Magic Quadrant for Network Firewalls
December 19, 2022
By: Rajpreet Kaur, Adam Hils and
With the emergence of cloud firewalls and firewall-as-a-service offerings, network firewalls are evolving into hybrid mesh firewalls, making the selection of the most suitable vendor a challenge. Gartner evaluated 17 vendors to help security and risk management leaders make the right choice for their organizations.
Strategic Planning Assumptions
By 2026, more than 60% of organizations will deploy more than one type of firewall, which will drive adoption of hybrid mesh firewalls.
By 2026, more than 30% of new distributed branch office firewall deployments will be firewall-as-a-service offerings, up from less than 10% in 2022.
Market Definition/Description
Gartner defines the network firewall market as the market for firewalls that secure networks using bidirectional stateful traffic inspection (egress and ingress). Network firewalls are implemented through hardware, virtual appliances and cloud-native controls.
Network firewalls are used to secure networks. These networks can be on-premises, hybrid (on-premises and cloud), public cloud or private cloud networks. Network firewall products support different deployment use cases, such as perimeter, midsize enterprise, data center, cloud, cloud-native and distributed office.
Network firewall capabilities include advanced networking, threat inspection and detection, and web filtering.
Core capabilities:
-
Networking:This includes support for routing tables with destination network address translation (DNAT) and static network address translation (SNAT) capabilities.
-
Stateful inspection:This enables traffic to be inspected according to stateful firewall rules.
-
Threat detection and inspection:This includes intrusion prevention system (IPS) and malware inspection capabilities.
-
Web filtering:This includes filtering outbound traffic for HTTP and HTTPS, as well as for applications.
-
Advanced logging and reporting:All actions of firewall administrators can be logged, and reports can be customized and run based on different object types and traffic types. Granular threat-based and web-filtering-based reports can be generated.
Optional capabilities:
-
Internet of Things (IoT) security:This can be achieved through modules built into threat detection controls or through dedicated subscriptions integrated into network firewall products. Specific capabilities may include discovery of IoT devices, risk analysis and dedicated rules to block attacks related to these devices. In addition, IoT signatures are part of the IPS signature library.
-
Network sandboxing:Network sandboxing monitors network traffic for suspicious objects and automatically submits them to a sandbox environment, where they are analyzed and assigned a malware probability score and severity rating.
-
Zero trust network access (ZTNA):Zero trust network access (ZTNA) enables identity- and context-based access boundaries between any user and device and applications.
-
Operational technology (OT) security:This includes integrated or dedicated capabilities related to securing OT environments. Standalone OT security products are not considered here. Capabilities may include dedicated OT-related threat intelligence, dedicated IPS signatures for OT devices, support for supervisory control and data acquisition (SCADA) applications, and threat inspection.
-
Domain name system (DNS) security:Secures DNS traffic by providing monitoring, detection and prevention capabilities against DNS-layer attacks.
-
Software-defined WAN (SD-WAN):It provides dynamic path selection based on business or application policies, centralized policy and device management, virtual private network (VPN) and zero-touch provisioning.
Magic Quadrant
Vendor Strengths and Cautions
Alibaba Cloud
Alibaba Cloud is a Challenger in this Magic Quadrant. Its Alibaba Cloud Firewall is a more mature cloud firewall offering than those of its direct cloud service provider (CSP) competitors, with features such as application control, URL filtering and advanced threat prevention. It also provides firewalls for emerging cloud use cases, such as container firewalls, as well as microsegmentation that is unique to its offering.
Alibaba Cloud is a cloud service provider with a broad portfolio. It offers a robust set of security controls. Alibaba Cloud Firewall is its cloud-native firewall offering.
Alibaba Cloud has made significant updates to its firewall traffic visualization capabilities and to the introduction of its DNS firewall. It has also expanded its points of presence (POPs) to more regions outside China.
-
Support for emerging cloud firewall use cases:Alibaba Cloud offers a mature container firewall module — Alibaba Security Center – Container Firewall — providing image security and runtime application security features. In addition, Alibaba Cloud Firewall offers mature microsegmentation as part of its advanced licensing tier.
-
Portfolio and market responsiveness:Alibaba Cloud is a large CSP with a broad portfolio. Compared with its direct CSP competitors, it places strong emphasis on expanding its security offerings, and it scores highly for market responsiveness.
-
Unified endpoint client:Alibaba Cloud provides a single client for its firewall VPN, secure access service edge (SASE) and endpoint detection and response (EDR) offerings, which makes management and vendor consolidation easier. Both the cloud firewall and EDR offerings can be centrally managed through Alibaba Security Center.
-
Advanced threat detection:Alibaba Cloud Firewall provides network detection and response (NDR) capabilities and integrates with Alibaba EDR and Alibaba Cloud Security Center and its extended detection and response (XDR) platform. Customers can also choose to purchase directly managed security services. Alibaba Cloud also offers a dedicated DNS firewall to secure DNS.
-
Application control:Although Alibaba Cloud provides strong support for regional applications and has data loss prevention (DLP) capabilities, its firewall lacks support for applications such as Microsoft Office 365 that are widely used outside China. Customers outside China must therefore compare Alibaba Cloud’s application control against the applications they use before making a purchasing decision.
-
Geographic presence:Alibaba Cloud has a significant presence in China, but it rarely appears on customer shortlists outside China. Its product strategy is therefore primarily aimed at Chinese requirements.
-
Third-party partnerships:Alibaba Cloud’s strategy is to build its own native offerings. As a result, it has only limited regional partnerships. It does not offer any firewall integration with third-party EDR, XDR and identity and access management (IAM) solutions.
-
Features:Alibaba Cloud Firewall does not support Transport Layer Security (TLS) decryption. It also lacks fully qualified domain name (FQDN)-based traffic routing and redirection, as well as IoT security features.
Amazon Web Services
Amazon Web Services (AWS) is a Niche Player in this Magic Quadrant. AWS Network Firewall is a native cloud firewall that provides basic capabilities compared with other network firewall vendors. Customers can also purchase third-party firewall-as-a-service (FWaaS) offerings through AWS Marketplace, including partner-managed firewall rules.
AWS is a CSP. AWS Network Firewall is delivered as a fully managed service on the AWS cloud platform. Other AWS security product families include IAM, network and application protection, data protection, incident response and compliance.
Recent significant features developed for AWS Network Firewall include enhanced east-west protection (traffic inspection between subnets within the same virtual private cloud), default deny/drop rules, strict rule ordering configuration options and support for centrally deployed AWS Firewall Manager.
-
Customer experience:AWS Network Firewall scores highly for high availability and auto scaling. In addition, customers like the customization of AWS managed rules. They cite the ease of use of these integrated capabilities as a primary reason for choosing AWS Network Firewall.
-
Pricing:Customers value the simplicity of the AWS Network Firewall pricing model. Customers pay based on the number of firewalls deployed and the traffic processed. Basic support is available to all customers at no additional cost.
-
Scalability:The performance, high availability and scalability of AWS Network Firewall offer a clear advantage over the offerings of other firewall vendors. It provides built-in high availability to ensure that all traffic is consistently inspected and monitored.
-
Ease of deployment: Easeof deployment is achieved through many different features in AWS Firewall Manager, such as automatic firewall configuration, the ability to automatically deploy firewalls across accounts and zero-touch deployment.
-
Product strategy:Compared with competing offerings, AWS Network Firewall lags in terms of features. As a result, AWS relies on partnerships with other vendors, such as Palo Alto Networks, which provide native AWS instances of the partner vendor’s firewall for customers who find AWS firewall limitations.
-
Integration:Gartner clients generally do not consider AWS an ideal vendor for consolidating a zero trust architecture. AWS lacks a native ZTNA offering. It has a complex deployment approach that uses AWS Virtual Private Cloud (VPC) to achieve microsegmentation, which limits its appeal for the emerging firewall use-case shortlist.
-
Feature gaps:AWS Network Firewall does not support native network address translation (NAT) capabilities and does not support IPv6. It also cannot detect client-based applications and lacks granular application control.
