BAYOUBREACHEach brief identifies an area to evaluate, recommends a Fortinet technology and explains how it could help. Hardware, virtual appliances, software and cloud services are clearly distinguished.
It is not a finding that a named organization lacked a control. Recommendations describe present-day capabilities and conditions, not a guarantee that a product would have prevented the historical event. Specific appliance models need environment and capacity information.
How recommendations are madeOpen the full assessment for its evidence, uncertainty, conditional controls and sizing questions.
Isolate affected networks while keeping essential services available
Can you isolate one department’s network while maintaining dispatch, public-safety communications and other priority services, and has that procedure been tested?
Exposure visibility and endpoint containment
Can your team demonstrate endpoint coverage and an approved isolation workflow for the computers that support public case access?
Validate credential exposure and vendor access
Can you list every outside provider with remote access, its named account, its authentication method and who can disable it?
Protect patient information outside the primary clinical application
Can you locate exported patient records and demonstrate which copying, upload and sharing routes are controlled without disrupting patient care?
Sensitive investigative records and controlled data movement
Which shared locations contain investigative records, who can export them, and can your team demonstrate controls on those transfer paths?
Credential exposure and sensitive records outside core systems
Which shared folders contain student or employee identifiers, and can your team demonstrate how unusual copying would be detected or blocked?
Protect exposed file-transfer applications
Who owns each internet-facing file-transfer service, and can they show patch status, supported blocking controls and access logs?
Clarify exposure and verify access controls
Can your team show which administrator and vendor accounts are controlled, and retain evidence of how those controls are tested?
Sensitive files and visibility into data leaving the network
Where do patient-file exports and shared copies live, and which of their transfer paths are actually monitored or controlled?
Understand exposure and protect clinical continuity
Can IT and clinical leaders demonstrate a safe containment decision that preserves essential patient-care workflows?
Validate the allegation before diagnosing a gap
What independent evidence supports the allegation, and which current systems or access paths need validation before selecting a control?
Endpoint containment during ransomware disruption
Can your team test isolation of an infected administrative device while keeping essential public-safety services operating?
Contain endpoint activity while preserving state services
Can each agency show endpoint coverage, ownership of isolation decisions and a tested path for restoring priority services?
Use these plain-language explanations to prepare a discussion with your IT team or service provider. Product capabilities were reviewed October 9, 2026.
How it works: Continuously discovers exposed assets and prioritizes vulnerabilities, while monitoring leaked credentials, ransomware activity, and other adversary intelligence so teams can remediate exposure and investigate emerging risk before or during an incident.
Deployment: Subscription exposure-management and intelligence service; not a physical network appliance.
When to consider it: When the agency needs external exposure, leaked-credential, or adversary-intelligence visibility and has an owner for remediation.
Coverage matters: Findings require investigation and remediation; exposure monitoring and ransomware intelligence do not directly block ransomware execution.
How it works: An endpoint agent analyzes malware and suspicious process behavior, can block harmful file access and outbound communications, and supports automated isolation and remediation to limit ransomware damage on protected devices.
Deployment: Software agents protect supported endpoints and servers; management components can be cloud, on-premises, or hybrid. This is not an inline hardware firewall.
When to consider it: When managed workstations and servers need endpoint detection, ransomware containment, and a tested response process.
Coverage matters: Protection depends on supported devices running the agent with suitable prevention and response policies; this does not guarantee every ransomware attack is stopped.
How it works: Inspects sensitive data and user activity through endpoint agents and supported cloud integrations, using content, origin, and behavioral context to flag risky movement and enforce controls on covered egress paths.
Deployment: Cloud-native data-protection platform using endpoint agents and supported cloud integrations; not a universal inline appliance for all server traffic.
When to consider it: When sensitive information needs controls on covered endpoint, SaaS, or cloud-drive data flows.
Coverage matters: Coverage follows deployed agents and supported integrations or egress paths; it is not universal exfiltration blocking for arbitrary servers or unseen traffic.
How it works: Centralizes authentication for integrated applications, VPNs, and administrative access, adding FortiToken factors and identity policies so a stolen password alone is less likely to provide access to protected resources.
Deployment: FortiAuthenticator is available as a physical or virtual appliance, including private/public-cloud deployment. FortiToken factors include mobile software and hardware tokens or security keys.
When to consider it: When VPN, administrator, and application access need centralized authentication and stronger sign-in verification.
Coverage matters: Phishing resistance requires an appropriate FIDO2 flow; OTP or push alone is not equivalent. Enabling MFA does not establish revocation of already stolen application sessions.
How it works: Vaults and rotates privileged credentials, brokers access under role-based policies, and records privileged sessions; administrators can restrict commands or terminate sessions to reduce credential exposure and misuse of elevated access.
Deployment: The current datasheet identifies a virtual appliance for privileged credential and session management. Do not label it a recommended physical box.
When to consider it: When shared administrator credentials, privileged vendor access, or unrecorded administrative sessions are a documented gap.
Coverage matters: Apply these controls to onboarded accounts and brokered sessions; unmanaged credentials or direct access that bypasses FortiPAM remain outside that enforcement path.
How it works: Separates network segments with firewall policies that restrict allowed communications, while IPS inspects traversing traffic for attack patterns and can block matching exploits, helping contain lateral movement between protected zones.
Deployment: Physical FortiGate appliances suit on-site network enforcement; FortiGate-VM supports private and public clouds. This classification does not select a model or claim all deployment types share identical capacity.
When to consider it: When network zones need restricted communications and inspected traffic paths, including between user, server, management, and externally accessible services.
Coverage matters: Traffic must cross the enforcement point, with restrictive policies and IPS enabled; encrypted payload inspection needs appropriate decryption and inspection configuration.
How it works: Analyzes observed network traffic to detect signs of lateral movement, command activity, and data exfiltration, providing investigation context and integrations that help security teams coordinate containment with enforcement tools.
Deployment: FortiNDR offers on-premises hardware and VM deployments; FortiNDR Cloud is SaaS with supported hardware or virtual sensors. Sensor placement determines the traffic available for analysis.
When to consider it: When network activity needs investigation beyond endpoint coverage, and staff or a service can investigate detections and execute containment.
Coverage matters: Detection depends on sensor visibility into relevant traffic; containment requires an enabled response workflow or integration with an enforcement tool.
How it works: Inspects web application requests using attack signatures and syntax-based SQL injection detection, allowing configured blocking rules to reject suspicious inputs before they reach a protected application or its database.
Deployment: FortiWeb supports hardware, VM, and container deployments. FortiAppSec Cloud is the separately named SaaS option for application security and should be labeled as such.
When to consider it: When the agency operates web applications or APIs and can place their traffic behind a maintained application-protection policy.
Coverage matters: Requires the application traffic and blocking policy to be covered. For MOVEit, this is a generic SQL injection control fit, not proof it would stop the historical exploit.
How it works: Identifies devices on the network and applies access policies through compatible network equipment. Quarantine workflows can restrict a suspicious device while the team investigates.
Deployment: The product line includes hardware appliances and virtual machines, with Control and Application Server functions and separate licensing. Enforcement depends on compatible network integrations.
When to consider it: When device inventory, onboarding, or access restriction is a documented gap across the network.
Coverage matters: Requires compatible network integrations and tested policies. Medical-device changes need clinical safety review; a hospital incident alone does not prove a device visibility gap.
Bring your service priorities, current coverage and a question. We can discuss which technology fits the need.