Fortinet was among the first companies to sign CISA’s Secure by Design Pledge in 2024. Since then, we have published regular updates that go well beyond simply restating our support for the pledge. Every update has highlighted what has changed in our products and development practices, the effects those changes are having, and where our work is still in progress.

That distinction is important. Secure by design isn’t a one-time certification. It’s an ongoing engineering practice, and its trustworthiness depends on evidence.

Over the past year, we have strengthened our authentication protections, increased automatic updates, reduced unsupported firmware on devices, fortified isolation and integrity in FortiOS, and provided more security information to customers. We also continue to discover and report vulnerabilities in our products as transparently as possible, keeping ahead of industry best practices.

Making Secure Defaults Easier to Use

CISA’s first two pledge goals address multi-factor authentication (MFA) and default passwords. Fortinet has eliminated default passwords across our product lines through our Secure Development Lifecycle Policy. Customers are now required to create unique credentials during installation rather than inheriting a predefined credential that may not ever be changed.

We have also continued expanding MFA coverage across our portfolio with MFA in our online services, FortiCare and FortiCloud, standing at 97.1%. We have met and exceeded our adoption goals, and we are now driving customers to uplevel to newer, more modern methods, reduce less secure methods such as SMS and email, and transition to our mobile token solution.

Our objective is not to simply make MFA available. It’s to reduce the friction that can come with some legacy MFA methods and to increase the adoption of newer, more secure methods.

Increasing Patch Adoption and Reducing Unsupported Devices

Security updates offer little protection until they are installed. That’s why one of the most consequential changes we have made under the pledge is the introduction of automatic updates for eligible FortiGate devices. Since the start of the pledge in May 2024, this capability has updated more than 1.8 million FortiGate devices without requiring administrators to initiate each update manually. We expect to break the 2 million mark before the end of the year, which will be a significant milestone.

Automatic updates, however, address only one part of the problem. Many devices remain in service even after their firmware or hardware has reached the end of support. Vendors have a responsibility to make that risk visible and to help customers move to supported releases and platforms. Through device monitoring, customer notifications, collaboration with regional Computer Emergency Response Teams (CERTs), and a trade-in program, Fortinet has reduced the number of devices running end-of-support firmware by 13% in the past three months.

This is a shared responsibility model. While vendors need to provide timely fixes, clear guidance, and practical upgrade paths, customers need to maintain current inventories, monitor vendor alerts (sometimes flashing red banners in the UI), and act on that guidance. The more effectively we automate routine updates and identify unsupported infrastructure, the fewer opportunities attackers will have to exploit known vulnerabilities (N-Day) for which a remedy already exists.

Reducing Vulnerability Classes at the Source

While patching individual vulnerabilities remains essential, secure development must also address the patterns that allow the same defects to recur. Over the past year, Fortinet has focused on reducing the number of defined vulnerability classes, with particular attention to SQL injection. These are well-understood weaknesses with established prevention methods, so recurrence should prompt a review not only of the affected code but also of the development controls intended to prevent them.

Our response has included expanded code auditing, regression testing, and management accountability tied to code quality. We have also designated functions whose misuse can commonly lead to issues involving command execution, memory safety, or input handling, and have prohibited their use except through controlled exceptions. Within the applicable FortiOS codebase, the use of these functions has decreased by 95% over the past 6 months. The impact of this reduction will hopefully become apparent in the coming months, as the reduced attack surface results in fewer vulnerabilities.

Our work in this area is ongoing and expanding to new areas (including integrating Frontier AI into our Secure Product Development Lifecycle Policy). The correct approach isn’t to claim victory once a control is implemented but to assess whether it effectively changes outcomes, review every recurrence, and enhance the development process as needed.

Building Additional Barriers to Exploitation

Although eliminating defects is our primary objective, no large software system can guarantee that every defect will be discovered before release. Therefore, we continue to harden FortiOS to make vulnerabilities more difficult to exploit and to reduce the impact of a compromised process on the entire system.

