What is FortiGate Antivirus Security?
FortiGate Antivirus Security is the malware-inspection capability delivered through FortiGuard Antivirus services and applied within compatible FortiGate security policies. It is mainly used to identify and block malicious files or content crossing inspected network traffic, with detection supported by signature, heuristic, behavioural and AI/ML-based techniques and updates from FortiGuard. Organisations using FortiGate at an internet edge, branch, campus, data-centre or other security boundary may consider it as one layer in a wider defence strategy. Before proceeding, a buyer should confirm the exact FortiGate platform, FortiOS version, subscription or bundle, inspection mode, encrypted-traffic policy, required performance and desired support scope. Antivirus should not be assumed to replace endpoint security, email security, backup, user awareness or other controls.
What it does at the gateway
A FortiGate can apply an antivirus security profile to selected firewall policies so that supported content is checked as it traverses the appliance. The practical purpose is to prevent known and emerging malware from moving through inspected channels before it reaches a protected destination. Fortinet describes its antivirus technology as combining signature-based detection with heuristic, behaviour-based and AI/ML analysis. FortiGuard updates help keep detection information current, while security policy choices determine where inspection is actually applied. This makes configuration as important as entitlement: buying a service without deciding which traffic to inspect, how to handle encrypted sessions and how to monitor logs can leave a gap between license ownership and operational protection.
Who should consider it
This option is relevant to businesses already using, purchasing or renewing FortiGate appliances and wanting malware controls integrated with their perimeter or segmentation policies. It may suit small offices, distributed branches, schools, professional services firms, retail sites, warehouses, hospitality networks, enterprises and mixed IT/OT environments when the FortiGate model is appropriately sized. It is particularly useful when the buyer wants centrally enforced gateway inspection rather than depending on user devices alone. It is less useful as a standalone purchase if there is no compatible Fortinet platform, no requirement for gateway content inspection, or no plan for deploying the security profiles that activate the capability in actual traffic flows.
Business problems this service helps address
Malicious file movement
Files entering through web, mail, file-transfer or other supported protocols can carry malware. Antivirus profiles add inspection at the network control point where policy enforcement already occurs.
Uneven endpoint coverage
Guest devices, unmanaged systems or specialised assets may not all run the same endpoint agent. Gateway inspection can provide an additional layer, while endpoint controls remain important.
Fast-changing malware
Threat patterns change continuously. FortiGuard Antivirus uses updated threat intelligence and multiple detection methods, helping administrators avoid relying on a static local signature set.
Policy consistency
Security teams can decide which firewall policies receive antivirus inspection and align those controls with network segments, business applications and operational requirements.
Core capabilities buyers should understand
FortiGuard provides ongoing antivirus updates so malware detection is not limited to the information present when the appliance was first deployed.
Fortinet combines signature, heuristic, behavioural and AI/ML approaches. Exact functions exposed to an administrator can vary by FortiOS release and platform.
Antivirus is applied through security profiles attached to policies, making rule design, protocol coverage and inspection scope central to the deployment.
FortiGuard Antivirus is used across several Fortinet solutions. On this page, purchasing guidance is focused on the FortiGate use case rather than claiming one license fits every platform.
Is FortiGate Antivirus Security the right fit?
| Requirement | Suitable when | Confirm before ordering |
|---|---|---|
| Gateway malware inspection | You want FortiGate policies to inspect supported file/content traffic for malware. | FortiGate model, FortiOS release, current entitlement and policy design. |
| Encrypted traffic | You have a defined SSL/SSH inspection approach and certificate deployment process where required. | Privacy, application compatibility, certificate trust and performance implications. |
| Bundle renewal | Your FortiGate is covered by an ATP, UTP or Enterprise bundle that includes antivirus. | Exact bundle SKU, term, renewal date and whether other services are required. |
| A-la-carte service | A separate FortiGuard service matches the appliance and procurement design. | Commercial availability for the exact model and whether a bundle is more suitable. |
| Endpoint replacement | Not normally selected as a complete substitute for endpoint malware controls. | Endpoint security, EDR, email security, backup and incident-response requirements. |
Licensing and compatibility are not one-size-fits-all
The FortiGate hardware model determines the correct subscription SKU and commercial price. Antivirus may be obtained as part of a FortiGuard bundle or, where the ordering structure allows, as an individual service. Fortinet’s current FortiGate bundle framework places antivirus within ATP, UTP and Enterprise tiers, but those bundles also contain different additional services. A buyer should therefore avoid purchasing solely by the phrase “antivirus license.” Confirm whether the requirement is a new subscription, co-term, renewal, upgrade from another bundle, or replacement of an expired entitlement. Also verify the FortiOS release and any feature dependencies before changing inspection policies. FourTeck can help map the requirement to the correct bill of materials without assuming that a license for one FortiGate model will apply to another.
