Full-Time

Presales Security Expert

Gsi-West

Posted on 8/23/2025

Fortinet

Fortinet

10,001+ employees

Delivers integrated cybersecurity via security fabric

Compensation Overview

$203k - $248k/yr

+ Bonus Eligibility + Equity Program

Calgary, AB, Canada + 1 more

More locations: Vancouver, BC, Canada

Remote

Category
Sales & Solution Engineering (1)
Required Skills
Sales
Salesforce
Requirements
  • Have a high aptitude for security technology, specifically encryption, authentication, with further knowledge of network security, intrusion detection, anti-virus, routing, switching, LAN and WAN being desirable
  • The CISSP accreditation would also be beneficial
  • Are currently or have previously worked in a pre-sales engineer role, managing end to end technical aspects of deals, through to technical closure
  • Can demonstrate your problem solving skills and how this has impacted key wins within your current organization
  • Understand and can demonstrate your ability to build and maintain customer relationships, including your ability to effectively communicate technically to a range of both external and internal stakeholders
  • Have a strong understanding of RADIUS, PKI, IKE, Certificates, L2TP, IPSEC, FIREWALL, 802.1Q, MD5, SSH, SSL, SHA1, DES, 3DES
  • Bachelor’s Degree or equivalent experience
  • Experience with RADIUS, PKI, IKE, Certificates, L2TP, IPSEC, FIREWALL, 802.1Q, MD5, SSH, SSL, SHA1, DES, 3DES
Responsibilities
  • Develop and execute on joint strategy with your direct sales person which is tied to your partners and Fortinet Goals
  • Have the ability to listen and to understand the technical requirements of the partner, reading between the lines to build a solution which outperforms the competitor offering
  • Be the primary technical point of contact for your partners(s) in close collaboration with your sales partner
  • Collectively work with Fortinet’s teams (account sales/ technical, marketing, specialization overlays) + your partners teams (sales/ technical/ professional services, managed services, etc) to develop “go to market” offerings to address Fortinet and our partners goals
  • Continuously strive to improve knowledge around the Fortinet products and solutions, along with maintaining a deep understanding of the competitive landscape and Fortinet’s ability to provide long lasting protection against the ever-evolving threats
  • Have a strong ability to position Fortinet solutions to the partner, whether this be remotely or in person. This requires strong communication skills and the ability to confidently present through whiteboarding, technical white papers, technical plans, or customer discussions
  • Manage your time effectively when working on multiple deals simultaneously, ensuring a positive customer experience is maintained
  • Maintain accurate activity, contact, and account technical information of all customers and prospects in our CRM (Salesforce)
Desired Qualifications
  • CISSP accreditation would be beneficial
  • Experience in specialized areas such as public or private cloud
  • Experience in building managed service offerings

Fortinet provides cybersecurity solutions for organizations with an emphasis on integrated security. Its core platform, the Fortinet Security Fabric, ties together firewalls, endpoint protection, intrusion detection, and secure SD-WAN so they share threat intelligence and security policies. The products work by coordinating across networks, endpoints, cloud, and applications through common management and subscription-based services. Fortinet differentiates itself with a broad, interoperable stack that enables centralized policy and visibility across on-premises, remote, and cloud environments, helping customers protect digital assets from a wide range of threats.

Company Size

10,001+

Company Stage

IPO

Headquarters

Sunnyvale, California

Founded

2000

Simplify Jobs

Simplify's Take

What believers are saying

  • Product revenue surges 41% from AI data center upgrades and FortiGate 3500G demand.
  • Q1 2026 billings grow 31% with OT security exceeding 70% and $1B free cash flow.
  • Full-year revenue guidance rises to $7.71B-$7.87B on Secure Networking convergence.

What critics are saying

  • Palo Alto's Wiz acquisition and CrowdStrike erode Lacework CNAPP market share within 18 months.
  • AI infrastructure normalization craters 41% product growth, collapsing valuation in 12 months.
  • FortiOS 8.0 AI agent compromise cascades failures across Security Fabric in 12 months.

