Cisco FTD: Firewall and Router Ledger 2026 Scorecard

Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: product (subscription)
Owner: Cisco Systems, Inc. (public, NASDAQ: CSCO, San Jose, California); Snort and the FirePOWER line came with Sourcefire in 2013
Engine: Snort 3 (open source IPS engine owned by Cisco) inside Threat Defense; ASAv follows the ASA code line
Licence: Proprietary. Threat Defense Virtual is licensed by performance tier (FTDv5 100 Mbps to FTDv100 16 Gbps and FTDvU without rate limit) under a base subscription plus Threat, Malware Defense and URL Filtering add-ons; BYOL on all clouds, PAYG on AWS and Azure. Management needs the Firewall Management Center (separate licence) or cloud-delivered management. No public price; a 90 day evaluation mode is reported in a 2020 community post only
Latest release: Version 10.0.1 (2026-02-18); 10.0.0 build dated 2025-12-23; 10.0.2 announced in a Cisco blog (date not read)
Support lifecycle: Per-release end-of-support notices; 7.7 (2025-03-14) ends 2027-09-29 per a secondary source; no lifecycle page for 10.0 found. Devices upgrade in place through the Management Center
Next milestone: none published with a date
Hypervisors: VMware, KVM, OpenStack, Nutanix AHV, HyperFlex and, from 10.0, Microsoft Hyper-V; clouds AWS, Azure, GCP, OCI, Alibaba, Megaport and Equinix. Minimum 4 vCPU and 8 GB RAM; FTDvU with 64 vCPU on VMware and KVM only. Proxmox VE, XCP-ng and ARM are not listed
Security record: Nine ASA and FTD software entries on the CISA KEV catalogue since 2023: CVE-2023-20269 (2023-09-13), CVE-2020-3259 (2024-02-15), CVE-2024-20359 and CVE-2024-20353 (2024-04-24), CVE-2024-20481 (2024-10-24), CVE-2014-2120 (2024-11-12), CVE-2025-20362 and CVE-2025-20333 (2025-09-25), CVE-2026-20349 (2026-08-11). Three Management Center entries counted separately: CVE-2026-20131 (2026-03-19), CVE-2026-20316 (2026-07-29), CVE-2026-20079 (2026-09-09). Advisories: https://sec.cloudapps.cisco.com/security/center/publicationListing.x
Tier: Enterprise virtual appliance
Archetype: Dependable builder, slowed by renames
Evidence grade: B. The Threat Defense Virtual data sheet, the 10.0 release notes and getting started guide, the 10.0.2 blog and the CISA KEV catalogue were read from primary sources. Release dates conflict between Cisco pages and aggregators, the lifecycle page for 10.0 was not found, and feature content before 7.7 is attributed from secondary sources.

Scorecard

Dimension	Score	Direction
Capability today	81.0 / 100	higher is better
Momentum since end of 2022	+2.8 points (2015 to 2022: +17.0)	higher is better
Credibility	15.0 / 25	higher is better
Commercial risk	13.5 / 25	lower is better
Technical lock-in	14.0 / 25	lower is better
Integrator fit	16.0 / 20	higher is better
AI leverage	5.5 / 20	higher is better
Ledger Index	60.8 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Routing and WAN (12)	3	3	3.5	4
Firewall and NAT core (12)	3.5	4	4.5	4.5
VPN and remote access (12)	3.5	3.5	3.5	4.5
Threat protection (12)	2.5	4	4.5	5
Network services (8)	3	3	3	3
Platform and hypervisor freedom (10)	2.5	3.5	4	4
High availability and performance (8)	3	3	4.5	4.5
Management, API and automation (10)	3	3.5	4	4.5
Observability (6)	3	3.5	4	4
Platform security and lifecycle (10)	3.5	3.5	3.5	2
Total / 100	61.2	69.6	78.2	81.0

Year by year: 2015: 61.2 · 2016: 67.6 · 2017: 67.6 · 2018: 67.6 · 2019: 69.6 · 2020: 71.6 · 2021: 71.6 · 2022: 78.2 · 2023: 80.6 · 2024: 78.6 · 2025: 81.0 · 2026: 81.0