From requirement to working protection
Identify the appliance
Provide the exact FortiGate model, serial number where appropriate, FortiOS release and whether the unit is physical, virtual or cloud-deployed.
Check entitlement
Review the existing FortiCare and FortiGuard status, bundle type, expiry date and any renewal or co-term objective.
Define inspection
Decide which policies, protocols and user groups require antivirus inspection and whether SSL/SSH inspection changes are part of the project.
Size and quote
Validate appliance capacity, subscription term and related services before the commercial quote is finalised.
Deploy and test
Apply profiles in a controlled manner, test representative applications and monitor logs, performance and user impact before broad enforcement.
Antivirus inspection depends on seeing the right traffic
Malware inspection is only effective on traffic the FortiGate is actually configured to inspect. That sounds obvious, but it is one of the most important design points in real deployments. Antivirus profiles are attached to policies, and the policy determines which traffic path, source, destination and service is in scope. Administrators should avoid applying broad changes simply because a license has been renewed. Start from business applications and risk: internet browsing, file downloads, email protocols, server transfers, shared-file access or east-west segments may have different requirements.
FortiOS supports both flow-based and proxy-based inspection modes, with feature differences between them. The correct mode should be selected using the FortiOS documentation for the deployed release and the features required by that policy. A configuration inherited from an older appliance should be reviewed rather than copied without validation, particularly after a hardware refresh or major FortiOS upgrade.
Encrypted traffic changes the inspection conversation
A large share of modern application traffic uses TLS encryption. If the security objective is to inspect file content inside encrypted sessions, certificate inspection alone may not expose the content required for full malware scanning. Deep SSL/SSH inspection can provide greater visibility, but it introduces its own design work: certificate trust must be deployed correctly, sensitive categories may need policy exceptions, applications using certificate pinning may behave differently, and legal or privacy requirements must be considered.
This is why an antivirus subscription should not be quoted in isolation from configuration when the buyer expects inspection of HTTPS traffic. The security team should identify which managed devices can trust the enterprise inspection certificate, how BYOD and guest traffic will be handled, what exemptions are justified, and how application owners will test critical services. FourTeck can include this review in the requested configuration scope rather than assuming a default certificate strategy fits every organisation.
Security subscriptions must be matched to appliance capacity
Turning on security inspection changes the workload handled by a firewall. The relevant sizing figure is therefore not simply raw firewall throughput. Buyers should look at the exact FortiGate data sheet and evaluate threat-protection or security-profile performance using traffic patterns that resemble the intended deployment. Number of users, concurrent sessions, internet speed, east-west traffic, VPN use, packet size, SSL inspection and the combination of enabled services can all influence practical headroom.
For a renewal on an established firewall, operational metrics are valuable. CPU, memory, session counts, interface utilisation and existing security-profile usage can show whether the appliance still has room for additional inspection. For a new deployment, growth assumptions should be documented rather than choosing the smallest appliance that meets today’s WAN speed. FourTeck can help connect the subscription decision to the wider FortiGate sizing exercise when the model has not yet been finalised.
Where FortiGate antivirus can fit in a business environment
Branch internet edge
Distributed offices can use consistent gateway malware policies on their FortiGate devices, provided each appliance and subscription is correctly sized and managed.
Head office and campus
Larger user populations may require inspection across multiple security zones. Policy design should distinguish employee, server, guest and infrastructure traffic rather than treating all flows identically.
Data-centre boundaries
Antivirus can support controls around application or server traffic when the protocols and inspection method are compatible. Performance and availability requirements deserve particular attention.
Mixed IT and OT sites
Gateway protection may add value around industrial or operational networks, but production protocols, maintenance windows and vendor requirements should be reviewed before introducing inspection.
Operational and integration considerations
Antivirus on a FortiGate operates inside a wider security policy stack. It may be combined with application control, IPS, web or DNS security, sandboxing and other services depending on the subscription or bundle. The presence of those adjacent capabilities should not be assumed from an antivirus-only requirement. Current FortiGate ATP, UTP and Enterprise bundles include antivirus, but each bundle adds a different set of services. A procurement team should decide whether it needs only malware inspection or a broader protection tier, because purchasing a bundle can change both functionality and renewal cost.
