Forcepoint NGFW: Firewall and Router Ledger 2026 Scorecard
Forcepoint's Stonesoft-derived firewall keeps a clean KEV record and strong clustering, under three renames since 7.0 and the thinnest public evidence in this group.
Where Forcepoint NGFW put its effort, 2016 to 2026
Each square is one capability area in one year. The brighter it is, the more the area gained in the Firewall and Router Ledger that year; 1, 2 and 3 mark that year's biggest pushes.
| ’16 | ’17 | ’18 | ’19 | ’20 | ’21 | ’22 | ’23 | ’24 | ’25 | ’26 | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Routing and WAN | 1 | ||||||||||
| Firewall and NAT core | 1 | ||||||||||
| VPN and remote access | |||||||||||
| Threat protection | 2 | ||||||||||
| Network services | |||||||||||
| Platform and hypervisor freedom | 1 | ||||||||||
| High availability and performance | |||||||||||
| Management, API and automation | 3 | ||||||||||
| Observability | |||||||||||
| Platform security and lifecycle |
Biggest pushes overall: Routing and WAN (+0.5), Firewall and NAT core (+0.5), Threat protection (+0.5). Already strong in 2015: High availability and performance, Firewall and NAT core, VPN and remote access.
Top focus each year: 2019 Firewall and NAT core; 2020 Platform and hypervisor freedom; 2022 Routing and WAN. 8 of 11 years show no gain in any area.
Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.
Snapshot
- Type: product
- Owner: Forcepoint LLC (Austin, US; private; Francisco Partners since January 2021; the government business was sold to TPG in 2023 and which entity holds the NGFW line after that split was not confirmed)
- Licence: Proprietary. Security Engine (virtual or appliance) and Security Management Center licensed by quote; metric, prices and any free tier not found
- Latest release: Security Engine 7.5.0 (release notes dated 2026-06-16, Feature Stream); 7.5.1 named as a fixed build in September 2026
- Support lifecycle: A Feature Stream and long-term model is named in the 7.5.0 notes; dates were not readable and no end-of-support dates were found
- Next milestone: none published
- Security record: 0 CISA KEV entries since 2023. Security policy bypass CVE-2026-12974 reported 2026-09-23, fixed in 7.3.4, 7.4.2 and 7.5.1; advisory page not found, release notes at help.forcepoint.com
- Hypervisors: VMware ESXi 7.0 and 8.0; KVM on Red Hat Enterprise Linux 9.x and 10.x (8.5 and 9.x in 7.4.1); Hyper-V only for Layer 3 engines on Windows Server 2016 per the 7.3 and 7.4 notes; a cloud section exists but providers were not read; Proxmox VE and XCP-ng not listed; no ARM
- Tier: Enterprise virtual appliance
- Archetype: Portfolio reshuffle
- Evidence grade: C. The release notes index and the 7.5.0 notes metadata, the 7.4 virtual node requirements, the CVE-2026-12974 advisory, the ownership press coverage and the KEV check were read. The feature lists in the release notes PDFs could not be decoded, so routing, VPN and threat capability rest on the dossier's knowledge of the Stonesoft line, and no release date for 7.3 to 7.5 beyond the 7.5.0 document date was found.
Scorecard
| Dimension | Score | Direction |
|---|---|---|
| Capability today | 70.6 / 100 | higher is better |
| Momentum since end of 2022 | +0.0 points (2015 to 2022: +5.6) | higher is better |
| Credibility | 11.5 / 25 | higher is better |
| Commercial risk | 16.0 / 25 | lower is better |
| Technical lock-in | 15.5 / 25 | lower is better |
| Integrator fit | 10.5 / 20 | higher is better |
| AI leverage | 1.5 / 20 | higher is better |
| Ledger Index | 47.3 / 100 | balanced weights; see the methodology |
Capability by domain, 2015 to today
Scores 0 to 5 against fixed anchors; total is weighted to 100.
