- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
Perimeter firewalls have never been more contested. In the first half of 2026, multiple credible threat intelligence sources have documented a sharp rise in targeted reconnaissance and exploitation attempts against next-generation firewalls (NGFW), with FortiGate appliances — among the most widely deployed enterprise firewalls globally — appearing prominently in adversary playbooks. For Indian CISOs operating under tightening DPDP Act obligations and CERT-In’s 6-hour incident reporting directive, a compromised perimeter firewall is not merely a technical problem: it is a regulatory and reputational crisis.
This post walks through the threat landscape, explains what adversaries are actually doing, and provides a concrete hardening checklist for FortiGate-based environments. At the end, we describe how PJ Networks’ managed security practice — and the PrahiX Ora platform we deploy for clients — provides continuous visibility and automated response across this exact attack surface.
For most of the 2010s, attackers treated firewalls as obstacles to route around — via phishing, credential stuffing, or supply-chain compromise. That calculus has shifted. Sophisticated threat actors — including groups attributed to nation-state sponsors as well as financially motivated ransomware operators — have invested heavily in understanding the internal operating systems of enterprise security appliances. Their motivation is straightforward: a foothold on a firewall yields persistent access, the ability to intercept encrypted traffic, lateral movement across network segments, and a vantage point to disable or blind other defences.
The attack patterns we observe across our managed client base include:
None of these techniques are hypothetical. They have been documented in public advisories and observed in our own SOC telemetry. The enterprises most at risk are those running FortiGate appliances with management interfaces exposed (directly or indirectly) to the internet, with default or weak administrative credentials, or with long patch-deferral cycles driven by change-control friction.
FortiGate appliances are powerful precisely because they consolidate many functions: stateful firewall, application control, IPS, SSL inspection, SD-WAN, VPN gateway, and web filtering all in a single platform. Each of those functions is a potential attack surface when misconfigured or unpatched.
The HTTPS management GUI and SSH administrative interface are the most common entry points in reported incidents. Best practice is to restrict these to a dedicated out-of-band management network or at minimum to a tightly controlled jump-host IP range. In practice, we frequently encounter enterprise FortiGate deployments where the management interface is bound to an uplink interface or, worse, the WAN interface — effectively internet-exposed. Even with strong credentials, this dramatically increases attack surface.
SSL-VPN portals are by design accessible from the internet to remote users. This makes them a persistent target. Threat actors regularly attempt credential stuffing against SSL-VPN login pages using leaked credential databases — a technique that requires no exploit code, only a valid username and password harvested from a previous breach. Multi-factor authentication on SSL-VPN is not optional in 2026; it is a baseline control.
Fortinet releases security advisories on a regular basis, and patch turnaround time is critical. The window between public disclosure of a critical vulnerability and active exploitation has compressed from weeks to days — and in some high-profile cases, to hours. Indian enterprises with quarterly or semi-annual patching cycles are systematically exposed during these windows.
The following checklist is grounded in Fortinet’s hardening guides, CIS benchmarks for FortiOS, and our own field experience managing hundreds of FortiGate appliances across Indian enterprise and mid-market clients.
For Indian organisations, a compromised perimeter firewall carries specific regulatory implications that go beyond the technical remediation.
Under CERT-In’s 2022 Direction, a security incident — including unauthorised access to network equipment — must be reported to CERT-In within six hours of detection. A firewall compromise is unambiguously a reportable incident. This means your SOC must be capable of detecting the event, triaging it, and notifying CERT-In, all within a six-hour window that begins the moment the incident is detected, not the moment remediation begins.
Under the DPDP Act 2023, if the compromised firewall provided access to systems processing personal data — which is true of virtually any enterprise network — the organisation has obligations as a Data Fiduciary. While the DPDP Rules are still being finalised, a conservative reading requires internal escalation, containment documentation, and notification to the Data Protection Board in the event of a significant breach.
The practical implication: your CERT-In and DPDP incident response procedures must explicitly cover network infrastructure compromise, not just application-layer or endpoint breaches. Most incident response plans we review do not.
Log retention is also a direct CERT-In requirement. The 2022 Direction mandates that logs be maintained for 180 days and stored within India. A FortiGate that logs locally to internal storage with a 30-day rotation fails this requirement. Logs must be shipped in real time to a SIEM that provides in-country storage with tamper-evident archival.
