FortiGate vs Palo Alto pricing: the five-year number

Why nobody can give you a number

A quote is a sales document. The person building it is trying to win the deal.

A quote that lines up cleanly against a competitor's makes winning harder. Scoping to a slightly different capability set, quoting a shorter term, and sizing to a smaller appliance each improve the total. Each is defensible on its own. Together they produce two documents that resist comparison.

Four further inputs move independently of the product itself.

Discount depth is set by the deal

What your customer pays is a negotiated number. Partner tier, deal size, the vendor's position as incumbent or challenger, and the point in the sales quarter all move the total. A published comparison reflects none of these. Two identically specified orders placed by different partners in different months come out at different prices.

The two vendors package along different lines

Fortinet groups security services into bundle tiers. Palo Alto names a subscription per capability. An equivalent configuration exists only once you assemble it deliberately on both sides until the capabilities match. Most published comparisons skip that step and compare a bundle against a partial stack.

Support tiers differ in scope

Support tiers set what your customer is entitled to. Response commitments, hardware replacement turnaround, and the level of engineer reached on escalation all vary by tier. Two quotes carrying different support tiers describe two different products. The cheaper one buys less.

Term length changes the shape

The discount attached to a longer term is itself negotiated. A three-year and a five-year commitment therefore resist clean annualization against each other. Dividing one by three and the other by five produces a number that looks precise and carries no meaning.

What actually drives it

Roughly in order of how much each moves the five-year total, which is close to the reverse of how much attention each one gets.

1. The appliance

The appliance is one payment inside a five-year model dominated by recurring costs. It receives the most attention and moves the total least.

Sizing is where it matters. An undersized appliance is replaced early, which costs far more than selecting a tier up at the start. Size against inspection throughput with decryption accounted for rather than against the headline firewall throughput figure. The sizing method is here.

2. The subscription

The subscription is the largest recurring line and the one most often mismatched between two quotes. Ask for the contents of both quotes listed capability by capability rather than by bundle name. Bundle names change and resist verification. Capability lists can be checked against the ordering guide.

Each vendor's structure carries a cost. Fortinet's bundling means your customer frequently pays for services they will never enable, and moving between tiers at renewal can be a step rather than an increment. Palo Alto's per-capability subscriptions mean the security posture they believe they bought is several separate line items, and a missing one is easy to miss until the day it matters. The capability-level matrix is here.

3. The support tier

Compare on scope. Ask both vendors to state response commitments and hardware replacement turnaround in the quote itself. Where the firewall is a single point of failure, the difference between next-business-day and four-hour replacement is material.

4. Term length

Fix the term identically across both quotes before comparing anything. Where one vendor quotes a different term, request both terms from both vendors.

5. Renewal pricing

Ask for renewal pricing in writing at the time of the original order, for every year of the model. This input has its own section below.

6. The management platform

Central management is routinely absent from a first quote and routinely required by year two. Past a handful of firewalls it becomes necessary, and both vendors license it by managed device count. A quote that omits it describes a smaller estate than the one being planned.

7. The labor

Operating labor sits on the profit and loss rather than on the quote. It has its own section below.

The five-year model

Complete this for both vendors on matched scope before comparing any total. Matched scope means an identical term, identical capability coverage, and an identical sizing basis.

This is a worksheet. We publish no prices for either vendor, so the numbers that belong in it come from your own quotes. A figure taken from a web page and repeated in a customer meeting is a liability.

Two rows are commonly left blank. Deployment and migration effort is real work with a real cost, and moving to a different platform costs more than staying on the current one. Operating labor is covered below.

Renewal is a separate negotiation

Initial pricing and renewal pricing are separate negotiations.

A vendor trying to replace an incumbent has a strong incentive to offer an aggressive discount. Three years later, the customer may depend on the platform, its integrations, and the expertise the team has built around it. A comparison that looks favorable in year one may understate the true cost by year four. This dependence gives the vendor more leverage at renewal.

This dynamic is a predictable part of the market and should be addressed when the original agreement is negotiated. Ask each vendor to state in writing how renewal pricing will be calculated for every year of the agreement. A vendor's willingness to provide those terms offers useful insight into what you can expect at renewal.

Where the real money goes

Every cost above appears on a document a vendor sends you. The largest recurring cost appears on your own payroll.

A firewall has to be monitored, patched, changed, and answered for when it breaks at 2am on a Sunday. That requirement is arithmetic before it is a hiring decision.

The full version of that arithmetic, across three coverage models and including the costs that are not salary, is on the build or buy page.

A week contains 168 hours and a full-time schedule covers 40. One seat staffed around the clock therefore requires 4.2 full-time engineers, before any allowance for leave, sickness, or training. Applying a standard absence factor of 1.2 to 1.3 puts the practical figure near five.

Published US medians for a network security engineer in 2026 span a wide band. PayScale reports $99,573, Indeed $116,534, ZipRecruiter $124,948, Salary.com $150,652, and Glassdoor $165,720. ZipRecruiter puts the 25th to 75th percentile at $104,500 to $143,000. Five engineers at the middle of that band is roughly half a million dollars in base salary, before employer burden, tooling, recruitment, or training.

Set that against the appliance and the subscription on the same worksheet. For most customers it is the largest line by a distance, and it is the one the quote never mentions.

Salary figures checked 4 August 2026 against each provider's public US average for "network security engineer". The 4.2 figure is 168 divided by 40. The absence factor range is the standard planning allowance for continuous shift coverage. A vendor estimate for a minimum viable 24/7 security operations team puts annual staffing above $1.5 million, which covers a broader function than firewall operations alone.

The requirement stays the same whichever vendor wins the hardware. Both leave the rota to the provider.

We have a commercial interest here, since running that rota for MSPs is our business. The point stands independently. A customer choosing between platforms on a difference smaller than their annual coverage cost is optimizing the smaller number, and raising that changes what the meeting is about.

Ten questions to send both resellers

Send all ten to both vendors in writing. The answers make the two quotes comparable.

1. What inspection throughput is this appliance sized for with decryption enabled, and what traffic profile was that figure measured with?
2. List every capability included in the proposed subscription, by capability rather than by bundle name.
3. Which capabilities in your product line are not included in this quote?
4. What are the support response commitments and the hardware replacement turnaround at this tier?
5. What is the term, and what does this same configuration cost at the other common term length?
6. What will subscription and support be priced at for each year after the initial term?
7. Does this include central management, and at what device count does it become necessary?
8. Does remote access as described here need any additional client, endpoint or posture licensing?
9. What deployment or migration services are assumed, and are they in this figure?
10. If a subscription lapses, what stops working and what keeps working?

Question six is deflected most often and changes the answer most often. Question ten is rarely asked and becomes relevant to most customers eventually.