| Domain (weight) | 2015 | 2019 | 2022 | Today |
|---|---|---|---|---|
| Routing and WAN (12) | 3 | 3 | 3.5 | 3.5 |
| Firewall and NAT core (12) | 3.5 | 4 | 4 | 4 |
| VPN and remote access (12) | 3.5 | 3.5 | 3.5 | 3.5 |
| Threat protection (12) | 3.5 | 4 | 4 | 4 |
| Network services (8) | 2.5 | 2.5 | 2.5 | 2.5 |
| Platform and hypervisor freedom (10) | 2.5 | 2.5 | 3 | 3 |
| High availability and performance (8) | 4 | 4 | 4 | 4 |
| Management, API and automation (10) | 3.5 | 4 | 4 | 4 |
| Observability (6) | 3.5 | 3.5 | 3.5 | 3.5 |
| Platform security and lifecycle (10) | 3 | 3 | 3 | 3 |
| Total / 100 | 65.0 | 68.4 | 70.6 | 70.6 |
Year by year: 2015: 65.0 · 2016: 65.0 · 2017: 65.0 · 2018: 65.0 · 2019: 68.4 · 2020: 69.4 · 2021: 69.4 · 2022: 70.6 · 2023: 70.6 · 2024: 70.6 · 2025: 70.6 · 2026: 70.6
What moved the score
| Year | Domain | Change | Points | Trigger |
|---|---|---|---|---|
| 2019 | Firewall and NAT core | 3.5 → 4 | +1.2 | 6.x: policy hit counters and application depth in SMC (grade C for the year) |
| 2019 | Management, API and automation | 3.5 → 4 | +1.0 | 6.x: NGFW Manager and SMC domains for tenant separation (grade C for the year) |
| 2019 | Threat protection | 3.5 → 4 | +1.2 | 6.x: Advanced Malware Detection sandbox integration and TLS inspection (grade C for the year) |
| 2020 | Platform and hypervisor freedom | 2.5 → 3 | +1.0 | Hyper-V for Layer 3 engines and cloud images (grade C for the year); no Proxmox VE, XCP-ng or ARM |
| 2022 | Routing and WAN | 3 → 3.5 | +1.2 | 7.1: FlexEdge Secure SD-WAN naming with multi-link path selection (feature items not read); no VRFs, MPLS or EVPN verified |
Direction, 2023 to 2026
Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
| Date | Item | Theme | Driver |
|---|---|---|---|
| 2023-01 | Sale of the Global Governments and Critical Infrastructure business to TPG; the commercial business stays with Francisco Partners (month not verified) | Packaging | P |
| 2023-01 | 7.2: Secure SD-WAN Engine and Manager line (month not verified) | Routing | P |
| 2024-01 | 7.3: renamed Forcepoint Network Security Platform (month not verified) | Packaging | P |
| 2025-01 | 7.4.0 to 7.4.2; KVM hosts on Red Hat Enterprise Linux 8.5 and 9.x (month not verified) | Platform | U |
| 2026-06 | 7.5.0 Feature Stream release; KVM on Red Hat Enterprise Linux 9.x and 10.x | Platform | C |
| 2026-09 | Security policy bypass CVE-2026-12974 in the engine; fixed in 7.3.4, 7.4.2 and 7.5.1 | Security and lifecycle | C |
- Centre of gravity: Packaging (2), Platform (2), Routing (1)
- Blind spots (no items): Firewall core, VPN, Threat protection, Network services, High availability, Management and API, Observability, Licensing, AI
- Driver mix: Vision 0%, Customer need 33%, Market window 0%, Upstream 17%, Portfolio 50%
- Idea-to-need index: 0.00 (0 = demand-pulled, 1 = thesis-pushed)
Credibility: 11.5 / 25
| Criterion | Score | Basis |
|---|---|---|
| Cadence | 3 | Version numbers show a feature release each year and several maintenance builds, but no release dates beyond the 7.5.0 document date were found |
| Roadmap transparency | 1.5 | Release notes public; no public roadmap; feature lists in PDFs that could not be read |
| Say-do | 2.5 | No dated promises found to test; three product names since 7.0 |
| Velocity | 2.5 | Maintenance builds dominate the 7.3 to 7.5 list; feature content of 7.5 not read |
| Lifecycle stability | 2 | Three renames since 7.0; lifecycle model named but no dates published |
Commercial risk: 16.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Price and licence volatility | 2.5 | Quote only; no changes found, and no public prices to track |
| Purchase constraints | 3.5 | Quote-based licensing through partners; no free or community edition |
| Channel and access | 3 | Partner sales; release notes public, downloads behind the support portal |
| Owner stability | 4 | Private-equity owner since January 2021; government business divested in 2023; owner of the NGFW line after the split not confirmed |
| Cost of staying supported | 3 | Subscription support; Feature Stream releases supersede each other and the long-term dates are not published |
Technical lock-in: 15.5 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Formats | 3.5 | Policies live in the SMC database; policy snapshots exportable in Forcepoint's own format |
| Export path | 3.5 | No converter to other vendors found |
| Stack coupling | 3 | Engines require the Security Management Center |
| Hardware / cloud coupling | 2 | ESXi and KVM on RHEL; Hyper-V limited; appliances optional |
| Skills and tooling coupling | 3.5 | SMC-specific tooling and a small skills base |
Integrator fit: 10.5 / 20
| Criterion | Score | Basis |
|---|---|---|
| Partner programme openness | 3 | Partner programme exists; terms not read |
| Multi-tenancy and self-service | 3 | SMC administrative domains (grade C) |
| API and infrastructure-as-code | 2 | SMC API; no Terraform or Ansible content found |
| Skills and certification | 2.5 | Forcepoint certification; niche skills base |
AI leverage: 1.5 / 20
How the product uses AI, scored per year like capability. Only GA counts.
