Fortinet FortiSandbox Zero-Day Threat Protection (On-Demand)

What do you like best about the product?

The best part is it takes a big load off our security team.
By catching threats early, it saves us both time and cleanup costs

What do you dislike about the product?

It’s given us good results, but it isn’t budget-friendly.
For those not using other Fortinet tools, the price may be tough

What problems is the product solving and how is that benefiting you?

Before, a single infection meant hours of cleanup.
Now the sandbox blocks them upfront, saving IT work and keeping things running

What do you like best about the product?

I really like the endpoint integration. FortiClient silently sends unknown files to FortiSandbox in the background, and we don’t have to babysit it. Once we tuned the policies, it’s been running reliably without slowing down users, which is a big plus for productivity.

What do you dislike about the product?

It can be resource-hungry. We had to allocate more hardware than initially expected to keep the performance smooth, especially with FortiClient endpoints constantly sending samples. Once scaled properly it’s fine, but the upfront sizing needs careful planning.

What problems is the product solving and how is that benefiting you?

Before deploying it, we were constantly dealing with suspicious attachments slipping through email and reaching endpoints. Now FortiClient forwards anything unknown to FortiSandbox, and verdicts come back quickly. It’s cut down on user-reported incidents and allowed us to keep our environment clean without adding more endpoint load.

What do you like best about the product?

The automation between FortiClient and FortiSandbox has been a game-changer. When a new threat is detected on one endpoint, that information gets shared instantly to all others. It reduces manual response work for our team and keeps incidents contained before they spread.

What do you dislike about the product?

The reports are thorough but not very user-friendly. They contain a lot of technical detail, which is great for deep analysis, but not easy to quickly skim during an active incident. I usually end up summarizing them manually for the rest of the team.

What problems is the product solving and how is that benefiting you?

It has streamlined our incident response process. When FortiSandbox detects a new threat on one machine, it automatically shares the IOC with all other FortiClient endpoints. That stops the spread before we even get involved. It’s saved our team a lot of time and reduced response workloads dramatically.

What do you like best about the product?

The strongest part for me is how well it works with FortiClient on our endpoints. Whenever a suspicious file shows up, it’s automatically sent to FortiSandbox, and the verdict comes back quickly. If it’s malicious, FortiClient immediately blocks it and updates its signatures, it’s closed several gaps we used to worry about.

What do you dislike about the product?

The main drawback I’ve noticed is the occasional delay during peak load. When multiple suspicious files come in at once, analysis can take a bit longer, which slightly slows down our incident triage. It’s not frequent, but it’s something we’ve had to plan around.

What problems is the product solving and how is that benefiting you?

It’s helped us close the gap against zero-day and evasive malware that our traditional signature-based tools were missing. By sending suspicious files from FortiClient to FortiSandbox for behavioral analysis, we’re catching threats before they ever execute. This has greatly reduced infection incidents and strengthened our security posture.

The company came to us and provided a proof of concept (POC) for six or seven months for testing the machine and evaluating how we can use Fortinet FortiSandbox . Also, we use FortiSandbox  for scanning files, like attachments.

Currently, there isn't a standout feature. We use Fortinet FortiSandbox for scanning files such as attachments, and we have not faced any issues so far. Up to now, it is performing well.

We sometimes face a delay in email scanning due to not having multiple virtual machines. Improvements could be made in dynamic scanning, scanning all email components such as URLs and attachments, and analyzing the Sandbox response. Additionally, better integration with cloud solutions and enhanced performance would be beneficial.

I have been using FortiSandbox for six months, specifically for testing purposes on the Alibaba Cloud  platform.

The solution is stable up to now because it is still new, just six months maximum.

The solution's performance is fine and more improved compared to the last two months.

As of now, I've primarily been in contact with the consultants for support and have only needed one ticket with Fortinet. I have no substantial experience with Fortinet's direct technical support.

Neutral

I previously used Cisco, but Fortinet is much easier in terms of configuration and service time.

The initial setup of Fortinet was easy, more so than other products. Even though I'm not directly involved, it has been very easy to work with Fortinet, especially compared to other solutions.

It was a combined effort. A consultant from an external company worked alongside us on the implementation. Most of the integration and support involved consultants.

I think it's affordable. For the six to seven months of usage, the cost has been reasonable.

FortiSandbox is rated five out of ten. It meets the requirements but still has room for growth and improvements.

Public Cloud

Alibaba