Fortinet FortiSandbox Zero-Day Threat Protection (On-Demand)

What do you like best about the product?

The best part is it takes a big load off our security team.
By catching threats early, it saves us both time and cleanup costs

What do you dislike about the product?

It’s given us good results, but it isn’t budget-friendly.
For those not using other Fortinet tools, the price may be tough

What problems is the product solving and how is that benefiting you?

Before, a single infection meant hours of cleanup.
Now the sandbox blocks them upfront, saving IT work and keeping things running

What do you like best about the product?

I really like the endpoint integration. FortiClient silently sends unknown files to FortiSandbox in the background, and we don’t have to babysit it. Once we tuned the policies, it’s been running reliably without slowing down users, which is a big plus for productivity.

What do you dislike about the product?

It can be resource-hungry. We had to allocate more hardware than initially expected to keep the performance smooth, especially with FortiClient endpoints constantly sending samples. Once scaled properly it’s fine, but the upfront sizing needs careful planning.

What problems is the product solving and how is that benefiting you?

Before deploying it, we were constantly dealing with suspicious attachments slipping through email and reaching endpoints. Now FortiClient forwards anything unknown to FortiSandbox, and verdicts come back quickly. It’s cut down on user-reported incidents and allowed us to keep our environment clean without adding more endpoint load.

What do you like best about the product?

The strongest part for me is how well it works with FortiClient on our endpoints. Whenever a suspicious file shows up, it’s automatically sent to FortiSandbox, and the verdict comes back quickly. If it’s malicious, FortiClient immediately blocks it and updates its signatures, it’s closed several gaps we used to worry about.

What do you dislike about the product?

The main drawback I’ve noticed is the occasional delay during peak load. When multiple suspicious files come in at once, analysis can take a bit longer, which slightly slows down our incident triage. It’s not frequent, but it’s something we’ve had to plan around.

What problems is the product solving and how is that benefiting you?

It’s helped us close the gap against zero-day and evasive malware that our traditional signature-based tools were missing. By sending suspicious files from FortiClient to FortiSandbox for behavioral analysis, we’re catching threats before they ever execute. This has greatly reduced infection incidents and strengthened our security posture.

The company came to us and provided a proof of concept (POC) for six or seven months for testing the machine and evaluating how we can use Fortinet FortiSandbox . Also, we use FortiSandbox  for scanning files, like attachments.

Currently, there isn't a standout feature. We use Fortinet FortiSandbox for scanning files such as attachments, and we have not faced any issues so far. Up to now, it is performing well.

We sometimes face a delay in email scanning due to not having multiple virtual machines. Improvements could be made in dynamic scanning, scanning all email components such as URLs and attachments, and analyzing the Sandbox response. Additionally, better integration with cloud solutions and enhanced performance would be beneficial.

I have been using FortiSandbox for six months, specifically for testing purposes on the Alibaba Cloud  platform.

The solution is stable up to now because it is still new, just six months maximum.

The solution's performance is fine and more improved compared to the last two months.

As of now, I've primarily been in contact with the consultants for support and have only needed one ticket with Fortinet. I have no substantial experience with Fortinet's direct technical support.

Neutral

I previously used Cisco, but Fortinet is much easier in terms of configuration and service time.

The initial setup of Fortinet was easy, more so than other products. Even though I'm not directly involved, it has been very easy to work with Fortinet, especially compared to other solutions.

It was a combined effort. A consultant from an external company worked alongside us on the implementation. Most of the integration and support involved consultants.

I think it's affordable. For the six to seven months of usage, the cost has been reasonable.

FortiSandbox is rated five out of ten. It meets the requirements but still has room for growth and improvements.

Public Cloud

Alibaba

We use FortiSandbox  for scanning files and images that pass through our networks. It integrates with different devices, such as five adapters and other Fortinet devices.

It is time-saving and more secure. It saves us from a lot of antivirus and anti-malware issues.

The adapter is beneficial as it allows integration with various devices, not just Fortinet.

It would be better if we could integrate FortiSandbox  with endpoint security solutions. This would allow us to scan files opened by the endpoint user and not just over the network.

I have about one year of experience working with FortiSandbox.

I would rate the stability of FortiSandbox as eight out of ten.

I would rate the scalability of FortiSandbox as eight out of ten.

Fortinet provides really good technical support. They introduce high-level support for us.

Positive

The initial configuration is straightforward and not difficult. We have an ID for port one and can assign port three for ID two for the device.

I am not familiar with the pricing because my role is strictly technical.

I recommend using FortiSandbox, especially if your environment relies on FortiGate  devices or is integrated with Fortinet. It ensures better compatibility.

I'd rate the solution nine out of ten.

Hybrid Cloud

Other