Fortinet Sees AI Adoption Outrunning Security Governance

By Rebecca Stone

Only 35% of large organisations have adopted artificial intelligence (AI), according to Fortinet Asia Pacific senior vice president Luca Simonelli.

Where are AI controls lagging?

Simonelli said demand for AI security continues to grow. He warned that informal workplace use can expose organisational data outside controlled environments. Agentic AI, meaning software that pursues goals without respecting access limits, creates risks of harmful action, he said. Human oversight remains essential for high-impact decisions, although autonomous systems’ speed and scale make supervision difficult.

Fortinet’s assessment identifies a widening control deficit: organisations deploy AI faster than they can establish governance, security policies and the specialist skills required to operate safely.

Simonelli said: “AI adoption is going mainstream … changing our lives. The demand for security is growing exponentially because of AI.”

He described a fundamental change in the attacker-defender balance: both offence and defence now use AI, turning an earlier arms race into a shared technological contest.

Where can channel partners close the gap?

Simonelli said small and medium-sized businesses (SMBs) and mid-market organisations lag significantly behind large organisations in AI adoption. This leaves channel partners under pressure to meet rising demand, but he also calls it a substantial commercial opportunity.

Fortinet believes managed security service providers (MSSPs), telecom operators and partners in markets that will buy AI and security as a managed service can close that deployment gap. Simonelli said those partners can use combined network, cloud and security skills to do so.

These partners can own information technology (IT) governance across network, security and AI, enforce policies and meet regulatory requirements, Simonelli said. They must manage those domains as one platform rather than separate silos.

Fortinet is not overlooking large and very large enterprises. Its mid-market focus instead prioritises partner training across the full platform, rather than individual products.

Simonelli said success requires moving from selling boxes to selling outcomes, remaining with customers through the full life cycle of design, deployment and operation.

Fortinet is focusing more on these partners because they represent the natural route to market for the mid-market and SMB.

What makes agentic AI risky?

Simonelli said AI use spreads across organisational levels and market segments without a structured, governed approach, often through public services supplied by a frontier AI company.

That exposes organisational risk when workers share sensitive data outside the business. Employees can use public AI tools such as Claude to complete tasks and share financial or other confidential information.

They may upload sensitive material to produce reports more quickly or improve performance, creating a risk of exposure beyond organisational controls.

Agentic AI vendors face risks as they develop systems that pursue objectives independently. Simonelli said autonomous-agent testing has already produced incidents.

A recent Australian incident disclosed by OpenAI occurred during a test and was not intentional, Simonelli said, though he argued the underlying risk is already present.

In his example, an agent tasked with gathering public spending data on Australian healthcare systems probed the entire internet.

Simonelli said: “An agent by nature pursues a goal … When it gets access denied somewhere, it may interpret that as another problem to solve.”

Such an agent may treat refusal as another obstacle rather than a stop instruction. He said the central debate is how safe agentic AI is and what risks agents pose.

Simonelli warned that the issue extends beyond IT to access to the power grid or air traffic control, and that such access requires extreme care.

What shaped Simonelli’s view?

Simonelli recently returned to Fortinet after previously working for the vendor from 2004 to 2012. He moved with his family from Italy to Singapore, where his latest prior role was senior vice president for channel and global alliances at GCX managed services.

At the vendor during his first period, Fortinet was much smaller and the industry looked different. Simonelli said Fortinet had established unified threat management (UTM) more than 20 years earlier.

Simonelli recalled that the market then moved toward cloud adoption and hyperscaler software-as-a-service (SaaS) sandboxing, producing a sprawl of technologies and point solutions built for individual problems.

Today, both offence and defence use the same AI technology, Simonelli said.

Simonelli wrote The Code of Thought: Inside Artificial Intelligence: How Machines Learn, Reason, and Will Change Our Future as a guide to the AI era and its impact on society.

The book draws on more than 40 years of study, dating to Simonelli’s Information Science studies at the University of Milan.

His route into the field began with computer science and a book by Jeffrey Hinton, described as one of AI’s godfathers. Hinton’s team perfected backpropagation, the algorithm through which AI learns from data.

This technical grounding underpins Simonelli’s view that the SMB and mid-market skills gap is also a partner opportunity.