Firewall and Router Ledger 2026
Ledger
Firewall and Router Ledger 2026
Check Point: Firewall and Router Ledger 2026 Scorecard
Check Point's gateway pairs reference-grade policy management with four-year support windows, but its hypervisor list is unpublished and two gateway flaws sit on the KEV catalogue.
Edition October 16, 20268 min read
Where Check Point CloudGuard put its effort, 2016 to 2026
Each square is one capability area in one year. The brighter it is, the more the area gained in the Firewall and Router Ledger that year; 1, 2 and 3 mark that year's biggest pushes.
| ’16 | ’17 | ’18 | ’19 | ’20 | ’21 | ’22 | ’23 | ’24 | ’25 | ’26 | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Routing and WAN | 1 | 1 | |||||||||
| Firewall and NAT core | 2 | ||||||||||
| VPN and remote access | 2 | ||||||||||
| Threat protection | 3 | 3 | |||||||||
| Network services | |||||||||||
| Platform and hypervisor freedom | 1 | ||||||||||
| High availability and performance | |||||||||||
| Management, API and automation | 1 | ||||||||||
| Observability | |||||||||||
| Platform security and lifecycle |
no change+0.5+1+1.5 or moreScores out of 5 per area.
Biggest pushes overall: Routing and WAN (+1), Threat protection (+1), Platform and hypervisor freedom (+1). Already strong in 2015: High availability and performance, Firewall and NAT core, Threat protection.
Top focus each year: 2017 Routing and WAN; 2020 Management, API and automation; 2022 Routing and WAN; 2024 Platform and hypervisor freedom. 7 of 11 years show no gain in any area.
Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.
Snapshot
- Type: product (subscription)
- Owner: Check Point Software Technologies Ltd. (public, NASDAQ: CHKP, Tel Aviv)
- Licence: Proprietary. Virtual gateways are licensed per core or through cloud marketplaces with usage or contract pricing; management is a separate server. No public list price for on-premises virtual editions; no free edition found (an evaluation licence exists, terms not read)
- Latest release: R82.10 (GA 2025-12, now the recommended version); R82.10 clean install packages dated 2026-03-31; a July 2026 jumbo hotfix followed the SmartConsole exploitation
- Support lifecycle: At least four years from GA: R82.10 to 2030-06, R82 to 2029-04, R81.20 to 2027-05 (an older page said 2026-11), R81.10 ended 2026-03
- Next milestone: none published with a date
- Hypervisors: The R82 release notes name Open Servers and Virtual Machines and point to the Hardware Compatibility List for hypervisors, which could not be read; community reports name VMware and Hyper-V. Clouds in the release notes: AWS, Azure and GCP in full, plus OCI, Huawei Cloud and Tencent Cloud in limited form. KVM, Proxmox VE, XCP-ng and ARM were not found
- Security record: Two Security Gateway entries on the CISA KEV catalogue since 2023: CVE-2024-24919 (2024-05-30, information disclosure, ransomware use flagged) and CVE-2026-50751 (2026-06-08, improper authentication, ransomware use flagged). Three management or multi-product entries counted separately: CVE-2026-16232 SmartConsole (2026-07-22), CVE-2026-93616 and CVE-2026-85102 (2026-09-22). Advisories: https://support.checkpoint.com/ (Security Alerts)
- Tier: Enterprise virtual appliance
- Archetype: Dependable builder with an AI push
- Evidence grade: C. The support lifecycle page, the R82 supported environments page, the SmartConsole advisory and the CISA KEV catalogue were read from primary sources. The Hardware Compatibility List that holds the virtual machine hypervisor list could not be read, R82.10 feature content comes from a community post seen through a search summary, and feature content before R82 is dated from the lifecycle table with features attributed from secondary sources.
