Forta uses a work token model that requires node runners to stake FORT tokens. The nodes scan transactions for potential threats and, when detected, send alerts to investors or protocols to take relevant action.