How FortiSense detects risk
How it worksFortiSense looks for early warning signals in how processes behave and how systems are used not just whether a file matches a known signature.
Many security tools either block known malware or collect huge volumes of telemetry that require specialist analysis. FortiSense takes a different approach: it focuses on high-signal indicators of risk, explains why something looks suspicious, and lets you decide what action to take.
No black boxes. No forensic overload.
Detection focused on signal, not noise
FortiSense is designed around a simple principle:
Most real incidents leave warning signs before they become obvious malware.
Instead of trying to log everything, FortiSense watches for patterns that commonly appear when something isn’t behaving as expected especially on systems that normally stay quiet.
easier to understand
easier to tune
easier to trust
The signals FortiSense monitors
FortiSense combines several types of signals to build context around what’s happening on an endpoint.
Behaviour & resource signals
SignalFortiSense watches how processes behave over time, not just what they’re called.
- Sudden CPU or memory spikes from unexpected processes
- Processes behaving differently from their normal baseline
- Unusual outbound network activity
Abuse, misuse, and early-stage attacks often cause resource or network changes before anything clearly malicious appears.
Parent–child process chains
SignalFortiSense records which process launched another process.
- A document viewer launching a scripting engine
- A background service spawning an interactive shell
- A system process starting user-space tooling
Some process relationships are normal. Others are not. Seeing what launched what provides immediate context that simple alerts lack.
Execution paths & context
SignalFortiSense looks at where executables are running from, not just their names.
- Executables running from user-writable directories
- Tools executing from temporary or unusual locations
- Legitimate binaries used outside their expected context
Attackers often rely on trusted tools running from unexpected places. Context helps separate normal admin work from risky execution.
Known-bad process names & file hashes
SignalFortiSense compares executables against a database of known malicious hashes and identifiers.
- Known malicious hashes matched on an endpoint
- Known-bad process identifiers observed in a snapshot
- Hash matches combined with behaviour context
Signature-based matching is still valuable, especially when combined with behavioural context rather than used alone.
Important clarification
Not just signaturesHash and identifier matching is one signal among many not the only detection method.
How signals turn into alerts
FortiSense does not alert on a single weak signal.
Instead, alerts are raised when:
- confidence thresholds are crossed
- multiple risk indicators align
- or a known high-risk condition is detected
- the process involved
- how it was launched
- what behaviour triggered concern
- what evidence was observed
This makes alerts actionable, not just informative.
Explainable by design
When FortiSense raises an alert, it explains why.
“Threat detected”
- what happened
- what triggered concern
- what evidence was observed
This allows you to:
- quickly decide whether to quarantine
- safely ignore false positives
- refine policies without guesswork
- explain decisions to colleagues or stakeholders
Explainability is what makes FortiSense usable without a dedicated security team.
Protection doesn’t stop when connectivity drops
Real environments aren’t always online.
FortiSense is designed to continue operating when endpoints are:
- offline
- intermittently connected
- restricted by network policies
- continues monitoring behaviour
- uses cached intelligence for high-confidence decisions
- stores telemetry locally
When connectivity resumes, telemetry is uploaded and alerts are processed normally.
This ensures visibility and protection even during outages especially on critical systems.
What this approach intentionally avoids
FortiSense does not try to:
- record every system call
- provide full forensic timelines
- replace enterprise SOC tooling
- make opaque “AI-only” decisions
Those capabilities exist elsewhere but they come with complexity and cost that many teams don’t need.
FortiSense focuses on early visibility, clarity, and control.
Who this detection model works best for
This approach works best if you:
- want early warning signals, not post-incident forensics
- manage desktops and servers with limited security staff
- prefer explainable alerts over automated black boxes
- need lightweight protection with minimal overhead
If you need compliance reporting, SOC workflows, or full incident reconstruction, FortiSense is best used alongside not instead of enterprise EDR.
Ready to see FortiSense in action?
Deploy the agent, generate real signals, and see how explainable detection works in your own environment.
Free to evaluate. No long-term commitments.
Summary
Detection- high-signal indicators
- context across signals
- explainable, actionable alerts
forensic overload and “log everything” telemetry.
On this page
JumpQuick links
ProductWant a fit check? Tell us your environment and we’ll suggest which signals matter most for your endpoints.