Firewall and Router Ledger 2026
Ledger
Firewall and Router Ledger 2026
Barracuda: Firewall and Router Ledger 2026 Scorecard
Barracuda CloudGen Firewall keeps a clean KEV record and a deep SD-WAN and VPN stack, with thin public pricing and lifecycle data under a private-equity owner.
Edition October 16, 20267 min read
Where Barracuda CloudGen put its effort, 2016 to 2026
Each square is one capability area in one year. The brighter it is, the more the area gained in the Firewall and Router Ledger that year; 1, 2 and 3 mark that year's biggest pushes.
| ’16 | ’17 | ’18 | ’19 | ’20 | ’21 | ’22 | ’23 | ’24 | ’25 | ’26 | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Routing and WAN | 2 | 1 | |||||||||
| Firewall and NAT core | 3 | 1 | |||||||||
| VPN and remote access | 2 | ||||||||||
| Threat protection | 1 | ||||||||||
| Network services | |||||||||||
| Platform and hypervisor freedom | 3 | ||||||||||
| High availability and performance | |||||||||||
| Management, API and automation | 2 | ||||||||||
| Observability | |||||||||||
| Platform security and lifecycle | 3 |
no change+0.5+1+1.5 or moreScores out of 5 per area.
Biggest pushes overall: Routing and WAN (+1), Firewall and NAT core (+1), Threat protection (+1). Already strong in 2015: VPN and remote access, Management, API and automation, Observability.
Top focus each year: 2018 Threat protection; 2020 Routing and WAN; 2024 Firewall and NAT core. 8 of 11 years show no gain in any area.
Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.
Snapshot
- Type: product
- Owner: Barracuda Networks, Inc. (private; owned by KKR funds since August 2022, before that Thoma Bravo from late 2017)
- Licence: Proprietary. Virtual capacity by model: VFC1, VFC2, VFC4 and VFC8 (1 to 8 licensed cores, at least 4 GB RAM and 80 GB storage each); one licence runs on VMs, Azure, AWS, Google Cloud or standard hardware. Energize Updates plus optional subscriptions; prices not published; no free edition found
- Latest release: Firmware 10.5.1 (2026-08-12); 10.5.0 March 2026; the 9.0.6 line is maintained in parallel (April 2026)
- Support lifecycle: An end-of-support page exists but was not readable; no branch dates found; direct upgrades across several majors are not possible (5.x to 7.2.x)
- Next milestone: none published
- Security record: 0 CISA KEV entries for CloudGen Firewall since 2023; the 2023 Barracuda entry (CVE-2023-2868) concerns the Email Security Gateway. Advisories: https://www.barracuda.com/support/security
- Hypervisors: VMware (OVA and ISO), XenServer (PVHVM), KVM (virtio) and Microsoft Hyper-V (Generation 1 VHD); Azure, AWS and Google Cloud images; Proxmox VE and XCP-ng not listed; no ARM
- Tier: Enterprise virtual appliance
- Archetype: Steady maintainer
- Evidence grade: C. The Vx platform page, the firmware release notes pages for 9.0.0, 10.0.x and 10.5.x, the KKR acquisition releases and the KEV check were read from Barracuda Campus, Business Wire and the CISA catalogue. Release note dates use an ambiguous day and month order. Feature lists for 2015 to 2022 and for most of 10.x were not read, so more than a quarter of the capability steps rest on the dossier's unsourced timeline.
Scorecard
| Dimension | Score | Direction |
|---|---|---|
| Capability today | 75.0 / 100 | higher is better |
| Momentum since end of 2022 | +3.2 points (2015 to 2022: +10.0) | higher is better |
| Credibility | 14.5 / 25 | higher is better |
| Commercial risk | 14.5 / 25 | lower is better |
| Technical lock-in | 13.5 / 25 | lower is better |
| Integrator fit | 12.0 / 20 | higher is better |
| AI leverage | 1.5 / 20 | higher is better |
| Ledger Index | 54.2 / 100 | balanced weights; see the methodology |
Capability by domain, 2015 to today
Scores 0 to 5 against fixed anchors; total is weighted to 100.
