Firewall and Router Ledger 2026
Ledger
Firewall and Router Ledger 2026
WatchGuard: Firewall and Router Ledger 2026 Scorecard
WatchGuard's virtual Firebox is a complete small-office UTM on four hypervisors, with two KEV entries in late 2025 and no published support window per Fireware version.
Edition October 16, 20268 min read
Where WatchGuard Firebox put its effort, 2016 to 2026
Each square is one capability area in one year. The brighter it is, the more the area gained in the Firewall and Router Ledger that year; 1, 2 and 3 mark that year's biggest pushes.
| ’16 | ’17 | ’18 | ’19 | ’20 | ’21 | ’22 | ’23 | ’24 | ’25 | ’26 | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Routing and WAN | 1 | ||||||||||
| Firewall and NAT core | 2 | ||||||||||
| VPN and remote access | 1 | 1 | |||||||||
| Threat protection | 1 | ||||||||||
| Network services | 2 | ||||||||||
| Platform and hypervisor freedom | 3 | 1 | |||||||||
| High availability and performance | |||||||||||
| Management, API and automation | |||||||||||
| Observability | |||||||||||
| Platform security and lifecycle |
no change+0.5+1+1.5 or moreScores out of 5 per area.
Biggest pushes overall: VPN and remote access (+1), Threat protection (+1), Platform and hypervisor freedom (+1). Already strong in 2015: Observability, Firewall and NAT core, VPN and remote access.
Top focus each year: 2018 Threat protection; 2019 Routing and WAN; 2021 VPN and remote access; 2025 Platform and hypervisor freedom; 2026 VPN and remote access. 6 of 11 years show no gain in any area.
Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.
Snapshot
- Type: product
- Owner: WatchGuard Technologies, Inc. (Seattle, US; private; the controlling owner was not confirmed from a public source)
- Licence: Proprietary, feature key per device. FireboxV in five sizes from Micro (2 vCPU) to Extra Large (16 vCPU); Firebox Cloud on AWS and Azure as BYOL in four sizes or pay as you go with a 30 day trial. Basic and Total Security Suite subscriptions; prices not published; no free edition
- Latest release: Fireware 12.12 (2026-03-27) for FireboxV and Firebox Cloud; the year-based 2026.x line covers new hardware only
- Support lifecycle: End-of-life policy is written per hardware model (end of life up to five years after end of sale, 60 days notice); signature updates for a release continue 12 months after the next version ships; no published window per Fireware version; Fireware 11.x is end of life
- Next milestone: none published
- Security record: 2 CISA KEV entries: CVE-2025-9242 (added 2025-11-12, IKEv2 out-of-bounds write) and CVE-2025-14733 (added 2025-12-19, out-of-bounds write, ransomware use flagged); fixes in Fireware 12.11.5 and 12.5.14. Advisories: https://www.watchguard.com/wgrd-psirt/advisories
- Hypervisors: VMware ESXi, Microsoft Hyper-V, Linux KVM (Fireware 12.6.2 or later) and Proxmox VE for FireboxV; Firebox Cloud on AWS and Azure; FireCluster active-passive on ESXi only, none on Hyper-V or KVM; no GCP, XCP-ng or ARM found
- Tier: Enterprise virtual appliance
- Archetype: Steady maintainer
- Evidence grade: B. The FireboxV hypervisor list, the Firebox Cloud licensing page, the end-of-life policy, the 12.11.7 and 12.12 release posts and the KEV entries were read from WatchGuard pages, the Canadian Cyber Centre and the CISA catalogue. Nothing from 2023 or 2024 was read, so the direction list starts in late 2025. Capability steps before 2026 rest on the dossier's timeline, which was not read from release notes.
Scorecard
| Dimension | Score | Direction |
|---|---|---|
| Capability today | 68.0 / 100 | higher is better |
| Momentum since end of 2022 | +0.2 points (2015 to 2022: +9.4) | higher is better |
| Credibility | 14.5 / 25 | higher is better |
| Commercial risk | 14.5 / 25 | lower is better |
| Technical lock-in | 13.0 / 25 | lower is better |
| Integrator fit | 12.5 / 20 | higher is better |
| AI leverage | 3.5 / 20 | higher is better |
| Ledger Index | 52.5 / 100 | balanced weights; see the methodology |
Capability by domain, 2015 to today
Scores 0 to 5 against fixed anchors; total is weighted to 100.