What moved the score

Year	Domain	Change	Points	Trigger
2016	Firewall and NAT core	3.5 → 4	+1.2	Threat Defense 6.0: application and user based access control from the Sourcefire line
2016	Management, API and automation	3 → 3.5	+1.0	Threat Defense 6.0: Firewall Management Center for fleets
2016	Observability	3 → 3.5	+0.6	Threat Defense 6.0: Management Center event viewer and dashboards
2016	Threat protection	2.5 → 4	+3.6	Threat Defense 6.0: Snort IPS with Talos updates, Malware Defense, URL filtering and TLS decryption
2019	Platform and hypervisor freedom	2.5 → 3.5	+2.0	6.2 to 6.5: Threat Defense Virtual on AWS, Azure and KVM beside VMware
2020	Management, API and automation	3.5 → 4	+1.0	6.6 and 6.7: Management Center REST API and cloud-delivered management
2020	Platform and hypervisor freedom	3.5 → 4	+1.0	6.6 and 6.7: Nutanix AHV, OpenStack and HyperFlex beside VMware, KVM and the clouds; Hyper-V arrives in 10.0; no ARM, Proxmox VE or XCP-ng
2022	Firewall and NAT core	4 → 4.5	+1.2	By 7.2: shared objects across Management Center domains and rule hit counts; IPv6 parity has gaps in some features
2022	High availability and performance	3 → 4.5	+2.4	7.1 and 7.2: Threat Defense Virtual clustering on VMware, KVM and the public clouds, auto-scale on AWS, Azure, GCP and OCI
2022	Observability	3.5 → 4	+0.6	By 7.2: unified event viewer, health monitoring dashboards and packet capture in the Management Center; SIEM integrations
2022	Routing and WAN	3 → 3.5	+1.2	7.1 and 7.2: virtual routers (VRFs) and policy-based routing with path monitoring in Threat Defense
2022	Threat protection	4 → 4.5	+1.2	7.2: Snort 3 as the default engine
2023	Management, API and automation	4 → 4.5	+1.0	By 7.4: Terraform provider (CiscoDevNet/fmc), Ansible collections and low-touch provisioning; multi-domain in the Management Center
2023	Platform security and lifecycle	3.5 → 3	-1.0	2023: KEV entry CVE-2023-20269 (2023-09-13); score lowered 0.5
2023	Routing and WAN	3.5 → 4	+1.2	7.3 and 7.4: up to 30 VRF instances on the virtual appliance and SD-WAN style path selection with probes; no EVPN or MPLS
2023	VPN and remote access	3.5 → 4	+1.2	7.3 and 7.4: route-based VTIs with dynamic hub-and-spoke and remote access enhancements with SAML MFA
2024	Platform security and lifecycle	3 → 2	-2.0	2024: CVE-2020-3259 (2024-02-15), CVE-2024-20359 and CVE-2024-20353 (2024-04-24); penalty capped at 1.5. CVE-2024-20481, CVE-2014-2120, CVE-2025-20362, CVE-2025-20333 and CVE-2026-20349 add no further penalty
2025	Threat protection	4.5 → 5	+1.2	10.0: SnortML protections for SQL injection, command injection and cross-site scripting; decryption policy UI
2025	VPN and remote access	4 → 4.5	+1.2	7.7.10: Universal ZTNA beside IPsec and Secure Client

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-09	CVE-2023-20269 remote access VPN unauthorized access added to the KEV catalogue	Security and lifecycle	C
2024-04	CVE-2024-20353 and CVE-2024-20359 (ArcaneDoor campaign) added to the KEV catalogue	Security and lifecycle	C
2024-10	CVE-2024-20481 remote access VPN denial of service added to the KEV catalogue	Security and lifecycle	C
2025-03	7.7: Universal ZTNA arrives in 7.7.10	VPN	V
2025-09	CVE-2025-20333 and CVE-2025-20362 added to the KEV catalogue	Security and lifecycle	C
2025-12	Version 10.0: new numbering scheme and Hybrid Mesh Firewall with the Mesh Policy Engine (status not verified)	Packaging	V
2025-12	10.0: SnortML machine learning protections for injection and XSS attacks	AI	V
2025-12	10.0: Hyper-V for Threat Defense Virtual, FTDvU with 64 vCPU, OpenStack Caracal, dynamic disk expansion	Platform	C
2026-02	10.0.1 maintenance release	Security and lifecycle	C
2026-03	Management Center CVE-2026-20131 deserialization flaw added to the KEV catalogue; two more follow in July and September	Management and API	C
2026-08	CVE-2026-20349 heap inspection flaw added to the KEV catalogue	Security and lifecycle	C

Centre of gravity: Security and lifecycle (6), VPN (1), Packaging (1)
Blind spots (no items): Routing, Firewall core, Threat protection, Network services, High availability, Observability, Licensing
Driver mix: Vision 27%, Customer need 73%, Market window 0%, Upstream 0%, Portfolio 0%
Idea-to-need index: 0.27 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 15.0 / 25