Many Indian enterprises face a common challenge: they have invested in strong perimeter security hardware — FortiGate NGFWs, managed switches, enterprise Wi-Fi — but their SOC visibility remains fragmented. Logs live in multiple silos, analysts context-switch between a firewall dashboard, a network management console, and a camera management system, and automated response capabilities are limited to manual CLI commands. This is exactly the problem that PrahiX Ora, a unified SecOps platform built by PrahiX Tech Pvt Ltd, is designed to solve. PJ Networks is PrahiX’s primary field deployment and operations partner — we deploy and operate the platform for our clients across their environments.
Ora is built on four integrated pillars, each directly relevant to the FortiGate hardening and compliance challenges described above:
Ora’s SIEM ingests logs from FortiGate firewalls, FortiMail, switches, authentication systems, endpoints, and cloud infrastructure into a single correlation engine. Detection rules are mapped to the MITRE ATT&CK framework, so when a lateral movement technique or privilege escalation attempt is observed across firewall and endpoint logs simultaneously, the platform reconstructs an attack storyline graph rather than generating isolated alerts. For CERT-In compliance, Ora provides tiered log retention with hot, warm, and archive tiers — logs are retained in-country for 180 days by default, satisfying the CERT-In Direction without requiring separate archival infrastructure.
Most Indian enterprise networks are multi-vendor: FortiGate at the perimeter, Cisco or Aruba switching in the core, a mix of Wi-Fi vendors in branch offices, and MPLS or SD-WAN WAN links. Ora’s Network Management System (NMS) provides unified observability across all of these, using LLDP and CDP-based topology discovery to build an accurate, auto-updating network map. ML-based anomaly detection flags unusual traffic volumes, routing changes, or interface state transitions that might indicate a compromised device — capabilities that individual vendor dashboards simply do not provide across a mixed estate.
For manufacturing plants, retail chains, and multi-site enterprises, physical security and network security are increasingly managed as a single operational domain. Ora includes an ONVIF-compatible video surveillance management system (VMS) supporting Hikvision, Dahua, and other common camera ecosystems. Video analytics feed directly into the same SecOps dashboard as network and security events — so a physical intrusion event at a data centre can be correlated with an anomalous firewall login that occurs within the same time window. This is particularly valuable for organisations that have historically run physical security and IT security as completely separate silos.
The CERT-In 6-hour reporting window is only achievable if your detection-to-response pipeline is highly automated. Ora’s SOAR module provides pre-built playbooks and connectors — including direct integration with FortiGate — that can automatically push blocklists, isolate compromised network segments, or quarantine endpoints the moment a confirmed threat is detected. For a FortiGate compromise scenario, a playbook can automatically lock down management access, capture a forensic log snapshot, and generate the initial CERT-In notification draft — all within minutes of detection. This is what makes the 6-hour timeline realistic rather than aspirational.
If your organisation is evaluating whether a unified SecOps platform would reduce your operational overhead and improve compliance posture, we are happy to walk through a deployment architecture relevant to your environment. Reach out to our team for a conversation.
PJ Networks manages FortiGate deployments for enterprise and mid-market clients across India — from single-site organisations with one firewall cluster to distributed enterprises with 50+ branch locations running SD-WAN. Our managed security practice wraps FortiGate management in a 24/7 NOC/SOC operation that handles patch monitoring, configuration review, threat detection, and incident response.
On the compliance side, we help clients document their FortiGate hardening posture for CERT-In audits, prepare incident response runbooks that reference CERT-In reporting procedures, and maintain the log-retention evidence that regulators may request. We do not claim that any tool or service makes a client “DPDP compliant” — compliance is ultimately the organisation’s responsibility — but we do help clients build and evidence the controls that support compliance.
For organisations that have not recently reviewed their FortiGate hardening posture, we offer a structured Firewall Configuration Review that benchmarks your environment against CIS and Fortinet hardening guides, identifies gaps, and produces a remediation roadmap with prioritised findings. Many clients use this as a starting point before extending to a full managed service engagement.
If you take away one thing from this post, let it be this: FortiGate hardening is not a one-time project. It is an ongoing operational discipline. Threat actors continuously refine their techniques, FortiOS vulnerability advisories appear regularly, and enterprise network environments change — new integrations, new administrators, new branch locations — in ways that can inadvertently weaken the hardening posture you established six months ago.
Here is a practical starting point for this week:
These five steps will not make your environment invulnerable, but they will move you out of the easiest-target category and give your team the visibility and speed needed to respond when something does go wrong.
For a deeper conversation about FortiGate managed security, CERT-In compliance readiness, or the PrahiX Ora platform, contact the PJ Networks team. We work with Indian enterprises across manufacturing, BFSI, healthcare, and technology sectors to build and operate security programmes that are both technically sound and regulatorily defensible.