| Domain (weight) | 2015 | 2019 | 2022 | Today |
|---|---|---|---|---|
| Routing and WAN (12) | 3 | 3.5 | 4 | 4 |
| Firewall and NAT core (12) | 3 | 3.5 | 3.5 | 4 |
| VPN and remote access (12) | 3.5 | 3.5 | 4 | 4 |
| Threat protection (12) | 3 | 4 | 4 | 4 |
| Network services (8) | 3 | 3 | 3 | 3 |
| Platform and hypervisor freedom (10) | 2.5 | 3 | 3.5 | 3.5 |
| High availability and performance (8) | 3 | 3 | 3.5 | 3.5 |
| Management, API and automation (10) | 3.5 | 3.5 | 3.5 | 4 |
| Observability (6) | 3.5 | 3.5 | 3.5 | 3.5 |
| Platform security and lifecycle (10) | 3 | 3 | 3 | 3.5 |
| Total / 100 | 61.8 | 67.6 | 71.8 | 75.0 |
Year by year: 2015: 61.8 · 2016: 61.8 · 2017: 61.8 · 2018: 67.6 · 2019: 67.6 · 2020: 71.8 · 2021: 71.8 · 2022: 71.8 · 2023: 71.8 · 2024: 75.0 · 2025: 75.0 · 2026: 75.0
What moved the score
| Year | Domain | Change | Points | Trigger |
|---|---|---|---|---|
| 2018 | Firewall and NAT core | 3 → 3.5 | +1.2 | 7.x: application rule depth and virtual MAC objects (grade C for the year) |
| 2018 | Platform and hypervisor freedom | 2.5 → 3 | +1.0 | 7.x: Azure and AWS images (grade C for the year) |
| 2018 | Routing and WAN | 3 → 3.5 | +1.2 | 7.x: traffic intelligence across multiple transports in TINA tunnels (grade C for the year) |
| 2018 | Threat protection | 3 → 4 | +2.4 | 7.x: Advanced Threat Protection sandbox, botnet and spyware protection, TLS inspection (grade C for the year) |
| 2020 | High availability and performance | 3 → 3.5 | +0.8 | 8.x: Secure SD-WAN multi-transport link aggregation and failover (grade C for the year); no active-active clustering |
| 2020 | Platform and hypervisor freedom | 3 → 3.5 | +1.0 | 8.x: Google Cloud image; one licence across VMs, clouds and hardware; no ARM, no Proxmox VE listing |
| 2020 | Routing and WAN | 3.5 → 4 | +1.2 | 8.x: Secure SD-WAN with path selection, link health and traffic duplication over TINA (grade C for the year); no VRFs, MPLS or EVPN found |
| 2020 | VPN and remote access | 3.5 → 4 | +1.2 | 8.x: dynamic mesh VPN and multi-transport TINA tunnels, IKEv2 (grade C for the year); no WireGuard |
| 2024 | Firewall and NAT core | 3.5 → 4 | +1.2 | 9.0: user and file content policies, HTTP/2 handling; shared objects across firewalls from Control Center |
| 2024 | Management, API and automation | 3.5 → 4 | +1.0 | 9.0: automated backups and automated security updates; no vendor Terraform or Ansible content |
| 2024 | Platform security and lifecycle | 3 → 3.5 | +1.0 | 9.0: automated security updates and automated backups; no KEV entries since 2023 |
Direction, 2023 to 2026
Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
| Date | Item | Theme | Driver |
|---|---|---|---|
| 2024-01 | 9.0.0: user and file content policies, HTTP/2 (month not verified; the release is placed in 2024 by the dossier) | Firewall core | C |
| 2024-01 | 9.0.0: automated backups and automated security updates (month not verified) | Security and lifecycle | C |
| 2024-01 | 9.0.0 discontinues FW Audit, the web UI, SMSd and WAN optimisation; Control Center PKI removed (month not verified) | Packaging | P |
| 2025-06 | 10.0.0: upgraded base distribution, over 250 enhancements for performance and stability (date format ambiguous) | Platform | U |
| 2025-11 | 10.0.1 maintenance release | Security and lifecycle | C |
| 2026-03 | 10.5.0: Single Sign On for Firewall Admin | Management and API | C |
| 2026-03 | 10.5.0: removal of the Always use Session Password option | Security and lifecycle | C |
| 2026-08 | 10.5.1 maintenance release; the 9.0.6 line maintained in parallel | Security and lifecycle | C |
- Centre of gravity: Security and lifecycle (4), Firewall core (1), Packaging (1)
- Blind spots (no items): Routing, VPN, Threat protection, Network services, High availability, Observability, Licensing, AI
- Driver mix: Vision 0%, Customer need 75%, Market window 0%, Upstream 13%, Portfolio 13%
- Idea-to-need index: 0.00 (0 = demand-pulled, 1 = thesis-pushed)
Credibility: 14.5 / 25
| Criterion | Score | Basis |
|---|---|---|
| Cadence | 3.5 | Two firmware lines with releases every few months (10.0.0 June 2025, 10.0.1 November 2025, 10.5.0 March 2026, 10.5.1 August 2026); no published schedule |
| Roadmap transparency | 2 | Release notes public on Barracuda Campus; no public roadmap |
| Say-do | 3 | No dated promises found to test; the 9.0 and 10.0 launch claims are counts of enhancements |
| Velocity | 3 | One or two substantive capabilities per feature release, such as content policies in 9.0 and SSO in 10.5 |
| Lifecycle stability | 3 | Parallel 9.0.x and 10.x lines and in-place upgrades; 9.0.0 removed four components; end-of-support dates not readable |
Commercial risk: 14.5 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Price and licence volatility | 2.5 | No dated change found since 2023; no public prices to track |
