{ "edition": "2026-10-16", "years": [ 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023, 2024, 2025, 2026 ], "ai_labels": [ [ "infra", "AI in threat detection" ], [ "stack", "AI platform stack" ], [ "ops", "AI-assisted operations" ], [ "agents", "Agent openness" ] ], "index_weights": { "cap": 35, "cred": 20, "safety": 20, "ai": 10, "integ": 10, "mom": 5 }, "domains": [ { "key": "routing", "label": "Routing and WAN", "weight": 12 }, { "key": "firewall", "label": "Firewall and NAT core", "weight": 12 }, { "key": "vpn", "label": "VPN and remote access", "weight": 12 }, { "key": "threat", "label": "Threat protection", "weight": 12 }, { "key": "services", "label": "Network services", "weight": 8 }, { "key": "platform", "label": "Platform and hypervisor freedom", "weight": 10 }, { "key": "ha", "label": "High availability and performance", "weight": 8 }, { "key": "mgmt", "label": "Management, API and automation", "weight": 10 }, { "key": "observability", "label": "Observability", "weight": 6 }, { "key": "lifecycle", "label": "Platform security and lifecycle", "weight": 10 } ], "groups": { "enterprise": "Enterprise virtual appliance", "opensource": "Open-source platform", "smb": "Small office and prosumer", "router": "Router operating system" }, "platforms": [ { "key": "fortigate", "name": "Fortinet FortiGate-VM (FortiOS)", "short": "FortiGate-VM", "kind": "product", "group": "enterprise", "since": 2015, "archetype": "Real innovator with a long KEV record", "grade": "B", "driver": "V", "mix": { "V": 46, "C": 38, "M": 0, "U": 8, "P": 8 }, "idx": 0.55, "domains": { "routing": { "2015": 3, "2016": 3, "2017": 3, "2018": 4, "2019": 4.5, "2020": 4.5, "2021": 4.5, "2022": 4.5, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "firewall": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 4.5, "2020": 4.5, "2021": 4.5, "2022": 4.5, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "vpn": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 4, "2021": 4.5, "2022": 4.5, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "threat": { "2015": 4, "2016": 4, "2017": 4, "2018": 4.5, "2019": 4.5, "2020": 4.5, "2021": 4.5, "2022": 5, "2023": 5, "2024": 5, "2025": 5, "2026": 5 }, "services": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "platform": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "ha": { "2015": 4.5, "2016": 4.5, "2017": 4.5, "2018": 4.5, "2019": 4.5, "2020": 4.5, "2021": 4.5, "2022": 4.5, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "mgmt": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 4, "2019": 4, "2020": 4.5, "2021": 4.5, "2022": 4.5, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "observability": { "2015": 3.5, "2016": 4, "2017": 4, "2018": 4, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "lifecycle": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 2.5, "2024": 2, "2025": 2, "2026": 2 } }, "cred": [ [ "Cadence", 4, "One feature train a year since 6.0 (March to July) with monthly patches; lifecycle windows are published, patch dates are not" ], [ "Roadmap transparency", 2, "Public release notes and admin guides; no public roadmap, direction appears at the Accelerate conference" ], [ "Say-do", 3, "8.0 shipped about six weeks after its 2026-03-10 announcement; the AI agents announced with it are not verified as GA; few other announcements could be tracked" ], [ "Velocity", 4, "Several substantive capabilities per train (SD-WAN, ZTNA, GenAI controls)" ], [ "Lifecycle stability", 4, "Three years of engineering support plus 18 months per train, in-place upgrades; 7.2 ended 2026-09-30 on schedule" ] ], "comm": [ [ "Price and licence volatility", 2, "No list price, so changes cannot be checked; legacy FC-10-FVM UTP SKUs carry a last service extension notice while FGVVS SKUs replace them (date not found)" ], [ "Purchase constraints", 3, "Subscription per vCPU tier; the permanent evaluation licence is limited to 1 vCPU, 3 policies and 3 routes" ], [ "Channel and access", 3, "Direct and partner sales; firmware images need a FortiCare account and a support contract" ], [ "Owner stability", 0.5, "Independent public company since 2000" ], [ "Cost of staying supported", 2.5, "Firmware updates are free within support; FortiGuard signatures and support are renewed per term" ] ], "risk": "commercial", "lock": [ [ "Formats", 3.5, "Proprietary FortiOS CLI configuration text; backup and restore documented, no standard export" ], [ "Export path", 3, "Migration to another vendor is manual or through that vendor's converter; FortiConverter only imports" ], [ "Stack coupling", 1.5, "Runs alone; FortiManager and FortiAnalyzer are optional and licensed separately" ], [ "Hardware / cloud coupling", 1.5, "Any listed hypervisor or cloud; the VM licence is bound to the FortiCare account and vCPU count" ], [ "Skills and tooling coupling", 3, "FortiOS CLI and NSE certification; Terraform and Ansible content is vendor specific" ] ], "integ": [ [ "Partner programme openness", 4, "Engage partner programme with tiers; MSP consumption licensing through FortiFlex (terms not read)" ], [ "Multi-tenancy and self-service", 4, "VDOMs on the firewall and ADOMs in FortiManager; no built-in self-service portal" ], [ "API and infrastructure-as-code", 4, "REST API across the configuration; vendor Terraform provider and Ansible collection" ], [ "Skills and certification", 4.5, "NSE certification programme with exams and a large talent pool" ] ], "alt": null, "ranked": true, "reading": "FortiGate-VM scores at the top of the enterprise group on capability because routing, SD-WAN, VPN, threat protection and platform breadth are all strong and the price of entry is a permanent evaluation licence. The score it loses is in platform security: seven FortiOS entries on the CISA KEV catalogue since 2023, four of them flagged for ransomware use, take the lifecycle domain down by the full 1.5. Credibility is held back by the lack of a public roadmap. The buyer's one check is the patch process: with a new train every year and several exploited flaws a year, the question is how fast your team can move FortiOS to a fixed build. Proxmox VE users should also note that Fortinet names Xen and KVM, never Proxmox.", "report": "/reports/firewall-router-ledger-2026/fortigate", "ai": { "infra": { "2015": 1, "2016": 1, "2017": 1, "2018": 1, "2019": 1, "2020": 1, "2021": 1, "2022": 1, "2023": 1, "2024": 1, "2025": 1, "2026": 3 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 3 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0.5 }, "agents": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 2, "2026": 2 } }, "ai_basis": { "infra": "8.0: application control for GenAI services with MCP and A2A visibility GA (vendor claim via trade press); FortiGuard ML models not verified", "stack": "8.0: FortiView for AI (shadow AI visibility) and GenAI policy controls GA", "ops": "8.0: AI agents for troubleshooting and configuration announced 2026-03; GA not verified, counted as a half step", "agents": "REST API with tokens; only third-party MCP servers exist" }, "ai_ledger": { "announced": 4, "ga": 3, "preview": 0, "pending": 1, "dropped": 0, "note": "GA: GenAI application control, MCP and A2A visibility and FortiView for AI, all in 8.0; pending: the conversational AI agents, whose GA status could not be verified." }, "ai_reading": "Fortinet's AI work in 8.0 is about seeing and controlling AI traffic rather than running the firewall with AI, and that part shipped. The operator agents are announced only, and there is no official MCP server, so agents drive FortiOS through the REST API today.", "mom": -2, "credT": 17, "commT": 11, "lockT": 12.5, "integT": 16.5 }, { "key": "opnsense", "name": "OPNsense (Deciso, Community and Business editions)", "short": "OPNsense", "kind": "product", "group": "opensource", "since": 2015, "archetype": "Dependable builder", "grade": "A", "driver": "C", "mix": { "V": 0, "C": 53, "M": 0, "U": 40, "P": 7 }, "idx": 0, "domains": { "routing": { "2015": 1.5, "2016": 1.5, "2017": 1.5, "2018": 2.5, "2019": 2.5, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3.5 }, "firewall": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "vpn": { "2015": 2.5, "2016": 2.5, "2017": 3, "2018": 3, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "threat": { "2015": 1, "2016": 2, "2017": 2, "2018": 3, "2019": 3, "2020": 3, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "services": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3.5, "2024": 4, "2025": 4, "2026": 4 }, "platform": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2, "2020": 2, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "ha": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "mgmt": { "2015": 1.5, "2016": 1.5, "2017": 1.5, "2018": 1.5, "2019": 2, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 3, "2025": 3.5, "2026": 3.5 }, "observability": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "lifecycle": { "2015": 2.5, "2016": 2.5, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 } }, "cred": [ [ "Cadence", 5, "Two majors a year on fixed dates since 15.1 (2015-01-05); the roadmap table shows every major delivered on its date; point releases every one to three weeks" ], [ "Roadmap transparency", 4, "Public roadmap page with planned items per release, open GitHub repositories and issue tracker; no support windows or end-of-life dates published" ], [ "Say-do", 4, "Roadmap items for 23.1 to 26.7 shipped in the named release; OpenVPN DCO stayed experimental from 24.7 with no GA found; 27.1 items pending" ], [ "Velocity", 3.5, "Each release rewrites several pages onto the MVC API and brings one or two capabilities (Kea HA, Suricata 8 inline, Dnsmasq DHCP); fewer new features than migrations" ], [ "Lifecycle stability", 3, "Six-month cycle with in-place upgrades and clean deprecation notices; the previous series stops receiving fixes at once; PPTP, L2TP and IKEv1 removal planned for 27.1" ] ], "comm": [ [ "Price and licence volatility", 0.5, "BSD licence unchanged; Business Edition listed at 149 EUR per year on 2026-10-15; no earlier price captured, no licence change found since 2023" ], [ "Purchase constraints", 0.5, "Community Edition free with every feature; Business Edition per installation in any quantity; a cluster needs two subscriptions" ], [ "Channel and access", 1, "Open download and open security fixes for everyone; Business repository lags the Community Edition by design; partner terms unpublished" ], [ "Owner stability", 1, "Small private Dutch company, founder-led, no acquisition found; size is the dependency" ], [ "Cost of staying supported", 1.5, "Updates are free, but staying patched means moving to a new series every six months; no LTS to stay on" ] ], "risk": "commercial", "lock": [ [ "Formats", 1, "One XML configuration file (config.xml) with documented backup and restore; plugins push backups to Git, Nextcloud, Google Drive and SFTP" ], [ "Export path", 1.5, "No converter to or from other firewalls; pfSense XML is not directly compatible; rules rebuilt by hand or through the API" ], [ "Stack coupling", 0, "Any storage, any switch; nothing beyond the host" ], [ "Hardware / cloud coupling", 0.5, "Any x86-64 machine or hypervisor, fully offline; no ARM build" ], [ "Skills and tooling coupling", 1, "FreeBSD and pf skills, less common than Linux; open REST API" ] ], "integ": [ [ "Partner programme openness", 2.5, "Resellers exist (Thomas-Krenn and others) and Deciso sells direct; partner programme terms not found on opnsense.org or deciso.com" ], [ "Multi-tenancy and self-service", 2, "OPNcentral in the Business Edition manages several firewalls; no tenancy, quotas or portal" ], [ "API and infrastructure-as-code", 3, "MVC REST API covers most objects by 26.7; Terraform providers and Ansible collections are community-maintained" ], [ "Skills and certification", 2.5, "Large community documentation and forum; Deciso training exists, no certification track verified" ] ], "alt": null, "ranked": true, "reading": "OPNsense earns its credibility score the plain way: eleven years of majors on the dates the roadmap named, with every feature in the free edition and a point release whenever a fix is ready. Capability sits in the solid band across the board because the project keeps rebuilding its own pages onto the API rather than adding enterprise layers, so central management, VRFs, TLS inspection and ARM are missing while VPN, DHCP and firewall basics are complete. The commercial and lock-in scores are among the lowest in the Ledger because nothing is gated and the configuration is one XML file. A buyer should check how the six-month series change fits their change window, since the previous series stops receiving fixes as soon as the next one ships.", "report": "/reports/firewall-router-ledger-2026/opnsense", "ai": { "infra": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "agents": { "2015": 1, "2016": 1, "2017": 1, "2018": 1, "2019": 1, "2020": 1, "2021": 1, "2022": 1, "2023": 1, "2024": 2, "2025": 2, "2026": 2 } }, "ai_basis": { "infra": "None", "stack": "None", "ops": "None", "agents": "24.1 onwards: REST API with key and secret covers firewall rules, NAT, aliases, VPN, DNS and DHCP; community MCP servers (vespo92/OPNSenseMCP 0.8.2, lucamarien) exist; an AGENTS.md file sits in the core repository; no official MCP server" }, "ai_ledger": { "announced": 0, "ga": 0, "preview": 0, "pending": 0, "dropped": 0, "note": "No AI item was announced by Deciso between 2023 and 2026." }, "ai_reading": "OPNsense has no AI in its threat engine, no assistant in the console and no AI announcements; Suricata signatures and third-party rulesets do the detection. Its REST API is broad enough for agents to drive, which is why community MCP servers appeared in 2025 without any Deciso involvement.", "mom": 7.4, "credT": 19.5, "commT": 4.5, "lockT": 4, "integT": 10 }, { "key": "paloalto", "name": "Palo Alto Networks VM-Series (PAN-OS)", "short": "VM-Series", "kind": "product", "group": "enterprise", "since": 2015, "archetype": "Dependable builder under exploitation pressure", "grade": "B", "driver": "C", "mix": { "V": 21, "C": 50, "M": 14, "U": 0, "P": 14 }, "idx": 0.25, "domains": { "routing": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 3.5, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "firewall": { "2015": 4.5, "2016": 4.5, "2017": 4.5, "2018": 4.5, "2019": 5, "2020": 5, "2021": 5, "2022": 5, "2023": 5, "2024": 5, "2025": 5, "2026": 5 }, "vpn": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 4, "2022": 4, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "threat": { "2015": 4, "2016": 4, "2017": 4, "2018": 4, "2019": 4.5, "2020": 5, "2021": 5, "2022": 5, "2023": 5, "2024": 5, "2025": 5, "2026": 5 }, "services": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "platform": { "2015": 2.5, "2016": 2.