Phitech 懇懋科技

05/08/2026

OT cybersecurity becomes a board-level priority as industrial security maturity rises, Fortinet finds
New data from Fortinet‘s 2025 State of Operational Technology and Cybersecurity Report found that industrial organizations are steadily maturing their OT security programs, with responsibility increasingly shifting to executive leadership. More than half of surveyed organizations now place OT cybersecurity under the CISO or CSO, up from 16% in 2022, while 80% plan to move OT security under CISO oversight within the next year. The report suggests that OT risk is becoming a board-level concern as organizations seek stronger governance over increasingly connected cyber-physical environments.

The study identified a correlation between higher OT security maturity and reduced operational impact from cyber incidents. Organizations reporting more advanced security practices, including segmentation, threat intelligence integration, and automation, experienced fewer attacks and lower business disruption.

While nearly half of respondents still reported cyber incidents affecting operations, the percentage of intrusions leading to revenue-impacting outages fell from 52% to 42%. At the same time, 46% of organizations reported reaching the highest level of OT security maturity, reflecting broader industry efforts to strengthen resilience across critical infrastructure and industrial operations.

“Industrial organizations now rely on interconnected systems, remote access, cloud-based analytics, and unified IT and OT environments to maintain production,” Richard Springer, senior director for marketing OT solutions at Fortinet, wrote in a Tuesday blog post. “While this advanced connectivity offers increased efficiency and resilience, it has also enlarged the attack surface for cybercriminals, ransomware groups, and nation-state actors.”

He added that the 2026 Fortinet State of Operational Technology and Cybersecurity Report shows that organizations are becoming more diligent in addressing these risks. “The report highlights a market that is increasingly realistic about OT cybersecurity maturity, more alert to intrusions, and more dedicated to meeting upcoming regulatory requirements.”

Springer mentioned that the good news is that many organizations are making progress. The challenge, however, is that maturity levels vary, with many OT environments still facing major issues with visibility, segmentation, secure remote access, incident response, and standardized security architecture.

Responsibility for OT cybersecurity remained largely concentrated with CISOs and CIOs, though the proportion of organizations reporting such oversight declined from 69% in 2025 to 60% in 2026. “Signaling an increase in maturity, the C-suite has mitigated OT risk to the point of delegating OT cybersecurity responsibility back down to senior leadership roles. Those respondents who do not have elevated OT risk yet still need specialized knowledge and leadership to address the increasing number of sophisticated threats.”

The report revealed that for the fifth consecutive year, the number of respondents who intend to move OT cybersecurity under the CISO in the next 12 months increased from 80% in 2025 to 81% in 2026. These changes indicate a solidifying of the importance of OT risk ownership in the C-suite.

Fortinet identified that organizations have reassessed their OT cybersecurity maturity as greater executive oversight, increased funding, and advanced security tools exposed previously unseen gaps. While earlier self-assessments often placed programs at maturity levels 3 and 4, many now recognize lower actual maturity and are focusing on foundational controls such as asset visibility, access management, and network segmentation.

Process maturity data shows that many organizations remain in reactive mode. The share of respondents at level 0 increased from 1% to 5%, while levels 1 and 2 rose from 5% to 17% and 13% to 27%, respectively. Level 3 organizations grew modestly, while level 4 respondents dropped sharply from 49% to 17%. The report views this decline as a positive recalibration, reflecting more realistic assessments driven by improved expertise, broader teams, and better visibility into security weaknesses.

“A positive indicator of increasing cybersecurity maturity is that teams are now reporting greater visibility of intrusions as opposed to reporting none,” according to the report. “In this year’s report, the declining numbers of respondents saying they had detected zero intrusions may point to a greater ability to detect intrusions rather than a real decline in the volume of successful attacks. At the top end, organizations that have had more than 10 intrusions in the year stayed steady at just 2%.”

However, the report observed that the number of respondents reporting multiple attacks (one to nine incidents) has increased from previous years, totaling 71%, up from 47%.

Moving on to laws, regulations, and compliance mandates, Fortinet identified that it continues to be a challenge for IT and OT leaders. “Increasingly, these leaders want to get ahead of governance cycles and learn about potential pending rule changes that may impact data protection, cybersecurity, health, safety, and other factors.”

