Fortinet’s unified approach to Endpoint Security

FortiEndpoint was announced several months ago, and at Accelerate 2025, we finally got a look under the hood to see how FortiEDR is being integrated into FortiClient.

The EDR collector (or agent) is now deployed as part of the FortiClient unified installer and appears as a new feature that can be installed alongside the FortiClient agent.

The creation and management of EDR collector groups must now be done within EMS, and these groups will be synced with the EDR Management System. When endpoints are assigned to an EMS deployment, they will automatically be assigned to the corresponding EDR collector group within the EDR Management console.

This first phase of integration shifts the responsibility for deploying and managing software versions from EDR to EMS. As a result, the Fortinet EDR Management Console is evolving into a SOC analyst portal, tightly integrated with FortiEMS.

A new Fabric Connector in the EMS console enables monitoring of the health status of the EMS–EDR connection. Additionally, EMS now includes dashboard widgets displaying unhandled EDR security events, along with visibility into the top 10 most targeted endpoints and their health status.

What is FortiEndpoint? 

It is the unified client that integrates the capabilities of FortiClient and FortiEDR. This unified client provides secure connectivity, endpoint security, advanced threat detection, and response. 
 
FortiEndpoint integrates key capabilities ZTNA, endpoint protection platform (EPP), endpoint detection and response (EDR), and extended detection and response (XDR) to deliver secure connectivity, advanced threat detection, and automated response into a single solution. This powerful, streamlined client gives IT and security teams enhanced visibility and control over their extended network environments. 

FortiEndpoint
=
ZTNA + EPP + EDR + XDR

4 use cases:

• Connect:
  Provide secure and controlled access to all applications through VPN, ZTNA, and cloud access security broker (CASB)
• Prevent:
  Fortify endpoints against known attacks and attack surface reduction technologies
• Protect:
  Defend against the most advanced attacks through behavior-based and AI-enabled dynamic protections
• Respond:
  Automate or use AI-guided remediation steps to hunt for and repair the damage caused by attacks across the Fortinet Security Fabric and third-party tools

In addition to a refreshed FortiClient user interface, several new updates were announced at Fortinet Accelerate 2025:

• New FortiClient Cloud locations are being rolled out to support global deployments.
• Multi-VPN tunnel support has been introduced, enhancing FortiClient’s flexibility for remote access use cases.
• Integration with FortiDeceptor via a Fabric Connector on EMS now makes it possible to deploy lure packages directly through FortiClient.
• A future integration with FortiData is also in the works, expanding centralized visibility and intelligence capabilities.
• On the ZTNA front, things are evolving quickly. Microsegmentation is now being introduced, offering granular access control by source application and new support for device tags via JAMF and Intune, empowering tighter policy enforcement across managed endpoints.

The FortiEndpoint unified agent is expected to be offered in three main license bundles:

• Prevent
• EDR Essentials
• XDR