Scorecard
| Dimension | Score | Direction |
|---|---|---|
| Capability today | 77.6 / 100 | higher is better |
| Momentum since end of 2022 | -1.0 points (2015 to 2022: +11.6) | higher is better |
| Credibility | 16.0 / 25 | higher is better |
| Commercial risk | 13.0 / 25 | lower is better |
| Technical lock-in | 15.0 / 25 | lower is better |
| Integrator fit | 17.0 / 20 | higher is better |
| AI leverage | 9.5 / 20 | higher is better |
| Ledger Index | 62.0 / 100 | balanced weights; see the methodology |
Capability by domain, 2015 to today
Scores 0 to 5 against fixed anchors; total is weighted to 100.
| Domain (weight) | 2015 | 2019 | 2022 | Today |
|---|---|---|---|---|
| Routing and WAN (12) | 2.5 | 3 | 3.5 | 3.5 |
| Firewall and NAT core (12) | 4 | 4.5 | 4.5 | 4.5 |
| VPN and remote access (12) | 3.5 | 3.5 | 4 | 4 |
| Threat protection (12) | 4 | 4.5 | 5 | 5 |
| Network services (8) | 2.5 | 3 | 3 | 3 |
| Platform and hypervisor freedom (10) | 2 | 2.5 | 2.5 | 3 |
| High availability and performance (8) | 4.5 | 4.5 | 4.5 | 4.5 |
| Management, API and automation (10) | 3.5 | 4 | 4.5 | 4.5 |
| Observability (6) | 3.5 | 4 | 4 | 4 |
| Platform security and lifecycle (10) | 3.5 | 3.5 | 3.5 | 2.5 |
| Total / 100 | 67.0 | 74.0 | 78.6 | 77.6 |
Year by year: 2015: 67.0 · 2016: 67.0 · 2017: 74.0 · 2018: 74.0 · 2019: 74.0 · 2020: 75.0 · 2021: 75.0 · 2022: 78.6 · 2023: 78.6 · 2024: 78.6 · 2025: 78.6 · 2026: 77.6
What moved the score
| Year | Domain | Change | Points | Trigger |
|---|---|---|---|---|
| 2017 | Firewall and NAT core | 4 → 4.5 | +1.2 | R80.10: unified policy layers shared across gateways, hit counts; IPv6 parity has gaps across blades |
| 2017 | Management, API and automation | 3.5 → 4 | +1.0 | R80.10: management API covering all objects; SmartConsole |
| 2017 | Network services | 2.5 → 3 | +0.8 | R80.10: Identity Awareness captive portal beside DHCP, NTP and RADIUS; no DHCP failover, DNS over TLS or voucher portal |
| 2017 | Observability | 3.5 → 4 | +0.6 | R80.10: unified logs and views in SmartConsole with SmartEvent and SIEM integrations |
| 2017 | Platform and hypervisor freedom | 2 → 2.5 | +1.0 | vSEC and CloudGuard IaaS: Azure and GCP images |
| 2017 | Routing and WAN | 2.5 → 3 | +1.2 | R80.10: routing and VRRP management in Gaia with cluster-aware dynamic routing |
| 2017 | Threat protection | 4 → 4.5 | +1.2 | R80.10: unified Threat Prevention policy with Threat Emulation sandbox |
| 2020 | Management, API and automation | 4 → 4.5 | +1.0 | R80.40 and R81: Central Deployment and zero-touch; Terraform provider and Ansible collection exist (vendor status not verified); Multi-Domain Server for fleets |
| 2022 | Routing and WAN | 3 → 3.5 | +1.2 | R81.20: SD-WAN beside OSPF, BGP and PBR; VRFs through VSX; no EVPN or MPLS |
| 2022 | Threat protection | 4.5 → 5 | +1.2 | R81.20: Threat Prevention updates with autonomous policy profiles, TLS inspection and documented exception handling |
| 2022 | VPN and remote access | 3.5 → 4 | +1.2 | R81.20: SD-WAN overlays beside IPsec and the remote access client; ZTNA sits in the separate Harmony products |
| 2024 | Platform and hypervisor freedom | 2.5 → 3 | +1.0 | R82: AWS, Azure, GCP in full with OCI, Huawei and Tencent limited; hypervisors documented only on the unreadable HCL; no ARM, KVM, Proxmox VE or XCP-ng found |
| 2024 | Platform security and lifecycle | 3.5 → 3 | -1.0 | 2024: KEV entry CVE-2024-24919 (2024-05-30); score lowered 0.5 |
| 2026 | Platform security and lifecycle | 3 → 2.5 | -1.0 | 2026: second gateway KEV entry CVE-2026-50751 (2026-06-08); score lowered 1.0 in total. Management entries CVE-2026-16232, CVE-2026-93616 and CVE-2026-85102 are not penalised |
Direction, 2023 to 2026
Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
| Date | Item | Theme | Driver |
|---|---|---|---|
| 2024-05 | CVE-2024-24919 gateway information disclosure added to the KEV catalogue | Security and lifecycle | C |
