FortiGuard Inline AI Security Service: What FortiGate Really Inspects

Fortinet has announced the FortiGuard Inline AI Security Service, which turns existing FortiGate appliances into an inspection point for prompts, model responses, MCP tool calls and agent actions. The only evidence behind it so far is vendor material. Before it lands in a budget line, security leads need to know what it covers, what it misses, and why self-hosting the companion gateway does not settle GDPR on its own.

What Fortinet announced for FortiGate customers

Fortinet announced two products. The FortiGuard Inline AI Security Service is cloud-delivered to existing FortiGate customers. FortiAIGate is a gateway customers can host themselves. According to Fortinet, the inline service inspects four kinds of AI traffic (prompts, model responses, MCP tool calls and agent actions) and can block or redact sensitive data in transit.

FortiAIGate adds model permissions, budgets and rate limits: which users and workloads reach which models, how much they spend and how fast they call. That is governance, not data loss prevention — evaluate it on its own terms.

The cost profiles differ. The inline service rides the FortiGate egress you already pay for. FortiAIGate runs on Kubernetes with NVIDIA GPUs for teams that need control over where prompts, data and logs are processed, which means GPU capacity, a cluster and people to run it.

The story surfaced on r/cybersecurity on 26 October 2026, when /u/Codeblix_Ltd summarized Fortinet’s investor release and the FortiAIGate product page and called it vendor evidence, with no independent benchmark or customer performance result. No CVE or incident is involved. Read it as a scoping document for a control you are about to test.

Can FortiGate inspect encrypted LLM traffic?

Only if the traffic is decrypted where the control can read it, and the announcement, as summarized, does not say how. Hosted model APIs and chat interfaces run over HTTPS. Without decryption, an appliance sees a hostname and byte counts, not the prompt.

Reading content takes TLS deep inspection, a gateway the client connects to directly, or an endpoint or provider integration. Deep inspection means trusting a corporate CA on every managed device and maintaining bypass lists for apps that break. In EU jurisdictions it raises privacy and works-council questions, because inspecting prompts means reading what employees write. Unmanaged and BYOD devices fall outside it.

MCP is the second gap. The protocol carries JSON-RPC 2.0 messages over transports that include stdio and Streamable HTTP. A coding agent talking to a local MCP server over stdio never touches the network. A cloud agent calling a SaaS connector may leave through a NAT gateway with no FortiGate in front of it.

“Inspects MCP tool calls” holds only for calls that cross the inspection point. If your MCP estate grew organically, MCP server and tool-chain security testing will show where those calls actually go.

Fortinet has published no supported FortiOS version, FortiGate model list or capacity figures. For a feature that parses streaming model output at line rate, sizing is an open question.

Can an inline AI firewall stop prompt injection and agent abuse?

It can catch symptoms, not the cause. The OWASP Top 10 for LLM Applications (2025 edition) separates what this announcement bundles together:

• LLM02 Sensitive Information Disclosure is what redaction addresses.
• LLM10 Unbounded Consumption is what budgets and rate limits address.
• LLM06 Excessive Agency is partly addressed by model permissions.
• LLM01 Prompt Injection is the hard one.

Indirect prompt injection happens when a model reads attacker-written text in a document, ticket or web page and treats it as an instruction. What reaches the wire is a well-formed tool call, such as “open a pull request” or “send this file”, issued by a legitimate agent identity with valid credentials.

This is the classic confused deputy. Unless the policy knows that this agent, on this task, should never call that tool with those arguments, the call goes through.

A demo that redacts a card number from a prompt tells you nothing about whether a hijacked agent gets stopped. That second test is the core of prompt injection testing. In agent pentests, the decisive finding is rarely a filter missing a string. It is the tool behind the agent holding permission to do the damage.

The audit trail still has value. Most organizations cannot say which agent called which tool, when and on whose behalf. A chokepoint that logs model, tool name and policy decision closes that gap for incident response.

What's still unknown about the FortiGuard Inline AI Security Service?