What makes Fortinet unique

  • Fortinet Security Fabric integrates firewalls, endpoints, and cloud into unified architecture.
  • FortiOS 8.0 deploys agentic AI agents with Model Context Protocol across Fabric.
  • FortiAIGate with NVIDIA secures AI workloads using zero-trust guardrails in real-time.

Help us improve and share your feedback! Did you find this helpful?

Benefits

Health Insurance

Dental Insurance

Vision Insurance

Life Insurance

Disability Insurance

Health Savings Account/Flexible Spending Account

Unlimited Paid Time Off

Paid Vacation

Paid Sick Leave

Paid Holidays

Hybrid Work Options

401(k) Company Match

Wellness Program

Mental Health Support

Employee & Family Assistance Plan

Company Equity

Growth & Insights and Company News

Headcount

6 month growth

0%

1 year growth

1%

2 year growth

0%
IT Networks Services
Apr 29th, 2026
Fortinet in 2026: what the latest FortiOS 8.0 updates mean for your network.

Fortinet in 2026: what the latest FortiOS 8.0 updates mean for your network. The cybersecurity landscape of 2026 is no longer just about blocking known viruses; it is a battle of machine-speed intelligence. At the recent Fortinet Accelerate 2026 conference, the unveiling of FortiOS 8.0 marked a pivotal shift in how enterprise networks are defended. If you are managing an IT network, the "business as usual" approach to firewall management is officially over. Here is a deep dive into what the latest Fortinet updates mean for your infrastructure and how to leverage them for maximum security. 1. The rise of "agentic" AI in secops. For years, AI in networking was limited to basic chatbots or pattern recognition. FortiOS 8.0 introduces Fabric-Based AI Agents that move beyond simple automation into "agentic" workflows. * Conversational Troubleshooting: You can now interact with your FortiGate using natural language to diagnose complex SD-WAN routing issues or firewall policy conflicts. * Automated Triage: These agents don't just alert you; they perform the initial investigation, verifying if an alert is a true positive before it even hits your dashboard. * Model Context Protocol (MCP): This allows AI agents to maintain "memory" across your entire Security Fabric. If an attacker pivots from a remote branch to your data center, the AI follows the trail in real-time. 2. Securing the "shadow AI" Attack surface. With over 98% of Generative AI (GenAI) apps initially entering enterprises unsanctioned, Fortinet has introduced FortiView for AI. This provides deep visibility into which AI tools your employees are using. * AI-Aware Controls: You can now allow productivity-boosting tools like ChatGPT while blocking specific "risky" actions - such as uploading sensitive source code or customer data. * Deep DLP with OCR: One of the most significant updates is the integration of Optical Character Recognition (OCR) into Data Loss Prevention. It can now detect sensitive information hidden in screenshots or images, closing a massive loophole for data exfiltration. 3. Next-Generation SASE and sovereignty. As global regulations tighten, FortiOS 8.0 introduces SASE Outpost and Sovereign SASE options. This is a game-changer for industries like finance, healthcare, and government. * Local Enforcement: SASE Outpost allows you to deploy a SASE Point of Presence (POP) within your own private data center while maintaining centralized cloud management. * Data Residency: Sovereign SASE provides granular control over where your logs are stored and where your control plane resides, ensuring compliance with regional data laws. 4. Preparing for the "Post-Quantum" Future. Threat actors are already practicing "Harvest Now, Decrypt Later." Fortinet is staying ahead with Quantum-Safe Protection. * PQC Certificates: FortiOS 8.0 uses Post-Quantum Cryptography (PQC) for management paths and agentless VPNs. * Hybrid Key Exchange: By combining traditional encryption with quantum-resilient algorithms, Fortinet ensures that your encrypted traffic remains unreadable even by future quantum computers. SEO checklist: why you should upgrade in 2026. If you are running older versions of FortiOS, you are likely facing increased targeting from AI-automated offensive tools. To optimize your network for 2026, consider these three steps: * Enable AI-Aware Application Control: Prevent data leaks via unsanctioned GenAI. * Audit Your Perimeter: AI-driven bots are now scaling vulnerability scans at machine speed; ensure your FortiGate is patched to the latest 8.0 firmware. * Leverage the Security Fabric: Move away from point products. The strength of FortiOS 8.0 lies in its ability to synchronize security across switches, access points, and firewalls. Final thoughts. Fortinet's 2026 strategy is clear: Intelligence by Design. By integrating AI natively into a single operating system rather than bolting it on through acquisitions, FortiOS 8.0 offers a unified, scalable foundation that anticipates risks before they manifest.