Logging is another practical consideration. The organisation should decide which events must be retained, where they will be reviewed and whether FortiAnalyzer or another logging workflow is part of the design. Blocking malware without a process for reviewing detections can make incident follow-up difficult. Administrators should also establish a controlled change process for antivirus profile settings, exemptions and certificate-inspection policies.
Finally, security inspection does not remove the need for patching, endpoint controls, backups, secure email handling, identity controls and user awareness. A firewall sees only the traffic that traverses and can be inspected by it. Files introduced through removable media, local shares, encrypted channels outside inspection scope or compromised endpoints require additional controls. The most useful buying decision is therefore one that places FortiGate Antivirus Security in the right architectural role instead of expecting it to provide complete malware protection by itself.
Questions to resolve before requesting a quote
Every commercial subscription maps to a specific appliance family or virtual offering.
Renewal dates, existing bundle names and support status can affect the correct ordering path.
ATP, UTP and Enterprise protection include different companion services.
Internet, email, file transfer, server and internal traffic can have different inspection needs.
Deep inspection may require certificate deployment, exceptions and application testing.
Include profile design, testing, logging, migration or change-window support in the scope if needed.
Procurement checklist for FortiGate antivirus protection
How FourTeck can assist with selection and deployment
FourTeck can review the commercial and technical inputs before a FortiGate antivirus quotation is prepared. For a renewal, that may mean confirming the appliance model, current protection bundle, expiry timing and desired term. For a new firewall project, the task can extend to model sizing, bundle comparison, bill-of-material preparation and configuration planning. The objective is to match the subscription to the actual FortiGate and security requirement rather than treating antivirus as an interchangeable software key.
Where configuration support is requested, the scope can cover antivirus profile planning, policy assignment, SSL/SSH inspection considerations, change sequencing, application testing and log review. The exact work should be agreed in the quotation because an existing production firewall may require a different change process from a new greenfield deployment.
You can also browse FourTeck firewall products, review network security services, or use the FourTeck contact page to share your model and licensing details.
Useful details to send
FortiGate model, serial or contract details for a renewal, license term, current bundle, preferred deployment date and whether you need configuration assistance.
UAE availability and support guidance
Contact FourTeck to confirm current UAE availability for the FortiGuard subscription or FortiGate bundle that matches your appliance. Availability may depend on the exact model, virtual or hardware platform, license term, quantity, existing entitlement, region and vendor lead time. Because this page covers the antivirus security capability rather than a single model-specific license SKU, a quotation cannot be finalised responsibly until the FortiGate identity is known.
For projects in Dubai, Abu Dhabi, Sharjah and Ajman, FourTeck can coordinate requirement review, quotation preparation and the requested installation or configuration scope. Delivery or electronic entitlement timing should be discussed after the exact SKU and subscription details are confirmed. If the project includes a hardware refresh, policy migration or SSL inspection rollout, include those requirements from the beginning so they can be planned alongside the licensing rather than added after purchase.
GCC Availability
Organisations planning FortiGate Antivirus Security across the GCC can ask FourTeck to review requirements that span the United Arab Emirates, Saudi Arabia, Kuwait, Qatar, Bahrain or Oman. The first step is to identify the FortiGate model at each site and determine whether the requirement is a new security subscription, an existing bundle renewal, a co-term exercise or part of a wider firewall replacement. This matters because licensing is tied to the platform and commercial term, while project requirements can vary between a single branch and a multi-country network.
FourTeck can assist with model or license selection, quotation coordination, configuration scope, installation planning and renewal guidance where requested. Product availability, electronic entitlement timing, service visits, vendor lead times and project scope can vary by country, model, quantity and requirement. Buyers should provide the destination country, FortiGate model, quantity, preferred subscription term, deployment location and expected project window. For regional enquiries, the FourTeck UAE contact team can help organise the next step, while FourTeck Kuwait information is available for relevant Kuwait requirements.
Africa Availability
For African projects, FortiGate antivirus licensing should be planned with the destination and platform details clearly identified. FourTeck can help organisations evaluate the FortiGate model, required protection tier, renewal term, companion security services, configuration needs and deployment expectations before a commercial request is finalised. This is useful for businesses with branch networks, regional offices, data-centre environments or mixed estates where different FortiGate models may require different subscription SKUs.
Availability and fulfilment can depend on destination country, model, quantity, license region, vendor lead time, shipping arrangements where hardware is involved, and local project conditions. Buyers in East Africa and other regions should share the country, exact appliance requirement, quantity, preferred subscription period, desired schedule and any installation or support expectations. FourTeck provides regional information through FourTeck Africa and FourTeck Kenya. Current inventory, customs outcomes and fixed delivery dates should not be assumed until the specific project has been reviewed.
