FortiSIEM pricing in 2026: the EPS and device licensing model, and what it really costs

The first thing to know is that Fortinet does not publish a FortiSIEM list price. There is no public Fortinet rate card, so every genuine number comes through a quote, with reseller SKU listings as the only public reference. What is documented, in Fortinet's ordering guide, is the model: four mutually exclusive ways to license (Device + EPS, GB per day, Cloud, and MSSP PAYG). On-premises, events per second (EPS), the sustained rate of security events the platform is entitled to process, is the meter most buyers meet first.

Under Device + EPS, EPS is bought through device and endpoint licences. A Device licence provides 10 EPS and an Endpoint licence provides 2 EPS, pooled, and Fortinet does not differentiate what kind of device, service, or application the licence monitors. The GB per Day model is a separate subscription sized on daily log volume. FortiSIEM Cloud licenses compute as FortiSIEM Compute Units (10 FCU provides 1,000 EPS, up to 600 FCU) and licenses Online Storage and Archive Storage as separate lines in 500 GB units, so storage is not folded into the FCU. MSSP PAYG, for qualifying MSSPs, licenses by devices, agents and UEBA. Device + EPS can be bought perpetual (CAPEX, with FortiCare support bought separately) or as an OPEX subscription.

On real numbers, the public reference points are reseller listings for named SKUs. Ingram Technologies lists the FSM-AIO-BASE perpetual licence (50 devices, 500 EPS, required with every perpetual order) at $19,061.10 and the FSM-AIO-2000-BASE perpetual licence for 100 devices and 1,000 EPS on the FSM-2000 appliance at $42,358, both excluding support. At scale, the FC8-10-FSM98-180-02-12 All-in-One subscription (minimum 5,000 devices) lists at $57.37 per device per year, about $286,850 a year at the minimum. These are reseller list prices, not Fortinet list pricing, and real quotes discount from them and vary by region, term and bundle.

The practical implication of the EPS meter is that cost tracks event rate, not raw bytes. Two environments with the same gigabytes per day can carry very different EPS depending on event size and verbosity, so FortiSIEM can be favourable for high-volume-but-large-event telemetry and less favourable for chatty, high-event-count sources. Filtering and aggregating at the collector, and sizing to sustained rather than peak EPS, are the levers that move the bill.

FortiSIEM wins most clearly for organisations already standardised on the Fortinet Security Fabric. Bundled commercial terms, native integration with FortiGate and the wider fabric, and the built-in discovery, CMDB, and availability monitoring make it a natural fit when Fortinet is already the network and security backbone. It also suits MSSPs, thanks to its multi-tenant architecture, and IT teams that value having asset inventory and performance monitoring inside the same platform as security analytics.

FortiSIEM is less compelling where transparent, self-serve pricing is a requirement (there is no Fortinet rate card), where the team wants a cloud-native security data lake with detection-as-code, or where the estate is not Fortinet-centric and the bundle advantage disappears. In those cases per-GB and consumption-priced platforms (Splunk, Sentinel, Chronicle, Panther) are easier to evaluate and often a better architectural fit. The deciding question is usually simple: if you are a Fortinet shop, FortiSIEM deserves the shortlist; if you are not, weigh it against the event profile and the friction of quote-only pricing.