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 4, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "ha": { "2015": 4, "2016": 4, "2017": 4, "2018": 4, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4.5, "2026": 4.5 }, "mgmt": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 4.5, "2020": 4.5, "2021": 4.5, "2022": 4.5, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "observability": { "2015": 4, "2016": 4, "2017": 4, "2018": 4, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "lifecycle": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 2, "2025": 2, "2026": 2 } }, "cred": [ [ "Cadence", 4, "A feature release every six to twelve months (11.1 2023-11, 11.2 2024-05, 12.1 2025-08) with a published lifecycle table" ], [ "Roadmap transparency", 2.5, "Public release notes, lifecycle table and compatibility matrix; direction appears in blogs and keynotes, no dated roadmap" ], [ "Say-do", 3, "The tracked items (12.1 Orion, Hyperscale Security Fabric, post-quantum VPN) shipped; too few announcements were collected for a full record" ], [ "Velocity", 4, "Several substantive capabilities per release since 10.2" ], [ "Lifecycle stability", 3.5, "48 month windows for majors and in-place upgrades, but fixed VM models were retired in 2024 and VM-Series accelerated feature releases get only 12 months" ] ], "comm": [ [ "Price and licence volatility", 3, "Fixed-capacity VM licences ended 2024-07-31; credits are the only model and have no public price" ], [ "Purchase constraints", 3.5, "Subscription only, quote only, no free production tier" ], [ "Channel and access", 3, "Channel and direct sales; software and content updates need a support portal login and entitlement" ], [ "Owner stability", 0.5, "Independent public company since 2005" ], [ "Cost of staying supported", 3.5, "Extended support months 37 to 48 carry Critical and High fixes only; VM-Series feature releases outside the long-support trains expire after 12 months" ] ], "risk": "commercial", "lock": [ [ "Formats", 3, "XML configuration, exportable and loadable, but proprietary in structure" ], [ "Export path", 2.5, "Expedition converts into PAN-OS; leaving means a manual rebuild or another vendor's converter" ], [ "Stack coupling", 2.5, "Panorama or Strata Cloud Manager for fleets; subscriptions for threat, DNS and SD-WAN features" ], [ "Hardware / cloud coupling", 1.5, "Any listed hypervisor or cloud; credits are bound to a deployment profile" ], [ "Skills and tooling coupling", 3.5, "PAN-OS specific skills (PCNSA, PCNSE) and tooling" ] ], "integ": [ [ "Partner programme openness", 4, "NextWave partner programme and cloud marketplaces; terms not read" ], [ "Multi-tenancy and self-service", 4, "Virtual systems, Panorama device groups and templates, Strata Cloud Manager tenants" ], [ "API and infrastructure-as-code", 4.5, "XML and REST APIs, vendor Terraform provider, pan-os-ansible collection" ], [ "Skills and certification", 4.5, "Exam-based PCNSA and PCNSE certifications with a large talent pool" ] ], "alt": null, "ranked": true, "reading": "VM-Series keeps the reference score for policy and threat protection, and the 12.1 train added clustering and Secure Boot for the virtual edition. Two things pull the Ledger Index down. The lifecycle domain carries the full KEV penalty, with nine PAN-OS entries since April 2024 and three flagged for ransomware use, most of them on the management interface or GlobalProtect portal. Commercial risk is the highest in its group because fixed licences are gone, prices are quote only and support outside the long trains is short. The buyer's check is exposure: keep the management interface off the internet and plan upgrades for the 12 month feature-release windows.", "report": "/reports/firewall-router-ledger-2026/paloalto", "ai": { "infra": { "2015": 1, "2016": 1, "2017": 1, "2018": 1, "2019": 1, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 2.5, "2025": 2.5, "2026": 2.5 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0.5, "2025": 0.5, "2026": 0.5 }, "agents": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 2, "2026": 2 } }, "ai_basis": { "infra": "10.0: cloud-delivered inline detection services; the vendor describes them as machine learning driven, which was not verified from primary pages in this edition", "stack": "None", "ops": "Strata Copilot is a vendor claim not verified as GA for PAN-OS administration; counted as a half step", "agents": "XML and REST APIs with tokens; only third-party MCP servers exist" }, "ai_ledger": { "announced": 0, "ga": 0, "preview": 0, "pending": 0, "dropped": 0, "note": "No AI announcements were collected for this edition; Precision AI, Strata Copilot and the AI security add-ons are vendor claims that were not checked and are listed as open questions." }, "ai_reading": "Palo Alto Networks talks about AI more than this scorecard credits, because the research pass did not verify the claims. What is verifiable is an API that agents can drive and no official MCP server, so the AI leverage score is low until the next edition checks the AI items.", "mom": 0, "credT": 17, "commT": 13.5, "lockT": 13, "integT": 17 }, { "key": "checkpoint", "name": "Check Point CloudGuard Network Security (Quantum Gaia)", "short": "Check Point CloudGuard", "kind": "product", "group": "enterprise", "since": 2015, "archetype": "Dependable builder with an AI push", "grade": "C", "driver": "C", "mix": { "V": 27, "C": 64, "M": 9, "U": 0, "P": 0 }, "idx": 0.27, "domains": { "routing": { "2015": 2.5, "2016": 2.5, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "firewall": { "2015": 4, "2016": 4, "2017": 4.5, "2018": 4.5, "2019": 4.5, "2020": 4.5, "2021": 4.5, "2022": 4.5, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "vpn": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "threat": { "2015": 4, "2016": 4, "2017": 4.5, "2018": 4.5, "2019": 4.5, "2020": 4.5, "2021": 4.5, "2022": 5, "2023": 5, "2024": 5, "2025": 5, "2026": 5 }, "services": { "2015": 2.5, "2016": 2.5, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "platform": { "2015": 2, "2016": 2, "2017": 2.5, "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 3, "2025": 3, "2026": 3 }, "ha": { "2015": 4.5, "2016": 4.5, "2017": 4.5, "2018": 4.5, "2019": 4.5, "2020": 4.5, "2021": 4.5, "2022": 4.5, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "mgmt": { "2015": 3.5, "2016": 3.5, "2017": 4, "2018": 4, "2019": 4, "2020": 4.5, "2021": 4.5, "2022": 4.5, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "observability": { "2015": 3.5, "2016": 3.5, "2017": 4, "2018": 4, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "lifecycle": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3, "2025": 3, "2026": 2.5 } }, "cred": [ [ "Cadence", 3.5, "A major about every 14 months (R81.20 2022-11, R82 2024-10, R82.10 2025-12) with jumbo hotfix takes in between; dates are not announced in advance" ], [ "Roadmap transparency", 2, "Release notes and lifecycle page are public; downloads and parts of the documentation need a login; no public roadmap" ], [ "Say-do", 3, "R82 and R82.10 shipped as announced; the AI Copilot and Agentic Exposure Validation items could not be verified as GA" ], [ "Velocity", 3.5, "One or two substantive capabilities per major plus steady hotfix takes" ], [ "Lifecycle stability", 4, "Four-year minimum support, in-place upgrades; the R81.20 end date moved between pages" ] ], "comm": [ [ "Price and licence volatility", 2.5, "No public price for virtual editions; marketplace listings are usage based; no change could be checked" ], [ "Purchase constraints", 3.5, "Quote only, subscription and management server required" ], [ "Channel and access", 3.5, "Partner and marketplace sales; downloads and hotfixes behind the Support Center login" ], [ "Owner stability", 0.5, "Independent public company since 1993" ], [ "Cost of staying supported", 3, "Four-year windows; management and gateway must be upgraded in step; blades renewed per term" ] ], "risk": "commercial", "lock": [ [ "Formats", 3.5, "Policy and objects live in the management database; export through the management API and migrate tools" ], [ "Export path", 3, "Leaving means a manual rebuild or another vendor's converter" ], [ "Stack coupling", 3, "A Security Management or Multi-Domain server is required; features sold as blades" ], [ "Hardware / cloud coupling", 2, "Virtual and cloud images exist but the supported hypervisor list is unpublished outside the HCL" ], [ "Skills and tooling coupling", 3.5, "SmartConsole and Gaia skills; CCSA and CCSE certifications" ] ], "integ": [ [ "Partner programme openness", 4, "Channel partner programme and marketplaces; terms not read" ], [ "Multi-tenancy and self-service", 4.5, "Multi-Domain Server and VSX virtual systems for provider tenancy" ], [ "API and infrastructure-as-code", 4, "Management API covers all objects; Terraform provider and Ansible collection exist (vendor status not verified)" ], [ "Skills and certification", 4.5, "Exam-based CCSA and CCSE with a long-established talent pool" ] ], "alt": null, "ranked": true, "reading": "Check Point scores where it always has: policy management, threat prevention and clustering are at or near the reference, and the four-year support windows are the longest in the group. It loses points on platform freedom because the hypervisor list for the virtual gateway lives on a compatibility list this edition could not read, no KVM or ARM image was found, and a management server is mandatory. The security record is better than Fortinet's or Palo Alto's on the gateway itself, with two entries, but 2026 brought three more exploited flaws on the management side. The buyer's check is the management plane: SmartConsole and the management server need the same patch discipline as the gateway.", "report": "/reports/firewall-router-ledger-2026/checkpoint", "ai": { "infra": { "2015": 1, "2016": 1, "2017": 1, "2018": 1, "2019": 1, "2020": 1, "2021": 1, "2022": 1, "2023": 1, "2024": 1, "2025": 3, "2026": 3 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 3, "2026": 3 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0.5, "2026": 0.5 }, "agents": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 3, "2026": 3 } }, "ai_basis": { "infra": "R82.10: GenAI application visibility including MCP usage and AI-related threat prevention GA (community post, vendor claim)", "stack": "R82.10: GenAI application controls GA; Agentic Exposure Validation announced 2026, not verified", "ops": "AI Copilot for administrators exists in the community; GA status not verified, counted as a half step", "agents": "Official Quantum Management MCP server on GitHub (CheckPointSW/mcp-servers), version 0.0.10, preview grade; R82.10 compatibility not stated" }, "ai_ledger": { "announced": 4, "ga": 1, "preview": 1, "pending": 2, "dropped": 0, "note": "GA: GenAI visibility in R82.10; preview: the Quantum Management MCP server; pending: AI Copilot GA status and Agentic Exposure Validation." }, "ai_reading": "Check Point is the only vendor in this group with an official MCP server for its management