Related options to compare
FortiGuard ATP bundle
A current FortiGate protection tier that includes antivirus plus foundational services such as IPS, FortiSandbox SaaS and application control. Confirm exact bundle contents for the ordering date.
FortiGuard UTP bundle
Designed for broader network and web security, adding web/DNS-related services around the ATP foundation. Suitable when the requirement extends beyond file malware inspection.
Enterprise protection bundle
A wider FortiGate service tier for organisations needing additional security capabilities. The correct choice depends on attack-surface requirements and budget, not simply the number of included services.
Configuration and migration support
Useful when antivirus activation accompanies a new firewall, FortiOS upgrade, policy redesign, certificate rollout or replacement of an existing security appliance.
Why businesses contact FourTeck for this requirement
The difficult part of a FortiGuard purchase is often not understanding that antivirus blocks malware; it is connecting that requirement to the correct FortiGate, bundle, term and operating design. FourTeck can help clarify whether the request is an individual service, a bundle renewal or part of a broader Fortinet security project. That reduces the chance of quoting the wrong platform SKU or overlooking a dependency such as encrypted-traffic inspection, logging, capacity or migration work.
For procurement teams, assistance can include bill-of-material review, subscription-term clarification and quotation coordination. For IT teams, the discussion can extend to security profile planning, policy scope, SSL inspection, testing, change windows and handover. The exact services included should be defined in the commercial proposal. FourTeck does not need to assume a fixed deployment scope before understanding your environment.
Practical buying guidance for FortiGate antivirus protection
Buyers researching FortiGate antivirus often start with a simple question: “Which antivirus license do I need?” The useful answer begins with the firewall, not the service name. FortiGuard subscriptions are tied to a FortiGate model or virtual platform, and the current bundle structure gives buyers several ways to obtain antivirus protection. The lowest-friction path for an existing appliance is to identify its model and current entitlement, then decide whether the objective is renewal, upgrade or addition of a service. A new firewall project requires an extra step because appliance sizing and protection tier should be decided together.
Antivirus versus a broader bundle
A buyer who only needs malware inspection may ask about an individual FortiGuard service, but a FortiGate commonly runs several security controls together. The ATP bundle includes antivirus with other foundational services. UTP adds broader web and DNS-oriented protection, while Enterprise protection adds further security functions. The “right” tier is the one that matches the risks and controls the organisation intends to operate. Paying for more services is not useful if they will never be configured, while choosing too narrow a service can force a second procurement process later.
Why SSL inspection appears in antivirus discussions
Many malware downloads travel over encrypted HTTPS. A FortiGate cannot inspect content it cannot decrypt. Deep SSL inspection can provide the visibility needed for content-level controls, but it has to be engineered rather than simply switched on across every user and application. Managed endpoints need the inspection certificate trust chain, sensitive traffic may require exceptions, and application compatibility must be tested. This is a security architecture decision with operational and privacy implications, so the licensing discussion should identify whether encrypted-content inspection is part of the expected outcome.
Another common question is whether FortiGate antivirus removes the need for endpoint antivirus or EDR. It should be treated as a complementary gateway control. The firewall can inspect supported network traffic that passes through it, but it does not see every event on an endpoint. Local execution, removable media, user behaviour, credential abuse and files that never traverse an inspected path still require other protections. Organisations usually get better results by defining which layer is responsible for which risk instead of asking one tool to cover every malware scenario.
Performance questions also need a model-specific answer. A FortiGate data sheet contains multiple throughput figures because basic forwarding and full security inspection are different workloads. If antivirus will run alongside IPS, application control, SSL inspection, VPN and other profiles, the appliance should be sized using the appropriate security-performance figures and realistic traffic assumptions. An existing appliance can be assessed using operational data: current WAN utilisation, peak sessions, CPU, memory and profile usage help show whether there is practical headroom. A generic claim that “antivirus will not affect performance” is not an appropriate basis for buying or configuration.
Renewal planning deserves equal attention. Waiting until an entitlement has expired can turn a routine procurement task into an urgent security and operations issue. Teams should record the firewall serial number, current bundle, expiry date, desired renewal period and any planned hardware replacement. If an appliance is approaching a lifecycle decision, it may make more sense to evaluate renewal and hardware refresh together. FourTeck can review those details and prepare the requested commercial path, but the appropriate option depends on the actual FortiGate estate rather than a single generic license name.
