Fortinet turns its firewall footprint into an AI security on-ramp
The fastest way to bring a new security capability into the enterprise has never been a new product. It’s a new license for something the customer already owns. Fortinet Inc. understands this better than most, as it has continued to add features to its FortiGate firewall.
This week, the company announced it is applying that strategy to the most pressing security problem facing information technology leaders today: securing artificial intelligence.
On Monday, the company announced the FortiGuard Inline AI Security Service, a cloud-delivered subscription that brings AI-specific inspection and guardrails to FortiGate firewalls. Customers turn it on, and FortiGate begins inspecting prompts, model responses and Model Context Protocol tool traffic in real time, without the customer having to deploy and manage a separate AI security stack. The engine behind the service is FortiAIGate, Fortinet’s AI gateway, which received a new set of capabilities, including technology from the Virtue AI acquisition the company closed in August.
AI security has shifted from a niche to a land grab in under two years. Palo Alto Networks Inc. bought Protect AI; Check Point Software Inc. acquired Lakera; F5 Inc. purchased CalypsoAI; and Cisco Systems Systems Inc. procured Robust Intelligence. Forrester tallied more than $2 billion in spending by major vendors on AI security startups over an 18-month period.
Every platform vendor now has an AI security story. The question for buyers is no longer who has the technology, but who can deploy it across the organization fastest and at the lowest operational cost. That’s the question Fortinet is trying to answer.
Here are some takeaways that should matter to chief information officers and chief information security officers:
Platform is the strategy
Most AI security products on the market today require customers to stand up something new: a proxy, a gateway, an API integration for every AI application, or a browser extension on every endpoint. Each of those is a project, and projects stall. In my conversations with security leaders, the gap between “we bought an AI security tool” and “we have AI security coverage” is often measured in quarters, which is why the security industry is filled with shelfware.
Fortinet’s approach mitigates that by riding on the FortiGate installed base, one of the largest in the industry. The firewall already sits in the traffic path at branches, campuses and data centers, so turning on AI inspection becomes a policy decision rather than an infrastructure deployment. Software-defined wide-area network integration was the primary reason the company went from a minority-share player in WAN connectivity to a market leader in just a few years.
Organizations need AI security that can scale as quickly as AI is deployed. By extending advanced AI inspection and guardrails through FortiGate, Fortinet is making AI security available within existing security infrastructure, which is the right move for the company and its customers.
Midmarket companies and distributed enterprises, such as retailers, healthcare systems and manufacturers, are adopting AI as quickly as anyone, but they lack the staff to run a dedicated AI security program. Delivering protection via an appliance they already manage lowers the barrier considerably. It’s the same model that made FortiGate the default choice for secure SD-WAN, and it’s likely to work here for the same reasons.
Inspection is moving from ‘who’ to ‘what’
The first wave of AI security products focused on discovery, identifying which employees are using ChatGPT, which SaaS apps have embedded AI, and whether sensitive files are being uploaded. Useful but shallow. Knowing that someone used an AI tool tells you nothing about whether the interaction was dangerous.
The new service goes further by inspecting the content of AI interactions. FortiAIGate applies multilayered guardrails across prompts, model responses, MCP tool calls and responses, API activity and agent actions. The inspection covers text, images, audio, video and code. Expanded data loss prevention detects 35 types of personally identifiable information and confidential data, and can trigger alerts, deny or redact them before they leave the organization.
This is the shift that will enable businesses to deploy AI safely. Traditional security tools focus on IP addresses, signatures, and payloads. AI threats, such as prompt injection and poisoned tool responses, live in natural language. A firewall that understands only packets will miss them. One that understands intent is better aligned with where AI is headed.
The real test will be accuracy at scale. Fortinet claims low latency and minimal false positives, and Virtue AI’s guardrail technology should help, but security teams have long memories of DLP tools that blocked everything or nothing. I’d want to see proof in production before buying the marketing.
AI cost control is now a security function
The capability I found most interesting has little to do with traditional threats. FortiAIGate lets administrators set model permissions, budgets, spending limits and rate limits at the organization, workspace, project or user level. Administrators are alerted as spending approaches a limit, and requests are blocked once the limit is exceeded. Intelligent routing sends each request to the appropriate model based on content, policy and cost, without requiring application re-architecting.
Fortinet also highlights “Denial-of-Wallet” attacks, in which malicious or runaway prompts burn through tokens and GPU compute. That threat category didn’t exist three years ago and is now a real budget risk. As agents run around the clock and machine token consumption outpaces that of humans, an uncontrolled agent loop can generate a five-figure inference bill over a weekend.
The bigger point is organizational. AI spending today is scattered across business units, developer credit cards, and cloud accounts. Finance can’t see it, IT can’t govern it and security doesn’t own it. Placing spend controls in the same gateway that enforces security policy gives CIOs a single control point for both risk and cost. I expect token governance to become a standard line item in AI security evaluations in 2027, and Fortinet is early to make it a core feature.
Agents are the new shadow IT
Shadow IT took a decade to bring under control. Shadow AI is emerging in months, and shadow agents will be even harder to manage because agents don’t just consume data; they act on it. They call APIs, invoke tools, connect to MCP servers, and trigger workflows, often with credentials that no one in security has reviewed.
