Firewalls and the Attack Chain: 5 Vendors Compared

Where does a firewall actually stop an attack?

A firewall can act on six of the seven attack chain stages, and the differences between vendors concentrate in two: delivery and lateral movement. A cyberattack is not one event. It is a sequence: the attacker finds you, gets something in, runs it, installs it, calls home, spreads sideways, then takes what they came for. A firewall does not defend all seven stages equally, and no vendor's marketing will tell you which stages it is weak at. This article maps Sophos XGS features to each stage of the attack chain, then compares how Palo Alto, Fortinet, Cisco, and pfSense handle the same stages. The short version: every commercial platform covers the early stages well, the differences show up at lateral movement, and the gap between commercial and open source is widest at delivery, because of encrypted traffic.

What are the seven stages of the attack chain?

The seven stages are reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. A firewall can act on six of them. Weaponisation happens entirely on the attacker's own infrastructure, so no network device sees it.

We use the Lockheed Martin Cyber Kill Chain here because it is the model most security teams already know. What matters for this article is which stages sit in front of the firewall and which do not.

Stage	What the attacker is doing	What a firewall can do
1. Reconnaissance	Scanning your public IPs, mapping exposed services	Hide the attack surface, block scans, geo-restrict
2. Weaponisation	Building the payload, off your network	Nothing. This happens on their side.
3. Delivery	Sending it, usually over HTTPS or email	Inspect encrypted traffic, filter web and DNS
4. Exploitation	Triggering a vulnerability	Intrusion prevention, deep packet inspection
5. Installation	Dropping the payload on the host	Sandbox unknown files, machine-learning file analysis
6. Command and control	Beaconing out for instructions	Detect C2 traffic, block malicious domains
7. Lateral movement and exfiltration	Spreading internally, stealing data	Isolate the compromised host, segment, inspect outbound

Stage 2 is the one nobody can defend at the network edge. Stages 3 and 7 are where platforms genuinely differ, and they are the two worth spending time on.

Why does encrypted traffic break most firewall defences?

Cloudflare Radar put human web traffic at 98.6% HTTPS in mid-2026, and Google's Transparency Report puts Chrome page loads at around 99%. If your firewall cannot decrypt and inspect TLS, then your intrusion prevention, your antivirus, and your web filtering are all inspecting an envelope they cannot open. Attackers use the same encrypted channels as everyone else, which is why inspecting them matters. (Figures vary by what is counted: Cloudflare measures requests, Google measures page loads, and W3Techs measures websites, which reports a lower figure of roughly 90%.)

Sophos designed the XGS hardware around this specific problem. The appliances use a dual-processor architecture: a general CPU plus a dedicated Xstream Flow Processor that offloads trusted traffic, leaving headroom for the traffic that actually needs decrypting. One consequence is worth knowing before you buy, because it is counterintuitive: TLS inspection capacity does not track firewall throughput. The desktop XGS 128 publishes 1,450 Mbps of TLS inspection, while the rackmount XGS 2100 publishes 1,100 Mbps, despite the 2100 having far higher raw firewall throughput at 30 Gbps against 19.1 Gbps. If encrypted inspection is your constraint rather than raw volume, size on the TLS number, not the headline.

This matters more than any throughput headline. A firewall rated at 20 Gbps that drops to a crawl with TLS inspection enabled is a 20 Gbps firewall you will end up running with inspection off.

The second layer at delivery: NDR without decryption

TLS inspection is not the only way to find something hidden in encrypted traffic. Sophos includes Network Detection and Response (NDR) in the firewall, which applies AI analysis to traffic patterns rather than payloads, so it can flag suspicious flows without decrypting them at all. That matters for the traffic you deliberately exclude from inspection, such as banking or health portals, where decryption is either prohibited or unwise.

Sophos states this is the only firewall with integrated AI-powered NDR, and that it is included at no extra cost rather than sold as a separate product. Treat the "only" as a vendor claim rather than an independent finding, but the practical point stands: on the other four platforms, network detection at this level is either a separate product, a separate appliance, or absent. It is worth asking any vendor directly whether NDR is included or extra.

Which Sophos XGS features cover each attack stage?

Sophos XGS has features addressing six of the seven stages, and the threat features listed below are all part of the Xstream Protection bundle rather than separate purchases. Stage 2, weaponisation, happens on the attacker's own systems, so no firewall touches it. The table below maps each feature to the stage it defends.

