Fortinet upgrades FortiRecon to boost proactive cyber defences
The new release incorporates expanded internal attack surface monitoring, adversary-centric dark web intelligence, and security orchestration into a unified system intended to help security teams proactively identify and prioritise exposures, validate risks, and speed up response times. These features are designed to reduce the chances and impact of security breaches by mirroring an attacker's viewpoint in security assessment and response.
Attack surfaces and risk prioritisation
Organisations are increasingly seeking strategies that address their growing attack surfaces, rising alert volumes, and the fragmentation of security operations. According to Gartner, "By 2026, organisations prioritising their security investments based on a continuous exposure management program will be three times less likely to suffer from a breach."
FortiRecon's latest update integrates with the Fortinet artificial intelligence-driven security operations centre (SOC) platform and aims to cover all five pillars of the Gartner CTEM framework: scoping, discovery, prioritisation, validation, and mobilisation. This integration is designed to facilitate coordinated remediation between IT and security teams by centralising security operations.
Nirav Shah, Senior Vice President, Products and Solutions at Fortinet, commented on the challenges facing security professionals: "Chief information security officers and security teams are overwhelmed by growing attack surfaces and an endless stream of unprioritised alerts. With the latest enhancements to FortiRecon, we're giving organisations an attacker's eye view of their internal and external exposures, backed by artificial intelligence-powered threat intelligence from FortiGuard Labs, real-world validation, and automated response. This allows organisations to cut through the noise, focus on what matters most, and measurably reduce risks and vulnerabilities before attackers can exploit them."
Expanded capabilities
The platform's enhancements consist of several core areas:
Attack surface management: FortiRecon now provides continuous monitoring and an adversary's perspective of both internal and external digital attack surfaces. New features include National Vulnerability Database severity ratings and FortiRecon Active Exploitation severity ratings to optimise patch management processes.
Adversary-centric intelligence: The updated platform offers actionable threat intelligence from sources such as dark web activity, ransomware trends, leaked credentials, exploited vulnerabilities, and data on at-risk vendors. Enhancements enable bulk downloads of indicators of compromise and provide stealer infection details to support security operations centres in accelerating breach detection and incident response.
Brand protection: The platform continues to monitor for threats such as domain imitation, rogue mobile applications, phishing campaigns, and executive targeting, employing proprietary detection algorithms to identify and assist in remediating those threats, as well as monitoring public code repositories and open data exposures.
Security orchestration: The addition of automated playbooks for threat investigation and response streamlines remediation workflows and reduces the time required for responding to incidents.
Flexible deployment and recognition
Existing customers using FortiFlex are able to deploy FortiRecon Cloud via their credits under a usage-based licensing arrangement. FortiFlex supports a wide customer base, including those managing hybrid and multi-cloud environments, as well as managed security service providers. Purchases via major cloud marketplaces can also contribute towards fulfilling cloud committed spend obligations.
The operational effectiveness of FortiRecon has been noted in the KuppingerCole Leadership Compass for Attack Surface Management 2025 report, where Fortinet is named as an Overall Leader, Market Leader, and Innovation Leader. The report highlights FortiRecon's capabilities within environments governed by Centre for Internet Security controls, industrial control systems, Internet of Things devices, and operational technology. Integration with the broader portfolio of Fortinet Security Fabric, such as FortiGate NGFW, FortiSOAR, FortiSIEM, and FortiDAST, was also recognised.
These enhancements mark the next stage in Fortinet's efforts to assist organisations in managing continuous threat exposure and streamlining their security operations through a centralised and coordinated platform.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Techday NZ
13 hours ago
- Techday NZ
Ransom payments surge to USD $1.13 million as data theft rises
Coveware by Veeam has released its Q2 2025 ransomware report, indicating significant increases in both the frequency and financial impact of targeted social engineering attacks, particularly those involving data exfiltration. The report highlights that average and median ransom payments rose sharply during the second quarter. The average ransom reached USD $1.13 million, a 104% increase from Q1 2025, while the median doubled to USD $400,000. This escalation follows a pattern of more significant demands after incidents in which data is stolen rather than systems encrypted. Social engineering threats According to Coveware by Veeam, three major ransomware groups - Scattered Spider, Silent Ransom, and Shiny Hunters - dominated activity in Q2. These offenders shifted away from broad, opportunistic attacks to highly targeted campaigns, employing sophisticated impersonation techniques. The tactics included posing as employees or service providers to breach help desks and exploit internal processes. "The second quarter of 2025 marks a turning point in ransomware, as targeted social engineering and data exfiltration have become the dominant playbook," said Bill Siegel, CEO of Coveware by Veeam. "Attackers aren't just after your backups – they're after your people, your processes, and your data's reputation. Organisations must prioritize employee awareness, harden identity controls, and treat data exfiltration as an urgent risk, not an afterthought," Data exfiltration on the rise The report found that data theft is now prioritised over encryption in extortion efforts. Exfiltration was involved in 74% of ransomware cases handled by Coveware in Q2. Attackers increasingly rely on multi-extortion tactics and are known to issue delayed threats, prolonging