FortiSandbox 3000G
160,000 files per hour, up to 20,000 users
- Files per hour
- 160,000
- Users
- 20,000
- Local VMs
- 8 + 142 optional
The FortiSandbox 3000G detonates suspicious files in instrumented virtual machines and reports what they actually do, at 160,000 files per hour. Verdicts feed back automatically to every FortiGate, FortiMail and FortiClient in the Fabric.
160,000 files an hour, 20,000 users, 8 local VMs expandable by 142. Five times the 1500G's throughput and a step change in concurrent analysis. This is service-provider and very-large-enterprise territory; below roughly 20,000 users the 1500G is almost always the right answer and the difference is spent better elsewhere in the Fabric.
Highlights
- 160,000 files per hour
- Verdicts shared automatically across the Security Fabric
- Catches targeted malware no signature has seen
- Samples never leave your premises
Typical deployments
- Service providers offering managed threat analysis
- Very large enterprises with estate-wide submission
- Central analysis tier serving many regional Fabric deployments
What this includes
Fortinet publishes no throughput table for this product — it is licensed per user, endpoint, workload or account. What follows is capability and sizing, not benchmarks.
Capacity
Effective sandboxing throughput is tested on files that are 80% documents and 20% executables, including both static and dynamic analysis, with pre-filtering enabled. User counts assume a ratio of one user per 25 emails.
| Effective sandboxing throughput (files/hour) | 160,000 |
|---|---|
| Number of users | 20,000 |
| Number of local VMs | 8 + 142 optional |
Sources
- Fortinet Product Matrix (July 2026) — retrieved 2026-09-01
Reproduced from Fortinet published documentation and subject to change without notice. Where a figure is load-bearing for your design, ask us to confirm it in writing before you order — we will.