Cybersecurity Threat AI
Apr 17th, 2026
Edge Device Exploitation: Risks, Attacks and Detection

Edge Device Exploitation: risks, attacks and detection. The recent wave of Edge Device Exploitation attacks targeting edge infrastructure from vendors like Ivanti, Fortinet, and Palo Alto Networks highlights a critical shift in how attackers gain access to enterprise environments. Instead of going after endpoints or users first, attackers are focusing on the systems that sit at the front door of the network. These devices are designed to provide secure remote access and enforce security policies. When they are compromised, they offer attackers a direct and often invisible path into the internal network. What is happening. Security teams across industries are observing large scale exploitation of vulnerabilities in VPN appliances, firewalls, and remote access gateways. These systems are typically exposed to the internet, making them highly attractive targets. Attackers scan for vulnerable devices, identify unpatched systems, and then attempt to gain access. In many cases, the exploitation process does not require user interaction. Once access is established, attackers deploy persistence mechanisms that allow them to return even after initial remediation attempts. Because these devices operate at the network boundary, activity originating from them is often trusted. This makes detection significantly more difficult. Why edge devices are a prime target. Edge infrastructure plays a unique role in enterprise security. It acts as both a gatekeeper and a bridge between external users and internal systems. If that gatekeeper is compromised, the entire trust model breaks down. There are several reasons why attackers prioritize these systems. They are always exposed to the internet. They often run complex software that may contain vulnerabilities. Many organizations delay patching due to operational concerns. And once compromised, these devices provide broad visibility into network traffic and authentication flows. In many incidents, attackers use edge devices not just for initial access but also for maintaining long term presence inside the network. How attackers operate. The attack process typically begins with automated scanning. Attackers look for known vulnerabilities in specific device versions. When a vulnerable system is identified, they attempt to exploit it to gain access. After initial access, the focus shifts to persistence. Attackers may modify system components or deploy hidden access methods that survive reboots and updates. From there, they move deeper into the network by harvesting credentials and mapping internal systems. Because the entry point is a trusted device, lateral movement can happen with minimal resistance. This allows attackers to escalate privileges and access sensitive data without triggering immediate alerts. Impact on organizations. The consequences of edge device compromise can be severe. Attackers can bypass traditional security controls and operate within the network as if they were legitimate users. This often leads to data theft, ransomware deployment, or long term espionage. In some cases, organizations discover the breach only after significant damage has already occurred. Another challenge is remediation. Even after patching the vulnerability, persistence mechanisms may remain. This means the attacker can regain access unless the device is thoroughly investigated and rebuilt. Detection and defense strategies. Defending against this type of attack requires a combination of strong hygiene and advanced monitoring. Patching edge devices promptly is critical, even if it requires operational planning. Organizations should also limit exposure by restricting access to these systems wherever possible. Monitoring should focus not just on whether a login is successful, but on whether the behavior associated with that login is normal. Unusual patterns such as unexpected configuration changes, abnormal authentication flows, or sudden spikes in internal traffic should be investigated immediately. It is also important to treat edge devices as high risk assets. Logs from these systems should be integrated into centralized monitoring platforms to enable better visibility. How Gurucul helps detect and stop these attacks. This is where Gurucul provides strong value. Traditional security tools often struggle with edge device attacks because they rely on known signatures or predefined rules. Gurucul takes a different approach by focusing on behavior and identity. Gurucul analyzes patterns across users, devices, and systems. If an edge device begins behaving differently, such as initiating unusual connections or accessing unexpected resources, it is flagged immediately. When attackers move from a compromised edge device into user accounts, Gurucul tracks those identity activities. It assigns risk scores based on behavior, helping security teams quickly identify compromised accounts. Network and lateral movement visibility. Gurucul provides visibility into how attackers move within the network. It detects abnormal communication patterns and privilege escalation attempts that often follow edge compromise. Automated response. The platform can trigger automated actions when suspicious behavior is detected. This helps contain threats before they spread further into the environment. Final thoughts. The exploitation of edge devices is not a temporary trend. It is becoming a preferred method for gaining access to enterprise networks. These systems sit in a position of trust, and once that trust is broken, the impact can be far reaching. Organizations need to move beyond basic patching and start focusing on continuous monitoring and behavioral analysis. Security today is not just about blocking access. It is about understanding what happens after access is granted.

