Blog

A practical guide to SASE, Zero Trust, Microsoft 365 security and VPN modernisation. 

FortiSASE is Fortinet's cloud-delivered Secure Access Service Edge (SASE) solution for secure remote access and hybrid work. It helps organisations protect users accessing the internet, Microsoft 365, SaaS services and private business applications. Security follows users wherever they work, rather than relying only on the office network perimeter. 

IBSCY Ltd, a Fortinet Advanced partner, helps companies plan and implement FortiSASE. Its role can include assessing security needs, design secure access policies and testing the solution with a pilot group. A phased rollout helps companies strengthen cloud security and adopt Zero Trust Network Access (ZTNA), which limits users to approved applications rather than granting broad network access. 

What is FortiSASE? 

• What is FortiSASE? FortiSASE is Fortinet's cloud-delivered Secure Access Service Edge (SASE) solution. It combines Security Service Edge (SSE) capabilities with connectivity options to secure users working beyond the office network. 
• Who is FortiSASE for? FortiSASE supports organisations with hybrid workers, remote employees, branch offices and cloud applications. Businesses using FortiGate can also evaluate FortiSASE as part of their Fortinet security strategy. 
• How does FortiSASE support Zero Trust access? Zero Trust Network Access (ZTNA) gives approved users access to specific private applications. This limits access to the resources they need, rather than opening up wider corporate network segments. 
• What security services does FortiSASE bring together? FortiSASE combines web security, SaaS security, cloud firewall services and private application access. Available features depend on the subscription, supported integrations and deployment design. 

How FortiSASE Secures Remote Users 

FortiSASE secures remote users through cloud-delivered security inspection and access policies. It helps protect internet browsing, SaaS use and access to approved private business applications. Protection depends on how users connect and which security controls are configured. 

FortiSASE can reduce the need to route internet traffic through headquarters. This may improve the remote-working experience, but faster access is not guaranteed. Performance depends on user location, service availability, traffic routing and inspection policies. A pilot should test key applications from typical working locations. 

Zero Trust Network Access (ZTNA) limits users to the applications the need. FortiSASE access policies can use user identity and supported device-posture checks to control access to private applications. Device posture describes whether a device meets security requirements. Strong authentication, endpoint protection and clearly defined permissions remain essential. 

IBSCY Ltd can help companies plan secure remote access with FortiSASE. This includes mapping users to the applications they need, choosing suitable connection methods and designing access policies. Company-managed devices, contractors and bring-your-own-device (BYOD) users should be assessed separately, as their access needs and available security controls may differ. 

How FortiSASE Fits with FortiGate 

FortiGate and FortiSASE work together to support security across offices, branches and remote users. FortiGate protects office and branch networks. FortiSASE provides cloud-delivered security and secure access for users working beyond those locations. 

FortiSASE lets existing Fortinet customers build on their FortiGate infrastructure. Rather than planning remote-user security in isolation, companies can consider office networks and cloud-delivered access together. Private applciation connectivity and software-defined wide area network (SD-WAN) integration must match the company's network design and supported product versions. 

 IBSCY Ltd, a Fortinet Advanced partner, can help plan FortiGate and FortiSASE integration. This includes reviewing existing infrastructure, identifying integration requirements and aligning security policies across office, branch and remote users. A coordinated design should define who manages, monitors and troubleshoots each service. It does not mean every security control is managed in the same way. 

What should companies check before integrating FortiGate and FortiSASE? 

• Connectivity: Plan how remote users and branch networks will connect to private business applications. 
• Compatibility: Confirm that existing FortiGate deployments supprot the required integrations. 
• Security policies: Align access rules, web controls and security policies across the deployment. 
• Monitoring: Define logging and visibility requirements to support incident investigation. 
• Resilience and support: Plan for service disruptions, assign support responsibilities and agree how configurations will be maintained. 

Can FortiSASE Replace a Traditional VPN? 

FortiSASE can replace some traditional remote-access VPN use cases, but not every application will be suitable. Zero Trust Network Access (ZTNA) offers access to specific private applications instead of broad network access. Migration should start by checking each application's access requirements and supported protocols. Traditional VPNS may still be needed for some systems. 