Last year, some respondents expected new regulations in a few years, but now the vast majority of respondents predict new regulations will be coming soon. These new regulations will increase cybersecurity demands, but also will improve network reliability and resilience. In 2026, almost nine out of 10 respondents (89%) expect increased regulation in five years or less. This number is up sharply from 66% in 2025.

Regarding timing, there was a 20-point shift in respondents now anticipating new regulations in two to five years as opposed to over five years, suggesting that respondents want to prepare for IT and OT regulatory compliance challenges as they relate to cybersecurity.

The report highlights that while cybersecurity has become a board-level priority across industries, OT security is increasingly receiving the same level of executive attention. Although the CISO remains a central figure, responsibility for cybersecurity in 2026 is more broadly distributed across non-technical vice presidents and C-suite leaders, reflecting its growing business impact.

At the same time, organizations are placing greater emphasis on cost efficiency amid tighter budgets. Cost reduction and avoidance became the top cybersecurity performance metric in 2026, rising from second place the previous year. Despite increased pressure to demonstrate value, organizations continue to prioritize operational resilience and security in the face of elevated cyber risk. The report also found growing expectations of new regulatory requirements, driving an increase in compliance and regulatory reporting as a key cybersecurity objective.

“Attacker dwell time measures how long attackers spend undetected. This critical key performance indicator (KPI) also often reflects how much damage attackers can inflict because it’s easier for attackers to perform malicious tasks before they’re detected,” Fortinet reported. “Our survey suggests that although there is some flattening of dwell times of minutes, hours or days, attacks with longer dwell times of weeks, or even months, have increased. These long dwell times leave enterprises open to surveillance, loss of IP, and increase the risk of a ransom event or physical disruption.”

Fortinet found that respondents appear to be refreshing their ICS systems, with 40% reporting that their systems are under five years old, a sharp increase from 2025 (20%) and previous years. This rise points to a healthy attitude toward the benefits of modernization and transformation. Those organizations with aging 11-year-old or older systems should upgrade soon, or if refreshing the systems isn’t feasible, they should adhere to a strict patching and monitoring schedule.

The report identifies network segmentation and microsegmentation as foundational elements of an effective OT cybersecurity strategy. Organizations that separate IT and OT environments and enforce granular communication controls are better positioned to limit lateral movement, improve asset visibility, and reduce the impact of cyber incidents.

The company also recommends adopting secure remote access technologies that apply zero-trust principles, enabling third-party maintenance while minimizing the risks associated with traditional VPN-based connectivity. Together, these measures help industrial organizations strengthen security, improve compliance, and reduce operational risk in environments where legacy systems and limited patching options remain common.

Fortinet also emphasizes the importance of integrating OT into broader security operations and incident response planning. As cybersecurity responsibility increasingly shifts to CISOs and executive leadership, organizations are encouraged to develop incident response playbooks that account for production systems, plant operations, and OT-specific risks.

The report further recommends investing in OT-focused threat intelligence to improve visibility into emerging threats and industrial attack techniques. To simplify increasingly complex security environments, Fortinet advocates a platform-based approach that consolidates security capabilities across IT and OT, providing centralized management, improved visibility, automated response capabilities, and the potential to leverage AI-driven insights for faster threat detection and remediation.

In conclusion, Fortinet reported that only by defining and defending key operational assets and ensuring their performance can businesses compete in the global marketplace and governments protect their citizens. “Although the convergence of IT and OT can be a powerful driver of innovation, it requires a strong commitment to implementing cybersecurity defenses, hiring, and strategic thinking. Because many OT devices are more than 20 years old and unsecure by design, creating a secure OT environment is extremely challenging for many organizations.”

However, Fortinet said it sees signs that more organizations are making progress and better assessing their OT security posture. “These efforts are paying off in greater awareness of intrusions and a lower overall volume of intrusions. As the 2026 State of Operational Technology and Cybersecurity Report shows, companies with higher OT maturity security levels are improving their numbers substantially. To continue this positive trend, everyone from the C-suite on down must commit to protecting sensitive OT systems and allocate the necessary resources to secure critical operations.”

source:
https://industrialcyber.co/industrial-cyber-attacks/ot-cybersecurity-becomes-a-board-level-priority-as-industrial-security-maturity-rises-fortinet-finds/

29/07/2026

Fortinet expands FortiGate G series to secure AI from the data centre to modern enterprise edges
Fortinet announced new additions to its FortiGate G series portfolio, designed to help organisations secure and scale modern enterprise networks. The FortiGate 3500G and FortiGate 400G deliver high-performance security that keeps pace with growing encrypted traffic, AI-driven workloads, and distributed environments, enabling organisations to strengthen protection, maintain performance, and simplify operations across hybrid infrastructures. Powered by Fortinet’s NP7 and SP5 processors and the FortiOS operating system, the new series combines advanced threat protection, integrated intelligence, and hardware-enforced security.