-
Advanced threat detection:AWS Network Firewall provides fewer vendor-researched proprietary signatures than other firewalls. In addition, TLS decryption is missing from AWS’s firewall.
Barracuda
Barracuda is a Visionary in this Magic Quadrant. It offers a range of firewall appliances in its CloudGen Firewall product line, focused on distributed offices and public cloud virtual appliances. Branch connectivity is an important market for Barracuda.
Barracuda’s security offerings include firewalls, web application and API protection (WAAP) products, secure web gateway, ZTNA (for remote access to private applications) and secure email gateway.
The latest updates to the Barracuda firewall family include IoT, OT and cloud security capabilities. For example, Barracuda added IPS, URL, content, antivirus and Secure Sockets Layer (SSL) inspection capabilities to its CloudGen WAN offering.
-
Cloud and branch capabilities:Barracuda’s CloudGen firewall product line provides mature integration with native AWS and Microsoft Azure controls. Barracuda added CloudGen WAN, a FWaaS offering, to address work-from-home and remote office use cases. Barracuda also introduced a secure connector for IoT connectivity with Microsoft Azure, which is fully managed through CloudGen WAN.
-
Firewall deployment modes:Barracuda already offers products in all major firewall modes — CloudGen Firewall for hardware and virtual; CloudGen WAN for FWaaS; secure connector for containerized firewalls; and CloudGen Firewall (rugged) to meet industrial firewall requirements.
-
Pricing:Barracuda’s low-end appliances offer a very good total cost of ownership (TCO). The vendor’s pool-based licensing enables administrators to allocate software licenses across platforms as needed.
-
IoT capabilities:Barracuda has enhanced its ability to secure IoT environments through partnerships with Crosser, Nozomi Networks and SCADAfence. Barracuda has also partnered with Crosser to run edge computing logic on some firewall appliances.
-
Virtualization:When running multiple virtual instances on the same appliance, Barracuda’s hardware appliances do not isolate certain functions, such as VPN, Dynamic Host Configuration Protocol (DHCP), DNS caching and DNS interception.
-
Multiple management portals:Separate management consoles are unique to their environments. The CloudGen WAN FWaaS offering must be managed through Barracuda’s cloud management platform. CloudGen physical and virtual appliances must be managed using a local firewall manager called Barracuda Firewall Admin.
-
Product strategy:Barracuda lacks native EDR and offers only limited third-party integration with endpoint and network security vendors. IPS functionality is provided, but it uses Trend Micro technology on an OEM basis. All IPS signatures are developed by third parties, and the number of signatures is inferior to that of competitors.
-
Customer feedback:Customer feedback indicates that the content filtering module Barracuda provides offers limited reporting, and that product management is a complex task.
Check Point Software Technologies
Check Point Software Technologies is a Leader in this Magic Quadrant. It is shortlisted by enterprise customers for standalone firewall use cases. Beyond firewalls, Check Point offers a broad set of security capabilities as well as mature cloud-based centralized management. This makes it a strong candidate for organizations seeking a security platform solution.
Check Point offers a comprehensive security portfolio that includes Quantum-branded hardware appliances and the Maestro hyperscale product line. Check Point packages its FWaaS as part of its Harmony Connect offering.
During the evaluation period for this Magic Quadrant, Check Point released new Quantum Lightspeed appliances, management appliances, midrange/branch firewalls and its “Titan” software version. It also enhanced CloudGuard Workload support for OpenShift and Docker, while adding microsegmentation.
-
Platform strategy:Check Point offers complementary product lines that help customers avoid the operational complexity and threat coordination gaps caused by managing too many security vendors. All of its products can be managed through its cloud-based centralized manager, Infinity Portal.
-
Data center use cases:Check Point is particularly attractive to large organizations that have large data centers and appreciate the licensing flexibility and scalability inherent in the Maestro hyperscale product line.
-
Pricing:Check Point’s pricing model is favorable for both large and midsize enterprise customers. Check Point offers subscription-based pricing, enabling large enterprises to avoid significant capital expenditure. A single SKU for midsize enterprises provides multiple security products in one bundle.
-
Advanced threat detection:Check Point ThreatCloud coordinates malware discovery and intelligence across Check Point’s various products and services. Check Point has one of the largest IPS signature libraries. It also has a large signature-based database for detecting client applications.
-
Sales and Marketing Execution:Compared with direct competitors, Check Point lacks a proactive pre-sales team. It also lacks awareness marketing, which causes prospective customers to turn elsewhere because they are unaware of Check Point’s product strategy and refreshed product portfolio.
-
Product Execution:Check Point’s cloud security posture management (CSPM) is not integrated with its on-premises firewall central management product.
-
Advanced Networking:Check Point’s firewalls lack built-in SD-WAN capabilities. The vendor partners with SD-WAN providers to deliver FWaaS products.
-
Product Features:Although Check Point has a large malicious URL threat intelligence database, it does not support dynamic categorization of uncategorized websites. This shortcoming creates operational complexity.
Cisco
Cisco is a Challenger in this Magic Quadrant. Cisco has a broad product portfolio, and its firewalls are typically sold as part of larger deals.
Cisco is an infrastructure vendor. It offers different firewall product lines for different deployment use cases: Cisco Secure Firewall, Cisco Adaptive Security Appliance (ASA), Cisco Secure Workload and the Cisco Meraki series. In addition, Cisco offers the Umbrella Secure Internet Gateway (SIG) for FWaaS and industrial firewalls (the Secure Firewall Industrial Security Appliance [ISA] series).
Key updates in 2021 and 2022 include native support for TLS 1.3 decryption; support for Cisco Secure Firewall Threat Defense in Alibaba Cloud and Alkira; and a cloud-delivered Secure Firewall Management Center. Cisco also added a VPN managed subscription service that enables Cisco to manage user scale and change and offers options including Umbrella SIG support.
-
IoT/Industrial Control System (ICS) Security:Cisco offers IoT security services and has established a partnership with Rockwell to secure ICS. Cisco has a dedicated IoT research team within the Cisco Talos Intelligence Group. Cisco Secure Firewall receives building management and medical asset information from Cisco Digital Network Architecture (DNA) endpoint analytics.
-
Licensing:Cisco has a diverse, flexible set of licensing agreements that allow organizations to deploy the Cisco security solutions that make sense for their use cases on favorable commercial terms.
-
Customer Feedback:Customers consider SecureX, the cloud-based threat correlation platform included with Cisco products, to be a strength. They praise Cisco for continuing to provide above-average technical support.
-
Distributed Office Use Case:Cisco offers Meraki firewalls to connect remote offices. These firewalls benefit from tight integration with Cisco Umbrella for SASE use cases. Zero-touch provisioning simplifies deployment while also providing connectivity assurance through VPN monitoring. Cisco also offers a dedicated FWaaS product through Cisco Umbrella.
-
Multiple Firewall Product Lines:Cisco’s firewall portfolio is confusing, with overlapping product features. This can lead to deploying products with different operating systems, which increases the learning curve and reduces efficiency.
-
Container Firewall:Cisco lacks a dedicated containerized firewall product to protect containers. It offers the Cisco Secure Workload microsegmentation product line for container security.
-
Sales Execution:Cisco Secure Firewall is typically sold as part of larger Cisco Enterprise License Agreement (ELA) deals and lacks visibility in pure firewall deals. Although Cisco Meraki MX firewalls are popular in distributed office use cases, Gartner does not find Cisco firewalls becoming a first choice on customers’ shortlists in other use cases, such as cloud firewalls and data centers.
-
Customer Feedback:We hear feedback from Gartner clients that Cisco’s reseller partners do not recommend Cisco Secure Firewall due to legacy instability issues and defective firmware. The firewall management GUI is a work in progress, and some Cisco customers report that firewall management is relatively weak. In addition, customers find Cisco Secure Firewall expensive to buy outside of ELA deals.
