We're a mid-sized healthcare clinic (around 250 users, mix of on-site and remote) finally modernizing our security stack. Our legacy VPN is a constant headache for clinicians trying to access EHR and imaging systems remotely, and our compliance team is rightfully pushing for better, more unified visibility and control.
I've been deep in evaluating cloud security gateways, and FortiSASE is on our shortlist. The tight integration with Fortinet's firewall ecosystem is a big plus for us, as we already run FortiGate at our edge. However, I'm coming from a data engineering background, so my lens is a bit different. I'm thinking about this like a data pipeline: traffic needs to be routed, transformed (inspected), and logged with high fidelity and quality.
My specific questions for this community:
* **Logging & Data Quality:** How granular and queryable are the connection/security logs? Can you easily pipe them into a SIEM or, in my case, a data warehouse (BigQuery/Snowflake) for custom compliance reporting? Are the schemas consistent?
* **Performance for Clinical Apps:** Has anyone measured latency impact on real-time applications like VDI or medical imaging viewers? We can't afford added lag.
* **Policy Management:** How flexible is the policy engine for defining context-aware rules (e.g., "User Role = Clinician" + "Device Compliant" + "Accessing EHR") without creating a spaghetti rule-set?
* **The "SD-WAN" Piece:** For a mostly cloud/SaaS setup (we use Azure heavily), is the SD-WAN functionality actually valuable, or is it overkill?
I'm less interested in marketing sheets and more in operational realities. What's the actual day-to-day like? Any pitfalls during deployment, especially around split-tunneling for sensitive healthcare systems? Budget is a factor, but security and compliance are non-negotiable.
Senior security engineer at a 250-employee orthopedic practice. We run FortiGate firewalls and replaced our old VPN with FortiSASE about 18 months ago for our hybrid workforce.
* **Logging Granularity:** Logs are detailed but rigid. You get all the security event and traffic data, but the schema is fixed. Pushing to a SIEM (we use Splunk Cloud) is straightforward via their built-in connector. For BigQuery, you'd need to route through a cloud function or similar tool to transform; it's not a native, elegant pipeline.
* **Clinical App Performance:** Measured latency for our Epic Hyperspace VDI and PACS image viewers. We saw a consistent 15-25ms add for Eastern US users vs. our old VPN. It's acceptable, but not invisible. The biggest win was reliable connection persistence.
* **Real Cost:** List is around $7.50/user/month for the full ZTNA/SSE bundle. Our actual cost after a 2-year commit and partner discount was $4.80. Watch for the CASB add-on, which is another ~$2/user, and the required FortiCare support on your underlying FortiGate licenses.
* **Where It Breaks:** The "tight integration" is a double-edged sword. Configuring complex ZTNA rules for internal apps sometimes requires mirroring policies in both the FortiGate *and* the SASE portal. It creates a single point of truth failure that has bitten us during audits.
I'd pick FortiSASE if you're already a Fortinet shop and your primary goal is replacing that VPN headache with something more secure that's managed from a familiar console. If your bigger need is that clean, queryable data pipeline for custom reporting, you should also look at Zscaler Private Access and tell us what your budget and in-house security team size are.
Trust but verify.