plane, which lifts agent openness even though the server is below version 1. The GenAI visibility in R82.10 and the Copilot are vendor claims seen through community posts, so the AI say-do record is mostly unverified.", "mom": -1, "credT": 16, "commT": 13, "lockT": 15, "integT": 17 }, { "key": "ciscoftd", "name": "Cisco Secure Firewall Threat Defense Virtual (and ASAv)", "short": "Cisco Threat Defense Virtual", "kind": "product", "group": "enterprise", "since": 2015, "archetype": "Dependable builder, slowed by renames", "grade": "B", "driver": "C", "mix": { "V": 27, "C": 73, "M": 0, "U": 0, "P": 0 }, "idx": 0.27, "domains": { "routing": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3.5, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "firewall": { "2015": 3.5, "2016": 4, "2017": 4, "2018": 4, "2019": 4, "2020": 4, "2021": 4, "2022": 4.5, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "vpn": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 4, "2024": 4, "2025": 4.5, "2026": 4.5 }, "threat": { "2015": 2.5, "2016": 4, "2017": 4, "2018": 4, "2019": 4, "2020": 4, "2021": 4, "2022": 4.5, "2023": 4.5, "2024": 4.5, "2025": 5, "2026": 5 }, "services": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "platform": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 3.5, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "ha": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 4.5, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "mgmt": { "2015": 3, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 4, "2021": 4, "2022": 4, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "observability": { "2015": 3, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "lifecycle": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3, "2024": 2, "2025": 2, "2026": 2 } }, "cred": [ [ "Cadence", 3.5, "A feature release about yearly (7.4 2023, 7.6 2024, 7.7 2025-03, 10.0 2025-12) with maintenance builds; dates conflict across Cisco pages and are not announced in advance" ], [ "Roadmap transparency", 2.5, "Public release notes, data sheets and advisories; direction in blogs and Cisco Live sessions; no dated roadmap" ], [ "Say-do", 3, "ZTNA, SnortML and Hyper-V shipped as announced; the Mesh Policy Engine status could not be verified" ], [ "Velocity", 3.5, "One or two substantive capabilities per release" ], [ "Lifecycle stability", 2.5, "Renamed from FTDv to NGFWv to Threat Defense Virtual, numbering jumped from 7.7 to 10.0, and the Management Center must be upgraded in step with devices" ] ], "comm": [ [ "Price and licence volatility", 2.5, "Performance-tier licensing since 7.0; no public price, so changes cannot be checked" ], [ "Purchase constraints", 3.5, "Subscription only through Smart Licensing; a Management Center or cloud management licence is required" ], [ "Channel and access", 3.5, "Partner and distributor sales; downloads need a Cisco account with an active contract" ], [ "Owner stability", 0.5, "Independent public company; the firewall line has been in-house since 2013" ], [ "Cost of staying supported", 3.5, "Short release windows, paired device and management upgrades, add-on subscriptions renewed per term" ] ], "risk": "commercial", "lock": [ [ "Formats", 3, "Threat Defense configuration lives in the Management Center; ASA configuration is a portable text file" ], [ "Export path", 3, "Cisco's Firewall Migration Tool imports from ASA, Check Point, Palo Alto and Fortinet; leaving is a manual rebuild" ], [ "Stack coupling", 3, "Management Center or cloud management, Smart Licensing and Talos subscriptions are required" ], [ "Hardware / cloud coupling", 2, "Any listed hypervisor or cloud; FTDvU only on VMware and KVM" ], [ "Skills and tooling coupling", 3, "ASA and Threat Defense skills (CCNP Security); vendor-specific Terraform and Ansible content" ] ], "integ": [ [ "Partner programme openness", 4, "Large global partner programme with specialisations; terms not read" ], [ "Multi-tenancy and self-service", 3.5, "Multi-domain in the Management Center; no self-service portal" ], [ "API and infrastructure-as-code", 4, "Management Center REST API, Terraform provider and Ansible collections" ], [ "Skills and certification", 4.5, "CCNP and CCIE Security certifications with the largest talent pool in the group" ] ], "alt": null, "ranked": true, "reading": "Threat Defense Virtual scores well on platform list, clustering and threat protection, and 10.0 added Hyper-V and the 64 vCPU tier. The lifecycle domain carries the full KEV penalty: nine ASA and FTD entries since 2023, including the ArcaneDoor pair in 2024 and two more in September 2025, plus three Management Center entries in 2026. Credibility suffers from the renames and the numbering jump to 10.0, which make release dates hard to pin down even from Cisco's own pages. The buyer's check is the management plane: the Management Center is mandatory, licensed separately, and now has its own exploited flaws, so budget for its patching alongside the firewalls.", "report": "/reports/firewall-router-ledger-2026/ciscoftd", "ai": { "infra": { "2015": 1, "2016": 1, "2017": 1, "2018": 1, "2019": 1, "2020": 1, "2021": 1, "2022": 1, "2023": 1, "2024": 1, "2025": 3, "2026": 3 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0.5, "2026": 0.5 }, "agents": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 2, "2026": 2 } }, "ai_basis": { "infra": "10.0: SnortML machine learning detection GA for SQL injection, command injection and cross-site scripting (Cisco blog)", "stack": "None", "ops": "Cisco AI Assistant for Security Cloud Control is a vendor claim not verified for the Management Center; counted as a half step", "agents": "Management Center REST API with tokens; no official MCP server found" }, "ai_ledger": { "announced": 2, "ga": 1, "preview": 0, "pending": 1, "dropped": 0, "note": "GA: SnortML in 10.0; pending: the AI Assistant for firewall administration, whose scope and GA status were not verified." }, "ai_reading": "Cisco is the only vendor in this group with machine-learning detection verified as GA on the firewall itself, through SnortML in 10.0. Everything else is an API that agents can drive; no official MCP server was found and the AI Assistant claims were not checked.", "mom": 2.8, "credT": 15, "commT": 13.5, "lockT": 14, "integT": 16 }, { "key": "vyos", "name": "VyOS (VyOS Networks: LTS, Stream and rolling)", "short": "VyOS", "kind": "product", "group": "router", "since": 2015, "archetype": "Dependable builder", "grade": "B", "driver": "C", "mix": { "V": 24, "C": 53, "M": 6, "U": 6, "P": 12 }, "idx": 0.29, "domains": { "routing": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3.5, "2020": 3.5, "2021": 4, "2022": 4, "2023": 4, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "firewall": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "vpn": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 3.5, "2020": 3.5, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "threat": { "2015": 0.5, "2016": 0.5, "2017": 0.5, "2018": 0.5, "2019": 0.5, "2020": 0.5, "2021": 0.5, "2022": 0.5, "2023": 0.5, "2024": 0.5, "2025": 0.5, "2026": 0.5 }, "services": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2.5, "2020": 2.5, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "platform": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3.5, "2026": 4 }, "ha": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3.5 }, "mgmt": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "observability": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 2.5, "2026": 3 }, "lifecycle": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 3, "2024": 3, "2025": 3, "2026": 3.5 } }, "cred": [ [ "Cadence", 3.5, "About three LTS patch releases a year and monthly Stream images; LTS majors are irregular (1.3 in 2021, 1.4 in 2024, 1.5 in 2026) and dates are not published ahead" ], [ "Roadmap transparency", 3.5, "Public Phabricator tracker, blog posts and Stream previews of the next LTS; no dated roadmap" ], [ "Say-do", 3, "1.4 LTS promised for 2023 shipped in June 2024; VPP announced in 2023 reached GA in 2026; the Stream channel arrived as announced; aarch64 pending" ], [ "Velocity", 4, "nftables rebuild, Kea, HTTP API sync, segment routing and the VPP dataplane within three years" ], [ "Lifecycle stability", 3, "Two-year LTS lines with a published minor policy and image rollback; 1.4 went to maintenance mode after 27 months; LTS access rules changed in 2018 and 2021" ] ], "comm": [ [ "Price and licence volatility", 2.5, "Tiers restructured on 2023-03-05 (Corporate 8,000, 3 or 5 year terms only); the 2026 page lists Corporate at 10,000 USD annual; prices on different VyOS pages conflict" ], [ "Purchase constraints", 3.5, "LTS images need a subscription from about 600 EUR (Professional, unconfirmed) to 10,000 USD per year, or a build from source; rolling and Stream are free but unsupported" ], [ "Channel and access", 3.5, "LTS downloads behind a support login; subscribers received the 1.5.1 and 1.4.5 security fixes five weeks before the public release" ], [ "Owner stability", 2, "Small private company; acquired its own support subsidiary in 2024; ownership and incorporation not published" ], [ "Cost of staying supported", 3, "Supported LTS requires an annual subscription; each LTS line lasts about two years with minors unsupported once three newer ones exist" ] ], "risk": "commercial", "lock": [ [ "Formats", 1, "One plain-text configuration tree with set and delete commands, import and export; migration scripts carry the syntax between versions" ], [ "Export path", 1, "Configuration is readable text; converting to another vendor's syntax is manual; Vyatta and EdgeOS syntax is close" ], [ "Stack coupling", 0, "Any storage, any switch; standard Linux networking" ], [ "Hardware / cloud coupling", 0.5, "Any x86-64 machine or the listed clouds; fully offline; aarch64 not yet shipped" ], [ "Skills and tooling coupling", 1.5, "Debian skills transfer; the Vyatta-style CLI is its own dialect; official Ansible collection and HTTP API" ] ], "integ": [ [ "Partner programme openness", 3.5, "Alliance tier for service providers from 25,000 USD per year with deployment rights, APT repository and certification vouchers; direct sales and marketplaces; terms beyond Alliance not found" ], [ "Multi-tenancy and self-service", 2, "VRFs and VRRP for tenant separation; no controller, portal or multi-site manager" ], [ "API and infrastructure-as-code", 3.5, "HTTP API, official vyos.vyos Ansible collection tested on 1.3.8, 1.4.1 and 1.5; Terraform documented for the clouds, no VyOS provider" ], [ "Skills and certification", 3, "VCNE (VyOS Certified Network Engineer) exists; a network engineer with Vyatta or Linux routing experience adapts quickly" ] ], "alt": null, "ranked": true, "reading": "VyOS scores highest in this group on routing because VRFs, MPLS, segment routing, IS-IS and RPKI shipped years ago and the 1.5 line added a VPP dataplane; it scores lowest on threat protection because it has no IDS, IPS or filtering engine at all. The commercial score carries the cost of that focus: LTS images are reserved for subscribers, the cheapest published on-premises tier is 10,000 USD per year, and in 2026 subscribers received security fixes five weeks before everyone else. A buyer running the free rolling or Stream images should treat them as what the vendor calls them, previews without support, and a buyer paying for LTS should check which tier and term the current price page actually offers, since the pages read in this pass disagree.", "report": "/reports/firewall-router-ledger-2026/vyos", "ai": { "infra": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "agents": { "2015": 1, "2016": 1, "2017": 1, "2018": 1, "2019": 1, "2020": 1, "2021": 1, "2022": 1, "2023": 1, "2024": 2, "2025": 2, "2026": 2 } }, "ai_basis": { "infra": "None", "stack": "None", "ops": "None", "agents": "1.4.0: HTTP API with key authentication that agents and Ansible drive; community MCP servers (alch3mistdev, danielbodnar) exist; no official MCP server" }, "ai_ledger": { "announced": 0, "ga": 0, "preview": 0, "pending": 0, "dropped": 0, "note": "No AI item was announced by VyOS Networks between 2023 and 2026." }, "ai_reading": "VyOS has no IDS or IPS, so there is nothing for AI to detect, and no assistant in the console. Its HTTP API and official Ansible collection are the agent surface; community MCP servers wrap that API without vendor involvement.", "mom": 11.6, "credT": 17, "commT": 14.5, "lockT": 4, "integT": 12 }, { "key": "vsrx", "name": "Juniper vSRX (Junos OS)", "short": "Juniper vSRX", "kind": "product", "group": "enterprise", "since": 2015, "archetype": "Dependable builder under a new owner", "grade": "C", "driver": "C", "mix": { "V": 13, "C": 38, "M": 0, "U": 25, "P": 25 }, "idx": 0.25, "domains": { "routing": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 4, "2020": 4, "2021": 4, "2022": 4.5, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "firewall": { "2015": 