Fortinet, a global leader in broad, integrated and automated cybersecurity solutions, has announced a new Extended Detection and Response (XDR) solution, FortiXDR, designed to reduce complexity, speed detection and coordinate response to cyberattacks across the organisation.

FortiXDR is the only solution of its kind to leverage artificial intelligence for the investigation effort critical to incident response.

Expanding on the cloud-native endpoint platform of FortiEDR, it enhances an organisation’s Security Fabric and the threat protection powered by FortiGuard Labs security services. Specifically, FortiXDR can fully automate security operations processes typically handled by experienced security analysts to mitigate threats faster across the broad attack surface.

Cybercriminals are using sophisticated and increasingly intelligent tools to target vulnerable network edges resulting from digital innovation. As a result, organisations need smarter, faster security operations to combat sophisticated, organised cybercrime. FortiXDR is the only XDR solution that leverages artificial intelligence to replicate the hands-on investigation that otherwise leaves organisations playing catch-up. Applied across the Security Fabric platform, it helps enterprises keep pace with today’s accelerating threat landscape, even for organisations limited by small teams and few tools. — John Maddison, executive vice president of products and chief marketing officer at Fortinet

XDR solutions solve critical security challenges

The large number of security products typically deployed by enterprises has resulted in an unmanageable volume of security information that can mask threats, leaving security teams struggling to detect and respond to cyberattacks. As a result, most organisations are either currently or planning in the next two to three years to consolidate security vendors.

Many organisations are gravitating towards consolidation based on an XDR solution. Gartner defines XDR as “a security incident detection and response platform that automatically collects and correlates data from multiple security products.”¹ XDR provides an intelligent and automated way to tie traditionally isolated solutions into a single system. (¹Firstbrook and Lawson, Innovation Insight for Extended Detection and Response, Gartner, 19 March 2020.)

However, while XDR solutions can ease some of the challenges related to vendor complexity, most focus on cross-product alert correlation and still require significant manual intervention of teams already stretched thin due to the cyber skills gap. Security teams require an XDR solution that can automate the entire process, from detection to event investigation to remediating security incidents.

Fortinet brings AI to XDR

Unlike other solutions, FortiXDR is AI-powered by a patent-pending Dynamic Control Flow Engine and continually trained by the threat data and research of FortiGuard Labs as well as the frontline expertise of its incident responders. The solution starts by leveraging the diverse security information shared across the Fortinet Security Fabric for correlation and analysis, converting them into high-fidelity security incidents. These are then investigated by the AI engine, just as a seasoned security analyst would, to come to a final threat classification and scope. Finally, the best possible contextual responses are defined and can be automatically implemented to quickly remediate confirmed incidents.

Key benefits of FortiXDR include:

Dramatically reduced number of alerts across products — by 77% or more on average;
Complex tasks handled in seconds that would take experts with specialised tools 30 minutes or more to accomplish. And without human error;
Consolidation of independent security products and an automatic, coordinated response; and
Fully automated intelligent incident investigation rather than relying on scarce human resources.

Reduce time to detection and response

FortiXDR can ingest telemetry from more aspects of an organisation than any other solution, increasing the chance of detecting and properly classifying attacks. It also covers more of the “cyberkill” chain stages and supports more points of response to mitigate the impact of an attack more effectively than competitive solutions. All of this enables organisations to reduce mean time to detection and mean time to response, while improving security operations efficiency and security posture. As a result, FortiXDR allows organisations to reduce the risk of missing potentially crippling cyberattacks from ransomware, phishing and more, all while easing the burden on small security teams.

FortiXDR and the Fortinet Security Fabric

Fortinet’s platform approach, the Fortinet Security Fabric, leverages the top-rated, global security services of FortiGuard Labs to stop as many attacks as possible across the digital attack surface. It also provides the perfect foundation for XDR — with a common data structure, correlated telemetry, unified visibility, native integration and seamless interoperation. Now, FortiXDR layers on automated analytics, incident investigation and predefined responses out of the box.

