IT AI Index
September 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index Network and edge Firewalls › Enterprise September 2026 Edition

Next-generation firewalls for enterprise buyers

Asked as “next-generation firewall”, and as “enterprise firewall appliance or virtual firewall”, on behalf of an enterprise B2B company. 53 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Contested
28% of first choices, contested.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Palo Alto Networks28%25%40criticized challenger
02Fortinet FortiGate28%11%28accepted challenger
03Fortinet11%4%28accepted challenger
04Palo Alto Networks PA-Series11%17%12accepted challenger
Show the three products at 0%, ordered by negative rate
07Cisco0%26%23criticized challenger
06Cisco Secure Firewall0%13%23accepted challenger
05Check Point0%9%32accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative40%
Key
01Palo Alto Networks28%
02Fortinet FortiGate28%
03Fortinet11%
04Palo Alto Networks PA-Series11%
05Check Point0%
06Cisco Secure Firewall0%
07Cisco0%

02What they warned about

One of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Palo Alto Networks
25%
10 of 40 labels negative · 7 of 12 models
“Researchers found commodity hardware, vulnerable software and firmware, and missing security features in Palo Alto Networks appliances” Claude Haiku 4.5, negative prompt
Cisco
26%
6 of 23 labels negative · 5 of 12 models
“Challenger | Good legacy integration, but trails leaders in advanced threat protection and cloud-native scaling” MiniMax M2.5, paraphrase prompt
Check Point
9%
3 of 32 labels negative · 3 of 12 models · 1 hard negative
“Check Point (due to significant SSL/TLS performance issues)” GLM 4.7 FlashX, negative prompt
Cisco Secure Firewall
13%
3 of 23 labels negative · 3 of 12 models
“Sales Lock-in: Pushes broad ELAs bundling non-firewall products... full NGFW lags pure-plays.” Grok 4.1 Fast, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

69 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 938 links across 250 sites, every framing counted. Ranked by the number of answers carrying the site or page.

