Fortinet FortiEDR Reviews

We use FortiAI, FortiSIEM, and FortiEDR.

Fortinet helped us scale large-scale deals with clients because of its strong offerings.

Fortinet is very straightforward to use. I have access to a lot of technical resources, and I have been able to use them effectively.

Fortinet has helped free up around 20 percent of our staff's time to help us out.

We saw time to value within two weeks of implementing the solution, which strengthened our use cases.

I would say FortiSIEM, is a good alternative to Splunk.

The focus area for analytics is to tie it into the firewall components within SD-WAN.

ZTNA can improve latency. I believe that a lot of the focus is on SD-WAN.

I have been using Fortinet FortiEDR for four years.

I rate Fortinet's stability a ten out of ten.

I rate Fortinet's scalability a nine out of ten.

Fortinet's technical support is top-notch. They have a partner manager, technical account reps, and a lot of ongoing community activities to ensure that people stay up-to-date on the latest information.

Positive

The initial setup requires a lot of communication with the business to gather and clarify requirements.

We worked with Fortinet to implement the solution, and then our team of technical staff deployed it.

We have seen a return on investment. Teams are being hired and staffed to meet the demand of having Fortinet implemented on our client projects.

The pricing is typical for enterprises and fairly priced. Deals are negotiated with an account manager.

We evaluated Palo Alto Networks. However, we felt that they did not have the entire suite of analytics that I was looking for. Fortinet, on the other hand, seems to have a more diversified offering in this area.

I give Fortinet FortiEDR a nine out of ten.

The RSA conference helps me stay up-to-date on technology. It also helps me think differently about my use cases. Sometimes, a feature is supported, but other times, vendors may not have it. There may be a reason why they're not doing things the way they say they will.

Attending RSA has an impact on our organization's cybersecurity purchases. In fact, some of the vendors I spoke to told me that a group had already scheduled a meeting with us, which I was unaware of.

Clients use the solution for endpoint protection purposes.

It's easy to configure and integrate the solution with the current network because it is used by Fortinet clients.

I have been using Fortinet FortiEDR for two years.

Fortinet FortiEDR is a stable solution.

Fortinet FortiEDR is a scalable solution.

I rate the solution’s scalability ten out of ten.

The solution costs less than 10,000 for 100 users. Users have to pay additional costs to have the solution on the cloud.

Fortinet FortiEDR provides good documentation and training for its partners. I would recommend the solution to other users.

Overall, I rate the solution ten out of ten.

After experiencing issues with ransomware, the company decided to implement technology that could enhance endpoint protection. As a result, we partnered with Fortinet and chose to use FortiEDR in our environment. FortiEDR helps block USB devices, protects specific applications, prevents unauthorized software installations, and controls lateral movement within the network. This allows us to maintain greater control over third-party devices and software within our IT infrastructure.

We have a specific policy to protect most of the software our employees use on EvoraMet, whether cloud-based or installed on Microsoft machines. We enforce a security rule where any software with a security score lower than three is blocked within the network. Employees who request access to such software can open a ticket. We'll then conduct a review to determine if allowing the software or if it should remain blocked is necessary. This policy helps us maintain a secure environment by controlling the use of low-rated software.

The best feature is FortiEDR's integration with the operating system kernel. In our case, we're using it on endpoints running Microsoft Windows 11, and this integration provides enhanced protection. FortiEDR safeguards all applications, scripts, and behaviors on the machine by embedding with the OS. The key modules we rely on include Execution Prevention, Exfiltration Prevention, and Ransomware Prevention. These are the most critical protections for our devices.

The control of scripts could be improved because you use Microsoft Active Directory and unnecessary scripts to keep the roles updated with company policies. We have some filters to block potential malicious scripts on the Roast. It blocks USB devices, like storage or other devices that the company does not allow, from trying to present some malware, etc.

I have been using Fortinet FortiEDR for six to eight months. We are a partner of Fortinet.

The installation process on the host is straightforward, though Fortinet could improve it, such as allowing email distribution lists. We work around this by providing the software and installation password to the IT team, who then deploy it on the machines.