For Dubai and UAE buyers, a useful quotation request includes the appliance model, number of units, whether the request is new or renewal, existing subscription name if known, preferred term, expected traffic profile and whether installation or configuration is needed. If deep inspection, a policy migration or a FortiOS upgrade is planned, mention that as well. Those details allow the antivirus requirement to be treated as part of a working security design instead of only a license transaction.
Buyer questions that clarify the next decision
How do I know whether my existing FortiGate already includes antivirus?
Check the current FortiGuard entitlement or bundle associated with the appliance. Fortinet’s present FortiGate ATP, UTP and Enterprise bundle structures include antivirus, but the name and validity of your existing contract still need confirmation. For a renewal quote, send the model and serial or the existing license details rather than ordering a second subscription by description alone.
Should I buy ATP, UTP or Enterprise protection?
Choose according to the security services you intend to use. ATP provides a foundational set that includes antivirus. UTP adds wider web and network protections. Enterprise protection expands the security set further. Compare required controls, operational capability and budget rather than assuming the highest tier is automatically necessary for every site.
Can antivirus scan HTTPS downloads?
Content inspection of encrypted sessions depends on the SSL/SSH inspection method in the firewall policy. Deep inspection can expose encrypted content to security profiles, but certificate trust, application compatibility, privacy requirements and exclusions must be designed and tested. The license alone does not determine the result.
What information makes a quotation more accurate?
Provide the exact FortiGate model, quantity, current subscription or bundle, expiry date for renewals, desired term and deployment country. Add implementation details if configuration, policy migration, certificate deployment, logging or testing is required. Those inputs reduce ambiguity between different model-specific license SKUs.
What if the current firewall is already heavily utilised?
Review appliance health and security-performance headroom before expanding inspection. Current CPU, memory, session load and throughput, together with the exact model data sheet, can indicate whether additional antivirus and SSL inspection should be enabled on the existing unit or considered as part of a hardware refresh.
Can one license cover several FortiGate appliances?
Do not assume so. FortiGuard subscriptions are generally associated with a specific FortiGate product and term. Multi-device estates should be reviewed as a bill of materials, especially when the branch models differ. FourTeck can help organise model-by-model requirements and renewal timing for the quotation.
Frequently asked questions
Is FortiGate Antivirus Security a separate hardware appliance?
No. In this context it is a FortiGuard security-service capability used with a compatible FortiGate. The commercial entitlement can be obtained through applicable service or bundle options tied to the FortiGate platform.
Does FortiGuard Antivirus come with every FortiGate automatically?
Do not assume an active antivirus subscription is included with every appliance purchase. The entitlement depends on the hardware bundle, subscription and term ordered. Confirm the exact SKU and service status for your unit.
Which FortiGuard bundles include antivirus?
Fortinet’s current FortiGate bundle structure includes antivirus within Advanced Threat Protection, Unified Threat Protection and Enterprise Protection. Bundle contents can evolve, so the ordering guide should be checked when the quote is prepared.
Can FortiGate antivirus replace endpoint security?
It is better treated as an additional network security layer. Endpoint malware protection or EDR can see local activity that a gateway does not, while the FortiGate can inspect network traffic that passes through configured security policies.
Does antivirus inspect encrypted web traffic automatically?
The amount of encrypted content that can be inspected depends on the configured SSL/SSH inspection method. Deep inspection may be required for content visibility and must be planned with certificate trust, privacy and application compatibility in mind.
Will enabling antivirus affect FortiGate performance?
Security inspection consumes resources, and the effect depends on the FortiGate model, traffic profile, SSL inspection and other enabled services. Size the appliance using the relevant security-performance data and operational headroom rather than raw firewall throughput alone.
What details are needed for a FortiGate antivirus renewal quote?
Send the FortiGate model, serial number or existing contract details, current bundle if known, expiry date, desired renewal term and deployment country. Mention any planned bundle change or hardware refresh.
Can FourTeck help configure antivirus profiles?
Configuration assistance can be discussed as part of the project. The scope may include profile setup, policy assignment, SSL inspection review, testing and logging, depending on the agreed quotation.
How do I check UAE availability and price?
Contact FourTeck with the exact FortiGate model, quantity and subscription term. Current price and availability depend on the model-specific license SKU, region, term and vendor lead time.
Ready to confirm the correct FortiGate antivirus option?
Send your FortiGate model, current license status, quantity, required term and whether configuration assistance is needed. FourTeck can use those details to prepare the appropriate UAE quotation and clarify whether an individual service or a broader FortiGuard bundle better matches the requirement.