Where each firewall and router platform stands, and where it is heading. Scored on what shipped. The overview puts every angle and an overall index in one place; the map below compares any two scores. Click a platform anywhere for its full scorecard.
The Firewall and Router Ledger scores 18 firewall and router platforms on capability, credibility, buyer risk, lock-in and AI, using public release records only (edition 2026-10-16). Top 5 by Ledger Index out of 100: FortiGate-VM (66.4), OPNsense (64.6), VM-Series (63.4), Check Point CloudGuard (62), Cisco Threat Defense Virtual (60.8). The full table is below; each name links to its scorecard, and the methodology explains every score.
| # | Name | Ledger Index /100 | Capability /100 | Credibility /25 | Commercial risk /25 | Lock-in /25 | AI /20 | Archetype |
|---|---|---|---|---|---|---|---|---|
| 1 | Fortinet FortiGate-VM (FortiOS) | 66.4 | 84.8 | 17 | 11 | 12.5 | 8.5 | Real innovator with a long KEV record |
| 2 | OPNsense (Deciso, Community and Business editions) | 64.6 | 70 | 19.5 | 4.5 | 4 | 2 | Dependable builder |
| 3 | Palo Alto Networks VM-Series (PAN-OS) | 63.4 | 84 | 17 | 13.5 | 13 | 5 | Dependable builder under exploitation pressure |
| 4 | Check Point CloudGuard Network Security (Quantum Gaia) | 62 | 77.6 | 16 | 13 | 15 | 9.5 | Dependable builder with an AI push |
| 5 | Cisco Secure Firewall Threat Defense Virtual (and ASAv) | 60.8 | 81 | 15 | 13.5 | 14 | 5.5 | Dependable builder, slowed by renames |
| 6 | VyOS (VyOS Networks: LTS, Stream and rolling) | 59.2 | 66 | 17 | 14.5 | 4 | 2 | Dependable builder |
| 7 | Juniper vSRX (Junos OS) | 58.1 | 75.6 | 15.5 | 15 | 12 | 5 | Dependable builder under a new owner |
| 8 | Sophos Firewall (virtual, software and Home edition) | 58 | 73.4 | 15.5 | 11.5 | 12 | 5 | Dependable builder |
| 9 | pfSense (Netgate: pfSense CE and pfSense Plus) | 55.9 | 68.4 | 13.5 | 14 | 6 | 1.5 | Portfolio-led builder |
| 10 | Barracuda CloudGen Firewall (Vx and public cloud) | 54.2 | 75 | 14.5 | 14.5 | 13.5 | 1.5 | Steady maintainer |
| 11 | MikroTik RouterOS (x86 licences and Cloud Hosted Router) | 53.1 | 57.6 | 16 | 4.5 | 11.5 | 1.5 | Dependable builder |
| 12 | SonicWall NSv (SonicOS) | 52.7 | 70.4 | 14.5 | 16 | 13.5 | 3.5 | Follower with lifecycle churn |
| 13 | WatchGuard FireboxV and Firebox Cloud (Fireware OS) | 52.5 | 68 | 14.5 | 14.5 | 13 | 3.5 | Steady maintainer |
| 14 | OpenWrt (community project, Software Freedom Conservancy) | 51.8 | 56.6 | 15 | 7.5 | 2.5 | 1.5 | Dependable builder |
| 15 | Netgate TNSR | 48.6 | 61.2 | 13 | 13.5 | 9 | 2 | Narrow specialist |
| 16 | IPFire | 48.1 | 56.2 | 15.5 | 10 | 6.5 | 0.5 | Dependable builder |
| 17 | Forcepoint Network Security Platform (formerly Forcepoint NGFW) | 47.3 | 70.6 | 11.5 | 16 | 15.5 | 1.5 | Portfolio reshuffle |
| 18 | Arista NG Firewall (formerly Untangle NG Firewall) | 46.4 | 63.4 | 11 | 12 | 9.5 | 0.5 | Slow follower |
Capability /100. Ten domains scored 0 to 5 against fixed anchors, weighted to 100. The buyer lens changes the weights, not the domain scores. History from 2015 uses the same anchors, so a line rises only when something ships.
Credibility /25. Cadence, roadmap transparency, say-do record, velocity and lifecycle stability, from the 2023 to 2026 release record.
Commercial risk and technical lock-in /25 each. Lower is better, so these axes are drawn reversed. Buyer risk is the two added together, out of 50.
AI leverage /20. Four strands scored per year: AI workload infrastructure, AI platform stack, AI-assisted operations and agent openness. Only GA counts; previews count half a step at most.
Ledger Index /100. A weighted blend of all parts, always shown with them. Before 2023 only capability and AI move; the other parts are held at today's values.
Idea-to-need index. Share of vision-led items among vision, customer and market-window items. 0 means demand-pulled, 1 means thesis-pushed. It is a direction, not a grade.