3.5, "2016": 3.5, "2017": 4, "2018": 4, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "vpn": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "threat": { "2015": 3, "2016": 3, "2017": 3.5, "2018": 3.5, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "services": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "platform": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "ha": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "mgmt": { "2015": 4, "2016": 4, "2017": 4, "2018": 4, "2019": 4, "2020": 4, "2021": 4.5, "2022": 4.5, "2023": 4.5, "2024": 4.5, "2025": 4.5, "2026": 4.5 }, "observability": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "lifecycle": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 2, "2024": 2, "2025": 2, "2026": 2 } }, "cred": [ [ "Cadence", 4, "Two Junos trains a year (24.4, 25.2, 25.4) on a published schedule with extended end-of-engineering releases" ], [ "Roadmap transparency", 2.5, "Public release notes and end-of-life dates; no public roadmap; HPE integration plans not published for vSRX" ], [ "Say-do", 3, "Trains ship on cadence; too few vSRX announcements were found to check against delivery" ], [ "Velocity", 3, "Maintenance and incremental features on the vSRX line; the release notes' vSRX sections were not read" ], [ "Lifecycle stability", 3, "Long trains and in-place upgrades, but vSRX 2.0 was retired at 22.4 and the owner changed in 2025" ] ], "comm": [ [ "Price and licence volatility", 2, "Flex subscription since 2021 with no change found since 2023; no public price to check" ], [ "Purchase constraints", 3.5, "Subscription only, per vCPU and tier, minimum 2 vCPU; quote based" ], [ "Channel and access", 3.5, "Juniper and HPE partners; downloads need a support account and contract" ], [ "Owner stability", 3, "Acquired by HPE on 2025-07-02; portfolio integration in progress" ], [ "Cost of staying supported", 3, "Three-year trains and 1, 3 or 5 year terms; a licence from before 21.1R1 expires after a 30 day grace period unless replaced" ] ], "risk": "commercial", "lock": [ [ "Formats", 2.5, "Hierarchical Junos text configuration, exportable and loadable" ], [ "Export path", 2.5, "Configuration is readable text; policy translation to another vendor is manual" ], [ "Stack coupling", 2.5, "Runs alone; Security Director and ATP Cloud are optional subscriptions" ], [ "Hardware / cloud coupling", 1.5, "Any listed hypervisor or cloud; licence bound to vCPU count" ], [ "Skills and tooling coupling", 3, "Junos skills (JNCIS-SEC, JNCIP-SEC); NETCONF and Ansible content is standard but Junos specific" ] ], "integ": [ [ "Partner programme openness", 3.5, "Juniper Partner Advantage; the merge with HPE's programme was not verified" ], [ "Multi-tenancy and self-service", 3.5, "Logical systems and tenant systems; Security Director Cloud for fleets; no self-service portal" ], [ "API and infrastructure-as-code", 4, "NETCONF and REST, vendor Ansible collection; Terraform provider community maintained" ], [ "Skills and certification", 4, "Exam-based JNCIA to JNCIE security tracks" ] ], "alt": null, "ranked": true, "reading": "vSRX scores on what Junos has always done well: routing policy, a clean text configuration with commit and rollback, and automation through NETCONF and Ansible, which also keeps its lock-in the lowest in the enterprise group. The lifecycle domain takes the full KEV penalty from one J-Web disclosure in November 2023 that produced three SRX entries at once. Commercial risk rose in 2025 because HPE now owns the product and has not published what the integration means for vSRX licensing or the partner programme. The buyer's check is the owner: confirm the vSRX roadmap and support terms under HPE before signing a five-year term.", "report": "/reports/firewall-router-ledger-2026/vsrx", "ai": { "infra": { "2015": 1, "2016": 1, "2017": 1, "2018": 1, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 2, "2026": 2 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "agents": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 3, "2026": 3 } }, "ai_basis": { "infra": "19.x: ATP Cloud with SecIntel threat feeds on vSRX 3.0; vendor-described ML in the cloud service", "stack": "None", "ops": "None", "agents": "Open-source Junos MCP server on GitHub, which Juniper advises to deploy locally for testing until secured; preview grade" }, "ai_ledger": { "announced": 1, "ga": 0, "preview": 1, "dropped": 0, "pending": 0, "note": "The Junos MCP server is open source with a testing-only deployment note; the Routing Director MCP server is documented but belongs to a different product. Marvis covers Mist, and its SRX integration was not verified." }, "ai_reading": "Juniper's AI story lives in Mist and Marvis on the wired and wireless side, and this edition found no verified AI feature inside vSRX itself. The open-source Junos MCP server gives agents a documented path onto the device, with the vendor's own note that it is not yet hardened.", "mom": -3, "credT": 15.5, "commT": 15, "lockT": 12, "integT": 15 }, { "key": "sophos", "name": "Sophos Firewall (virtual, software and Home edition)", "short": "Sophos Firewall", "kind": "product", "group": "enterprise", "since": 2015, "archetype": "Dependable builder", "grade": "B", "driver": "C", "mix": { "V": 25, "C": 63, "M": 0, "U": 0, "P": 13 }, "idx": 0.29, "domains": { "routing": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 3, "2020": 3, "2021": 3, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "firewall": { "2015": 3, "2016": 3, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "vpn": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3.5, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "threat": { "2015": 3, "2016": 3, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4.5 }, "services": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "platform": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "ha": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "mgmt": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3.5, "2021": 3.5, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "observability": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "lifecycle": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 2, "2026": 2 } }, "cred": [ [ "Cadence", 3.5, "A major each year and several maintenance releases (v22 GA December 2025, MR1, MR2 announced 2026-07-14); no published schedule" ], [ "Roadmap transparency", 3, "Public release notes and an open early access programme; no written roadmap" ], [ "Say-do", 3, "The v22 requested-features list shipped; the REST API and AI assistant are still early access; the Home edition RAM change promised for a future update is unconfirmed" ], [ "Velocity", 3.5, "Health Check, NDR Essentials, Config Studio V2 and a new macOS client within one major" ], [ "Lifecycle stability", 2.5, "Only the last two maintenance releases are supported and the previous one is retired on each release; the legacy IPsec remote access retirement blocks upgrades for some firewalls" ] ], "comm": [ [ "Price and licence volatility", 1.5, "One change since 2023, the 2025-03-01 removal of RAM limits, in the buyer's favour; no public prices to track" ], [ "Purchase constraints", 2.5, "Subscription only through partners; the free Home edition is non-commercial and capped at 4 cores and 6 GB" ], [ "Channel and access", 2.5, "Channel-only sales; trial downloads need an account; firmware is free with a valid support licence" ], [ "Owner stability", 3, "Private-equity owner since 2020 (secondary source); the Secureworks acquisition is being folded into the firewall" ], [ "Cost of staying supported", 2, "Firmware updates included with support; staying supported means moving to each new maintenance release" ] ], "risk": "commercial", "lock": [ [ "Formats", 3, "Entities XML backup specific to SFOS" ], [ "Export path", 2.5, "Backup and restore between SFOS devices; converters only from Cyberoam and Sophos UTM" ], [ "Stack coupling", 2, "Runs alone; Central is optional for management, required for ZTNA and MSP features" ], [ "Hardware / cloud coupling", 1.5, "Any x86 hardware or the listed hypervisors; some features such as the Home edition and Wi-Fi tied to editions or hardware" ], [ "Skills and tooling coupling", 3, "Sophos-specific console and certification track" ] ], "integ": [ [ "Partner programme openness", 4, "Open partner programme with MSP terms; all sales go through partners" ], [ "Multi-tenancy and self-service", 3.5, "Sophos Central MSP Flex with multi-tenant firewall group management" ], [ "API and infrastructure-as-code", 2.5, "XML API covers the main objects; REST API only in v23 early access; no vendor Terraform or Ansible content found" ], [ "Skills and certification", 3.5, "Sophos Certified Engineer and Architect tracks" ] ], "alt": null, "ranked": true, "reading": "Sophos Firewall scores near the top of this group on threat protection and management because its sandbox, TLS inspection, NDR and Central management shipped and are documented, and its free Home edition makes it the one enterprise product here a homelab can run without a licence. Two things hold the score back: the lifecycle policy keeps only the last two maintenance releases supported, and the two CISA KEV entries added in February 2025 concern flaws disclosed in 2020, which says more about patching in the field than about the current code. A buyer should check that no legacy IPsec remote access configuration remains, because those firewalls cannot move to v22 MR1 or later. The REST API and the AI assistant are early access and should not be assumed in a purchase.", "report": "/reports/firewall-router-ledger-2026/sophos", "ai": { "infra": { "2015": 0, "2016": 0, "2017": 1.5, "2018": 1.5, "2019": 1.5, "2020": 1.5, "2021": 1.5, "2022": 1.5, "2023": 1.5, "2024": 1.5, "2025": 1.5, "2026": 3 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0.5 }, "agents": { "2015": 1.5, "2016": 1.5, "2017": 1.5, "2018": 1.5, "2019": 1.5, "2020": 1.5, "2021": 1.5, "2022": 1.5, "2023": 1.5, "2024": 1.5, "2025": 1.5, "2026": 1.5 } }, "ai_basis": { "infra": "v22 MR1: NDR Essentials with active threat intelligence on virtual, software and cloud instances (vendor describes AI models)", "stack": "None", "ops": "v23 early access: AI firewall assistant (Sophos Fusion); preview counts half a step", "agents": "XML API over HTTPS that scripts can drive; REST API with token authentication is in v23 early access; no MCP server found" }, "ai_ledger": { "announced": 3, "ga": 1, "preview": 2, "pending": 0, "dropped": 0, "note": "NDR Essentials shipped in v22 MR1; the AI firewall assistant and AI Defense visibility are in v23 early access." }, "ai_reading": "Sophos uses machine learning in its sandbox and in NDR Essentials, which reached virtual and software firewalls with v22 MR1 in 2026. An operator assistant exists only in the v23 early access, and there is no official agent interface beyond the XML API.", "mom": 0.2, "credT": 15.5, "commT": 11.5, "lockT": 12, "integT": 13.5 }, { "key": "pfsense", "name": "pfSense (Netgate: pfSense CE and pfSense Plus)", "short": "pfSense", "kind": "product", "group": "opensource", "since": 2015, "archetype": "Portfolio-led builder", "grade": "A", "driver": "C", "mix": { "V": 6, "C": 50, "M": 0, "U": 19, "P": 25 }, "idx": 0.11, "domains": { "routing": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 3, "2025": 3.5, "2026": 3.5 }, "firewall": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "vpn": { "2015": 3, "2016": 3, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "threat": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3.5 }, "services": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3.5, "2024": 4, "2025": 4, "2026": 4 }, "platform": { "2015": 2, "2016": 2, "2017": 2.5, "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "ha": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "mgmt": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 3, "2026": 3 }, "observability": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2.5, "2024": 3, "2025": 3, "2026": 3 }, "lifecycle": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 3, "2025": 3, "2026": 3 } }, "cred": [ [ "Cadence", 3, "Plus about two majors a year with dates on the versions page; CE irregular, 17 months between 2.7.2 and 2.8.0; 26.10 listed as TBD" ], [ "Roadmap transparency", 2, "No public roadmap; direction appears in release blogs; next version date TBD; Plus source closed" ], [ "Say-do", 3, "Nexus, Snort 3 and Kea HA shipped as announced; the CE 2.8 promise was kept late; the Go GUI is stated direction without a date" ], [ "Velocity", 3.5, "Plus gained Nexus, Kea HA, NAT64, pflow and post-quantum SSH within three years; CE receives them later or not at all" ], [ "Lifecycle stability", 2, "Free Home+Lab withdrawn and repriced within four days in October 2023; a GUI rewrite that may not run on VMs; no published support