FortiGate vs Sophos XG - which is better for a small MSP with 50 clients?

I'm a founding engineer at an MSP serving about 60 clients, mostly healthcare and professional services. We migrated everything off Cisco ASAs and pfSense boxes five years ago and have run both FortiGate and Sophos XG in production across our client base.

* **Multi-Tenant Management:** FortiManager is the actual product. For 50 clients, the ADOM structure lets you silo configs and push standardized policy updates in about 10 minutes. Sophos Central Firewall Manager is simpler but becomes a scrolling nightmare after 30 devices; policy search and bulk changes are clumsy. The operational time difference is real, about 2-3 hours saved weekly per engineer.
* **Real Total Cost:** FortiGate's sticker shock is upfront. A hardware+UTM bundle for a 50-user office runs ~$2,500-$3,500 for the box and ~$1,200/yr in FortiCare and UTM subs. Sophos hardware is cheaper for the specs (often 30% less), but their subscription model is where they get you. Full guard licensing (AV, web, IPS, etc.) per user ends up around $5-7/user/year at our scale, which for a 50-user client adds $250-$350 annually on top of the base support. Over 3 years, the TCO difference shrinks to within 10-15%, with Fortinet usually ending up slightly more expensive.
* **API and Automation Depth:** FortiGate's REST API lets you do everything from a script, including pulling formatted logs. I've automated client onboarding (VLANs, policies, VPN users) down to a 15-minute Terraform run. Sophos's API is HTTP-based but feels like an afterthought for core config; you'll still need the GUI for certain SD-WAN or VPN settings. Their webhook system for alerts is good, but for config-as-code, Fortinet is ahead.
* **Where They Break:** FortiGate's logging, especially to FortiAnalyzer, is immense but the SQL-like query language has a steep curve. Simple "who accessed this?" queries can take 5 minutes to build. Sophos XG's application control and web filtering are easier for junior techs to tune, but the stateful inspection engine chokes on specific high-throughput scenarios (like a client's large offsite backups) unless you oversize the appliance by one model, negating the cost advantage.

I'd pick FortiGate for your scale, but only if your team is willing to learn its ecosystem quirks. The management overhead reduction at 50 devices is the deciding factor. If your primary constraint is absolute upfront capital cost and your clients have simple, predictable traffic patterns, Sophos is defensible. Tell us your average client device count and whether you have a dedicated network engineer, and I could give a blunter answer.

This is really helpful, thanks. The operational time difference you mentioned is huge. I work for a nonprofit, and we have to track staff hours very carefully for grants.

When you say the 3-year TCO difference shrinks to 10-15%, does that calculation include the engineer time savings from FortiManager? It sounds like that could actually make Fortinet cheaper over time, even with the higher upfront cost.

Yeah, the operational math is what sealed it for us. We built a simple spreadsheet to track that exact thing - "time to deploy a standard security policy update" across ten pilot clients.

With FortiManager, it was under 15 minutes. With the Sophos Central Firewall Manager, it took us over an hour due to the manual per-device work and occasional sync hiccups. When you scale that out across 50 clients and multiply by the number of policy changes per year, the labor cost alone tipped the scales for Fortinet, even with their higher initial quotes.

One caveat, though: that FortiManager efficiency assumes you've put in the upfront work to build solid templates and groups. If you're just managing each ADOM as a one-off, you lose most of the benefit. It's a bit of an investment to get your config framework right.

It absolutely should, but in my experience, that's the part most MSPs miss when running the numbers. They just compare the line items from the quotes.

Your point about grants is key, though, because that time tracking forces you to account for it. For us, those weekly hours saved on policy pushes and firmware compliance checks added up to over 100 engineer-hours a year. At 50 clients, that easily covered the licensing delta.

The hidden trap, as user901 hinted, is that initial configuration debt. If you don't standardize your FortiManager ADOMs and object groups from day one, you won't capture those savings. It's a discipline tax.

Your cost breakdown is accurate, but it hinges on a massive assumption: that every client fits the 50-user box. The minute you get a 10-person dentist office or a 200-person manufacturing client, that tidy per-user math for Sophos and the standardized hardware bundle for Fortinet both go out the window. The real TCO killer for an MSP isn't the per-device cost, it's the sprawl of different models and licensing tiers you have to support.

That operational time you save with FortiManager can evaporate if you're constantly building unique ADOMs for oddball client sizes instead of using templates. The discipline tax is real, but so is the client diversity tax.

> Their REST API is fairly comprehensive

It is, but the real automation win for us was using FortiManager's API as the control plane instead of hitting individual firewalls. You can use Terraform with the FortiManager provider to define your ADOMs, policy packages, and even device registrations as code. That's how we enforce the standardization everyone's talking about - it's baked into the repo.

One heads up though: The FortiManager API has some quirks with version upgrades. We learned to pin our provider version and have a staging ADOM to test any API changes before rolling out to clients. Saved us from a few broken syncs on a Friday afternoon 😅

Did you look into how you'd handle config drift? That's where the time saving can disappear if you're not careful.

> Their REST API is fairly comprehensive, allowing for custom dashboards and alert routing

Absolutely, and that's been a lifesaver for some of our more demanding clients who need custom reporting. But I have to echo the later point about FortiManager's API being the real key for scale. Where the rubber meets the road for us was automating new client onboarding.

We wrote a Python script that uses the FortiManager API to spin up a new ADOM, apply our base policy package, and register the FortiGate by serial number - all from a CSV upload. It cut a 2-hour manual process down to about 10 minutes. The API's ability to handle the entire deployment workflow is what makes the multi-tenant model actually sustainable.

One little snag we hit, though: the API's behavior around policy reordering can be weird. If you're doing a lot of programmatic inserts, you sometimes have to explicitly set the `policyid` to avoid a cascading renumber that briefly opens unintended holes. Just something to test for in your automation.

Spot on with using the FortiManager API as the control plane, that's absolutely the way to scale. We tried Terraform for a bit, but honestly, we found the provider lagged too far behind the FortiOS releases for our comfort. We've since moved to managing our configs as Python dictionaries and using the REST API directly with a simple wrapper library that handles the authentication quirks.

Your point about config drift is the killer. That's where the initial time investment in templates pays off, or bites you. We built a nightly script that uses the API to pull a config snapshot from each ADOM, diffs it against our golden templates, and sends a Slack alert if there's manual drift. It's the only way we can confidently push mass updates, knowing nothing's been tweaked locally on a device.