RS Web Solutions
Apr 10th, 2026
Trend Micro Inc shares: the importance of cybersecurity resilience for investors today.

Trend Micro Inc shares: the importance of cybersecurity resilience for investors today. Table of Contents Amid the escalating landscape of cyber threats, Trend Micro Inc emerges as a formidable entity, providing robust defenses for both enterprises and individual users. Whether your investments target markets in the United States, Europe, or beyond, comprehending its role within the burgeoning cybersecurity sector can significantly influence your investment strategy. ISIN: JP3180400008 You may be contemplating whether Trend Micro Inc's stock warrants inclusion in your portfolio at this juncture. As cyber threats proliferate at an unprecedented pace, this Japanese cybersecurity titan offers solutions that safeguard everything from cloud infrastructures to endpoint devices, making it particularly attractive for investors focused on defensive technology. Its expansive reach and commitment to securing hybrid work environments position it favorably in an era of digital transformation. Understanding Trend Micro's significance. For the latest insights on Trend Micro Inc, visit the company's official website. Trend Micro Inc specializes in pioneering advanced threat protection solutions essential for securing networks, endpoints, and cloud systems. In an era where ransomware and data breaches dominate headlines, their platform provides real-time detection and response, serving enterprises, governments, and consumers across over 100 countries. This extensive applicability ensures a consistent demand regardless of your investment origin. What differentiates them is their commitment to AI-powered analytics, which anticipate attacks before they materialize. For investors, this signifies enduring resilience within a volatile tech landscape. Their solutions blend effortlessly with hybrid cloud architectures, an imperative as businesses continue to adopt remote and flexible work methodologies in a post-pandemic world. Globally, spending on cybersecurity is on an upward trajectory, with enterprises placing a premium on protection over growth amid economic uncertainty. Trend Micro's collaborations with major cloud service providers illustrate its relevance, ensuring its technology scales in tandem with your preferred hyperscalers. This positions the stock as a prudent defensive investment with potential for growth. Navigating a competitive landscape. In the crowded cybersecurity market, Trend Micro faces competition from industry giants like Palo Alto Networks, CrowdStrike, and Fortinet; however, it carves out a unique niche with its holistic, multi-layered security offerings. Their more than 30 years of experience contribute to a deep reservoir of threat intelligence spanning mobile, email, and web security, essential for retaining customers requiring all-encompassing solutions. For instance, their Apex One platform integrates endpoint protection with expanded detection and response, appealing to the mid-sized enterprises you may follow in your investment pursuits. Unlike companies that focus exclusively on endpoint security, Trend Micro's hybrid approach accommodates varied IT environments, from on-premises infrastructures to zero-trust frameworks. This flexibility appeals to global investors, addressing diverse regulatory landscapes. Holding a significant market share within the Asia-Pacific region gives Trend Micro an advantage as digital adoption increases without the market saturation seen in the US. Notably, their utilization of regional data centers for low-latency protection is a compelling factor in securing enterprise contracts, serving as a buffer against potential slowdowns in the US market. Financial viability and catalysts for growth. Trend Micro generates revenue primarily through subscription services, resulting in predictable cash flows that investors value in the technology sector. With over 90% of revenue derived from recurring sources in recent years, the company sustains margins despite ramping up R&D for AI capabilities. This model resembles that of software-as-a-service leaders, providing stability in fluctuating economic climates. Key growth drivers include increasing demand for cloud security as organizations migrate workloads to the cloud. The Vision One platform, which correlates threats across multiple environments for proactive safeguarding, is anticipated to make significant contributions. Collaborations with AWS, Azure, and Google Cloud further enhance this, directing leads from your preferred cloud ecosystems. For