Firewall and Router Ledger 2026
Ledger
Firewall and Router Ledger 2026
Palo Alto: Firewall and Router Ledger 2026 Scorecard
PAN-OS remains the reference for application and identity policy, sold only through credits, with nine PAN-OS entries on the CISA KEV catalogue since 2024.
Edition October 16, 20268 min read
Where VM-Series put its effort, 2016 to 2026
Each square is one capability area in one year. The brighter it is, the more the area gained in the Firewall and Router Ledger that year; 1, 2 and 3 mark that year's biggest pushes.
| ’16 | ’17 | ’18 | ’19 | ’20 | ’21 | ’22 | ’23 | ’24 | ’25 | ’26 | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Routing and WAN | 1 | 1 | |||||||||
| Firewall and NAT core | 3 | ||||||||||
| VPN and remote access | 2 | 1 | |||||||||
| Threat protection | 1 | ||||||||||
| Network services | 2 | ||||||||||
| Platform and hypervisor freedom | 1 | 2 | 2 | ||||||||
| High availability and performance | 1 | ||||||||||
| Management, API and automation | 1 | ||||||||||
| Observability | |||||||||||
| Platform security and lifecycle |
no change+0.5+1+1.5 or moreScores out of 5 per area.
Biggest pushes overall: Platform and hypervisor freedom (+2), Routing and WAN (+1.5), VPN and remote access (+1). Already strong in 2015: Firewall and NAT core, Threat protection, High availability and performance.
Top focus each year: 2017 Platform and hypervisor freedom; 2019 Management, API and automation; 2020 Threat protection; 2021 Routing and WAN; 2022 Routing and WAN; 2023 VPN and remote access; 2025 High availability and performance. 4 of 11 years show no gain in any area.
Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.
Snapshot
- Type: product (subscription)
- Owner: Palo Alto Networks, Inc. (public, NYSE: PANW, Santa Clara, California)
- Licence: Proprietary. VM-Series is sold under Software NGFW Credits (a deployment profile of PAN-OS version, vCPUs and firewall count, maximum 64 cores); fixed-capacity VM-50 to VM-1000-HV models reached end of sale 2021-07-31 and end of life 2024-07-31. No public price; no permanent free edition found
- Latest release: PAN-OS 12.1 (GA 2025-08-28); the compatibility matrix lists patches up to 12.1.9 (patch date not found)
- Support lifecycle: 12.1 standard support to 2028-08-28 and Extended Support+ to 2029-08-28; 11.2 to 2027-05-02; 11.1 to 2027-05-03; 10.2 extended to 2027-03-31. Months 37 to 48 are extended support with Critical and High fixes only; VM-Series accelerated feature releases get 12 months
- Next milestone: none published with a date
- Hypervisors: VMware ESXi 6.5 to 8.0, KVM on RHEL, Oracle Linux, Ubuntu, CentOS and SUSE, Hyper-V (Windows Server 2012 R2 to 2025, up to PAN-OS 11.2.3 only), Nutanix AHV (to 12.1.9), OpenShift Virtualization (11.2.5 to 11.2.13); clouds AWS, Azure, GCP, OCI and Alibaba; ARM on KVM and AWS Graviton from 11.1. Proxmox VE and XCP-ng are not listed
- Security record: Nine PAN-OS entries on the CISA KEV catalogue since 2023: CVE-2024-3400 (2024-04-12), CVE-2024-9474 and CVE-2024-0012 (2024-11-18), CVE-2024-3393 (2024-12-30), CVE-2025-0108 (2025-02-18), CVE-2025-0111 (2025-02-20), CVE-2026-0300 (2026-05-06), CVE-2026-0257 (2026-05-29), CVE-2026-0322 (2026-10-14). Three Expedition migration tool entries (2024-11) are not PAN-OS. Advisories: https://security.paloaltonetworks.com/
- Tier: Enterprise virtual appliance
- Archetype: Dependable builder under exploitation pressure
- Evidence grade: B. The end-of-life summary, the VM-Series compatibility matrix, the 12.1 virtualization release notes and the CISA KEV catalogue were read from primary sources. Feature content of trains before 11.1 is dated from the lifecycle table with features attributed from secondary sources, and no price exists to read.
