Start with an
assessment, not a sales pitch.

One office: compare Essential and Secure. Regulated practice: Compliance. Two or more locations: Multi-Site. Higher tiers include everything in Essential.

Billed monthly. Onboarding is a one-time fee of twice the monthly plan fee, at least $1,950 and no more than $3,500 for the first site; each additional full site is $1,500. You can give notice in the first 90 days and leave 30 days later without an early-termination fee; onboarding fees are non-refundable. The initial term is 12, 24 or 36 months. Longer terms lock your price instead of discounting it: a 3% adjustment after year one on 24 months, one adjustment only on 36 months. After the initial term, 60 days' notice. Your documentation, configuration history and credentials come back to you within 30 days if you leave.

If we miss the business-hours acknowledgement target on a Critical issue, you can claim a credit of 10% of that site's monthly fee, up to 25% a month, in writing within 60 days; it comes off your next invoice. Credits follow the terms in your agreement; Firmware Care targets and downtime during a firmware window don’t qualify.

Firmware Care. For FortiGates listed under Firmware Care in your agreement, we watch Fortinet’s security advisories and CISA’s list of actively exploited vulnerabilities during business hours. If an actively exploited issue affects a feature that is enabled and reachable on your firewall, within one business day of learning of it we aim to assess it, tell you, and apply Fortinet’s mitigation where a suitable one exists, or propose it to you first if it would disable something you use. Once your firewall is on our recommended release, we aim to install Fortinet’s fix within 14 calendar days for those actively exploited issues, or within 30 calendar days for other Critical or High issues, starting once Fortinet has both released a fix on your firewall’s current release line and published the advisory; these clocks pause while a prerequisite is missing, while you haven’t responded to a proposed window, or if you choose a later window, and a fix that needs a move to a new release line is quoted. Up to four planned upgrade windows per site per contract year are included, normally on a weekday evening, scheduled with you; extra windows, and windows moved outside our schedule at your request, are billed or wait for the next scheduled one. On Edge Firewall Managed, Firmware Care’s windows replace the one yearly window. The add-on is $125 a month per site on Essential and per firewall or high-availability pair on Edge Firewall Managed. These are targets, not guarantees, and they don’t earn service credits. Each window needs active Fortinet support on the firewall, our recovery kit at the firewall, a named on-site contact reachable during the window and the next business morning, a signed site recovery acknowledgment, and your approval of the window and of any billable recovery work. If an upgrade fails, remote recovery is free at any hour. On-site recovery is free, including travel, at sites that are Recovery-Ready at the start of the window (a working Ambio-approved cellular out-of-band console that you purchase, or a synced high-availability pair with both units under support), except where the cause is a hardware fault or that console or pair was unavailable for reasons outside our control; otherwise it bills at our on-site rates, including the minimum, trip charge and after-hours rates, or at an on-site partner’s charges stated before dispatch; if the failure came from us not following our documented upgrade procedure, we waive the on-site labor but not travel. Switch and access point firmware is quoted per window. The full terms are in your service agreement, which governs.

Human response is business hours. Outside business hours monitoring and alerts keep running; emergency work is $487.50 per hour ($525 for architecture work), two-hour minimum, when an authorized contact asks. A planned after-hours change can be booked as a scheduled two-hour evening cutover window, $325 per window. Response means acknowledgement, triage and the start of mitigation, not a guarantee of repair or uptime. Incidents caused by a single-carrier internet outage where you declined a second circuit, end-of-life equipment, changes made without us, or a risk we recommended fixing that was declined are outside response targets and bill at the hourly rate. On Secure and up, ISP escalation is included except in that one case: a single-carrier outage where you declined a second circuit is billed hourly on every plan.