“Organisations modernising their infrastructures for AI-driven workloads and increasingly distributed environments need security platforms that can deliver both performance and protection at scale,” said Ken Xie, Founder, Chairman of the Board, and Chief Executive Officer at Fortinet. “The expansion of our FortiGate G series reflects our commitment to helping customers simplify their architectures, reduce complexity, and protect their AI deployments from the data centre to the enterprise edge.”

Bringing AI visibility and control to high-performance security

With encrypted traffic, east-west data flows, and AI-driven threats accelerating, traditional firewall architectures are reaching their limits, forcing organisations to choose between performance and security. The FortiGate G series eliminates that trade-off with a unified platform built on Fortinet’s custom ASIC acceleration, delivering predictable, high-performance security, integrated threat intelligence, and consistent operations across hybrid environments.

FortiGate 3500G and 400G extend Fortinet’s AI-driven Security Fabric with native shadow AI detection, providing real-time visibility into unsanctioned usage across AI applications while enforcing controls to protect sensitive data. FortiGuard AI-Powered Security Services apply continuously updated intelligence and machine learning to identify and prioritise threats and automate protection, with FortiOS 8.0 expanding visibility through MCP and agent-to-agent traffic inspection for deeper control over AI data flows and access.

FortiGate 3500G: Built for the next era of data centre scale and trust

The FortiGate 3500G series is built for the next era of data centre scale and performance, where AI workloads, east-west traffic growth, and zero-trust requirements are redefining how infrastructure operates. Security is no longer a checkpoint—it is foundational to performance, scale, and trust.

Designed for this shift, the 3500G delivers 400Gb connectivity, advanced ASIC acceleration, and significant performance gains to secure high-density environments without introducing bottlenecks or requiring architectural redesign. It also addresses a growing gap in the market: trust in the security infrastructure itself. With hardware-level validation, secure firmware enforcement, and system-level transparency, the platform enables organisations to move from assumed trust to verified trust.

By tightly integrating security enforcement with SOC operations and maintaining familiar form factors, the FortiGate 3500G enables organisations to scale critical infrastructure, simplify operations, and deploy high-performance security with confidence.

FortiGate 400G: Modernising the enterprise edge without disruption

Extending these capabilities to the enterprise edge, the FortiGate 400G series modernises the mid-range firewall segment by bringing G-series performance, architecture, and operational consistency to distributed environments.

As applications span data centres, cloud, and edge, and encrypted and east-west traffic continue to surge, many legacy firewalls struggle to maintain performance when advanced security services are enabled, creating trade-offs between protection and efficiency. The FortiGate 400G eliminates compromises with consistent, hardware-accelerated performance, integrated threat intelligence, and a platform designed to support high-density traffic and segmentation-driven security without added complexity.

With a simplified upgrade path from existing FortiGate deployments and consistent interfaces across the portfolio, the 400G enables organisations to modernise their network edge, standardise operations, and scale security with predictable performance and minimal disruption.

– Threat protection performance is measured with firewall, IPS, application control and malware protection, and logging enabled.

– The numbers for competitive solutions are based on publicly available sources. Variations in testing methodologies and performance metrics may exist across different vendors.

– All power consumption values are taken from external data sheets and hardware system guides using maximum power consumption.

A unified platform for secure networking

Together, these additions reinforce Fortinet’s platform-driven approach, anchored by a single operating system, centralised management, and AI-driven threat intelligence and security capabilities. By integrating FortiOS, FortiManager, FortiAnalyzer, and FortiGuard Labs intelligence into a unified Security Fabric, Fortinet enables organisations to reduce tool sprawl, improve visibility, and accelerate threat detection and response while lowering total cost of ownership.

source:
https://www.expresscomputer.in/news/fortinet-expands-fortigate-g-series-to-secure-ai-from-the-data-centre-to-modern-enterprise-edges/135181/

22/07/2026

Fortinet Deepens Integration with NVIDIA to Uniquely Secure Enterprise AI at Scale
May 18, 2026



Fortinet, the global cybersecurity leader driving the convergence of networking and security, is accelerating the FortiAIGate solution with NVIDIA’s AI platforms and software technologies—protecting AI workloads, data, and autonomous agents in real time in data centers and the cloud, enabling organizations monitor AI usage, and securely build, deploy, and scale agentic AI without compromising performance or governance.