Forcepoint
Forcepoint is a Niche Player in this Magic Quadrant. It offers firewalls focused on distributed office use cases but lacks capabilities such as FWaaS and cloud-based management. It is primarily considered by distributed enterprises looking for appliance-based, SD-WAN-enabled firewalls for their sites.
Forcepoint offers Forcepoint ONE (a Security Service Edge [SSE] platform) along with network security and data security products. Forcepoint Next-Generation Firewall (NGFW) is the name of its firewall product line.
Key feature updates related to Forcepoint firewalls over the past year include support for more public cloud platforms, improved application inspection performance, the addition of remote browser isolation (RBI) capabilities and subscriptions, and content disarm and reconstruction (CDR) capabilities. Forcepoint also introduced new firewall models for remote and branch offices.
-
Distributed Office Use Case:Forcepoint firewalls have built-in advanced SD-WAN capabilities, with comprehensive IPv6 support, advanced dynamic routing and mature VPN management controls, and active-active clustering. These make them attractive for distributed offices.
-
Integration with Forcepoint ONE:Forcepoint provides cloud-based service chaining integration through the EasyConnect capability between Forcepoint firewalls and Forcepoint ONE. Features such as RBI and CDR integration enhance the advanced threat detection and prevention capabilities of its firewalls.
-
Mature Application Control:Forcepoint offers mature application control, DLP and URL filtering capabilities. In addition to supporting dynamic categorization of uncategorized sites, service chaining with Forcepoint ONE CASB (a cloud access security broker) makes application control more granular.
-
Customer Feedback:Forcepoint’s on-premises firewall manager, the NGFW Security Management Center (SMC), is frequently well received by customers. It is a powerful firewall management platform with granular management, zero-touch provisioning, VPN management and logging capabilities.
-
Features:Forcepoint lacks the FWaaS features required by branch offices and roaming users. Its firewall offers limited support for IoT protocols. It does not provide 5G support for devices.
-
Visibility:As more vendors support this use case, Forcepoint does not stand out in the pure firewall shortlists Gartner sees, including those for distributed offices. Forcepoint also lacks visibility in cloud firewall use cases. In addition, it lacks a dedicated container firewall.
-
Separate endpoint agents:Forcepoint offers two separate endpoint agents: the Endpoint Context Agent (ECA) for Forcepoint NGFW and Forcepoint ONE Endpoint for its SSE solution. This makes it a less attractive vendor for customers seeking ease of management and consolidation.
-
Pricing strategy:Despite having a large portfolio, Forcepoint does not offer an ELA contract covering its firewall product line and other products. The resulting licensing complexity and lack of ELA-based discounts deter customers from consolidating on Forcepoint.
Fortinet
Fortinet is a Leader in this Magic Quadrant. Because it delivers mature SD-WAN and firewall capabilities in a single appliance, it leads in appliance-based distributed office use cases.
Fortinet is a network security vendor with a rich product portfolio. In addition to its FortiGate firewall products, Fortinet offers SASE, networking, and security operations products.
Key firewall-related updates in 2022 include the introduction of ZTNA, inline sandboxing, and inline CASB. Fortinet also achieved further integration between FortiGate and its network access control (FortiNAC), and launched a security operations center (SOC) as a service, bundled with FortiGate licenses.
-
Integrated SD-WAN:Fortinet provides built-in advanced SD-WAN and routing capabilities in FortiGate firewall appliances. Fortinet offers a complete SD-WAN package with features including forward error correction, packet duplication, and intelligent, dynamic application routing.
-
Hybrid ZTNA deployment:Fortinet offers flexible ZTNA deployment models. The ZTNA implementation is part of the FortiGate operating system (FortiOS) and can be deployed on-premises or as a service as part of FortiSASE (a standalone product). The vendor also launched an inline CASB with integrated ZTNA capabilities.
-
Product portfolio:Fortinet has a large product portfolio. It offers products for networking, network security, and security operations. Most of its products can be managed through a single management interface and provide integration through the Fortinet Security Fabric.
-
Centralized management:Fortinet offers mature on-premises and cloud-based centralized management through FortiManager and FortiCloud, respectively. These products share the same functionality and support centralized management of most Fortinet devices. FortiGate customers appreciate the ease of management and configuration of Fortinet firewalls.
-
Customer feedback:Feedback from some Gartner clients indicates that FortiGate firewalls do not lead in price-performance. Clients that include Fortinet on their midmarket and data center use case shortlists find its products more expensive than competing products.
-
Dedicated container firewall:FortiGate lacks a native containerized firewall to protect container workloads. It provides container security through FortiGate-VM firewalls and Calico integration.
-
Integrated FWaaS offering:Fortinet lacks an integrated FWaaS offering. It provides FWaaS through FortiSASE as a dedicated product line, without integration with FortiGate firewalls. FortiSASE comes with a dedicated management interface. Integration between FortiGate’s built-in SD-WAN capabilities and FortiSASE is also lacking.
-
Visibility:Compared with direct competitors, Fortinet appears less frequently on shortlists for cloud firewall and FWaaS use cases. Fortinet is still primarily considered for its hardware firewall products.
H3C
H3C is a Niche Player in this Magic Quadrant. It offers a full range of hardware firewalls, called the SecPath series, for small, medium, and large environments. HC3 focuses on the Chinese market. It provides limited support for cloud providers outside China.
H3C has a diverse security portfolio that includes products for the XDR, EDR, distributed denial of service (DDoS), and web application firewall (WAF) market segments. The H3C CloudSecPath firewall service is its FWaaS offering. For enterprises seeking a security stack focused on the Chinese market, H3C is a good choice.
Key updates over the past year include new appliances in the F100, F1000, F5000, and M9000 series. H3C also enhanced its advanced threat detection and prevention capabilities by adding support for dynamic authorization, encrypted transmission, and sensitive data protection.
-
Scalability:H3C’s firewalls support highly scalable deployments. H3C’s hardware appliances support up to 4,096 virtual instances. The H3C CloudSecPath firewall service delivers high capacity; H3C claims it can support 200 GB of throughput for 200,000 users.
-
Product portfolio:H3C has a rich security portfolio and is chosen by many enterprises seeking consolidation. H3C offers products such as SecCenter CSAP for endpoint protection and CSAP Threat Discovery for XDR, making it an ideal vendor for consolidation in China.
-
Firewall deployment models:H3C offers a complete firewall product line, including hardware firewalls, virtual firewalls, FWaaS, containerized firewalls, and industrial firewalls. As a result, it is a good choice for enterprises seeking to consolidate different firewall deployment models from a single vendor.
-
Pricing:Compared with many other vendors, H3C’s pricing gives it a good five-year TCO. Support pricing is reasonable, at only 10% of list price. Some features (such as DLP) come at no extra charge.
-
Platforms supporting cloud firewalls:H3C provides cloud firewalls for VMware and H3C cloud environments, but lacks support for regional cloud providers such as Alibaba and Huawei. It also lacks support for AWS, Microsoft Azure and Google Cloud Platform (GCP). H3C offers a container firewall, but it requires NGINX for enforcement.
-
Regional support:H3C’s firewalls rely on partnerships with regional vendors for VPN authentication and EDR integration. H3C provides granular social media controls mainly for local applications such as WeChat and QQ, with limited support for applications such as Microsoft Office 365.
-
Centralized management:Compared with H3C’s direct competitors, the firewall central manager scales to manage only a limited number of devices. The platform lacks support for zero-touch provisioning of branch firewalls.
-
Geographic presence:The majority of H3C’s sales are concentrated in the Chinese market and a few areas in Southeast Asia. It lacks presence in other regions.
Hillstone Networks
Hillstone Networks is a Visionary in this Magic Quadrant. It is well suited to midsize enterprise use cases for customers in Asia/Pacific and some Latin American customers, especially cloud-first organizations.
Hillstone’s network firewall products are part of its edge protection product family. Hillstone’s primary offering is network firewalls, but it also offers microsegmentation, endpoint and server security, WAF, application delivery controllers (ADCs), XDR and DLP.