investors in the US and Europe, the stock's listing on the Tokyo Stock Exchange under ticker 4704 grants exposure to yen-denominated assets, effectively managing currency risk. Additionally, their track record of dividend payments, characterized by steady increases, provides an added incentive for patient investors. Tracking enterprise adoption in regulated industries, such as finance and healthcare, will offer insights into billing performance. Broker assessments of Trend Micro stock. Analysts from prestigious firms closely monitor Trend Micro, often accentuating its defensive attributes in uncertain markets. Research reports typically highlight the company's robust balance sheet and alignment with long-term cybersecurity trends, suggesting its resilience relative to broader tech performance during downturns. Insights from major financial institutions underscore consistent execution in cloud transitions as a favorable aspect. The prevailing sentiment leans toward holding or moderate buy recommendations from institutions monitoring the Tokyo tech sector, appreciating the robustness of the subscription model. Recent industry discussions spotlight opportunities in managed detection services, where Trend Micro aims to bolster margins through professional offerings. For international portfolios, analysts note the stock's perceived undervaluation compared to US counterparts based on forward multiples. While price targets may fluctuate, the consensus acknowledges Trend Micro's substantial investment in R&D, accounting for 15-20% of revenue, propelling innovation without compromising shareholder value. Financial entities evaluating the Asian tech landscape view it as a consistent growth entity, particularly as the prevalence of state-sponsored threats drives demand. Continuous review of the latest reports is advisable for a well-rounded investment thesis. Potential risks and future monitor points. No investment is devoid of challenges; for Trend Micro, the intense rivalry poses risks to pricing structures and market share. Investors should remain vigilant about potential encroachment by newer players on its endpoint dominance, especially within small to medium-sized business segments. Economic factors, such as delayed IT budgets during recessions, may impede growth; nevertheless, the essential nature of cybersecurity offers an inherent safeguard. Geopolitical tensions in Asia could potentially disrupt supply chains or regional revenue streams; thus, European investors should exercise caution. Additionally, evolving regulations around data privacy - such as prospective expansions to GDPR or amendments to Japanese law - may incur increased compliance expenditures. Monitoring quarterly billings will provide critical insights regarding potential subscription attrition. So, what should you focus on next? Earnings announcements that reveal advancements in cloud revenue, noteworthy contract acquisitions, or merger and acquisition activities are pivotal. Additionally, reviewing threat landscape reports published by Trend Micro itself can illuminate market needs. For US investors, fluctuations in the yen against the dollar could impact returns; employing currency-hedged ETFs may mitigate concerns. For further developments, reports, and contextual insights on this stock, you can quickly explore the linked overview pages. Investment implications: is now the time to buy? Ultimately, the decision to invest in Trend Micro's stock hinges on your risk appetite and portfolio requirements. If your objective is to gain exposure to technology with reduced volatility, its cybersecurity focus is compelling - the provision of essential services often proves more resilient than discretionary software in turbulent times. Global investors benefit from the diversified revenue streams, less tethered to any singular economy. When comparing with US-listed competitors, Trend Micro is available at attractive valuations, potentially affording superior entry points. A strategic allocation of 2-5% might be prudent for constructing a defensive technology segment, complemented by growth-oriented investments. Reassessing your position after earnings releases will help confirm market momentum. Staying informed is crucial - cyber threats are relentless, ensuring sustained long-term necessity. This stock aligns well with wealth accumulation strategies that emphasize compounding through dividends and stock buybacks. Delve into their investor relations site for filings that refine your comprehension.

Miami Dade College
Apr 7th, 2026
Miami Dade College to host Cybersecurity Hackathon on April 10.

