Firewall and Router Ledger 2026
Ledger
Firewall and Router Ledger 2026
Sophos Firewall: Firewall and Router Ledger 2026 Scorecard
Sophos Firewall pairs a deep threat stack and a free Home edition with short maintenance windows and two KEV entries added in 2025 for old CVE-2020 flaws.
Edition October 16, 20268 min read
Where Sophos Firewall put its effort, 2016 to 2026
Each square is one capability area in one year. The brighter it is, the more the area gained in the Firewall and Router Ledger that year; 1, 2 and 3 mark that year's biggest pushes.
| ’16 | ’17 | ’18 | ’19 | ’20 | ’21 | ’22 | ’23 | ’24 | ’25 | ’26 | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Routing and WAN | 1 | 1 | |||||||||
| Firewall and NAT core | 1 | 1 | |||||||||
| VPN and remote access | 2 | 1 | |||||||||
| Threat protection | 2 | 3 | 1 | ||||||||
| Network services | |||||||||||
| Platform and hypervisor freedom | 1 | 1 | |||||||||
| High availability and performance | |||||||||||
| Management, API and automation | 2 | ||||||||||
| Observability | |||||||||||
| Platform security and lifecycle |
no change+0.5+1+1.5 or moreScores out of 5 per area.
Biggest pushes overall: Threat protection (+1.5), Routing and WAN (+1), Firewall and NAT core (+1). Already strong in 2015: Network services, Observability, Firewall and NAT core.
Top focus each year: 2017 Firewall and NAT core; 2018 Platform and hypervisor freedom; 2019 Routing and WAN; 2020 Firewall and NAT core; 2021 VPN and remote access; 2022 Routing and WAN; 2024 Platform and hypervisor freedom; 2026 Threat protection. 3 of 11 years show no gain in any area.
Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.
Snapshot
- Type: product
- Owner: Sophos Ltd. (Abingdon, UK; private, owned by Thoma Bravo funds since the 2020 take-private, secondary source)
- Licence: Proprietary. Virtual, software and cloud BYOL instances licensed per CPU core; RAM limits removed for business licences on 2025-03-01. Xstream Protection bundle or single modules; prices not published. Home edition free for non-commercial use: 4 cores and 6 GB RAM per the 2023 FAQ, no support
- Latest release: v22 MR2 (announced 2026-07-14); v22 GA December 2025 per partner news; v23 in early access
- Support lifecycle: The previous maintenance release is retired when a new one ships and the last two are supported; end-of-life dates announced about 90 days ahead; v18.5 and v19.5 ended 2025-04-30; firewalls still on the legacy IPsec remote access VPN cannot upgrade to v22 MR1 or later
- Next milestone: v23 (early access, no GA date): REST API with token authentication, high availability improvements, AI firewall assistant
- Security record: 2 CISA KEV entries since 2023, both added 2025-02-06: CVE-2020-15069 (XG Firewall buffer overflow) and CVE-2020-29574 (CyberoamOS SQL injection, ransomware use flagged). Advisories: https://www.sophos.com/en-us/security-advisories
- Hypervisors: VMware vSphere, Microsoft Hyper-V, KVM (Proxmox VE and Virtual Machine Manager named as tools), Citrix Hypervisor (XenCenter and XCP-ng Center named), Nutanix Prism; a cloud deployment section exists, marketplace listings not confirmed; x86 only, no ARM
- Tier: Enterprise virtual appliance
- Archetype: Dependable builder
- Evidence grade: B. The hypervisor list, the lifecycle policy, the v22 MR1 feature post, the 2025 RAM licence change and the KEV entries were read from Sophos pages and the CISA catalogue. Release dates for v22 and its maintenance releases come from partner news without exact dates. Capability steps before 2025 rest on the dossier's release timeline, which was not read from release notes, and the Home edition limits come from a community FAQ last edited in January 2023.