risks to targeted organisations long after the initial breach is detected and contained. Targeted sectors and company sizes Analysis of the case data indicates that the professional services, healthcare, and consumer services sectors accounted for the highest proportion of incidents, comprising 19.7%, 13.7%, and 13.7% of attacks, respectively. Mid-sized enterprises, defined as those employing between 11 and 1,000 people, represented 64% of victim organisations. The report notes that attackers view such companies as offering the best balance between substantial ransom payout potential and relatively less developed cyber defences. Attack methods and vulnerabilities Credential compromise, phishing emails, and exploitation of internet-facing services remain the principal means of obtaining initial access to victim networks. The report also points to increased exploitation of vulnerabilities in well-known platforms including Ivanti, Fortinet, and VMware. Simultaneously, there has been a rise in attacks by so-called "lone wolf" perpetrators. These individuals are described as seasoned extortionists who use generic toolkits, but without clear branding or affiliation to known ransomware groups. The top ransomware variants in Q2 were named as Akira (19%), Qilin (13%), and Lone Wolf (9%). For the first time, Silent Ransom and Shiny Hunters also appeared within the top five variants monitored. Ransom payment dynamics The report attributes the dramatic increase in payment values largely to larger organisations choosing to pay ransoms following theft of sensitive data. This occurred even as the overall percentage of organisations agreeing to pay ransoms remained steady at 26%. Coveware by Veeam reports that its findings are based on proprietary data collected during incident response engagements, rather than external or third-party sources. The company utilises forensic tools and detailed documentation of threat actor behaviour to generate its quarterly insights. These reports are intended to offer actionable guidance on ongoing trends and new tactics, techniques, and procedures emerging within the ransomware landscape. Through real-time analysis, Coveware by Veeam has identified patterns that inform recommendations for enhancing organisational defences, such as improved employee training, more rigorous identity management protocols, and preparedness for incidents focused purely on data theft.
Techday NZ
13 hours ago
- Techday NZ
Red Hat named leader in 2025 Gartner Magic Quadrant for containers
Red Hat has been named a Leader in the 2025 Gartner Magic Quadrant for Container Management for the third year in a row, following an evaluation of 15 vendors. This ongoing recognition highlights both the role of Red Hat OpenShift in enterprise container strategies and the company's approach to hybrid cloud environments. The Gartner Magic Quadrant recognised OpenShift for its Completeness of Vision and Ability to Execute. Red Hat OpenShift provides a platform for container management that supports operational consistency and standardisation among organisations implementing cloud-native approaches. The platform is designed to standardise, automate, and scale container projects across various settings including data centres, multiple cloud environments, and edge deployments. Red Hat credits this acknowledgment to OpenShift's integrated security features, advanced management capabilities, and emphasis on developer productivity. These characteristics are seen as benefits for IT teams seeking to modernise applications and improve delivery of business value. The Gartner Magic Quadrant for Container Management is based on specific criteria that examine each vendor's completeness of vision and ability to execute. According to Gartner, Leaders are those who execute effectively against their current vision and are positioned well for future developments. Red Hat has previously received similar recognition, having been named a Leader in Gartner's 2025 Magic Quadrant for Cloud-Native Application Platforms. Company comments "We believe being recognised as a Leader for the third consecutive year in the Gartner Magic Quadrant for Container Management validates Red Hat OpenShift's role as a cornerstone for modern IT strategies. Our platform empowers enterprises to standardise, automate and scale their container initiatives across any footprint, from the datacenter to multiple cloud environments, providing the flexibility and control needed to meet evolving business demands." This was stated by Mike Barrett, Vice President & General Manager, Hybrid Cloud Platforms at Red Hat. The company states that OpenShift is suitable for organisations that require deployment capabilities across different infrastructures, including both private data centres and public clouds, as well as edge locations. Security and operational management are integrated into the platform to help developers and IT operations teams manage their workloads efficiently. The report from Gartner provides analysis of multiple vendors offering container management solutions, with an emphasis on their strategic direction and capability to deliver support for modern container workloads. Gartner's methodology identifies Leaders as vendors who are successful in both the vision and execution aspects of the market. The Gartner Magic Quadrant is frequently referenced by IT professionals and procurement teams seeking independent assessments of technology vendors. The evaluation of Red Hat OpenShift considered its ability to help enterprises with complex IT requirements and support their migration to cloud-native architectures. Red Hat continues to position OpenShift as a platform for standardising container operations, both on-premises and in cloud environments. Its feature set includes automation, policy enforcement, and monitoring, all built on a foundation powered by Kubernetes. The recognition by Gartner further builds on Red Hat's presence in the enterprise IT market, where container management is seen as a key capability for organisations pursuing digital transformation and modernisation of software delivery practices. The ability to operate workload across multiple environments is monitored closely by businesses managing diverse infrastructure estates. Gartner's commentary on container management vendors does not constitute an endorsement, but serves as one of several independent reference points for organisations considering their options in the market.