The solution’s inline deployment provides visibility while supporting data sovereignty requirements, delivering high-performance protection with minimal latency, according to the companies.

“The accelerating shift toward autonomous AI agents is creating unprecedented demand for secure, high-performance enterprise computing platforms. By integrating its FortiAIGate solution with the full-stack NVIDIA AI platform, Fortinet provides zero-trust security and real-time governance, reducing threat exposure by shortening response times,” said Justin Boitano, vice president, enterprise AI platforms, NVIDIA.

Business benefits of FortiAIGate for AI-driven enterprises include:

Accelerated, safe AI runtime: FortiAIGate provides a secure foundation for organizations to rapidly adopt AI-driven applications and autonomous agents. It applies security guardrails for large language models (LLMs) at runtime and protects the ecosystem behind it, including MCP servers and AI agents. Accelerated by NVIDIA Blackwell GPUs and NVIDIA Hopper with the latest open-source, distributed inference-serving framework NVIDIA Dynamo, it operates at high performance so businesses can harness AI productivity gains without incurring unnecessary latency, slowdowns, or service degradation.
AI sovereignty: With its self-hosting deployment modes, FortiAIGate enables organizations to develop, deploy, and govern AI using their own infrastructure, data, and workforce, ensuring compliance with local laws and security requirements, utilizing NVIDIA Nemotron safety models. FortiAIGate monitors user and device interactions, logging the actual prompt and response of any suspicious incident.
Zero-trust AI environments: FortiAIGate extends zero-trust security principles to AI environments, preventing LLM abuse and data leakage. It manages all AI model traffic and enforces strict guardrails on inputs and outputs, blocking threats like prompt injection attacks on LLMs and filtering toxic or unauthorized content generated by AI.
Operational efficiency and lower TCO: Built on NVIDIA AI infrastructure, FortiAIGate delivers high-throughput AI security with a fraction of the hardware footprint and energy use of traditional CPU-bound solutions. This means organizations can achieve low-latency protection for AI-powered applications without slowing them down, all while reducing server load and power consumption.
Scalable multitenant protection: FortiAIGate is architected for scale-out AI deployments and multitenant environments common in enterprises and AI data centers. It uses NVIDIA virtualization techniques to securely partition resources and isolate different AI workloads or customer datasets on the same hardware.
FortiAIGate supports flexible deployment across on-premises, cloud, hybrid, and edge environments. It is available as a GPU-powered appliance for data centers or as a virtual appliance or as containers on NVIDIA-Certified Systems. Regardless of form factor, organizations benefit from consistent protection and centralized management. Its inline deployment between applications and AI models also helps meet data sovereignty requirements.

For more information about this news, visit www.fortinet.com.

source:
https://www.dbta.com/Editorial/News-Flashes/Fortinet-Deepens-Integration-with-NVIDIA-to-Uniquely-Secure-Enterprise-AI-at-Scale-174827.aspx

Fortinet, the global cybersecurity leader driving the convergence of networking and security, is accelerating the FortiAIGate solution with NVIDIA's AI platforms and software technologies-protecting AI workloads, data, and autonomous agents in real time in data centers and the cloud, enabling organi...

15/07/2026

Fortinet unveils AI-powered security operations platform to combat rising cyber threats
Global cybersecurity leader Fortinet has introduced a major upgrade to its Security Operations (SecOps) Platform, unveiling a new wave of AI-powered innovations designed to help enterprises combat increasingly sophisticated cyber threats driven by artificial intelligence.

Announced during Fortinet Accelerate 2026, the latest enhancements bring together unified cloud-based Security Operations Center (SOC) capabilities, agentic AI workflows, managed detection and response services, and expanded endpoint security under a single integrated Security Fabric architecture.

The company said the latest developments are aimed at helping organizations modernize their security operations as cybercriminals increasingly use AI to accelerate attacks, automate reconnaissance, and exploit vulnerabilities faster than ever before.

