Firewall and Router Ledger 2026
Ledger
Firewall and Router Ledger 2026
FortiGate: Firewall and Router Ledger 2026 Scorecard
FortiOS ships the widest feature set and platform list in its group, and carries seven FortiOS entries on the CISA KEV catalogue since 2023.
Edition October 16, 20268 min read
Where FortiGate-VM put its effort, 2016 to 2026
Each square is one capability area in one year. The brighter it is, the more the area gained in the Firewall and Router Ledger that year; 1, 2 and 3 mark that year's biggest pushes.
| ’16 | ’17 | ’18 | ’19 | ’20 | ’21 | ’22 | ’23 | ’24 | ’25 | ’26 | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Routing and WAN | 1 | 3 | |||||||||
| Firewall and NAT core | 2 | ||||||||||
| VPN and remote access | 2 | 1 | |||||||||
| Threat protection | 2 | 1 | |||||||||
| Network services | 1 | ||||||||||
| Platform and hypervisor freedom | 1 | 1 | |||||||||
| High availability and performance | |||||||||||
| Management, API and automation | 3 | 3 | |||||||||
| Observability | 1 | ||||||||||
| Platform security and lifecycle |
no change+0.5+1+1.5 or moreScores out of 5 per area.
Biggest pushes overall: Platform and hypervisor freedom (+2), Routing and WAN (+1.5), Firewall and NAT core (+1). Already strong in 2015: High availability and performance, Threat protection, Firewall and NAT core.
Top focus each year: 2016 Observability; 2018 Routing and WAN; 2019 Platform and hypervisor freedom; 2020 Network services; 2021 VPN and remote access; 2022 Threat protection; 2024 Platform and hypervisor freedom. 4 of 11 years show no gain in any area.
Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.
Snapshot
- Type: product (subscription)
- Owner: Fortinet, Inc. (public, NASDAQ: FTNT, Sunnyvale, California)
- Licence: Proprietary. FortiGate-VM is licensed per vCPU (VM01 to VM32 and unlimited) plus FortiGuard bundles; Fortinet publishes no list price. A reseller lists a 2 vCPU, 3 year UTP bundle at USD 5,330.12. A permanent evaluation licence (one per FortiCare account) is limited to 1 vCPU, 2 GB RAM, 3 interfaces, 3 policies and 3 routes
- Latest release: FortiOS 8.0.0 build 0167 (2026-04-21); 7.6.7 and 7.4.12 are the current patches on the older trains
- Support lifecycle: Three years of engineering support plus 18 months of limited support per train: 8.0 to 2030-10-21, 7.6 to 2030-01-25, 7.4 to 2028-11-11; 7.2 ended 2026-09-30 (dates from endoflife.date)
- Next milestone: none published with a date
- Hypervisors: Release notes list images for VMware, KVM, Hyper-V and Xen, clouds AWS, Azure, GCP, OCI, Alibaba and IBM, and ARM64 images for KVM, AWS, Azure, GCP and OCI. Proxmox VE and XCP-ng are not named; users run the KVM image on Proxmox without a support statement
- Security record: Seven FortiOS entries on the CISA KEV catalogue since 2023: CVE-2022-41328 (2023-03-14), CVE-2023-27997 (2023-06-13), CVE-2024-21762 (2024-02-09), CVE-2024-55591 (2025-01-14), CVE-2025-24472 (2025-03-18), CVE-2019-6693 (2025-06-25), CVE-2025-68686 (2026-07-27). Four more multi-product entries that Fortinet advisories tie to FortiOS (CVE-2024-23113, CVE-2025-59718, CVE-2026-24858, CVE-2025-25249) were not verified against the PSIRT pages. Advisories: https://www.fortiguard.com/psirt
- Tier: Enterprise virtual appliance
- Archetype: Real innovator with a long KEV record
- Evidence grade: B. The 8.0 and 7.6 release notes, the evaluation licence page and the CISA KEV catalogue were read from primary sources. Lifecycle dates come from endoflife.date because Fortinet's lifecycle page returned no content, prices are reseller listings, and the feature content of trains before 7.4 is dated from the lifecycle table with features attributed from secondary sources.