| 2024-10 | R82: 64-bit management kernel, Gaia updates | Platform | C |
| 2024-10 | R82: AWS Gateway Load Balancer, Azure Virtual WAN and GCP managed instance groups | Platform | M |
| 2025-12 | R82.10: more than 20 capabilities; recommended version for all customers | Firewall core | C |
| 2025-12 | R82.10: GenAI application visibility including MCP usage | AI | V |
| 2025-12 | R82.10 support window published to 2030-06 | Security and lifecycle | C |
| 2025-12 | Quantum Management MCP server published as open source (version 0.0.x) | AI | V |
| 2026-06 | CVE-2026-50751 gateway authentication flaw added to the KEV catalogue | Security and lifecycle | C |
| 2026-07 | SmartConsole CVE-2026-16232 exploited; jumbo hotfix under the Frontier AI Readiness Program | Security and lifecycle | C |
| 2026-09 | Two multi-product entries added to the KEV catalogue (CVE-2026-93616, CVE-2026-85102) | Security and lifecycle | C |
| 2026-09 | Agentic Exposure Validation announced (press release) | AI | V |
- Centre of gravity: Security and lifecycle (5), AI (3), Platform (2)
- Blind spots (no items): Routing, VPN, Threat protection, Network services, High availability, Management and API, Observability, Packaging, Licensing
- Driver mix: Vision 27%, Customer need 64%, Market window 9%, Upstream 0%, Portfolio 0%
- Idea-to-need index: 0.27 (0 = demand-pulled, 1 = thesis-pushed)
Credibility: 16.0 / 25
| Criterion | Score | Basis |
|---|---|---|
| Cadence | 3.5 | A major about every 14 months (R81.20 2022-11, R82 2024-10, R82.10 2025-12) with jumbo hotfix takes in between; dates are not announced in advance |
| Roadmap transparency | 2 | Release notes and lifecycle page are public; downloads and parts of the documentation need a login; no public roadmap |
| Say-do | 3 | R82 and R82.10 shipped as announced; the AI Copilot and Agentic Exposure Validation items could not be verified as GA |
| Velocity | 3.5 | One or two substantive capabilities per major plus steady hotfix takes |
| Lifecycle stability | 4 | Four-year minimum support, in-place upgrades; the R81.20 end date moved between pages |
Commercial risk: 13.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Price and licence volatility | 2.5 | No public price for virtual editions; marketplace listings are usage based; no change could be checked |
| Purchase constraints | 3.5 | Quote only, subscription and management server required |
| Channel and access | 3.5 | Partner and marketplace sales; downloads and hotfixes behind the Support Center login |
| Owner stability | 0.5 | Independent public company since 1993 |
| Cost of staying supported | 3 | Four-year windows; management and gateway must be upgraded in step; blades renewed per term |
Technical lock-in: 15.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Formats | 3.5 | Policy and objects live in the management database; export through the management API and migrate tools |
| Export path | 3 | Leaving means a manual rebuild or another vendor's converter |
| Stack coupling | 3 | A Security Management or Multi-Domain server is required; features sold as blades |
| Hardware / cloud coupling | 2 | Virtual and cloud images exist but the supported hypervisor list is unpublished outside the HCL |
| Skills and tooling coupling | 3.5 | SmartConsole and Gaia skills; CCSA and CCSE certifications |
Integrator fit: 17.0 / 20
| Criterion | Score | Basis |
|---|---|---|
| Partner programme openness | 4 | Channel partner programme and marketplaces; terms not read |
| Multi-tenancy and self-service | 4.5 | Multi-Domain Server and VSX virtual systems for provider tenancy |
| API and infrastructure-as-code | 4 | Management API covers all objects; Terraform provider and Ansible collection exist (vendor status not verified) |
| Skills and certification | 4.5 | Exam-based CCSA and CCSE with a long-established talent pool |
AI leverage: 9.5 / 20
How the product uses AI, scored per year like capability. Only GA counts.