Scorecard
| Dimension | Score | Direction |
|---|---|---|
| Capability today | 84.0 / 100 | higher is better |
| Momentum since end of 2022 | +0.0 points (2015 to 2022: +15.0) | higher is better |
| Credibility | 17.0 / 25 | higher is better |
| Commercial risk | 13.5 / 25 | lower is better |
| Technical lock-in | 13.0 / 25 | lower is better |
| Integrator fit | 17.0 / 20 | higher is better |
| AI leverage | 5.0 / 20 | higher is better |
| Ledger Index | 63.4 / 100 | balanced weights; see the methodology |
Capability by domain, 2015 to today
Scores 0 to 5 against fixed anchors; total is weighted to 100.
| Domain (weight) | 2015 | 2019 | 2022 | Today |
|---|---|---|---|---|
| Routing and WAN (12) | 2.5 | 2.5 | 4 | 4 |
| Firewall and NAT core (12) | 4.5 | 5 | 5 | 5 |
| VPN and remote access (12) | 3.5 | 3.5 | 4 | 4.5 |
| Threat protection (12) | 4 | 4.5 | 5 | 5 |
| Network services (8) | 2.5 | 3.5 | 3.5 | 3.5 |
| Platform and hypervisor freedom (10) | 2.5 | 3.5 | 4 | 4.5 |
| High availability and performance (8) | 4 | 4 | 4 | 4.5 |
| Management, API and automation (10) | 3.5 | 4.5 | 4.5 | 4.5 |
| Observability (6) | 4 | 4 | 4 | 4 |
| Platform security and lifecycle (10) | 3.5 | 3.5 | 3.5 | 2 |
| Total / 100 | 69.0 | 77.0 | 84.0 | 84.0 |
Year by year: 2015: 69.0 · 2016: 69.0 · 2017: 71.0 · 2018: 71.0 · 2019: 77.0 · 2020: 78.2 · 2021: 81.8 · 2022: 84.0 · 2023: 86.2 · 2024: 83.2 · 2025: 84.0 · 2026: 84.0
What moved the score
| Year | Domain | Change | Points | Trigger |
|---|---|---|---|---|
| 2017 | Platform and hypervisor freedom | 2.5 → 3.5 | +2.0 | 8.0 era: Azure, GCP and Hyper-V images |
| 2019 | Firewall and NAT core | 4.5 → 5 | +1.2 | By 9.1 (2019-12): rule usage hit counts and policy optimizer beside App-ID, User-ID and shared objects; the reference implementation |
| 2019 | Management, API and automation | 3.5 → 4.5 | +2.0 | By 9.1 (2019-12): REST API beside the XML API, zero-touch provisioning, vendor Terraform provider and the pan-os-ansible collection (community supported per pan.dev) |
| 2019 | Network services | 2.5 → 3.5 | +1.6 | By 9.1: dynamic DNS registration, DNS proxy, DHCP and a captive portal with MFA; RADIUS, TACACS+ and SAML; no DHCP failover or voucher portal |
| 2019 | Threat protection | 4 → 4.5 | +1.2 | 9.1: DNS Security and expanded decryption beside Threat Prevention and WildFire |
| 2020 | Threat protection | 4.5 → 5 | +1.2 | 10.0: cloud-delivered security services and IoT Security integrated in the firewall |
| 2021 | Routing and WAN | 2.5 → 3.5 | +2.4 | 10.1: SD-WAN with path health probes as a subscription |
| 2021 | VPN and remote access | 3.5 → 4 | +1.2 | 10.1: ZTNA 1.0 through GlobalProtect with MFA and host checks |
| 2022 | Platform and hypervisor freedom | 3.5 → 4 | +1.0 | 10.2 and 11.0: Nutanix AHV support |
| 2022 | Routing and WAN | 3.5 → 4 | +1.2 | 10.2 and 11.0: Advanced Routing Engine (FRRouting based) with route policies and logical routers; no MPLS or EVPN |
| 2023 | Platform and hypervisor freedom | 4 → 4.5 | +1.0 | 11.1: ARM images on KVM and AWS Graviton 2 and 3; OpenShift Virtualization from 11.2.5; DPDK and SR-IOV documented; Proxmox VE and XCP-ng unlisted |
| 2023 | VPN and remote access | 4 → 4.5 | +1.2 | 11.1: post-quantum IKEv2 for site-to-site VPN; no dynamic mesh without the SD-WAN subscription |
| 2024 | Platform security and lifecycle | 3.5 → 2 | -3.0 | 2024: three KEV entries, CVE-2024-3400 (2024-04-12), CVE-2024-9474 and CVE-2024-0012 (2024-11-18); score lowered 1.5 (cap). Six later PAN-OS entries from CVE-2024-3393 to CVE-2026-0322 add no further penalty |
| 2025 | High availability and performance | 4 → 4.5 | +0.8 | 12.1.2: Hyperscale Security Fabric clustering for VM-Series |
Direction, 2023 to 2026
Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
| Date | Item | Theme | Driver |
|---|---|---|---|
| 2023-11 | 11.1: post-quantum IKEv2 site-to-site VPN | VPN | V |
| 2023-11 | 11.1: ARM VM-Series on KVM and AWS Graviton | Platform | C |
| 2024-04 | CVE-2024-3400 GlobalProtect command injection added to the KEV catalogue | Security and lifecycle | C |