Scorecard
| Dimension | Score | Direction |
|---|---|---|
| Capability today | 84.8 / 100 | higher is better |
| Momentum since end of 2022 | -2.0 points (2015 to 2022: +18.0) | higher is better |
| Credibility | 17.0 / 25 | higher is better |
| Commercial risk | 11.0 / 25 | lower is better |
| Technical lock-in | 12.5 / 25 | lower is better |
| Integrator fit | 16.5 / 20 | higher is better |
| AI leverage | 8.5 / 20 | higher is better |
| Ledger Index | 66.4 / 100 | balanced weights; see the methodology |
Capability by domain, 2015 to today
Scores 0 to 5 against fixed anchors; total is weighted to 100.
| Domain (weight) | 2015 | 2019 | 2022 | Today |
|---|---|---|---|---|
| Routing and WAN (12) | 3 | 4.5 | 4.5 | 4.5 |
| Firewall and NAT core (12) | 3.5 | 4.5 | 4.5 | 4.5 |
| VPN and remote access (12) | 3.5 | 3.5 | 4.5 | 4.5 |
| Threat protection (12) | 4 | 4.5 | 5 | 5 |
| Network services (8) | 3 | 3 | 4 | 4 |
| Platform and hypervisor freedom (10) | 2.5 | 4 | 4 | 4.5 |
| High availability and performance (8) | 4.5 | 4.5 | 4.5 | 4.5 |
| Management, API and automation (10) | 3.5 | 4 | 4.5 | 4.5 |
| Observability (6) | 3.5 | 4 | 4 | 4 |
| Platform security and lifecycle (10) | 3.5 | 3.5 | 3.5 | 2 |
| Total / 100 | 68.8 | 80.6 | 86.8 | 84.8 |
Year by year: 2015: 68.8 · 2016: 69.4 · 2017: 69.4 · 2018: 74.0 · 2019: 80.6 · 2020: 84.4 · 2021: 85.6 · 2022: 86.8 · 2023: 84.8 · 2024: 84.8 · 2025: 84.8 · 2026: 84.8
What moved the score
| Year | Domain | Change | Points | Trigger |
|---|---|---|---|---|
| 2016 | Observability | 3.5 → 4 | +0.6 | 5.4: FortiView flow analytics and packet capture in the UI; long-term logging needs FortiAnalyzer |
| 2018 | Management, API and automation | 3.5 → 4 | +1.0 | 6.0: automation stitches and the REST API |
| 2018 | Routing and WAN | 3 → 4 | +2.4 | 6.0: SD-WAN rules with SLA health probes |
| 2018 | Threat protection | 4 → 4.5 | +1.2 | 6.0: Security Fabric with sandbox integration and threat feeds |
| 2019 | Firewall and NAT core | 3.5 → 4.5 | +2.4 | 6.2: NGFW policy mode puts applications, URL categories and users in the rule; hit counters; shared objects through FortiManager; IPv6 parity has gaps |
| 2019 | Platform and hypervisor freedom | 2.5 → 4 | +3.0 | By 6.2: images for VMware, KVM, Hyper-V, Xen, AWS, Azure, GCP and OCI |
| 2019 | Routing and WAN | 4 → 4.5 | +1.2 | 6.2: application-aware SD-WAN steering beside VRFs and VXLAN; no MPLS or segment routing |
| 2020 | Management, API and automation | 4 → 4.5 | +1.0 | By 6.4: vendor-maintained Terraform provider (fortinetdev/fortios) and Ansible collection (fortinet.fortios); zero-touch provisioning through FortiManager (separate licence) |
| 2020 | Network services | 3 → 4 | +1.6 | 6.4: DNS over TLS for the DNS filter; guest accounts for the captive portal; no DHCP failover beyond HA |
| 2020 | VPN and remote access | 3.5 → 4 | +1.2 | 6.4: SD-WAN IPsec overlays with dynamic mesh (ADVPN) |
| 2021 | VPN and remote access | 4 → 4.5 | +1.2 | 7.0: ZTNA access proxy beside IPsec and SSL VPN with MFA |
| 2022 | Threat protection | 4.5 → 5 | +1.2 | 7.2: IPS engine updates and inline sandboxing; documented false-positive handling through FortiGuard |
| 2023 | Platform security and lifecycle | 3.5 → 2.5 | -2.0 | 2023: two KEV entries, CVE-2022-41328 (2023-03-14) and CVE-2023-27997 (2023-06-13); score lowered 1.0 |
| 2024 | Platform and hypervisor freedom | 4 → 4.5 | +1.0 | 7.6 release notes list ARM64 images for KVM, AWS, Azure, GCP and OCI; Proxmox VE and XCP-ng still not named |
| 2024 | Platform security and lifecycle | 2.5 → 2 | -1.0 | 2024: third KEV entry CVE-2024-21762 (2024-02-09); penalty capped at 1.5. Later entries CVE-2024-55591, CVE-2025-24472, CVE-2019-6693 and CVE-2025-68686 add no further penalty |
Direction, 2023 to 2026
Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
| Date | Item | Theme | Driver |
|---|---|---|---|
| 2023-05 | 7.4: ZTNA and SD-WAN updates, post-quantum groundwork | VPN | V |
| 2023-06 | CVE-2023-27997 SSL-VPN heap overflow patched and added to the KEV catalogue | Security and lifecycle | C |
| 2024-02 | CVE-2024-21762 out-of-bounds write added to the KEV catalogue | Security and lifecycle | C |
