makes the difference and how to put three-year costs side by side fairly. All prices are indicative (October 2026, excl. VAT, reseller prices vary) and linked to a source.

Zenarmor vs FortiGate at a glance

The key difference is architecture. Zenarmor is a security engine (next-generation firewall, secure web gateway, SSE and ZTNA) that runs as software: as a plugin on OPNsense or pfSense CE, on Linux, in Docker, or as an agent on Windows, macOS, Linux, Android and iOS. Everything is managed centrally in Zenconsole. FortiGate is an appliance built around Fortinet's own security processors, extended with per-device FortiGuard subscriptions and separate products such as FortiClient EMS, FortiManager and FortiAnalyzer.

Criterion	Zenarmor	Fortinet FortiGate
Architecture	Software on your own x86 hardware, VM (Proxmox, Hyper-V, VMware), cloud or Deciso appliance, plus endpoint agents	Proprietary appliance with Fortinet security processors (ASIC/SoC); also available as FortiGate-VM
Licensing model	Per user per month (min. 10); first site included, each extra site +$50/month	Per appliance: hardware + yearly FortiGuard bundle (e.g. UTP); FortiClient EMS per endpoint (min. 25)
Application control	5,000+ applications, dynamically updated app database	FortiGuard Application Control (in the bundles)
Web filtering	300+ million websites in 120+ categories, Safe Search and YouTube Restricted Mode	FortiGuard Web Filtering (UTP bundle and up)
TLS inspection	Lightweight (certificate-based) and full; add-on on Unified Secure, included in Unified Secure Plus	SSL/TLS deep inspection; throughput depends on the model
Threat intelligence	Cloud threat intelligence, IPS, DNS deep inspection, Essential and Advanced security rules	FortiGuard Labs: IPS, antivirus, outbreak prevention
Remote users / ZTNA	Endpoint agents, encrypted mesh VPN, ZTNA with device posture checks	IPsec VPN (SSL VPN tunnel mode dropped from FortiOS 7.6.3); ZTNA via FortiClient EMS licence
SSE / CASB	Cloud Access Rules (block upload, share, delete) from the SSE plan up; no content-aware DLP (roadmap)	CASB/DLP in higher bundles; cloud SSE via FortiSASE (separate product)
Central management	Zenconsole: cloud, multi-tenant, policy import, audit trail	FortiManager or FortiGate Cloud (licensed separately)
Reporting and data residency	Local (Elasticsearch/SQLite), streaming to SIEM/Syslog, or cloud reporting with a Netherlands or Germany region	Local logs (model-dependent), FortiAnalyzer or Fortinet cloud services
High availability	Gateway HA on OPNsense (from Unified Secure)	Mature HA clustering; second appliance with licences required
When the licence expires	OPNsense firewall, routing and VPN keep running (open source); paid Zenarmor features need a valid licence	Firewall and VPN keep working; no new signatures, cloud web filter drops all web traffic by default, outbreak prevention stops
Hardware lock-in	None: per-user licence, platform can be changed freely	Subscriptions tied to the appliance serial number
SD-WAN	Mostly on the roadmap	Mature and built in
Indicative price	From $5.00 per user/month (Unified Secure), $9.00 (Unified Secure Plus)	40F + 1-year UTP ≈ €1,180; 60F + 1-year UTP ≈ €1,050–1,417; 60F UTP renewal ≈ £403–460 per year

Sources: Zenarmor plans and documentation; Fortinet bundles and prices via Software Express and TNP; licence behaviour per the Fortinet Community. Status October 2026.

Security features compared

Application control and web filtering

On paper, both are on a par here: each recognises thousands of applications and categorises websites through a cloud database. Zenarmor cites more than 5,000 applications and over 300 million websites in 120+ categories, with ready-made profiles (Permissive, Moderate, High) and enforcement of Safe Search and YouTube Restricted Mode. The practical difference is granularity: Zenarmor ties policy to interface, VLAN, device category, IP, MAC, user, group and time schedule, using identities from Entra ID, Google Workspace, Okta or SAML 2.0. Read more in our articles on application control and the Zenarmor web filter.

TLS inspection

Without TLS inspection, no firewall can see inside encrypted traffic. Zenarmor offers a lightweight, certificate-based mode and full inspection (decrypt/re-encrypt), with a bypass list of 80+ predefined exceptions for categories such as banking and healthcare. FortiGate also provides deep inspection; there, the hardware model determines how much inspected throughput you get. Bear in mind that in the EU, TLS inspection touches the GDPR and, in many countries, employee-representation rights. See TLS inspection with Zenarmor.

Remote workers, remote access and ZTNA

This is where the two differ most. A FortiGate protects traffic that passes through the appliance; for home workers you use remote-access VPN or ZTNA. From FortiOS 7.6.3, Fortinet replaced SSL VPN tunnel mode with IPsec VPN; existing tunnel-mode configurations are not upgraded and must be migrated before the upgrade (Fortinet documentation). ZTNA with posture checks requires a FortiClient EMS licence, per endpoint, with a minimum of 25 licences (Fortinet EMS licensing).

