FortiWeb 3-year total cost of ownership — comparing four deployment shapes
Published 13 Jul 2026
· By
Pawan Sharma
· Network Security
· 14 min read
CFOs ask one question: what does it actually cost over 3 years? The answer depends on workload shape — DC vs cloud, steady-state vs bursty, single-app vs multi-app portfolio. This guide projects 3-year TCO across the four mainstream FortiWeb deployment shapes (HW, VM-S subscription, BYOL on cloud, FortiAppSec Cloud SaaS) plus the PAYG-marketplace alternative, with the assumptions stated so you can rebuild the model against your workload.
5 shapes
Compared
HW, VM-S, BYOL, FortiAppSec SaaS, PAYG. All running same VM02-equivalent workload.
3 years
Horizon
Year-by-year cost projection. Renewal effect captured.
INR + GST
Currency
BYOL via Ogma is INR-locked. PAYG carries FX exposure.
Order-of-magnitude
Caveat
Illustrative bands. Ogma builds your specific TCO model in 5 working days.
The workload — what we're comparing against
Reference workload
Single application, ~100 Mbps HTTP peak, India region, 3-year horizon, no HA (single-instance)
This is the VM02 / FortiAppSec ~4 Bandwidth seats / FortiWeb-600F-equivalent workload. Real workloads scale up or down from here proportionally.
3-year TCO — five shapes side by side
| Shape | Year 1 | Year 2 | Year 3 | 3-year total (INR ex GST, illustrative band) |
|---|---|---|---|---|
| HW Appliance (600F Standard) | ~₹12 L (HW + 1yr svc) | ~₹3.5 L (renewal) | ~₹3.5 L (renewal) | ~₹19 L |
| VM-S Subscription (VM02 Standard, on-prem) | ~₹3.5 L | ~₹3.5 L | ~₹3.5 L | ~₹10.5 L |
| VM-S BYOL on AWS (+ EC2 m5.large) | ~₹3.5 L + ~₹70K compute | ~₹3.5 L + ~₹70K | ~₹3.5 L + ~₹70K | ~₹12.6 L |
| PAYG via AWS Marketplace | ~₹5.2 L (licence-bundled) | ~₹5.2 L | ~₹5.2 L | ~₹15.6 L |
| FortiAppSec Cloud Standard | ~₹4.5 L (4 BW + 1 App seats) | ~₹4.5 L | ~₹4.5 L | ~₹13.5 L |
Illustrative INR bands as of 30 May 2026, ex GST, assuming single-instance (no HA), no add-ons. HW Year 1 includes one-time HW + 1-yr Standard bundle; Years 2-3 are Standard renewal. Real quotes vary by distributor margin, term length, HA, and bundle tier. Treat as order-of-magnitude. Ogma builds your specific 3-yr TCO model against your workload in 5 working days.
Reading the numbers — what surprises CFOs
▸ HW Y1 looks expensive…
…but Y2 and Y3 drop sharply. Renewal is ~25-35% of HW cost per year. By Year 3 the HW path is competitive on annual run-rate.
▸ VM-S beats HW on 3-yr but loses on 5-yr
For a 5-year horizon, HW's amortisation continues to compound; VM-S keeps paying the full subscription. HW wins at 5+ years for steady-state.
▸ BYOL beats PAYG by ~₹3 L over 3 years
At this workload size. Bigger workloads (VM04, VM08) see the gap widen to ₹10-30 L over 3 years.
▸ FortiAppSec is close to VM-S
Subscription pricing is comparable; FortiAppSec wins on operational overhead (no FortiManager / FortiAnalyzer to operate).
▸ PAYG is the most expensive
For 3-year horizon at this scale. Only wins for sub-6-month workloads.
▸ Currency lock matters
BYOL INR-locked. PAYG carries 3-5%/yr FX exposure — ~10-15% cumulative over 3 years on top of the headline rate.
What changes the picture
| Factor | Effect on TCO |
|---|---|
| HA pair (active-passive or active-active) | Doubles all shapes equally — choice doesn't change between shapes |
| Bundle tier (Std → Adv → Ent) | +25-40% per step. Enterprise required for PCI 4.0. |
| Multi-year term (3-yr, 5-yr) | ~5-15% off rolling 1-yr. Compounds annual saving over the term. |
| Multi-region deployment | Licence per region. Multiplies the relevant shape's cost. |
| Higher throughput (VM04, VM08+) | BYOL vs PAYG gap widens. HW vs VM-S gap closes (HW gets relatively cheaper). |
| Operational hours | Self-managed shapes add ~15-30% of licence cost in operational hours. FortiAppSec Cloud absorbs this. |
| Multi-app portfolios | FortiAppSec per-seat scaling vs HW ML Domain ceilings. HW becomes relatively cheaper at larger portfolios. |
The 5-year picture (preview)
3 years is a typical CFO horizon. For a fuller picture, the 5-year view changes the winner:
| Shape | 5-year TCO (illustrative) | 5-yr vs 3-yr ratio |
|---|---|---|
| HW Appliance (600F) | ~₹26 L | 1.4× |
| VM-S Subscription (VM02) | ~₹17.5 L | 1.7× |
| VM-S BYOL on cloud | ~₹21 L | 1.7× |
| FortiAppSec Cloud | ~₹22.5 L | 1.7× |
HW's amortisation makes the ratio sub-linear (1.4× over 1.67×). For steady-state DC workloads with 5+ year horizons, HW wins decisively on TCO.
FAQ
What's the headline TCO winner for typical mid-market workloads?
Why is HW TCO best for steady-state DC workloads?
Does FortiAppSec Cloud SaaS save infrastructure cost?
How does the 3-year TCO change with HA pair?
What about FortiManager + FortiAnalyzer costs at multi-WAF scale?
Do the TCO numbers include opex hours?
How do you handle renewal cost increases?
Currency lock — how big is the FX dimension?
Free 3-year TCO model — your specific workload
Finance-ready output. Five working days. No commitment.
Ogma takes your workload (throughput, HA, region, term horizon, PCI scope) and returns a month-by-month 3-year and 5-year TCO across all 5 shapes — sized to your specific numbers.
Request the TCO model or explore the FortiWeb pricing landingSources
- FortiWeb Ordering Guide (FWEB-OG-R25-20260318) — all SKUs, bundle structure
- aws.amazon.com/marketplace — PAYG vs BYOL listings
- aws.amazon.com/ec2/pricing/on-demand — EC2 ap-south-1 rates
Related: BYOL vs PAYG math · FortiWeb pricing · FortiWeb pricing landing
Stay ahead of cyber threats
One short email a week — curated Indian cybersecurity news, Fortinet releases, DPDPA updates. No fluff.
