IT AI Index
Index Network and edge Firewalls › Small business September 2026 Edition

Next-generation firewalls for small business buyers

Asked as “next-generation firewall”, and as “enterprise firewall appliance or virtual firewall”, on behalf of a small B2B company. 46 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Contested
35% of first choices, contested.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Fortinet FortiGate35%2%42endorsed leader
02WatchGuard Firebox13%0%30accepted challenger
03Sophos Firewall11%0%15accepted challenger
04Sophos XGS2%0%14accepted challenger
05SonicWall TZ Series2%33%12criticized challenger
Show the three products at 0%, ordered by negative rate
08Palo Alto Networks0%62%16criticized challenger
07SonicWall0%50%10criticized challenger
06Cisco Meraki MX0%18%11accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative50%
Key
01Fortinet FortiGate35%
02WatchGuard Firebox13%
03Sophos Firewall11%
04Sophos XGS2%
05SonicWall TZ Series2%
06Cisco Meraki MX0%
07SonicWall0%
08Palo Alto Networks0%

02What they warned about

Five of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, Perplexity Sonar, Grok 4.1 Fast, DeepSeek V4 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Palo Alto Networks
62%
10 of 16 labels negative · 7 of 12 models · 3 hard negative
“small businesses should avoid or be cautious about high-end enterprise NGFWs (like Palo Alto) unless they have the resources to manage them” Mistral Small, negative prompt
SonicWall
50%
5 of 10 labels negative · 5 of 12 models
“Older SonicWall appliances or virtual models that are in the retirement pipeline... they're a poor choice unless you're certain the lifecycle fits your replacement plan.” GPT-5.4 mini, negative prompt
Zyxel
100%
4 of 4 labels negative · 4 of 12 models · 4 hard negative
“it appears frequently in "avoid" lists within Managed Service Provider (MSP) communities” Qwen 3.7 Flash, negative prompt
Check Point
80%
4 of 5 labels negative · 4 of 12 models · 3 hard negative
“Palo Alto Networks & Check Point (The "Overkill" Risk)... Why to avoid (unless you have an MSP)” Qwen 3.7 Flash, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

63 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 5 of those lists are Google grounding redirects that name no site and are left out of the counts. 849 links across 214 sites, every framing counted. Ranked by the number of answers carrying the site or page.

35 answers · 35 citations · 10 models
32 answers · 36 citations · 10 models
vendor site · Fortinet25 answers · 36 citations · 9 models
25 answers · 25 citations · 9 models
23 answers · 41 citations · 9 models
20 answers · 26 citations · 8 models
vendor site · Cisco18 answers · 27 citations · 9 models
16 answers · 23 citations · 6 models
14 answers · 17 citations · 7 models
vendor site · InvGate14 answers · 14 citations · 8 models
13 answers · 13 citations · 7 models
12 answers · 13 citations · 6 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best next-generation firewall for a small B2B company?”Paraphrase“Which enterprise firewall appliance or virtual firewall would you recommend to a small business that sells to other businesses?”Comparative“What are the top next-generation firewalls for a small team and how do they differ?”Budget-constrained“What is the best next-generation firewall for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a next-generation firewall. What should we look at?”Negative“Which next-generation firewalls should a small business avoid or be cautious about?”