| 2024-07 | 7.6 train; Azure Generation 2 images from 7.6.1 | Platform | U |
| 2024-07 | 7.6 release notes list ARM64 images for KVM and the main clouds | Platform | C |
| 2025-01 | CVE-2024-55591 authentication bypass added to the KEV catalogue; CVE-2025-24472 follows in March | Security and lifecycle | C |
| 2025-12 | CVE-2025-59718 FortiCloud SSO signature verification flaw across FortiOS, FortiProxy and FortiSwitchManager | Security and lifecycle | C |
| 2026-03 | FortiOS 8.0 announced at Accelerate with AI governance and quantum-safe features | AI | V |
| 2026-04 | 8.0: application control for GenAI services with MCP and A2A traffic visibility | AI | V |
| 2026-04 | 8.0: post-quantum cryptography and multipath IPsec | VPN | V |
| 2026-04 | 8.0: DLP with OCR | Threat protection | V |
| 2026-04 | 8.0: AI agents for troubleshooting and configuration (GA not verified) | AI | V |
| 2026-09 | 7.2 reaches end of support | Security and lifecycle | P |
- Centre of gravity: Security and lifecycle (5), AI (3), VPN (2)
- Blind spots (no items): Routing, Firewall core, Network services, High availability, Management and API, Observability, Packaging, Licensing
- Driver mix: Vision 46%, Customer need 38%, Market window 0%, Upstream 8%, Portfolio 8%
- Idea-to-need index: 0.55 (0 = demand-pulled, 1 = thesis-pushed)
Credibility: 17.0 / 25
| Criterion | Score | Basis |
|---|---|---|
| Cadence | 4 | One feature train a year since 6.0 (March to July) with monthly patches; lifecycle windows are published, patch dates are not |
| Roadmap transparency | 2 | Public release notes and admin guides; no public roadmap, direction appears at the Accelerate conference |
| Say-do | 3 | 8.0 shipped about six weeks after its 2026-03-10 announcement; the AI agents announced with it are not verified as GA; few other announcements could be tracked |
| Velocity | 4 | Several substantive capabilities per train (SD-WAN, ZTNA, GenAI controls) |
| Lifecycle stability | 4 | Three years of engineering support plus 18 months per train, in-place upgrades; 7.2 ended 2026-09-30 on schedule |
Commercial risk: 11.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Price and licence volatility | 2 | No list price, so changes cannot be checked; legacy FC-10-FVM UTP SKUs carry a last service extension notice while FGVVS SKUs replace them (date not found) |
| Purchase constraints | 3 | Subscription per vCPU tier; the permanent evaluation licence is limited to 1 vCPU, 3 policies and 3 routes |
| Channel and access | 3 | Direct and partner sales; firmware images need a FortiCare account and a support contract |
| Owner stability | 0.5 | Independent public company since 2000 |
| Cost of staying supported | 2.5 | Firmware updates are free within support; FortiGuard signatures and support are renewed per term |
Technical lock-in: 12.5 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Formats | 3.5 | Proprietary FortiOS CLI configuration text; backup and restore documented, no standard export |
| Export path | 3 | Migration to another vendor is manual or through that vendor's converter; FortiConverter only imports |
| Stack coupling | 1.5 | Runs alone; FortiManager and FortiAnalyzer are optional and licensed separately |
| Hardware / cloud coupling | 1.5 | Any listed hypervisor or cloud; the VM licence is bound to the FortiCare account and vCPU count |
| Skills and tooling coupling | 3 | FortiOS CLI and NSE certification; Terraform and Ansible content is vendor specific |
Integrator fit: 16.5 / 20
| Criterion | Score | Basis |
|---|---|---|
| Partner programme openness | 4 | Engage partner programme with tiers; MSP consumption licensing through FortiFlex (terms not read) |
| Multi-tenancy and self-service | 4 | VDOMs on the firewall and ADOMs in FortiManager; no built-in self-service portal |
| API and infrastructure-as-code | 4 | REST API across the configuration; vendor Terraform provider and Ansible collection |
| Skills and certification | 4.5 | NSE certification programme with exams and a large talent pool |
AI leverage: 8.5 / 20
How the product uses AI, scored per year like capability. Only GA counts.
