AI is becoming part of everyday business operations, but every new AI capability also creates another security concern. Fortinet’s acquisition of Virtue AI shows just how seriously the industry is taking these risks, and KIS Technologies Inc. offers AI and cybersecurity solutions that can help businesses strengthen their protection as they adopt new technologies.
The challenge is no longer simply protecting a company’s network or computers. Businesses now need to consider what their AI systems can access, which tools they can use, what information they process and whether an AI agent could be manipulated into doing something it should not. The solution is to treat AI security as part of the broader cybersecurity strategy rather than as an afterthought.
Why Fortinet’s Virtue AI Acquisition Matters
Fortinet’s decision to acquire Virtue AI is significant because it reflects a major change in how businesses need to think about cybersecurity. AI systems are becoming increasingly autonomous, and that means traditional security controls may not be enough to protect every part of the environment.
The acquisition brings Virtue AI’s technology into Fortinet’s existing security portfolio, expanding its capabilities around AI runtime protection, automated validation and autonomous AI systems.
Financial details were not disclosed, although Fortinet described the consideration as immaterial to its business. The financial size of the transaction may be less important than what the acquisition represents: cybersecurity companies are increasingly investing in technologies specifically designed to secure AI.
AI Is Creating a Much Larger Attack Surface
The AI Attack Surface Goes Beyond the Network
For years, cybersecurity discussions focused heavily on networks, endpoints, cloud infrastructure and applications. Those areas remain important, but AI introduces additional components that need protection.
Businesses using AI may now have to secure prompts, models, AI agents, API calls, Model Context Protocol tools and the infrastructure supporting those systems.
An attacker does not necessarily need to compromise a traditional server to cause damage. Manipulating an AI system into revealing sensitive information, executing an unauthorized action or interacting with a malicious tool could create a completely different type of security incident.
AI Agents Introduce New Risks
AI agents are particularly interesting because they can perform tasks rather than simply respond to individual prompts. Depending on how they are configured, an agent could interact with applications, databases, APIs and other business tools.
That creates a difficult security question: what happens if an agent is tricked into making a malicious tool call?
Virtue AI’s technology is designed to address this type of problem by providing visibility into AI agents and the tools they use, while also monitoring agent behaviour and identifying potentially dangerous activity.
Continuous AI Security Is Becoming Essential
One of the most important aspects of the acquisition is Virtue AI’s focus on continuous validation.
AI systems can change over time. Models may be updated, policies can be modified and fine-tuning can alter how a system behaves. A security assessment performed once may therefore not provide enough assurance months or even weeks later.
Testing AI Systems After Updates
Virtue AI provides automated validation capabilities designed to evaluate AI systems after changes are made. According to the original report, its technology can test against hundreds of attack vectors and more than 1,000 risk categories.
That approach is important because security cannot simply be treated as a one-time checkbox during AI deployment.
A system that passed testing before an update could behave differently afterward. Continuous validation provides organizations with a way to identify those changes and determine whether additional controls are required.
Red Teaming AI Agents
Virtue AI also provides red-teaming capabilities for autonomous agents across more than 50 sandboxed environments and 14 high-stakes domains.
This is particularly relevant because traditional penetration testing does not necessarily address the unique behaviour of AI systems. Security teams need to understand how an AI agent responds when it encounters malicious instructions, unexpected inputs or attempts to manipulate its decision-making.
Protecting Against Prompt Injection and Data Leakage
Fortinet had already been expanding into AI security through FortiAIGate, which is designed to address threats such as prompt injection, data leakage, model poisoning and excessive resource use.
The Virtue AI acquisition extends that strategy further.
Instead of focusing only on what happens when users interact with an AI model, Fortinet can now strengthen coverage around the broader AI lifecycle, including development, testing and runtime operation.
Why Prompt Injection Is a Serious Concern
Prompt injection is one of the clearest examples of how AI security differs from traditional cybersecurity. An attacker may attempt to manipulate an AI system through carefully crafted instructions, potentially causing it to ignore intended safeguards or expose information it should not reveal.
For organizations using AI with access to internal systems or confidential information, this can become a serious business risk.
Security controls therefore need to consider not only the infrastructure hosting AI, but also the instructions, permissions and interactions that determine what the AI is allowed to do.
Businesses Need an AI Security Strategy
The Fortinet acquisition also highlights an important lesson for businesses: adopting AI without considering security from the beginning can create unnecessary risks.
Organizations should understand which AI applications employees are using, what information those applications can access and whether unauthorized AI tools have entered the business environment.
Shadow AI Is Another Security Challenge
Employees may use AI tools without formally involving their IT or security teams. This can create visibility problems, especially when sensitive business information is entered into external services.
AI security therefore needs to include governance and visibility alongside traditional technical protections.
Businesses should know where AI is being used, who has access to it and what data is flowing through those systems.
The AI Security Market Is Growing Quickly
Fortinet cited Gartner research forecasting that the market for securing AI ecosystems and AI agents could grow from $2.8 billion in 2026 to $16.4 billion by 2030.
That projected growth demonstrates why major cybersecurity vendors are moving aggressively into this area.
The industry is shifting from asking whether businesses should use AI to asking how they can safely operate AI at scale. As more companies move AI projects from experimentation into production, security requirements will become increasingly sophisticated.
What Businesses Should Take Away
Fortinet’s acquisition of Virtue AI is more than another cybersecurity acquisition. It is another indication that AI security is becoming a fundamental part of enterprise cybersecurity.
Businesses should not wait until an AI-related incident forces them to address these risks. AI applications, agents, APIs, data access and third-party tools should be evaluated as part of an overall security strategy.
The organizations that benefit most from AI will likely be those that can deploy it confidently while maintaining strong control over their data, systems and users. As AI becomes more autonomous, security needs to become equally proactive.