Fortinet's customers are consolidating onto the platform and fleeing it at the same time. The reasoning behind both moves is the signal worth reading for anyone positioned around the security trade.

Few vendors inspire commentary as polarized as Fortinet's right now. In ETR's Edge Qualitative Commentary on Fortinet, gathered from 29 technology leaders, one C-Level respondent called the vendor "a key focus to our security strategy." Another said, "The only place Fortinet fits is in the dumpster, and preferably engulfed in flames."

The report captures 15 respondents increasing Fortinet spend by 6% or more over the next six months and 14 decreasing by 6% or worse. One note before diving in: ETR's Edge Reports are designed to reach a minimum threshold of representation from both spend groups, so the near-even split reflects methodology, not the broader market's balance of sentiment. What the commentary offers is deal-level reasoning you will not find in a Net Score alone.

The Bull Case: Consolidation and Net-New Spend

The dominant driver among increasers is consolidation, with Fortinet as the destination. Respondents described displacing Palo Alto Networks, Cisco, Check Point, SonicWall, and Aruba, and price came up repeatedly as the deciding factor. A C-Level respondent at a large EMEA financial firm, moving off both Palo Alto and Cisco, put it plainly: "Fortinet offering great price for all the functions and integrated products." A Fortune 500 architect converting "from Palo Alto everywhere to more Fortinet internally" added that "upper management would rather divert the monies to AI," a budget dynamic worth noting across the sector.

The rest of the bull case is expansion rather than displacement. An APAC Director modernizing through SD-WAN, SASE, and Zero Trust called Fortinet a "key component of our long-term IT strategy." Two financial firms are adding net-new controls for cloud migration, one tied to a growing Azure footprint. Others are expanding into OT and AI threat protection, FortiSIEM, and SOCaaS. Notably, nearly all increasers framed these commitments as long-term and strategic rather than short-term, the stickier kind of spend.

The Bear Case: Displacement, Vulnerabilities, and Price

The traffic runs both ways. Palo Alto appears in three separate decreaser accounts: one replacing Fortinet across its data centers, one standardizing firewalls and site-to-site VPNs on Palo Alto because it "offers better ROI," and one APAC firm testing Palo Alto for cloud capabilities and AI alignment. Others are consolidating to Cisco or moving to Broadcom, Sophos, or Unifi Gateway.

The single most concrete data point favors a private disruptor: a Fortune 1000 financial firm is migrating 200 locations from FortiGate firewalls to Cato Networks, citing ease of management, SASE feature set, ROI, and lower cost of ownership, and noting that Fortinet's SASE solution "did not rate as well as Juniper and Cato Networks."

Security itself is the harsher thread. One Senior Manager said simply, "The constant vulnerabilities, it's too much of a risk." A midsize company Director cited "terrible security posture, repeated zero-day compromises, terrible user interface, aggressive and incompetent sales reps." And price cuts against Fortinet here, too: a small retailer seeking a replacement "can't justify the price for what we get," while a financial firm shifting toward Zero Trust and Tailscale argued that "there are now far more cost-effective solutions available" and called the firewalls "a major security liability." These are individual accounts, not a market-wide conclusion, but they mark where churn risk concentrates.

What the Split Signals

Three patterns stand out for anyone underwriting a thesis on the firewall and SASE market. First, cost is a double-edged catalyst: it pulls accounts to Fortinet from Palo Alto, Cisco, and SonicWall, and pushes accounts out to Cato, Tailscale, and open source. Second, the Fortinet versus Palo Alto contest is account-specific, with displacement flowing in both directions in the same survey window. Third, and sharpest, is the asymmetry on security: no increaser raised Fortinet's vulnerability record, while it runs throughout the decreaser commentary as a primary exit driver.

The watch items follow directly. Track whether SASE evaluations keep rating Fortinet below specialists like Cato, whether the vulnerability narrative spreads from smaller accounts into larger ones, and whether the consolidation wins continue to skew long-term and strategic. Consolidation is a game Fortinet is simultaneously winning and losing, one account at a time, and the account-level reasoning is where the trade gets decided before the metrics move.

Want more respondent-level commentary, including spend levels, verticals, and strategic-fit detail? Reach out to insights@etr.ai for more information or to request custom research.