| Criterion | 2019 | 2022 | Today | Latest step |
|---|---|---|---|---|
| AI in threat detection | 1 | 1 | 3 | 2026: 8.0: application control for GenAI services with MCP and A2A visibility GA (vendor claim via trade press); FortiGuard ML models not verified |
| AI platform stack | 0 | 0 | 3 | 2026: 8.0: FortiView for AI (shadow AI visibility) and GenAI policy controls GA |
| AI-assisted operations | 0 | 0 | 0.5 | 2026: 8.0: AI agents for troubleshooting and configuration announced 2026-03; GA not verified, counted as a half step |
| Agent openness | 2 | 2 | 2 | 2015: REST API with tokens; only third-party MCP servers exist |
Year by year: 2015: 3 · 2016: 3 · 2017: 3 · 2018: 3 · 2019: 3 · 2020: 3 · 2021: 3 · 2022: 3 · 2023: 3 · 2024: 3 · 2025: 3 · 2026: 8.5
AI say-do, 2023 to 2026: 4 AI items announced; 3 GA, 0 still preview, 1 pending, 0 dropped. GA: GenAI application control, MCP and A2A visibility and FortiView for AI, all in 8.0; pending: the conversational AI agents, whose GA status could not be verified.
Fortinet's AI work in 8.0 is about seeing and controlling AI traffic rather than running the firewall with AI, and that part shipped. The operator agents are announced only, and there is no official MCP server, so agents drive FortiOS through the REST API today.
Reading
FortiGate-VM scores at the top of the enterprise group on capability because routing, SD-WAN, VPN, threat protection and platform breadth are all strong and the price of entry is a permanent evaluation licence. The score it loses is in platform security: seven FortiOS entries on the CISA KEV catalogue since 2023, four of them flagged for ransomware use, take the lifecycle domain down by the full 1.5. Credibility is held back by the lack of a public roadmap. The buyer's one check is the patch process: with a new train every year and several exploited flaws a year, the question is how fast your team can move FortiOS to a fixed build. Proxmox VE users should also note that Fortinet names Xen and KVM, never Proxmox.
Open questions and items to re-score
- Fortinet's own lifecycle page could not be read; the 8.0 and 7.6 support dates come from endoflife.date.
- The four multi-product KEV entries (CVE-2024-23113, CVE-2025-59718, CVE-2026-24858, CVE-2025-25249) were not checked against the Fortinet PSIRT pages; they would not change the capped penalty.
- Dates of 7.6.7 and 8.0.1, and the evaluation licence limits as stated in the 8.0 documentation, were not found.
- SSL VPN tunnel mode removal on small hardware models in 7.6 and WireGuard support were not verified; neither changes the VM score.
- Features attributed to the 5.4, 6.0, 6.2 and 6.4 trains before 2023 were dated from the lifecycle table and attributed from secondary sources.
- SR-IOV and DPDK support, the FGVVS SKU change date and the AI agents' GA status in 8.0 were not verified.
Related reading
More from Firewall and Router Ledger 2026
- Overview: all platforms side by side
- Firewall and Router Ledger Methodology: How Every Score Is Built
- Barracuda: Firewall and Router Ledger 2026 Scorecard
- Check Point: Firewall and Router Ledger 2026 Scorecard
- Cisco FTD: Firewall and Router Ledger 2026 Scorecard
- Forcepoint NGFW: Firewall and Router Ledger 2026 Scorecard
- IPFire: Firewall and Router Ledger 2026 Scorecard
- Juniper vSRX: Firewall and Router Ledger 2026 Scorecard
- Netgate TNSR: Firewall and Router Ledger 2026 Scorecard
- NG Firewall: Firewall and Router Ledger 2026 Scorecard
- OpenWrt: Firewall and Router Ledger 2026 Scorecard
- OPNsense: Firewall and Router Ledger 2026 Scorecard
- Palo Alto: Firewall and Router Ledger 2026 Scorecard
- pfSense: Firewall and Router Ledger 2026 Scorecard
- RouterOS: Firewall and Router Ledger 2026 Scorecard
- SonicWall NSv: Firewall and Router Ledger 2026 Scorecard
- Sophos Firewall: Firewall and Router Ledger 2026 Scorecard
- VyOS: Firewall and Router Ledger 2026 Scorecard
- WatchGuard: Firewall and Router Ledger 2026 Scorecard