Fortinet Endpoint-IoT Solution
Monitor, control, and protect the expanding digital attack surface.Watch Now
Endpoints are frequently the target of initial compromise or attacks. One recent study found that 30% of breaches involved malware being installed on endpoints. FortiClient strengthens endpoint security through integrated visibility, control, and proactive defense. With the ability to discover, monitor, and assess endpoint risks, you can ensure endpoint compliance, mitigate risks, and reduce exposure. FortiClient proactively defends against advanced attacks. Its tight integration with the Security Fabric enables policy-based automation to contain threats and control outbreaks. FortiClient is compatible with Fabric-Ready partners to further strengthen enterprises’ security posture.
Broad endpoint visibility
Endpoint compliance and vulnerability management
Proactive endpoint defense
Automated threat containment
Secure remote access
Easy to deploy and manage
FortiClient contains the following key modules: Fabric Agent for Security Fabric connectivity, the endpoint security modules, and the secure remote access modules. FortiClient integrates with many key components of the Fortinet Security Fabric and is centrally managed by the Enterprise Management Server (EMS).
Endpoint telemetry for visibility
FortiClient shares endpoint telemetry with the Security Fabric to ensure unified endpoint awareness and deliver integrated endpoint and network security. Endpoint information shared includes device information, OS, security status, vulnerabilities, events, and user ID.
Dynamic access control for compliance enforcement
EMS creates virtual groups based on endpoint security posture. These virtual groups are then retrieved by FortiGate and used in firewall policy for dynamic access control. Dynamic groups help automate and simplify compliance for security policies.
Automates policy-based response when triggered by security events. For example, automatically quarantine a suspicious or compromised endpoint to contain incidents and prevent outbreaks.
Vulnerability scanning and patching
Ensures endpoint hygiene and hardens endpoints to reduce the attack surface. Identifies vulnerable endpoints and prioritizes unpatched OS and software vulnerabilities with flexible patching options including auto-patching.
Provides visibility of installed software. In addition to managing licenses, software inventory can improve security hygiene. When software installed is not required for business purposes, it unnecessarily introduces potential vulnerabilities, and thereby increases the likelihood of compromise.
Administrators can leverage inventory information to detect and remove unnecessary or outdated applications that are potentially vulnerable to reduce the attack surface.
Anti-malware leverages FortiGuard Content Pattern Recognition Language (CPRL), machine learning, and AI to protect endpoint against malware. The pattern-based CPRL is highly effective in detecting and blocking polymorphic malware. It also blocks attack channels and malicious websites.
Protects against advanced threats exploiting zero-day and unpatched vulnerabilities. This signature-less and behavioral-based technology detects and blocks memory violation techniques. It shields web browsers, java/flash plug-ins, office applications, PDF readers, load library, and script interpreters from exploit-based attacks.
Powered by FortiGuard research, the web filtering function monitors all web browser activities to enforce web security and acceptable usage policy with 75+ categories. It works across all supported operating systems and works with Google SafeSearch. The endpoint web filtering profile can be synchronized from FortiGate for consistent policy enforcement. Admins can set black/white lists, on-/off-net policies, and import FortiGate web filtering policies for consistent enforcement.
FortiClient now supports a web filter plugin that improves detection and enforcement of web filter rules on HTTPS sites with encrypted traffic.
Provides the ability to monitor, allow, or block application traffic by categories. It uses the same categories as FortiGate, enabling consistent application traffic control. It leverages FortiGuard anti-botnet, IPS, and application control intelligence and can prevent the use of unwanted applications including proxy apps and HTTPS messaging apps.
FortiClient natively integrates with FortiSandbox. FortiClient automatically submits files to the connected FortiSandbox for real-time analysis. Sandbox analysis results are automatically synchronized with EMS. Administrators can see detailed information and behavior activities of submitted objects including graphic visualization of the full process tree.
FortiSandbox Cloud support
FortiClient now offers a license that includes a FortiSandbox Cloud subscription. Licensed endpoints running FortiClient 6.2.0 can now use the FortiSandbox Cloud service for deep inspection of zero-day threats.
Cloud-based threat detection
Protects against emerging threats with real-time threat intelligence powered by FortiGuard.
Schools continues to enhance their technologies in the curriculum and the adoption of personal devices such as Chromebook are increasingly commonplace. Schools are required to be in compliance with Children’s Internet Protection Act (CIPA) and protect students from harmful content while browsing the Internet.
