FortiSandbox 500G
10,000 files per hour, up to 1,400 users
- Files per hour
- 10,000
- Users
- 1,400
- Local VMs
- 2 + 12 optional
The FortiSandbox 500G detonates suspicious files in instrumented virtual machines and reports what they actually do, at 10,000 files per hour. Verdicts feed back automatically to every FortiGate, FortiMail and FortiClient in the Fabric.
10,000 files an hour and 1,400 users, with 2 local VMs expandable by 12. Remember the published figures already assume pre-filtering is on and are tested at 80% documents to 20% executables, so size on what actually reaches the sandbox after filtering, not on total email and download volume. That distinction routinely changes the model.
How to work out whether it fits
The arithmetic a datasheet leaves out. If any of it does not match your situation, that is worth a call rather than a guess.
Ten thousand files an hour is far more than most mid-size organisations generate post-filter, so this model is usually chosen for the local VM headroom rather than the throughput. Two VMs expandable by twelve is the number to plan against: concurrent detonation capacity determines whether a burst queues, and a queue during a phishing campaign is exactly when latency matters. Buy the expansion licences with the appliance rather than after the first incident.
What to order alongside the FortiSandbox 500G
The published threat protection figure for this model is measured with IPS, application control and malware protection all running. Those arrive as a FortiGuard subscription, so the bundle you choose decides whether the hardware can reach the number you sized it on. Every bundle already includes FortiCare Premium 24x7 support.
| Bundle | What it adds | 1 yearlist price | 3 yearslist price | 5 yearslist price |
|---|---|---|---|---|
| Enterprise ProtectionENT | The broadest bundle. Everything in UTP, plus the services that cover data, SaaS posture and attack-surface visibility, plus inline zero-day malware prevention. | on quote | on quote | on quote |
| Unified Threat ProtectionUTP | The traditional mid-tier: perimeter defence covering network, file, web and email threats. Everything most sites actually switch on. | on quote | on quote | on quote |
| Advanced Threat ProtectionATP | The narrow bundle: IPS and the full malware stack including cloud sandboxing, without the web and email filtering layers. | on quote | on quote | on quote |
These are Fortinet list prices. You will not pay them.
Every quote we write is discounted from list, and how far below depends on quantity, term and whether we register the deal with Fortinet. Longer terms also price better per year, which is why three and five year bundles are usually the better buy on a device you intend to keep through a refresh cycle. Part numbers follow Fortinet’s standard bundled convention; not every model carries every combination, so we confirm the exact orderable SKU before anything is placed.
Highlights
- 10,000 files per hour
- Verdicts shared automatically across the Security Fabric
- Catches targeted malware no signature has seen
- Samples never leave your premises
Typical deployments
- Mid-size organisations with on-premises analysis requirements
- Estates where FortiMail and FortiGate both submit samples
- Deployments needing verdicts without leaving the network
What this includes
Fortinet publishes no throughput table for this product; it is licensed per user, endpoint, workload or account. What follows is capability and sizing, not benchmarks.
Capacity
Effective sandboxing throughput is tested on files that are 80% documents and 20% executables, including both static and dynamic analysis, with pre-filtering enabled. User counts assume a ratio of one user per 25 emails.
| Effective sandboxing throughput (files/hour) | 10,000 |
|---|---|
| Number of users | 1,400 |
| Number of local VMs | 2 + 12 optional |
Sources
- Fortinet Product Matrix (July 2026), retrieved 2026-09-01
- Fortinet Partner Portal price list, retrieved 2026-09-01
Reproduced from Fortinet published documentation and subject to change without notice. Where a figure is load-bearing for your design, ask us to confirm it in writing before you order; we will.