The right-fit solution for any size organisation

FortiXDR joins Fortinet’s industry-leading portfolio of AI-driven security operations offerings, including incident response components suitable for organisation of any size or sophistication. FortiXDR’s “out-of-the-box” operation makes it perfect for most midmarket and average enterprise organisations with limited teams, tools and processes. For organisations with more staff, solutions and systemic processes, FortiSIEM adds multi-vendor visibility while FortiSOAR orchestrates response. This family of products delivers the right-fit solution to organisations of any size to help teams reduce the risk potential of security incidents by blocking more, detecting sooner and responding faster.

What Fortinet customers have to say

We know that even experienced security professionals struggle with a range of threat detection and response challenges. Our recent research found that two-thirds (67%) of organisations manage threat detection and response using an assortment of point tools. Further, nearly half report they rely on manual processes for threat detection and response and struggle with the daily volume of security alerts, so it’s not surprising that 23% are already working on an XDR project and a further 70% expect to have budget to invest in XDR over the next 12 months. With the introduction of FortiXDR, Fortinet is well positioned to emerge as a major player in the XDR market. — Jon Oltsik, senior principal analyst, ESG

Many customers, especially those with smaller teams, are looking to consolidate individual point products deployed over time with an integrated solution set that is much more manageable and effective. FortiXDR will allow us to offer customers a differentiated approach to consolidation and extended detection and response, powered by the industry’s most sophisticated AI technology. In a field where seconds matter, this helps reduce the risk of missing potentially crippling cyberattacks. FortiXDR is another example of the innovation Fortinet is delivering with its Security Fabric. — Andrew Hammond, director of strategic services, Liquid Networx

Before FortiXDR, our team would have to make a decision between investigating numerous alerts across our many platforms and performing other more visible business objectives. The FortiXDR platform can automatically digest and investigate, alleviating us from this balancing act. Given that each incident may take up to 45 minutes to investigate, we have not only gained the ability to have a more competent security review but also allowed staff to focus on what they do best. Further, the FortiGuard Managed Detection Response Service team works in concert with our business direction to ensure that FortiXDR automates a standard playbook for responding to threats and unwanted programs. They are available for escalations during an immediate incident and provide a wonderful augment to my high-level system and security administrators. This augmentation has allowed us to lower our call-back expenses for afterhours incidents and allows me to empower my helpdesk staff to achieve rapid resolution without needing to escalate through our internal support tiers. — Jay Larson, IT director, Summit Healthcare

Additional resources

Visit the blog to find out more about FortiXDR and how security teams can take control of security operations with consolidation and XDR.
Read the ESG Survey Report to learn how security practitioners view the threat detection process, top challenges and plans for XDR.
Find out how the Fortinet Security Fabric platform delivers broad, integrated and automated protection across an organisation’s entire digital infrastructure.
Learn more about FortiGuard Labs’ threat intelligence and research and the FortiGuard Security Subscriptions and Services portfolio.
Learn more about Fortinet’s Network Security Expert (NSE) Training Institute, including its free cybersecurity training initiative, the NSE Certification Programme, Security Academy Programme and Veterans Programme.
Read more about how Fortinet customers are securing their organisations.
Engage in the Fortinet User Community. Share ideas and feedback, learn more about our products and technology, and connect with peers.
Follow Fortinet on Twitter, LinkedIn, Facebook, YouTube and Instagram.

About Fortinet
Fortinet secures the largest enterprise, service provider and government organisations around the world. Fortinet empowers its customers with complete visibility and control across the expanding attack surface and the power to take on ever-increasing performance requirements today and into the future. Only the Fortinet Security Fabric platform can address the most critical security challenges and protect data across the entire digital infrastructure, whether in networked, application, multi-cloud or edge environments. Fortinet ranks number one in the most security appliances shipped worldwide and more than 500 000 customers trust Fortinet to protect their businesses. Both a technology company and a learning organisation, the Fortinet Network Security Expert (NSE) Training Institute has one of the largest and broadest cybersecurity training programmes in the industry. Learn more at www.fortinet.com, the Fortinet blog or FortiGuard Labs.