- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Fortra Cloud Security (CASB, SWG, ZTNA)
A contractor downloads your client list from SharePoint onto a personal laptop. Your office proxy never sees it — Fortra CASB, Fortra SWG and Fortra ZTNA share one agent, one proxy and one policy to control SaaS, web and private-app traffic, with DLP and file encryption built in — the security service edge Fortra bought from Lookout in May 2025.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Fortra platform family
This page covers Fortra CASB, Fortra SWG and Fortra ZTNA — Fortra DSPM, from the same Lookout deal, has its own page. The rest:
Quick facts
30-second orientation- Product
- Security service edge: Fortra CASB, Fortra SWG and Fortra ZTNA on one agent, one proxy and one policy
- Maker
- Fortra, LLC of Eden Prairie, Minnesota; privately held, backed by TA Associates and Harvest Partners
- Origin
- Bought with Lookout’s Cloud Security business on 12 May 2025; Lookout kept its mobile security line
- Delivery
- SaaS only, with no on-prem edition; Lookout ran its PoPs on AWS and Google Cloud
- Modules
- Web gateway, CASB, ZTNA, DLP, EDRM, browser isolation, firewall-as-a-service, UEBA, sandbox, CSPM/SSPM
- Identity
- Okta, Ping Identity and Microsoft Azure AD are the identity providers named in the ZTNA datasheet
- Analysts
- KuppingerCole Zero Trust Platforms 2026: Product and Market Leader; not in Gartner’s 2025 or 2026 SSE MQ
- Price
- Quote-only; CASB, SWG and ZTNA are each quoted on request, with no bundle, tier or meter published
- India
- Fortra documents no Indian PoP, no India log region and no PoP list at all; there is no on-prem route
- In India via
- TechBag — PoP and log answers in writing, a latency pilot, and a quote in INR with GST
Understand SSE before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is a security service edge?
An SSE moves the web gateway, CASB and ZTNA into the cloud, so policy follows users wherever they work.
VPN plus an office proxy vs Fortra Cloud Security — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | VPN plus an office proxy | Fortra Cloud Security (CASB, SWG, ZTNA) |
|---|---|---|
| Remote access | VPN puts users on the network | Per-app access, with or without an agent |
| Web traffic | Hairpinned through the office proxy | Inspected by a cloud proxy; PoP list unpublished |
| SaaS data | Unseen once it reaches the cloud app | Proxy and API CASB with inline DLP |
| Downloaded files | Plain copies on personal devices | Encrypted on download for key holders |
| Policy | Three consoles, three rule sets | One agent, one proxy, one policy |
| What it is NOT | — | SD-WAN, experience monitoring or an India PoP list |
The cheapest test is a pilot with one team: measure latency from each Indian office before you compare features.
The four pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Agent
One agent steers web, SaaS and private-app traffic and reports device posture; contractors and BYOD users can reach web apps through agentless browser access instead.
Proxy
Forward and reverse proxy plus firewall-as-a-service inspect web and non-web traffic once, applying DLP, threat engines and isolation; PoP locations are not published.
API
API mode scans data already stored in SaaS tenants such as Microsoft 365 and Google Workspace, and checks SaaS and IaaS settings for risky configuration.
Policy
One policy set governs all three products, and Fortra’s ARC layer merges their signals with DSPM findings and Fortra DLP endpoint and network data for reporting.
One agent and one cloud proxy carry web, SaaS and private-app traffic to a single policy — Fortra does not publish where its points of presence are.
Nine capabilities. Web, SaaS, private apps.
Fortra Cloud Security sends web, SaaS and private-app traffic through one proxy — and keeps DLP and encryption on the data the whole way.
Cloud web gateway
URL and content filtering from Fortra’s Security Graph, several threat-intel engines, and TLS inspection done once for all traffic.
Firewall as a service
Built-in firewall-as-a-service handles non-web traffic on all ports and protocols, so remote users skip the office firewall.
Isolation and phishing
Remote browser isolation renders risky sites away from the device, and AI-based detection flags phishing pages as they load.
Proxy and API modes
Forward and reverse proxies plus API scanning cover managed laptops, unmanaged BYOD devices and data already stored in SaaS tenants.
DLP with file encryption
Inline DLP can encrypt, watermark, mask, redact or expire content, and EDRM encrypts downloads so only key holders can open them.
SaaS posture and behaviour
CSPM and SSPM checks catch risky SaaS and IaaS settings, UEBA flags unusual users, and a cloud sandbox tests suspicious files.
Agent or agentless access
The agent reaches browser and TCP/UDP thick-client apps with posture checks; agentless access covers web apps for contractors.
Find apps, then cloak them
Private-app discovery shows what the VPN carries today; app cloaking and micro-segmentation then hide each app from the internet.
Data rules in private apps
DLP and DRM apply to files inside private apps and anti-malware scans transfers; Fortra claims no other ZTNA offers DRM.