Claude Haiku 4.5no first choiceFortinet FortiGate, Sophos XGSChanged
Three alternativesCheck Point's Quantum Spark, FortiGate VM, SonicWall TZ
Sophos Firewall XGS
One alternativeFortinet FortiGate
against: Palo Alto Networks PA-Series
Fortinet FortiGate, Ubiquiti UniFi Cloud Gateway Max
Two alternativesFirewalla, Sophos Firewall XGS
no first choicenothing named
GPT-5.4 miniFortinet FortiGate
One alternativePalo Alto Networks
against: Sophos
Fortinet FortiGateHeld
Two alternativesCisco Secure Firewall Small Business Edition, Palo Alto Networks
Fortinet FortiGate
Five alternativesCisco Meraki SD-WAN, Cisco Secure Firewall, Palo Alto Networks PA-400 Series, Sophos Firewall, WatchGuard Firebox
Fortinet FortiGate
One alternativeCisco Secure Firewall 220
against: Palo Alto PA-501
no first choiceagainst: Cisco Secure Firewall / Firepower, SonicWall, WatchGuard
Gemini 3.5 FlashFortinet FortiGate
Three alternativesCisco Meraki, Palo Alto Networks, Sophos XGS
Fortinet FortiGateHeld
Two alternativesCisco Meraki, Palo Alto Networks
against: Ubiquiti
Sophos XGS Series
Four alternativesCisco Meraki MX Series, Fortinet FortiGate, Netgate / pfSense, Palo Alto Networks PA-Series
Fortinet FortiGate
Five alternativesFirewalla Gold Pro or Gold Plus, OPNsense, Sophos XGS Series, Ubiquiti UniFi, Zenarmor
against: Cisco, Palo Alto
no first choice
Four alternativesCisco Meraki, Fortinet, Palo Alto Networks, Sophos
against: Cisco Meraki, Cisco Secure Firewall, Palo Alto Networks, SonicWall TZ, Ubiquiti UniFi, Zyxel USG
Perplexity SonarSophos Firewall
Two alternativesFortinet FortiGate, WatchGuard Firebox
Fortinet FortiGateChanged
Two alternativesSophos Firewall XGS, WatchGuard Firebox
against: Palo Alto Networks PA-Series, Prisma Cloud
Sophos XGS, WatchGuard Firebox
One alternativeFortinet FortiGate
against: Palo Alto PA-Series
Fortinet FortiGate, Sophos Firewall
One alternativeWatchGuard Firebox
against: SonicWall TZ/Gen 7
no first choiceagainst: Check Point Quantum, Cisco Firepower/FTD, Palo Alto Networks, SonicWall entry-level / SOHO models, WatchGuard, Zyxel
Grok 4.1 FastSophos Firewall
Two alternativesFortinet FortiGate, WatchGuard Firebox
against: Cisco Meraki MX/Firepower 1000, SonicWall TZ
Fortinet FortiGate 60FChanged
Four alternativesCisco Meraki MX67, FortiGate VM, Palo Alto PA-410, WatchGuard Firebox T40/T85
against: pfSense
Sophos Firewall, WatchGuard Firebox
One alternativeFortinet FortiGate
against: Palo Alto Networks PA-400/440 Series, SonicWall TZ Series
pfSense Community Edition
Two alternativesOPNsense, Ubiquiti UniFi Dream Machine
against: FortiGate 30G/60F, Palo Alto, SonicWall TZ270/TZ370, Sophos
WatchGuard Firebox
Two alternativesCisco Meraki MX, Fortinet FortiGate
against: Check Point, Palo Alto PA-Series
against: Check Point NGFW, Cisco Secure Firewall, Palo Alto Networks NGFW, SonicWall Gen 7, Zyxel Firewalls
Mistral SmallWatchGuard Firebox
Two alternativesFortinet FortiGate, SonicWall TZ Series
WatchGuard FireboxHeld
Two alternativesFortinet FortiGate 40F, Sophos Firewall
Sophos Firewall, WatchGuard Firebox
One alternativeFortinet FortiGate
Sophos Firewall
Three alternativesNetgate 110, SonicWall, Ubiquiti UniFi Security Gateway
no first choice
One alternativeFortinet
against: Check Point, Palo Alto, SonicWall
against: D-Link, Fortinet FortiGate, Palo Alto Networks
DeepSeek V4 FlashWatchGuard Firebox
Three alternativesFortinet FortiGate, SonicWall, Sophos Firewall
Fortinet FortiGateChanged
Four alternativesCisco Meraki MX, Fortinet FortiGate-VM, Palo Alto PA-400 Series / Prisma Access, Sophos Firewall
Fortinet FortiGate
Four alternativesCisco Meraki MX, SonicWall TZ Series, Sophos Firewall XGS, WatchGuard Firebox
against: Palo Alto PA-400
Fortinet FortiGate
Three alternativesSonicWall TZ, Sophos XGS, Ubiquiti UniFi Cloud Gateway
WatchGuard Firebox T-series
Two alternativesFortiGate 40F/60F, Sophos XGS
against: Cisco Firepower 1010, Palo Alto PA-220
against: Cisco Meraki MX, Palo Alto Networks, SonicWall, Ubiquiti/UniFi firewalls, Zyxel
Llama 4 MaverickWatchGuard Firebox
Two alternativesFortinet FortiGate, SonicWall Gen 7
WatchGuard FireboxHeld
One alternativeSophos Firewall
WatchGuard Firebox
Five alternativesBarracuda CloudGen Firewall, Check Point Harmony SASE, Cisco Firepower 1000 Series, SonicWall Firewall, Sophos XGS Series
SonicWall Gen 7