Our company has around forty employees, and they travel, the deployment generally takes about five days to complete.

Security is implemented in layers. Protecting our endpoints is essential because we relied on a Microsoft solution that didn't provide centralized management or visibility into our network's behavior. It's important to have full control over the network, like FortiGate and wireless controllers, at the endpoint level.

Overall, I rate the solution an eight out of ten.

We had some customers looking for an EDR solution for their endpoint devices based on their company's security posture and standing. So Fortinet FortiEDR was recommended to them.

Fortinet FortiEDR made our clients feel secure and more at ease, knowing that they had an EDR solution that would close the gap in their security posture. Our clients are happy with the solution.

The solution's installation from a central installation server could be improved because the engineers had a little bit of trouble getting it installed from a central location.

Once it was up and running, customers didn't have any complaints about the product's stability.

Fortinet FortiEDR's scalability is okay, and we like the product.

I rate Fortinet FortiEDR a six out of ten for the ease of its initial setup. The engineers had some trouble setting up the solution, and they had to contact Fortinet to get some help.

Overall, I rate Fortinet FortiEDR a seven out of ten.

We use FortiEDR to detect malicious activities that primarily occur on the endpoints. For example, it can catch a server downloading malicious software or a user accidentally accessing a harmful URL. Three or four engineers manage the solution.

The console is easy to read. I also like the scanning part and the ability to move assets from one to the other.

FortiEDR could add a separate scanning dashboard. In incident management, we prefer to remove the endpoint system from the environment and scan the system. We typically use Symantec for that, but if we want to use FortiEDR for that, then we need a scanning tab to clarify things. 

If I'm scanning assets from the backend, I should be able to tell from my end if any malicious files were installed onto the server. It may be any server like Windows Server or the operating system for an endpoint laptop or desktop. 

We deployed FortiEDR around eight or nine months ago.

I rate FortiEDR 10 out of 10 for stability. 

Fortinet support is excellent. I don't deal with the Fortinet firewall, but a few of my colleagues are on the firewall team, and they say their T1 or P2 calls are handled smoothly.

Setting up FortiEDR isn't difficult. 

I rate FortiEDR 10 out of 10. I say go for it. 

Our primary use cases for Fortinet FortiEDR are cash registers and endpoint, and point of sales.

The reason we originally started with FortiClient with one of our clients in the first place was that they were able to have legacy cash registers, a really old technology, which we had to get to run in a small resource space, and FortiClient, which was the predecessor, allowed us to literally pick and choose what features we wanted in the client and reduce its size, which you couldn't do with any other types of clients that were out there. That's how we started with that.

It is mostly on premise and any cloud services that we use are directly from Fortinet themselves. I would call that public cloud. We do run some of the customer's environment in private cloud, basically co-location. This has provided the services back to their dataset. I am talking about Fortinet's cloud for the public. For the private stuff it was basically out at Q9, which is the co-location provider.

Fortinet FortiEDR has the ability to customize the footprint of the client or the agents on the device and on the endpoint.

The features that I have found most valuable are the ability to customize it and to reduce its size. It lets you run in a very small window in terms of memory and resources on legacy cash registers. The customer has literally about 800 cash registers. That was the use case for Fortinet FortiEDR - to get that down into a tiny space. The only way to do that was to use this product because it had that ability to unbundle services that were a surplus.

In terms of what could be improved, I would say everything with Fortinet having to do with their cloud services. They need to invest more in their internal infrastructure that they are running in the cloud. One of the things I find with their cloud environment compared to others' is that they go cheap on the equipment. So it causes some performance degradation.

A classic example of that would be products like FortiMail where you're basically acting as a mail relay. So say you're on a support call and I'm sending you a mail with document that you expect to come to you immediately, or within 30 - 60 seconds, could take up to 45 minutes because of the load on the cloud services. This can result in trouble tickets and other customer side issue.

In the next release I would like to see more investment in their cloud services. Additionally, they definitely need better integration into their FortiSIEM and FortiSOAR solutions.

They should continue to improve that and possibly include a managed threat hunting feature, an MDR solution.