vendor site · Fortinet34 answers · 58 citations · 10 models
32 answers · 48 citations · 10 models
vendor site · Check Point29 answers · 46 citations · 10 models
27 answers · 29 citations · 9 models
vendor site · Palo Alto Networks25 answers · 35 citations · 11 models
25 answers · 28 citations · 10 models
24 answers · 26 citations · 9 models
17 answers · 18 citations · 8 models
17 answers · 18 citations · 8 models
16 answers · 16 citations · 9 models
13 answers · 18 citations · 7 models
13 answers · 16 citations · 6 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best next-generation firewall for an enterprise B2B company?”Paraphrase“Which enterprise firewall appliance or virtual firewall would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade next-generation firewalls and how do they differ?”Budget-constrained“What is the best next-generation firewall for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a next-generation firewall. What should we look at?”Negative“Which next-generation firewalls should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5Palo Alto Networks PA-Series
Two alternativesCheck Point Quantum, Fortinet FortiGate
Fortinet FortiGate, Palo Alto Networks StrataChangedFortinet FortiGate, Palo Alto Networks PA-Series
Three alternativesCheck Point Quantum, Cisco Secure Firewall, Sophos Firewall
Fortinet FortiGateagainst: Palo Alto Networksno first choiceagainst: AWS Network Firewall, Azure Firewall, Cisco, Citrix, Fortinet, Palo Alto Networks
GPT-5.4 miniPalo Alto Networks
One alternativeFortinet
Fortinet, Palo Alto NetworksChanged
One alternativeCheck Point Quantum Force
Palo Alto Networks
Four alternativesCheck Point Quantum, Cisco Secure Firewall, Fortinet FortiGate, Juniper SRX
Fortinet FortiGate
One alternativePalo Alto Networks NGFW
no first choiceagainst: Cisco firewall platforms / Firepower / ASA-family deployments, Fortinet FortiGate, Ivanti, Palo Alto Networks PAN-OS, SonicWall firewalls
Gemini 3.5 FlashFortinet, Palo Alto Networks
Two alternativesCheck Point, Cisco
Palo Alto NetworksChanged
Two alternativesCheck Point, Fortinet
Palo Alto Networks
Three alternativesCheck Point Software, Cisco, Fortinet
Fortinet FortiGate
One alternativeCato Networks
against: Palo Alto Networks
Palo Alto Networks
Two alternativesCisco, Fortinet
against: AWS Network Firewall, Azure Firewall, Cisco Meraki, Cisco Secure Firewall, Juniper, SonicWall, Sophos
Perplexity SonarPalo Alto Networks PA-Series
Two alternativesCheck Point Quantum, Fortinet FortiGate
Fortinet FortiGateChanged
Four alternativesCheck Point NGFW, Cisco Secure Firewall 4200, Juniper SRX Series, Palo Alto Networks
Palo Alto Networks PA-Series
Three alternativesCheck Point Quantum, Cisco Secure Firewall, Fortinet FortiGate
against: Sophos XGS
Fortinet FortiGate
One alternativePalo Alto
no first choiceagainst: Cloudflare One, Hillstone, Huawei, Untangle, WatchGuard, Zscaler
Grok 4.1 FastPalo Alto Networks
Three alternativesCheck Point, Cisco Secure Firewall, Fortinet
Palo Alto Networks PA-7000 Series, Palo Alto Networks VM-SeriesChanged
Two alternativesCisco Secure Firewall 4200 Series, Fortinet FortiGate 3000F/3200F Series
against: Fortinet FortiGate-VM
Palo Alto Networks PA-Series
Three alternativesCheck Point Quantum, Cisco Secure Firewall, Fortinet FortiGate
Fortinet FortiGate
Two alternativesCheck Point Quantum, Cisco Secure Firewall
against: Palo Alto Networks
Fortinet FortiGate, Palo Alto Networks
One alternativeCisco Secure Firewall
against: Barracuda CloudGen, Check Point Quantum Force NGFW, Cisco Secure Firewall, Fortinet FortiGate, Huawei NGFW, OPNsense, pfSense
Mistral SmallFortinet FortiGate, Palo Alto Networks NGFW
Two alternativesCisco Secure Firewall, Sophos Firewall
Cisco Secure Firewall 4200 Series, Palo Alto Networks PA-SeriesChanged
Two alternativesFortiGate NGFW, Zscaler Firewall-as-a-Service
Palo Alto Networks
Four alternativesBarracuda CloudGen Firewall, Check Point, Cisco, Fortinet
Fortinet FortiGate
One alternativePalo Alto Networks PA-Series
no first choiceagainst: Cisco ASA and FTD, Palo Alto Networks NGFWs
DeepSeek V4 FlashFortinet, Palo Alto Networks
Two alternativesCheck Point, Cisco Secure Firewall
Palo Alto NetworksChanged
Three alternativesCheck Point Maestro, Cisco Secure Firewall, Fortinet FortiGate
Palo Alto Networks
Three alternativesCheck Point Quantum, Cisco Secure Firewall, Fortinet FortiGate
Fortinet FortiGate
Four alternativesCato Networks, Cloudflare, Fortinet FortiSASE, Zscaler
against: Palo Alto Networks
Palo Alto Networks
Three alternativesCheck Point, Cisco, Fortinet
against: Check Point, Cisco Secure Firewall, Fortinet FortiGate, Huawei NGFW, Palo Alto Networks, Sophos Firewall, WatchGuard Firebox
Llama 4 MaverickFortinet's FortiGate
One alternativePalo Alto Networks
Cisco Secure Firewall 4200 SeriesChanged
Two alternativesFortinet, Palo Alto Networks
no first choicePalo Alto Networks PA-Series
Two alternativesCheck Point Quantum 6700, Fortinet FortiGate 600F
Fortinet FortiGate, Palo Alto Networks NGFW
Three alternativesCisco Firepower, Cisco Secure Firewall, Sophos Firewall
nothing named
Qwen 3.7 FlashPalo Alto Networks
Two alternativesCisco, Fortinet
Palo Alto NetworksHeld
One alternativeFortinet
Palo Alto Networks
Three alternativesCheck Point, Cisco, Fortinet
Fortinet
One alternativeCheck Point
against: Cisco, Palo Alto Networks
Palo Alto Networks
Three alternativesCheck Point, Cisco, Fortinet
against: Barracuda, Cisco, Huawei, Juniper Networks, Palo Alto Networks, SonicWall, Sophos, WatchGuard, ZTE
Kimi K2Fortinet FortiGate, Palo Alto Networks PA-Series
Two alternativesCheck Point Quantum Security Gateways, Cisco Secure Firewall
Palo Alto Networks PA-Series / VM-SeriesChanged
Two alternativesCisco Secure Firewall 4200 Series, Fortinet FortiGate 6000/7000 Series
Palo Alto Networks
Three alternativesCheck Point, Cisco Secure Firewall, Fortinet
Fortinet FortiGate
Two alternativesFortinet FortiSASE, Palo Alto Networks Prisma Access
against: Palo Alto Networks PA-Series
Fortinet, Palo Alto Networks
One alternativeCheck Point
against: Cisco, Ivanti, Palo Alto Networks
GLM 4.7 FlashXPalo Alto Networks PA-Series
Three alternativesCheck Point Quantum, Cisco Secure Firewall, Fortinet FortiGate
Palo Alto Networks PA-7000 SeriesChanged
Two alternativesCisco Secure Firewall 4200 Series, Fortinet FortiGate 7000F series
