#3 of 18 firewall and router platforms · Updated October 2026
VM-Series review 2026
Palo Alto Networks VM-Series (PAN-OS) · Dependable builder under exploitation pressure
VM-Series ranks #3 of 18 firewall and router platforms in the Firewall and Router Ledger 2026, with a Ledger Index of 63.4 out of 100. PAN-OS remains the reference for application and identity policy, sold only through credits, with nine PAN-OS entries on the CISA KEV catalogue since 2024.
Scores
Source: Firewall and Router Ledger 2026, edition 2026-10-16. How each score works: methodology.
Pros
- Firewall and NAT core5/5
- Threat protection5/5
- VPN and remote access4.5/5
- Platform and hypervisor freedom4.5/5
Cons
- Platform security and lifecycle2/5
What the Ledger says
VM-Series keeps the reference score for policy and threat protection, and the 12.1 train added clustering and Secure Boot for the virtual edition. Two things pull the Ledger Index down. The lifecycle domain carries the full KEV penalty, with nine PAN-OS entries since April 2024 and three flagged for ransomware use, most of them on the management interface or GlobalProtect portal. Commercial risk is the highest in its group because fixed licences are gone, prices are quote only and support outside the long trains is short. The buyer's check is exposure: keep the management interface off the internet and plan upgrades for the 12 month feature-release windows.
Palo Alto Networks talks about AI more than this scorecard credits, because the research pass did not verify the claims. What is verifiable is an API that agents can drive and no official MCP server, so the AI leverage score is low until the next edition checks the AI items.
Capability by area
Buying, lock-in and release record
Buying and licence (commercial risk)(lower is better)
- Price and licence volatility3
- Fixed-capacity VM licences ended 2024-07-31; credits are the only model and have no public price
- Purchase constraints3.5
- Subscription only, quote only, no free production tier
- Channel and access3
- Channel and direct sales; software and content updates need a support portal login and entitlement
- Owner stability0.5
- Independent public company since 2005
- Cost of staying supported3.5
- Extended support months 37 to 48 carry Critical and High fixes only; VM-Series feature releases outside the long-support trains expire after 12 months
Technical lock-in(lower is better)
- Formats3
- XML configuration, exportable and loadable, but proprietary in structure
- Export path2.5
- Expedition converts into PAN-OS; leaving means a manual rebuild or another vendor's converter
- Stack coupling2.5
- Panorama or Strata Cloud Manager for fleets; subscriptions for threat, DNS and SD-WAN features
- Hardware / cloud coupling1.5
- Any listed hypervisor or cloud; credits are bound to a deployment profile
- Skills and tooling coupling3.5
- PAN-OS specific skills (PCNSA, PCNSE) and tooling
Release credibility
- Cadence4
- A feature release every six to twelve months (11.1 2023-11, 11.2 2024-05, 12.1 2025-08) with a published lifecycle table
- Roadmap transparency2.5
- Public release notes, lifecycle table and compatibility matrix; direction appears in blogs and keynotes, no dated roadmap
- Say-do3
- The tracked items (12.1 Orion, Hyperscale Security Fabric, post-quantum VPN) shipped; too few announcements were collected for a full record
- Velocity4
- Several substantive capabilities per release since 10.2
- Lifecycle stability3.5
- 48 month windows for majors and in-place upgrades, but fixed VM models were retired in 2024 and VM-Series accelerated feature releases get only 12 months
Partners and services
- Partner programme openness4
- NextWave partner programme and cloud marketplaces; terms not read
- Multi-tenancy and self-service4
- Virtual systems, Panorama device groups and templates, Strata Cloud Manager tenants
- API and infrastructure-as-code4.5
- XML and REST APIs, vendor Terraform provider, pan-os-ansible collection
- Skills and certification4.5
- Exam-based PCNSA and PCNSE certifications with a large talent pool
Alternatives to VM-Series
Questions about VM-Series
Is VM-Series any good?
VM-Series ranks #3 of 18 firewall and router platforms in the Firewall and Router Ledger 2026, with a Ledger Index of 63.4 out of 100. Its strongest areas are firewall and nat core, threat protection, vpn and remote access. Its weakest are platform security and lifecycle.
What are the best alternatives to VM-Series?
The closest by Ledger Index are OPNsense (64.6), Check Point CloudGuard (62), Cisco Threat Defense Virtual (60.8), FortiGate-VM (66.4).
How is VM-Series licensed and sold?
Fixed-capacity VM licences ended 2024-07-31; credits are the only model and have no public price.
How much lock-in does VM-Series bring?
VM-Series scores 13 out of 25 on technical lock-in (lower is better). Export path: Expedition converts into PAN-OS; leaving means a manual rebuild or another vendor's converter.
User reviews of VM-Series
No reviews yet
Be the first to say how VM-Series worked for you.
Write a review
No account needed and no email asked. We read every review before it appears and remove adverts, spam and personal attacks.