Fortinet Enhances FortiRecon to Align with Continuous Threat Exposure Management (CTEM) Framework to Help Organizations Stay Ahead of Threats

Rhea-AI Summary

Fortinet (NASDAQ: FTNT) has announced major enhancements to its FortiRecon platform, aligning it with the continuous threat exposure management (CTEM) framework. The upgraded platform introduces expanded internal attack surface monitoring, adversary-centric dark web intelligence, and security orchestration in a unified solution.

Key improvements include enhanced attack surface management with NVD severity ratings, advanced adversary-centric intelligence with bulk IOC downloads, strengthened brand protection features, and automated security orchestration capabilities. The platform integrates with Fortinet's AI-Driven SOC platform across the five CTEM framework pillars: scoping, discovery, prioritization, validation, and mobilization.

Notably, Fortinet was recognized as an Overall Leader in the KuppingerCole Leadership Compass for Attack Surface Management 2025, highlighting FortiRecon's operational readiness and broad integration capabilities.

Positive

• Enhanced platform capabilities aligned with CTEM framework
• Recognition as Overall Leader in KuppingerCole Leadership Compass 2025
• Integration with broader Fortinet Security Fabric tools
• Flexible deployment options through FortiFlex credits

Negative

• None.

Insights

Cybersecurity Analyst

Fortinet's FortiRecon platform upgrade significantly enhances its CTEM capabilities, potentially strengthening its competitive position in the growing attack surface management market.

Fortinet's FortiRecon platform enhancements represent a strategic expansion of their cybersecurity portfolio, now covering all five pillars of Gartner's Continuous Threat Exposure Management framework. This positions Fortinet to capitalize on a critical market trend, as Gartner predicts organizations using CTEM will be three times less likely to suffer breaches by 2026.

The upgraded platform introduces several high-value capabilities: expanded internal attack surface monitoring, adversary-centric dark web intelligence, and security orchestration - all unified in a single platform. The integration with Fortinet's AI-Driven SOC platform creates a comprehensive security ecosystem that addresses the growing problem of attack surface expansion and alert fatigue.

What's particularly valuable is FortiRecon's approach to vulnerability prioritization by combining standard NVD severity ratings with FortiRecon Active Exploitation severity ratings. This enables security teams to focus remediation efforts on vulnerabilities actively being exploited in the wild rather than wasting resources on theoretical vulnerabilities.

Fortinet's recent recognition as an Overall Leader in KuppingerCole's Leadership Compass for Attack Surface Management 2025 validates their technical approach. The availability through FortiFlex credits also creates a flexible adoption path for existing customers, potentially accelerating uptake.

This enhancement strengthens Fortinet's competitive position against pure-play attack surface management vendors and larger security platforms, particularly as organizations increasingly seek integrated security solutions rather than point products.

New features integrate attack surface management, threat intelligence, and security orchestration to help security teams reduce risk faster and more proactively

SUNNYVALE, Calif., Aug. 12, 2025 (GLOBE NEWSWIRE) --

News Summary

Fortinet® (NASDAQ: FTNT), the global cybersecurity leader driving the convergence of networking and security, today announced significant enhancements to the FortiRecon platform, evolving it into one of the industry’s most comprehensive solutions aligned to the continuous threat exposure management (CTEM) framework. The latest release introduces expanded internal attack surface monitoring, adversary-centric dark web intelligence, and security orchestration, all in a single, unified platform. These enhancements help organizations proactively identify and prioritize real-world exposures, validate risks like an attacker would, and accelerate response, ultimately reducing the likelihood and impact of breaches.

“CISOs and security teams are overwhelmed by growing attack surfaces and an endless stream of unprioritized alerts,” said Nirav Shah, Senior Vice President of Products and Solutions at Fortinet. “With the latest enhancements to FortiRecon, we’re giving organizations an attacker’s eye view of their internal and external exposures, backed by AI-powered threat intelligence from FortiGuard Labs, real-world validation, and automated response. This allows organizations to cut through the noise, focus on what matters most, and measurably reduce risks and vulnerabilities before attackers can exploit them.”