Hillstone recently released several new hardware and virtual firewalls, as well as a virtual firewall integrated with VMware NSX-T. New features include DNS security and a cloud data lake.
-
Cloud-centric product strategy:Hillstone takes a cloud-first approach, supporting AWS, Microsoft Azure, GCP and Alibaba Cloud, as well as several Chinese public clouds. Hillstone offers a microsegmentation solution and CloudArmour, a container firewall that can operate in Kubernetes environments.
-
Advanced capabilities:Hillstone’s ZTNA capabilities are integrated into all of its network firewalls. Hillstone NGFW acts as a ZTNA gateway, and the Hillstone SSL VPN client can be upgraded to a ZTNA endpoint. Activating ZTNA capabilities requires an additional subscription license. Hillstone enforces ZTNA on the firewall.
-
IoT security:Hillstone’s IoT security can proactively detect IoT devices such as network cameras, multimedia players and game consoles. As an inclusive feature, it can provide risk analysis and control as well as threat detection for traffic associated with these IoT assets.
-
Geographic strategy:Hillstone is leveraging its strength in China to fund targeted sales opportunities in other regions. Hillstone has a small but growing number of customers in Latin America and North America.
-
Cloud security:Hillstone uses Hillstone virtual appliances to integrate with multiple public clouds, but does not offer CSPM to manage cloud-native firewall policies. It also does not manage native security controls in SDN infrastructures (such as VMware NSX and Cisco Application Centric Infrastructure (ACI)).
-
Product strategy:Hillstone’s IPS capabilities are not differentiated. Hillstone has a relatively small threat research team that develops custom rules for “in the wild” threats. Compared with most competitors, Hillstone has a small client-based application database, which limits the breadth of its Layer 7 awareness.
-
Price/performance:Although Hillstone’s firewall appliance prices may appear low, they are not low compared with many competitors. Given the traffic they can handle, the throughput of the lowest-end firewalls is very low, while the price of the data center firewalls is relatively high.
-
Customer feedback:Compared with other Chinese regional vendors in the Chinese market, Hillstone’s customers consider the lack of high-throughput and high-performance hardware appliances to be a weakness.
Huawei
Huawei is a Challenger in this Magic Quadrant. A broad product portfolio makes Huawei an ideal vendor for customers looking to consolidate. Huawei has different firewalls for different use cases. It often wins deals based on its price/performance.
Huawei is a large infrastructure vendor with a diversified product portfolio. Its firewalls include the USG series for enterprises and the Eudemon series for carriers, which are part of its network security portfolio.
Key updates related to Huawei firewalls in 2022 include enhancements to routing, SD-WAN and sandboxing capabilities.
-
Scalability:Huawei has a large carrier and data center customer base. As a result, it offers highly scalable appliances. Among all vendors evaluated in this Magic Quadrant, Huawei offers support for the most virtual firewall instances in its dedicated hardware appliance models and scalable management console.
-
Cloud-native firewall:Huawei offers a cloud-native firewall service for Huawei Cloud, and also offers a container firewall service, Container Guard Service (available only on Huawei Cloud). The container firewall provides capabilities such as container runtime security and image security with vulnerability management. It can be managed through a centralized console within Huawei Cloud.
-
Advanced threat detection:Huawei provides threat correlation across its firewalls, native EDR and XDR platforms. Customers can also leverage a managed detection and response (MDR) service offered directly by Huawei, sold under the name Qiankun Border Protection and Response.
-
Pricing:Huawei firewalls offer competitive price/performance. Their TCO is among the lowest in the market. Huawei often wins deals on this basis.
-
Regional partners:Huawei’s partners are mostly limited to Chinese companies. For example, its ZTNA offering can integrate with Zhuyun’s IAM solution, and on EDR, Huawei partners with Jiangmin and Leagsoft.
-
Products outside Huawei Cloud:Although Huawei offers virtual cloud firewalls, container firewalls and microsegmentation products, these products are primarily aimed at Huawei Cloud. Only recently did Huawei partner with Microsoft Azure to develop a cloud firewall.
-
IoT security:Huawei firewalls provide only basic IoT-related security. They lack capabilities such as IoT discovery. Huawei offers only limited signature-based protection against common IoT vulnerabilities through the IPS signature database in its firewalls.
-
ELA:Despite its broad product portfolio, Huawei does not offer ELA-based deals. An ELA would make multi-year, multi-product deals easier for customers to understand and accept.
Juniper
Juniper is a Challenger in this Magic Quadrant. It has a broad firewall product line covering many use cases and deployment types, including FWaaS and container firewalls. We typically see Juniper firewalls shortlisted alongside Juniper networking products, which limits their market penetration.
Juniper offers a wide range of products, including networking and security products. It offers appliance-based firewalls in the SRX, vSRX and cSRX product lines. It also offers FWaaS products. Other products provide security information and event management, DDoS mitigation and threat intelligence.
Recent updates include the introduction of Security Director Cloud, Secure Edge (an SSE product) and Cloud Workload Protection. Juniper also acquired cloud-based network access control products through the acquisition of WiteSand.
-
Firewall deployment use cases:Juniper’s firewall product line, the SRX series, includes hardware appliances and virtual appliances (vSRX) with native, mature SD-WAN support. FWaaS is offered with the Secure Edge product, and a fully featured containerized firewall is included in the cSRX series.
-
Platform approach:Juniper offers a single console to manage all of its security products through its Security Director and Security Director Cloud. Juniper also offers Advanced Threat Prevention and SecIntel as shared threat intelligence products across its networking and firewall product lines.
-
IoT and OT security:Juniper has demonstrated a focus on IoT security by enhancing its automated device fingerprinting and control. Partnerships with Dragos and SEL provide threat detection and response capabilities for industrial applications in OT and SCADA environments.
-
Scalability:Juniper offers high-throughput firewalls that maintain good throughput even when decrypting traffic. Junos Space Security Director and Juniper Security Director Cloud are centralized managers that can manage up to 25,000 Juniper devices, including firewalls, switches and routers.
-
Visibility:Although Juniper offers firewall products for all deployment use cases, it is not as visible on Gartner’s customer shortlists as its direct competitors. Juniper firewalls are mainly shortlisted by telecommunications carriers, or used to integrate with Juniper’s other networking product lines.
-
Market responsiveness:The network security market is highly competitive, and competition among vendors to define key emerging use cases such as FWaaS, ZTNA, cloud security, SSE and security operations is intense. Although Juniper is a large networking vendor, it has been slow to identify such use cases and launch products for them.
-
Product strategy:Compared with direct competitors that are aggressively expanding their security product offerings, Juniper lacks a strong in-house security portfolio. As a result, Gartner customers do not consider it an ideal candidate for security vendor consolidation.
-
Customer feedback:Gartner customers cite slow response times and a lack of innovation in emerging security use cases as reasons for not shortlisting Juniper. They also find its pricing high relative to competitors. SD-WAN and DLP capabilities are available, but require an additional fee.
Microsoft
Microsoft is a Niche Player in this Magic Quadrant. Existing Microsoft customers seeking consolidation mainly consider its Azure Firewall. Application teams seeking a native firewall to integrate seamlessly with Azure workloads also prefer Microsoft Azure Firewall.
Microsoft Azure Firewall is available in two subscriptions: Standard and Premium. It can be centrally managed by Azure Firewall Manager and monitored using Azure Monitor and Microsoft Sentinel.
Microsoft continues to invest in security, as evidenced by the addition of DDoS management to Azure Firewall Manager and WAF policies to Azure Firewall Manager. In addition, Microsoft has added IPS to its Premium subscription.
-
Vendor consolidation:Existing Microsoft customers that want to consolidate onto a single vendor widely consider Microsoft firewalls. Microsoft offers a range of security services, including Azure Firewall, Azure Web Application Firewall and Azure Active Directory, that can be deployed together.
