Tool profile
FortiSOAR: cost, fit and limits
FortiSOAR is a security orchestration, automation and response platform made by Fortinet, Inc. of Sunnyvale that adds prebuilt AI agents to playbooks for incident response, vulnerability management and IT or OT operations. It is sold as SaaS or software.
What to know first
FortiSOAR combines playbook automation with more than 20 prebuilt expert agents that run in workflows, in playbooks or through MCP, and supports your own or third-party agents and LLMs. The page claims over 700 API connections and offers SaaS or self-managed deployment. Default agents use FortiAI, which the FAQ says is powered by OpenAI. No price or licensing model is on the page.
FortiSOAR at a glance
| Maker | Fortinet, Inc., United States |
|---|---|
| Free plan | No |
| Entry price | Quote only |
| API access | Yes |
| Category | Best AI SOAR Platforms in 2026, rank 7 of 10 |
| Website | fortinet.com/products/fortisoar |
Who FortiSOAR is best for
Fortinet customers
Native fit with a Fortinet estate is the obvious draw, and the page covers incident management, vulnerability management and compliance and IT or NOC operations.
Teams with OT environments
The product includes OT security features, which suits industrial sites that need response steps beyond the corporate network. Ask which OT protocols are supported.
Buyers who need control over agents
Governance controls include execution controls, access policies, guardrails and logging of each agent step, so teams can limit what an agent may do.
FortiSOAR plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| SaaS FortiSOAR | Not shown | Fortinet-hosted deployment of the platform; the page directs buyers to speak with an expert, and no pricing is listed. |
| Self-managed FortiSOAR | Not shown | Customer-managed software deployment of the same platform; licensing details are in an ordering guide that was not read. |
| Pre-built solution packs | Not shown | Packs for common SOC and IT workflows, plus a virtual MCP server for sources that offer APIs but not MCP. |
Checked November 2026.
What FortiSOAR does
- Prebuilt expert agents
- More than 20 agents handle autonomous or interactive alert investigation, playbook building, free-form tasks and operations insights, and can be invoked in playbooks or over MCP.
- Bring your own agents and LLMs
- The platform supports your own or third-party agents and your preferred LLM, so a customer is not tied to the default model. That keeps model choice with the customer.
- AI-powered playbooks
- Playbooks combine AI reasoning with predictable execution, so an AI step can sit between deterministic steps without taking over the whole flow. Rules stay predictable while language reasoning handles the ambiguous steps.
- Agent governance
- Execution controls, access policies and guardrails limit agent actions, and each step is logged for review. Logs of every step let reviewers reconstruct what an agent did, which is essential before widening autonomy.
- Connections and MCP
- The page cites over 700 API connections and MCP-based communication, with a virtual MCP server for sources that lack it. Sources without MCP can still be reached through the virtual server.
How FortiSOAR handles your data
Hosting regions, certifications and AI data use go unmentioned on the product page. Fortinet's privacy policy says its data centers for processor data are located primarily in Canada, that it uses Standard Contractual Clauses for transfers, and that backups may be kept longer than the original data. It states no dedicated AI policy and no position on training. The default agents use FortiAI, which the FAQ says is powered by OpenAI, so a buyer should ask how prompts reach that provider and whether a self-managed deployment avoids it.
Where FortiSOAR falls short in practice
- Default model is third-party. The FAQ states FortiAI is powered by OpenAI, so organizations that bar external model providers must configure their own LLM. A model change adds configuration work.
- No price on the page. Licensing is handled through an ordering guide and a sales form, so the cost per user, action or deployment is unknown from public pages. Expect to need the ordering guide.
- No certification stated. The page names analyst awards and reviews, not security certifications, so assurance documents must be requested. Ask for current reports and scope documents, because the public page offers none to rely on in a vendor review.
Works with
Alternatives to FortiSOAR
FortiSOAR: common questions
Can FortiSOAR run self-managed?
Yes. The product page says FortiSOAR is available as SaaS or as self-managed software. Pricing and licensing for each are handled through the ordering guide and a sales conversation. Ask about differences in features and support between the two. Both are covered.
Which AI model does FortiSOAR use?
Default pre-built agents use FortiAI, which the FAQ says is powered by OpenAI. The page also says customers can use their own or third-party agents and their preferred LLM. Ask how the default agents handle your data. Check the data terms.
How many integrations does FortiSOAR have?
The page claims over 700 API connections and MCP-based communication, plus prebuilt solution packs. Verify that your specific products have maintained connectors before relying on the number. Ask for the maintained connector list. Test them with a pilot on your real products and actions before you commit.
Does FortiSOAR cover OT?
The product page says it includes OT security features alongside incident management, vulnerability management and IT or NOC operations. Ask for a demo with your own OT protocols and assets. Ask for a pilot against your assets and protocols. Include them in the pilot scope.
Does FortiSOAR have security certifications?
The page lists analyst and peer recognition, including a Gartner Peer Insights award and a KuppingerCole ranking, rather than certifications. A product certifications page exists on the site, but its content was not read. Ask the vendor for its current attestations and scope.