| Purchase constraints | 3 | Capacity model by licensed cores, subscription through partners; no free edition |
| Channel and access | 3 | Channel and MSP sales; firmware downloads need a Barracuda Campus account |
| Owner stability | 3 | Two private-equity owners in five years: Thoma Bravo 2017, KKR since August 2022 |
| Cost of staying supported | 3 | Energize Updates subscription required for updates and support |
Technical lock-in: 13.5 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Formats | 3 | Barracuda box and Control Center configuration, PAR archives |
| Export path | 3 | Backup and restore between Barracuda firewalls; no converter to other vendors found |
| Stack coupling | 2.5 | Control Center optional for one firewall, needed for fleet features; TINA is a Barracuda-only VPN protocol |
| Hardware / cloud coupling | 2 | Four hypervisors and three clouds; one licence moves between them |
| Skills and tooling coupling | 3 | Firewall Admin and Control Center tooling; Barracuda training |
Integrator fit: 12.0 / 20
| Criterion | Score | Basis |
|---|---|---|
| Partner programme openness | 3.5 | Partner and MSP programmes; terms not read |
| Multi-tenancy and self-service | 3 | Control Center ranges and clusters give tenant separation (not verified in this pass) |
| API and infrastructure-as-code | 2.5 | REST API on the firewall and Control Center (not verified); no Terraform or Ansible content found |
| Skills and certification | 3 | Barracuda training and certification |
AI leverage: 1.5 / 20
How the product uses AI, scored per year like capability. Only GA counts.
| Criterion | 2019 | 2022 | Today | Latest step |
|---|---|---|---|---|
| AI in threat detection | 0 | 0 | 0 | 2015: None |
| AI platform stack | 0 | 0 | 0 | 2015: None |
| AI-assisted operations | 0 | 0 | 0 | 2015: None |
| Agent openness | 1.5 | 1.5 | 1.5 | 2015: REST API on the firewall and Control Center (not verified); no MCP server |
Year by year: 2015: 1.5 · 2016: 1.5 · 2017: 1.5 · 2018: 1.5 · 2019: 1.5 · 2020: 1.5 · 2021: 1.5 · 2022: 1.5 · 2023: 1.5 · 2024: 1.5 · 2025: 1.5 · 2026: 1.5
AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI items for the firewall were found from 2023 to 2026; Barracuda markets AI in its email products.
No AI feature is documented for CloudGen Firewall, and none was announced. The sandbox and threat feeds are signature and reputation based as far as the sources read show.
Reading
CloudGen Firewall earns its scores on SD-WAN, VPN and central management, where TINA tunnels, dynamic mesh and Control Center have been in place for years, and on a KEV record with no firewall entries since 2023. The weak points are not in the product: prices, support dates and the 10.x feature lists are hard to find in public, and the company has changed private-equity owners twice since 2017. A buyer should get the end-of-support dates for the 9.0 and 10.5 lines in writing, because the public page could not be read. Proxmox VE is not on the supported list, so a homelab should expect the KVM image to run unsupported at best.
Open questions and items to re-score
- End-of-support dates for the 9.0.x and 10.x lines; the Barracuda page was not readable.
- The month of 9.0.0 and whether 10.0.0 shipped on 2025-06-10 or 2025-10-06; the release notes use an ambiguous date format.
- Marketplace licensing (BYOL, PAYG, hourly) and public prices.
- REST API coverage on the firewall and Control Center.
- Feature list of 10.5 beyond Single Sign On.
- Capability steps dated 2018 and 2020 rest on the dossier's unsourced timeline.
Related reading
More from Firewall and Router Ledger 2026
- Overview: all platforms side by side
- Firewall and Router Ledger Methodology: How Every Score Is Built
- Check Point: Firewall and Router Ledger 2026 Scorecard
- Cisco FTD: Firewall and Router Ledger 2026 Scorecard
- Forcepoint NGFW: Firewall and Router Ledger 2026 Scorecard
- FortiGate: Firewall and Router Ledger 2026 Scorecard
- IPFire: Firewall and Router Ledger 2026 Scorecard
- Juniper vSRX: Firewall and Router Ledger 2026 Scorecard
- Netgate TNSR: Firewall and Router Ledger 2026 Scorecard
- NG Firewall: Firewall and Router Ledger 2026 Scorecard
- OpenWrt: Firewall and Router Ledger 2026 Scorecard
- OPNsense: Firewall and Router Ledger 2026 Scorecard
- Palo Alto: Firewall and Router Ledger 2026 Scorecard
- pfSense: Firewall and Router Ledger 2026 Scorecard
- RouterOS: Firewall and Router Ledger 2026 Scorecard
- SonicWall NSv: Firewall and Router Ledger 2026 Scorecard
- Sophos Firewall: Firewall and Router Ledger 2026 Scorecard
- VyOS: Firewall and Router Ledger 2026 Scorecard
- WatchGuard: Firewall and Router Ledger 2026 Scorecard