-
Ease of use:Microsoft Azure Firewall integrates seamlessly with other Azure managed services. It is simpler to deploy than third-party firewalls because it is an inline product with built-in sizing and scaling capabilities.
-
Sales execution:Microsoft capitalizes on customers’ opportunities to move workloads to Azure by offering a simple firewall that meets basic needs. Gartner sees customers considering Azure Firewall for Azure workloads, and this Microsoft product frequently competes with offerings from dedicated firewall vendors.
-
Customer experience:Users cite ease of deployment as the main reason for using Microsoft Azure Firewall. An important secondary reason is its tight integration with the Azure ecosystem, which helps DevOps. Customers also appreciate Microsoft’s credibility as a vendor and its support for the product.
-
Innovation:Microsoft focuses on integrating Azure Firewall with native Azure products, but it lags in delivering features that support emerging cloud firewall use cases. It lacks a dedicated container firewall product. Microsegmentation is handled through security tags rather than a firewall product.
-
Feature gaps:Microsoft Azure Firewall lacks several capabilities that a cloud firewall requires and that competitors provide. It does not support IPv6, offers no sandbox, and has no signature-based application control.
-
Performance:When IPS with TLS is enabled, network traffic throughput drops by 90%. Microsoft does, however, offer an option to manually add sites to a list in order to bypass TLS decryption.
-
Customer feedback:Customers report that the premium firewall subscription is expensive, that documentation quality is poor, that training materials are lacking, and that logging offers insufficient support for troubleshooting.
Palo Alto Networks
Palo Alto Networks is a Leader in this Magic Quadrant. Based on Gartner client inquiries, it has the most clearly defined firewall offering for a range of firewall use cases. With the recent launch of the PA-400 Series, Palo Alto Networks firewalls have become a solid choice for midsize enterprises.
Palo Alto Networks is a security vendor with a large product portfolio. Beyond its most popular firewall line, the PA Series, the vendor also offers SSE, cloud security, and security operations product lines.
Key firewall-related updates over the past year include the release of two major firmware versions that enhanced URL filtering, DNS security, IoT security, and threat prevention. The vendor also introduced AIOps and enhanced the DLP capabilities of its firewalls.
-
Product portfolio:Palo Alto Networks has a vast product portfolio. Gartner frequently sees this vendor contracted for multiple product lines alongside its firewalls. Prisma Access (SASE) and Cortex Data Lake (XDR) are often shortlisted together with the firewalls.
-
Deployment models:Palo Alto Networks supports many forms of firewall deployment, including the PA Series (hardware firewalls), VM Series (virtual firewalls), Prisma Access (FWaaS), Cloud NGFW (AWS cloud-native firewall), and the CN Series (containerized firewalls). This makes it an ideal choice for hybrid environments where customers want a single firewall provider.
-
Advanced security features:Palo Alto Networks firewalls score highly on advanced security features. The vendor delivers strong threat detection and prevention capabilities. Its IoT security subscription provides automatic discovery of IoT devices. Palo Alto Networks also offers advanced DNS security and 5G security capabilities.
-
FWaaS:Prisma Access, Palo Alto Networks’ FWaaS offering, continues to mature and supports the full set of SSE capabilities, including Secure Web Gateway (SWG), CASB, and ZTNA. It can be managed as a plug-in to Panorama (an on-premises centralized manager) or as a standalone cloud-based management product.
-
Technical support:Gartner receives consistent feedback from Palo Alto Networks clients indicating a decline in technical support quality, particularly long escalation cycles associated with Level 1 support. As a result, clients often feel compelled to escalate their support to a higher tier for a faster SLA, at a higher price.
-
Cloud-based manager:Palo Alto Networks’ cloud-based firewall manager for distributed office and centralized management use cases is on par with on-premises management. Its cloud-based manager is used primarily with the Prisma Access product line and “4th generation” hardware models.
-
Customer feedback:Some Gartner clients have reported connectivity and routing issues with the Prisma Access service. This feedback comes in particular from users of its FWaaS and Prisma Access GlobalProtect services (as it relates to the firewall client).
-
Lack of transparency in ELA contracts:Palo Alto Networks offers several types of licenses, such as ELAs and credit-based licenses, but its quotes often lack transparency. Most include volume-based pricing and lack clarity on line-item part numbers and line-item costs.
Sangfor Technologies
Sangfor Technologies is a Visionary in this Magic Quadrant. This China-based vendor is attractive to enterprises in Asia/Pacific and in Europe, the Middle East and Africa (particularly the Middle East) that want to consolidate their security products with a single vendor.
Sangfor’s network firewall products all belong to its Next-Generation Application Firewall (NGAF) product line, which also includes WAF functionality. Beyond network firewalls, Sangfor offers a broad range of security products for WAAP, SASE, ZTNA, IAM, endpoint security, microsegmentation, and cloud workload protection.
Sangfor has recently released several new hardware firewall appliances. New features include cloud deception subscriptions to improve attack detection. Sangfor also offers network firewalls that are fully integrated with its ZTNA and SASE offerings.
-
Platform approach:Sangfor builds products that can be managed together. Its Platform-X cloud management platform can manage Sangfor’s network firewalls, Endpoint Secure, and microsegmentation solutions, as well as Sangfor’s SWG and SD-WAN capabilities.
-
IoT security:As part of its base license package, Sangfor provides differentiated IoT signatures, including support for IP camera protocols. Sangfor supports IoT asset classification, access control, protocol identification and control, weak password detection, and monitoring-based detection of IoT vulnerabilities on the network.
-
Scalability:Sangfor Central Manager, the vendor’s on-premises centralized management appliance, is highly scalable. A large number of devices can be managed from a single console.
-
Pricing strategy:As a vendor with many large customers, Sangfor uses its ELA as a strategic packaging vehicle. It typically offers substantial discounts, flexible virtual firewall deployment terms, and new product additions over the ELA term, with adjustments made at renewal.
-
Advanced networking:Sangfor firewalls lack 5G support. This is a significant shortcoming for customers in China, several other Asia/Pacific countries and parts of the Middle East, where 5G infrastructure is largely concentrated.
-
Public cloud integration:Sangfor lacks integration with the Microsoft Azure and GCP public clouds that are popular in many regions.
-
Threat detection:Sangfor has fewer IPS signatures than the other firewall vendors evaluated in this Magic Quadrant, and it does not combine IPS with machine learning analysis to improve detection effectiveness. In addition, Sangfor lacks integrations with third-party tools to improve malware detection.
-
Geographic strategy:Sangfor has little presence outside Asia and the Middle East. Other regional competitors evaluated in this Magic Quadrant are more often considered and deployed in Latin America.
SonicWall
SonicWall is a Niche Player in this Magic Quadrant. It is a strong candidate for midsize enterprises, because it delivers strong security and represents good value. Its native SD-WAN capabilities with FWaaS make it a good fit for distributed office and remote access use cases.
SonicWall offers three hardware appliance firewall product lines — the TZ, NSa and NSsp series — as well as the NSv series of virtual appliance firewalls. Beyond firewalls, SonicWall also sells integrated EDR, secure email gateway, ZTNA and CASB capabilities.
Recent updates include enhancements to the centralized manager, including rule optimization and SD-WAN workflows that simplify branch firewall configuration. SonicWall has also introduced centralized management for SonicWall switches, SonicWave wireless access points and SonicWall Capture Client.
-
Distributed office use cases:SonicWall delivers native SD-WAN capabilities across all of its firewall models and in SonicWall Network Security Manager. It also offers Cloud Edge Secure Access, a SASE offering with the FWaaS, ZTNA, network access control and CASB capabilities required for distributed office use cases.
-
Pricing:SonicWall offers competitive pricing, which makes it a good choice for midsize enterprises. SD-WAN capabilities are included in all of its appliances at no extra cost. DLP capabilities are part of the base package, also at no additional charge.
-
Customer feedback:Customers appreciate SonicWall’s single management interface for managing different SonicWall products. In addition, they cite low TCO as a reason for choosing SonicWall firewalls.