Consistent web filtering policy enforcement on- and off- campus
Powered by FortiGuard research, the web filtering function monitors all web browser activities to enforce web security and acceptable usage policy with 75+ categories and supports Google SafeSearch:
Easy to deploy, simple to use
Flexible detailed logging and reporting
Check the solution brief.
FortiClient leverages the Security Fabric Architecture and integrates with many Security Fabric components:
FortiClient natively integrates with FortiSandbox. FortiClient automatically submits files to the sandbox for real-time analysis. Real-time threat intelligence from FortiSandbox is instantly shared across the enterprise.
FortiClient offers an optional FortiSandbox Cloud subscription. Licensed endpoints running FortiClient 6.2.0 can now use the FortiSandbox Cloud service for deep inspection of zero-day threats.
FortiClient shares endpoint telemetry with FortiGate enterprise firewalls to enforce endpoint security compliance. FortiClient telemetry also contributes to the security rating. The diverse VPN client provides secure remote access.
FortiClient web filtering policy can be automatically synchronized with the FortiGate Web Filter profile
FortiGate EMS connector
EMS shares endpoint groups with FortiGate via the EMS connector. EMS dynamically updates these endpoint groups when host compliance or other events happen. Users can combine the endpoint groups with FortiGate firewall policies to provide dynamic access control based on endpoint status.
In addition to endpoint telemetry, FortiClient sends logs including traffic, vulnerability, software inventory, and events for the network operation center (NOC) and security operation center (SOC) for threat analysis and forensic investigation.
Enables secure sign-on (SSO) and two-factor authentication.
FortiClient uses SSL and IPsec VPN to provide secure and reliable access to the corporate network. Two-factor authentication can also be leveraged for additional security. Features such as always-on, auto-connect, dynamic VPN gateway selection and split-tunneling, result in optimized user experience and security.
It integrates with FortiAuthenticator identity and access management service to provide single sign-on.
EMS provides central management of Windows, Mac, Linux, iOS, Android, and Chromebook devices.
Features include remote endpoint deployment, client provisioning, Windows AD integration, real-time endpoint status, vulnerability dashboard, software inventory, quarantine management, alerts, and more.
Windows AD integration helps sync organizations’ AD structure into EMS so same OUs can be used for endpoint management. Realtime Endpoint Status always provides current information on endpoint activity & security events.
Centralized FortiClient deployment and provisioning that allows administrators to remotely deploy endpoint software and perform controlled upgrades. Makes deploying FortiClient configuration to thousands of clients an effortless task with a click of a button.
Vulnerability dashboard helps manage organizations attack surface. All vulnerable endpoints are easily identified for administrative action.
Sandbox detection results are automatically synchronized with EMS and detailed analysis of FortiClient submitted files for behavior-based detection is accessible in EMS. Administrators can see analysis details and behavior activities of a file including graphic visualization of full process tree.
Dynamic endpoint grouping and EMS connector (endpoint compliance)
As part of the Security Fabric, users can now configure categorization rules on EMS to dynamically group/tag FortiClient Fabric Agent endpoints. These endpoint groups are automatically shared with FortiGate. EMS dynamically updates these endpoint groups based on the real-time endpoint status, event, and security posture.
|Windows||MAC OS X||Linux||Android||iOS||Chromebook|
|Endpoint telemetry - visibility||✔||✔||✔||✔||✔||✔|
FortiGuard Antivirus protects against the latest viruses, spyware, and other content-level threats. It uses industry-leading advanced detection engines to prevent both new and evolving threats from gaining a foothold inside your network and accessing its invaluable content.
The FortiGuard IP Reputation Service aggregates malicious source IP data from the Fortinet distributed network of threat sensors, CERTs, MITRE, cooperative competitors, and other global sources that collaborate to provide up-to-date threat intelligence about hostile sources. Near real-time intelligence from distributed network gateways combined with world-class research from FortiGuard Labs helps organizations stay safer and proactively block attacks.
Improve security and meet compliance with easy enforcement of your acceptable use policy through unmatched, real-time visibility into the applications your users are running. With FortiGuard Application Control, you can quickly create policies to allow, deny, or restrict access to applications or entire categories of applications.
FortiGuard IPS protects against the latest network intrusions by detecting and blocking threats before they reach network devices.
Protects your organization by blocking access to malicious, hacked, or inappropriate websites.
This full working demo shows the Enterprise Management Server (EMS) for FortiClient. Have a look at the Dashboard, FortiClient Status, Vulnerability Scan and Software Inventory. Check out the Endpoints section and see the summary and available actions, such as quarantine an endpoint. And you can also configure system settings and scanning options under Endpoint Profile.
