Breaking: Price increase notification just received. Looking at alternatives.

Yep, got the same email. It's a tough spot, especially when you're newer to managing the stack.

For our SMB setup, we actually moved to FortiGate a couple years back after a similar price hike from another vendor. The transition wasn't too painful, and their VPN for remote staff has been solid. The admin interface feels a bit more intuitive to me than Sophos, but that might just be personal preference.

Have you looked at any of the cloud-first options like Palo Alto's Prisma Access? The operational cost model is different, but it can be simpler for remote access.

Price hikes are always a catalyst for reviewing the total cost of ownership, which goes beyond the license sticker shock. While FortiGate is a viable on-prem alternative, the real analysis for an SMB should center on operational burden and feature utilization.

You mentioned basic internet security and VPN. If that's truly the extent of your needs, migrating to a cloud-based secure web gateway and a separate, modern zero-trust VPN (like Zscaler, Twingate, or even Cloudflare Zero Trust) can often be cheaper than appliance renewal when you factor in power, admin time, and future hardware refreshes. You're trading capex for opes, but the opes can be significantly lower.

Before you commit to another hardware platform, do an audit of what percentage of your Sophos feature set you actually use. You might be paying for a suite when you only need a few discrete services.

This is such a crucial point. The audit idea is spot on. I did this exercise with a previous CRM and discovered we were paying for complex marketing automation when we really just needed email templates and a pipeline view. It felt silly once we saw it.

A big caveat for SMBs splitting services is the integration tax. Using a cloud gateway from one vendor and a ZTNA solution from another can work, but you'll spend more time making them talk for reporting or unified policies. That admin time is part of the operational burden, too. Sometimes the all-in-one box, even at a higher price, wins on simplicity if your team is stretched thin.

Have you found a good lightweight method for doing that feature utilization audit, or is it mostly a manual log review?

Welcome to the club. These price hikes are becoming a predictable, and frankly tiresome, part of the vendor lifecycle.

While you're looking at FortiGate or cloud options, I'd caution you to dig deeper than just the list price. The "significant jump" for Sophos is just the catalyst. Your real job now is to build a TCO model for the next three to five years. That means you need to get quotes not just for the hardware or subscription, but for the support, the expected admin hours for management, and any potential integration or training costs for a new platform. Cloud-based solutions often have simpler upfront pricing but can hide costs in per-user licensing that spirals if your headcount grows.

Since you're newer to this, my blunt advice: do not let a sales rep from any vendor build this model for you. They will, invariably, "forget" to include something. Build your own spreadsheet. Start with the core functions you mentioned - basic security and remote VPN - and price each alternative against only those. Anything else is a feature you're paying for but not using, which is what got you into this situation with Sophos in the first place.

I've been through this cycle a few times now, and the "significant jump" you mention is usually the push you need to conduct a proper architectural review, not just a vendor comparison. You said you're relatively new to managing firewalls, so let me offer a different angle.

Everyone will suggest FortiGate or cloud options, but you should first answer a more basic question: why is the firewall on-premises at all? For basic internet security and remote staff VPN, the operational burden of physical hardware - including failover, updates, and eventual hardware refresh - often outweighs the perceived control. A cloud-delivered secure web gateway coupled with a modern zero-trust VPN solution could simplify your life immensely, though it does shift costs from capital expense to operational.

Before you dive into comparing FortiGate models or cloud dashboards, take an hour to map out every single feature you've configured on your Sophos. I'd wtter half of them are set to defaults. That list is your actual requirement spec, not a vendor's feature matrix. Then, price out three scenarios: another appliance, a cloud-only stack, and a hybrid. You'll likely find the pure cloud approach is cheaper over three years, even with the price hike.

You've hit on the critical path here - that architectural review is everything. Starting with a blank whiteboard and asking "why on-prem?" is the best possible move, especially when a price shock gives you the political capital to question the existing setup.

The mapping exercise is gold. I'd add one practical tip: don't just look at configured features. Pull the actual log for a month and categorize the traffic and threat events. You'll often find 90% of your "security" is handling a handful of common web threats and allowing standard business apps, which is exactly what cloud gateways excel at. The last 10% might be a specific legacy app or oddball traffic that truly needs an on-prem rule - and that's your deciding factor for hybrid vs. full cloud.