| 2024-05 | 11.2: quantum-safe VPN and Advanced Routing updates | Routing | V |
| 2024-07 | Fixed-capacity VM-Series models reach end of life; Software NGFW Credits only | Licensing | P |
| 2024-11 | CVE-2024-0012 and CVE-2024-9474 management interface flaws added to the KEV catalogue | Security and lifecycle | C |
| 2024-11 | OpenShift Virtualization support from 11.2.5 | Platform | M |
| 2025-02 | CVE-2025-0108 and CVE-2025-0111 added to the KEV catalogue | Security and lifecycle | C |
| 2025-08 | 12.1 Orion: passwordless authentication, Advanced Device-ID, quantum protections | Firewall core | V |
| 2025-08 | 12.1.2: Hyperscale Security Fabric clustering for VM-Series | High availability | M |
| 2025-08 | 12.1.2: Secure Boot for VM-Series on GCP | Security and lifecycle | C |
| 2025-08 | VM-Series accelerated feature releases get 12 months of support | Licensing | P |
| 2026-05 | CVE-2026-0300 and CVE-2026-0257 added to the KEV catalogue; CVE-2026-0322 follows 2026-10-14 | Security and lifecycle | C |
| 2026-05 | 10.2 extended support moved to 2027-03-31 | Security and lifecycle | C |
- Centre of gravity: Security and lifecycle (6), Platform (2), Licensing (2)
- Blind spots (no items): Threat protection, Network services, Management and API, Observability, Packaging, AI
- Driver mix: Vision 21%, Customer need 50%, Market window 14%, Upstream 0%, Portfolio 14%
- Idea-to-need index: 0.25 (0 = demand-pulled, 1 = thesis-pushed)
Credibility: 17.0 / 25
| Criterion | Score | Basis |
|---|---|---|
| Cadence | 4 | A feature release every six to twelve months (11.1 2023-11, 11.2 2024-05, 12.1 2025-08) with a published lifecycle table |
| Roadmap transparency | 2.5 | Public release notes, lifecycle table and compatibility matrix; direction appears in blogs and keynotes, no dated roadmap |
| Say-do | 3 | The tracked items (12.1 Orion, Hyperscale Security Fabric, post-quantum VPN) shipped; too few announcements were collected for a full record |
| Velocity | 4 | Several substantive capabilities per release since 10.2 |
| Lifecycle stability | 3.5 | 48 month windows for majors and in-place upgrades, but fixed VM models were retired in 2024 and VM-Series accelerated feature releases get only 12 months |
Commercial risk: 13.5 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Price and licence volatility | 3 | Fixed-capacity VM licences ended 2024-07-31; credits are the only model and have no public price |
| Purchase constraints | 3.5 | Subscription only, quote only, no free production tier |
| Channel and access | 3 | Channel and direct sales; software and content updates need a support portal login and entitlement |
| Owner stability | 0.5 | Independent public company since 2005 |
| Cost of staying supported | 3.5 | Extended support months 37 to 48 carry Critical and High fixes only; VM-Series feature releases outside the long-support trains expire after 12 months |
Technical lock-in: 13.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Formats | 3 | XML configuration, exportable and loadable, but proprietary in structure |
| Export path | 2.5 | Expedition converts into PAN-OS; leaving means a manual rebuild or another vendor's converter |
| Stack coupling | 2.5 | Panorama or Strata Cloud Manager for fleets; subscriptions for threat, DNS and SD-WAN features |
| Hardware / cloud coupling | 1.5 | Any listed hypervisor or cloud; credits are bound to a deployment profile |
| Skills and tooling coupling | 3.5 | PAN-OS specific skills (PCNSA, PCNSE) and tooling |
Integrator fit: 17.0 / 20
| Criterion | Score | Basis |
|---|---|---|
| Partner programme openness | 4 | NextWave partner programme and cloud marketplaces; terms not read |
| Multi-tenancy and self-service | 4 | Virtual systems, Panorama device groups and templates, Strata Cloud Manager tenants |
| API and infrastructure-as-code | 4.5 | XML and REST APIs, vendor Terraform provider, pan-os-ansible collection |
| Skills and certification | 4.5 | Exam-based PCNSA and PCNSE certifications with a large talent pool |
AI leverage: 5.0 / 20
How the product uses AI, scored per year like capability. Only GA counts.
