FortiGuard Labs and Threat Intelligence | Securevalley

July 2, 2026 · Nouh Droussi · Fortinet · Maroc · 4 min read · Updated September 26, 2026

FortiGuard Labs feeds Fortinet devices with signatures, reputation data and alerts. Here is how these services work and how to benefit from them every day.

FortiGuard Labs is Fortinet's threat research and intelligence team. It produces the updates (signatures, reputation databases, web categories) that feed Fortinet devices through subscriptions known as FortiGuard services. It also publishes alerts and security advisories that anyone can consult free of charge, and which are useful even to organizations operating beyond the Fortinet ecosystem.

What FortiGuard covers

The name refers to two things that are best kept separate:

• the laboratory, which collects data from a vast network of sensors, analyzes malware and vulnerabilities, and relies on machine learning to process these volumes;
• the security services, sold as subscriptions, which turn this work into updates that can be used by FortiGate, FortiMail, FortiWeb, FortiSandbox, FortiClient and other products.

A Fortinet device without an active subscription continues to filter traffic according to its rules, but its detection engines no longer receive new information. Since threats evolve every day, the level of protection offered by such a device quickly deteriorates.

The main security services

The services described by Fortinet include:

• intrusion prevention (IPS), which detects attempts to exploit vulnerabilities;
• antivirus, for files passing through the network or email;
• URL and DNS filtering, based on the categorization of websites and domains;
• application control, to identify and govern the applications in use;
• detection of connected devices (IoT);
• protection against botnets and command-and-control servers;
• content disarm and reconstruction (CDR), which removes active elements from documents.

These services are often grouped into bundles. When purchasing or renewing a subscription, check precisely which services are included, as the content of these bundles changes depending on the product range.

Outbreak Alerts, PSIRT advisories and encyclopedia

The public FortiGuard website offers several free resources:

• Outbreak Alerts, which describe ongoing attack campaigns, the vulnerabilities being exploited and the corresponding Fortinet protections;
• Threat Signals, short alert notes on emerging threats;
• PSIRT advisories, which document vulnerabilities affecting Fortinet products themselves, along with the fixed versions;
• the threat encyclopedia, along with several lookup tools (IP reputation, URL category, antivirus signatures).

PSIRT advisories deserve particular attention. Vulnerabilities in Fortinet products regularly appear in CISA's Known Exploited Vulnerabilities (KEV) catalog. An administrator should therefore subscribe to these advisories and have a rapid patching process in place for the devices they manage.

Cooperation and intelligence sharing

FortiGuard Labs takes part in sharing initiatives, including the Cyber Threat Alliance and MITRE Engenuity's Center for Threat-Informed Defense, of which Fortinet is a research partner. This type of cooperation improves detection coverage for all participants and contributes to the MITRE ATT&CK framework, which has become a common language used across the industry to describe attack techniques.

Putting intelligence to use every day

Having updates is not enough; you must also make sure they are actually being used. A few simple checks help with this:

• verify that devices connect properly to the update servers and that database versions are recent;
• enable security profiles (IPS, antivirus, web filtering) on the relevant policies, rather than simply purchasing the license;
• follow Outbreak Alerts to confirm, during a widely reported campaign, that the corresponding signatures are active;
• feed relevant indicators of compromise into your SIEM to search for traces of past activity.

Threat intelligence reaches its full value when it is compared against your own context: which assets are exposed, which vulnerabilities remain unpatched, which sectors are being targeted. This is the difference between receiving information and producing intelligence that supports decision-making.

Skills and training

Making the most of FortiGuard requires both technical command of the devices and a method for analyzing intelligence. The following training paths are relevant:

• FortiGate Administrator certification preparation to configure the security profiles that consume FortiGuard services;
• Certified Threat Intelligence Analyst (CTIA) to learn how to collect, analyze and disseminate threat intelligence;
• Certified SOC Analyst (CSA) to make use of indicators and alerts in a monitoring context.

Conclusion

FortiGuard Labs is the engine that keeps the detection capabilities of Fortinet products up to date, as well as a public source of alerts that is useful to any security team. To benefit from it, check your subscriptions, actually enable your security profiles and organize the follow-up of vulnerability advisories.