The announcement comes amid growing demand for exposure-driven security strategies as organizations struggle to manage expanding attack surfaces, alert fatigue, and fragmented security operations. According to Gartner®, “By 2026, organizations prioritizing their security investments based on a continuous exposure management program will be three times less likely to suffer from a breach.”¹

A Unified Platform for Continuous Threat Exposure Management
FortiRecon, in combination with its strong integration to the Fortinet AI-Driven Security Operations Center (SOC) platform, now delivers capabilities across the five pillars of the Gartner CTEM framework—scoping, discovery, prioritization, validation, and mobilization—enabling organizations to operationalize these pillars within a single, tightly integrated platform and drive coordinated remediation efforts across security and IT teams. The latest enhancements include:

• Attack surface management: Continuously monitors and delivers an adversary’s view of the organization’s internal and external digital attack surface. The latest release adds National Vulnerability Database (NVD) severity ratings, in addition to FortiRecon Active Exploitation severity ratings for faster and smarter patching.
• Adversary-centric intelligence: Provides actionable threat insights from dark web activity, ransomware intelligence, leaked credentials, vulnerabilities being exploited in the wild, and at-risk vendors. Enhancements include bulk indicators of compromise (IOC) downloads and stealer infection details, accelerating SOC workflows, and improving breach detection.
• Brand protection: Monitors for domain impersonation, rogue mobile apps, phishing campaigns, and executive targeting. FortiRecon Brand Protection uses proprietary algorithms to monitor, detect, and take down fake phishing domains, brand and executive impersonations, rogue mobile applications on multiple app stores, data leaks in code repos, open bucket exposures, and phishing campaigns, and helps protect executive online presence.
• Security orchestration: Leverages security orchestration and automated playbooks to investigate and respond to security threat findings. FortiRecon Security Orchestration reduces the time needed for responders to prioritize and take appropriate actions by automating and streamlining security workflows.

Existing FortiFlex customers may use their FortiFlex credits to deploy FortiRecon Cloud. FortiFlex offers usage-based licensing with the security industry's broadest catalog for customers with dynamic hybrid and multi-cloud environments and MSSPs. When purchased through major cloud marketplaces, FortiFlex can also help customers meet cloud committed spend obligations.

Industry Recognition and Customer Results
Fortinet was recently named an Overall Leader as well as a Market Leader and Innovation Leader in the KuppingerCole Leadership Compass for Attack Surface Management 2025. The report highlights the operational readiness of FortiRecon with broad support for CIS, ICS, IoT, and OT environments, and its integrations with the broader Fortinet Security Fabric tools such as FortiGate NGFW, FortiSOAR, FortiSIEM, and FortiDAST.

Supporting Quotes
“FortiRecon has elevated the way we deliver managed security services. It enables our teams to provide clients with continuous, contextualized risk insights not just alerts. We’re now able to prioritize remediation based on business impact, helping our customers reduce risk faster while demonstrating measurable security outcomes. It’s a key differentiator in how we build long-term trust and value.”

- Paul Cragg, CTO at Norm Cyber

Additional Resources

• Learn how FortiRecon can help advance your organization’s CTEM journey.
• Visit fortinet.com/trust to learn more about Fortinet innovation, collaboration partners, product security processes, and enterprise-grade products. 
• Learn more about Fortinet's commitment to product security and integrity, including its responsible product development and vulnerability disclosure approach and policies. 
• Learn about Fortinet’s free cybersecurity training, which includes broad cyber awareness and product training. The Fortinet Training Institute also provides training and certification through the Network Security Expert (NSE) Certification, Academic Partner, and Education Outreach programs.
• Learn more about FortiGuard Labs threat intelligence and research and Outbreak Alerts, which provide timely steps to mitigate breaking cybersecurity attacks.
• Learn more about Fortinet’s FortiGuard Security Services portfolio.
• Read about how Fortinet customers are securing their organizations.
• Follow Fortinet on X, LinkedIn, Facebook, and Instagram. Subscribe to Fortinet on our blog or YouTube.

¹ Gartner. How to Manage Cybersecurity Threats, Not Episodes, by Jeremy D’Hoinne. Gartner, 11 Oct. 2023.

About Fortinet
Fortinet (Nasdaq: FTNT) is a driving force in the evolution of cybersecurity and the convergence of networking and security. Our mission is to secure people, devices, and data everywhere, and today we deliver cybersecurity everywhere our customers need it with the largest integrated portfolio of over 50 enterprise-grade products. Well over half a million customers trust Fortinet's solutions, which are among the most deployed, most patented, and most validated in the industry. The Fortinet Training Institute, one of the largest and broadest training programs in the industry, is dedicated to making cybersecurity training and new career opportunities available to everyone. Collaboration with esteemed organizations from both the public and private sectors, including Computer Emergency Response Teams (CERTS), government entities, and academia, is a fundamental aspect of Fortinet’s commitment to enhance cyber resilience globally. FortiGuard Labs, Fortinet’s elite threat intelligence and research organization, develops and utilizes leading-edge machine learning and AI technologies to provide customers with timely and consistently top-rated protection and actionable threat intelligence. Learn more at https://www.fortinet.com, the Fortinet Blog, and FortiGuard Labs.