Fortinet, Palo Alto Networks
Two alternativesCheck Point, Cisco Secure Firewall
Fortinet FortiGate
One alternativeCheck Point
against: Cisco, Palo Alto Networks
no first choiceagainst: Check Point, Forcepoint, Fortinet FortiGate NGFW, Palo Alto Networks PA-Series
MiniMax M2.5Palo Alto Networks
Four alternativesCheck Point, Cisco, Fortinet, Juniper
FortinetChanged
Two alternativesCheck Point, Palo Alto Networks
against: Cisco, Juniper Networks
Fortinet FortiGate, Palo Alto Networks
Three alternativesBarracuda CloudGen Firewall, Check Point, Cisco Secure Firewall
Fortinet FortiSASE
One alternativeFortiGate
against: Check Point, Palo Alto Networks Prisma Access, Zscaler
no first choicenothing named
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 09:41yes98 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:40yes36 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 13:39yes1819 s
Direct recommendationPerplexity Sonarsonar2026-09-17 11:39yes185 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 10:35yes3118 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 13:15yes54 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:29yes1013 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 09:51yes53 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 09:49yes531 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 13:53yes1528 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 11:17yes27164 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 14:06yes554 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:40yes98 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:23yes36 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 14:00yes1524 s
ParaphrasePerplexity Sonarsonar2026-09-17 09:54yes205 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:26yes4120 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 12:01yes96 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:55yes1014 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 12:50yes53 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 12:22yes541 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:38yes1425 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 14:14yes1543 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:26yes571 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:25yes1611 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:29yes68 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 09:34yes2023 s
ComparativePerplexity Sonarsonar2026-09-17 13:47yes207 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:05yes2716 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 10:04yes2013 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 13:57yes1726 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:49yes52 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:16no038 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 11:33yes1044 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 11:08yes10139 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 13:54yes925 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:55yes1810 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:32yes35 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 13:46yes1828 s
Budget constrainedPerplexity Sonarsonar2026-09-17 12:50yes207 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:06yes3518 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 12:35yes54 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:35yes1722 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:05yes54 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:05yes870 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 13:18yes1027 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:35yes1268 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:52yes2385 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:54yes1710 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 13:06yes49 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 14:06yes1126 s
Scale constrainedPerplexity Sonarsonar2026-09-17 13:21yes207 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 09:33yes2014 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 13:22no010 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 13:51yes4053 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:31yes54 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:44no041 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 10:07yes3056 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:08yes3072 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:07yes1443 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 12:26yes2515 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 11:40yes57 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:12yes2625 s
Negative framingPerplexity Sonarsonar2026-09-17 13:58yes207 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 11:53yes2413 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 12:15yes56 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:44yes2551 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 14:11yes104 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:19yes17122 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 14:09yes2756 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 09:58yes28210 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:05yes742 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
None. Every name in this category resolved on its own.
Unresolved, counted raw
Check Point Maestro (Hyperscale)
Check Point Quantum 6700
Check Point Quantum Force
Check Point Quantum Force NGFW
Check Point Quantum Security Gateways
Check Point Software
Cisco ASA and FTD
Cisco Secure Firewall 4200
Cisco firewall platforms / Firepower / ASA-family deployments
FortiGate NGFW
FortiManager
Fortinet FortiGate 3000F/3200F Series
Fortinet FortiGate 6000/7000 Series
Fortinet FortiGate 600F
Fortinet FortiGate 7000F series
Fortinet's FortiGate
Google Cloud's *Cloud NGFW Enterprise*
Juniper (HPE) SRX
Juniper SRX Series
Microsoft Entra Secure Access
Neocarrier's Managed Firewall
Palo Alto Networks PA-Series / VM-Series
Palo Alto Networks PAN-OS
Palo Alto Networks Strata
Panorama
SonicWall firewalls
Sourcefire 8290
Zscaler Firewall-as-a-Service (FWaaS)
Discontinued, still offered
No shut-down product was recommended here.
← DDoSSASE →