What shipped. On Monday, two days before its Q3 print, Fortinet announced the FortiGuard Inline AI Security Service. It’s a cloud-delivered subscription that FortiGate firewall customers can switch on. It inspects what’s inside AI traffic: the prompts people send, the answers models give back, and the calls AI agents make to outside tools through MCP (Model Context Protocol, the common way agents plug into apps and data).
Fortinet says it can block prompt attacks, mask 35 types of personal and confidential data before they leak, and set spending limits so a flood of junk prompts can’t run up the token bill. The engine underneath is FortiAIGate, which now includes technology from Fortinet’s recent Virtue AI acquisition. Customers who want everything kept in-house can self-host FortiAIGate on Kubernetes with NVIDIA GPUs.
The feature isn’t the story. The footprint is. Read the release closely and the key line isn’t about detection quality. It’s this: customers can turn it on “without deploying and managing separate AI security infrastructure.” Fortinet is betting the winner in AI guardrails won’t be the smartest classifier. It’ll be whoever already sits in the traffic path.
That’s the firewall vendor’s oldest trick. Fortinet did it with SD-WAN. It’s doing it with SASE. Every new security need becomes a license key on a box the customer already racked. The buyer gets one less vendor review, one less agent to deploy, and one less console. Procurement loves that. So does the CFO.
Check Point is running the same play. Its R82.20 release added an “AI Network Firewall” in July to inspect AI traffic and govern agents at the network layer, and on Monday it bundled that into a new firewall subscription. Two of the biggest firewall vendors now say the same thing: AI security is a network control, and we already own the network.
Where that argument breaks. A firewall sees traffic that crosses it. A lot of AI doesn’t. A developer’s coding agent calling a model API from a laptop on hotel Wi-Fi never touches the branch firewall. An agent running inside a SaaS app talks to its model inside the vendor’s cloud. Encrypted traffic needs to be decrypted to be read, and plenty of shops still skip that for performance or privacy reasons. And a prompt is just text. Telling a bad one from a good one depends on context the network often doesn’t have: who the user is, what the agent was asked to do, and what data it’s allowed to touch.
That’s the gap the standalone AI security companies were built for. They sit closer to the app, the browser, the identity layer, or the agent itself. The honest pitch for them is no longer “we can inspect prompts.” Fortinet now says that too, and it ships to a giant installed base with one toggle.
So what should a startup in this space say now? Three things hold up. First, coverage of traffic the firewall never sees, like endpoints, SaaS-embedded agents, and developer tools. Second, deeper context, meaning tying an agent’s action to a user, a task, and a permission, not just a packet. Third, speed. The attack techniques against models change monthly, and the startup that publishes detections fastest earns trust a platform release cycle can’t match.
What buyers should do this week. If you run FortiGate, turn this on in monitor mode and see how much of your AI traffic it actually catches. That number is your real coverage. The traffic it misses is your shopping list for a specialist. Don’t buy two tools that watch the same pipe.
The market read. Fortinet reports Q3 on Wednesday. It guided Q3 billings to $2.25 billion to $2.35 billion. Watch whether management talks about AI security as a billings driver or just a talking point. If firewall vendors can turn AI guardrails into a paid add-on across their installed base, the standalone AI guardrail category starts to look like an acquisition list. That’s not a bad outcome for the startups. It’s just a different one than their pitch decks promised.