Demystifying Fortinet Licensing: Enterprise Protection vs. Unified Threat Protection (UTP) vs. Advanced Threat Protection (ATP)

A FortiGate without a security subscription still passes traffic. It just stops seeing threats.

That's the part of Fortinet licensing that surprises buyers most often. The hardware provides the firewall, the routing, the SD-WAN, and the acceleration. The FortiGuard subscription provides the intelligence that makes the security features work: the IPS signatures, the antivirus definitions, the web categories, and the sandbox verdicts. Choosing the right bundle is as important as choosing the right model.

The Two Layers of a FortiGate License

Every FortiGate license covers two separate things.

FortiCare is the support contract. It covers technical support, firmware updates, and hardware replacement. All three FortiGuard bundles include FortiCare Premium, which provides round-the-clock technical support.

FortiGuard is the security services subscription. It delivers the threat intelligence and security capabilities that run on the firewall. Fortinet packages these services into three bundles, and they build on each other.

What Each Bundle Includes

ATP covers the core network threat protection: IPS, antivirus, application control, and sandboxing. It suits environments where web filtering happens elsewhere, or where the FortiGate plays a narrower role.

UTP adds the web and DNS security layer on top of ATP, including blocking of malicious and newly registered domains and command-and-control communication. For most organizations using the FortiGate as their primary internet edge, UTP is the practical baseline.

Enterprise Protection adds the services that address data, SaaS, and the wider attack surface: CASB, DLP, IoT device detection, security posture rating against best practices and compliance frameworks, and inline malware prevention that stops unknown files in real time. It fits larger organizations, regulated sectors, and environments with significant IoT or SaaS exposure.

Fortinet also sells services individually. Organizations with specific needs can add single services to a bundle instead of stepping up a tier.

What Happens When a License Expires

The consequences depend on which layer lapses.

If FortiGuard expires, the FortiGate keeps routing and filtering traffic as a stateful firewall. The security services stop receiving updates, so IPS, antivirus, and web filtering fall behind the threats they're meant to catch. The device looks healthy while its protection quietly decays.

If FortiCare expires, the organization loses technical support, firmware updates, and hardware replacement. A hardware failure becomes an unsupported outage, and unpatched firmware becomes a growing risk.

Track both renewal dates for every device. Expired subscriptions on a single branch firewall are a common and avoidable gap.

What Sits Outside the Bundles

Several Fortinet capabilities require their own licenses and aren't covered by any FortiGuard bundle, including FortiSASE, FortiEDR, and the centralized management and analytics platforms FortiManager and FortiAnalyzer. OT-specific protocol signatures are also available as a separate FortiGuard service. Plan these into the budget alongside the firewall bundle.

How to Choose

Three questions settle most decisions:

1. Is the FortiGate your primary internet edge? If yes, the web and DNS protections in UTP are usually essential.
2. Do you need DLP, CASB, or IoT visibility, or do you report against compliance frameworks? If yes, Enterprise Protection likely costs less than adding those capabilities separately.
3. Are other tools already covering part of the stack? If a separate web gateway or SASE service handles web filtering, ATP may be enough on some devices.

Different devices in the same estate can carry different bundles. A head office edge firewall and an internal segmentation firewall rarely need the same services.

Get the Licensing Right the First Time

IT Builders is an authorized Fortinet Engage Partner holding seven Partner Specializations, along with the Engage Tech Support Partner and Engage Preferred Services Partner designations. Across more than 250 clients, our engineers match licensing to the role each device plays, avoid paying for overlapping services, and track renewals so protection never quietly lapses.

Reviewing a renewal or planning a new deployment?