IT AI Index
September 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index Network and edge September 2026 Edition

Next-generation firewalls

Asked as “next-generation firewall”, and as “enterprise firewall appliance or virtual firewall”, on behalf of a mid-market B2B company. 46 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Clear leader
61% of first choices, clear leader.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a mid-market B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Fortinet FortiGate61%8%38endorsed leader
02Fortinet9%26%19criticized challenger
03Palo Alto Networks2%29%31criticized challenger
04Check Point2%9%23accepted challenger
05Sophos Firewall2%0%13accepted challenger
06SonicWall2%50%16criticized challenger
Show the four products at 0%, ordered by negative rate
10Cisco0%18%11accepted challenger
07Cisco Secure Firewall0%11%18accepted challenger
09Sophos0%10%10accepted challenger
08WatchGuard Firebox0%10%10accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

One product takes 61% of first choices here, so the chart would put nine markers in one corner and one at the far edge. The two measurements it plots are columns in the standing above: share, and the negative label rate. Three products carry a negative rate above 25% in this category. Jump to the standing

02What they warned about

Seven of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Mistral Small and GLM 4.7 FlashX changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
SonicWall
50%
8 of 16 labels negative · 8 of 12 models · 2 hard negative
“Critical SSL-VPN vulnerabilities (CVE-2024-40766, CVE-2024-53704) with CVSS scores up to 9.3 ... Consider disabling SSL-VPN if not essential” Kimi K2, negative prompt
Palo Alto Networks
29%
9 of 31 labels negative · 7 of 12 models
“Earned "Caution" in NSS Labs 2025 (lowest security effectiveness at 46.37%, failed critical network/transport-layer evasions)” Grok 4.1 Fast, negative prompt
Fortinet
26%
5 of 19 labels negative · 5 of 12 models · 1 hard negative
“20+ CVEs on CISA's Known Exploited Vulnerabilities catalog — among the highest for any firewall vendor ... Fortinet and SonicWall currently require the most aggressive hardening” Kimi K2, negative prompt
Fortinet FortiGate
8%
3 of 38 labels negative · 3 of 12 models
“Older models of Fortigate, Palo Alto, and other NGFW devices can become security liabilities if not regularly updated.” Mistral Small, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

64 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 812 links across 236 sites, every framing counted. Ranked by the number of answers carrying the site or page.

