SecureGuard runs on your own hardware or VM. Community is free for good, and you can preview every change before it goes live and undo it in one step.
Small and mid-size teams that want a capable firewall with published per-appliance prices and a free Community tier.
| Topic | FortiGate | SecureGuard |
|---|---|---|
| Hardware | Fortinet-built appliances or FortiGate-VM. | Your own hardware or VM; we don't sell appliances. |
| Price | Quote from Fortinet or partner. | Community $0 · Home $149/yr · Business $589/yr · Enterprise $1,495/yr per appliance |
| Preview / rollback | Configuration revisions and restore (model-dependent; FortiManager adds revision history). | Preview every change before it goes live; undo it in one step (all tiers, including Community). |
| HA | Active-passive and active-active clusters (FGCP). | Active/passive HA on Business ($589/yr) and Enterprise. |
Stay on FortiGate if you rely on FortiGuard security services such as application control, antivirus, sandboxing, or URL and DNS filtering; need app-by-app control; use the Fortinet Security Fabric; or already run a Fortinet estate or contract. SecureGuard does not replace those services. FortiGate also makes sense if you want vendor-built hardware under one support contract.
Yes. Community is a working firewall at $0 on the same software image as the paid tiers. It includes the full policy engine, Suricata IPS, one site-to-site tunnel, and preview with one-step undo. HA, dynamic routing, and external authentication start on Business. It is not a trial.
Only if you turn it on. By default, AI suggests changes and a person approves each one. On Business and Enterprise you can turn on automatic blocks, which act only when two signals agree, are rate-limited, and expire on their own. This is not MDR.
Generic UTM-to-appliance move: UTM replacement. How preview and rollback work: Rollback, Architecture docs. What is actually built: Platform. Sophos UTM specifically: /sophos-utm.