Miami Dade College to host Cybersecurity Hackathon on April 10. Event will connect students with industry leaders to tackle real-world cyber threats Miami, Fla. (April 7, 2026) - As cybersecurity threats continue to rise and demand for skilled professionals reaches record levels, Miami Dade College (MDC) has partnered with Fortinet, Inc to host a Cybersecurity Hackathon on Friday, April 10, from 8:30 a.m. to 1:30 p.m., bringing together students, industry partners and South Florida's tech community to engage in real-world cybersecurity challenges and develop innovative solutions to today's most pressing digital security issues. The event will be held at MDC's North Campus and is free and open to all students, but pre-registration is required. Working media is welcome. "Activities such as this one are a great way to expose individuals to the reality that cybersecurity is not a product but a process. At present, cybercrime is the greatest threat to any organization in the world," said Mauricio Ardila, Major Account Manager at Fortinet. According to industry reports, the global cybersecurity workforce gap exceeds 3.5 million unfilled positions, underscoring the urgent need for hands-on training and talent development. MDC's hackathon aims to help bridge that gap by providing students with immersive, experiential learning opportunities that mirror the fast-paced environments of today's cybersecurity field. During the event, students will collaborate in teams, guided by industry mentors, to address simulated cybersecurity scenarios - from threat detection to risk mitigation - while competing for prizes and recognition. The hackathon will also feature a panel discussion with Clifford Payne, vice president of engineering at Tesys Networks, and Mario Diez, chief information officer for the city of Sweetwater. "This event is about more than competition - it's about preparing the next generation of cybersecurity professionals," said Manuel Perez, dean of MDC's School of Engineering Technology and Design (EnTec). "By working alongside industry experts and tackling real-world challenges, our students gain the skills and confidence needed to succeed in one of today's most critical and fastest-growing fields." Event highlights include: * A student-focused cybersecurity hackathon featuring hands-on, real-world challenges * Collaboration with industry partners and experienced mentors * Opportunities for students to showcase their skills and compete for prizes * Direct engagement with Miami's rapidly growing tech ecosystem * Panel discussion with industry experts The Cybersecurity Hackathon is part of MDC's broader commitment to expanding experiential learning and strengthening the pipeline of tech talent in South Florida. As Miami continues to position itself as an emerging technology hub, initiatives like this play a key role in aligning education with workforce needs. Visit https://www.mdc.edu/entec/ for more information about all programs from the School of Engineering Technology and Design. WHAT: Miami Dade College Cybersecurity Hackathon WHEN: Friday, April 10, 8:30 a.m. to 1:30 p.m. / Register at: https://luma.com/piiv5rhi WHERE: MDC North Campus, 11380 NW 27th Ave., Room 3249

SOCRadar
Apr 6th, 2026
CVE-2026-35616: FortiClient EMS API auth bypass enables command execution.