-
Centralized management:SonicWall’s Capture Security Center (CSC) is the “single pane of glass” management portal for SonicWall products, including its firewalls and Cloud Edge Secure Access offerings. It simplifies management.
-
Visibility:Gartner observes SonicWall primarily on the firewall shortlists of midsize enterprises. It lacks visibility in other use cases, particularly distributed office use cases (despite its native SD-WAN capabilities and FWaaS offerings) and data center use cases.
-
Product capabilities:SonicWall supports only a limited number of virtual instances on its hardware appliances (suited to data center use cases). It supports fewer web application categories than other vendors evaluated in this Magic Quadrant. SonicWall lacks a native XDR offering; instead, it provides integrations with third-party XDR platforms.
-
Cloud firewalls:SonicWall’s public cloud support lags behind other vendors in this Magic Quadrant, covering only AWS and Microsoft Azure; GCP is not supported. Azure does not offer a pay-as-you-go option. SonicWall lacks container firewall and microsegmentation offerings.
-
Customer feedback:SonicWall customers say that the reporting capabilities of the firewall products are limited and lack granularity. They have also experienced long delays after contacting technical support.
Sophos
Sophos is a Niche Player in this Magic Quadrant. Its product strategy and platform-based approach focus on the needs of midsize enterprises, delivering strong integration between firewall and EDR. Sophos is gradually expanding its cloud security portfolio.
Sophos offers network security, endpoint security, cloud security and MDR products. Its firewall products sit across different product lines. Sophos’ firewall and Intercept X endpoint security products are its most popular offerings.
Key firewall-related updates over the past year include the launch of the Sophos XGS series of hardware firewalls, along with the introduction of the Sophos ZTNA offering and new software subscriptions. Sophos has also improved XGS performance and enhanced SD-WAN orchestration.
-
Platform approach:Sophos offers its firewall, EDR and XDR as a unified platform with strong integration, centralized management and correlation capabilities. It provides a single cloud console with a single endpoint agent to manage both products.
-
Midsize enterprise use cases:Sophos’ strategy and sales execution focus on midsize enterprises. In addition to integrating firewall and EDR capabilities, Sophos has launched managed threat response and rapid response services for customers seeking outsourced MDR services.
-
Cloud-based centralized manager:Sophos provides a single cloud-based centralized manager to manage all of its products. This makes management easier.
-
Customer feedback:Customers frequently cite Sophos’ customer support and mature product documentation as key strengths. Sophos has introduced context-sensitive help, guided tutorials and embedded how-to videos to further improve the product management experience.
-
Visibility:Sophos is typically visible to midsize enterprises, but is less commonly used in other firewall use cases. Although Sophos offers a separate product for ZTNA and a cloud firewall that includes a container firewall.
-
ELA:Although Sophos has a broad product portfolio, it does not offer ELA pricing, even though customers seeking to consolidate products from a single vendor would like it to. Instead, Sophos offers a simpler multiyear consumption model.
-
Features:Sophos does not offer FWaaS, even though FWaaS is ideal for use cases involving branch offices and roaming users. Its firewalls also lack support for 5G, while they do support SD-WAN.
-
Customer feedback:As competition among vendors in the midsize enterprise market intensifies, some Gartner clients find Sophos to be expensive compared with other vendors that sell to midsize enterprises.
WatchGuard
WatchGuard is a Niche Player in this Magic Quadrant. It offers firewalls for midsize enterprise and distributed enterprise use cases. In addition to the Firebox firewall, WatchGuard also offers a virtual appliance (FireboxV) and a virtual appliance designed specifically for public cloud environments (Firebox Cloud).
WatchGuard Dimension is the vendor’s on-premises firewall management solution. All WatchGuard security products can be managed through its cloud-based console, WatchGuard Cloud. Other products in the WatchGuard security portfolio provide multifactor authentication (MFA), secure Wi-Fi and endpoint security.
WatchGuard recently released several new firewall hardware appliances. Examples of new capabilities include the integration of Firebox with WatchGuard’s MFA and secure Wi-Fi products, and load-sharing capabilities for SD-WAN functionality on the vendor’s firewalls.
-
Product strategy:Over the past several years, WatchGuard has shifted from a traditional value-added reseller (VAR)-based go-to-market strategy to a strategy centered on managed service providers (MSPs). This renewed focus has enabled the vendor to make WatchGuard Cloud service-provider-friendly and easy to use, while also scaling across each service provider’s multiple end-user customers.
-
Endpoint integration:WatchGuard’s Firebox firewalls are managed together with its endpoint security products. The vendor has a process called ThreatSync that collects event data from WatchGuard firewalls, endpoint sensors and threat intelligence feeds, analyzes the collective data and assigns threat scores.
-
OT security:WatchGuard has ruggedized network firewalls that are sometimes used in certain manufacturing and utility environments. The vendor also includes SCADA signatures in its Basic Security Suite and Total Security Suite feature packs.
-
Pricing strategy:Under the FlexPay licensing model, WatchGuard offers the option to purchase firewalls using prepaid, WatchGuard credits or WatchGuard pay-as-you-go, which is unique in a traditional capex-based firewall appliance market.
-
IaaS security:WatchGuard has public cloud-friendly firewalls only for AWS and Microsoft Azure. In this regard, it lags behind most competitors, which typically support three or more infrastructure as a service (IaaS) providers. The lack of GCP support limits WatchGuard’s opportunity to serve “born-in-the-cloud” midsize enterprises, which sometimes choose Google as their infrastructure provider.
-
FWaaS and ZTNA:Many small and midsize Gartner clients ask about FWaaS as an alternative to traditional branch office firewalls. However, WatchGuard does not offer FWaaS. It also lacks a ZTNA offering.
-
Product strategy:WatchGuard lacks offerings for emerging cloud security use cases, such as containerized firewalls and microsegmentation. As a result, it lacks visibility in Gartner’s shortlists, except among midsize organizations seeking hardware firewalls.
-
Advanced networking:As of this analysis, WatchGuard does not offer any 5G-capable firewalls. This limits its adoption in many regions that have already established extensive 5G infrastructure.
Vendors Added and Dropped
As the market changes, we review and adjust the inclusion criteria for the Magic Quadrant. As a result of these adjustments, the mix of vendors in any Magic Quadrant may change over time. A vendor appearing in a Magic Quadrant one year and not the next does not necessarily indicate that we have changed our view of that vendor. It may reflect a change in the market and therefore a change in the evaluation criteria, or a change in the vendor’s focus.
Added
None.
Dropped
-
Cato Networks
-
Versa Networks
Inclusion and Exclusion Criteria
The inclusion criteria represent the specific attributes that Gartner analysts believe a vendor must have to be included in this Magic Quadrant.
Network firewall feature vendors covered in the Market Definition/Description section were considered for evaluation in this Magic Quadrant under the following conditions:
-
Vendors must deliver hardware/virtual appliances or cloud-native firewalls as their primary firewall offering.
-
Vendors must operate in at least three of the following regions, including their own: Asia/Pacific, North America, Latin America, Europe and the Middle East.
-
Vendors that provide hardware/virtual appliances as their primary firewall offering must have generated at least US$70 million in revenue from hardware/virtual appliance-only firewalls in 2021.
-
Vendors must have a track record of meeting the requirements of public cloud use cases.
-
Gartner analysts must have assessed the vendor as able to compete effectively in the network firewall market.
-
Gartner analysts must have determined that these vendors are significant players in the network firewall market because of their market presence, competitive visibility or technical innovation.
-
Vendors must be able to address multiple network firewall deployment use cases referenced in the market definition/description.
-
Public cloud vendors must offer a dedicated firewall offering.
Exclusion criteria:
-
Gartner does not consider vendors that offer FWaaS as their primary firewall product line eligible for inclusion in this Magic Quadrant.