Stage	Sophos XGS feature	Bundle
Reconnaissance	Firewall rules, geo-IP restriction, IPS scan detection	Base
Delivery	Xstream TLS 1.3 inspection, web protection, application control, DNS Protection	Xstream
Exploitation	Next-gen IPS, streaming deep packet inspection engine	Xstream
Installation	Real-time cloud sandboxing and deep-learning file analysis via SophosLabs Intelix	Xstream
Command and control	Advanced Threat Protection, integrated NDR, Sophos X-Ops threat feeds, DNS Protection	Xstream
Lateral movement	Lateral Movement Protection, Security Heartbeat, Synchronized Security	Xstream
Exfiltration	Active Threat Response, automatic host isolation, outbound inspection	Xstream

How does Sophos stop lateral movement?

Most firewalls treat an internal host as trusted once traffic is inside the perimeter. Sophos does not. The XGS maintains a Security Heartbeat with Sophos endpoints, so the firewall knows the health status of every protected machine in real time.

When an endpoint is compromised, three things happen without an administrator touching anything:

• The firewall isolates the host, cutting its access to other systems and to the internet.
• Other endpoints ignore it. Healthy Sophos endpoints refuse traffic from an unhealthy peer, which means isolation holds even on the same network segment, where a firewall cannot see the traffic at all.
• Sophos switches enforce it too. Pair the firewall with Sophos switches and the isolation reaches the access layer.

That second point is the part worth understanding. Two machines on the same VLAN talking to each other do not route through the firewall at all, so a firewall alone cannot see or block that traffic, whichever vendor made it. Sophos solves it by making the endpoints part of the enforcement, not just the firewall.

How do Palo Alto, Fortinet, Cisco, and pfSense compare?

Palo Alto leads on application-layer policy, Fortinet on inspection throughput per dollar, Cisco on file retrospection, and pfSense on cost. All four are credible platforms. What follows is not a list of things they cannot do, it is where the architectures differ.

Palo Alto Networks PA-Series: strongest policy engine

Palo Alto's App-ID engine is widely regarded in industry comparisons as the most granular application-layer policy engine in the category. App-ID and User-ID identify applications and users regardless of port or protocol, which makes stages 3 and 4 very strong, and its single-pass architecture inspects once across firewalling, threat prevention, URL filtering, and decryption. WildFire is a well-regarded sandbox with an on-premises appliance option for air-gapped sites, and Unit 42 threat intelligence is premium tier.

The trade-off sits in licensing. Automated host isolation lives in Cortex XDR, a separate product with separate licensing. And the subscription model is granular, with Threat Prevention, Advanced Threat Prevention, WildFire, DNS Security, and Advanced URL Filtering all sold separately. Excellent coverage, more SKUs to assemble and renew.

Fortinet FortiGate: fastest inspection per dollar

Fortinet's advantage is hardware. Custom NP and CP security processors accelerate IPS, IPsec, and SSL inspection in silicon rather than software, which is the basis for its price-performance position in published NGFW comparisons. FortiGuard services cover IPS, antivirus, web filtering, and application control, and ZTNA is built into FortiOS rather than sold separately, as is SD-WAN.

Sandboxing is the piece that sits outside the box. It runs through FortiSandbox, a separate cloud subscription or on-premises appliance. Host isolation and endpoint response come through the Security Fabric with FortiClient or FortiEDR, so the capability exists but it is an assembled fabric rather than a single bundle. If you are buying the whole Fortinet stack, that is fine. If you want the firewall alone to do it, it will not.

Cisco Secure Firewall: file retrospection and Snort 3

Cisco runs Snort 3 for intrusion prevention, which means open rule syntax and a large public rule ecosystem, backed by Talos threat intelligence. Secure Malware Analytics handles sandboxing, and Cisco has one capability the others do not advertise as clearly: file retrospection, which retroactively flags a file that passed inspection but was later determined malicious. For stage 5, that is a genuinely useful safety net.

Response is where Cisco asks more of you. Quarantine and identity-based enforcement run through ISE, which is powerful and also a significant deployment in its own right. Cisco's strength is coherence if you already run Cisco switching and identity; it is a heavier lift if you do not. Note also that Cisco Meraki MX is a different product line with a simpler operating model and more limited native inspection, so do not read Firepower capabilities onto an MX.

pfSense: capable, with two specific gaps

pfSense is a capable open-source firewall and router, and for stages 1 and 2 it does the job. Snort or Suricata provide IDS/IPS, pfBlockerNG handles IP and DNS blocking, and the price is hard to argue with.

