Security effectiveness ranges from 0% to 99.95%.
Austin, Texas, USA, September 29th / PRNewswire / -- A non-profit organization dedicated to providing confidence in cybersecurity products and services through independent testing, CyberRatings.org ( CyberRatings ), today announced the results of its latest evaluation of cloud network firewalls ( CNFW ). The testing was conducted by NSS Labs and can now be obtained for free on the CyberRatings.org website.
Among the 9 products under testing, only 4 received a "Recommended" rating; the performance of native cloud firewalls is far less stable than that of specialized third-party products. All products that received a "Recommended" rating achieved a security effectiveness of 99.7% or higher:
- Fortinet FortiGate Next - Generation Firewall
- HPE Juniper Networking vSRX Next Generation Firewall
- Palo Alto Networks VM - Series Next - Generation Firewall
- Versa Networks Next Generation Firewall
The security and effectiveness of Check Point CloudGuard Network Security Next to Gen Firewall is the highest, reaching 99.95%, but due to the price of Mbps being higher than the average level, it has received a "neutral" rating.
The security effectiveness of AWS Network Firewall and Microsoft Azure Firewall is both 0%, hence they have been rated as "Cautious". The security effectiveness of Google Cloud Platform ( GCP ) NGFW Enterprise is 77.45%, and that of Cisco Secure Firewall Threat Defense Virtual is 66.10%; they have also been rated as "Cautious".
The products of cloud service providers, as well as those of third-party security vendors (the latter deployed on Amazon Web Services), are evaluated under the same conditions. The evaluation utilizes NSS Labs Cloud Network Firewall Test Methodology and v4.1. The test content includes real-world vulnerability exploitation, evasion techniques, malware, false positive samples, and continuous enterprise-level traffic loads.
The evasion tests covered 5,004 attacks, involving 43 techniques from the 3rd, 4th, and 7th layers of OSI. Attackers use these evasion methods to disguise malicious traffic and bypass detection; a single successful evasion can allow an entire class of vulnerabilities or malware to succeed, therefore a strong evasion handling capability is crucial.
CyberRatings.org CEO Vikram Phatak stated: "Attackers often use evasion techniques to bypass detection, and the products that received a 'Recommended' rating this year have proven their ability to withstand tests under real-world conditions. Buyers should regard the evasion resistance capability as equally important as the TLS detection rate and the original interception rate."
Advice for Buyers
- Regular testing. Agile development and CI / CD pipelines enable manufacturers to quickly introduce improvements, but rapid changes can also introduce regressions, subtly weakening the protective capabilities.
- Consider the native cloud firewall as a baseline, not an end goal. Before using the native product as the primary control measure, it is necessary to verify its capabilities in intercepting vulnerabilities, malware, and resisting bypass attempts based on the organization's requirements.
- It is required to detect TLS and to attach great importance to the ability to evade resistance. Firewalls that are unable to inspect encrypted traffic will leave obvious blind spots, and a single successful evasion could allow an entire class of attacks to succeed.
- Re-evaluate the firewall requirements for workloads targeting AI and agentic. The local AI model and agentic workflows will consume more network resources and will require more complex policies, including east-west agent-to-agent traffic.
- Manufacturers are required to take responsibility and increase transparency. No product is perfect; the key lies in how manufacturers respond when they discover shortcomings. A lack of transparency should be regarded as a warning sign.
NSS Labs is an official testing partner of CyberRatings, generating test results and reports for the publications of CyberRatings. When testing the cloud network firewall, the proprietary technology of NSS Labs as well as the CyPerf tool from Keysight were used to assess security, performance, TLS functionality, and stability.
Cloud network firewall test reports, comparison reports, and security maps can be obtained at CyberRatings.org.
About CyberRatings.org
CyberRatings.org is a 501(c)(6) non-profit organization dedicated to providing confidence in cybersecurity products and services through research and testing projects. We offer independent and objective security product efficacy ratings to help businesses make informed decisions. To become a member, please visit www.cyberratings.org and follow us on LinkedIn.