Evaluation Criteria
Ability to Execute
Gartner analysts evaluate vendors on the quality and efficacy of the processes, systems, methods or procedures that enable vendor performance to be competitive, efficient and effective, and to positively impact revenue, retention and reputation. The following criteria are used to assess vendors’ Ability to Execute.
Product or Service:Core goods and services offered by the vendor for the defined market. This includes current product/service capabilities, quality, feature sets and skills, whether offered natively or through OEM agreements/partnerships as defined in the market definition and detailed in the subcriteria.
Subcriteria:
-
Products address and focus on different network firewall use cases.
-
Platform approach.
-
Support is assessed on the quality, breadth and value of the offering as it relates specifically to enterprise and cloud use cases.
Overall Viability:
Viability includes an assessment of the overall organization’s financial health, the financial and practical success of the business unit, and the likelihood that the individual business unit will continue investing in the product, will continue offering the product and will advance the state of the art within the organization’s portfolio of products.
Sales Execution/Pricing:The vendor’s capabilities in all presales activities and the structure that supports them. This includes deal management, pricing and negotiation, presales support, and the overall effectiveness of the sales channel.
Subcriteria:
-
Customer feedback on pricing.
-
Transparency of contracts.
-
BClear and easy-to-understand pricing models.
-
Competitive total cost of ownership.
-
Strong pre- and post-sales support and services.
Market Responsiveness/Record:The ability to respond, change direction, be flexible and achieve competitive success as opportunities develop, competitors act, customer needs evolve and market dynamics change. This criterion also considers the vendor’s history of responsiveness.
Subcriteria:
-
Timely delivery of new features that meet customer needs.
-
Ability to support emerging use cases such as SASE, cloud security and IoT security.
-
Timely partner integrations that support customer needs.
Marketing Execution:The clarity, quality, creativity and efficacy of programs designed to deliver the organization’s message to influence the market, promote the brand and business, increase awareness of the products, and establish a positive identification with the product/brand and organization in the minds of buyers. This “mind share” can be driven by a combination of publicity, promotional initiatives, thought leadership, word of mouth and sales activities.
Subcriteria:
-
Visibility of the vendor on customer shortlists.
-
The extent to which end users migrate away from the vendor.
-
The extent to which the vendor’s marketing faces direct competition.
-
End users’ awareness of the vendor’s brand.
Customer Experience:The relationships, products and services/programs that enable clients to be successful with the products evaluated. Specifically, this includes the ways customers receive technical support or account support. This can also include ancillary tools, customer support programs (and the quality thereof), availability of user groups, service-level agreements, and so on.
The most important factor is customer satisfaction throughout the entire sales and product life cycle. Equally important are ease of use, platform approach, centralized management and protection against the latest attacks.Trending feedback (positive or negative) about the vendor’s product or supportalso carriessignificant weight.
Operations:The ability of the organization to meet its goals and commitments. Factors include the quality of the organizational structure, including skills, experiences, programs, systems and other vehicles that enable the organization to operate effectively and efficiently on an ongoing basis.
Completeness of Vision
Gartner analysts evaluate whether vendors have the ability to convincingly articulate logical statements about the market’s current and future direction, innovation, customer needs and competitive forces. They assess how well these statements align with Gartner’s view of the market.
Market Understanding:A vendor’s ability to understand buyer requirements and translate them into products and services. Vendors with the highest vision listen to and understand buyer requirements, and can shape or enhance those requirements through their vision.
Sub-criteria:
-
Ability to understand and add capabilities that meet customers’ needs across different use cases.
-
Ability to understand and respond to customers’ product- and market-related requirements.
-
Ability to meet the timelines set out in customer requirements.
-
Support for hybrid environments and different firewall deployment use cases, platform approaches, centralized management and visibility, cloud security, cloud workload protection, and automation.
Marketing Strategy:A set of clear, differentiated messages that are communicated consistently throughout the organization and made concrete through websites, advertising, customer programs, and positioning statements.
Sub-criteria:
-
Ability to deliver clear messages that resonate with customers’ use cases and requirements.
-
Ability to communicate effectively with sales and distribution channels, end users, and different types of buyers about capabilities, product firmware, and vision, with a focus on evolving use cases, in order to build the brand.
-
Strong, clear messaging about evolving use cases.
Sales Strategy:A strategy for selling products that leverages the appropriate direct and indirect sales, marketing, service, and communication affiliate networks to expand market reach and depth, skills, expertise, technology, services, and customer base.
Sub-criteria:
-
Effective sales and pricing models that meet customers’ requirements across different deployment use cases.
-
Clear and transparent pricing models.
-
A comprehensive channel and partner strategy that can sell into multiple deployment use cases.
-
An approach to the network security and/or cloud workload buying center.
Offering (Product) Strategy:A vendor’s approach to product development and delivery, emphasizing differentiation, capabilities, approach, and feature sets to meet current and future requirements.
Sub-criteria:
-
Development of robust capabilities to enhance threat defense.
-
Integrated capabilities and automation rather than a broad portfolio of overlapping products.
-
Robust capabilities and implementation that support all network firewall use cases.
-
Mature product integrations with partners that enhance network firewall capabilities for environments such as OT, branch/campus, cloud security, and work-from-home users.
Business Model:The soundness and logic of a vendor’s underlying business proposition.
Vertical/Industry Strategy:A vendor’s strategy for directing resources, skills, and products to meet the specific needs of various market segments, including vertical markets.
Innovation:Direct, related, complementary, and synergistic deployment of resources, expertise, or capital for investment, consolidation, defensive, or preemptive purposes.
Sub-criteria:
-
Platform approach.
-
Strong vision and superior capabilities for specific firewall deployment use cases.
-
Capability maturity.
-
Integration with overlapping products.
-
Use of technology to detect and prevent threats.
-
Superior, differentiated capabilities and innovation that support one or more network firewall use cases.
Geographic Strategy:A vendor’s strategy for directing resources, skills, and products, whether directly or through partners, channels, and subsidiaries suited to that geography and market, to meet specific needs beyond its “home” or local geography.
Table 2: Completeness of the Vision Evaluation Criteria
| Evaluation Criteria | Weighting |
|---|---|
|
Market Understanding
|
High
|
|
Market Strategy
|
Medium
|
|
Sales Strategy
|
Medium
|
|
Offering (Product) Strategy
|
High
|
|
Business Model
|
Medium
|
|
Vertical/Industry Strategy
|
No Rating
|
|
Innovation
|
High
|
|
Geographic Strategy
|
Medium
|
Source: Gartner (December 2022)
Quadrant Descriptions
Leaders
The Leaders quadrant comprises vendors that shape the market by being first to introduce additional capabilities and by raising awareness of their importance. Leaders have the potential to address enterprise requirements for multiple firewall use cases within a single platform solution.
Leaders deliver new capabilities that protect customers from emerging threats. They meet the requirements of evolving hybrid networks, including public and private clouds. They provide expert capabilities rather than treating firewalls as commodities. They have a strong track record of avoiding vulnerabilities in their security products.
Leaders offer innovative capabilities that simplify the configuration and management of firewall policies in hybrid environments. They can typically handle the highest throughput with minimal performance loss. In addition, they usually offer hardware acceleration options, support for private and public cloud platforms, and form factors that protect enterprises as they move to new infrastructure form factors. Leaders deliver the first features and capabilities that provide deep support for emerging firewall use cases. They take an integrated platform approach rather than offering multiple distinct product lines for different use cases without integration.
Beyond providing technology that is well suited to customers’ current needs, Leaders also demonstrate exceptional vision and execution for potential future requirements and the evolution of hybrid networks.
Challengers
Challengers have sound reseller channels and customers, but they do not consistently lead with differentiated next-generation capabilities. Many Challengers’ firewall capabilities are not yet fully mature. They may have other security products that have succeeded in the enterprise space, and they may rely on existing customer relationships rather than their firewall products to win deals.
Challengers’ products are usually reasonably priced, and because of strong execution these vendors can offer economical security product bundles that many other vendors cannot.
Many Challengers prevent themselves from becoming Leaders by giving security or firewall products a lower priority within their overall product portfolio.
