FortiClient secures remote access and protects endpoints. Editions, EMS, the move to IPsec, ZTNA and integration into FortiEndpoint.
FortiClient is Fortinet's agent installed on workstations: it provides secure remote access (VPN and ZTNA), web filtering and, depending on the edition, protection against malware. Centrally managed by FortiClient EMS, it also reports the device's security posture to the Security Fabric. In 2026, it is part of the FortiEndpoint platform, which brings FortiClient and FortiEDR together under a single agent and a single console.
FortiClient is designed as a modular agent. The features that are actually enabled on a given endpoint depend on the edition and the licence purchased:
There is also a free version of the agent limited to VPN, with no central management or support, suitable for occasional use but not for a corporate fleet.
The value of FortiClient in the enterprise lies mainly in its management by FortiClient EMS (Endpoint Management Server), on-premises, or by its cloud equivalent. EMS makes it possible to:
These tags are then shared with FortiGate, which can use them as criteria in its firewall policies. A non-compliant endpoint can thus be quarantined or denied access to certain applications.
Many organisations use FortiClient as an SSL VPN client in tunnel mode. However, starting with FortiOS 7.6.3, SSL VPN tunnel mode is no longer supported on FortiGate and its configuration is not carried over during the upgrade. Fortinet asks customers to migrate to IPsec VPN before moving to this version. IPsec can run over TCP (port 443 by default) to traverse networks where UDP is filtered. The former web mode, which does not require an agent, is retained under the name "Agentless VPN".
In concrete terms, for administrators, this means preparing new IPsec VPN profiles in EMS, testing them, and then pushing them to endpoints before upgrading the firewalls, in order to avoid an interruption of remote access.
With ZTNA, FortiClient no longer grants access to an entire network but to specific applications. FortiGate acts as an access proxy in front of the applications and checks, for each connection, the user's identity, the device certificate issued by EMS and its posture tags. If the posture deteriorates during the session, access can be revoked. This model reduces the opportunities for lateral movement if an endpoint is compromised.
Fortinet now groups its endpoint offerings under the FortiEndpoint name. The platform brings together in a single agent and a common console the ZTNA, VPN, endpoint protection, antivirus, EDR (endpoint detection and response, provided by FortiEDR), data protection and AI application usage visibility functions. The integration of the FortiEDR agent into FortiClient appears in the documentation from FortiClient 7.4.1 onwards. In July 2026, Fortinet added FortiAI-Assist, to query the console in natural language, as well as native data loss prevention.
For an organisation whose fleet is already equipped with FortiClient, this evolution makes it possible to consider EDR without multiplying agents on endpoints.
FortiClient administration is closely tied to FortiGate administration: IPsec VPN, ZTNA, posture tags and security policies are configured on both sides. The FortiGate Administrator certification preparation covers the firewall side. For endpoint and network defence more generally, EC-Council CND addresses endpoint protection and monitoring, and CompTIA Security+ provides the essential foundations.
FortiClient is no longer just a VPN client: it is the agent that connects the workstation to the organisation's security policy. The priorities for 2026 are clear: migrate SSL VPN tunnel mode connections to IPsec, rely on EMS and posture tags for ZTNA, and assess convergence with FortiEDR within FortiEndpoint.