Two announcements, one question
FortiSASE, FortiEndpoint and FortiEDR are not three versions of the same thing. One secures traffic, one secures the device, and one investigates and responds, and buying the wrong pair means paying twice for the same features.
Fortinet's two biggest security messages this year sound almost identical. In July, Fortinet expanded FortiEndpoint and pitched it as one agent, one console and one license for zero trust, AI governance, EDR and data protection. In October, its SASE Summit recap made a similar promise from the network side: visibility into AI apps, unified policy and a single endpoint agent.
Neither piece mentions the other product. Here's how I tell them apart when I scope a customer.
Three products, three jobs
All three run on the endpoint, but each one is built for a different job.
Product | Its job | What it covers | Sold for |
|---|---|---|---|
Protects the traffic | Secure web gateway, firewall-as-a-service, IPS, SSL inspection, web and DNS filtering, CASB, inline DLP and ZTNA, delivered from Fortinet's cloud. The license includes the FortiClient agent, which already brings endpoint protection, sandboxing and vulnerability scanning. Agentless web access covers devices you don't manage. | Users, wherever they work | |
Protects the device | FortiClient, FortiEDR and FortiDLP in one agent: endpoint protection, EDR, ZTNA, native DLP and insider risk, AI app visibility and control, and endpoint risk scoring. Managed tiers are available. | Managed devices, from 25 seats | |
FortiEDR | Investigates and responds | Behavioral detection, real-time defusing of malicious activity and forensics, with optional Fortinet-run MDR on top. | Managed devices, bundles from 100 to 500 seats |
FortiEndpoint is the newest of the three. Fortinet introduced it as a unified client that merges FortiClient and FortiEDR, and the July update folded in FortiDLP and AI controls.
Where they overlap
Buy FortiSASE and FortiEndpoint together and you can end up licensing four things twice:
Endpoint protection. FortiSASE's FortiClient agent already includes EPP.
Zero-trust access. Both include ZTNA.
Data protection. FortiSASE inspects data inline as it moves; FortiEndpoint now ships native DLP on the device.
AI app control. FortiSASE gives visibility into the AI services people use, and FortiEndpoint now adds its own shadow-AI controls.
The July update made this overlap bigger, not smaller. A year ago it was mostly EPP and ZTNA.
What only FortiSASE gives you: inspection of cloud and SaaS traffic everywhere people work, and coverage for laptops you don't own.
What only FortiEndpoint or FortiEDR gives you: real EDR. That means investigation, forensics, device isolation and, if you want it, analysts watching your endpoints around the clock.
Where FortiEDR is headed
Fortinet is betting on one agent instead of a new agent for every feature, and that puts pressure on standalone FortiEDR.
The classic reason to buy FortiEDR on its own was the managed option, with Fortinet analysts reviewing your alerts. According to the FortiEndpoint ordering guide, FortiEndpoint already offers managed tiers with incident response included, and it starts at 25 seats.
I wouldn't be surprised to see FortiEDR fold into FortiEndpoint entirely one day. For now it sticks around for two reasons: on-premises deployments still run on FortiClient EMS and FortiEDR, and existing FortiEDR customers can't move to FortiEndpoint directly.
A real scoping example
For a small, all-Mac team I scoped this month, FortiSASE won and FortiEndpoint came off the proposal.
Their files live in cloud storage, and contractors work from their own laptops. FortiSASE and FortiEndpoint were both on the table, and the deciding factor was where the risk actually sat:
The risk was in the traffic, not the device. Cloud file sharing and unmanaged contractor laptops are exactly what FortiSASE covers and FortiEndpoint can't.
FortiEndpoint duplicated half of FortiSASE. Endpoint protection and ZTNA were already on every company Mac through the FortiSASE agent.
EDR wasn't on their list. Its unique value, investigation and SOC monitoring, wasn't something they had asked for.
The recommendation was FortiSASE Advanced plus security awareness training.
How I scope it
Start from where the risk lives, then pick the product that covers it without paying twice.
Users everywhere, data in SaaS, devices you don't fully control: start with FortiSASE.
Managed fleet, no SASE in play, and you want protection and response in one console: FortiEndpoint at the tier that fits.
You need both network security and real EDR: pair FortiSASE with FortiEDR rather than FortiEndpoint.
That last one deserves an explanation, because FortiEDR's seat minimums run higher. I would rather pay for extra seats than pay twice for the same features. FortiSASE plus FortiEndpoint duplicates endpoint protection, ZTNA, data protection and AI controls; FortiSASE plus FortiEDR gives you the network layer and the response layer with far less overlap.
Two things to plan for with that pairing:
It's less overlap, not zero. FortiEDR's prevention tier includes its own antivirus, alongside the EPP in FortiClient.
Two agents on each device. FortiSASE runs FortiClient and FortiEDR runs its own collector, so deployment and updates need a plan.
These three products blur together on a datasheet. If you're weighing them, reach out to AMIS and we'll scope the right mix for your team.
Sources
FortiEndpoint Expands Security for the AI Era (Fortinet, July 14, 2026)
3 Key Takeaways from the Fortinet SASE Summit 2026 (Fortinet, October 8, 2026)
Revolutionizing Endpoint Security with FortiEDR and a Unified Client (Fortinet, March 18, 2025)
FortiEndpoint Ordering Guide (Fortinet)
FortiEDR/FortiXDR Ordering Guide (Fortinet, via reseller copy)
FortiEndpoint Administration Guide (Fortinet Document Library)
SOURCE / FORTINET ANNOUNCEMENT
This is AMIS’s independent perspective, not a Fortinet datasheet or a performance guarantee. Validate specifications, availability, and licensing before making a purchasing decision.