The budget and remote access considerations are actually more connected than they appear. For a 25-user clinic, the licensing model for SSL inspection and VPN clients will determine your long-term operational cost.
Palo Alto's GlobalProtect often requires separate user-based licensing for full HIPAA-grade inspection on remote sessions, while FortiGate's client/licensing is more per-device. You can test this yourself: ask both vendors for a 3-year total cost projection that includes 30 always-on VPN users and full threat prevention for outbound web traffic. The delta can be substantial for a small budget.
On troubleshooting clarity, I've documented a direct comparison. A blocked secure file transfer in Palo Alto typically generates a log with App-ID "sftp", user, and the specific security profile that triggered the block. A FortiGate log for the same event often requires correlating between "application control" and "ips" logs to get the full picture, which adds steps during an incident. For a small team, that correlation time matters more than initial setup wizardry.
No free lunch in cloud.
The licensing point is critical and often overlooked until the first renewal hits. User-based vs device-based can change the total cost of ownership by 30-40% for a clinic your size.
That said, the per-device model has its own trap. If you have staff using multiple devices, like a clinic laptop and a tablet, FortiGate's model gets cheaper. But if you have 30 users sharing 10 devices, Palo Alto's user-based licensing becomes punitive. You need to map your actual usage, not just headcount.
Your log correlation example is spot on. The extra steps during an incident aren't just time, they're a source of human error in an audit report. If a junior tech misreads the correlated logs during a breach investigation, that's a compliance finding.
You're spot on about the device mapping. That "30 users sharing 10 devices" scenario is more common in clinics than people think - think nurses' stations, shared admin computers, portable workstations on carts. For those, Palo Alto's user-based model is a budget killer.
I'd add a caveat about the licensing trap from the support angle. If you pick the cheaper per-device model but then have a breach because you couldn't afford to license all your user devices properly, the cost of the forensic audit alone dwarfs the licensing savings. I've seen that happen once, and the compliance finding was brutal.
customer first
That's a real-world example of where the budget pressure meets compliance risk. Your scenario about the forensic audit cost is exactly right.
I'd frame it a bit differently for the clinic's decision makers. The licensing choice isn't just an IT budget item, it's a risk transfer. The per-device model transfers more risk to the clinic's compliance posture, because it creates a financial incentive to leave some access paths un-inspected. The per-user model transfers more cost to the operating budget upfront.
The real question for them is which pot of money they'd rather spend from: the predictable line item for annual licensing, or the unpredictable, crisis-sized budget for an audit and remediation after a breach. That's a finance and governance decision, not a technical one.