Even though we are no longer actively using Fortinet FortiRecon and are now exploring other CTI tools, I still found its features very useful for monitoring our external attack surface. It gave us good visibility into exposed assets, leaked credentials and potential indicators of compromise linked to our organization. We initially used it alongside a broader infrastructure that included Symantec devices Cisco Catalyst switches, and FortiGate firewalls. That said, it’s important to understand that FortiRecon doesn’t directly protect these assets the way an endpoint or firewall solution does. Instead, it gives you an outside-in view, showing what an attacker could potentially discover about your environment from the outside. Integration with other vendors is possible through API keys but the process feels a bit manual and takes extra effort. The documentation is straightforward, but I think Fortinet could do a better job of offering more in-depth training focused specifically on FortiRecon, especially for teams that are new to external threat intelligence tools. Overall, I would recommend FortiRecon to organizations that want clearer visibility into their external risks. It’s easy to use, does a great job of highlighting issues we weren’t aware of, and is more beginner-friendly compared to many other threat intelligence platforms. I would give it an 8 out of 10 for visibility and usability, but after factoring in the integration challenges, my overall rating comes to 7 out of 10.