FortiAIGate’s expanded agent visibility shows which agents are operating across the business and how they interact with enterprise applications, APIs, tools, data and MCP servers. Combined with Virtue AI’s capabilities to discover unsanctioned agents, scan MCP tools and block malicious tool calls, Fortinet is building a solid foundation for agent governance.
Visibility is step one, not the finish line. Enterprises need to treat agents as identities, with owners, least-privilege access and continuous monitoring. Fortinet’s broader Security Fabric, spanning network, identity, endpoint and security operations, provides a credible path to connect agent visibility with enforcement. The company needs to demonstrate that those dots are connected in practice, not just in architecture slides.
Flexibility on where AI traffic is processed is a must-have
Not every organization will be comfortable sending prompts and model responses through a cloud service. Regulated industries, governments and companies with data sovereignty requirements often need inspections to occur within their own environment. Fortinet addresses this with self-hosted FortiAIGate, which can run on-premises, in the customer’s cloud or on Kubernetes with Nvidia Corp. graphics processing units, keeping prompts, responses, data and logs within the environment.
The company also includes more than 50 predefined compliance policies covering AI governance frameworks, data privacy laws, industry regulations and security frameworks, along with detailed logs of every prompt, output and tool call for auditors. As the EU AI Act and a patchwork of state and industry rules take shape, that audit trail will be worth as much as the guardrails themselves.
The dual model is smart. The cloud-delivered service is the onramp for the broad base, while self-hosted FortiAIGate is the destination for customers with demanding performance, privacy or sovereignty needs. It also addresses an important blind spot. A firewall sees only traffic that passes through it, but a growing share of agent activity occurs cloud-to-cloud or within application tiers that never cross a FortiGate. A gateway placed next to the AI workload closes that gap.
A note on earnings
On a related note, Fortinet announced its third-quarter results on Wednesday. By almost any operational measure, it was a strong quarter, with revenue up 20%, to $2.08 billion, beating the $2.06 billion consensus. Product revenue jumped 37%, to $765 million, and billings grew 29%, to $2.34 billion.
Investors seemed fixated on a single line item: Service revenue grew only 13%, to $1.31 billion, and Fortinet trimmed its full-year services forecast to $5.15 billion to $5.17 billion, down from $5.18 billion to $5.22 billion. The stock fell more than 20% on Thursday, pulling other cybersecurity names down with it.
I think the market overreacted, and I’m not alone. Rosenblatt Securities analyst Catharine Trebnick titled her post-earnings note “Selloff Overdone” and maintained her Buy rating. Large enterprise customers typically buy hardware first and activate services in stages, which Chief Financial Officer Christiane Ohlgart called “really a timing issue.” Trebnick agrees, writing that “the leading indicators support that read”: Service billings grew 26%, total deferred revenue rose 19%, and short-term deferred revenue grew 14.5%, its fastest pace in five quarters.
More important, the product surge is being driven by customers moving to higher-end FortiGates with the computing power to run new functions such as AI security. Every one of those boxes is a future subscription, including the AI service announced this week. Trebnick called the new FortiGuard service “the clearest path we have seen for AI security to show up in service revenue rather than hardware.” Product revenue today becomes service revenue tomorrow, and investors who sold on a one-quarter timing gap are looking at the wrong number.
Final thoughts
Fortinet’s move reflects a broader truth about the AI security market, namely that the technology is converging and the battle is shifting to distribution and operational simplicity. Every major vendor now offers some form of prompt inspection, guardrails and agent visibility. Fortinet’s edge is that it can deliver those capabilities to a massive installed base with little more than a license and a policy change, a meaningful advantage in a market where most organizations are still figuring out where to start.
There are open questions. Inline inspection of AI traffic depends on TLS decryption, which many organizations still don’t enable broadly, so the service’s effectiveness is limited by the customer’s inspection posture. Pricing and packaging will determine how quickly the service spreads beyond early adopters. Fortinet will need to prove its accuracy claims against rivals that have been selling AI guardrails longer.
For buyers, I’d focus on four things. First, if you already run FortiGate, evaluate the service against your actual AI traffic before buying a standalone tool; you may already have the control point you need. Second, revisit your TLS inspection policies, because AI security without decryption is AI visibility at best. Third, bring finance into the conversation now and set token budgets and rate limits before agent spending surprises you. Finally, build an agent inventory with an owner for every agent, because you can’t secure what you can’t see, and you can’t hold accountable what no one owns. AI will create more security work, not less. The vendors that make that work easiest to absorb will win, and Fortinet has made a strong case for being among them.
Zeus Kerravala is a principal analyst at ZK Research, a division of Kerravala Consulting. He wrote this article for SiliconANGLE.
Image: Fortinet
Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities.
- 15M+ viewers of theCUBE videos , powering conversations across AI, cloud, cybersecurity and more
- 11.4k+ theCUBE alumni — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network
Are you an AWS customer? Support SiliconANGLE financially by buying your AWS services from our Marketplace portal page and links: https://siliconangle.com/aws-marketplace/
About SiliconANGLE Media
theCUBE AIand theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.
Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.