“As attackers weaponize AI to accelerate reconnaissance, exploit development, and social engineering, security operations must function with the same speed and coordination,” said Ken Xie. “Fortinet is advancing a unified, AI-powered security operations platform that provides a scalable operating architecture across our defense framework.”

At the center of the announcement is FortiSOC, a new cloud-delivered platform currently in preview that consolidates the capabilities of FortiAnalyzer, FortiSIEM, FortiSOAR, and FortiTIP into a single integrated service. The platform is designed to simplify security operations by combining log ingestion, analytics, automation, case management, and threat intelligence into one unified console.

Fortinet also expanded FortiAI, moving beyond traditional AI copilots toward what it calls “agentic ex*****on” — enabling AI-driven workflows that can autonomously perform alert triage, threat hunting, investigations, and response actions across security environments.

The company noted that the platform integrates telemetry from both Fortinet and third-party systems, allowing organizations to maintain visibility across increasingly complex hybrid and multicloud environments.

To strengthen managed security coverage, Fortinet also upgraded its FortiGuard SOC-as-a-Service offering. The enhancements now include support for third-party log monitoring, expanded Security Fabric integrations, FortiNDR telemetry, and deeper cloud visibility through FortiCNAPP.

Meanwhile, Fortinet introduced significant improvements to FortiEndpoint, its endpoint security solution, aimed at reducing operational complexity while improving protection against AI-enabled threats and unauthorized AI application usage.

The upgraded FortiEndpoint platform now unifies multiple security functions — including Zero Trust Network Access (ZTNA), Secure Access Service Edge (SASE), Endpoint Protection Platform (EPP), Endpoint Detection and Response (EDR), and Data Loss Prevention (DLP) — into a single agent and management console.

Fortinet said the integrated approach is intended to help organizations reduce “agent sprawl,” simplify licensing and administration, and strengthen overall cyber resilience.

With cyberattacks becoming faster, more automated, and increasingly difficult to detect, Fortinet believes enterprises need security operations platforms capable of responding in real time across endpoints, networks, cloud systems, email, and identities.

The latest innovations, according to the company, aim to give security teams faster visibility, streamlined investigations, and smarter automated response capabilities — all within a single architecture built to defend against AI-driven cyber threats at scale.


source:

Global cybersecurity leader Fortinet has introduced a major upgrade to its Security Operations (SecOps) Platform, unveiling a new wave of AI-powered innovations designed to help enterprises combat …

08/07/2026

Fortinet launches new firewalls for AI traffic control

Joseph Gabriel Lagonsin
JOSEPH GABRIEL LAGONSINNews Editor
Fortinet has expanded its FortiGate G Series with the FortiGate 3500G and FortiGate 400G, two firewalls aimed at securing AI-related traffic across data centres and enterprise edge networks.

The launch comes as companies contend with rising volumes of encrypted traffic, more east-west data movement within networks, and wider use of AI tools across distributed systems.

The two systems are designed to address a common challenge in corporate networks: the performance hit that can occur when advanced inspection and security controls are enabled. Fortinet is positioning the 3500G for data centre environments and the 400G for enterprise edge deployments in the mid-range firewall segment.

Both products run on Fortinet's FortiOS software and use its NP7 and SP5 processors. They combine traffic inspection, threat intelligence, and hardware-based integrity controls in a single platform.

AI focus

A central part of the expansion is greater oversight of AI use inside organisations. Fortinet says the FortiGate 3500G and 400G include native shadow AI detection, giving security teams visibility into unsanctioned use of AI applications and controls to protect sensitive data.

Its FortiGuard AI-Powered Security Services are used to identify and prioritise threats and automate protection measures. FortiOS 8.0 adds inspection of MCP and agent-to-agent traffic, intended to give customers closer control over AI-related data flows and access.

The data centre model is built around high-capacity connectivity and hardware-based trust features. Fortinet says the 3500G offers 400Gb connectivity and is aimed at organisations facing rising internal traffic volumes, zero-trust requirements, and heavier AI workloads in dense environments.

It also includes hardware-level validation, secure firmware enforcement, and system-level transparency measures designed to help customers verify the integrity of their security infrastructure rather than rely on assumed trust.

Edge systems

At the enterprise edge, the 400G is intended as an upgrade path for existing FortiGate users seeking newer hardware without a major operational change. The model keeps interface consistency across the wider portfolio, which could make it easier for network and security teams to standardise administration across sites.

