The short version: Between 2014 and 2017, I was the only Official Cyberoam Certified Trainer in India, and I trained over 1,500 IT dealers and corporate clients on firewall and network security — back when Cyberoam was still an independent company, before Sophos acquired it. That experience shaped how I teach FortiGate NSE today, and most of what I learned had nothing to do with the product and everything to do with how security actually gets adopted.
The problem nobody tells you about firewall training
Most security training assumes the room already wants to be there. Mine didn't. I was training IT dealers — people who resell and support security hardware for a living, often to small businesses that see a firewall as a box they were told to buy, not a system they understand. That's a very different audience from an enterprise security team sitting a certification exam.
What that taught me: a dealer who doesn't understand a feature won't sell it, and a customer who doesn't understand a feature won't trust it. So the training had to work backward from "can this person explain it to someone else tomorrow," not just "can this person pass a test."
Three things that mattered more than the product manual
1. Policy logic before interface clicks. Dealers who memorized where buttons were in the UI forgot it within weeks. Dealers who understood why a rule evaluates top-to-bottom, or why a deny-all default matters, could apply that logic to any firewall vendor they touched later — not just Cyberoam, and later, not just FortiGate. The product changes. The logic underneath mostly doesn't.
2. Real misconfiguration stories beat hypothetical ones. I used actual support tickets — anonymized — as teaching material: a rule ordering mistake that quietly let traffic through for six months, a UTM profile that was technically "on" but not actually inspecting anything because of a scope mismatch. Nobody forgets a war story. Everybody forgets a checklist item.
3. The exam isn't the finish line. Several of the 1,500+ people I trained went on to need FortiGate NSE later, as the vendor landscape consolidated. The ones who struggled weren't the ones who'd memorized Cyberoam's interface — they were the ones who'd only learned the interface, with nothing underneath it to transfer.
"A dealer who doesn't understand a feature won't sell it, and a customer who doesn't understand a feature won't trust it."
Why this still matters in 2026, long after Cyberoam
Firewalls and the vendors behind them keep changing — Cyberoam became Sophos, FortiGate's own feature set has changed several times over since 2017. What hasn't changed is the underlying security logic: Zero Trust assumptions, policy evaluation order, the gap between "configured" and "actually enforcing." That's what I still lead with when I train FortiGate NSE today, because it's the part that survives the next product refresh.
If you're a corporate training lead evaluating whether a security certification track will still be relevant in three years, the honest answer is: the vendor-specific parts won't be, but the underlying architecture thinking will — provided that's what the training actually teaches.