windows" ] ], "comm": [ [ "Price and licence volatility", 3.5, "Free Home+Lab licence withdrawn on 2023-10-26, TAC Lite at 129 USD added on 2023-10-30; list prices unchanged since then; Nexus added a per-device metric in 2025" ], [ "Purchase constraints", 3, "Plus on own hardware or a VM needs a subscription of at least 129 USD per year per instance; Nexus per managed device; CE remains free" ], [ "Channel and access", 3, "Plus installs through the Netgate Installer with a subscription; Plus patches need a current TAC subscription; Home+Lab installs without one got no updates; CE download is open" ], [ "Owner stability", 1.5, "Private company with a long record; owner details not published; no acquisition found" ], [ "Cost of staying supported", 3, "Plus updates stop without a subscription; new features land in Plus and Nexus first; CE users are encouraged to move to Plus" ] ], "risk": "commercial", "lock": [ [ "Formats", 1.5, "One XML configuration file with encrypted export and free AutoConfigBackup to Netgate's cloud; Plus is closed source" ], [ "Export path", 2, "No vendor converter; moving to OPNsense or another firewall means a rebuild, with community guides only" ], [ "Stack coupling", 0.5, "Runs alone; Nexus is optional today but hosts the new GUI and the newest features" ], [ "Hardware / cloud coupling", 1, "Any x86-64 machine; ARM only on Netgate appliances; Plus tied to the Netgate Installer and subscription; works offline" ], [ "Skills and tooling coupling", 1, "FreeBSD and pf skills with the largest admin pool among software firewalls; no official single-instance API" ] ], "integ": [ [ "Partner programme openness", 2.5, "Resellers and marketplaces exist; partner programme terms not found on netgate.com; Netgate sells direct" ], [ "Multi-tenancy and self-service", 2.5, "Nexus manages many instances with a REST API; early users report no shared objects across instances; no tenancy or portal" ], [ "API and infrastructure-as-code", 2.5, "Nexus REST API for Plus; single instances rely on the community pfREST package; Terraform and Ansible community only" ], [ "Skills and certification", 3, "Netgate training offers and a large pool of experienced administrators; certification track not verified" ] ], "alt": null, "ranked": true, "reading": "pfSense remains a complete firewall with the deepest pool of administrators, and its capability line keeps pace with OPNsense on VPN, DHCP and observability. What separates the two is the commercial record: the free Plus licence for home use vanished and came back as a 129 USD subscription within four days in October 2023, the Community Edition then went 17 months without a release, and since 2025 the newest features (Nexus, Snort 3, CoreDNS, the Go GUI) ship only through Nexus on Plus. The Portfolio-led label reflects that five of sixteen direction items serve the subscription rather than a user request. A buyer should settle which edition they are buying and read the 26.07 note that the new GUI may not run on VMs and some third-party platforms before standardising on a virtual deployment.", "report": "/reports/firewall-router-ledger-2026/pfsense", "ai": { "infra": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "agents": { "2015": 1, "2016": 1, "2017": 1, "2018": 1, "2019": 1, "2020": 1, "2021": 1, "2022": 1, "2023": 1, "2024": 1, "2025": 1.5, "2026": 1.5 } }, "ai_basis": { "infra": "None", "stack": "None", "ops": "None", "agents": "25.07: Nexus REST API for Plus instances; community MCP servers (night4me, gensecaihq, abl030) run on the community pfREST package; no official MCP server" }, "ai_ledger": { "announced": 0, "ga": 0, "preview": 0, "pending": 0, "dropped": 0, "note": "No AI item was announced by Netgate between 2023 and 2026; the 26.07 release blog does not mention AI." }, "ai_reading": "pfSense uses no AI in detection, operations or the console; Snort, Suricata and list-based blocking do the work. Agents can drive a single instance only through the community pfREST package, and the vendor API arrived in 2025 inside Nexus for Plus customers.", "mom": 12.6, "credT": 13.5, "commT": 14, "lockT": 6, "integT": 10.5 }, { "key": "barracuda", "name": "Barracuda CloudGen Firewall (Vx and public cloud)", "short": "Barracuda CloudGen", "kind": "product", "group": "enterprise", "since": 2015, "archetype": "Steady maintainer", "grade": "C", "driver": "C", "mix": { "V": 0, "C": 75, "M": 0, "U": 13, "P": 13 }, "idx": 0, "domains": { "routing": { "2015": 3, "2016": 3, "2017": 3, "2018": 3.5, "2019": 3.5, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "firewall": { "2015": 3, "2016": 3, "2017": 3, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 4, "2025": 4, "2026": 4 }, "vpn": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "threat": { "2015": 3, "2016": 3, "2017": 3, "2018": 4, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "services": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "platform": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 3, "2019": 3, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "ha": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "mgmt": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 4, "2025": 4, "2026": 4 }, "observability": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "lifecycle": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3.5, "2025": 3.5, "2026": 3.5 } }, "cred": [ [ "Cadence", 3.5, "Two firmware lines with releases every few months (10.0.0 June 2025, 10.0.1 November 2025, 10.5.0 March 2026, 10.5.1 August 2026); no published schedule" ], [ "Roadmap transparency", 2, "Release notes public on Barracuda Campus; no public roadmap" ], [ "Say-do", 3, "No dated promises found to test; the 9.0 and 10.0 launch claims are counts of enhancements" ], [ "Velocity", 3, "One or two substantive capabilities per feature release, such as content policies in 9.0 and SSO in 10.5" ], [ "Lifecycle stability", 3, "Parallel 9.0.x and 10.x lines and in-place upgrades; 9.0.0 removed four components; end-of-support dates not readable" ] ], "comm": [ [ "Price and licence volatility", 2.5, "No dated change found since 2023; no public prices to track" ], [ "Purchase constraints", 3, "Capacity model by licensed cores, subscription through partners; no free edition" ], [ "Channel and access", 3, "Channel and MSP sales; firmware downloads need a Barracuda Campus account" ], [ "Owner stability", 3, "Two private-equity owners in five years: Thoma Bravo 2017, KKR since August 2022" ], [ "Cost of staying supported", 3, "Energize Updates subscription required for updates and support" ] ], "risk": "commercial", "lock": [ [ "Formats", 3, "Barracuda box and Control Center configuration, PAR archives" ], [ "Export path", 3, "Backup and restore between Barracuda firewalls; no converter to other vendors found" ], [ "Stack coupling", 2.5, "Control Center optional for one firewall, needed for fleet features; TINA is a Barracuda-only VPN protocol" ], [ "Hardware / cloud coupling", 2, "Four hypervisors and three clouds; one licence moves between them" ], [ "Skills and tooling coupling", 3, "Firewall Admin and Control Center tooling; Barracuda training" ] ], "integ": [ [ "Partner programme openness", 3.5, "Partner and MSP programmes; terms not read" ], [ "Multi-tenancy and self-service", 3, "Control Center ranges and clusters give tenant separation (not verified in this pass)" ], [ "API and infrastructure-as-code", 2.5, "REST API on the firewall and Control Center (not verified); no Terraform or Ansible content found" ], [ "Skills and certification", 3, "Barracuda training and certification" ] ], "alt": null, "ranked": true, "reading": "CloudGen Firewall earns its scores on SD-WAN, VPN and central management, where TINA tunnels, dynamic mesh and Control Center have been in place for years, and on a KEV record with no firewall entries since 2023. The weak points are not in the product: prices, support dates and the 10.x feature lists are hard to find in public, and the company has changed private-equity owners twice since 2017. A buyer should get the end-of-support dates for the 9.0 and 10.5 lines in writing, because the public page could not be read. Proxmox VE is not on the supported list, so a homelab should expect the KVM image to run unsupported at best.", "report": "/reports/firewall-router-ledger-2026/barracuda", "ai": { "infra": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "agents": { "2015": 1.5, "2016": 1.5, "2017": 1.5, "2018": 1.5, "2019": 1.5, "2020": 1.5, "2021": 1.5, "2022": 1.5, "2023": 1.5, "2024": 1.5, "2025": 1.5, "2026": 1.5 } }, "ai_basis": { "infra": "None", "stack": "None", "ops": "None", "agents": "REST API on the firewall and Control Center (not verified); no MCP server" }, "ai_ledger": { "announced": 0, "ga": 0, "preview": 0, "pending": 0, "dropped": 0, "note": "No AI items for the firewall were found from 2023 to 2026; Barracuda markets AI in its email products." }, "ai_reading": "No AI feature is documented for CloudGen Firewall, and none was announced. The sandbox and threat feeds are signature and reputation based as far as the sources read show.", "mom": 3.2, "credT": 14.5, "commT": 14.5, "lockT": 13.5, "integT": 12 }, { "key": "routeros", "name": "MikroTik RouterOS (x86 licences and Cloud Hosted Router)", "short": "MikroTik RouterOS", "kind": "product", "group": "router", "since": 2015, "archetype": "Dependable builder", "grade": "B", "driver": "C", "mix": { "V": 14, "C": 86, "M": 0, "U": 0, "P": 0 }, "idx": 0.14, "domains": { "routing": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "firewall": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "vpn": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "threat": { "2015": 0.5, "2016": 0.5, "2017": 0.5, "2018": 0.5, "2019": 0.5, "2020": 0.5, "2021": 0.5, "2022": 0.5, "2023": 0.5, "2024": 0.5, "2025": 0.5, "2026": 0.5 }, "services": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "platform": { "2015": 3, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "ha": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "mgmt": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "observability": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "lifecycle": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 2.5, "2025": 2.5, "2026": 1 } }, "cred": [ [ "Cadence", 3.5, "Stable and long-term point releases every few weeks (7.24 on 2026-08-14, 7.23.8 and 6.49.23 on 2026-10-09); no published schedule" ], [ "Roadmap transparency", 2.5, "Detailed public changelogs and public beta threads on the forum; no roadmap page and no stated direction beyond beta changelogs" ], [ "Say-do", 2.5, "MikroTik announces almost nothing in advance; v7 spent about two years in beta before 7.1 shipped on 2021-12-01, and the CVE-2026-67278 fix needed a second release" ], [ "Velocity", 4, "7.20 to 7.24 brought a routing filter wizard, packet steering, container controls, post-quantum SSH and VRF offload within one year" ], [ "Lifecycle stability", 3.5, "v6 still receives releases five years after v7 shipped, a long-term channel exists and upgrades are in place; support windows are not published" ] ], "comm": [ [ "Price and licence volatility", 0.5, "No change found since 2023; the published levels (x86 $45, $95, $250; CHR $45, $95, $250) sit on undated pages" ], [ "Purchase constraints", 1, "Perpetual licences in any quantity, a free CHR level and a Level 1 demo; an x86 licence level cannot be changed after purchase" ], [ "Channel and access", 1, "Open downloads and free patches without a subscription; sold through distributors and the MikroTik store; partner terms not published" ], [ "Owner stability", 1.5, "Founder-owned private company since 1996 with no acquisitions; a single mid-sized company is the dependency" ], [ "Cost of staying supported", 0.5, "Licences never expire and all upgrades are free" ] ], "risk": "commercial", "lock": [ [ "Formats", 3, "Configuration lives as RouterOS script export text; binary backups are tied to the version" ], [ "Export path", 3, "The text export is readable but no converter to or from other vendors exists" ], [ "Stack coupling", 1, "Runs alone; no management cloud required" ], [ "Hardware / cloud coupling", 1.5, "CHR runs on any x86 hypervisor fully offline; ARM only on MikroTik hardware" ], [ "Skills and tooling coupling", 3, "RouterOS syntax and Winbox are vendor specific, though trained people are plentiful" ] ], "integ": [ [ "Partner programme openness", 3, "Distributor network, certified consultants and training partners; programme terms not published" ], [ "Multi-tenancy and self-service", 1.5, "VRFs and User Manager; no multi-tenant console or self-service portal" ], [ "API and infrastructure-as-code", 3, "REST API and binary API cover the configuration; Terraform and Ansible content is community-maintained" ], [ "Skills and certification", 4, "MikroTik runs its own multi-level certification track (programme page not fetched)" ] ], "alt": null, "ranked": true, "reading": "RouterOS