Questions people ask before they start

Yes. Every new user always receives 2 free audit credits on sign up. Separately, the current free trial period also makes additional trial items available until the trial end date.

The always-included sign-up credits are separate from the free trial offer. The free trial offer ends on 30 September 2026.

No. You can start with the current trial offer, run real audits, and only move to paid credits or licensing if the workflow fits your environment.

Use audit credits for occasional one-off reviews. Use an annual license when you want scheduled reviews, collector-based retrieval, or continuous monitoring for a firewall or cluster.

ConfigSentry is a Fortinet FortiGate-specific firewall auditing platform. It analyses FortiGate firewall configurations to identify security risks, misconfigurations, and compliance gaps.

Only Fortinet FortiGate firewalls are supported right now, across physical, virtual, and cloud deployments, as long as a valid FortiOS configuration is available for review.

No. It audits the wider FortiGate firewall configuration, including administrative access, VPNs, interfaces, objects, logging, and broader security posture settings.

No. ConfigSentry is an independent auditing solution developed by secdit. It is designed to complement Fortinet products, not replace them.

It is designed for network engineers, security teams, consultants, and organisations responsible for securing FortiGate environments.

The platform analyses a FortiGate configuration, either uploaded manually or retrieved through a collector workflow, and evaluates it against defined checks that consider both specific settings and wider configuration context.

No. ConfigSentry is read-only. It does not push configuration changes and it does not execute commands that modify the FortiGate firewall.

No. You can start with uploaded configuration files. If you want recurring retrieval or continuous monitoring, you can use a read-only collector-based workflow instead of relying on manual exports.

Continuous monitoring helps detect configuration changes, security drift, and newly introduced risk over time instead of relying on occasional manual review.

Audit frequency is configurable. Teams typically choose an interval that gives quick visibility into change without creating unnecessary operational noise.

Most teams can begin with a manual upload in minutes. Collector-based monitoring takes longer because it requires collector setup, appropriate read-only access, and internal approval where needed.

No. Manual upload uses a FortiGate configuration export you already have, so it does not require network changes or live read-only access to begin.

Audits reference recognised security guidance such as Fortinet best practices, CIS FortiGate Benchmarks where applicable, and broader security hygiene checks. These mappings support alignment and review discussions, but they do not by themselves guarantee compliance.

Findings are categorised by severity and include context, impact, and remediation guidance so teams can prioritise what needs attention first.

Yes. Audit outputs can help demonstrate security posture, internal control quality, and alignment with recognised best practice during internal or third-party review.

It significantly reduces manual effort, but it works best alongside experienced security and network professionals who still make the final judgement calls.

Raw firewall configurations are processed in memory for the audit run and removed from memory after processing. The platform can still retain config-derived findings, scores, report metadata, and audit history records until you delete them or remove them through account cleanup, so review the Security and Data Handling page for the workflow-specific model.

Yes. ConfigSentry can audit multiple FortiGate firewalls or clusters so organisations can keep a consistent review standard across environments.

Yes. You can clone existing rules and modify them to suit your requirements, or create entirely new custom rules from scratch.

Yes. You can create and manage audit rule templates, allowing you to choose exactly which checks are performed during each audit.

Yes. Cloud-hosted FortiGate instances can be audited in the same way as on-premises FortiGate firewalls, provided configuration access is available.

Usually within minutes of signing up. New users can create an account, use their included sign-up credits, and run a real audit straight away.

Support is available through the support portal and contact channel. For onboarding, product, or commercial questions, contact secdit so the right follow-up path can be arranged.

Yes. If you need help planning evaluation, collector setup, or the right usage model for your environment, contact secdit through the normal contact path.

If you need invoice or purchase-order handling, contact secdit to confirm the current commercial options for your region and buying process.

For the current renewal or cancellation process for paid licenses, contact secdit. The exact commercial handling can depend on how the purchase is arranged.

That is what audit credits are for. You can stay with one-off reviews and buy credits only when you need another audit, without moving to a recurring license.

Yes. Multi-factor authentication helps protect access to audit results and config-derived findings, especially where account history is shared across a team.

Workflow-specific handling differs. Raw firewall configurations are processed in memory and removed after processing, while audit history and account-linked data can remain available until deleted or removed through account cleanup. Deleting data normally removes it from the main platform workflow, while some operational logs or backups may remain temporarily as part of normal resilience processes.

For current hosting location or jurisdiction details relevant to your review, contact secdit directly so the latest information can be confirmed during evaluation.

Public website access and collector upload or download endpoints are provided over HTTPS. Exported report encryption or password protection, where offered, applies to the downloaded report package and should not be read as a statement about every platform-side storage control. Contact secdit if you need current deployment or storage-architecture details for review.

ConfigSentry is not currently presented here as independently certified. The security controls and data-handling model described on the site are intended to support customer review.