Scorecard
| Dimension | Score | Direction |
|---|---|---|
| Capability today | 73.4 / 100 | higher is better |
| Momentum since end of 2022 | +0.2 points (2015 to 2022: +14.0) | higher is better |
| Credibility | 15.5 / 25 | higher is better |
| Commercial risk | 11.5 / 25 | lower is better |
| Technical lock-in | 12.0 / 25 | lower is better |
| Integrator fit | 13.5 / 20 | higher is better |
| AI leverage | 5.0 / 20 | higher is better |
| Ledger Index | 58.0 / 100 | balanced weights; see the methodology |
Capability by domain, 2015 to today
Scores 0 to 5 against fixed anchors; total is weighted to 100.
| Domain (weight) | 2015 | 2019 | 2022 | Today |
|---|---|---|---|---|
| Routing and WAN (12) | 2.5 | 3 | 3.5 | 3.5 |
| Firewall and NAT core (12) | 3 | 3.5 | 4 | 4 |
| VPN and remote access (12) | 3 | 3 | 4 | 4 |
| Threat protection (12) | 3 | 3.5 | 4 | 4.5 |
| Network services (8) | 3.5 | 3.5 | 3.5 | 3.5 |
| Platform and hypervisor freedom (10) | 2.5 | 3 | 3 | 3.5 |
| High availability and performance (8) | 3 | 3 | 3.5 | 3.5 |
| Management, API and automation (10) | 3 | 3 | 4 | 4 |
| Observability (6) | 3.5 | 3.5 | 4 | 4 |
| Platform security and lifecycle (10) | 3 | 3 | 3 | 2 |
| Total / 100 | 59.2 | 63.8 | 73.2 | 73.4 |
Year by year: 2015: 59.2 · 2016: 59.2 · 2017: 61.6 · 2018: 62.6 · 2019: 63.8 · 2020: 69.8 · 2021: 71.0 · 2022: 73.2 · 2023: 73.2 · 2024: 74.2 · 2025: 72.2 · 2026: 73.4
What moved the score
| Year | Domain | Change | Points | Trigger |
|---|---|---|---|---|
| 2017 | Firewall and NAT core | 3 → 3.5 | +1.2 | SFOS 16 and 17: Synchronized Security puts endpoint health into rules (grade C for the year) |
| 2017 | Threat protection | 3 → 3.5 | +1.2 | SFOS 16 and 17: Sandstorm cloud sandboxing (grade C for the year) |
| 2018 | Platform and hypervisor freedom | 2.5 → 3 | +1.0 | SFOS 17: Nutanix and cloud deployments added (grade C for the year) |
| 2019 | Routing and WAN | 2.5 → 3 | +1.2 | SFOS 17.5 and 18: SD-WAN policy routing with link health probes (grade C for the year) |
| 2020 | Firewall and NAT core | 3.5 → 4 | +1.2 | SFOS 18: Xstream DPI engine, rule grouping and hit counts; shared objects through Sophos Central |
| 2020 | High availability and performance | 3 → 3.5 | +0.8 | SFOS 18: Xstream FastPath offload in software; no clustering beyond two nodes |
| 2020 | Management, API and automation | 3 → 3.5 | +1.0 | SFOS 18: management through Sophos Central with zero-touch deployment (grade C for the year) |
| 2020 | Observability | 3.5 → 4 | +0.6 | SFOS 18: new log viewer with live filters; Central reporting (grade C for the year) |
| 2020 | Threat protection | 3.5 → 4 | +1.2 | SFOS 18: Xstream TLS inspection and DPI with SophosLabs threat feeds |
| 2020 | VPN and remote access | 3 → 3.5 | +1.2 | SFOS 18: route-based IPsec (xfrm) and the Sophos Connect client |
| 2021 | VPN and remote access | 3.5 → 4 | +1.2 | SFOS 18.5: ZTNA through Sophos Central; SFOS 19 adds SD-WAN VPN orchestration; no WireGuard |
| 2022 | Management, API and automation | 3.5 → 4 | +1.0 | SFOS 19: firewall group management and SD-WAN orchestration in Central; no vendor Terraform or Ansible content |
| 2022 | Routing and WAN | 3 → 3.5 | +1.2 | SFOS 19: SD-WAN profiles and VPN orchestration; no VRFs, MPLS or EVPN |
| 2024 | Platform and hypervisor freedom | 3 → 3.5 | +1.0 | v20 documentation names Proxmox VE under KVM and XCP-ng Center under Citrix; no ARM, no hardware acceleration |
| 2025 | Platform security and lifecycle | 3 → 2 | -2.0 | KEV deduction: CVE-2020-15069 and CVE-2020-29574 both added 2025-02-06 (minus 1.0) |
| 2026 | Threat protection | 4 → 4.5 | +1.2 | v22 MR1: NDR Essentials and NDR active threat intelligence on virtual, software and cloud instances |
Direction, 2023 to 2026
Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
| Date | Item | Theme | Driver |
|---|---|---|---|
| 2024-01 | SFOS 20: SD-WAN and high availability improvements, FIPS release (month not verified) | Routing | C |