scores on what network engineers buy it for: BGP, OSPF, MPLS, VRFs and queues, licensed once for a few dollars and running on any x86 hypervisor through CHR. It loses most of its points in threat protection, where there is no engine at all, and in the security record, where three CISA KEV entries in September 2026 including one exploited SSH flaw take 1.5 points off the lifecycle line. The buyer-side numbers are among the lowest risks in the Ledger because licences never expire and patches are free. The one thing a buyer should check is the patch process: the same month produced an incomplete fix and a critical WebFig flaw, and MikroTik publishes no support windows, so someone has to own the update cadence. Treat it as a router with a stateful firewall, and pair it with a separate IPS if threat protection matters.", "report": "/reports/firewall-router-ledger-2026/routeros", "ai": { "infra": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "agents": { "2015": 1, "2016": 1, "2017": 1, "2018": 1, "2019": 1, "2020": 1, "2021": 1.5, "2022": 1.5, "2023": 1.5, "2024": 1.5, "2025": 1.5, "2026": 1.5 } }, "ai_basis": { "infra": "None", "stack": "None", "ops": "None", "agents": "7.1: REST API; third-party MCP servers (vesact/mikrotik-mcp, MikroMCP) build on it, no official one" }, "ai_ledger": { "announced": 0, "ga": 0, "preview": 0, "pending": 0, "dropped": 0, "note": "No AI items were announced from 2023 to 2026." }, "ai_reading": "RouterOS has no AI in threat detection, no assistant and no AI platform. Its REST API is open enough that community MCP servers exist, and that is the whole AI story.", "mom": -3, "credT": 16, "commT": 4.5, "lockT": 11.5, "integT": 11.5 }, { "key": "sonicwall", "name": "SonicWall NSv (SonicOS)", "short": "SonicWall NSv", "kind": "product", "group": "enterprise", "since": 2015, "archetype": "Follower with lifecycle churn", "grade": "C", "driver": "C", "mix": { "V": 0, "C": 55, "M": 18, "U": 0, "P": 27 }, "idx": 0, "domains": { "routing": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2.5, "2020": 2.5, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "firewall": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3.5, "2020": 3.5, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "vpn": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "threat": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3.5, "2020": 3.5, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "services": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "platform": { "2015": 1, "2016": 1, "2017": 1, "2018": 1, "2019": 2.5, "2020": 2.5, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3.5 }, "ha": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "mgmt": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3.5, "2020": 3.5, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "observability": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "lifecycle": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 2.5, "2025": 2, "2026": 2 } }, "cred": [ [ "Cadence", 3.5, "Four SonicOS 8 releases between November 2025 and August 2026 plus Gen 7 maintenance; dates not announced in advance" ], [ "Roadmap transparency", 2, "Public release notes; no public roadmap; lifecycle dates published per product only" ], [ "Say-do", 3, "The Gen 7 import promised for 8.2.0 in the 8.1.0 notes arrived by 8.2.2; little else was announced in advance" ], [ "Velocity", 3.5, "One or two substantive capabilities per 8.x release" ], [ "Lifecycle stability", 2.5, "Gen 6 to Gen 7 needed new instances and a Secure Upgrade licence, 7.3.3 needs a fresh install from 7.0 to 7.2, and Gen 7 end dates are unpublished" ] ], "comm": [ [ "Price and licence volatility", 3, "New vCPU-based NSv models and terms in 2026 replace the NSv 270, 470 and 870 line; no public price to check" ], [ "Purchase constraints", 3.5, "Subscription only with bundled services; no free edition" ], [ "Channel and access", 3.5, "SecureFirst partners; a MySonicWall account is needed to register, download firmware and license" ], [ "Owner stability", 2.5, "Private company; a private equity owner is reported but was not verified" ], [ "Cost of staying supported", 3.5, "Generation migrations with new instances or fresh installs; NSM required for fleets" ] ], "risk": "commercial", "lock": [ [ "Formats", 3, "Exportable preferences file in a proprietary format" ], [ "Export path", 3, "In-product import across SonicOS generations only; leaving is a manual rebuild" ], [ "Stack coupling", 2.5, "NSM for fleets and bundled security services; the optional cloud backup holds configurations" ], [ "Hardware / cloud coupling", 2, "ESXi, Hyper-V, KVM, Proxmox VE, AWS and Azure; licence bound to a MySonicWall account" ], [ "Skills and tooling coupling", 3, "SonicOS specific skills (SNSA, SNSP); no vendor infrastructure-as-code content" ] ], "integ": [ [ "Partner programme openness", 3.5, "SecureFirst partner programme with MSP options (terms not read)" ], [ "Multi-tenancy and self-service", 3.5, "Network Security Manager (SaaS or on-premises) with tenants and templates; no self-service portal" ], [ "API and infrastructure-as-code", 2.5, "SonicOS REST API; no vendor Terraform provider or Ansible collection found" ], [ "Skills and certification", 3.5, "SNSA and SNSP certifications; smaller talent pool than the larger vendors" ] ], "alt": null, "ranked": true, "reading": "NSv is the smallest and simplest platform in the enterprise group, and 2026 was its most useful year: SonicOS 8.2.2 gave it an official Proxmox VE guide, a 1 vCPU size and subscriptions from one to seven years, which no other vendor here offers. The scores stay mid-table because the firewall lacks VRFs, infrastructure-as-code content and a documented threat scoring model, and because the lifecycle record is the weakest: two exploited SSL VPN flaws, a cloud backup breach that exposed configuration files, and generation changes that require new instances or fresh installs. The buyer's check is the upgrade path: confirm how your NSv generation reaches SonicOS 8 and whether the cloud backup service is still in use.", "report": "/reports/firewall-router-ledger-2026/sonicwall", "ai": { "infra": { "2015": 1, "2016": 1, "2017": 1, "2018": 1, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 2, "2026": 2 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "agents": { "2015": 1.5, "2016": 1.5, "2017": 1.5, "2018": 1.5, "2019": 1.5, "2020": 1.5, "2021": 1.5, "2022": 1.5, "2023": 1.5, "2024": 1.5, "2025": 1.5, "2026": 1.5 } }, "ai_basis": { "infra": "6.5: Capture ATP cloud sandbox with vendor-described machine learning (RTDMI); not verified from primary pages", "stack": "None", "ops": "None", "agents": "SonicOS REST API; no official MCP server or infrastructure-as-code content" }, "ai_ledger": { "announced": 0, "ga": 0, "preview": 0, "pending": 0, "dropped": 0, "note": "No AI announcements for SonicOS or NSv were found between 2023 and 2026." }, "ai_reading": "SonicWall's AI is the cloud sandbox it has sold since the Gen 6.5 era, and nothing new was announced for the firewall between 2023 and 2026. There is no assistant and no official agent interface beyond the REST API.", "mom": -1, "credT": 14.5, "commT": 16, "lockT": 13.5, "integT": 13 }, { "key": "watchguard", "name": "WatchGuard FireboxV and Firebox Cloud (Fireware OS)", "short": "WatchGuard Firebox", "kind": "product", "group": "enterprise", "since": 2015, "archetype": "Steady maintainer", "grade": "B", "driver": "C", "mix": { "V": 0, "C": 67, "M": 0, "U": 0, "P": 33 }, "idx": 0, "domains": { "routing": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "firewall": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "vpn": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 4 }, "threat": { "2015": 3, "2016": 3, "2017": 3, "2018": 4, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "services": { "2015": 3, "2016": 3, "2017": 3, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "platform": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3.5, "2026": 3.5 }, "ha": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "mgmt": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "observability": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "lifecycle": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 2, "2026": 2 } }, "cred": [ [ "Cadence", 3.5, "Release posts every one to two months (12.11.7 on 2026-02-02, 12.12 on 2026-03-27); no published schedule" ], [ "Roadmap transparency", 2, "Release notes and blog posts public; no public roadmap" ], [ "Say-do", 3, "No dated promises found to test; the shipped items in 2026 were not pre-announced" ], [ "Velocity", 3, "One or two substantive capabilities per 12.x release, such as the Firebox Gateway and vulnerability alerts" ], [ "Lifecycle stability", 3, "Policy is per hardware model and predictable; the Fireware line split into 12.x for virtual and 2026.x for new hardware" ] ], "comm": [ [ "Price and licence volatility", 2.5, "A price adjustment notice appears on the vendor blog; amount and date not read; no public prices" ], [ "Purchase constraints", 3, "Subscription and feature key through a reseller; only a 30 day cloud trial, no free edition" ], [ "Channel and access", 3.5, "Channel-only sales through WatchGuardONE partners; software downloads need an account" ], [ "Owner stability", 2.5, "Private company; the current controlling owner was not confirmed from a public source" ], [ "Cost of staying supported", 3, "Security services are subscriptions; signature updates for a release end 12 months after the next version" ] ], "risk": "commercial", "lock": [ [ "Formats", 3, "Fireware XML policy file specific to WatchGuard" ], [ "Export path", 3, "Backup and restore between Fireboxes; no converter to or from other vendors found" ], [ "Stack coupling", 2, "Runs alone; WatchGuard Cloud needed for fleet features and FireCloud" ], [ "Hardware / cloud coupling", 2, "Any of four hypervisors; FireCluster needs ESXi; Firebox Cloud tied to AWS and Azure images" ], [ "Skills and tooling coupling", 3, "WatchGuard System Manager and WatchGuard Cloud tooling; certified training partners" ] ], "integ": [ [ "Partner programme openness", 4, "WatchGuardONE programme open to resellers and MSPs; all sales through the channel" ], [ "Multi-tenancy and self-service", 3, "WatchGuard Cloud multi-tenant MSP management (not verified in this pass)" ], [ "API and infrastructure-as-code", 2.5, "Fireware REST API exists; coverage not verified; no Terraform or Ansible content found" ], [ "Skills and certification", 3, "WatchGuard certified training programme" ] ], "alt": null, "ranked": true, "reading": "The virtual Firebox covers the full small-office feature list, from sandboxing and DNS filtering to a WireGuard gateway in 12.12, on ESXi, Hyper-V, KVM and Proxmox VE. The scores fall where the virtual edition is weaker than the hardware: FireCluster runs only on ESXi, and the two CISA KEV entries added in November and December 2025 take a full point off the lifecycle domain. A buyer should ask for the support end date of the Fireware release they deploy, because the published policy covers hardware models and not software versions. The gap in this scorecard is 2023 and 2024, where no release was read.", "report": "/reports/firewall-router-ledger-2026/watchguard", "ai": { "infra": { "2015": 0, "2016": 0, "2017": 0, "2018": 2, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 2, "2026": 2 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "agents": { "2015": 1.5, "2016": 1.5, "2017": 1.5, "2018": 1.5, "2019": 1.5, "2020": 1.5, "2021": 1.5, "2022": 1.5, "2023": 1.5, "2024": 1.5, "2025": 1.5, "2026": 1.5 } }, "ai_basis": { "infra": "12.2: IntelligentAV machine learning malware detection (vendor claim; year grade C); ThreatSync correlation", "stack": "None", "ops": "None", "agents": "Fireware REST API; no MCP server or agent interface found" }, "ai_ledger": { "announced": 0, "ga": 0, "preview": 0, "pending": 0, "dropped": 0, "note": "No AI items for the firewall were announced from 2023 to 2026 in the sources read." }, "ai_reading": "WatchGuard's AI sits in detection: IntelligentAV classifies malware with machine learning and ThreatSync correlates events across products. There is no operator assistant and no agent interface beyond the REST API.", "mom": 0.2, "credT": 14.5, "commT": 14.5, "lockT": 13, "integT": 12.5 }, { "key": "openwrt", "name": "OpenWrt (community project, Software Freedom Conservancy)", "short": "OpenWrt", "kind": "product", "group": "opensource", "since": 2015, "archetype": "Dependable builder", "grade": "B", "driver": "C", "mix": { "V": 22, "C": 67, "M": 0, "U": 11, "P": 0 }, "idx": 0.25, "domains": { "routing": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "firewall": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "vpn": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "threat": { "2015": 1, "2016": 1, "2017": 1, "2018": 