Zero Trust access checks identity and device conditions rather than trusting a VPN connection alone. Users receive access to approved resources based on defined permissions. Limiting those permissions can reduce exposure if an account or device is compromised. 

IBSCY Ltd can help companies plan a phased migration from VPN access to FortiSASE. This includes listing VPN-dependent applications, checking compatibility and choosing which services to migrate first. Legacy or specialist systems amy need to retain VPN access. the transition should include testing, a period when both access methods remain available and a documented plan to restore the previous setup I needed. 

 What are the potential benefits of VPN modernisation with FortiSASE? 

• More direct cloud access: Connect users to internet and cloud services more directly where the deployment supports it. 
• Application-specific permissions: Limit access to approved applications rather than wider network segments. 
• Less traffic through headquarters: Reduce reliance on the office network for remote-user internet access. 
• Clearer access visibility: Gain insight into access to approved business applications. 
• Structured onboarding: Establish a consistent access process for employees, contractors and partners. 
• Controlled migration: Retain VPN access for systems that still require it until suitable alternatives are validated. 

Core FortiSASE Capabilities 

FortiSASE combines secure internet access, SaaS security and private application access in a cloud-delivered platform. Its Security Service Edge (SSE) capabilities can work with Fortinet networking integrations. Before choosing subscription, confirm the features, licences, connection methods and application integrations your company needs. 

• Secure Web Gateway (SWG): Protect internet browsing. Applies web filtering, application controls and threat inspection to support traffic. These controls help restrict malicious websites and inappropriate destinations. 
• Zero Trust Network Access (ZTNA): Control private application access. Uses user identity and supported device security checks to grant access to approved private applications. 
• Cloud Access Security Broker (CASB): Manage cloud applciation use. Helps organisations see and control SaaS usage and sensitive data handling. This includes shadow IT- cloud applications used without IT approval. Coverage depends on the application and inspection or integration method. 
• Firewall as a Service (FWaaS): Inspect traffic in the cloud. Applies cloud-based firewall policies and security inspection or integration method. 
• SaaS Security Posture Management (SSPM): Identify cloud configuration risks. Checks supported SaaS integration for risky settings and security gaps. Findings help administrators prioritise fixes. 
• Secure Browser: Support controlled access from unmanaged devices. Where available and appropriate, it provides a controlled browsing environment. Confirm supported applications, everyday user workflows and restrictions on data handling before deployment. 
• Secure SD-WAN integration: Connect branch networking and cloud security. Brings software-defined wide area network (SD-WAN) connectivity into a broader Fortinet SASE design. Integration depends on the chosen network architecture. 
• Digital Experience Monitoring (DEM): Investigate user experience issues. Provides insight into connectivity and application performance to help IT teams investigate reported problems. 

IBSCY Ltd can help companies choose FortiSASE capabilities that address their security needs. Start with the users, applications and data that need protection most. Map features to business risks rather than selecting services simply because they appear on a product checklist. 

Protecting Microsoft 365 and SaaS Applications 

FortiSASE helps strengthen Microsoft 365 and SaaS security through visibility and controls for supported cloud application use. Protection depends on the available inspection settings and sensitive data- not just whether users can open an application. 

CASB, DLP and SSPM address different cloud security risks. A Cloud Access Security Broker (CASB) helps govern cloud application use. Data Loss Prevention (DLP) can detect and control sensitive data movement in inspected traffic. SaaS Security Posture Management (SSPM) checks supported SaaS configurations for security gaps. These services complement, rather than replace, identity security, tenant administration and native application protections. 

What should companies prioritise for Microsoft 365 and SaaS security? 

• Cloud application visibility: Identify approved applications and investigate shadow IT- cloud services used without IT approval. 
• Access risks: Review how users access supported services and what activity information is available. 
• Sensitive data protection: Define which business information needs protection and test suitable DLP policies. 
• SaaS configuration security: Assess supported configuration checks and assign responsibility for fixing security gaps. 
• Device access controls: Set appropriate access conditions fro company-managed and unmanaaged devices. 
• Everyday productivity: Test collaboration, file transfers and routine tasks before enforcing restrictions. 

