SECURITY ATLAS / EVALUATION BRIEF FortiNDR On Premises for OT Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/fortindr-ot/ THE ATLAS TAKE FortiNDR On Premises for OT belongs in a focused evaluation when industrial traffic analysis must stay local and Fortinet integrations are useful. The product is distinct from FortiNDR Cloud, so the trial should begin with the actual appliance or sensor architecture and named protocol support. Atlas would prioritize evidence quality at a representative site and the behavior of response integrations. A detection becoming a firewall request is only a handoff; the team must still prove appropriate authority, a correct target and a reversible action that engineering has approved. SCOPE This profile concerns the on-premises OT deployment described in the data sheet. FortiNDR Cloud is a distinct deployment. FortiGate, FortiNAC, FortiAnalyzer and FortiSOAR integrations do not imply that those products are included. WORTH A LOOK WHEN Industrial teams evaluating local NDR with explicitly scoped Fortinet response integrations. THINK TWICE WHEN The proposal borrows Cloud capabilities or assumes all Security Fabric products are included. IMPLEMENTATION 1. Define the local design Record sensor roles, expected traffic and permitted central connectivity for the industrial site. 2. Check protocol evidence Use representative authorized traffic and identify the fields available for each relevant protocol version. 3. Constrain response permissions Test a narrow lab action, target-side audit and rollback before connecting any production enforcement. OPERATING REALITY Sensor health, mirrored traffic and local storage need site ownership. Security analysts must collaborate with engineers when a new communication or suspicious payload appears. Any connected response requires separate accounts, permissions and safety review; the detection platform should not silently inherit broad authority over production network controls. COMMERCIAL CONSIDERATIONS Request the on-premises OT bill of materials and selected subscription scope. Separate FortiGate, FortiNAC, FortiAnalyzer and orchestration products and include site operations. - Sensor/appliance architecture and monitored traffic - Selected analysis and support subscriptions - Separate enforcement products and integration operations EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Observe representative lab industrial traffic Acceptance evidence: Retain protocol, asset and communication evidence. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Interrupt a nonproduction central link Acceptance evidence: Document local functions and visible operational degradation. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Trace a simulated response request Acceptance evidence: Capture approval, integration authority and target-side reversal. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Which OT protocol versions and traffic paths are actually observable? - What works locally when central connectivity is unavailable? - Which separate licenses and service accounts enable the response integration? EVIDENCE GAPS - Atlas has not independently verified OT protocol depth or detection efficacy. - Confirm release-specific local operation and every response integration entitlement. SOURCES FortiNDR for OT security (Product information) https://www.fortinet.com/solutions/ot-security/fortindr FortiNDR on-premises data sheet (Product information) https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/fortindr.pdf FortiNDR ordering guide (Product information) https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/og-fortindr.pdf Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.