Four alternativesBarracuda CloudGen Firewall, Netgate 110, Ubiquiti UniFi Security Gateway, WatchGuard
no first choicenothing named
Qwen 3.7 FlashFortinet FortiGate
Two alternativesSophos XGS, WatchGuard Firebox
against: Cisco Meraki MX
Fortinet FortiGateHeld
Three alternativesOPNsense, Sophos XGS, pfSense
against: Asus, Palo Alto Networks, TP-Link
Cisco Meraki MX
Three alternativesFortinet FortiGate, Sophos Firewall XGS, WatchGuard Firebox
Ubiquiti, WatchGuard
Three alternativesOPNsense, SonicWall, pfSense
Sophos, WatchGuard
One alternativeFortinet
against: Palo Alto Networks
against: Check Point, Cisco Meraki MX Series, Netgear, Palo Alto Networks, SonicWall, Ubiquiti, Zyxel
Kimi K2Sophos Firewall
Two alternativesFortinet FortiGate, WatchGuard Firebox
Fortinet FortiGate 60FChanged
One alternativeSophos XGS Series
against: Palo Alto Networks PA-400 Series, SonicWall TZ Series, pfSense
Sophos Firewall, WatchGuard Firebox
Two alternativesFortinet FortiGate, SonicWall TZ Series
SonicWall TZ Series
Two alternativesFortinet FortiGate, Sophos Firewall
Fortinet FortiGate
Two alternativesCisco Meraki MX, Sophos XGS
against: Cisco ASA 5505/5506, Cisco Meraki MX Series, Palo Alto Networks PA-400 Series, Palo Alto PA-200/PA-220, SonicWall TZ205, WatchGuard Firewalls, pfSense/OPNsense
GLM 4.7 FlashXFortinet FortiGate 40F
Three alternativesCisco Meraki MX, Sophos Firewall XGS, WatchGuard Firebox
against: Palo Alto Networks PA-Series, SonicWall TZ Series
Fortinet FortiGateChanged
Three alternativesCheck Point Harmony SASE, SonicWall TZ Series, WatchGuard Firebox
Sophos Firewall, WatchGuard Firebox
Six alternativesCato Networks Network Firewall, Check Point Harmony SASE, Cisco Meraki MX, Fortinet FortiGate, SonicWall TZ Series, pfSense/OPNsense
Netgate 1100
One alternativeSonicWall TZ 270
against: Ubiquiti UniFi Security Gateway
no first choice
Four alternativesCisco Meraki MX, Fortinet FortiGate, Sophos XGS, WatchGuard
against: Palo Alto Networks, SonicWall TZ Series
against: Check Point, Cisco ASA Series, Fortinet, Palo Alto Networks, SonicWall
MiniMax M2.5no first choiceFortinet FortiGate 90G, Fortinet FortiGate Virtual ApplianceChanged
One alternativeWatchGuard Firebox T45
against: Palo Alto Networks VM-Series
Fortinet FortiGate
Five alternativesCisco Meraki MX Series, Palo Alto Networks PA-400, SonicWall TZ Series, Sophos XGS Series, WatchGuard Firebox
Fortinet FortiGate 70G, SonicWall TZ270
One alternativeWatchGuard Firebox T45
Fortinet
Three alternativesCisco Meraki, SonicWall, Sophos
against: Palo Alto Networks
against: Cisco Meraki, SonicWALL SOHO, Sophos, WatchGuard, Zyxel
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:39no05 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:34yes37 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 14:10yes2223 s
Direct recommendationPerplexity Sonarsonar2026-09-17 10:24yes176 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:44yes2717 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 12:15yes55 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 11:30yes811 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 14:09yes53 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 14:00yes529 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 10:12yes821 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 13:39yes31153 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 12:19no049 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:12yes1611 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 10:36yes57 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:18yes1520 s
ParaphrasePerplexity Sonarsonar2026-09-17 10:15yes187 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:26yes3620 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 10:57yes56 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 13:35yes2126 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:51yes52 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:21no042 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 10:48yes2972 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:05yes1733 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 13:21yes5109 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 10:51yes97 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 13:00yes36 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:25yes1926 s