The 400G is designed for distributed environments where applications span data centres, cloud systems, and edge locations. In those settings, older firewalls can struggle to maintain throughput when inspection features such as intrusion prevention, application control, and malware protection are enabled.

Ken Xie, Founder, Chairman of the Board, and Chief Executive Officer at Fortinet, linked the launch to broader changes in enterprise infrastructure.

"Organisations modernizing their infrastructures for AI-driven workloads and increasingly distributed environments need security platforms that can deliver both performance and protection at scale," said Ken Xie, Founder, Chairman of the Board, and Chief Executive Officer, Fortinet.

He said the latest additions are intended to help customers simplify how they build and protect those environments.

"The expansion of our FortiGate G series reflects our commitment to helping customers simplify their architectures, reduce complexity, and protect their AI deployments from the data center to the enterprise edge," said Xie.

Single platform

The launch also highlights Fortinet's long-standing effort to bring networking and security functions together under a single management and operating framework. The two new systems sit within its broader Security Fabric approach, which combines FortiOS, FortiManager, FortiAnalyser, and threat intelligence from FortiGuard Labs.

That structure is intended to give organisations a central way to manage policy, visibility, and incident response across hybrid environments. For large companies running separate systems across branch sites, campuses, cloud deployments, and data centres, this kind of consolidation is often presented as a way to reduce the number of security tools in use and simplify operations.

Fortinet did not disclose pricing. It said performance comparisons in its materials were based on firewall, intrusion prevention, application control, malware protection, and logging being enabled, while competitor figures were drawn from publicly available information.

Power consumption figures in its comparison materials were taken from external data sheets and hardware guides using maximum power consumption values.

For buyers, the significance of the new models will depend on whether they can maintain inspection rates as AI traffic and encrypted workloads continue to grow inside corporate networks. Fortinet says the products are intended to let organisations apply tighter controls across hybrid infrastructure while keeping operations consistent from the data centre to the edge.

source:

Rising encrypted and AI-related traffic is forcing firms to rethink firewall performance as Fortinet adds higher-capacity models for data centres and edge sites.

