Fortress Information Security

Fortress Information Security focuses on a specific, high-consequence slice of governance, risk, and compliance: third-party and supply chain cyber risk for regulated critical infrastructure operators, primarily electric utilities, but also transportation, finance, and healthcare. Its platform combines structured vendor risk assessments with continuous AI-assisted monitoring of suppliers, aiming to replace the point-in-time vendor questionnaires that leave utilities blind to supply chain threats between audit cycles, and to help them meet demanding regulatory regimes like NERC CIP.

Founded in 2015 and headquartered in Orlando, Florida, Fortress has grown to roughly 210 employees and works with the top seven investor-owned utilities in the U.S., a customer concentration that reflects how specialized and regulation-driven its market is. In 2022, Goldman Sachs Asset Management made a $125 million strategic investment in the company, part of $144 million raised in total. In 2025, Fortress Government Solutions won a 10-year, $919 million Blanket Purchase Agreement with the GSA for the Supply Chain Risk Illumination Professional Tools and Services (SCRIPTS) program, extending its critical-infrastructure risk model into direct federal government use. A published case study describes one regulated electric utility using Fortress to go from routine NERC CIP violations to zero violations and an audit exemption, cutting remediation timelines for vulnerabilities like Log4Shell and CitrixBleed from 30-90 days down to a matter of days.

For CISOs in regulated critical infrastructure sectors, Fortress is relevant as a compliance-and-risk specialist rather than a general GRC platform: its value proposition is built around the specific regulatory and supply chain risk pressures utilities and similar operators face, evidenced by real audit outcomes rather than generic risk-scoring dashboards.