Criterion	Score	Basis
Cadence	3.5	A feature release about yearly (7.4 2023, 7.6 2024, 7.7 2025-03, 10.0 2025-12) with maintenance builds; dates conflict across Cisco pages and are not announced in advance
Roadmap transparency	2.5	Public release notes, data sheets and advisories; direction in blogs and Cisco Live sessions; no dated roadmap
Say-do	3	ZTNA, SnortML and Hyper-V shipped as announced; the Mesh Policy Engine status could not be verified
Velocity	3.5	One or two substantive capabilities per release
Lifecycle stability	2.5	Renamed from FTDv to NGFWv to Threat Defense Virtual, numbering jumped from 7.7 to 10.0, and the Management Center must be upgraded in step with devices

Commercial risk: 13.5 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	2.5	Performance-tier licensing since 7.0; no public price, so changes cannot be checked
Purchase constraints	3.5	Subscription only through Smart Licensing; a Management Center or cloud management licence is required
Channel and access	3.5	Partner and distributor sales; downloads need a Cisco account with an active contract
Owner stability	0.5	Independent public company; the firewall line has been in-house since 2013
Cost of staying supported	3.5	Short release windows, paired device and management upgrades, add-on subscriptions renewed per term

Technical lock-in: 14.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	3	Threat Defense configuration lives in the Management Center; ASA configuration is a portable text file
Export path	3	Cisco's Firewall Migration Tool imports from ASA, Check Point, Palo Alto and Fortinet; leaving is a manual rebuild
Stack coupling	3	Management Center or cloud management, Smart Licensing and Talos subscriptions are required
Hardware / cloud coupling	2	Any listed hypervisor or cloud; FTDvU only on VMware and KVM
Skills and tooling coupling	3	ASA and Threat Defense skills (CCNP Security); vendor-specific Terraform and Ansible content

Integrator fit: 16.0 / 20

Criterion	Score	Basis
Partner programme openness	4	Large global partner programme with specialisations; terms not read
Multi-tenancy and self-service	3.5	Multi-domain in the Management Center; no self-service portal
API and infrastructure-as-code	4	Management Center REST API, Terraform provider and Ansible collections
Skills and certification	4.5	CCNP and CCIE Security certifications with the largest talent pool in the group

AI leverage: 5.5 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI in threat detection	1	1	3	2025: 10.0: SnortML machine learning detection GA for SQL injection, command injection and cross-site scripting (Cisco blog)
AI platform stack	0	0	0	2015: None
AI-assisted operations	0	0	0.5	2025: Cisco AI Assistant for Security Cloud Control is a vendor claim not verified for the Management Center; counted as a half step
Agent openness	2	2	2	2015: Management Center REST API with tokens; no official MCP server found

Year by year: 2015: 3 · 2016: 3 · 2017: 3 · 2018: 3 · 2019: 3 · 2020: 3 · 2021: 3 · 2022: 3 · 2023: 3 · 2024: 3 · 2025: 5.5 · 2026: 5.5

AI say-do, 2023 to 2026: 2 AI items announced; 1 GA, 0 still preview, 1 pending, 0 dropped. GA: SnortML in 10.0; pending: the AI Assistant for firewall administration, whose scope and GA status were not verified.

Cisco is the only vendor in this group with machine-learning detection verified as GA on the firewall itself, through SnortML in 10.0. Everything else is an API that agents can drive; no official MCP server was found and the AI Assistant claims were not checked.

Reading

Threat Defense Virtual scores well on platform list, clustering and threat protection, and 10.0 added Hyper-V and the 64 vCPU tier. The lifecycle domain carries the full KEV penalty: nine ASA and FTD entries since 2023, including the ArcaneDoor pair in 2024 and two more in September 2025, plus three Management Center entries in 2026. Credibility suffers from the renames and the numbering jump to 10.0, which make release dates hard to pin down even from Cisco's own pages. The buyer's check is the management plane: the Management Center is mandatory, licensed separately, and now has its own exploited flaws, so budget for its patching alongside the firewalls.

Open questions and items to re-score

The GA date of Threat Defense 10.0.0 differs between the Cisco release notes (build dated 2025-12-23) and an aggregator (2026-02); the Cisco date was used.
No lifecycle page for 10.0 was found; the 7.7 end date comes from a secondary source.
Which Hyper-V versions 10.0 supports, the ASAv release list and licensing, and the current 90 day evaluation mode were not verified.
Features attributed to 6.0, 6.2 to 6.7, 7.1 to 7.4 were attributed from secondary sources and dated by train.
The Mesh Policy Engine status and the AI Assistant's coverage of the Management Center were not verified.

	’16	’19	’20	’22	’23	’25
Routing and WAN				2	1
Firewall and NAT core	2			3
VPN and remote access					2	1
Threat protection	1					2
Network services
Platform and hypervisor freedom		1	1
High availability and performance				1
Management, API and automation	3		2		3
Observability
Platform security and lifecycle