32 answers · 35 citations · 10 models
29 answers · 30 citations · 10 models
28 answers · 30 citations · 10 models
vendor site · Fortinet23 answers · 34 citations · 10 models
vendor site · Check Point20 answers · 26 citations · 9 models
17 answers · 24 citations · 8 models
vendor site · Palo Alto Networks14 answers · 27 citations · 8 models
14 answers · 16 citations · 8 models
13 answers · 17 citations · 7 models
13 answers · 13 citations · 8 models
vendor site · Cisco12 answers · 16 citations · 8 models
12 answers · 12 citations · 7 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best next-generation firewall for a mid-market B2B company?”Paraphrase“Which enterprise firewall appliance or virtual firewall would you recommend to a mid-sized B2B company?”Comparative“What are the top next-generation firewalls and how do they differ?”Budget-constrained“What is the best next-generation firewall for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a next-generation firewall. What should we look at?”Negative“Which next-generation firewalls should I avoid or be cautious about?”
Claude Haiku 4.5Fortinet FortiGate
One alternativePalo Alto Networks PA-Series
Fortinet FortiGate, Sophos FirewallChanged
Two alternativesCisco Meraki MX85-HW, WatchGuard
Palo Alto Networks
Three alternativesCheck Point, Cisco Secure Firewall, Fortinet FortiGate
Fortinet FortiGate
Two alternativesSonicWall, Sophos XG
no first choiceagainst: AWS Network Firewall, Arista Edge Threat Management, Azure Firewall, Fortinet, Palo Alto Networks, SonicWall
GPT-5.4 miniPalo Alto Networks
Two alternativesCheck Point, Fortinet
Check PointChanged
Four alternativesFortinet, Juniper, Palo Alto Networks, Versa
Palo Alto Networks
Four alternativesCheck Point Quantum, Cisco Secure Firewall, Fortinet FortiGate, Juniper SRX
Fortinet FortiGate
One alternativeSonicWall
against: Palo Alto Cloud NGFW
no first choicenothing named
Gemini 3.5 FlashFortinet FortiGate
Two alternativesPalo Alto Networks, Sophos Firewall
FortinetChanged
Two alternativesPalo Alto Networks, Sophos Firewall
Palo Alto Networks
Three alternativesCheck Point, Cisco, Fortinet
Fortinet FortiGate
Four alternativesOPNsense, Sophos XGS Series, Ubiquiti UniFi, Zenarmor
against: Cisco, Palo Alto Networks
Fortinet
One alternativeSophos
against: Check Point, Palo Alto Networks
against: AWS Network Firewall, Cisco Secure Firewall, D-Link, DrayTek, Fortinet, Google Cloud Firewall, Huawei, Kaspersky, Microsoft Azure Firewall, Netgear, Palo Alto Networks, SonicWall, Sophos, TP-Link, ZTE
Perplexity SonarFortinet FortiGate
Three alternativesCheck Point Quantum, Palo Alto Networks PA-Series, Sophos Firewall XGS
Fortinet FortiGateHeld
Four alternativesCheck Point, Palo Alto Networks PA-Series, SonicWall, Sophos Firewall
Palo Alto Networks
Four alternativesCheck Point Quantum, Cisco Secure Firewall, Fortinet FortiGate, Sophos Firewall
Fortinet FortiGate
Three alternativesSonicWall TZ, WatchGuard Firebox, pfSense
no first choicenothing named
Grok 4.1 FastFortinet FortiGate
Four alternativesCisco Secure Firewall, Palo Alto PA-Series, Sophos Firewall, WatchGuard Firebox
Fortinet FortiGateHeld
Two alternativesPalo Alto Networks PA-1400 Series or VM-Series, Sophos XGS Series
against: WatchGuard Firebox
Fortinet, Palo Alto Networks
Three alternativesCheck Point, Cisco, Sophos
Fortinet FortiGate
Four alternativesSonicWall TZ270, Sophos Firewall XGS 87, WatchGuard Firebox T45, pfSense/OPNsense
Fortinet FortiGate
Two alternativesCisco Secure Firewall, Palo Alto Networks
against: AWS/GCP/Azure, Cisco Firepower, Fortinet FortiGate, Palo Alto Networks, SonicWall
Mistral SmallFortinet FortiGate
Two alternativesPalo Alto Networks, Sophos
FortinetChanged
One alternativePalo Alto Networks
Palo Alto Networks Security NGFW
Five alternativesBarracuda CloudGen Firewall, Check Point NGFW, Cisco Secure Firewall, Fortinet FortiGate NGFW, Sophos Firewall
SonicWall TZ Series, WatchGuard Firebox T45
One alternativeSophos XGS 87
no first choiceagainst: Cisco ASA and FTD Firewalls, Fortinet FortiGate, Palo Alto Networks NGFWs
DeepSeek V4 FlashFortinet FortiGate
Five alternativesCheck Point, Cisco Secure Firewall, Palo Alto Networks, Sophos XGS, WatchGuard Firebox
Fortinet FortiGateHeld
Five alternativesCheck Point, Cisco Firepower, Cisco Meraki SD-WAN, Palo Alto Networks, WatchGuard Firebox
Fortinet FortiGate, Palo Alto Networks
Three alternativesCheck Point Quantum, Cisco Secure Firewall, Sophos Firewall
Fortinet FortiGate
Three alternativesSonicWall TZ Series, Sophos Firewall, pfSense/OPNsense
Fortinet FortiGate
Two alternativesCisco Secure Firewall, WatchGuard
against: Palo Alto Networks
against: Arista NG Firewall, Cisco Firepower, Forcepoint, Fortinet, Hillstone, Huawei, Sangfor, SonicWall
Llama 4 MaverickFortinet FortiGate
Two alternativesPalo Alto Networks PA-Series, Sophos Firewall
Fortinet FortiGateHeld
Two alternativesPalo Alto Networks, WatchGuard
Palo Alto Networks PA-Series
Four alternativesCheck Point Quantum, Cisco Secure Firewall, Fortinet FortiGate, Juniper SRX
SonicWall, Untangle NG Firewall
Three alternativesFirewalla Purple SE, Fortinet FortiGate 40F Hardware, WatchGuard Firebox
no first choicenothing named
Qwen 3.7 FlashFortinet FortiGate
Two alternativesCisco Security Firewall, Palo Alto Networks
Fortinet FortiGateHeld
Three alternativesCisco Meraki, Palo Alto Networks, Sophos Intercept X Firewall
Palo Alto Networks
Four alternativesCheck Point, Cisco Secure Firewall, Fortinet, Sophos
Fortinet
One alternativeSonicWall
against: Untangle NG Firewall
no first choice
Four alternativesCheck Point, Cisco, Fortinet, Sophos
against: Palo Alto Networks
against: Alcatel-Lucent, Check Point Gaia/CNS, Cisco ASA, F5 Advanced WAF, Fortinet FG-200/FG-100 Legacy Series, Imperva Incapsula, SonicWall, Sophos XGS, Ubiquiti EdgeSwitch/Firewall
Kimi K2Fortinet FortiGate
Three alternativesPalo Alto Networks PA-Series, SonicWall NSa Series, WatchGuard Firebox
Fortinet FortiGateHeld
Two alternativesPalo Alto Networks VM-Series, SonicWall NSa Series
Palo Alto Networks PA-Series
Three alternativesCheck Point Quantum, Cisco Secure Firewall, Fortinet FortiGate
Fortinet FortiGate 40F/60F, SonicWall TZ Series
Three alternativesOPNsense, WatchGuard Firebox, pfSense
Fortinet FortiGate
Two alternativesCheck Point, Palo Alto Networks
against: Check Point, Cisco, Fortinet, Palo Alto Networks, SonicWall
GLM 4.7 FlashXFortinet FortiGate
Three alternativesCisco Secure Firewall, Palo Alto Networks PA-Series, Sophos XGS
against: SonicWall TZ Series
FortiGate\u2011VM, Fortinet FortiGate 60FChanged
