- Fortinet announced a cloud-delivered service that checks AI prompts, replies and agent tool calls for FortiGate customers. It also offers a self-hosted option called FortiAIGate.
- The launch material is from the vendor only. It gives no independent speed or cost results, and the release does not say where inspection runs.
- Before buying, ask where inspection happens, whether traffic must be decrypted, and who owns the spending limits.
AI traffic is a conversation, and firewalls were built for packets
For decades, a firewall asked simple questions. Where is this traffic from? Does it match a known attack? Is it carrying something forbidden? An AI agent changes that, because the risky part is what the request says.
Fortinet builds its announcement on that point. It argues that older tools look at addresses, signatures and payloads, but not at the meaning of a prompt or a reply. The lesson here is that AI has added a new layer of traffic. The control point has to sit where the conversation happens.
What Fortinet announced
Fortinet unveiled the FortiGuard Inline AI Security Service on October 26, 2026. It is delivered from the cloud and aimed at customers who already run FortiGate firewalls. Fortinet says they can turn it on without building separate AI security infrastructure.
Fortinet says this gives customers a "simpler path" to AI security. That is the vendor's claim. The release does not say where the inspection runs or how traffic reaches the service.
A second option is FortiAIGate. Fortinet says customers with strict privacy or sovereignty needs can host it themselves, on-premises or in their own cloud. It runs on Kubernetes with NVIDIA GPUs. Fortinet says prompts, responses, data and logs then stay in the customer's environment.
Fortinet also says the service draws on technology from its recent acquisition of Virtue AI.
How the control point works
Picture a checkpoint between an AI application and the model it calls. Fortinet says FortiAIGate sits in that spot. It reads each exchange and applies rules based on the model, the application, the user's role and the business context.
The checks reach past chat. Fortinet lists prompts, model replies, calls to tools that use the Model Context Protocol (MCP, a standard that lets AI agents use other software), API activity and agent actions. It says the checks also cover images, audio, video and code.
Data loss prevention is part of the package. Fortinet says its expanded version detects 35 types of personal and confidential data. Administrators can alert, deny or redact that data before it leaves.
Money is now a security setting
One feature shows how the problem has widened. Fortinet describes spending rules that an administrator can apply to a whole organization, a team workspace, a single project or one person. The rules cover which models are allowed, budgets and request rates.
Administrators get a warning as spending nears the cap. Once it passes the cap, further requests are refused.
Fortinet also names what it calls Denial-of-Wallet attacks. These are malicious requests meant to use up paid tokens or GPU time. The company says it blocks them before they use either.
For a finance leader, this matters. An agent that loops or is abused can create a bill as well as a breach. Tying usage rules to spending puts both risks under one policy.
What the launch does not show
The evidence so far comes from the vendor. A Reddit post summarizing the launch notes that it includes no independent benchmark or customer performance result. Speed and running cost are therefore open questions.
Fortinet's release claims low delay and few false alarms. Those are claims, not measurements.
A reader in the same Reddit thread asked whether the service needs traffic decryption, with the performance cost that brings. The release does not answer that. Another commenter replied that firewalls should be sized to decrypt anyway. Both are forum opinions. The question is still fair, and a buyer should get a written answer.
Some commenters also raised Fortinet's record of vulnerabilities in its own products. The release is silent on that, and no CVE appears in the material we reviewed. A buyer can still ask how the AI service is isolated and patched.
Questions to put to your team
First, find out where your AI traffic goes today. Fortinet says its tools can discover shadow AI, meaning AI tools staff use without approval. Start by counting what is already in use.
Second, ask the vendor for results on your own traffic: added delay, false blocks and the cost of any extra capacity. Third, ask where inspection runs and whether it needs traffic decryption.
Fourth, decide who owns the spending limits and the redaction rules, and who can see the logs. Fortinet says it can give auditors a record of each prompt, reply and tool action. That is useful. It is also a new store of sensitive data to protect.
Fortinet says this approach lowers the effort of starting. That may hold for FortiGate customers, but it does not remove the need to test. A control point only helps when it is measured.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Fortinet.