| 2025-03 | RAM limits removed from business virtual, software and cloud BYOL licences; Home edition excluded at the time | Licensing | C |
| 2025-04 | SFOS v18.5 and v19.5 reach end of life | Security and lifecycle | P |
| 2025-12 | v22: Health Check against CIS benchmarks, Secure by Design hardening, XDR Linux sensor | Security and lifecycle | V |
| 2026-07 | v22 MR1 and MR2: NDR Essentials and NDR active threat intelligence on virtual, software and cloud instances (dated by the MR2 announcement) | Threat protection | C |
| 2026-07 | v22 MR1: Sophos Connect 2.0 for macOS with SSL VPN; policy-based IPsec fixes; Config Studio V2 | VPN | C |
| 2026-10 | v23 early access (open in October 2026): REST API with token authentication, high availability improvements | Management and API | C |
| 2026-10 | v23 early access: AI firewall assistant (Sophos Fusion) and AI Defense visibility | AI | V |
- Centre of gravity: Security and lifecycle (2), Routing (1), Licensing (1)
- Blind spots (no items): Firewall core, Network services, Platform, High availability, Observability, Packaging
- Driver mix: Vision 25%, Customer need 63%, Market window 0%, Upstream 0%, Portfolio 13%
- Idea-to-need index: 0.29 (0 = demand-pulled, 1 = thesis-pushed)
Credibility: 15.5 / 25
| Criterion | Score | Basis |
|---|---|---|
| Cadence | 3.5 | A major each year and several maintenance releases (v22 GA December 2025, MR1, MR2 announced 2026-07-14); no published schedule |
| Roadmap transparency | 3 | Public release notes and an open early access programme; no written roadmap |
| Say-do | 3 | The v22 requested-features list shipped; the REST API and AI assistant are still early access; the Home edition RAM change promised for a future update is unconfirmed |
| Velocity | 3.5 | Health Check, NDR Essentials, Config Studio V2 and a new macOS client within one major |
| Lifecycle stability | 2.5 | Only the last two maintenance releases are supported and the previous one is retired on each release; the legacy IPsec remote access retirement blocks upgrades for some firewalls |
Commercial risk: 11.5 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Price and licence volatility | 1.5 | One change since 2023, the 2025-03-01 removal of RAM limits, in the buyer's favour; no public prices to track |
| Purchase constraints | 2.5 | Subscription only through partners; the free Home edition is non-commercial and capped at 4 cores and 6 GB |
| Channel and access | 2.5 | Channel-only sales; trial downloads need an account; firmware is free with a valid support licence |
| Owner stability | 3 | Private-equity owner since 2020 (secondary source); the Secureworks acquisition is being folded into the firewall |
| Cost of staying supported | 2 | Firmware updates included with support; staying supported means moving to each new maintenance release |
Technical lock-in: 12.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Formats | 3 | Entities XML backup specific to SFOS |
| Export path | 2.5 | Backup and restore between SFOS devices; converters only from Cyberoam and Sophos UTM |
| Stack coupling | 2 | Runs alone; Central is optional for management, required for ZTNA and MSP features |
| Hardware / cloud coupling | 1.5 | Any x86 hardware or the listed hypervisors; some features such as the Home edition and Wi-Fi tied to editions or hardware |
| Skills and tooling coupling | 3 | Sophos-specific console and certification track |
Integrator fit: 13.5 / 20
| Criterion | Score | Basis |
|---|---|---|
| Partner programme openness | 4 | Open partner programme with MSP terms; all sales go through partners |
| Multi-tenancy and self-service | 3.5 | Sophos Central MSP Flex with multi-tenant firewall group management |
| API and infrastructure-as-code | 2.5 | XML API covers the main objects; REST API only in v23 early access; no vendor Terraform or Ansible content found |
| Skills and certification | 3.5 | Sophos Certified Engineer and Architect tracks |
AI leverage: 5.0 / 20
How the product uses AI, scored per year like capability. Only GA counts.