I'm a Fortinet Gold Reseller but primarily we're a consulting company, not a product company. We tend to be agnostic with the one caveat being Fortinet, and only because I was the first guy in Canada to get certified in that, and also the first guy to sell it. There is a personal preference there. But I'm looking deeper into more enterprise security solutions that are SASE and endpoints and EDR, XDR, MDR, all that kind of stuff.

We've done work primarily with FortiGate deployments, but we've also done multiple SD-WAN projects and we've worked with FortiEDR, which is similar to their version of EDR. We've worked with FortiClient before that. As far as FortiCloud goes, we've worked with FortiMail in the cloud, we've worked with FortiManager in the cloud, but we haven't gone into CASB stuff yet.

We also do some Fortinet managed services in our customer base. So I have worked with Fortinet since 2004, 2005.

Fortinet FortiEDR has only been out for a couple of years. We've been working with it for a couple of months, primarily migrating a customer from FortiClient to FortiEDR.

We haven't done full scale deployments of FortiEDR yet, it's still fairly new.

In terms of stability, EDR is a pretty decent solution, but it's not best of breed. One of the challenges with Fortinet, and all of these vendors, is that they are doing acquisitions and doing things to retrofit into their environment, but there's a dependency on legacy or other features that Fortinet has, and Prisma from Palo Alto has. They have their own products, which are how their system is designed. It's really a suite of products. Fortinet is now FortiFabric, with Palo Alto it's Prisma, Prisma Cloud and XSOAR and all that stuff.

All these types of companies are not as flexible. I think in the future, people are not going to be interested in having these huge complex suites of products in order to take advantage of integration.

If you look at a true SASE solution, for example Zscaler, it's a product on its own. And it typically integrates with industry best of breed products first. So Zscaler would work with CrowdStrike or Microsoft Defender before it's going to work with an integrated solution like Palo Alto or Fortinet.

I'm finding more and more that these companies, Palo Alto, Fortinet, Check Point, Juniper, are all doing well right now. But I think in the next year to two, you're going to see a transition away from that type of technology.

It is actually one of Fortinet's big selling points that they're not maintenance heavy and they've got their gang leveraging all the other components. It actually updates itself automatically if you choose. And it has the ability, using FortiManager and other products, where you can push out policies very easily across multiple appliances, although that requires proper design and architecture from the beginning to make sure that you've got cookie cutter configurations across your enterprise.

Scalability is Fortinet's sweet spot, even though they're heavily focused trying to sell into enterprise, their sweet spot is still mid-size, SMB, customers.

Those products work well in an environment which is below 3000 users. It also works well in in terms of large enterprises, like a bank.

I don't see EDR really expanding. Fortinet Firewalls is another story. Firewalls can scale up to very large enterprises, including Telcos, but I don't see the EDR product deployed in those environments.

Their support is getting better.

Right now it is not that good. Fortinet was never big on technical support. I think they went by the theory that if it was hard to write, it should be hard to understand. Their technical support is getting better, but if you compare it to Cisco, it's not as good and it never was. It is one of their weak points. Its response time is not bad, but the attitude of the people on the phone is. It's the amount of information they ask for to do an RMA, for example. They can be very challenging to work for. That's an opportunity for managed security providers, because if you confront them, and take it away from the customer, it makes the customer's experience much better. So a bad support center is good for an MSSP.

The initial setup is complex compared to stuff like CrowdStrike or other products where you can just sign up and download and it, and it works.

It's a little bit more complex with FortiEDR because you're dealing with the setup and management of it, whereas in products like CrowdStrike, it's pretty automatic and it's just a question of a radio button to turn on or turn off additional features that you may want.

For example, going EDR to XDR or going EDR to MDR in CrowdStrike, you can do that in Fortinet but you have to implement FortiSOAR and all this other stuff.

Initially the setup took us a while, simply because we had to mess around with the client. We are talking weeks because we had to test and make sure that there were no performance issues and no interruptions in the flow of data, etc...

That took us probably five, six weeks to get up in a POC type environment. Once we got that, it's cookie cutter. You have an image that you deploy that already has that compiled in it, and it works pretty easily.