1, "2019": 1, "2020": 1, "2021": 1, "2022": 1.5, "2023": 1.5, "2024": 1.5, "2025": 1.5, "2026": 1.5 }, "services": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "platform": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3.5, "2026": 3.5 }, "ha": { "2015": 1.5, "2016": 1.5, "2017": 2, "2018": 2, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 2, "2026": 2 }, "mgmt": { "2015": 2, "2016": 2, "2017": 2, "2018": 2.5, "2019": 2.5, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "observability": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 2, "2026": 2 }, "lifecycle": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 } }, "cred": [ [ "Cadence", 3, "A stable series every 6 to 18 months with no published schedule; service releases monthly to quarterly" ], [ "Roadmap transparency", 3, "Open trackers, mailing lists and release notes; no written roadmap and no next-milestone page" ], [ "Say-do", 3, "The apk transition and the OpenWrt One shipped; little is announced ahead, so there is little to miss" ], [ "Velocity", 3, "Steady device and kernel work each series; firewall4, apk and ucode are the platform changes of the decade" ], [ "Lifecycle stability", 3, "Two series supported at a time with sysupgrade between neighbours; some upgrades need a configuration wipe (swconfig to DSA); the apk change breaks opkg habits" ] ], "comm": [ [ "Maintainer concentration", 2.5, "Broad contributor base across many targets; the number of release maintainers is not published; no company employs the core team" ], [ "Backer health", 2, "Member project of the Software Freedom Conservancy funded by donations and the OpenWrt One levy; hardware vendors ship it under their own terms without funding obligations" ], [ "Licence-change risk", 0.5, "GPL-2.0 with thousands of copyright holders and no contributor agreement; a relicensing is impractical" ], [ "Abandonment signs", 0.5, "25.12.0 in March 2026, five service releases by July and a 24.10 service release the same month" ], [ "Security response", 2, "Advisory page and fast service releases, but a series loses security updates about six months after its successor ships, and the July 2026 batch fixed a critical odhcpd flaw" ] ], "risk": "sustainability", "lock": [ [ "Formats", 0.5, "UCI text files under /etc/config with sysupgrade -b backup; fully scriptable" ], [ "Export path", 0.5, "Plain text configuration; nothing proprietary to convert" ], [ "Stack coupling", 0, "No storage or management stack" ], [ "Hardware / cloud coupling", 0.5, "Any supported device or x86-64 machine; device support varies by target and a series upgrade can drop devices" ], [ "Skills and tooling coupling", 1, "Embedded Linux skills; LuCI and UCI are specific to OpenWrt" ] ], "integ": [ [ "Partner programme openness", 1, "No partner programme; anyone may build on it, nobody is supported by the project" ], [ "Multi-tenancy and self-service", 0.5, "None in the project; third-party controllers not verified" ], [ "API and infrastructure-as-code", 2.5, "ubus and rpcd JSON-RPC, UCI; Ansible and Terraform modules are community work not verified here" ], [ "Skills and certification", 2, "Large wiki and forum; no certification" ] ], "alt": null, "ranked": true, "reading": "OpenWrt scores as a solid router and firewall for one site: nftables firewall, all three VPNs, dnsmasq and odhcpd, and a platform reach no other entry matches across SoCs, x86, ARM and RISC-V. It scores low where a business firewall is judged, with no failover with state sync, no IDS integration, no central management and support windows shorter than a year and a half. The sustainability rows are the real read: the licence cannot move and the releases keep coming, but the project depends on donations and unpaid maintainers, and the July 2026 security batch shows how much code a volunteer team now carries. A buyer should plan a series upgrade every year and check that each device survives it.", "report": "/reports/firewall-router-ledger-2026/openwrt", "ai": { "infra": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "agents": { "2015": 1.5, "2016": 1.5, "2017": 1.5, "2018": 1.5, "2019": 1.5, "2020": 1.5, "2021": 1.5, "2022": 1.5, "2023": 1.5, "2024": 1.5, "2025": 1.5, "2026": 1.5 } }, "ai_basis": { "infra": "None", "stack": "None", "ops": "None", "agents": "ubus JSON-RPC and UCI that scripts and agents can drive; no official MCP server or agent interface" }, "ai_ledger": { "announced": 0, "ga": 0, "preview": 0, "pending": 0, "dropped": 0, "note": "No AI item appears in any release note from 2023 to 2026." }, "ai_reading": "OpenWrt has no AI in any form and announces none. Its JSON-RPC interface is open enough for agents to configure a device, which is the whole of its agent story.", "mom": 1, "credT": 15, "commT": 7.5, "lockT": 2.5, "integT": 6 }, { "key": "tnsr", "name": "Netgate TNSR", "short": "TNSR", "kind": "product", "group": "router", "since": 2018, "archetype": "Narrow specialist", "grade": "B", "driver": "C", "mix": { "V": 0, "C": 67, "M": 0, "U": 33, "P": 0 }, "idx": 0, "domains": { "routing": { "2018": 3, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "firewall": { "2018": 1, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 3, "2026": 3 }, "vpn": { "2018": 2, "2019": 2, "2020": 2, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "threat": { "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 2, "2023": 2, "2024": 2, "2025": 2, "2026": 2 }, "services": { "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 2.5, "2025": 2.5, "2026": 2.5 }, "platform": { "2018": 2.5, "2019": 2.5, "2020": 3, "2021": 3, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "ha": { "2018": 2.5, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 4 }, "mgmt": { "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "observability": { "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 2.5, "2025": 2.5, "2026": 2.5 }, "lifecycle": { "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 } }, "cred": [ [ "Cadence", 3.5, "Version names show a release about every four months (25.02, 25.06, 25.10, 26.02); no release found after 26.02.2 by October 2026; no published schedule" ], [ "Roadmap transparency", 1.5, "Release notes public; no public roadmap or tracker" ], [ "Say-do", 3, "No dated promises found to test" ], [ "Velocity", 2.5, "26.02 brought HA state sync, upstream VPP and DPDK bumps and fixes; one substantive capability per release" ], [ "Lifecycle stability", 2.5, "No published support policy; upgrades are in place and documented per release" ] ], "comm": [ [ "Price and licence volatility", 3, "Per-instance pricing since 2020 with no current public number; the free Home+Lab edition is no longer visible on the product pages (status unconfirmed)" ], [ "Purchase constraints", 3.5, "Subscription only; package repositories need a business subscription; lab evaluation by request to sales" ], [ "Channel and access", 2.5, "Direct sales, resellers and AWS and Azure Marketplace; update certificates tied to the subscription" ], [ "Owner stability", 2, "Small private company, same owner since the first release; no acquisition" ], [ "Cost of staying supported", 2.5, "Annual subscription per instance; no LTS, so staying supported means following the four-monthly releases" ] ], "risk": "commercial", "lock": [ [ "Formats", 2, "Clixon configuration exportable as text through the CLI and RESTCONF; TNSR-specific syntax" ], [ "Export path", 2, "No converter to or from pfSense or other platforms; FRRouting and strongSwan configuration concepts carry over" ], [ "Stack coupling", 1, "Any network and storage; runs alone" ], [ "Hardware / cloud coupling", 1.5, "x86 with SSE4.2 and DPDK-compatible NICs; Secure Boot must be disabled; Netgate appliances optional" ], [ "Skills and tooling coupling", 2.5, "VPP, FRRouting and YANG skills transfer; the CLI is TNSR's own" ] ], "integ": [ [ "Partner programme openness", 2.5, "Netgate reseller programme; terms not published" ], [ "Multi-tenancy and self-service", 0.5, "No tenant model or central manager" ], [ "API and infrastructure-as-code", 3, "Complete RESTCONF and NETCONF API; no vendor Terraform or Ansible content" ], [ "Skills and certification", 1.5, "Documentation and TAC; no certification found" ] ], "alt": null, "ranked": true, "reading": "TNSR scores as a router first: BGP, OSPF, IS-IS and IPsec run on the VPP dataplane with DPDK, and 26.02 added firewall state sync between HA peers. It scores low on threat protection and network services because it has no TLS inspection, web or DNS filtering, captive portal or web UI, so it fits a data centre edge or a lab that wants throughput over features. A buyer should confirm the current price and whether a free lab edition still exists before planning on it, because the 2020 price list is the last public number and Home+Lab has left the product pages. The lack of a published support window is the main lifecycle gap.", "report": "/reports/firewall-router-ledger-2026/tnsr", "ai": { "infra": { "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "stack": { "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "agents": { "2018": 2, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 2, "2026": 2 } }, "ai_basis": { "infra": "None", "stack": "None", "ops": "None", "agents": "RESTCONF and NETCONF API on YANG models that any agent can drive; no MCP server" }, "ai_ledger": { "announced": 0, "ga": 0, "preview": 0, "pending": 0, "dropped": 0, "note": "No AI items found for TNSR from 2023 to 2026." }, "ai_reading": "TNSR has no AI features and announces none. Its model-driven RESTCONF API is the one asset an automation agent can use today.", "mom": 4, "credT": 13, "commT": 13.5, "lockT": 9, "integT": 7.5 }, { "key": "ipfire", "name": "IPFire", "short": "IPFire", "kind": "product", "group": "opensource", "since": 2015, "archetype": "Dependable builder", "grade": "B", "driver": "C", "mix": { "V": 11, "C": 67, "M": 0, "U": 22, "P": 0 }, "idx": 0.14, "domains": { "routing": { "2015": 1.5, "2016": 1.5, "2017": 1.5, "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 2.5, "2025": 2.5, "2026": 2.5 }, "firewall": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "vpn": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3.5, "2026": 3.5 }, "threat": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3.5 }, "services": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "platform": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 2.5, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "ha": { "2015": 1, "2016": 1, "2017": 1, "2018": 1, "2019": 1, "2020": 1, "2021": 1, "2022": 1, "2023": 1, "2024": 1, "2025": 1, "2026": 1 }, "mgmt": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2, "2020": 2, "2021": 2, "2022": 2, "2023": 2, "2024": 2, "2025": 2, "2026": 2 }, "observability": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 2.5, "2025": 2.5, "2026": 2.5 }, "lifecycle": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 } }, "cred": [ [ "Cadence", 3.5, "A Core Update every one to two months with a testing release announced first (199 in January, 200 in March, 201 in April, 202 in May, 203 in July, 204 in October 2026); no published schedule" ], [ "Roadmap transparency", 3, "Release notes per update and blog posts that explain direction; a bug tracker exists; no written roadmap" ], [ "Say-do", 3, "Few promises on record; the DNS Firewall named as the next milestone in March 2026 shipped in the next update; the DBL blocklist GA status is unconfirmed" ], [ "Velocity", 3, "One or two substantive items per Core Update (WireGuard, DNS Firewall, Knot Resolver, Wi-Fi 7 AP) around kernel and library updates" ], [ "Lifecycle stability", 3, "Rolling model with one supported branch and in-place upgrades; the Unbound to Knot Resolver swap caused a regression fixed one update later" ] ], "comm": [ [ "Maintainer concentration", 3.5, "Six named core developers inside a 31-person team; one lead developer has carried the project since 2004" ], [ "Backer health", 3, "Sponsor donations and one small company, Lightning Wire Labs, that sells appliances and support; no foundation and no investors" ], [ "Licence-change risk", 1, "Open source without a single corporate owner; the licence name was not read from the project page" ], [ "Abandonment signs", 1, "Six Core Updates in 2026 and a project history since 2004" ], [ "Security response", 1.5, "Kernel and library fixes ship in regular Core Updates and no KEV entries exist; no central advisory page was found" ] ], "risk": "sustainability", "lock": [ [ "Formats", 1.5, "Plain text configuration under /var/ipfire and a backup archive" ], [ "Export path", 2, "Readable text configuration; no converter to other firewalls" ], [ "Stack coupling", 0.5, "Runs alone with any upstream and any switch" ], [ "Hardware / cloud coupling", 0.5, "Any x86-64 or aarch64 machine, fully offline" ], [ "Skills and tooling coupling", 2, "Own colour zone model and Pakfire package