| Criterion | 2019 | 2022 | Today | Latest step |
|---|---|---|---|---|
| AI in threat detection | 0 | 0 | 0 | 2015: None |
| AI platform stack | 0 | 0 | 0 | 2015: None |
| AI-assisted operations | 0 | 0 | 0 | 2015: None |
| Agent openness | 1.5 | 1.5 | 1.5 | 2015: SMC API that scripts can drive; no MCP server |
Year by year: 2015: 1.5 · 2016: 1.5 · 2017: 1.5 · 2018: 1.5 · 2019: 1.5 · 2020: 1.5 · 2021: 1.5 · 2022: 1.5 · 2023: 1.5 · 2024: 1.5 · 2025: 1.5 · 2026: 1.5
AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI items for the NGFW were found from 2023 to 2026; Forcepoint markets AI in its data security lines.
No AI feature is documented for the NGFW engine or the Security Management Center in the sources read. The SMC API is the only automation surface.
Reading
Forcepoint's firewall scores well on clustering, central policy and inline IPS, which are the Stonesoft strengths it inherited, and its KEV record since 2023 is clean. The scorecard carries grade C because the release note feature lists could not be read, no release dates for 7.3 to 7.5 were found, and the product has been renamed three times under a private-equity owner that sold half the company in 2023. A buyer should ask which legal entity owns and supports the NGFW line today and for the long-term support dates of the version they deploy. Until the release notes are read, the routing, VPN and threat scores are held one half step below what the vendor's materials suggest.
Open questions and items to re-score
- Which entity owns and supports the NGFW line after the 2023 sale of the government business to TPG.
- Release dates of 7.3.x, 7.4.x and 7.5.1; only the 7.5.0 document date (2026-06-16) was found.
- Lifecycle model dates (Feature Stream versus long-term) and end-of-support dates.
- Cloud providers in the supported cloud environments section of the 7.5.0 notes.
- Feature lists for 7.1 to 7.5; routing, VPN and threat steps rest on knowledge of the Stonesoft line.
- Licence metric and prices.
Related reading
More from Firewall and Router Ledger 2026
- Overview: all platforms side by side
- Firewall and Router Ledger Methodology: How Every Score Is Built
- Barracuda: Firewall and Router Ledger 2026 Scorecard
- Check Point: Firewall and Router Ledger 2026 Scorecard
- Cisco FTD: Firewall and Router Ledger 2026 Scorecard
- FortiGate: Firewall and Router Ledger 2026 Scorecard
- IPFire: Firewall and Router Ledger 2026 Scorecard
- Juniper vSRX: Firewall and Router Ledger 2026 Scorecard
- Netgate TNSR: Firewall and Router Ledger 2026 Scorecard
- NG Firewall: Firewall and Router Ledger 2026 Scorecard
- OpenWrt: Firewall and Router Ledger 2026 Scorecard
- OPNsense: Firewall and Router Ledger 2026 Scorecard
- Palo Alto: Firewall and Router Ledger 2026 Scorecard
- pfSense: Firewall and Router Ledger 2026 Scorecard
- RouterOS: Firewall and Router Ledger 2026 Scorecard
- SonicWall NSv: Firewall and Router Ledger 2026 Scorecard
- Sophos Firewall: Firewall and Router Ledger 2026 Scorecard
- VyOS: Firewall and Router Ledger 2026 Scorecard
- WatchGuard: Firewall and Router Ledger 2026 Scorecard