Watch Fortra explain its CASB and ZTNA
Three short product videos from Fortra’s official channel, all from late 2025: CASB, ZTNA and hybrid-workforce data protection. Fortra has no YouTube video of its SWG.
Stay in Control: How Fortra CASB Secures Your Cloud Data
A 1:45 Fortra short on how Fortra CASB secures collaboration tools and SaaS configurations across cloud apps.
Protect Your Data with Zero Trust Network Access
A 1:25 Fortra short contrasting Fortra ZTNA with VPN access, and protecting data held inside private apps.
Secure Your Hybrid Workforce | Simplify IT & Reduce Risk
A 1:36 Fortra short on its cloud data-protection tools for a workforce split between office and home.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Most SSE stops at allow or block. Fortra keeps the file encrypted after it leaves.
Here’s what genuinely sets it apart — and exactly where it stops.
Data control that travels with the file
Many SSE products stop at allow or block. Fortra’s CASB and SWG can encrypt, watermark, mask, redact or expire content inline, and EDRM encrypts files on download so only key holders open them. Fortra claims its ZTNA is the only one with DRM for private apps; treat that as its own claim.
One agent, one proxy, three products
Fortra’s datasheets describe a single unified agent, a single proxy and one policy across SWG, CASB and ZTNA, with TLS inspected once. The ARC reporting layer adds DSPM signals and Fortra DLP endpoint and network data, so a Fortra DLP estate gets one view of data in motion.
CASB that reaches unmanaged devices
A forward proxy for managed devices, a reverse proxy for BYOD with no agent, and API mode for data already in Microsoft 365, Google Workspace, Dropbox, Slack or Teams. Corporate and personal instances of one app are told apart, and a sandbox maps suspicious files to MITRE ATT&CK.
Where it stops
No PoP list, Indian PoP or Indian log region is published, and there is no on-prem fallback. It is absent from Gartner’s 2025 and 2026 SSE Magic Quadrants, documents no experience monitoring or SD-WAN, and is quoted per product. The business changed hands in May 2025; ask about the roadmap and agent.
The numbers behind the platform
What your Fortra Cloud Security rollout looks like
Map users, apps and sites
List remote users, offices, sanctioned SaaS tenants and every private app with its protocol: web, SSH, RDP, thick client or VoIP.
Get PoP and log answers
Ask Fortra in writing which PoPs your Indian offices will use and where logs are stored, and for how long, before pilot traffic flows.
Pilot with one team
Deploy the unified agent to a pilot group, run SWG and CASB in monitor mode, and measure latency from each Indian office.
Move apps off the VPN
Publish private apps through ZTNA one at a time, switch DLP from monitor to block, and log any app the agent cannot reach.
Settle scope and price
Fix the product mix, user count and log retention, confirm the EDRM exit plan, then take the INR quote with GST from TechBag.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“The reverse proxy let us put DLP on contractors’ own laptops without installing anything, which our old CASB could not manage.”
“Encrypt-on-download decided it for us: client files pulled from SharePoint stay locked even if a laptop walks out the door.”
“Our ERP thick client moved off the VPN through the agent; we kept the VPN for one VoIP system we could not test in time.”
“Endpoint DLP and the SSE reporting in one Fortra view cut the time our analysts spend matching the same incident twice.”
“Fortra could not show us a PoP list. Latency from Chennai and Pune was fine in the pilot, but log location is now a clause.”
“Three separate quotes for CASB, SWG and ZTNA slowed budgeting badly; ask for one consolidated price at the very start.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the security service edge market — tap any vendor to see why it sits where it does.
TechBag SSE Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Quote-only; ex-Lookout since May 2025; no PoP list.
Data Control × Private-App Reach
The grid nobody publishes — how far each SSE goes in protecting the data itself (DLP, CASB modes, file encryption) vs how many kinds of private app its ZTNA can reach.
DLP with EDRM and DRM; ZTNA reach web and TCP/UDP only.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Fortra Cloud Security vs the SSE field
Against Netskope One SSE, Zscaler, Skyhigh SSE, Prisma Access and Cloudflare One — on modules, CASB modes, data protection, ZTNA reach, analysts, price and Indian PoPs.