Copyright © 2025 Fortinet, Inc. All rights reserved. The symbols ® and ™ denote respectively federally registered trademarks and common law trademarks of Fortinet, Inc., its subsidiaries and affiliates. Fortinet’s trademarks include, but are not limited to, the following: Fortinet, the Fortinet logo, FortiGate, FortiOS, FortiGuard, FortiCare, FortiAnalyzer, FortiManager, FortiASIC, FortiClient, FortiCloud, FortiCore, FortiMail, FortiSandbox, FortiADC, FortiAgent, FortiAI, FortiAIOps, FortiAntenna, FortiAP, FortiAPCam, FortiAppSec, FortiAuthenticator, FortiBranchSASE, FortiCall, FortiCam, FortiCamera, FortiCarrier, FortiCART, FortiCASB, FortiCentral, FortiCNP, FortiConnect, FortiController, FortiConverter, FortiCSPM, FortiCWP, FortiDAST, FortiDATA, FortiDB, FortiDDoS, FortiDeceptor, FortiDeploy, FortiDevice, FortiDevSec, FortiDLP, FortiEdge, FortiEDR, FortiEndpoint, FortiExplorer, FortiExtender, FortiFirewall, FortiFlex, FortiFone, FortiGSLB, FortiGuest, FortiHypervisor, FortiInsight, FortiIsolator, FortiLAN, FortiLink, FortiMonitor, FortiNAC, FortiNDR, FortiPAM, FortiPenTest, FortiPhish, FortiPoint, FortiPoints, FortiPolicy, FortiPortal, FortiPresence, FortiProxy, FortiRecon, FortiRecorder, FortiSASE, FortiScanner, FortiSDNConnector, FortiSEC, FortiSIEM, FortiSMS, FortiSOAR, FortiSRA, FortiStack, FortiSwitch, FortiTelemetry, FortiTester, FortiToken, FortiTrust, FortiVoice, FortiWAN, FortiWeb, FortiWiFi, FortiWLC, FortiWLM, FortiXDR, Lacework FortiCNAPP, Linksys, Intelligent Mesh, Velop, Max-Stream, Performance Perfected and SECURITY FABRIC. Other trademarks belong to their respective owners. Fortinet has not independently verified statements or certifications herein attributed to third parties and Fortinet does not independently endorse such statements. Notwithstanding anything to the contrary herein, nothing herein constitutes a warranty, guarantee, contract, binding specification or other binding commitment by Fortinet or any indication of intent related to a binding commitment, and performance and other specification information herein may be unique to certain environments.

Media Contact:
Fortinet, Inc.
408-235-7700
pr@fortinet.com

Investor Contact:
Fortinet, Inc.
408-235-7700
investors@fortinet.com

Analyst Contact:
Fortinet, Inc.
408-235-7700
analystrelations@fortinet.com

FAQ

What new features did Fortinet (FTNT) add to FortiRecon in August 2025?

Fortinet added expanded internal attack surface monitoring, adversary-centric dark web intelligence, and security orchestration capabilities. The platform now includes NVD severity ratings, bulk IOC downloads, enhanced brand protection, and automated security orchestration.

How does FortiRecon align with the CTEM framework?

FortiRecon aligns with the five CTEM pillars: scoping, discovery, prioritization, validation, and mobilization, delivering these capabilities in a single integrated platform to enable coordinated remediation across security and IT teams.

What recognition did Fortinet receive for FortiRecon in 2025?

Fortinet was named an Overall Leader, Market Leader, and Innovation Leader in the KuppingerCole Leadership Compass for Attack Surface Management 2025.

How can customers access FortiRecon Cloud?

Existing FortiFlex customers can use their FortiFlex credits to deploy FortiRecon Cloud, offering usage-based licensing for dynamic hybrid and multi-cloud environments and MSSPs.

What are the key components of FortiRecon's brand protection features?

FortiRecon Brand Protection monitors and takes down fake phishing domains, brand impersonations, rogue mobile apps, data leaks in code repos, open bucket exposures, and phishing campaigns, while protecting executive online presence.