ATP vs UTP vs Enterprise: which FortiGate bundle do you actually need?

The hierarchy, correctly

The bundles nest — each tier contains everything below it. From bottom to top: FortiCare → ATP → UTP → Enterprise Protection. (If you read somewhere that ATP is "UTP plus extras", it was wrong: ATP is the smaller security bundle, UTP the larger.)

Exact service composition varies slightly by FortiOS version and appliance generation — Fortinet adjusts bundle contents over time. We confirm the current composition for your specific model on the quote.

Who each bundle is for

FortiCare only — the "keep it supported" tier

Support, hardware replacement and firmware, no security subscriptions. Right when the FortiGate is purely a router/VPN box, or when another product handles security inspection. If users browse the web through this firewall, it's usually too thin.

ATP — core threat protection

Adds the essentials: IPS, anti-malware, application control, sandboxing. Right for environments where web filtering and antispam are handled elsewhere (a Microsoft 365 stack with Defender policies, say) but you still want the network edge inspecting traffic.

UTP — the default for good reason

Everything in ATP plus web/DNS/video filtering, antispam and IoT detection. This is the bundle most South African SMBs actually need — the full "unified threat protection" set at the edge. If you're unsure, UTP is the safe answer, which is why it's the most-renewed bundle by far.

Enterprise Protection — for specific needs, not status

Everything in UTP plus OT/industrial security and attack-surface management. Right for manufacturing plants, utilities, regulated industries, and complex estates. If you don't have OT networks or a compliance driver, you're likely paying for capability you won't switch on — renew UTP instead and bank the difference.

Renewal-time advice

• Don't auto-renew last year's bundle. Renewal is the natural moment to right-size — both up (you added a warehouse full of IoT devices) and down (you moved email filtering to the cloud and no longer need antispam at the edge).
• Match the bundle to what's actually configured. If web filtering has never been enabled, an ATP renewal may serve you at meaningfully lower cost. We check what your quote covers against what you describe using — and bundle choice is one of the three big price levers.
• Mixed estates can mix bundles. A 200F head office on Enterprise and branch 40Fs on UTP is normal — each device renews on its own bundle. See per-model options.