| Criterion | 2019 | 2022 | Today | Latest step |
|---|---|---|---|---|
| AI in threat detection | 1 | 2.5 | 2.5 | 2020: 10.0: cloud-delivered inline detection services; the vendor describes them as machine learning driven, which was not verified from primary pages in this edition |
| AI platform stack | 0 | 0 | 0 | 2015: None |
| AI-assisted operations | 0 | 0 | 0.5 | 2024: Strata Copilot is a vendor claim not verified as GA for PAN-OS administration; counted as a half step |
| Agent openness | 2 | 2 | 2 | 2015: XML and REST APIs with tokens; only third-party MCP servers exist |
Year by year: 2015: 3 · 2016: 3 · 2017: 3 · 2018: 3 · 2019: 3 · 2020: 4.5 · 2021: 4.5 · 2022: 4.5 · 2023: 4.5 · 2024: 5 · 2025: 5 · 2026: 5
AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI announcements were collected for this edition; Precision AI, Strata Copilot and the AI security add-ons are vendor claims that were not checked and are listed as open questions.
Palo Alto Networks talks about AI more than this scorecard credits, because the research pass did not verify the claims. What is verifiable is an API that agents can drive and no official MCP server, so the AI leverage score is low until the next edition checks the AI items.
Reading
VM-Series keeps the reference score for policy and threat protection, and the 12.1 train added clustering and Secure Boot for the virtual edition. Two things pull the Ledger Index down. The lifecycle domain carries the full KEV penalty, with nine PAN-OS entries since April 2024 and three flagged for ransomware use, most of them on the management interface or GlobalProtect portal. Commercial risk is the highest in its group because fixed licences are gone, prices are quote only and support outside the long trains is short. The buyer's check is exposure: keep the management interface off the internet and plan upgrades for the 12 month feature-release windows.
Open questions and items to re-score
- The newest 12.1 patch and its date were not found on a vendor page; 12.1.9 appears only in the compatibility matrix.
- Hyper-V support stops at PAN-OS 11.2.3; whether a later train restores it was not found. The platform score will fall when 11.2 leaves support in 2027 if nothing changes.
- Trial licence terms, WireGuard support and the AI items (Precision AI, Strata Copilot, AI Access Security) were not verified.
- Features attributed to 7.0, 8.0, 9.1 and 10.0 were dated from the lifecycle table and attributed from secondary sources.
- Whether the pan-os-ansible collection is vendor supported: pan.dev calls it community supported.
Related reading
More from Firewall and Router Ledger 2026
- Overview: all platforms side by side
- Firewall and Router Ledger Methodology: How Every Score Is Built
- Barracuda: Firewall and Router Ledger 2026 Scorecard
- Check Point: Firewall and Router Ledger 2026 Scorecard
- Cisco FTD: Firewall and Router Ledger 2026 Scorecard
- Forcepoint NGFW: Firewall and Router Ledger 2026 Scorecard
- FortiGate: Firewall and Router Ledger 2026 Scorecard
- IPFire: Firewall and Router Ledger 2026 Scorecard
- Juniper vSRX: Firewall and Router Ledger 2026 Scorecard
- Netgate TNSR: Firewall and Router Ledger 2026 Scorecard
- NG Firewall: Firewall and Router Ledger 2026 Scorecard
- OpenWrt: Firewall and Router Ledger 2026 Scorecard
- OPNsense: Firewall and Router Ledger 2026 Scorecard
- pfSense: Firewall and Router Ledger 2026 Scorecard
- RouterOS: Firewall and Router Ledger 2026 Scorecard
- SonicWall NSv: Firewall and Router Ledger 2026 Scorecard
- Sophos Firewall: Firewall and Router Ledger 2026 Scorecard
- VyOS: Firewall and Router Ledger 2026 Scorecard
- WatchGuard: Firewall and Router Ledger 2026 Scorecard