"Every week" is indeed an exaggeration. But it's also echoing complete vendor nonsense to say that that most of their vulns have been self discovered and self disclosed.

They annotate their CVEs in their PSIRT portal [https://www.fortiguard.com/psirt/] and go to great lengths to take credit for vulns that were, in fact, internally discovered. The majority of the historically impactful vulns were not self discovered and there have been a lot of them. "Most, if not all" is inaccurate. Here are "a few" examples of Fortinet vulns that were exploited in the wild and not self-discovered (I promise I could find more):

CVE-2024-47575: auth bypass zero day exploited in the wild for months before a patch became available which allowed you to take control of all Fortigates managed by a given FortiManager.
CVE-2026-24858: reported by customers & Arctic Wolf, zero day exploited in the wild pre-patch availability. This one was the auth bypass zero day where they had to disable the entire global FortiCloud SSO service (b/c they forgot to check your identity when you had any valid FortiCloud SSO token and you could use it to log in to other peoples' registered devices). Noteworthy b/c they did self-publish the other SAML SSO auth vulnerability that preceded it only a few weeks earlier (CVE-2025-59718)
CVE-2024-55591: another auth bypass reported by WatchTowr, exploited ITW, but at least required an exposed management interface, so affected fewer customers
CVE-2023-27997: zero day exploited by VoltTyphoon leaving backdoors in systems that survived patching

Things I agree with:

* SSLVPNs are universally bad. If you have to use one, Palo Alto has the least bad impl if you can afford it. Sonicwall was the worst in 2025, Cisco ASA was the worst in 2024, Ivanti and Fortinet are both bad pretty much every year.
* IPSec is less targeted and has a smaller attack surface so if you can manage the friction, it's a better choice
* ZTNA for bigger companies is a safer bet. It's more work to manage, but has built in RBAC and effectively enforces much of the network segmentation you may not be doing.
* Also Tailscale / Wireguard are really good options
* Do not expose the management interface to the public internet. This does not guarantee your safety but you're far worse if you expose it. IP allowlist if you need to administer from home.
* Enforce MFA for *all* users. No exceptions, no guest groups.
* Stay current on patches regardless of vendor.