Having a firewall is not the same as having a managed firewall service.
A firewall is an important part of protecting your business. But buying a good firewall and having it professionally installed are only the starting point.
What matters next is how it is managed. Who controls changes, who maintains its software, who can access it, who investigates suspicious activity, and who takes responsibility when something goes wrong.
The latest FortiBleed warning brings that distinction into focus - on 6 October 2026, the FBI and US Secret Service warned that the credential-compromise campaign remains active, targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. Their advisory cites more than 86,644 compromised devices across 194 countries.
For Australian organisations, the lesson is not simply “check your firewall”.
It is “check the service behind your firewall”.
What is FortiBleed?
FortiBleed is a campaign that uses stolen, leaked or reused credentials to gain access to FortiGate firewalls and VPN services. The FBI and US Secret Service also identify legacy password storage as a factor that allows attackers to crack stolen authentication data at scale.
Fortinet describes the activity as a credential-harvesting campaign rather than a vulnerability. Its analysis points to credentials from earlier incidents, brute-force techniques, weak password hygiene and missing multifactor authentication as being the true cause of the issue.
This distinction really matters! Updating software is essential, but an update alone does not make a stolen password unusable or remove an account that an attacker has already created.
The advisory describes attackers adding administrative accounts to maintain access and, in some cases, changing or deleting legitimate accounts so the organisation can no longer access its own device.
A firewall can still be passing traffic while its administrative access has been compromised (ie: the average end user will have no idea that the device has been compromised). Keeping the internet working and keeping the firewall secure are related responsibilities - but they are not the same test.
What should a professionally managed firewall service include?
A managed firewall service needs to be an ongoing operational responsibility - these are not a set and forget appliance with a support number attached.
The controls recommended in the FortiBleed advisory provide a useful way to assess whether that responsibility is being carried out. They cover management access, authentication, configuration validation, log review and secure credential storage - so much more than just applying patches.
Controlled configuration and changes
Your provider should be able to explain what the approved configuration is, who can change it, and how unexpected changes are identified/blocked.
For Fortinet environments, FortiManager is the tool used to centralise policy and device management, helping teams apply consistent security policies across multiple locations.
This capability matters when a business has several sites. Security should not depend on each firewall being configured independently, with no consistent way to verify the result.
However, the FortiManager platform is only part of the answer. Fortinet’s incident guidance specifically recommends comparing the current configuration with a known-good configuration and checking for unauthorised changes and unfamiliar accounts.
So the useful question is not just “Do you use FortiManager?”
It's more like “Can you demonstrate that our configuration is controlled and that unauthorised changes would be investigated?”
Logs that lead to action
Centralised logging makes security activity easier to investigate (and harder for third party actors to hide their tracks). FortiAnalyzer supports log collection, analysis, monitoring and reporting across Fortinet environments and separately from the FortiGate firewalls under attack.
But... A log repository is not, by itself, a monitoring service!
Ask who reviews the information, which events trigger investigation and how findings are escalated. The FortiBleed advisory recommends reviewing firewall, VPN, authentication and domain-controller logs for unusual access, suspicious accounts, unauthorised changes and movement into other systems.
The business value is not the number of logs collected. It is whether someone recognises a problem and takes responsibility for the response.
Patching backed by verification
Software maintenance remains essential. But “the firewall is patched” should not be the end of the security and risk conversations.
For FortiBleed, the FBI and US Secret Service recommend confirming that administrator credentials use PBKDF2 password hashing and removing weaker legacy hashes in accordance with Fortinet’s technical guidance.
That is a configuration and credential-storage check, not simply a firmware-version tick box.
A well-run management service needs to verify that the required security outcome is being achieved - not just note that an update has been completed.
Protected administrative and remote access
The advisory recommends restricting external management access, with removing internet-facing administration identified as the strongest of the listed options. It also calls for phishing-resistant multifactor authentication on remote-access and administrative accounts, enforced across the relevant gateways and interfaces.
Your provider must be able to explain:
- How administrators reach the firewall.
- Which accounts have privileged access.
- How authentication requirements are enforced.
- How VPN access is approved and reviewed.
- How automation credentials and API keys are controlled.
API access deserves attention too. The advisory recommends reviewing all API keys, removing unknown keys and refreshing legitimate keys so attackers cannot continue using them for access.
If you suspect a Compromise
If a device may already have been compromised, routine maintenance is not enough.
The FBI and US Secret Service recommend identifying and isolating affected systems, collecting relevant evidence, investigating the extent of the intrusion and applying measures to remove the attacker’s access.
That requires a provider who can move from day-to-day operations into incident response, with clear ownership and communication.
“Everything appears to be working” is not a viable substitute for a thorough investigation of the FortiGate and all downstream systems.
A firewall appliance versus a managed firewall service
The difference becomes clearer when you look at the questions each approach answers.
A hardware purchase answers:
-
“Which firewall do we have?”
A managed service should also answer:
- Who is responsible for maintaining it?
- How do we know its configuration remains appropriate?
- How quickly are relevant security advisories assessed?
- Who investigates suspicious activity?
- What evidence can we obtain for governance and audit?
- Who coordinates recovery if connectivity or security fails?
Those are service expectations, not features that become effective automatically because a product has been purchased.
FortiManager and FortiAnalyzer can support the configuration and visibility parts of that model. The provider still needs the people, processes and accountability to use them effectively.
Why firewall management belongs with managed internet connectivity
For any multi-site business, internet connectivity, firewall configuration and service recovery are closely connected operational responsibilities. Treating them as unrelated purchases can leave the business coordinating several suppliers when something fails - this is never a good situation and one to be avoided!
Microsolve’s managed internet connectivity service brings internet links, firewalls and site-to-site connectivity into a managed service. Microsolve’s comprehensive service approach includes implementation, monitoring, ongoing tuning, proactive alerts, regular reporting and a single point of accountability.
That is the practical outcome organisations should look for: connectivity that supports daily work, security that is actively maintained, and a team that owns the service rather than leaving staff to chase faults.
The firewall remains important. But it sits within a broader service designed to keep your locations connected and supported.
Questions to ask your firewall provider now
Use the FortiBleed warning as a reason to ask for evidence, rather than reassurance - ultimately, the firewall is protecting YOUR assets and it's YOUR accountability that an insurance investigator will be checking post a breach.
- Have you assessed our environment against the FortiBleed advisory?
- Is firewall administration exposed to the public internet, and why?
- Is phishing-resistant MFA enforced for administrative and remote access?
- Have you verified secure administrator-password storage and removed weaker legacy hashes?
- Have you checked accounts, API keys and configurations for unexpected changes?
- Are relevant logs being reviewed, and who owns the response to suspicious activity?
- If previous compromise is suspected, what investigation and recovery process applies?
These questions reflect the main control and investigation areas in the FBI and US Secret Service advisory (and a practical baseline).
Look for accountability, not a promise of zero risk
No provider should promise that a firewall makes an organisation immune to attack.
What a professional service should offer is a clear operating standard: appropriate controls, ongoing maintenance, active monitoring, documented changes and a response process when evidence suggests something is wrong.
That is the difference between having a firewall and having a firewall service that is maintained to leading-practice standards.
To explore a more accountable approach to business connectivity, visit
Microsolve’s managed internet connectivity service.
.