manager; general Linux skills transfer partly" ] ], "integ": [ [ "Partner programme openness", 1.5, "No partner programme found; Lightning Wire Labs sells appliances and support" ], [ "Multi-tenancy and self-service", 0.5, "None" ], [ "API and infrastructure-as-code", 0.5, "No API, Terraform or Ansible content found" ], [ "Skills and certification", 1, "Documentation and community forum; no training or certification found" ] ], "alt": null, "ranked": true, "reading": "IPFire earns its points in threat protection and the VPN set, where inline Suricata, the new DNS Firewall, WireGuard and a rebuilt OpenVPN give a small site more filtering than most free firewalls, and in buyer safety, because there is nothing to buy and nothing to export from except text files. The scores stop where the product stops: no failover, no API, no central management, dynamic routing only through a command-line add-on and no official statement on which hypervisors it supports. The sustainability risk sits in the middle because the project is twenty years old and ships every few weeks, yet depends on a handful of developers and one small company. A buyer should check IPv6 support against their needs before choosing it, because the research did not assess it and the firewall line is scored without it.", "report": "/reports/firewall-router-ledger-2026/ipfire", "ai": { "infra": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "agents": { "2015": 0.5, "2016": 0.5, "2017": 0.5, "2018": 0.5, "2019": 0.5, "2020": 0.5, "2021": 0.5, "2022": 0.5, "2023": 0.5, "2024": 0.5, "2025": 0.5, "2026": 0.5 } }, "ai_basis": { "infra": "None", "stack": "None", "ops": "None", "agents": "No API; SSH and the web UI only; no MCP server found" }, "ai_ledger": { "announced": 0, "ga": 0, "preview": 0, "pending": 0, "dropped": 0, "note": "No AI items were announced from 2023 to 2026; the DBL blocklist is a curated list." }, "ai_reading": "IPFire uses no AI in detection or operations and announces none. Without an API there is nothing for an agent to drive beyond SSH.", "mom": 2.4, "credT": 15.5, "commT": 10, "lockT": 6.5, "integT": 3.5 }, { "key": "forcepoint", "name": "Forcepoint Network Security Platform (formerly Forcepoint NGFW)", "short": "Forcepoint NGFW", "kind": "product", "group": "enterprise", "since": 2015, "archetype": "Portfolio reshuffle", "grade": "C", "driver": "P", "mix": { "V": 0, "C": 33, "M": 0, "U": 17, "P": 50 }, "idx": 0, "domains": { "routing": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "firewall": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "vpn": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "threat": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "services": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 2.5, "2025": 2.5, "2026": 2.5 }, "platform": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 2.5, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "ha": { "2015": 4, "2016": 4, "2017": 4, "2018": 4, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "mgmt": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 4, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "observability": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "lifecycle": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3, "2021": 3, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 } }, "cred": [ [ "Cadence", 3, "Version numbers show a feature release each year and several maintenance builds, but no release dates beyond the 7.5.0 document date were found" ], [ "Roadmap transparency", 1.5, "Release notes public; no public roadmap; feature lists in PDFs that could not be read" ], [ "Say-do", 2.5, "No dated promises found to test; three product names since 7.0" ], [ "Velocity", 2.5, "Maintenance builds dominate the 7.3 to 7.5 list; feature content of 7.5 not read" ], [ "Lifecycle stability", 2, "Three renames since 7.0; lifecycle model named but no dates published" ] ], "comm": [ [ "Price and licence volatility", 2.5, "Quote only; no changes found, and no public prices to track" ], [ "Purchase constraints", 3.5, "Quote-based licensing through partners; no free or community edition" ], [ "Channel and access", 3, "Partner sales; release notes public, downloads behind the support portal" ], [ "Owner stability", 4, "Private-equity owner since January 2021; government business divested in 2023; owner of the NGFW line after the split not confirmed" ], [ "Cost of staying supported", 3, "Subscription support; Feature Stream releases supersede each other and the long-term dates are not published" ] ], "risk": "commercial", "lock": [ [ "Formats", 3.5, "Policies live in the SMC database; policy snapshots exportable in Forcepoint's own format" ], [ "Export path", 3.5, "No converter to other vendors found" ], [ "Stack coupling", 3, "Engines require the Security Management Center" ], [ "Hardware / cloud coupling", 2, "ESXi and KVM on RHEL; Hyper-V limited; appliances optional" ], [ "Skills and tooling coupling", 3.5, "SMC-specific tooling and a small skills base" ] ], "integ": [ [ "Partner programme openness", 3, "Partner programme exists; terms not read" ], [ "Multi-tenancy and self-service", 3, "SMC administrative domains (grade C)" ], [ "API and infrastructure-as-code", 2, "SMC API; no Terraform or Ansible content found" ], [ "Skills and certification", 2.5, "Forcepoint certification; niche skills base" ] ], "alt": null, "ranked": true, "reading": "Forcepoint's firewall scores well on clustering, central policy and inline IPS, which are the Stonesoft strengths it inherited, and its KEV record since 2023 is clean. The scorecard carries grade C because the release note feature lists could not be read, no release dates for 7.3 to 7.5 were found, and the product has been renamed three times under a private-equity owner that sold half the company in 2023. A buyer should ask which legal entity owns and supports the NGFW line today and for the long-term support dates of the version they deploy. Until the release notes are read, the routing, VPN and threat scores are held one half step below what the vendor's materials suggest.", "report": "/reports/firewall-router-ledger-2026/forcepoint", "ai": { "infra": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "agents": { "2015": 1.5, "2016": 1.5, "2017": 1.5, "2018": 1.5, "2019": 1.5, "2020": 1.5, "2021": 1.5, "2022": 1.5, "2023": 1.5, "2024": 1.5, "2025": 1.5, "2026": 1.5 } }, "ai_basis": { "infra": "None", "stack": "None", "ops": "None", "agents": "SMC API that scripts can drive; no MCP server" }, "ai_ledger": { "announced": 0, "ga": 0, "preview": 0, "pending": 0, "dropped": 0, "note": "No AI items for the NGFW were found from 2023 to 2026; Forcepoint markets AI in its data security lines." }, "ai_reading": "No AI feature is documented for the NGFW engine or the Security Management Center in the sources read. The SMC API is the only automation surface.", "mom": 0, "credT": 11.5, "commT": 16, "lockT": 15.5, "integT": 10.5 }, { "key": "ngfirewall", "name": "Arista NG Firewall (formerly Untangle NG Firewall)", "short": "Arista NG Firewall", "kind": "product", "group": "smb", "since": 2015, "archetype": "Slow follower", "grade": "C", "driver": "C", "mix": { "V": 0, "C": 71, "M": 0, "U": 29, "P": 0 }, "idx": 0, "domains": { "routing": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 3, "2023": 3, "2024": 3, "2025": 3, "2026": 3 }, "firewall": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "vpn": { "2015": 3, "2016": 3, "2017": 3, "2018": 3, "2019": 3, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "threat": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "services": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "platform": { "2015": 2, "2016": 2, "2017": 2, "2018": 2, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 2.5, "2025": 2.5, "2026": 2.5 }, "ha": { "2015": 1.5, "2016": 1.5, "2017": 1.5, "2018": 1.5, "2019": 1.5, "2020": 1.5, "2021": 1.5, "2022": 1.5, "2023": 1.5, "2024": 1.5, "2025": 1.5, "2026": 1.5 }, "mgmt": { "2015": 3, "2016": 3, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 3.5, "2021": 3.5, "2022": 3.5, "2023": 3.5, "2024": 3.5, "2025": 3.5, "2026": 3.5 }, "observability": { "2015": 3.5, "2016": 3.5, "2017": 3.5, "2018": 3.5, "2019": 3.5, "2020": 4, "2021": 4, "2022": 4, "2023": 4, "2024": 4, "2025": 4, "2026": 4 }, "lifecycle": { "2015": 2.5, "2016": 2.5, "2017": 2.5, "2018": 2.5, "2019": 2.5, "2020": 2.5, "2021": 2.5, "2022": 2.5, "2023": 2.5, "2024": 2.5, "2025": 2.5, "2026": 2.5 } }, "cred": [ [ "Cadence", 2, "About two tagged releases a year on an irregular rhythm (17.4.1 on 2026-01-29, 17.5.0 on 2026-07-17); no schedule" ], [ "Roadmap transparency", 1.5, "No roadmap; the release highlights page stops at 17.0 and the release history article is not publicly readable; the wiki is public" ], [ "Say-do", 2.5, "Little is announced; the 17.5 beta of 2026-05-29 was tagged seven weeks later, though its GA status is not confirmed" ], [ "Velocity", 2.5, "One substantive item per release (per-profile DNS in 17.4, Dynamic Blocklists in 17.5) plus maintenance" ], [ "Lifecycle stability", 2.5, "In-place upgrades and a long version line; renamed after the 2022 acquisition, 32-bit dropped at 16.1, and no published support windows" ] ], "comm": [ [ "Price and licence volatility", 1.5, "No change documented since 2023; no public price list to track" ], [ "Purchase constraints", 2.5, "Paid apps are subscription only, per server and per device band; the Lite apps and NG Firewall Free have no expiry" ], [ "Channel and access", 2.5, "Direct and reseller sales; downloads through the ETM portal with an account; partner programme terms not found; the core source is public" ], [ "Owner stability", 2.5, "Large public owner since 2022, but the product is a small line inside Arista and its public release page has not been updated since 17.0" ], [ "Cost of staying supported", 3, "Paid apps stop working without a current subscription; platform upgrades are in place" ] ], "risk": "commercial", "lock": [ [ "Formats", 2.5, "Configuration in a database exported as a backup file" ], [ "Export path", 3, "Backup files restore only to NG Firewall; migration to another firewall is manual" ], [ "Stack coupling", 1, "Runs alone; the ETM Dashboard is optional" ], [ "Hardware / cloud coupling", 1, "Any x86 machine, VMware, AWS or Azure; paid apps check their licence online" ], [ "Skills and tooling coupling", 2, "App-based web administration specific to the product on a Debian base" ] ], "integ": [ [ "Partner programme openness", 2.5, "Reseller channel exists; programme terms were not found" ], [ "Multi-tenancy and self-service", 2.5, "ETM Dashboard manages many appliances with templates (vendor claim); no multi-tenant separation documented" ], [ "API and infrastructure-as-code", 1, "JSON-RPC API not verified; no Terraform or Ansible content" ], [ "Skills and certification", 1.5, "Wiki documentation and forum; no certification track found" ] ], "alt": null, "ranked": true, "reading": "NG Firewall scores well on the things Untangle built a decade ago: layer 7 application control, identity-based rules, TLS inspection, a reputation feed and reports that most small office firewalls lack. It scores badly on everything that needs a public record, because Arista publishes no roadmap, no support windows, no advisory page and no readable release history, and the latest release highlights page still describes 17.0. The hypervisor story is the practical limit for this Ledger's readers: VMware is the only documented hypervisor and Proxmox VE, KVM and Hyper-V are not mentioned on the installation pages. The one thing a buyer should check is whether 17.5.0 is a general release or still a beta, and what the per-server subscription costs for their device count, since neither is published.", "report": "/reports/firewall-router-ledger-2026/ngfirewall", "ai": { "infra": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "stack": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "ops": { "2015": 0, "2016": 0, "2017": 0, "2018": 0, "2019": 0, "2020": 0, "2021": 0, "2022": 0, "2023": 0, "2024": 0, "2025": 0, "2026": 0 }, "agents": { "2015": 0.5, "2016": 0.5, "2017": 0.5, "2018": 0.5, "2019": 0.5, "2020": 0.5, "2021": 0.5, "2022": 0.5, "2023": 0.5, "2024": 0.5, "2025": 0.5, "2026": 0.5 } }, "ai_basis": { "infra": "None; Threat Prevention uses a reputation feed that the vendor does not describe as AI", "stack": "None", "ops": "None", "agents": "A JSON-RPC administration API is reported but was not verified; no MCP server found" }, "ai_ledger": { "announced": 0, "ga": 0, "preview": 0, "pending": 0, "dropped": 0, "note": "No AI items were announced from 2023 to 2026." }, "ai_reading": "NG Firewall ships no AI features and announces none. Its threat scoring comes from a third-party reputation feed, and agent access depends on an API the research could not verify.", "mom": 0, "credT": 11, "commT": 12, "lockT": 9.5, "integT": 7.5 } ] }