01/07/2026

The Fortinet 2026 report reveals surge in AI-enabled cybercrime, with 389% increase in ransomware victims
Fortinet released the 2026 Global Threat Landscape Report from FortiGuard Labs. Derived exclusively from FortiGuard Labs telemetry, the latest annual report is a snapshot of the active threat landscape and trends from 2025, including a comprehensive analysis across all tactics used in cyberattacks, as outlined in the MITRE ATT&CK framework. The data reveals that cybercrime no longer functions as a series of isolated campaigns—it operates as a system, with malicious hackers operating across an end-to-end life cycle and compressing the attack life cycle with shadow agents.
“Cybercrime is one of the world’s most pervasive and costly threats, and our latest Global Threat Landscape Report reveals how malicious actors are beginning to leverage agentic AI to execute more sophisticated attacks,” said Derek Manky, chief security strategist and global VP of threat intelligence, Fortinet FortiGuard Labs. “As cybercriminals increasingly use AI to bolster their tactics, cyber defenders must evolve cybersecurity operations into an industrialized defense and adopt AI-enabled tools that respond at the same velocity as modern threats.”
Attack Techniques and Targeted Sectors in Today’s Threat Landscape
Modern cybercrime crosses borders and sectors, and even traditional definitions of crime itself. As attacks grow more sophisticated and interconnected, key findings from the latest FortiGuard Labs Global Threat Landscape Report reveal:
Velocity defines risk as time-to-exploit (TTE) shrinks: As AI accelerates reconnaissance, weaponization, and ex*****on, FortiGuard Intelligence shows that TTE as 24–48 hours for critical outbreaks, a sharp increase from earlier reports that revealed a TTE of 4.76 days. Real-world incidents reflect how minutes can define outcomes: Active exploitation attempts were made within hours of the React2Shell vulnerability public disclosure.
Ransomware victims skyrocket: FortiRecon adversary intelligence identified 7,831 confirmed ransomware victims globally, skyrocketing from approximately 1,600 identified victims in the Fortinet 2025 Global Threat Landscape Report. Availability of crime service kits like WormGPT, FraudGPT, and BruteForceAI contributed to this 389% increase year-over-year (YoY). The top three targeted sectors include manufacturing (1,284), business services (824), and retail (682). Geographic concentration includes the U.S. (3,381), Canada (374), and Germany (291).
Identity sprawl defines cloud exposure: FortiCNAPP intelligence confirms that throughout 2025, most confirmed cloud incidents originated from stolen, exposed, or misused credentials rather than from infrastructure exploitation. Sector analysis shows hospitals/physician clinics and retail establishments as the #1 target. Large identity populations, federated access models, and complex cloud integrations make these prime targets for malicious hackers.
Inside the Habits of Modern, AI-Enabled Cybercriminals
As FortiGuard Labs Cyberthreat Predictions for 2026 projected, the most capable threat groups function as semi-autonomous enterprises, supported by shadow agents, access brokers, and botnet operators who provide services on demand. Key findings from the 2026 Global Threat Landscape Report show:
Shadow agents reduce operator skill requirements while increasing workflow speed. FortiRecon dark web signals captured AI-enabled offensive tooling advertised as services and products, including enhanced versions of WormGPT and FraudGPT, and novel services like HexStrike AI, an offensive AI tool with automated reconnaissance attack path generation; and BruteForceAI, a pe*******on testing tool that integrates large language models (LLMs) for intelligent form analysis and can execute sophisticated multi-threaded attacks.
With AI, criminals work smarter, not harder. FortiGate IPS telemetry recorded a 22% decrease in brute force attempts YoY, pointing to efficiency gains: With optimized, intelligent brute force techniques, threat actors are making fewer attempts against better-selected targets, increasing success probability per credential tested. This activity translates into about 67.65 billion brute force events globally, with approximately 185 million attempts per day; 1.3 billion attempts per week; and 5.6 billion attempts per month. At the same time, intelligence revealed a 25.49% increase in global exploitation attempts YoY.
Stolen datasets are more popular than leaked credentials. In the 2025 Global Threat Landscape Report, FortiGuard Labs observed a 500% increase in logs available from systems compromised by infostealer malware. In 2026, FortiRecon intelligence found an additional 79% increase and revealed a shift toward theft of more comprehensive data sets, enabled by agentic AI. Within dark web “database” activity, stealer logs dominated advertised and shared datasets (67.12%), exceeding combolists (16.47%) and leaked credentials (5.96%). Stealer logs reduce attacker effort by bundling identity material with contextual artifacts, including browser-resident data, enabling immediate replay and faster conversion than brute force or password spraying.
Credential-stealer malware persists. Credential-stealer malware remains a lucrative industry and primary upstream engine for exposure generation. FortiRecon telemetry shows stealer activity dominated by RedLine: 911,968 infections (50.80%); Lumma: 499,784 (27.84%); and Vidar: 236,778 (13.19%).
Putting Awareness into Action: Disrupting Cybercriminal Ecosystems
Fortinet is committed to disrupting cybercrime by collecting and sharing threat intel and actively working to combat cyberthreats on a global scale.
A recent collaborative effort spearheaded by INTERPOL and supported by Fortinet through the World Economic Forum Cybercrime Atlas resulted in the takedown of a cybercriminal network. Operation Red Card 2.0 took down infrastructure and operators behind online scams, mobile money fraud, and fraudulent loan applications in Africa. Fortinet is a founding member of the Cybercrime Atlas, a global public-private collaboration effort hosted by the World Economic Forum that uses open-source intelligence to map cybercriminal networks, identify infrastructure vulnerabilities, and support joint disruption operations with law enforcement, such as the recent Operation Red Card 2.0 and Operation Serengeti 2.0.
The 2026 Global Threat Landscape Report reveals that incentivizing the disruption of cybercrime has never been more important. To empower defenders to stay ahead of cybercriminals, Fortinet and Crime Stoppers International launched the Cybercrime Bounty program to provide a secure, anonymous channel for citizens and ethical hackers to submit information about cyberthreats.
Discover how FortiGuard Labs Advisory Services combine cutting-edge technology and expert services to help organizations strengthen their security posture before threats emerge. FortiGuard Outbreak Alerts provide key information about ongoing cybersecurity attacks with significant ramifications affecting companies, organizations and industries. In the event of an incident, FortiGuard Labs offers swift, effective response and in-depth forensic analysis to minimize impact and prevent future intrusions, delivering comprehensive protection in today’s increasingly volatile digital landscape.

source:

Fortinet released the 2026 Global Threat Landscape Report from FortiGuard Labs. Derived exclusively from FortiGuard Labs telemetry, the latest annual report is...