Most of what a buyer needs to sign a contract. Put each gap to Fortinet in writing before a pilot starts:

• Latency. No figures. Redacting a streamed response means buffering it, which adds delay, or deciding token by token, which weakens the check. Agents that chain dozens of calls compound the overhead.
• Cost. No pricing, licensing model or subscription terms. FortiAIGate adds GPU hardware and cluster operations on top.
• Availability. Only “announced” — no general-availability date.
• Coverage. No named model providers, MCP transport details or FortiOS versions.
• Efficacy. No detection logic, false-positive rates or third-party test results.

What should a CISO or CTO decide now?

Name the problem you are paying to solve, then check whether this product solves it.

Data residency. FortiAIGate on your own cluster keeps inspection local but does not settle GDPR. If the gateway forwards a redacted prompt to a model hosted outside the EEA, Chapter V transfer rules still apply, as do Article 28 processor terms with the model provider, vendor support access and any telemetry Fortinet collects. Your DPO will ask both where the gateway sits and where the data flows.

Shadow AI and prompt leakage. If employees paste customer data into public chatbots, the inline service is likely the lowest-incremental-cost control point, because it rides egress you already run. That holds only if you accept TLS inspection on managed devices and the policy work that follows.

Runaway agent spend. Budgets and rate limits are a real control against unbounded consumption, and a finance team will grasp them faster than any DLP pitch.

Either way, the gateway becomes a sensitive data store. Prompts, responses, tool arguments and agent traces carry credentials, personal data and deal terms, so its logs need the same retention, access, export and deletion review as your CRM. Do not commit to multi-year terms before you have pilot numbers.

How would we test it before you sign?

Like any other control: canaries, bypass paths and timing, not a browser demo. The minimum we run on an AI gateway pilot:

1. Four separate canary cases: prompt exfiltration, sensitive model output, an MCP tool argument and an agent action. Send each through the gateway, then straight to the provider API. If the direct path works, so does the attacker’s.
2. Indirect injection with a benign canary: plant an instruction in a document the agent reads. Record whether the agent attempts the forbidden tool call, whether the gateway blocks it, and whether the destination system’s own authorization denies it. That last check saves you when inspection is bypassed.
3. Latency under load: p50, p95 and p99 latency, error rate and throughput, without and then with enforcement, on identical requests. Include long and streamed responses, concurrent agents and redaction-heavy payloads.
4. Correlation: one event should tie together user or workload identity, model, MCP server, tool name and policy decision. If you cannot rebuild an incident from the log, the log is decoration.

In practice, the bypass is almost always a path nobody routed through the gateway: a developer API key in a CI job, or a SaaS connector calling the model provider server-to-server. Inventory every route to a model before you rely on any chokepoint.

Where does an AI gateway fit in an AI defense stack?

An AI gateway is one layer between your agents and the outside world, and on its own it fixes nothing. In the model from AI agent security: three lines of defense, the gateway catches what leaves and enforces spend, least privilege on tools limits what a hijacked agent can do, and adversarial testing shows which layer fails first.

What a gateway cannot replace is testing the agent itself: what it does when its context is poisoned, and what the credentials behind its tools allow. That is the work of AI agent penetration testing, measured against your own traffic rather than a vendor’s slide.

FAQ

How is FortiAIGate different from the inline FortiGuard service?

FortiAIGate is a separate gateway focused on governance: model permissions, budgets and rate limits. It can be self-hosted on Kubernetes with NVIDIA GPUs to control where prompts, data and logs are processed.

Does inspecting AI traffic on FortiGate require TLS decryption?

Fortinet's announcement, as summarized, does not say. Reading HTTPS prompt content generally requires decryption at the control point, a terminating gateway, or an endpoint or provider integration.

Can an inline AI gateway stop prompt injection?

Not reliably on its own. Indirect injection forms inside the model's context and the resulting tool call looks legitimate on the wire, so tight tool permissions and authorization at the destination system are still required.

When will FortiGuard Inline AI Security be available and what does it cost?

Fortinet has stated no general-availability date, pricing, licensing model or latency figures. Only the announcement, reported on 26 October 2026, is public.

Before an AI gateway becomes your only line, find out what your agents do when their context is hostile. agent::offense runs AI and LLM agent security testing that measures your controls against your own traffic.