Techday NZ
19 hours ago
- Techday NZ
Neglected software updates put Kiwi SMEs at cyber threat risk
Neglecting software updates is exposing small businesses in New Zealand to increased risk of cyberattacks and data breaches. Patch management overlooked Small and medium enterprises (SMEs) often deprioritise software patching, with daily operational demands pushing updates down the to-do list. According to Mark Gorrie, Managing Director APAC for Gen Digital, this delay creates serious security gaps, especially in third-party applications such as business apps, browsers, conferencing tools, and document readers. Gorrie explains, "Neglecting software updates is leaving the doors of small and medium businesses wide open. Operating systems tend to be patched regularly, but it's everyday third-party apps like business applications, browsers, conferencing tools, and document readers that pose the bigger risk. The majority of vulnerabilities, 86%, come from applications (National Vulnerability Database). Each delay in patching increases the risk of ransomware attacks, stolen data, costly recovery efforts, or even falling short of compliance requirements – and local SMBs are exposed." Research by the Ponemon Institute shows that 57% of data breaches are linked to inadequate patch management. The consequences for SMEs can include financial loss, legal penalties, and reputational damage. Examples of breaches Recent incidents underscore the threat. High-profile breaches involving Microsoft SharePoint have been reported worldwide. In New Zealand, the Mediaworks organisation lost control of its competition database due to a third-party platform vulnerability, and the Reserve Bank of New Zealand was compromised via a flaw in a file sharing service. Ticketmaster attributed loss of customer details to a breach in a customer support application. Gorrie notes that while such cases often involve larger organisations, small businesses face similar risks from outdated software and unpatched systems. Gorrie says, "The recent Microsoft SharePoint breaches are a clear example. In New Zealand the Mediaworks lost control of its competition database due to a third-party platform and the Reserve Bank of New Zealand was breached thanks to a flaw in a file sharing service. Ticketmaster lost control of customer details and attributed the break to a customer support application, and the list goes on. These are the medium and large organisations that make the news, but the same vulnerabilities, even if not seen in print, are faced by small businesses too – outdated software, unpatched systems, and gaps in oversight. According to Ponemon Institute research, 57% of data breaches stem from poor patch management." Challenges for small businesses Many SMEs lack dedicated IT staff, so managing software updates is often a manual, time-intensive process. This situation means patches for third-party software can be delayed or overlooked entirely, sometimes until a problem occurs. Gorrie writes, "For many, software patching often sits on the 'someday' list. It's considered important, and since there's no dedicated IT employee, it's constantly pushed aside by more urgent tasks. It's easy to see why, patching is time-consuming, prone to disruption, and often overlooked until something goes wrong. But what's often underestimated is the real risk of putting it off." Automated solutions To address these risks and challenges, Gorrie highlights the role of automated patch management. He says that solutions can help SMEs by taking the manual work out of the process, reducing disruption to daily business operations and ensuring timely application of patches across devices and software. "With Avast Business Patch Management, you don't have to worry about tracking patches across multiple applications or deploying updates during peak business hours. The platform scans for vulnerabilities, tests patches, and automatically rolls them out, all from a central cloud-based dashboard." The approach, Gorrie contends, helps businesses by providing real-time visibility and control over their patch status. Automated systems can check for missing updates every 24 hours, efficiently distribute them across a network, and minimise network impact by scheduling deployments at convenient times. He elaborates, "Businesses can expect time back because patch management removes the time-consuming burden patches cause. You can set flexible deployment schedules or let the system take care of it automatically with minimal network impact. That means less time checking for updates and fewer disruptions to daily operations." Reducing risks and aiding compliance Managing software updates proactively can reduce exposure to cyber threats, such as ransomware and data theft, and support compliance with industry and data protection standards. Gorrie notes, "Smart businesses understand that the technology reduces risk. By closing known vulnerabilities quickly, you reduce the likelihood of ransomware attacks, data theft, or software issues. The system supports thousands of patches, including widely used apps like Adobe Reader, Java, and Zoom, so you're not just relying on Windows updates to keep your systems safe." Compliance is another benefit identified by Gorrie. "Owners know compliance is critical. Whether it's meeting internal standards or aligning with industry or customer requirements, staying on top of patching helps you demonstrate that your business takes data protection seriously. The platform's built-in reporting tools make it easy to track and show compliance progress too." Control and flexibility for SMEs Automated patch management solutions, according to Gorrie, can be managed from a central dashboard, even allowing updates to be deployed to devices that are remote or not currently online. In the event of issues caused by a patch, the system allows businesses to roll back changes without needing IT intervention. He states, "Patch Management means you don't need an IT qualification to gain control and visibility. Everything runs through one dashboard, and you can patch devices even if they're remote, asleep, or behind a firewall. And that's a big advantage for hybrid teams or those with multiple sites. If a patch causes a problem, you can roll it back without waiting for an IT technician to step in." Patching as part of security Gorrie describes patch management as an essential aspect of broader security strategies, offering an opportunity to enhance cyber resilience without significant resource investment. He concludes, "Patching doesn't have to be a painful, manual process. With the right tools, it can become a quiet but powerful layer of protection, running in the background while you focus on growing your business. Avast Business Patch Management is about making security easier, not harder, and giving small businesses the tools to stay safe without stretching your resources thin."