The NSS Labs AEP group test evaluates products for security effectiveness, performance, and total cost of ownership (TCO). These products include endpoint security technologies that combine the protective capabilities of anti-threat products with the detection, investigation, and prevention capabilities of endpoint security products. FortiClient with integrated FortiSandbox earned a “Recommended” rating for the third year in a row. Fortinet achieved an average security effectiveness of over 97.65%, proven resistant to all evasion techniques with zero false positives, and low TCO.
The NSS Labs AEP group test evaluates products for security effectiveness, performance, and total cost of ownership (TCO). These products include endpoint security technologies that combine the protective capabilities of anti-threat products with the detection, investigation, and prevention capabilities of endpoint security products. FortiClient with integrated FortiSandbox earned a “Recommended” rating with average security effectiveness of over 97.3%, zero false positives, and low TCO.
NSS Labs introduced a new group test, BPS focused on detecting and blocking exploits, advanced malware, and evasions. This helps validate the advanced threat response cycle of prevent-detect-mitigate across a number of threat vectors including web, email, and endpoint. Fortinet's Security Fabric consisting of FortiSandbox, FortiGate, FortiMail, and FortiClient integrated together, earned a Recommended award by achieving a block rate of 99.6% and offering the lowest 3-year TCO.
FortiClient provides integration with many leading IT vendors as part of the Fortinet Security Fabric. Below is a list of current FortiClient Alliance Partners:
Carbon Black leads a new era of endpoint security by enabling organizations to disrupt advanced attacks, deploy the best prevention strategies for their business, and leverage the expertise of 10,000 professionals from IR firms, MSSPs, and enterprises to shift the balance of power back to security teams.
SentinelOne is shaping the future of endpoint security with an integrated platform that unifies the detection, prevention and remediation of threats initiated by nation states, terrorists, and organized crime. SentinelOne’s unique approach is based on deep inspection of all system processes combined with innovative machine learning to quickly isolate malicious behaviors, protecting devices against advanced, targeted threats in real time.
Symantec Corporation (NASDAQ:SYMC), the world’s leading cyber security company, helps organizations, governments and people secure their most important data wherever it lives. The partnership with Fortinet combines Symantec’s endpoint protection leadership with Fortinet’s best-in-class network security and Fabric integration to deliver unparalleled security protection.
Ziften delivers all-the-time visibility and control for any asset, anywhere - client devices, servers, and cloud VMs – whether on-network or remote; connected or not. Our unified systems and security operations (SysSecOps) platform empowers IT and security operations teams to quickly repair user impacting endpoint issues, reduce their overall risk posture, speed security threat response, and increase operations productivity. Ziften’s secure architecture delivers continuous, streaming endpoint monitoring and historical data collection for large and mid-sized enterprises, governments, and managed security service providers (MSSP). And Ziften helps extend the value of incumbent tools and fill the gaps between fragmented, siloed systems.
What is Fabric Agent?
Fabric Agent, one of the FortiClient modules, connects endpoints and integrates endpoints into the Security Fabric. Fabric Agent sends endpoint telemetry with the Security Fabric. Information shared includes risk profile, unpatched vulnerabilities, operating systems, protection status. User, device ID, and endpoint behavior data can be shared too.
Can FortiClient help us mitigate endpoint vulnerabilities?
Yes, when unpatched vulnerabilities are discovered during the scan, FortiClient provides flexible patching options including auto patching. Additionally, administration can define endpoint compliance policy to monitor unpatched vulnerabilities and their severity.
How does FortiClient prevent exploit-based attacks?
FortiClient endpoint protection capabilities feature anti-exploit, a behavioral-based detection technology that protects against memory exploitation techniques and exploit kits.
With vulnerability management, FortiClient helps companies improve security hygiene and provides visualization for the network security team to identify vulnerable endpoints and mitigate the risks.
How does FortiClient integrate with FortiSandbox?
FortiClient integrates natively with FortiSandbox and can automatically submit objects to the sandbox for analysis. What’s unique about Fortinet is that the sandbox infrastructure can be shared across FortiGate, FortiMail, and partners. The threat intelligence is automatically disseminated across the enterprise.
I have a FortiGate, can I try FortiClient and endpoint telemetry feature?
Yes, you can download FortiClient and EMS from the product download page. Your FortiGate can receive telemetry from up to 10 client for testing.
What endpoint telemetry does Fabric Agent send?
FortiClient telemetry data include: Endpoint operation system, device ID (such as MAC), logged-in user ID with avatar, endpoint protection (AV) status, endpoint vulnerabilities, endpoint behavior data, FortiClient version, and the device online/offline status.