FortiGuard IPS is Fortinet’s AI/ML-powered intrusion prevention service designed to detect and block cyberthreats before they reach your devices. It combines several capabilities into one service:

• Deep packet inspection (DPI) to continuously monitor network traffic and inspect packets in detail.
• Signature-based detection using an IPS library with over 13,500 vulnerability and exploit signatures.
• Behavior and anomaly analysis powered by AI/ML to spot unknown and zero-day attacks that don’t yet have signatures.
• Virtual patching to protect against vulnerabilities before vendors release official patches.

When FortiGuard IPS detects a potential threat, it can automatically block the traffic and share that intelligence with FortiGuard Labs and other products in the Fortinet Security Fabric (such as FortiGate, FortiProxy, FortiClient, FortiADC, and Secure SD-WAN). This enables a coordinated, networkwide response.

The service is built on a modern architecture and Fortinet’s patented ASICs, which helps maintain high performance and low latency even in large data centers, whether you deploy it as an appliance, virtual device, cloud-based service, or standalone subscription.

FortiGuard IPS is designed to help you rethink how you keep pace with fast-changing threats by combining global intelligence, AI/ML, and automated updates:

• Global threat visibility: FortiGuard Labs draws on a global network of more than 3 million sensors to gain insight into threats appearing anywhere in the world.
• AI/ML-driven analysis: Traffic is analyzed in real time using AI/ML to detect anomalies and suspicious behavior, not just known signatures. This is key for zero-day protection.
• Signature clustering: Instead of managing many separate signatures for the same vulnerability, FortiGuard IPS uses signature clustering to group related attack patterns. This improves detection accuracy and reduces processor load.
• Virtual patching: The service can enforce protections against vulnerabilities before vendor patches are available, reducing your exposure window.
• Near-real-time and daily updates: New and updated IPS signatures are created by FortiGuard Labs and pushed across the Security Fabric in near real time, with daily signature updates to keep defenses current.

In practice, this means your IPS policies are continuously refreshed with the latest intelligence, helping you mitigate both known and emerging threats without waiting for traditional patch cycles.

FortiGuard IPS is tightly integrated into the Fortinet Security Fabric, which helps you reimagine IPS as part of a unified security platform rather than a standalone point product.

Key integrations include:

• FortiGate Next-Generation Firewalls (including Secure SD-WAN)
• Fortinet Secure Web Gateway
• FortiClient
• FortiADC
• FortiProxy

Within this fabric, IPS policies can be centrally managed from a single console, making it easier to correlate threat data and automate coordinated responses across your network.

Deployment and subscription options:

• Available as a standalone IPS service or as part of bundled subscriptions (e.g., ATP, UTP, ENT bundles; specific pricing is provided in Fortinet price lists).
• Can be deployed on physical appliances, as virtual devices, or as cloud-based services, depending on your architecture.
• Organizations simply add the desired IPS subscription to their existing Fortinet Security Fabric deployment to start using the service.

This approach lets you scale IPS coverage across IT and OT environments while keeping management and updates streamlined through the broader Fortinet ecosystem.