Zenarmor takes the policy to the device itself. Endpoint agents for Windows, macOS, Linux, Android and iOS enforce the same web, app and security policy on hotel Wi-Fi as in the office, and can be rolled out through Intune or Jamf. Unified Secure includes 5 endpoint and 5 mesh agents; Unified Secure Plus includes 2 agents per user (phone or tablet included) and mesh VPN for site-to-site connectivity across up to 20 sites. If you have to rebuild remote access anyway, now is the moment to compare.

Performance: the honest story about ASICs

FortiGate has a genuine advantage here: its own security processors. Fortinet quotes threat-protection throughput of 600 Mbps for the 40F and 700 Mbps for the 60F (Fortinet). Zenarmor runs on standard CPUs and scales with the hardware: its hardware guidance cites around 300 Mbps for 0–50 devices on modest hardware and 1–2 Gbps for 250–1,000 devices with 16 GB RAM. Since version 2.7, Zenarmor supports multi-core 10G processing on OPNsense (Business and higher, see the release notes). For most SME connections up to 1 Gbps that is plenty; for multi-gigabit inspection with minimal hardware, FortiGate is stronger.

Management, reporting and data residency

Zenarmor is managed through Zenconsole: one cloud portal for gateways and endpoint agents, multi-tenant for MSPs, with policy import, backup and an audit trail of changes. Reporting can stay entirely local (Elasticsearch or SQLite), be streamed to your own SIEM or Syslog, or be stored in the Zenarmor cloud in a region of your choice, including the Netherlands and Germany. Zenarmor cites 60+ built-in reports. More on multi-site management: Zenconsole central management.

A single FortiGate is easy to manage through its own web interface. Central management and long-term log retention run through FortiManager, FortiAnalyzer or FortiGate Cloud, each licensed separately. Zenarmor's own comparison frames this as "one app, one stack, one console" versus several Fortinet products. That is a vendor claim, so check in your own quote which of those products you actually need.

Licensing and cost: what do you pay over three years?

Fortinet charges per appliance: hardware plus a yearly FortiGuard bundle, optionally with FortiClient EMS, FortiManager and FortiAnalyzer. Zenarmor charges per user per month; one user licence covers two actively used devices, and printers, cameras and IoT are not counted. Add the platform: OPNsense Community Edition is free, the Business Edition costs €149 per year, and Deciso appliances start at €978 (DEC740), or you reuse existing hardware or a VM (OPNsense shop).

Zenarmor plan	10–49 users	50–99 users	100–150 users	Key contents
Unified Secure	$5.00	$4.50	$4.00	NGFW, IPS, app and web filtering, DNS deep inspection, 5 endpoint + 5 mesh agents, gateway HA, 15-day retention; TLS add-on $3 per user/month
Unified Secure Plus	$9.00	$8.50	$8.00	Everything in Unified Secure + full TLS inspection, 2 agents per user, mesh VPN up to 20 sites, 30-day retention
SSE / ZTNA / SASE	On request			CASB, posture checks, 90-day retention, custom data residency

Zenarmor list prices in USD per user per month, excl. VAT, October 2026, subject to change. Zenarmor's own prepay discounts: −15% (1 year), −25% (3 years), −35% (5 years). Extra site: $50 per month (up to 20 sites). Above 150 users or 20 sites: quote.

Example 1: around 25 users, one site

Cost item (3 years)	Zenarmor Unified Secure	FortiGate 60F + UTP
Licences / subscription	25 × $5.00 × 36 = $4,500; with 3-year prepay $3,375	Year 1 bundle €1,050–1,417 + 2 × renewal £403–460
Hardware	€0 (existing hardware or VM) or DEC740 €978	Included in the year-1 bundle
Platform	OPNsense CE €0 or Business Edition 3 × €149 = €447	—
Remote workers	5 endpoint + 5 mesh agents included	IPsec VPN; ZTNA via FortiClient EMS (min. 25 endpoints, price via reseller)
Indicative total	$3,375 up to $3,375 + €1,425	Approx. €2,000–2,500 (converted, without EMS)

To be fair: for one small site without remote workers, the FortiGate bundle is cheaper at list price. The picture changes if you want to protect more than five home workers with agents (Unified Secure Plus is then the logical choice: 25 × $9.00 × 36 = $8,100, or $6,075 with a 3-year prepay), if you need full TLS inspection and 30-day retention, or if you want ZTNA with posture checks without separate endpoint licences. Hardware reuse and the partner discount via Secrotec narrow the gap further.

