Fortinet Unveils Self-Learning AI Capabilities in New Network Detection & Response Offering

Fortinet has announced FortiNDR, a new network detection and response offering that leverages powerful artificial intelligence and pragmatic analytics to enable faster incident detection and accelerated threat response.

SecOps Teams Must Leverage AI to Stay Ahead of Threats

Security operations teams are confronted with advanced, persistent cybercrime that is more damaging and unpredictable than ever before, an attack surface that continues to increase with hybrid IT infrastructures, and chronic employee shortages owing to the cybersecurity skills gap. Those who use legacy security systems have the additional difficulty of overwhelming and time-consuming manual alert triage, which diverts key resources away from high-priority activities such as threat mitigation. As cybercriminals get increasingly sophisticated, so must an organization’s security tools.

FortiNDR Accelerates Threat Detection with Artificial Intelligence
With the introduction of FortiNDR, Fortinet is delivering full-lifecycle network protection, detection, and response powered by AI to:
• Detect signs of sophisticated cyberattacks: FortiNDR builds sophisticated baselines of regular network activity for a company and finds abnormalities that may suggest ongoing cyber campaigns using self-learning AI, machine learning, and advanced analytics. Profiling can be performed using IP/Port, Protocol/Behavior, Destination, Packet Size, Geography, Device Type, and other criteria. Taken together, this means that enterprises will be able to detect risks sooner since they will no longer have to rely on generic threat feeds, which rely on threats or components becoming widely recognized in order to spot indicators of compromise.
• Offload intensive human analyst functions with a Virtual Security Analyst: FortiNDR includes a Virtual Security Analyst (VSATM), which employs Deep Neural Networks – The next generation of AI is aimed to relieve human security experts by evaluating code written by malicious traffic and determining its propagation. VSATM is pre-trained with over 6 million harmful and safe characteristics that can recognize and classify IT- and OT-based malware. By assessing the complete infection movement, these characteristics may precisely determine patient zero and the lateral propagation of multi-variant malware. VSATM is also capable of detecting encrypted assaults, harmful web campaigns, weak ciphers/protocols, and malware classification.
• Identify compromised users and agentless devices: An endpoint detection and response agent cannot be deployed on all endpoints in an organization (for example, personal, third-party, IoT, or OT devices) in order to identify a breach. FortiNDR overcomes this by deploying a dedicated network sensor that analyzes every device traffic.
Coordinated Response with Security Fabric Integration
FortiNDR also offers native connections with the Fortinet Security Fabric and API interfaces with third-party solutions for a coordinated response to identified threats to mitigate their impact. Quarantining devices that generate anomalous traffic, enforcing with third-party devices using an API interface, triggering an orchestrated process powered by SOAR, and other standard automation to speed response are all covered.

As one of the industry’s highest performing cybersecurity mesh platforms powered by FortiOS everywhere and a common management framework, the Fortinet Security Fabric enables broad visibility, seamless integration and interoperability between critical security elements, and granular control and automation.

Fortinet’s Robust Portfolio of Detection and Response Solutions
FortiNDR rounds out Fortinet’s existing portfolio of detection and response solutions, including managed detection and response (MDR), endpoint detection and response (EDR), and extended detection and response (XDR) solutions.

Organizations looking to add detection and response capabilities to their traditional prevention-oriented security controls can choose from:

• FortiGuard MDR Service: For smaller organizations with a single IT/Security team (or larger organizations looking to offload first line alert monitoring and triage), managed detection and response (MDR) is a good option to add security monitoring capabilities without needing the specialized expertise to run it effectively.

• FortiEDR: For mid-size to mainstream organizations with dedicated (but small) security teams, endpoint detection and response (EDR) is a good option to add deep, host-level analysis that is necessary to identify the signs of ransomware activity on the endpoint.

• FortiNDR: Network detection and response adds broader analytics and anomaly detection across network segments or even the entire organization, insight into activity from devices without agents (whether IoT or unmanaged devices), and faster deployment with no impact on production systems to larger organizations or robust security teams that have already implemented EDR.

• FortiXDR: Extended detection and response include curated detection analytics, AI-powered alert investigation, and automatable incident response for enterprises with numerous Fortinet security controls.