Hardware vs VM vs Cloud vs FortiCloud — the FortiWeb 5-question test

Q: This is a quick test — when do I need the full guide?

If you answer 2 or more questions differently from the recommended pattern, or your workload spans multiple deployment categories, read the full FortiWeb deployment models guide. This quick test is for the single-app or single-deployment-shape decision.

Q: What if I run multiple apps with different needs?

Most enterprises run hybrid — HW for DC + VM-S BYOL for cloud production + FortiAppSec for public marketing site. Pick the shape per app and centralise via FortiManager.

Q: What if my answer changes with workload growth?

Plan for the 18-month horizon, not the current state. If you're at 25 Mbps now but trajectory says 200 Mbps in 12 months, size for VM02 (100 Mbps) or VM04 (500 Mbps), not VM01.

Q: Can I change deployment shape later?

Yes — but with cost. HW to VM is a re-quote + re-deploy. VM-S to FortiAppSec Cloud is a re-quote + DNS swap. Container to VM is a re-architect. Cheaper to pick right the first time.

Q: Does the 5-question test account for cost?

Indirectly. Q5 (BYOL vs PAYG) is the explicit cost question. The other four are fit questions — the right deployment shape is usually the cheapest one for that workload class.

Published 06 Jul 2026 · By Pawan Sharma · Network Security · 11 min read

Five questions, one right FortiWeb deployment shape. Answer in order; the first decisive answer picks your shape. This is the 60-second version of the full deployment models guide — for the single-app decision or first-pass scoping. If your workload is multi-app or mixes deployment categories, jump to the full guide.

5 questions

Decision tree

Sequential — first decisive answer picks your shape.

~60 sec

Time to answer

For single-app or first-pass scoping decisions.

5 shapes

Possible outcomes

Appliance, VM-S, Cloud BYOL, FortiAppSec Cloud SaaS, Container.

+ tier

Then bundle

Once shape is picked, Std / Adv / Ent bundle by PCI scope and feature need.

Question 1 — Is the app on Kubernetes / containers?

If YES

→ FortiWeb Container

Sidecar or ingress integration. CI/CD-aligned policy refresh. Continuous-learning ML adapts to app updates automatically. This is the only shape that fits container-native estates cleanly.

If NO → continue to Q2.

Question 2 — Does the app need to run on-premise or in your DC?

If YES

→ FortiWeb HW Appliance

Pick model by HTTPS throughput at peak — 100F (100 Mbps) through 4000F (70 Gbps). 60% headroom rule applies. ML Domain count nudges sizing up for large app portfolios. Best TCO over 5-year horizon for steady-state DC workloads.

If NO (cloud-native) → continue to Q3.

Question 3 — Is the app public-facing and DNS-front-able?

If YES, AND zero infra appetite

→ FortiAppSec Cloud (SaaS)

CNAME the app hostname. Multi-region delivery, CDN caching, DDoS bundled. Three plan tiers. Bandwidth seats (25 Mbps each) + Application seats (1 app each). Zero infra to manage.

If NO (internal cloud app, or you want policy depth control) → continue to Q4.

Question 4 — Is the app on AWS or Azure (or GCP, OCI, IBM)?

If YES, AND duration ≥ 12 months

→ FortiWeb-VM BYOL (via Ogma)

Annual subscription priced in INR + GST. Cloud carries only compute. Typical 30-50% savings vs marketplace PAYG over 12-36 months. Five tiers — VM01 (25 Mbps) through VM16 (6 Gbps).

If YES, AND duration < 6 months (POC, project) → consider PAYG via marketplace instead. Continue to Q5 for the explicit BYOL vs PAYG check.

Question 5 — Will the workload run for 6+ months at steady state?

If YES (production, 6+ months)

→ BYOL via Ogma
INR + GST locked rate
Multi-year term saves more
Partner-managed renewal
Typical saving: 30-50% over PAYG

If NO (POC, project, bursty)

→ PAYG via cloud Marketplace
Per-hour billing
No commitment
Higher hourly rate
Right answer for short-duration workloads

Once the shape is picked — pick the bundle

Workload type	Recommended bundle	Why
Dev / UAT / non-production	Standard	OWASP Top 10, signatures — sufficient for non-prod
Production non-card	Advanced	+ Sandboxing, ML detection, Threat Analytics, Credential Stuffing Defense
Card-payment / PCI 4.0 in scope	Enterprise	+ Client-Side Protection for PCI 4.0 Req 6.4.3 + 11.6.1
Bot-heavy (e-commerce, BFSI)	Enterprise	Advanced Bot Protection — ML + biometric + behavioural
API-heavy / public APIs	Advanced+	API Discovery + Schema enforcement + API Gateway (FortiAppSec)

The 5 answers, mapped to deployment shape

Q1 (K8s?)	Q2 (DC?)	Q3 (public+DNS?)	Q4 (cloud?)	Q5 (6+ mo?)	Shape
Yes	—	—	—	—	Container
No	Yes	—	—	—	HW Appliance
No	No	Yes (zero infra)	—	—	FortiAppSec Cloud SaaS
No	No	No	Yes	Yes	Cloud BYOL via Ogma
No	No	No	Yes	No	PAYG via Marketplace
No	No	—	No	—	VM-S on private cloud

Hybrid is the most common real answer

If your apps span categories (and most enterprise estates do), you don't pick one shape — you pick the right shape per app:

▸ DC apps

HW appliance pair

▸ Cloud production apps

FortiWeb-VM BYOL

▸ Marketing / public site

FortiAppSec Cloud SaaS

▸ Microservices in K8s

FortiWeb Container

▸ Short-duration POC

FortiWeb-VM PAYG

▸ Centralised management

FortiManager across all shapes

FAQ

This is a quick test — when do I need the full guide?

If you answer 2 or more questions differently from the recommended pattern, or your workload spans multiple deployment categories, read the full FortiWeb deployment models guide. This quick test is for the single-app or single-deployment-shape decision.

What if I run multiple apps with different needs?

Most enterprises run hybrid — HW for DC + VM-S BYOL for cloud production + FortiAppSec for public marketing site. Pick the shape per app and centralise via FortiManager.

What if my answer changes with workload growth?

Plan for the 18-month horizon, not the current state. If you're at 25 Mbps now but trajectory says 200 Mbps in 12 months, size for VM02 (100 Mbps) or VM04 (500 Mbps), not VM01.

Can I change deployment shape later?

Yes — but with cost. HW to VM is a re-quote + re-deploy. VM-S to FortiAppSec Cloud is a re-quote + DNS swap. Container to VM is a re-architect. Cheaper to pick right the first time.

Does the 5-question test account for cost?

Indirectly. Q5 (BYOL vs PAYG) is the explicit cost question. The other four are fit questions — the right deployment shape is usually the cheapest one for that workload class.

Free 30-min FortiWeb scoping call

Confirm the right shape + tier against your specific workload

Ogma walks the 5-question test against your actual app portfolio in 30 minutes and returns a sized FortiWeb recommendation — shape, tier, term, HA topology — plus an INR quote in 2 working days.

Book the scoping call or read the full deployment models guide

Sources

FortiWeb Ordering Guide (FWEB-OG-R25-20260318) — deployment shapes, tiers, SKUs
FortiWeb Data Sheet — feature set

Tags Fortinet FortiWeb WAF Sizing Decision Deployment

Stay ahead of cyber threats

One short email a week — curated Indian cybersecurity news, Fortinet releases, DPDPA updates. No fluff.

Hardware vs VM vs Cloud vs FortiCloud — the FortiWeb 5-question test