IBSCY Ltd can help companies plan Microsoft 365 and SaaS security with FortiSASE. This includes assessing requirements, selecting relevant integrations and refining controls during a pilot. The aim is to balance data protection with everyday work. The assessment should also identify risks that still need native Microsoft 365 or SaaS settings and identity controls. 

 Consistent Security Across Offices and Remote Locations 

FortiSASE supports consistent security policies for office and remote work. Access decisions use verified user identity and relevant device and applications information. In a Zero Trust approach, wokring inside an office is not enough to establish trust. 

Consistent security does not mean giving everyone the same permissions. An employee on a company-managed laptop, a contractor using one application and a person on a personal davice may need different controls. Policies should match those needs without adding unnecessary exceptions based only on location. 

IBSCY Ltd can help companies organisae and maintain FortiSASE security policies. This includes defining reusable policy groups, reviewing exceptions and agreeing how changes are approved. Clear documentation and access logs help IT teams investigate problems and update policies as business needs change. 

What are the benefits of consistent FortiSASE security policies? 

• Aligned protection: Coordinate controls for internet, SaaS and private application access. 
• Less location-based trust: Avoid treating an office connection alone as proof that a user should have access. 
• Simpler policy management: Reduce deplicated or conflicting access rules. 
• Appropriate permissions: Match access to employee, contractors and partner needs. 
• Clearer policy updates: Establish a defined process for reviewing and changing security rules. 
• Better investigation evidence: Maintain consistent records to support security governance and incident investigation. 

 Scaling Secure Access as the Business Grows 

FortiSASE helps companies extend secure access to new users and locations through cloud-delivered security. This reduces the need for an identical security appliance at every user location. Branch connectivity and infrastructure for private business applications still require careful planning. 

Scaling FortiSASE requires more than adding licences. Before entering new regions or onboarding more teams, check service coverage, bandwidth and device setup. Identity integration an the IT team's ability to support additional users also need review. 

IBSCY Ltd can help companies plan a scalable FortiSASE rollout. Reusable configuration templates, clear onboarding guidance and agreed tests can make expansion more predictable. The plan should still account for different sites, user groups and access requirements. 

What should companies check before scaling FortiSASE? 

• Service coverage: Confirm availability and connectivity for each target location. 
• Subscriptions and traffic: Review lcience requirements and expected traffic demand. 
• Device onboarding: Plan device setup and any local infrastructure needed. 
• Security policies: Reuse approved templates and review exceptions. 
• User access: Define access arrangements for contractors, partners and mobile users. 
• Ongoing capacity: Reassess service coverage, capacity and support needs as the business grows. 

Building a Zero Trust Architecture

FortiSASE supports Zero Trust architecture through verified, least-privilege access. Least privilege means giving users only the access they need. Zero Trust is a security approach, not a product that eliminates every risk. Effective implementation also requires identity management, endpoint security, appropriate application design and clear operational processes. 

Zero Trust Network Access (ZTNA) connects users to approved private applications, not the wider network. Permissions should match each user's business role. Review access when employees, contractors or partners join, change roles or leave the organisation. 

Supported device-posture checks help assess whether a device meets security requirements. Policies can use this information and other supported context to respond to changing device conditions. Validate the available checks, when access is reassessed and how restrictions are enforced. These behaviours may differ between connection methods and deployments. 

What should a FortiSASE Zero Trust deployment include? 

• Identity and device verification: Use strong authentication and check relevant device security conditions. 
• Least-privilege access: Grant only the application access required for private applications and systems. 
• Protected private resources: Design connectivity to limit exposure of private applications and systems. 
• Controlled exceptions: Remove unnecessary broad permissions and document justified exceptions. 
• Access lifecycle reviews: Review employee, contractor and partner permissions as their role and relationship change. 
• Logging and ivnestigation: Retain useful access logs and define procedures for investigating security issues. 

IBSCY Ltd can help companies put Zero Trust principles into practice with FortiSASE. This includes mapping business roles to applications, configuring supported access controls and testing that approved access works while unauthorised access is denied. Regular reviews help keep the deployment aligned with changing business needs. 