Challengers often hold significant market share, but they may lag behind competitors with smaller share when releasing new capabilities.
Visionaries
Visionaries lead in innovation, but only in one or two firewall deployment use cases. They have the right design and capabilities, but lack the sales foundation, strategy, or financial means to compete consistently with Leaders and Challengers. At times, Visionaries make a conscious decision to focus on a limited number of firewall use cases. Most Visionaries’ products offer good next-generation firewall capabilities, but fall short in performance and support networks.
Visionaries demonstrate strong vision and market-leading innovation in areas such as securing work-from-home users, securing workloads, delivering east-west segmentation in public cloud and software-defined networking environments, and automating threat detection.
Niche Players
Most Niche Players have a leading installed base or prominence in a specific use case, such as those involving data centers, telecommunications companies, distributed enterprises, midsize enterprises, and public IaaS. Some Niche Players that offer firewalls as a module alongside other services or components focus on particular use cases.
Because of their limited customer base, Niche Players lack execution capability and often show little innovation. Some are limited to specific regions.
Context
As networks evolve, network firewall vendors continue to expand their portfolios to cover overlapping security markets and attract buyers seeking consolidation. However, buying from the same vendor does not necessarily guarantee simplicity and centralized management.
Appliance-based firewalls remain relevant for a variety of firewall use cases. Hardware appliance refresh remains fairly steady. Demand for high-throughput hardware firewalls, particularly for data center and enterprise perimeter use cases.
Demand for FWaaS is growing for remote use cases, whether they involve branch offices or homes. Here too, consolidation is evident, and SSE that combines CASB, ZTNA, and SWG capabilities is increasingly in demand. Branch offices with high-throughput requirements or compliance constraints continue to choose hardware appliances for branch use cases. (Standalone FWaaS vendors do not appear in this year’s Magic Quadrant because demand for their products is not sufficient to warrant inclusion.)
Driven by strong demand for cloud firewalls (cloud-native firewalls and container firewalls), vendors innovating for cloud security use cases are gaining traction. We have therefore included cloud service providers in this Magic Quadrant.
Sales execution/pricing carries significant weight because of consistent customer feedback on its importance and frequent increases in network firewall prices. More complex contracts, higher renewal costs, and a higher total cost of ownership are causing customer dissatisfaction.
Market Overview
The network firewall market remains one of the largest security markets and has consistently evolved along with the broader security market. As a result, a number of factors now drive the network firewall market.
The rise of hybrid environments is a key factor behind vendors introducing multiple firewall deployment types, such as FWaaS and cloud-native. Demand is growing to use firewalls to protect on-premises environments, multiple cloud environments, and remote users.
Interest in zero trust favors choosing a single firewall vendor that can help enterprises implement ZTNA, so they do not have to work with multiple vendors. Customers expect mature integration capabilities when buying overlapping technologies from the same vendor.
There is strong interest in visibility into and control over east-west segmentation policies, as well as enhanced security operations integration.
Advanced security capabilities remain a key driver, as threat actors use more sophisticated methods to attack hybrid workforces and cloud networks. Most vendors are trying to develop or acquire products that deliver these capabilities, but they face intense competition from the best vendors offering granular capabilities for that specific use case.
The network firewall market has evolved to include the following segments, each with a specific set of capabilities:
-
Cloud firewalls:These firewalls from cloud infrastructure vendors are designed as standalone virtual instances or cloud-native deployments in containers. Container firewalls can also secure connections between containers.
-
Hybrid mesh firewalls:These platforms extend modern network firewall controls to multiple enforcement points (including FWaaS and cloud firewalls) and are managed centrally through a single cloud-based manager, helping to secure hybrid environments.
-
Firewall as a Service (FWaaS):FWaaS is a versatile security gateway delivered as a cloud-based service, typically used to protect small branch offices and mobile users.
Other important observations about this market:
-
Customers continue to give negative feedback on rising prices for network firewall products. Only regional providers appear to offer simple and competitive pricing. Other providers continue to raise prices on a regular basis.
-
Advanced threat detection and prevention remains an important shortlisting criterion. Network firewall providers have been steadily enhancing their capabilities in this area, mainly strengthening features related to IoT security and DNS security.
-
More providers have launched cloud firewall offerings, although these products vary in maturity. Container firewalls are still offered by only a small number of providers.
-
Providers may prioritize introducing FWaaS offerings, but more providers are introducing ZTNA and/or SWG first.
-
Although providers claim strong integration between their network firewalls and other overlapping product lines, Gartner finds these integrations to be very basic.
-
Data center network firewall providers continue to introduce higher-performance firewalls.
-
All firewall providers evaluated in this Magic Quadrant offer native SD-WAN capabilities in their firewall appliances.
-
As midsize enterprises increasingly become hybrid-environment organizations, their need for mature security is driving increased security budgets. As a result, the midsize enterprise firewall use case appears to be growing, and more providers are introducing appliances and bundled licenses to attract these enterprises. Competition to win business is now intense.
Evaluation Criteria Definitions
Ability to Execute
Product/Service:The core goods and services that a provider offers to a specific market. This includes current product/service capabilities, quality, feature sets, skills, and so on, whether offered natively or through OEM agreements/partnerships as defined in the market definition and detailed in the subcriteria.
Overall Viability:Viability includes an assessment of the overall organization’s financial health, the financial and practical success of the business unit, and the likelihood that the individual business unit will continue to invest in the product, continue offering the product and advance the state of the art within the organization’s portfolio of products.
Sales Execution/Pricing:The provider’s capabilities in all presales activities and the structure that supports them. This includes deal management, pricing and negotiation, presales support, and the overall effectiveness of the sales channel.
Market Responsiveness/Record:The ability to respond, change direction, be flexible and achieve competitive success as opportunities develop, competitors act, customer needs evolve and market dynamics change. This criterion also considers the provider’s history of responsiveness.
Marketing Execution:The clarity, quality, creativity and efficacy of programs designed to deliver the organization’s message to influence the market, promote the brand and business, increase awareness of the products, and establish a positive identification with the product/brand and organization in the minds of buyers. This “mind share” can be driven by a combination of publicity, promotional initiatives, thought leadership, word of mouth and sales activities.
Customer Experience:The relationships, products and services/programs that enable clients to be successful with the products evaluated. Specifically, this includes the ways customers receive technical support or account support. This can also include ancillary tools, customer support programs (and the quality thereof), availability of user groups, service-level agreements, and so on.
Operations:The ability of the organization to meet its goals and commitments. Factors include the quality of the organizational structure, including skills, experiences, programs, systems and other vehicles that enable the organization to operate effectively and efficiently on an ongoing basis.
Completeness of Vision
Market Understanding:The ability of the provider to understand buyers’ needs and translate these into products and services. Providers with the highest degree of vision listen to and understand buyers’ wants and needs, and can shape or enhance those with their added vision.
Marketing Strategy:A clear, differentiated set of messages consistently communicated throughout the organization and externalized through the website, advertising, customer programs and positioning statements.
Sales Strategy:The strategy for selling products that uses the appropriate network of direct and indirect sales, marketing, service and communication affiliates that extend the scope and depth of market reach, skills, expertise, technologies, services and the customer base.
Offering (Product) Strategy:The provider’s approach to product development and delivery that emphasizes differentiation, functionality, methodology and feature sets as they map to current and future requirements.
Business Model:The soundness and logic of the provider’s underlying business proposition.
Vertical/Industry Strategy:The provider’s strategy to direct resources, skills and offerings to meet the specific needs of individual market segments, including vertical markets.
Innovation:Direct, related, complementary and synergistic layouts of resources, expertise or capital for investment, consolidation, defensive or preemptive purposes.
Geographic Strategy:The provider’s strategy to direct resources, skills and offerings to meet the specific needs of geographies outside the “home” or native geography, either directly or through partners, channels and subsidiaries as appropriate for that geography and market.
(Source: https://www.gartner.com/)
