FortiAI once referred to an appliance, now renamed FortiNDR. In 2026, it is the generative and agentic AI built into the entire Security Fabric.
The meaning of the name FortiAI has changed over the years. It originally referred to a threat detection appliance, which has since been renamed FortiNDR. Today, FortiAI is the name of the family of artificial intelligence features, both generative and agentic, that Fortinet builds into its entire Security Fabric. This article clarifies what the term covers in 2026 and what it changes in practice for network and security teams.
In its early versions, FortiAI was a dedicated product: an appliance (physical or virtual) that analysed files and network traffic with machine learning models to identify malware and suspicious behaviour. The FortiOS documentation states that this product was renamed FortiNDR, for Network Detection and Response. The change appears in the FortiOS 7.0.8 and 7.2.0 new features notes, and the FortiSIEM integration guides refer to it as "FortiNDR (formerly FortiAI)".
If you come across the old name in an older configuration or document, it therefore refers to what is now called FortiNDR. The FortiAI name was subsequently reused to designate the AI built into the whole product range.
In April 2025, Fortinet organised its AI offering into three pillars:
This structure separates three different questions: AI that helps the analyst, AI that protects the user and the network, and the security of the organisation's own AI projects.
FortiAI-Assist is built into several operations products, including FortiAnalyzer, FortiManager, FortiSIEM, FortiSOAR and FortiNDR Cloud. The idea is the same everywhere: the administrator or analyst asks a question in natural language, and the assistant helps them find events, summarise an incident, propose a query or suggest an action. The so-called agentic capabilities go further: the assistant can chain several steps of a task, within the limits set by the administrators.
In July 2026, Fortinet extended FortiAI-Assist to its FortiEndpoint platform, with visibility into the AI applications used on endpoints, native data loss prevention for exchanges with these tools, and assistance in investigating at-risk endpoints.
FortiNDR remains a separate product, dedicated to network detection and response. It is available on-premises (appliances and virtual machines, particularly suited to OT or air-gapped environments) and as a SaaS version, FortiNDR Cloud, with physical or virtual sensors. It analyses traffic to identify lateral movement, data exfiltration or privilege escalation, without any agent on endpoints.
The link with FortiAI is twofold: historical, since FortiNDR is the former FortiAI, and functional, since FortiNDR now benefits from FortiAI-Assist to carry out threat hunting in natural language.
These assistants speed up work, but they do not remove the need to understand what they produce. A few precautions are necessary:
FortiAI-Assist features are mainly used in analysis and monitoring tools. The FortiAnalyzer Analyst certification preparation covers working with logs and incidents in FortiAnalyzer, and FortiAnalyzer Administrator covers its deployment and administration. For vendor-neutral analysis methods, Certified SOC Analyst (CSA) prepares for day-to-day work in a security operations centre.
In 2026, talking about FortiAI means talking about the AI built into the entire Fortinet range, organised into Assist, Protect and SecureAI. The former FortiAI appliance is called FortiNDR and remains the vendor's network detection solution. For teams, the goal is not to delegate analysis to AI, but to use it to save time while keeping control over decisions.