| Dimension | Fortra Cloud Security | Netskope One SSE | Zscaler ZIA + ZPA | Skyhigh SSE | Palo Alto Prisma Access | Cloudflare One |
|---|---|---|---|---|---|---|
| What it is | 3 products, one agent | One-client SSE | ZIA plus ZPA | Three SSE suites | SSE half of Prisma SASE | Zero Trust suite |
| Delivery | SaaS on public clouds | Own NewEdge network | 150+ data centres | Cloud plus on-prem | Cloud, 100+ locations | 330+ cities |
| Modules | SWG, CASB, ZTNA, FWaaS | SWG, CASB, ZTNA, DLP | Full set, two bills | All six, by suite | CASB is an add-on | Five of six |
| CASB modes | Proxy and API | Inline + API, by tenant | By edition | 40,000+ app registry | SaaS Security add-on | API CASB; more on Ent. |
| Data protection | DLP plus EDRM | DLP-first platform | Inline DLP, by edition | DLP in every suite | DLP in the bundle | Custom DLP: Enterprise |
| ZTNA reach | Web and TCP/UDP apps | All four rungs | All four, with add-on | Web, SSH and RDP | Web, SSH/RDP, desktop | Web plus SSH and RDP |
| Experience monitoring | Not documented | P-DEM add-on | ZDX subscription | Not documented | ADEM add-on | Not in TechBag’s guide |
| Platform ecosystem | Fortra DLP and DSPM | SD-WAN via Infiot | Zero Trust Exchange | On-prem gateways | Palo Alto firewalls | CDN, WAF, Magic WAN |
| Analyst standing | KC Leader; no Gartner | Gartner Leader 2026 | Gartner Leader 2026 | First for Advanced SSE | Gartner Leader 2026 | Gartner Visionary 2026 |
| Pricing model | Quoted per product | Per user, by module | Per user, by edition | Per user, by suite | Per user per year | Free tier, then per user |
| Published entry price | Not published | ~$15+/user/month | ~$6–12 plus ~$6–11 | Not published | Not published | Free to 50, then $7 |
| India PoPs and logs | Not published | 8 India DCs, India plane | India nodes, logs open | PoPs + India log store | Mumbai since 2021 | 6 cities, logs open |
| Lock-in and exit | Plan the EDRM exit | Several modules at once | No firewall of its own | Hybrid by design | Palo Alto policy model | Self-serve plans |
| Best fit | Data-led, Fortra DLP | CASB-led, India residency | Cloud-only, at scale | Hybrid web gateways | Palo Alto firewall shops | Start free, scale later |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Fortra Cloud Security (CASB, SWG, ZTNA) if…
- ✓You run Fortra DLP or DSPM and want web, SaaS and private-app traffic under the same data policy
- ✓Files must stay encrypted after download, whether they come from SaaS tenants or private apps
- ✓Contractors and BYOD users need CASB control without an agent on their devices
Compare alternatives if…
- ✓Indian PoPs and India log storage must be documented — Netskope and Skyhigh document both
- ✓You want a price you can read today — Cloudflare One lists $7 per user monthly beyond its 50-user free plan
- ✓A Gartner SSE placement is on your RFP — Zscaler and Prisma Access were Leaders in 2026
Do not expect…
- ✓SD-WAN or digital experience monitoring — it is the security half only
- ✓A published PoP map, an Indian PoP or a price list
- ✓The on-premises Fortra Web Gateway — that is a different product with a different page
Fortra Cloud Security (CASB, SWG, ZTNA) is one of 23 sase & sse products TechBag carries. The SASE & SSE guide narrows them to a shortlist and shows the reasoning. →
What does running VPN, proxy and CASB apart cost you?
Drag the sliders (users in scope; IT-hour cost). Estimates model the admin time spent keeping separate VPN, web proxy and CASB policies aligned and handling access tickets, at an assumed 0.5 hours per user a year, with 50% of it removed by one agent and one policy. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote only. Fortra publishes no price for CASB, SWG or ZTNA: each has its own quote request, and no bundle, tier or billing meter is listed. The AWS Marketplace figure shown for every Fortra product is a placeholder rather than a price, and the few public listings from before May 2025 priced the Lookout product, not Fortra’s. TechBag scopes users, apps and offices, then gets the quote itemised in INR with GST.
Fortra SWG + Fortra CASB
Best for web and SaaS data control
- Quoted per product; meter unpublished
- Proxy, API and inline DLP with EDRM
- Confirm it is the cloud SWG
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ Fortra ZTNA
Best when retiring the remote-access VPN
- Agent or agentless private-app access
- Same agent and policy as SWG and CASB
- Map SSH, RDP and server-initiated apps
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Which PoPs will users in each Indian city connect to, and what latency did the pilot measure from your own offices?
Where are SWG, CASB and ZTNA logs stored, and can retention reach the 180 days CERT-In expects for incident evidence?
Does the quote name the cloud Fortra SWG and its FWaaS, rather than the on-premises Fortra Web Gateway?
Since the May 2025 sale, which console and agent will you run, and is the Lookout-era agent being replaced?
Can ZTNA reach your SSH, RDP and server-initiated apps such as VoIP or SCCM? Fortra documents web and TCP/UDP.
If you leave, how are EDRM-encrypted files decrypted, and who holds the keys during and after the contract?
No experience monitoring is documented: which tool will show whether slowness is the PoP, the network or the app?
Which of CASB, SWG and ZTNA are quoted, on what meter and term? Ask TechBag for it itemised in INR with GST.
Questions buyers ask
Ready to evaluate Fortra Cloud Security?
List your users, offices, SaaS tenants and private apps, or let a TechBag advisor get Fortra’s PoP, log-region and roadmap answers in writing and the quote itemised in INR.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.