With the Fortinet FortiGuard Inline AI security service, the company is betting that the next fight over artificial intelligence will not be won by another dashboard — it will be won inside the network gear enterprises have already installed.
Fortinet FortiGuard Inline AI security arrived on Monday, October 26, 2026, with a simple pitch to chief information security officers who are already overwhelmed: you do not need another box, another agent or another console to start governing how your employees and your applications use artificial intelligence. Announced at 09:00 ET via GlobeNewswire from Sunnyvale, California, the new offering is a cloud-delivered service that brings AI-specific inspection and guardrails to existing FortiGate firewalls, the appliances Fortinet, listed on Nasdaq as FTNT, says it has already placed with more than one million customers worldwide.
According to Fortinet’s release, summarised the same day by Wisevoter, the service gives visibility into AI activity, stops AI threats and data exposure, and inspects prompts, responses and tool calls in real time. It does not merely block banned chatbot sites; it looks at what is asked, what the model answers, and what tools an agent calls — while traffic is still moving.
What Fortinet actually launched
The FortiGuard Inline AI Security Service, as Fortinet describes it, can detect 35 types of personally identifiable information and comes with more than 50 predefined compliance policies. In plain terms, if an employee pastes a customer list, a passport number, a bank account detail or a block of source code into a public chatbot, the service is meant to recognise the pattern, apply the policy the company has chosen, and block, redact or flag the exchange before the data leaves the organisation’s control.
The same inspection works in the other direction. Responses can carry malicious instructions or data the user should not receive, and tool calls — when an agent reaches out to a database, calendar or code repository — are inspected too, because that is where an assistant can become an uncontrolled link between systems that were never meant to touch.
Fortinet says the service is powered by FortiAIGate innovation and technology from its recent Virtue AI acquisition. It comes in two forms: enable the cloud service on the existing FortiGate footprint, with no separate infrastructure; or, for advanced security, privacy or sovereignty needs, deploy FortiAIGate in your own environment — on premises or in Kubernetes, accelerated by NVIDIA GPUs.
Fortinet FortiGuard Inline AI security and the shadow-AI problem
Threaded through the announcement is a phrase security teams use constantly: shadow AI — the tools employees use without approval, from a personal chatbot in a browser tab to a coding assistant quietly connected to a private repository. None of it goes through procurement, and all of it can carry company data out of the building.
Fortinet says the service provides shadow-AI and agent visibility, and that visibility may be its most valuable part. Security leaders cannot write a sensible policy for tools they cannot see; a firewall that enumerates which AI services are used, by whom and with what data gives them something firmer than a staff survey.
Why this matters
This launch matters because it marks a shift in where AI security is expected to live. A crowded market of start-ups sold point tools for single jobs: one to scan prompts, another to catalogue models, another to test for jailbreaks. Together they left buyers with too many consoles, agents and renewal dates, and no single whole picture.
Fortinet argues AI security will follow network security’s path: from separate boxes toward platform features delivered through infrastructure customers already own. If that wins, value moves toward the installed base. A vendor with a million customers need not persuade each to rip out firewalls — only to switch on a service. That is a much easier sale.
It also matters because the real leak path is rarely a sophisticated attacker. It is an ordinary employee working faster: a contract pasted in for summarising, a spreadsheet uploaded for analysis, a customer email dropped in for a draft reply. Detecting 35 types of personal information inside a prompt speaks directly to that everyday risk.
Context: a crowded week for AI security
Fortinet did not launch into a quiet market. In the space of a week, as Signal Post News has reported in related coverage, Microsoft published new security guidance for AI agents on October 19, SentinelOne advanced its autonomous security operations centre on October 20, and Tenable announced an AI integration programme on October 20. Each company is approaching the same anxiety from a different direction: agents that act on their own, models connected to real systems, and employees adopting tools faster than policies can be written.
The comparison is instructive. Microsoft’s guidance covers how agents should be built and governed, SentinelOne’s push automates the security operations centre, and Tenable’s programme connects exposure management to AI. Fortinet’s claim is narrower and more physical: traffic still crosses a network, and the network is where inspection can cover every user and application at once, including unapproved ones.
There is precedent for this contest. When web filtering and intrusion prevention emerged as separate markets, platform vendors eventually absorbed them as features; many specialists were acquired. Fortinet’s purchase of Virtue AI fits that pattern: buy the capability, then deliver it through the platform.
Data in context: what the numbers do — and do not — prove
The headline numbers in the release deserve a careful read. More than one million customers worldwide is a statement about reach, not about how many of those customers will enable this service, pay for it, or keep it switched on after the first month of alerts. Fifty-plus predefined compliance policies is useful as a starting library — building policies from a blank page is slow work — but a policy that exists is not the same as a policy that matches a company’s actual obligations in health care, finance or government. Thirty-five detectable types of personal information sounds precise, and precision is welcome, but detection rates matter more than category counts, and Fortinet has not published independent test results alongside the launch.
The honest test is not 35 categories against a rival’s 30. It is a pilot: how many real leaks it catches, how many false alarms it raises, and how much latency inline inspection adds.
Both sides: the platform case and the critics
Supporters make a straightforward case. Security teams are short-staffed; a service that turns on inside existing firewalls lowers the start from weeks of deployment to a configuration change. Central inspection also closes the oldest loophole — the tool nobody installed officially. Governance covering only approved applications governs the employees who were never the problem.
Critics raise three serious objections, and buyers should weigh all of them. First, vendor claims at launch are unaudited. Detection counts and policy libraries are marketing figures until independent testing or a customer’s own pilot confirms them. Second, inspecting prompts raises genuine employee-privacy questions. A prompt can contain a medical question, a legal worry or a draft resignation letter. A system that reads prompts to protect the company also reads prompts that are none of the company’s business, and organisations will need clear rules — and in some jurisdictions, consultation with employees — about what is logged, who can see it and how long it is kept.
Third, the cloud-delivered tier cuts both ways. Sending inspection to a vendor’s cloud is what makes the service easy to enable, but it also means metadata about AI use — and depending on configuration, potentially more than metadata — leaves the network the firewall was meant to protect. Fortinet’s answer to that concern is built into the launch itself: customers for whom that trade-off is unacceptable can deploy FortiAIGate in their own environment instead, on their own hardware, with NVIDIA GPU acceleration. Whether that second tier is priced and packaged within reach of mid-sized organisations, rather than only large enterprises with sovereignty requirements, will decide how real that answer is.
What happens next
The next test is adoption, and it will be visible in ordinary places: in Fortinet’s earnings commentary as analysts ask about attach rates for the new service, in the first independent evaluations of inline prompt inspection, and in whether rival platform vendors answer with equivalent features in their own firewalls within the next two quarters. Given the crowded launch week that produced this announcement, a fast competitive response is more likely than not.
For security teams, the practical step is to run visibility before blocking: learn what the organisation is actually doing with AI, write a policy matching that reality, agree privacy rules for prompt logs, and only then enforce. Companies that skip straight to blocking teach staff one lesson — use a personal phone instead, where no firewall can see anything.
Fortinet has placed its bet clearly: AI governance belongs in the network, delivered as a service, sold to an installed base of more than a million. If it is right, this announcement will look, in retrospect, like the moment AI security stopped being a separate product category. If the critics are right — about privacy, about cloud inspection, about unaudited claims — it will look like the moment those questions became impossible for buyers to postpone. Either way, the firewall you already own just became the place where your company’s AI policy is enforced, or visibly is not.
Read next: Chrome, Gemini and the new scam-detection warnings and Why disclosed AI vulnerabilities doubled.