| Criterion | 2019 | 2022 | Today | Latest step |
|---|---|---|---|---|
| AI in threat detection | 1.5 | 1.5 | 3 | 2026: v22 MR1: NDR Essentials with active threat intelligence on virtual, software and cloud instances (vendor describes AI models) |
| AI platform stack | 0 | 0 | 0 | 2015: None |
| AI-assisted operations | 0 | 0 | 0.5 | 2026: v23 early access: AI firewall assistant (Sophos Fusion); preview counts half a step |
| Agent openness | 1.5 | 1.5 | 1.5 | 2015: XML API over HTTPS that scripts can drive; REST API with token authentication is in v23 early access; no MCP server found |
Year by year: 2015: 1.5 · 2016: 1.5 · 2017: 3 · 2018: 3 · 2019: 3 · 2020: 3 · 2021: 3 · 2022: 3 · 2023: 3 · 2024: 3 · 2025: 3 · 2026: 5
AI say-do, 2023 to 2026: 3 AI items announced; 1 GA, 2 still preview, 0 pending, 0 dropped. NDR Essentials shipped in v22 MR1; the AI firewall assistant and AI Defense visibility are in v23 early access.
Sophos uses machine learning in its sandbox and in NDR Essentials, which reached virtual and software firewalls with v22 MR1 in 2026. An operator assistant exists only in the v23 early access, and there is no official agent interface beyond the XML API.
Reading
Sophos Firewall scores near the top of this group on threat protection and management because its sandbox, TLS inspection, NDR and Central management shipped and are documented, and its free Home edition makes it the one enterprise product here a homelab can run without a licence. Two things hold the score back: the lifecycle policy keeps only the last two maintenance releases supported, and the two CISA KEV entries added in February 2025 concern flaws disclosed in 2020, which says more about patching in the field than about the current code. A buyer should check that no legacy IPsec remote access configuration remains, because those firewalls cannot move to v22 MR1 or later. The REST API and the AI assistant are early access and should not be assumed in a purchase.
Open questions and items to re-score
- Exact GA date of v22 and the dates of v22 MR1 and MR2; the partner news gives only December for GA and 2026-07-14 for the MR2 announcement.
- Whether the Home edition limits of 4 cores and 6 GB RAM still apply; the FAQ was last edited in January 2023 and the 2025 RAM change excluded Home at that time.
- Marketplace availability on AWS, Azure and other clouds was not confirmed from a Sophos page.
- WireGuard support was not found; re-check with v23.
- REST API GA date and coverage; v23 is early access.
- Ownership facts (Thoma Bravo since 2020, Secureworks acquisition) come from secondary sources.
- Capability steps dated 2017 to 2022 rest on the dossier's release timeline, which was not read from release notes.
Related reading
More from Firewall and Router Ledger 2026
- Overview: all platforms side by side
- Firewall and Router Ledger Methodology: How Every Score Is Built
- Barracuda: Firewall and Router Ledger 2026 Scorecard
- Check Point: Firewall and Router Ledger 2026 Scorecard
- Cisco FTD: Firewall and Router Ledger 2026 Scorecard
- Forcepoint NGFW: Firewall and Router Ledger 2026 Scorecard
- FortiGate: Firewall and Router Ledger 2026 Scorecard
- IPFire: Firewall and Router Ledger 2026 Scorecard
- Juniper vSRX: Firewall and Router Ledger 2026 Scorecard
- Netgate TNSR: Firewall and Router Ledger 2026 Scorecard
- NG Firewall: Firewall and Router Ledger 2026 Scorecard
- OpenWrt: Firewall and Router Ledger 2026 Scorecard
- OPNsense: Firewall and Router Ledger 2026 Scorecard
- Palo Alto: Firewall and Router Ledger 2026 Scorecard
- pfSense: Firewall and Router Ledger 2026 Scorecard
- RouterOS: Firewall and Router Ledger 2026 Scorecard
- SonicWall NSv: Firewall and Router Ledger 2026 Scorecard
- VyOS: Firewall and Router Ledger 2026 Scorecard
- WatchGuard: Firewall and Router Ledger 2026 Scorecard