| Domain (weight) | 2015 | 2019 | 2022 | Today |
|---|---|---|---|---|
| Routing and WAN (12) | 2.5 | 3 | 3 | 3 |
| Firewall and NAT core (12) | 3 | 3.5 | 3.5 | 3.5 |
| VPN and remote access (12) | 3 | 3 | 3.5 | 4 |
| Threat protection (12) | 3 | 4 | 4 | 4 |
| Network services (8) | 3 | 3.5 | 3.5 | 3.5 |
| Platform and hypervisor freedom (10) | 2.5 | 3 | 3 | 3.5 |
| High availability and performance (8) | 3 | 3 | 3 | 3 |
| Management, API and automation (10) | 3 | 3.5 | 3.5 | 3.5 |
| Observability (6) | 3.5 | 4 | 4 | 4 |
| Platform security and lifecycle (10) | 3 | 3 | 3 | 2 |
| Total / 100 | 58.4 | 66.6 | 67.8 | 68.0 |
Year by year: 2015: 58.4 · 2016: 58.4 · 2017: 58.4 · 2018: 61.6 · 2019: 66.6 · 2020: 66.6 · 2021: 67.8 · 2022: 67.8 · 2023: 67.8 · 2024: 67.8 · 2025: 66.8 · 2026: 68.0
What moved the score
| Year | Domain | Change | Points | Trigger |
|---|---|---|---|---|
| 2018 | Network services | 3 → 3.5 | +0.8 | 12.2: DNSWatch resolver with blocklists (grade C for the year) |
| 2018 | Threat protection | 3 → 4 | +2.4 | 12.2 and 12.3: IntelligentAV machine learning detection, DNSWatch, Threat Detection and Response, TLS content inspection (grade C for the year) |
| 2019 | Firewall and NAT core | 3 → 3.5 | +1.2 | 12.x: policy aliases, geolocation in policies, hit counts in WatchGuard Cloud (grade C for the year); fewer shared objects across devices than Central-managed rivals |
| 2019 | Management, API and automation | 3 → 3.5 | +1.0 | 12.5: WatchGuard Cloud management with RapidDeploy zero-touch provisioning and templates; Fireware REST API coverage not verified (grade C for the year) |
| 2019 | Observability | 3.5 → 4 | +0.6 | 12.5: WatchGuard Cloud visibility and reporting (grade C for the year) |
| 2019 | Platform and hypervisor freedom | 2.5 → 3 | +1.0 | 12.6.2: Linux KVM for FireboxV; Firebox Cloud on AWS and Azure (year grade C) |
| 2019 | Routing and WAN | 2.5 → 3 | +1.2 | 12.x: SD-WAN actions with link health measurement on multi-WAN (grade C for the year); no VRFs or EVPN |
| 2021 | VPN and remote access | 3 → 3.5 | +1.2 | 12.7 and 12.8: IKEv2 improvements and Access Portal (grade C for the year) |
| 2025 | Platform and hypervisor freedom | 3 → 3.5 | +1.0 | FireboxV documentation names Proxmox VE (year of the addition not found); no ARM, GCP or acceleration |
| 2025 | Platform security and lifecycle | 3 → 2 | -2.0 | KEV deduction: CVE-2025-9242 added 2025-11-12 and CVE-2025-14733 added 2025-12-19 (minus 1.0) |
| 2026 | VPN and remote access | 3.5 → 4 | +1.2 | 12.12: WireGuard based Firebox Gateway for FireCloud on FireboxV and Firebox Cloud; new 64-bit IPsec mobile client |
Direction, 2023 to 2026
Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
| Date | Item | Theme | Driver |
|---|---|---|---|
| 2025-12 | Fireware 12.11.5 and 12.5.14 fix the IKEv2 out-of-bounds write CVE-2025-9242; Fireware 11.x declared end of life (advisory AV25-816) | Security and lifecycle | C |
| 2026-02 | 12.11.7: Firmware Vulnerability Alerts in WatchGuard Cloud for FireboxV and Firebox Cloud | Security and lifecycle | C |
| 2026-02 | 12.11.7: stronger default security settings | Firewall core | C |
| 2026-02 | Fireware 2026.1 line for new tabletop and rackmount hardware; FireboxV and Firebox Cloud stay on 12.x | Packaging | P |
| 2026-03 | 12.12: WireGuard based Firebox Gateway for FireCloud on FireboxV and Firebox Cloud | VPN | P |
| 2026-03 | 12.12: 64-bit IPsec Mobile VPN Client (NCP 15.33) | VPN | C |
- Centre of gravity: Security and lifecycle (2), VPN (2), Firewall core (1)
- Blind spots (no items): Routing, Threat protection, Network services, Platform, High availability, Management and API, Observability, Licensing, AI
- Driver mix: Vision 0%, Customer need 67%, Market window 0%, Upstream 0%, Portfolio 33%
- Idea-to-need index: 0.00 (0 = demand-pulled, 1 = thesis-pushed)
Credibility: 14.5 / 25
| Criterion | Score | Basis |
|---|---|---|
| Cadence | 3.5 | Release posts every one to two months (12.11.7 on 2026-02-02, 12.12 on 2026-03-27); no published schedule |
| Roadmap transparency | 2 | Release notes and blog posts public; no public roadmap |
| Say-do | 3 | No dated promises found to test; the shipped items in 2026 were not pre-announced |
| Velocity | 3 | One or two substantive capabilities per 12.x release, such as the Firebox Gateway and vulnerability alerts |
| Lifecycle stability | 3 | Policy is per hardware model and predictable; the Fireware line split into 12.x for virtual and 2026.x for new hardware |
Commercial risk: 14.5 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Price and licence volatility | 2.5 | A price adjustment notice appears on the vendor blog; amount and date not read; no public prices |
| Purchase constraints | 3 | Subscription and feature key through a reseller; only a 30 day cloud trial, no free edition |
| Channel and access | 3.5 | Channel-only sales through WatchGuardONE partners; software downloads need an account |
| Owner stability | 2.5 | Private company; the current controlling owner was not confirmed from a public source |
| Cost of staying supported | 3 | Security services are subscriptions; signature updates for a release end 12 months after the next version |
Technical lock-in: 13.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Formats | 3 | Fireware XML policy file specific to WatchGuard |
| Export path | 3 | Backup and restore between Fireboxes; no converter to or from other vendors found |
| Stack coupling | 2 | Runs alone; WatchGuard Cloud needed for fleet features and FireCloud |
| Hardware / cloud coupling | 2 | Any of four hypervisors; FireCluster needs ESXi; Firebox Cloud tied to AWS and Azure images |
| Skills and tooling coupling | 3 | WatchGuard System Manager and WatchGuard Cloud tooling; certified training partners |
Integrator fit: 12.5 / 20
| Criterion | Score | Basis |
|---|---|---|
| Partner programme openness | 4 | WatchGuardONE programme open to resellers and MSPs; all sales through the channel |
| Multi-tenancy and self-service | 3 | WatchGuard Cloud multi-tenant MSP management (not verified in this pass) |
| API and infrastructure-as-code | 2.5 | Fireware REST API exists; coverage not verified; no Terraform or Ansible content found |
| Skills and certification | 3 | WatchGuard certified training programme |
AI leverage: 3.5 / 20
How the product uses AI, scored per year like capability. Only GA counts.