Three alternativesCheck Point Harmony SASE, Fortinet FortiSASE, WatchGuard Firebox
against: Sophos XGS
Fortinet, Palo Alto Networks
Five alternativesCheck Point, Cisco, Huawei, Sophos, Zscaler
Ubiquiti UniFi Dream Machine
Three alternativesFortinet FortiGate 30E / 40F, SonicWall TZ370 / TZ470, WatchGuard Firebox T25
against: Cisco Meraki MX67
no first choiceagainst: Cisco Secure Firewall, Forcepoint NGFW, Fortinet FortiGate, SonicWall
MiniMax M2.5Fortinet FortiGate
Two alternativesPalo Alto Networks PA-Series, Sophos Firewall
Fortinet FortiGateHeld
Four alternativesCheck Point Quantum, Palo Alto Networks VM-Series, Sophos Firewall, WatchGuard Firebox
Palo Alto Networks
Five alternativesCato Networks, Cisco Secure Firewall, Fortinet FortiGate, Sophos Firewall, Zscaler
SonicWall TZ270, WatchGuard Firebox T45
Two alternativesFortinet FortiGate 90G, Sophos XGS 87
no first choiceagainst: Fortinet, Hillstone, Palo Alto Networks, SonicWall
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:24yes911 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:45yes37 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 13:54yes721 s
Direct recommendationPerplexity Sonarsonar2026-09-17 14:06yes187 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:31yes3518 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 14:12yes54 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 13:03yes811 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 12:32yes52 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 11:48yes523 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 10:38yes1532 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:44yes1376 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 14:01yes535 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:05yes1812 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:36yes15 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:11yes825 s
ParaphrasePerplexity Sonarsonar2026-09-17 11:43yes205 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:37yes3317 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 10:36yes95 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:40yes1418 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 10:22yes52 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 11:31no037 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 13:03yes1529 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 14:03yes1860 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:49yes528 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:21yes1711 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:09yes77 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 10:24yes1827 s
ComparativePerplexity Sonarsonar2026-09-17 10:01yes209 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:26yes2019 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 12:11yes97 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-09-17 13:07yes1943 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 10:55yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:36no039 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:11yes929 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 09:57yes2948 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:38yes519 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:11yes1810 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 13:34yes35 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 10:42yes1119 s
Budget constrainedPerplexity Sonarsonar2026-09-17 11:02yes196 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:25yes4620 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 13:02yes54 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 11:57yes1414 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 14:01yes53 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:07yes535 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 10:20yes1537 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 10:18yes15129 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:57yes526 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:46no07 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:11no011 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:45yes930 s
Scale constrainedPerplexity Sonarsonar2026-09-17 12:52yes208 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:36yes1913 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 10:23no08 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:19yes1417 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 14:14yes53 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:30yes534 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 13:04yes1529 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:18no054 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 13:52yes516 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 10:32yes189 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 12:56no02 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:46yes1926 s
Negative framingPerplexity Sonarsonar2026-09-17 10:16yes207 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:05yes4017 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 10:37yes56 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via deepinfra2026-09-17 13:54yes2567 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 09:32yes54 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 11:14no049 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:21yes2945 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 14:08yes2850 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 13:35yes1034 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
None. Every name in this category resolved on its own.
Unresolved, counted raw
Alcatel-Lucent (ALC)
Arista Edge Threat Management (NGFW)
Arista NG Firewall
Check Point Gaia/CNS
Cisco ASA (Adaptive Security Appliance)
Cisco ASA and FTD Firewalls
Cisco Meraki MX85-HW
Cisco Security Firewall
Cloud-native firewalls (AWS/Azure native)
DrayTek
Firewalla Purple SE
FortiGate\u2011VM
Fortinet FG-200/FG-100 Legacy Series
Fortinet FortiGate 30E / 40F
Fortinet FortiGate 40F Hardware
Fortinet FortiGate 40F/60F
Google Cloud Firewall
Huawei USG
Imperva Incapsula
Juniper Networks NGFW
Microsoft Azure Firewall
Palo Alto Cloud NGFW
Palo Alto Networks PA-1400 Series or VM-Series
Palo Alto Networks Security NGFW
SonicWall TZ370 / TZ470
Sophos Firewall XGS 87
Sophos Intercept X Firewall
Ubiquiti EdgeSwitch/Firewall
Discontinued, still offered
No shut-down product was recommended here.
← DDoSSASE →