• Virtual patching has been available in FortiGate products for several years to prevent local and third-party vulnerabilities. As part of our secure-by-design, defense-in-depth commitment, we made the virtual patching of the FortiGate itself free of charge to all customers.
• Additional compile-time and kernel hardening raise the technical barrier of turning a coding flaw into repeatable code execution.
• Process segmentation employs chroot-based isolation to confine certain services to a limited file-system view, thereby reducing their access to files and system resources if compromised.
• Security Domains introduce an additional enforcement layer by restricting application system calls, capabilities, resources, and inter-process interactions to prevent escalation or lateral movement.
• FortiSentry offers an additional, complementary hardware-based control for FortiGate models, beginning with the newly released FortiGate 700G. It operates independently of the main system, constantly checking critical system files for unusual activity during normal operation and blocking unauthorized changes. This separation is crucial, as the monitor does not rely on the environment it safeguards.

We understand that not every customer has the resources available to correctly configure and keep up with the management of their solutions, so Fortinet offers a managed firewall service to support the configuration and hardening of their devices and SOC-as-a-Service to support organizations struggling with hiring and retaining experienced professionals for critical, continuous security operations.

Each of these controls serves a different purpose. Hardening reduces the reliability of exploitation. Segmentation confines system reach. Security-domain enforcement restricts what processes can do. Out-of-band monitoring offers an alternative method to detect interference with critical files. Collectively, these measures aim to prevent any single defect or compromised service from gaining unrestricted control of the device.

Visibility and Forensics

Customers need more than preventive controls. When suspicious activity occurs, they need evidence to determine whether a device has been altered and what action to take.

FortiOS 7.4.4 improved real-time file-system integrity checks by hashing executable binaries and shared libraries, detecting unauthorized changes, and logging modifications. Later releases have expanded these features further by moving this to hardware (FortiSentry).

Making Product-Security Data More Usable

Transparency is beneficial only if customers can act on the information provided. Fortinet continues to publish a machine-readable security policy through security.txt and to include Common Weakness Enumeration (CWE) and Common Platform Enumeration (CPE) data in PSIRT advisories.

In 2025, 60% of the vulnerabilities Fortinet disclosed were discovered internally. Internal discovery of vulnerabilities indicates robust security testing, code audits, and product reviews to identify issues before they become exploited in the field. We have added the discovery source to our advisory interface, enabling customers and researchers to differentiate between internally identified vulnerabilities and those reported by external researchers and authenticated vs unauthenticated, allowing customers to accelerate risk-based patching decisions.

What We Are Prioritizing Next

The past year’s work gives us measurable progress. Fortinet’s next priorities include continued focus on our secure-by-default initiatives, expanding automatic-update coverage to more products, and supporting customer hygiene best practices with training and guidance; this may sometimes include removing beloved but insecure legacy protocols. In 2026, telnet is a prime example of this.

Fortinet is committed to providing cyber responders with a more robust foundation for detecting tampering and investigating potential security breaches by aligning with the UK National Cyber Security Centre’s initiative to establish forensic observability as a standard feature of network devices. Our next step is to enhance the evidence available to administrators and incident responders and simplify the process of collecting and analyzing it.

We must also continue expanding the hardening efforts described earlier. Security controls are most effective when they are consistently applied across product releases, tested against real-world attack paths, and measured by outcomes rather than by implementation alone.

We have invested heavily in post-quantum cryptography (PQC) development and support PQC algorithms in firewall, SD-WAN, SASE, management, and infrastructure.  Features that support customers with crypto visibility and encourage migrations are a priority for driving acceptance.

Secure by design is an ongoing commitment, not just a one-time pledge. Its goal is to consistently reduce preventable risks, simplify secure operations for customers, and provide transparent evidence of our progress. We will continue to demonstrate and report on these initiatives, including ongoing tasks, and we welcome customers, researchers, and government partners to hold us and others in the industry accountable to this standard.