| Criterion | 2019 | 2022 | Today | Latest step |
|---|---|---|---|---|
| AI in threat detection | 2 | 2 | 2 | 2018: 12.2: IntelligentAV machine learning malware detection (vendor claim; year grade C); ThreatSync correlation |
| AI platform stack | 0 | 0 | 0 | 2015: None |
| AI-assisted operations | 0 | 0 | 0 | 2015: None |
| Agent openness | 1.5 | 1.5 | 1.5 | 2015: Fireware REST API; no MCP server or agent interface found |
Year by year: 2015: 1.5 · 2016: 1.5 · 2017: 1.5 · 2018: 3.5 · 2019: 3.5 · 2020: 3.5 · 2021: 3.5 · 2022: 3.5 · 2023: 3.5 · 2024: 3.5 · 2025: 3.5 · 2026: 3.5
AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI items for the firewall were announced from 2023 to 2026 in the sources read.
WatchGuard's AI sits in detection: IntelligentAV classifies malware with machine learning and ThreatSync correlates events across products. There is no operator assistant and no agent interface beyond the REST API.
Reading
The virtual Firebox covers the full small-office feature list, from sandboxing and DNS filtering to a WireGuard gateway in 12.12, on ESXi, Hyper-V, KVM and Proxmox VE. The scores fall where the virtual edition is weaker than the hardware: FireCluster runs only on ESXi, and the two CISA KEV entries added in November and December 2025 take a full point off the lifecycle domain. A buyer should ask for the support end date of the Fireware release they deploy, because the published policy covers hardware models and not software versions. The gap in this scorecard is 2023 and 2024, where no release was read.
Open questions and items to re-score
- End-of-support dates for Fireware 12.11 and 12.12; the policy page gives hardware dates only.
- The controlling owner of WatchGuard Technologies; no public source confirmed it, so the dossier's private-equity attribution is not stated as fact.
- The year Proxmox VE was added to the FireboxV documentation; the 2025 platform step is an estimate.
- Fireware REST API coverage and whether any Terraform or Ansible content exists.
- The price adjustment announced on the vendor blog: date and amount.
- Releases from 2023 and 2024 were not read; capability steps dated 2018 to 2021 rest on the dossier's timeline.
Related reading
More from Firewall and Router Ledger 2026
- Overview: all platforms side by side
- Firewall and Router Ledger Methodology: How Every Score Is Built
- Barracuda: Firewall and Router Ledger 2026 Scorecard
- Check Point: Firewall and Router Ledger 2026 Scorecard
- Cisco FTD: Firewall and Router Ledger 2026 Scorecard
- Forcepoint NGFW: Firewall and Router Ledger 2026 Scorecard
- FortiGate: Firewall and Router Ledger 2026 Scorecard
- IPFire: Firewall and Router Ledger 2026 Scorecard
- Juniper vSRX: Firewall and Router Ledger 2026 Scorecard
- Netgate TNSR: Firewall and Router Ledger 2026 Scorecard
- NG Firewall: Firewall and Router Ledger 2026 Scorecard
- OpenWrt: Firewall and Router Ledger 2026 Scorecard
- OPNsense: Firewall and Router Ledger 2026 Scorecard
- Palo Alto: Firewall and Router Ledger 2026 Scorecard
- pfSense: Firewall and Router Ledger 2026 Scorecard
- RouterOS: Firewall and Router Ledger 2026 Scorecard
- SonicWall NSv: Firewall and Router Ledger 2026 Scorecard
- Sophos Firewall: Firewall and Router Ledger 2026 Scorecard
- VyOS: Firewall and Router Ledger 2026 Scorecard