CVE-2026-35616: FortiClient EMS API auth bypass enables command execution. Fortinet disclosed a critical vulnerability in Fortinet FortiClient EMS (Enterprise Management Server) tracked as CVE-2026-35616. Fortinet also says it has observed in-the-wild exploitation and released out-of-band hotfix guidance for affected builds. This post breaks down what CVE-2026-35616 is, who is affected, and what defenders should do now. What is CVE-2026-35616? CVE-2026-35616 is a CWE-284 Improper Access Control vulnerability in the FortiClient EMS API. Fortinet describes it as an API authentication and authorization bypass, meaning certain requests can reach protected functionality without a valid login or without passing expected authorization checks. The assigned CVSS v3 score is 9.1 (Critical). The main drivers are no authentication required and the possibility of unauthorized code/command execution. Which FortiClient EMS versions are affected? Fortinet's advisory lists the affected versions as: * FortiClientEMS 7.4.5 * FortiClientEMS 7.4.6 Fortinet also notes that FortiClientEMS 7.2 is not affected (per the advisory's affected version table). If you are on the 7.4 branch, treat 7.4.5 to 7.4.6 as the immediate triage target. How does this API authentication bypass turn into real impact? Fortinet's summary is brief but high impact: an unauthenticated attacker may be able to bypass API authentication/authorization and execute unauthorized code or commands via crafted requests. Fortinet also lists the impact as escalation of privilege. From a defender's perspective, the risk is not limited to "someone can call an API." FortiClient EMS is a centralized management system, so unauthorized access inside EMS can carry a large blast radius. Even without public details on the exact endpoints, assume a successful bypass could allow an attacker to: * Interact with EMS management functions without a valid session * Escalate privileges within EMS workflows (as characterized in third-party reporting) * Execute commands or code in the EMS context if the reachable functionality supports it Because exploitation is described as unauthenticated, internet exposure is the key multiplier. An EMS instance reachable from untrusted networks is easier to find via scanning and easier to target at scale. Is CVE-2026-35616 being exploited in the wild? Fortinet's advisory text says it has observed exploitation in the wild and urges customers to install the hotfix. That should drive prioritization. The vendor's decision to publish out-of-band hotfix guidance matches an urgent, real-world risk. Separate third-party reporting also pointed to early exploitation signals observed in late March 2026, including honeypot activity. How broad is exposure right now? Shadowserver identified roughly 2,000FortiClient EMS instances reachable worldwide, with the United States and Germany accounting for the largest visible share. That matters even more because attackers have been exploiting not only CVE-2026-35616, but also CVE-2026-21643, an earlier critical FortiClient EMS flaw. CVE-2026-21643 is a pre-auth SQL injection issue in the administrative interface that can let a remote attacker execute unauthorized code or commands through crafted HTTP requests, and Fortinet's advisory lists 7.4.4 as the affected release, with 7.4.5 or later as the fix. What is the timeline defenders should know? Key dates that matter for patch urgency and incident review: * March 31, 2026: exploitation attempts reportedly observed against honeypots. * April 4, 2026: Fortinet published PSIRT advisory FG-IR-26-099. * April 5, 2026: broader public coverage highlighted the out-of-band hotfix and exploitation concerns. If you run EMS 7.4.5 or 7.4.6, do two things in parallel: apply the hotfix and review recent logs and admin actions dating back at least to late March. Strengthen external threat visibility with socradar XTI. SOCRadar helps your organization track risk from both the threat and exposure side. With Cyber Threat Intelligence, teams can monitor emerging vulnerabilities, attacker activity, and exploit chatter that may raise the urgency of a flaw. With Attack Surface Management, you can identify internet-facing assets, spot exposed systems, and reduce unnecessary visibility before attackers abuse it. Used together, they help security teams move faster from detection to action. What should defenders do now? Prioritize hotfix installation for 7.4.5 and 7.4.6 Fortinet's guidance is direct: if you are running FortiClient EMS 7.4.5 or 7.4.6, install the hotfix using Fortinet's documented hotfix installation process. Fortinet indicates a permanent fix is expected in FortiClientEMS 7.4.7, but the hotfix is the immediate step intended to block exploitation. Reduce exposure while you patch Fortinet does not describe a separate workaround in the advisory content summarized here, so focus on exposure reduction you can enforce operationally: * Remove or restrict internet access to EMS management interfaces and APIs where possible. * Limit inbound access to known admin networks (VPN, jump hosts, allowlists) and enforce segmentation around EMS. * Confirm you are not unintentionally publishing EMS through reverse proxies or cloud security groups. Treat suspicious behavior as a compromise lead, not just a scan Even without published IOCs in the materials provided, you can still hunt for patterns consistent with an API auth bypass attempt: * Unusual spikes in API requests or atypical user-agent patterns targeting EMS * Requests that appear to hit administrative functions without a normal authentication flow * Unexpected configuration changes, new accounts, or altered access controls in EMS Plan validation after patching After applying the hotfix or upgrading when available, validate that: * The EMS instance is no longer externally reachable except through intended admin paths * Administrative accounts and roles match expected baselines * No unexplained scheduled tasks, integrations, or agent deployment changes occurred during the exposure window

INACTIVE