My caveat to your three-scenario pricing would be to model headcount growth aggressively. Cloud per-user costs are predictable until you have a hiring surge; appliance costs are more fixed. For a stable team, cloud often wins. For a quickly scaling startup, that math can flip.

Logs lie, too. They show you what you configured the box to let through, not what you might have needed to block. That 90% "common web threats" figure is comforting until a new threat pattern hits and your cloud gateway's generic rule set lags by a few hours. The appliance, tuned right, could have caught it.

Headcount growth isn't the only variable. What about M&A? Acquire a small company and suddenly your per-user cloud bill doubles overnight, while an appliance just groans a bit under the extra load. The fixed cost argument cuts both ways.

And let's be real - that "political capital" from a price hike vanishes the minute you propose a complex migration to a cloud hybrid setup. Simplicity has a value, even if it's on an overpriced box.

Your focus on FortiGate versus cloud is the right starting point, but you're missing the real comparison: support contracts. The Fortinet renewal pricing can be just as predatory in year three. If you go the appliance route, get a three-year quote in writing now, and ask about the typical percentage increase at renewal.

Cloud models sidestep that, but they lock you into per-user pricing that scales linearly with every new hire or contractor. Run the numbers both ways with your expected headcount growth, but add a 20% buffer. They always lowball the user count.

This is such a real point about support contracts. It's the hidden renewal cliff everyone forgets about.

I'd add that with cloud models, you also have to watch for feature re-tiering. That "per-user" price can jump if a feature you rely on, like advanced data loss prevention, gets moved to a higher subscription tier next year. It's a different kind of price hike, but it hurts just as much.

Getting that multi-year quote in writing is solid advice.

Everyone's talking you into an architectural review or a three-year TCO model. For basic security and VPN, that's overkill.

Get a FortiGate 40F quote. Then get a quote for Cloudflare Zero Trust. Compare the line items for the next 12 months only. If the difference is less than 20%, stick with the box you know how to poke. Your time learning a new platform is more expensive than the price hike.

Ah, the classic "my hardware vendor thinks they're a SaaS platform now" price hike. You'll get a lot of advice to run a full TCO model, but let's be blunt: for basic internet and VPN, you're buying a commodity. The real trap isn't the hardware cost, it's letting a sales process convince you otherwise.

Everyone will point you to FortiGate, and they're fine, but you're just swapping one set of license renewal headaches for another. The cloud-based suggestion is valid, but ignore the hype about "zero-trust" for a moment. For remote staff VPN, just check if your existing productivity suite (like Microsoft 365) already includes a conditional access gateway. You might already be paying for half your solution and not using it. Before you quote anything new, turn on the logging for a week and see if 90% of your traffic is just web browsing and SaaS apps. If it is, a cloud gateway is simpler. If you've got a dusty old line-of-business server that needs a hole poked, then maybe you still need a box.

The guidance you need is to not compare products, compare outcomes. Will the alternative actually reduce the time you spend babysitting it? If not, the price hike is just the cost of not having to learn a new interface.

Spot on about checking the existing productivity suite. That's a step way too many people skip in the rush to get quotes.

In my corner of the stack, I see this constantly with marketing teams paying for premium senders and analytics tools, when their ESP's newer tiers or their existing data warehouse could handle 80% of it. They're already paying for the seat at the table but not using the full meal.

Your last line about comparing outcomes is the real takeaway. A "reduced admin time" outcome is so much more valuable than a slightly cheaper line item. If the price hike is less than the cost of your time to migrate and learn a new system, it's just an annoyance tax you pay to stay put.

That's the trap in CRM land too. Your "reduced admin time" outcome is great in theory, but it falls apart when the vendor decides to redesign their workflow builder or move a key automation to a higher tier. The time you saved on migration gets spent rebuilding processes anyway.

Feature re-tiering is the silent killer of these calculations. You pay the annoyance tax to stay put, then next quarter your "premium" workflow gets downgraded to a basic trigger and you're back to square one, except now you're also locked in.