Fortinet sold factory security the same week the FBI called its firewalls a ransomware doorway
The FBI and Secret Service confirmed FortiBleed is still active, reselling Fortinet firewalls to ransomware affiliates, on the same day Fortinet expanded its industrial-security footprint with Aramco and Rockwell. The stock sits near a 52-week high ahead of the October 28 print.
Vincent Jiang · 2 min read
The fire sale ran the same day the fire alarm rang
On October 6, 2026, the FBI and the Secret Service published a joint alert confirming that FortiBleed, a credential-compromise campaign against Fortinet firewalls and SSL VPN gateways, is still active and is feeding ransomware crews 1. SOCRadar has verified 86,644 compromised devices across 194 countries; its CISO says the wider operation targeted 400,000 to 450,000 firewalls 1. Initial access brokers resell the foothold to ransomware affiliates including INC/Lynx and Payload, and victims risk being locked out of their own devices by attackers who delete or change admin passwords 12.
The same day, Fortinet signed an MoU with Aramco to secure Saudi industrial environments 3, and Rockwell Automation launched managed services that put Fortinet FortiGate firewalls inside factories 4. Buyers are paying to protect oil and plants with the hardware Washington just called a proven entry point.
The stock is priced as if nothing bled
The market has not flinched. Fortinet shares rose 119.9% in six months, outperforming the broader technology sector's 32.1% gain, and traded at $189.14 on October 6 with a $138.8 billion market capitalization, near the top of a 52-week range of $73.55 to $192.41 56. That premium sits on fundamentals: Q2 2026 revenue up 26% to $2.05 billion, product revenue up 52% to $773 million, billings up 33% to $2.37 billion, and FY2026 guidance raised to $8.02 to $8.18 billion 56.
The security industry beat Fortinet's rally; the sector did not
Data
| Value | |
|---|---|
| Fortinet (FTNT) | +119.9% in 6 months |
| Zacks Security industry | +135% in 6 months |
| Computer & Tech sector | +32.1% in 6 months |
Revenue growth accelerated for three straight quarters, hitting 25.6% in Q2 2026
Data
| Revenue | |
|---|---|
| Q3 '23 | $1.34B |
| Q4 '23 | $1.42B |
| Q1 '24 | $1.35B |
| Q2 '24 | $1.43B |
| Q3 '24 | $1.51B |
| Q4 '24 | $1.66B |
| Q1 '25 | $1.54B |
| Q2 '25 | $1.63B |
| Q3 '25 | $1.73B |
| Q4 '25 | $1.91B |
| Q1 '26 | $1.85B |
| Q2 '26 | $2.05B |
The complication is who carries the risk
The risk ledger does not close. Fortinet's own quarter shows OT billings up over 55%, which means more FortiGate boxes at refinery edges and factory floors, exactly where FortiBleed bites 5. SOCRadar had already counted at least 12 confirmed ransomware attacks off this campaign by July; the federal alert now confirms the chain 2. Patching and password resets are not sufficient, the agencies say, because stolen credentials persist beyond the patch 1. The cost of that failure lands on customers, not on the vendor's income statement.
What the market will price next
The counterweight is real: guidance is guiding, Scotiabank raised its FY2026 EPS estimate on October 1, and the money keeps arriving 6. Fortinet reports Q3 on October 28, guiding $2.01 to $2.10 billion in revenue 56. Watch whether any disclosure, customer attrition, or federal follow-up turns FortiBleed from a customer's cost into Fortinet's problem. So far the bleed is priced in other people's systems.
Deepdive
AI-generated from this story and its cited sources. Not investment advice.