Business Benefits to Evaluate 

FortiSASE can help simplify security operations, improve visibility and support reliable application access. These potential business benefits depend on your existing environment, chosen services and implementation. Evaluate results against your company's goals, including how easily users can complete everyday tasks. 

• Reliable application access: Test whether employees can reach essential applications from their usual working locations. 
• Simpler security management: Look for opportunities to consolidate overlapping tools and policies. Include integration and support effort in the assessment. 
• Clearer security visibility: Check whether logs and dashboards give IT teams useful insight into applications where feasible. 
• Repeatable business expansion: Use consistent onboarding and rollout processes for new users, locations and applications. 
• Coordinated networking and security: Align connectivity plans with security needs and application performance. 

IBSCY Ltd can help measure FortiSASE's value through a controlled pilot. Record current performance and operating conditions as a baseline, then agree what success should look like. Compare pilot results with that baseline before making investment decisions. Lower costs and faster access should be demonstrated, not assumed. 

How IBSCY Ltd Can Help Implement FortiSASE

IBSCY Ltd, a Fortinet Advanced parter, can help companies assess, design and implement FortiSASE. Start by identifying where users work, which applications they need and how devices are manaed. Define the security and performance problems the deployment should address. 

A phased FortiSASE implementation starts with one clear use case. IBSCY Ltd can work with your IT team to coordinate the design, check prerequisites and define deployment and support responsibilities. Agree the project scope, subscriptions and ongoing service arrangements before work begins. 

How can IBSCY Ltd help implement FortiSASE? A six-step approach: 

1.  Assess the environment: Review users, devices, locations, applications, identity systems, FortiGate infrastructure and VPN usage. Identify dependencies and security gaps. Record current performance and support demand as a baseline. 
2. Define goals and scope: Choose the first business problem to address and the pilot users. Agree success criteria, licensing, supported features and service coverage. Clarify the responsibilities of IBSCY Ltd and your IT team. 
3. Design the solution: Plan identity integration, authentication, device onboarding and private application connectivity. Define access policies and Microsoft 365 and SaaS requirements. Include logging, resilience and a plan to restore the previous setup if needed. 
4. Configure and run a pilot: Deploy the agreed services to a representative user group. Test web access, collaboration and private applications under realistic conditions. Check supported device-security checks and access-policy enforcement. 
5. Measure, refine and prepare users: Review performance, security events and help-desk feedback. Adjust policies and document exceptions. Provide practical user and administrator guidance before expanding the deployment. 
6. Roll out and optimise: Add users and applications in planned phases. Retain necessary legacy access until replacements are validated. Agree operational handover, policy reviews and any ongoing support or optimisation services. 

Measure FortiSASE implementation success against agreed targets. Track application response times, access failures, VPN usage, onboarding time, help-desk demand and policy-management effort. Compare results with the pre-deployment baseline at each rollout stage. Deployment alone does not prove success. 

Prepare your team to manage FortiSASE after launch. Within the agreed project scope, IBSCY Ltd can help document the configuration, explain common troubleshooting steps and support user and administrator training. Define support escalation routes, change approvals and review schedules for ongoing operations. 

Is FortiSASE Right for your Organisation? 

FortiSASE is worth considering if your organisation needs secure remote access, cloud security and controlled access to private applications. It may suit businesses with distributed teams, existing FortiGate infrastructure or plans to reduce reliance on traditional VPNs. 

Choose FortiSASE based on your company's requiremenst, not its feature list alone. Check application compatibility, user locations, device requirements and supported integrations. Include both implementation and ongoing operating costs. An assessment and pilot can help confirm suitability before a wider rollout. 

Start your FortiSASE deployment with one clear priority. This could be secure remote internet access, SaaS visibility or controlled access to a private application. IBSCY Ltd can help select the first use case, validate the design and plan a phased rollout based on pilot results. 

Plan your FortiSASE implementation with IBSCY Ltd, a Fortinet Advanced Partner. Contact  [email protected] to discuss assessment, solution design and implementation support. Agree an approach that fits your company's users, applications and infrastructure.