Example 2: around 100 users, three sites, hybrid work

Cost item (3 years)	Zenarmor	Fortinet
Subscription	Unified Secure: (100 × $4.00 + 2 × $50) × 36 = $18,000, approx. $13,500 with prepay. Unified Secure Plus: (100 × $8.00 + 2 × $50) × 36 = $32,400, approx. $24,300 with prepay	Two branches with a 60F-class unit: 2 × (€1,050–1,417 + 2 × £403–460); head office usually a larger model, price on request
Hardware	Reuse or VM €0, or DEC850 €1,648 + 2 × DEC740 €978	In the year-1 bundles
HA at head office	Second gateway (hardware or VM); HA is part of the licence	Second appliance with its own licences
Remote workers / ZTNA	Plus: 2 agents per user and mesh VPN included	FortiClient EMS for approx. 100 endpoints (price on request)
Central management and logging	Zenconsole and 15/30-day retention included; local or SIEM possible	FortiManager/FortiAnalyzer or FortiGate Cloud (separate)

At this size, the boxes are not what decides the difference; the extra components are: ZTNA for 100 endpoints, central logging, HA and the larger head-office model. Ask for those lines explicitly in your Fortinet quote so that a fair comparison is possible. If home workers connect via a VPN to the office (OPNsense supports WireGuard, IPsec and OpenVPN at no extra cost), Unified Secure is often sufficient. The prepay figures assume Zenarmor's discount applies to the whole subscription; a quote through Secrotec also includes a partner discount.

What happens when the licence expires?

According to the Fortinet Community, firewall and VPN keep working on a FortiGate when FortiGuard licences expire, but IPS, antivirus and application definitions are no longer updated. Web filtering based on FortiGuard categories then drops all web traffic by default, and outbreak prevention stops. With Zenarmor, the open-source OPNsense firewall, routing and VPN keep running; the paid Zenarmor functions, such as L7 filtering, TLS inspection and agents, require an active licence. Either way: plan renewals in good time. That is simply an ISO 27001 control as well.

Compliance: evidence for ISO 27001, NIS2 and TISAX

A firewall does not make you compliant; it produces evidence. Both FortiGate and Zenarmor can support ISO 27001:2022 Annex A controls such as A.8.20 (network security), A.8.22 (segregation of networks), A.8.23 (web filtering), A.8.15 (logging) and A.8.16 (monitoring activities). The same applies to the risk-management measures in NIS2 Article 21 and national laws such as the Dutch Cyberbeveiligingswet, in force since 15 August 2026 (see ISO 27001 and NIS2).

The difference lies in the configuration. Secrotec is both auditor and implementer: we configure Zenarmor so that policies, network segmentation, logging and reports map directly onto your Statement of Applicability. For automotive suppliers, we support TISAX® readiness (gap review against VDA ISA, self-assessment, implementing controls); the assessment itself is performed by an ENX-approved audit provider. Read more about reporting as evidence for NIS2 and ISO 27001 and TISAX and network security, or plan an ISO 27001 audit.

When is FortiGate the better choice?

• You need multi-gigabit throughput with full inspection and want to achieve it with as little hardware as possible.
• SD-WAN is core functionality for you: it is mature at Fortinet and largely on the roadmap at Zenarmor.
• You already run a Fortinet Security Fabric with FortiSwitch, FortiAP and FortiAnalyzer, and your team knows FortiOS well.
• You have a single small site without remote workers and are looking purely for the lowest list price.
• Your FortiGuard subscription has just been prepaid for several years.

When is Zenarmor the better choice?

• Your staff work hybrid and you want the same policy in the office, at home and on the road, with agents instead of tunnels back to the office.
• You want no hardware lock-in: run on existing servers, Proxmox, Hyper-V or VMware, and switch later without buying a new licence.
• You manage several sites or customers (MSP) and want a single multi-tenant console.
• You want to keep reporting on-premises or in a Dutch or German cloud region for GDPR and data-sovereignty reasons.
• You want control over cloud actions, such as blocking uploads to WeTransfer; see SSE, CASB and DLP.
• You want predictable per-user costs and a partner who also makes the configuration audit-ready.

Want to learn more about the platform first? See how Zenarmor goes beyond NGFW with SSE, ZTNA and CASB.

Partner discount via Secrotec: send us your FortiGate renewal quote

As the official Zenarmor partner in the Netherlands, we supply licences based on the list prices above, with a partner discount. In Zenarmor projects the price is always negotiable. Do you have a FortiGate or FortiGuard renewal quote on your desk? Send it to us. We will prepare a fair side-by-side comparison: the same users, sites, remote workers and retention, with a clear 3-year TCO. If the comparison favours your FortiGate, we will tell you that too.

Request a quote with partner discount, see the full Zenarmor price comparison or compare with WatchGuard and Cisco Meraki. Prefer to hand it all over? Our managed firewall service combines Zenarmor with management and monitoring.

Fortinet, FortiGate, FortiGuard, FortiOS, FortiClient, FortiManager, FortiAnalyzer and FortiSASE are trademarks of Fortinet, Inc. Zenarmor is a trademark of Sunny Valley Cyber Security Inc. OPNsense is a trademark of Deciso B.V. All prices are indicative, October 2026, excl. VAT; reseller prices and exchange rates vary. This comparison is based on public sources linked in the text and is not a statement by Fortinet or Zenarmor.