Fortinet FortiEDR is priced pretty competitively if you compare it to other companies that are in the same boat, like Palo Alto, who have similar product suites. It is reasonable. In the industry, they call Fortinet the Chevy of Perimeter Security and Palo Alto the Cadillac. I think that's undeserved. I think Fortinet is actually, in the long run, a better product, but it has that reputation because of their pricing. Palo Alto, right off the bat, charged a much higher premium, which created the illusion that you're getting a better product. Palo Alto products are brutally expensive.

But that's the way Palo Alto works and it works for them. Although, I've heard rumors that they're changing their channel model where they're going after enterprise customers directly, rather than forcing it through the channel. Fortinet is a 100% channel, Palo Alto is not. And that's affecting them. If you look at stock prices and earnings, Fortinet is actually doing better.

With any of these products, you need to step back and look at where the wave of technology is going in the security posture. I think that you need to step back and say, "Here's my current situation, what's the best solution two to three years from now?" If you look at that, I don't see Fortinet or Palo Alto or any of those traditional product vendors being the future state.

These companies are like system integrators. A lot of system integrators went out of business mostly because they couldn't make the paradigm shift from a product led business to a service led business. I see the same type of thing happening in the traditional Perimeter Security companies, that are not designed from the ground up. They make an acquisition of a product and they try to integrate it into their business model, and to leverage all their other products in a suite. That's not the way the industry is going.

On a scale of one to ten, I would rate Fortinet FortiEDR somewhere around a six.

It goes back to what I said that I don't think it's got a huge future. If you compare it to CrowdStrike or those type of products, it is very similar to Palo Alto's Cortex, they didn't even come out with an an EDR solution, they went directly to an XDR solution. What is XDR penetration? About 2% of the market right now. It's just not a fit to the future. That's why I give it a six.

The solution is used by a small organization of around 500 end users to provide online courses to their students.

Fortinet FortiEDR's scalability is quite good, and you can add licenses to the solution.

Fortinet FortiEDR should include some of the new features and better pricing. The solution should address emerging threats like SQL injection. It would be good if the solution detects ransomware files.

We have implemented Fortinet FortiEDR for our clients, and they have been using it for the last two to three years.

Fortinet FortiEDR is a stable solution. Our client has been running it successfully for the last three years.

The solution's technical support is good and fast.

The solution's initial setup is very straightforward.

The solution was deployed within a week.

Fortinet FortiEDR has a yearly subscription. The solution's pricing should be improved because other players in the market are coming up with competitive prices.

Two to three people are required to deploy Fortinet FortiEDR.

Overall, I rate Fortinet FortiEDR an eight out of ten.

We work with the end-to-end Fortinet portfolio, especially their UTM firewall, anti-APT, and EDR solutions.

Fortinet has improved our customer satisfaction. This is primarily what I see.

Fortinet FortiEDR is easy to use. It is easy to deploy, manage, and configure.

Fortinet helps free up around 14 percent of our staff's time to work on other projects.

Fortinet is very user-friendly for customers. The support is also very good.

To improve Fortinet, we need to see more features and technology areas at the endpoint level introduced.

We are a global system integration partner with Fortinet, and we have been reselling Fortinet products for more than ten years.

I give the stability an eight out of ten.

I give the scalability a seven out of ten. Fortinet must consider performance when scaling, and ensure that the performance is not impacted.

The technical support is good.

Positive

We switched to Fortinet because it is easy to use.

The initial setup is straightforward. The deployment configuration is straightforward.

We are a reseller, so we implement the solution for our clients.

We have seen a return on investment in the form of time saved and increased customer satisfaction.

The pricing is good. Prices used to be lower, but I think they are getting higher.

I evaluated Palo Alto and Check Point firewalls. Fortinet is user-friendly.

I give Fortinet FortiEDR an eight out of ten.

The time to value depends on the complexity of the solution and can take anywhere from two to fifteen days.

This is my third time attending RSA. I always look forward to meeting my old friends, and I always come away with a lot of knowledge.

Attending RSA gives us the opportunity to explore new cybersecurity vendors for potential future purchases.