# Next-generation firewalls for enterprise buyers: what AI models recommend, September 2026

IT AI Recommendation Index, September 2026 Edition. Asked as "next-generation firewall" and as "enterprise firewall appliance or virtual firewall", six framings each, to twelve models with search on, on behalf of an enterprise B2B company. Page: https://it-ai-index.com/network/next-generation-firewalls/enterprise/

**Standing:** Palo Alto Networks (tied with Fortinet FortiGate) leads with 28% of first choices; verdict contested. 53 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| # | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | Palo Alto Networks | 28% | 25% | 40 |
| 2 | Fortinet FortiGate | 28% | 11% | 28 |
| 3 | Fortinet | 11% | 4% | 28 |
| 4 | Palo Alto Networks PA-Series | 11% | 17% | 12 |
| 5 | Check Point | 0% | 9% | 32 |
| 6 | Cisco Secure Firewall | 0% | 13% | 23 |
| 7 | Cisco | 0% | 26% | 23 |

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Palo Alto Networks PA-Series; alternatives Check Point Quantum, Fortinet FortiGate
- GPT-5.4 mini: Palo Alto Networks; alternatives Fortinet
- Gemini 3.5 Flash: Fortinet, Palo Alto Networks; alternatives Check Point, Cisco
- Perplexity Sonar: Palo Alto Networks PA-Series; alternatives Check Point Quantum, Fortinet FortiGate
- Grok 4.1 Fast: Palo Alto Networks; alternatives Check Point, Cisco Secure Firewall, Fortinet
- Mistral Small: Fortinet FortiGate, Palo Alto Networks NGFW; alternatives Cisco Secure Firewall, Sophos Firewall
- DeepSeek V4 Flash: Fortinet, Palo Alto Networks; alternatives Check Point, Cisco Secure Firewall
- Llama 4 Maverick: Fortinet's FortiGate; alternatives Palo Alto Networks
- Qwen 3.7 Flash: Palo Alto Networks; alternatives Cisco, Fortinet
- Kimi K2: Fortinet FortiGate, Palo Alto Networks PA-Series; alternatives Check Point Quantum Security Gateways, Cisco Secure Firewall
- GLM 4.7 FlashX: Palo Alto Networks PA-Series; alternatives Check Point Quantum, Cisco Secure Firewall, Fortinet FortiGate
- MiniMax M2.5: Palo Alto Networks; alternatives Check Point, Cisco, Fortinet, Juniper

## Sources the answers cite

69 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- fortinet.com: 34 answers, 58 citations
- decryptiondigest.com: 32 answers, 48 citations
- checkpoint.com: 29 answers, 46 citations
- comparitech.com: 27 answers, 29 citations
- paloaltonetworks.com: 25 answers, 35 citations
- esecurityplanet.com: 25 answers, 28 citations
- cybersecuritynews.com: 24 answers, 26 citations
- cyberpress.org: 17 answers, 18 citations

Pages named in the most answers:

- https://comparitech.com/net-admin/next-gen-firewalls (26 answers)
- https://decryptiondigest.com/blog/enterprise-ngfw-comparison-2026 (25 answers)
- https://esecurityplanet.com/products/top-ngfw (25 answers)
- https://cybersecuritynews.com/best-next-generation-firewall (23 answers)
- https://checkpoint.com/comparison/top-4-ngfw-compared (16 answers)
- https://cyberpress.org/best-next-generation-firewall-ngfw-solutions-for-every-business-size (15 answers)
- https://cybervendorguide.com/guides/firewall-ngfw/enterprise-ngfw (14 answers)
- https://tech-insider.org/palo-alto-vs-fortinet-vs-check-point-2026 (14 answers)
- https://expertinsights.com/network-security/the-top-network-firewalls (13 answers)
- https://gbhackers.com/ngfw-solutions-compared-features-pricing (12 answers)

## Warned against

- Palo Alto Networks: 10 of 40 labels negative. "Researchers found commodity hardware, vulnerable software and firmware, and missing security features in Palo Alto Networks appliances" (Claude Haiku 4.5, negative prompt)
- Cisco: 6 of 23 labels negative. "Challenger | Good legacy integration, but trails leaders in advanced threat protection and cloud-native scaling" (MiniMax M2.5, paraphrase prompt)
- Check Point: 3 of 32 labels negative. "Check Point (due to significant SSL/TLS performance issues)" (GLM 4.7 FlashX, negative prompt)
- Cisco Secure Firewall: 3 of 23 labels negative. "Sales Lock-in: Pushes broad ELAs bundling non-firewall products... full NGFW lags pure-plays." (Grok 4.1 Fast, negative prompt)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.