ComparativePerplexity Sonarsonar2026-09-17 11:42yes168 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:11yes2416 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 11:15yes56 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 13:39yes1631 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 13:42yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 10:22yes1042 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 09:58yes829 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 12:06yes1763 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 10:51yes1944 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 13:20yes97 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 11:42yes45 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 11:11yes1724 s
Budget constrainedPerplexity Sonarsonar2026-09-17 09:30yes2010 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:35yes4018 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 11:25yes53 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 12:16yes1622 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:29yes52 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 12:31no038 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 12:21yes822 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 11:49yes30229 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:18yes524 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 09:51no07 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 11:09no06 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:05no015 s
Scale constrainedPerplexity Sonarsonar2026-09-17 12:42yes2014 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 13:19yes1813 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 11:12no09 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 09:37yes2923 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 09:51yes52 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 13:27no040 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 10:22yes1037 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 09:30yes15102 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 11:46yes520 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 11:38yes187 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 09:36yes47 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 12:30yes1626 s
Negative framingPerplexity Sonarsonar2026-09-17 12:48yes208 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 12:53yes4019 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 11:31yes55 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 10:24yes2727 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 11:10yes53 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 11:59yes1556 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 10:58yes2540 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 09:26yes29145 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 13:28yes1967 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
None. Every name in this category resolved on its own.
Unresolved, counted raw
Asus
Cato Networks Network Firewall
Check Point's Quantum Spark
Cisco ASA 5505/5506
Cisco ASA Series
Cisco Firepower 1000 Series
Cisco Firepower 1010
Cisco Firepower Virtual (FMCv)
Cisco Firepower/FTD
Cisco Meraki MX/Firepower 1000
Cisco Meraki vMX
Cisco Secure Firewall 220
Cisco Secure Firewall Small Business Edition
Firewalla
Firewalla Gold Pro or Gold Plus
FortiGate 30G/60F
FortiGate 40F/60F
Fortinet FortiGate 70G
Fortinet FortiGate Virtual Appliance
Netgate / pfSense
Netgate 1100
Palo Alto Networks PA-400
Palo Alto Networks PA-400/440 Series
Palo Alto PA-200/PA-220
Palo Alto PA-220
Palo Alto PA-400
Palo Alto PA-400 Series / Prisma Access
Palo Alto PA-410
Palo Alto PA-501
Protectli Vault
SonicWALL SOHO
SonicWall Firewall
SonicWall Gen 7 / TZ series
SonicWall TZ/Gen 7
SonicWall TZ205
SonicWall TZ270/TZ370
SonicWall entry-level / SOHO models
Sophos XGS Virtual
Ubiquiti UniFi Cloud Gateway
Ubiquiti UniFi Cloud Gateway Max
Ubiquiti/UniFi firewalls (UDM, USG, etc.)
WatchGuard Firebox T-series
WatchGuard Firebox T40/T85
WatchGuard FireboxV
WatchGuard Firewalls
Zyxel Firewalls (e.g., USG FLEX, ZyWALL)
Zyxel USG
pfSense Community Edition (CE)
Discontinued, still offered
No shut-down product was recommended here.
← DDoSSASE →