Your FortiGate Is Deployed. It's Probably Not Tuned. Here's What That Costs You.

A FortiGate sitting at the edge of your network is not a security control. A correctly configured, continuously tuned FortiGate is. Across the Saudi mid-market, the gap between those two states is the single most common — and most expensive — finding in our network and security assessments.

The pattern almost never varies. A capable integrator delivers the firewall, runs a deployment checklist, validates basic connectivity, hands over the credentials, and moves on to the next job. Nothing about that is negligent; it's what the statement of work said. Six months later the appliance is online, traffic is flowing, the dashboard glows green, and nobody has touched the policy table since go-live. The threat protection licences are paid in full. Half of them aren't switched on. The other half are running default profiles that block almost nothing worth blocking.

Consider this the diagnostic. If you operate FortiGate firewalls in Riyadh, Jeddah, the Eastern Province, or anywhere across the Kingdom, the seven issues below are statistically likely to be live in your environment right now. Each is fixable in days, not months. Together, they're the difference between owning a firewall and being protected by one.

1. Deep SSL inspection isn't enabled — so your NGFW is inspecting nothing

The overwhelming majority of enterprise web traffic is encrypted. A FortiGate without deep SSL/TLS inspection can't see inside any of it. Application control, web filtering, intrusion prevention, antivirus, DLP — all decorative. They scan the small fraction of unencrypted traffic and wave the rest through.

Think about what that means practically. The malicious attachment arrives over an encrypted connection. The command-and-control callback rides HTTPS. The data exfiltration leaves through a TLS session. Every one of them passes a firewall that is, from the traffic's perspective, just a router with a licence bill.

Deep inspection is genuinely non-trivial to deploy: it needs a properly distributed CA certificate, exception lists for banking, government, and healthcare destinations where inspection is inappropriate or legally constrained, and capacity sized for the real decryption load. It's not a checkbox, and anyone who tells you otherwise hasn't done it at scale. But running an NGFW without it means you're paying enterprise licensing for a stateful packet filter.

2. Security profiles are configured but never applied

This is the most common single finding we see, full stop.

The administrator has built an antivirus profile, a web filter, an IPS profile, an application control profile — thoughtfully, with reasonable settings — and left every one of them sitting in the profile library, never bound to an actual firewall policy. Traffic flows. Profiles do nothing. The console shows a healthy configuration, because the configuration is healthy. It's simply not connected to anything.

A FortiGate only inspects when a profile is explicitly applied to the policy the traffic matches. "Configured" and "active" are not the same word, and the distinction is invisible unless you go looking policy by policy.

Every internet-bound policy should carry, at minimum, an antivirus profile, an IPS profile, an application control profile, a web filter, and a DNS filter. Anything less is documented, intentional exposure — whether anyone documented it or not.

3. IPS signatures are stale or set to monitor-only

Two failure modes here, both common, both quiet.

First: signature updates aren't arriving. The licence lapsed at renewal and nobody noticed. Or the device can't reach the FortiGuard cloud because of an egress rule. Or a proxy is silently blocking the update path. The IPS engine runs faithfully against signatures that are months out of date, which means it catches yesterday's attacks and misses today's.

Second, and more frustrating: the profile exists, signatures are current, but every action is set to "monitor" rather than "block." The firewall sees the attack, logs the attack, and lets the attack straight through. This usually happens because blocking caused a false positive during commissioning, someone flipped it to monitor to unblock a business process, and nobody ever flipped it back.

A weekly check — signatures updating, critical and high-severity signatures set to block, exception lists documented and reviewed — isn't sophisticated work. It's just rare in environments without an active managed relationship, because nobody owns it.

4. Default credentials, shared admin accounts, no MFA

The web interface and SSH console are management surfaces, and they deserve to be treated like the crown jewels they are.

We routinely find shared administrator accounts where three engineers use one login and nobody can tell who changed what. No MFA on management access. Weak password policies. No IP allowlisting on the management interface. And worst of all — HTTPS admin access exposed straight to the public internet, because someone needed to manage it from home once.

Each of those is a finding on its own. Stacked together, they're the exact path an attacker takes to disable the firewall before launching everything else. Why fight through a security control when you can log into it?

The fix is well documented: per-administrator accounts with role-based privileges, MFA through FortiToken or third-party TOTP, admin access restricted to internal management VLANs, SSH disabled on external interfaces, and trusted-host lists set per administrator.

5. No segmentation between user, server, IoT, and OT zones

A FortiGate is, among other things, a segmentation engine — and most mid-market deployments we audit never use it that way.

