Fortinet launches FortiAIGate to secure enterprise AI traffic

Bridging the AI security gap

Traditional security tools are often ill-equipped to handle the nuances of artificial intelligence. While standard systems can inspect IP addresses and signatures, they usually cannot analyze the specific content of a prompt or a model's response. This creates a vulnerability where malicious instructions or sensitive data can bypass existing defenses.

Fortinet is addressing this by launching FortiAIGate, a security suite designed to act as a control point between AI applications and models. As reported by Industrial Cyber, the service provides real-time inspection and guardrails for interactions involving large language models (LLMs) and autonomous agents. It aims to stop threats that hide within the actual communication between a user and an AI system.

The company is leveraging its existing FortiGate footprint to make these tools accessible to a wider range of organizations. Instead of requiring customers to deploy and manage entirely new infrastructure, they can enable the FortiGuard Inline AI Security Service through the hardware they already use. This approach simplifies the path to adopting advanced security as AI becomes more common in corporate workflows.

Real-time inspection and guardrails

FortiAIGate works by analyzing the content of AI interactions to enforce security and compliance policies. It can inspect various formats, including text, images, audio, video, and code, while maintaining low latency. The system is designed to identify and block malicious prompts or harmful tool calls before they can trigger actions in an organization's environment.

One of the primary functions of the service is data loss prevention (DLP). It can detect 35 different types of personally identifiable information and confidential data. If sensitive information is detected, the system can alert administrators, deny the request, or redact the information before it is ever exposed to the external AI model.

The technology also provides visibility into 'shadow AI,' which refers to the unauthorized use of AI tools within a company. By monitoring these interactions, administrators can see which agents are operating across the business and how they interact with APIs, tools, and data. This provides a centralized view of AI activity that was previously difficult to track or govern.

Managing costs and permissions

Beyond security, FortiAIGate offers tools to manage the financial and operational aspects of AI usage. Organizations can set specific budgets, spend limits, and rate limits for different workspaces, projects, or individual users. This helps prevent 'Denial-of-Wallet' attacks, where malicious actors attempt to drain a company's resources by making excessive requests that consume expensive GPU compute or tokens.

The system also features intelligent routing to help optimize how requests are handled. It can direct each request to the appropriate model based on the specific content, the company's policies, and the associated costs. This happens automatically without requiring the organization to re-architect its existing applications.

To simplify governance, the service includes more than 50 predefined policies. These can be added with a single click and cover various AI governance frameworks, data privacy laws, and industry regulations. Each policy can be customized, and the system provides detailed logs of every prompt, output, and tool call for auditors to review.

Deployment and sovereignty

Fortinet is offering different deployment options to accommodate various privacy and sovereignty requirements. Customers can use the cloud-delivered FortiGuard Inline AI Security Service for ease of use. This allows them to gain visibility and protection without the overhead of managing separate security infrastructure.

For organizations with stricter requirements, FortiAIGate can be self-hosted on-premises or in a private cloud environment. This includes the ability to run the gateway on Kubernetes with NVIDIA GPUs. When self-hosted, all prompts, responses, data, and logs stay entirely within the organization's own environment, ensuring maximum control over data residency.

The integration of technology from the recent acquisition of Virtue AI is intended to strengthen these capabilities. According to Will Townsend of LoneStar Advisory and Research, the integration improves the guardrails and performance needed for production environments. This combination allows Fortinet to connect AI inspection with broader capabilities spanning network, cloud, identity, and security operations.