A FortiWeb administrator is reviewing issues found during a security audit.

The mapping follows the security risk each FortiWeb feature mitigates. User Tracking maps to Broken Access Control because it helps enforce authenticated-session behavior and can prevent unauthorized access patterns. HSTS Header Security maps to Cryptographic Failures because it forces browsers toward HTTPS and reduces downgrade or weak transport behavior. Padding Oracle Protection also maps to Cryptographic Failures because padding oracle attacks exploit weaknesses in encrypted session or token handling. Web Vulnerability Scan maps to Security Misconfiguration because scans help expose misconfigured, exposed, or vulnerable application components. Session Forwarding fits Insecure Design because it helps enforce expected application flow rather than allowing users or attackers to jump through weakly designed paths.