One inside zone. One outside zone. A flat network behind it. Lateral movement between endpoints, servers, printers, IP cameras, and (in industrial sites) OT systems runs completely unrestricted, because no internal policies exist to restrict it. The firewall is doing perimeter duty and nothing else, while the actual risk — an attacker already inside, moving toward something valuable — goes entirely unaddressed.

A modern deployment uses VLAN-aware policies to separate user traffic from server traffic, IT from OT, and IoT and CCTV onto isolated zones with explicitly defined east-west rules. This is the single control that contains a phishing-driven endpoint compromise to one user, instead of letting it walk to the domain controller. It's also the control that regulators increasingly expect to see evidence of.

6. The Fortinet Security Fabric is half-deployed

FortiGate is one component of a much larger architecture. It's designed to integrate with FortiAnalyzer for centralised logging, FortiManager for multi-device policy management, FortiSIEM or FortiSOAR for correlation and automated response, FortiClient for endpoints, FortiAuthenticator for identity, FortiSandbox for unknown-threat detonation, and FortiEDR for advanced endpoint protection. Each integration multiplies the value of the others.

What we actually find: standalone FortiGates with no FortiAnalyzer, so logs live on-box and rotate out within days — meaning that when an incident surfaces three weeks later, the evidence is gone. No FortiManager, so policy drift across sites goes unmanaged and every branch slowly becomes its own snowflake. No SIEM integration at all, so firewall telemetry never reaches the people who could correlate it with anything else.

The licences are paid; the architecture was never built. Fabric integration is where the platform earns its premium — and it's the part most often left on the table.

7. No change management, no backup discipline, no review cadence

The last finding is operational, not technical, which is why it's the one nobody budgets for.

Policy tables grow. New rules pile on top of old ones. Temporary exceptions quietly become permanent — the rule opened for a two-week migration in 2022 is still there. Service accounts get added, services get retired, and the rules permitting them just stay. Within two years the policy table is an archaeological dig where nobody's entirely sure which rules are still needed, which are dormant, and which are actively dangerous.

The discipline that prevents this isn't exotic: documented change management with a justification for every rule, automated configuration backups (FortiManager handles this natively), a quarterly policy review, and unused-rule reporting to flag retirement candidates. None of it is hard. All of it is missing from the average mid-market deployment, because it's the work that never feels urgent until an auditor asks.

What this actually costs you

The financial cost of these gaps is rarely the licence price. It's the cost of an incident the firewall was supposed to prevent — ransomware reaching production servers because lateral movement was open, business email compromise landing because deep inspection wasn't catching the malicious attachment, an OT environment breached because IT and OT shared a flat network.

The compliance cost is just as real. NCA ECC, the SAMA Cybersecurity Framework, and PDPL all require effective segmentation, monitoring, and threat prevention. [1][2] An auditor asking for evidence of policy review, IPS efficacy reports, and segmentation documentation will not accept "we have a FortiGate" as an answer. Ownership isn't evidence. Operation is.

Frequently asked questions

How do I know if my FortiGate is tuned? Check three things quickly: is deep SSL inspection enabled, are security profiles actually attached to your internet-bound policies, and are IPS signatures both current and set to block? If any answer is no, the findings above apply to you.

How long does remediation take? Most of these are days of work, not months. The exception is deep SSL inspection, which needs careful certificate distribution and exception handling, and segmentation, which needs design work first.

Will tuning break things? Done carelessly, yes — which is why it's phased. You profile traffic, apply changes in monitor mode first, resolve false positives, then move to blocking. Rushing straight to enforcement is how organisations end up disabling protection permanently.

Can our internal team do this? Some of it, absolutely. The challenge is usually the ongoing cadence — the quarterly reviews, the signature checks, the policy hygiene — rather than the one-time fixes.

Where ITBuilders fits

We're a Fortinet partner in Saudi Arabia with certified engineers who design, deploy, and operationally manage FortiGate environments end-to-end — as a continuous capability, not a one-off project. Recent work includes a 130-branch FortiGate SD-WAN rollout, a multi-site refresh covering 300+ switches and core security architecture, and optimisation programmes for clients across financial services, manufacturing, and government.

We'll run a structured assessment of your existing FortiGate deployment, identify which of the seven findings apply to you, and hand you a prioritised remediation plan you can act on — with us or without us. No commitment.

Book your FortiGate health check. Call 920-020-750, email [email protected], or visit itbuilders.com.sa.