| Criterion | 2019 | 2022 | Today | Latest step |
|---|---|---|---|---|
| AI in threat detection | 1 | 1 | 3 | 2025: R82.10: GenAI application visibility including MCP usage and AI-related threat prevention GA (community post, vendor claim) |
| AI platform stack | 0 | 0 | 3 | 2025: R82.10: GenAI application controls GA; Agentic Exposure Validation announced 2026, not verified |
| AI-assisted operations | 0 | 0 | 0.5 | 2025: AI Copilot for administrators exists in the community; GA status not verified, counted as a half step |
| Agent openness | 2 | 2 | 3 | 2025: Official Quantum Management MCP server on GitHub (CheckPointSW/mcp-servers), version 0.0.10, preview grade; R82.10 compatibility not stated |
Year by year: 2015: 3 · 2016: 3 · 2017: 3 · 2018: 3 · 2019: 3 · 2020: 3 · 2021: 3 · 2022: 3 · 2023: 3 · 2024: 3 · 2025: 9.5 · 2026: 9.5
AI say-do, 2023 to 2026: 4 AI items announced; 1 GA, 1 still preview, 2 pending, 0 dropped. GA: GenAI visibility in R82.10; preview: the Quantum Management MCP server; pending: AI Copilot GA status and Agentic Exposure Validation.
Check Point is the only vendor in this group with an official MCP server for its management plane, which lifts agent openness even though the server is below version 1. The GenAI visibility in R82.10 and the Copilot are vendor claims seen through community posts, so the AI say-do record is mostly unverified.
Reading
Check Point scores where it always has: policy management, threat prevention and clustering are at or near the reference, and the four-year support windows are the longest in the group. It loses points on platform freedom because the hypervisor list for the virtual gateway lives on a compatibility list this edition could not read, no KVM or ARM image was found, and a management server is mandatory. The security record is better than Fortinet's or Palo Alto's on the gateway itself, with two entries, but 2026 brought three more exploited flaws on the management side. The buyer's check is the management plane: SmartConsole and the management server need the same patch discipline as the gateway.
Open questions and items to re-score
- The Hardware Compatibility List virtual machine tab (hypervisors and versions for R82.10) could not be read; the platform score assumes VMware and Hyper-V from community reports only.
- R81.20 end of support: 2026-11 on an older page, 2027-05 on the page read.
- Whether CVE-2026-85102 and CVE-2026-93616 affect the gateway as well as management; they were counted as management entries.
- Evaluation licence terms, on-premises virtual prices, and the vendor status of the Terraform provider and Ansible collection were not verified.
- Features attributed to R77.30, R80.10, R80.40 and R81.20 were dated from the lifecycle table and attributed from secondary sources.
- AI Copilot GA status and the Agentic Exposure Validation release date were not found.
Related reading
More from Firewall and Router Ledger 2026
- Overview: all platforms side by side
- Firewall and Router Ledger Methodology: How Every Score Is Built
- Barracuda: Firewall and Router Ledger 2026 Scorecard
- Cisco FTD: Firewall and Router Ledger 2026 Scorecard
- Forcepoint NGFW: Firewall and Router Ledger 2026 Scorecard
- FortiGate: Firewall and Router Ledger 2026 Scorecard
- IPFire: Firewall and Router Ledger 2026 Scorecard
- Juniper vSRX: Firewall and Router Ledger 2026 Scorecard
- Netgate TNSR: Firewall and Router Ledger 2026 Scorecard
- NG Firewall: Firewall and Router Ledger 2026 Scorecard
- OpenWrt: Firewall and Router Ledger 2026 Scorecard
- OPNsense: Firewall and Router Ledger 2026 Scorecard
- Palo Alto: Firewall and Router Ledger 2026 Scorecard
- pfSense: Firewall and Router Ledger 2026 Scorecard
- RouterOS: Firewall and Router Ledger 2026 Scorecard
- SonicWall NSv: Firewall and Router Ledger 2026 Scorecard
- Sophos Firewall: Firewall and Router Ledger 2026 Scorecard
- VyOS: Firewall and Router Ledger 2026 Scorecard
- WatchGuard: Firewall and Router Ledger 2026 Scorecard