The honest gap is stage 3. pfSense has no native TLS inspection. Snort and Suricata abandon a session as soon as they see it is encrypted, falling back to metadata such as SNI and JA3 fingerprints. With almost all web traffic now encrypted, that is a real hole rather than a theoretical one. There is also no built-in sandboxing for stage 5, no endpoint integration for stages 6 and 7, and no centralised multi-site management. Rule tuning is manual and ongoing.

None of that makes pfSense a bad choice for the right site. It makes it a different category of product, and the difference concentrates in exactly the stages where modern attacks succeed.

The wider Sophos stack across the chain

The firewall does not work alone, and a buying decision usually involves more than one product. This is which Sophos product covers which stage, and where the coverage overlaps.

Three things are worth pulling out of that picture.

• Stage 7 is the most heavily covered, with five products stacking there. That is deliberate, because lateral movement is where an incident turns into a breach.
• Stage 3 is thinner than people expect. Only Sophos Email, the firewall, and MDR sit at delivery, which is why encrypted inspection capacity matters so much there.
• Only Managed Risk works before the attack starts, by finding and reducing what is exposed rather than reacting to what is arriving.

What each product adds, and where

Product	Stages	What it contributes
Sophos Managed Risk	1	Finds exposed services and unpatched vulnerabilities before an attacker does
Sophos XGS Firewall	1, 3 to 7	TLS inspection, IPS, sandboxing, integrated NDR, and automatic host isolation
Sophos Email	3	Stops phishing, business email compromise, and malicious attachments at the inbox
Sophos Endpoint	4 to 7	Exploit prevention, CryptoGuard ransomware rollback, and the Security Heartbeat
Sophos ITDR	6, 7	Detects credential theft and identity abuse, the usual route for lateral movement
Sophos XDR	4 to 7	Correlates firewall, endpoint, email, and identity signals into one investigation
Sophos Next-Gen SIEM	5 to 7	Long-term log retention and audit-ready evidence, added on to XDR or MDR
Sophos MDR	3 to 7	Sophos analysts monitoring and responding 24/7 across the whole chain

You do not need all of it. The useful question is which stages your current stack leaves thin, then filling those rather than buying another layer on a stage you already cover three times.

The stage nobody puts on the diagram: the firewall itself

The kill chain assumes the attacker is coming for your users and servers. Recent years have shown a different pattern: the firewall is the target. Edge devices from several major vendors have had actively exploited vulnerabilities, and an internet-facing appliance with an unpatched flaw is an entry point rather than a defence.

This belongs in a buying decision, and it rarely appears in feature tables. Sophos groups its answer under Secure by Design, which covers three things worth asking any vendor about:

• Automatic hotfix patching. Critical fixes apply without waiting for a maintenance window, which shortens the exposure gap between disclosure and patch.
• Configuration health check. The firewall flags risky settings, such as an exposed management interface, rather than assuming the administrator got everything right.
• Remote integrity monitoring. Sophos watches its own deployed appliances for signs of compromise.

Whichever platform you choose, these are the questions to put to the vendor: how fast do critical patches reach my device, can it tell me when I have configured it dangerously, and who is watching the appliance itself. A firewall that stops every stage of the attack chain is still a liability if it is the way in.

Attack chain coverage compared: all five platforms

Stage	Sophos XGS	Palo Alto	Fortinet	Cisco	pfSense
Recon	Yes	Yes	Yes	Yes	Yes
Delivery: native TLS inspection	Yes, hardware accelerated	Yes	Yes, ASIC accelerated	Yes	No
Exploitation: IPS	Yes	Yes, with inline ML	Yes	Yes, Snort 3	Yes, Snort/Suricata
Installation: sandboxing	Included in Xstream	WildFire, separate	FortiSandbox, separate	Secure Malware Analytics	No
C2 detection	Included in Xstream	DNS Security, separate	FortiGuard	Talos	pfBlockerNG, partial
Network detection and response (NDR)	Included in the firewall	Separate product	Separate product	Separate product	No
Lateral movement: auto host isolation	Included in Xstream	Cortex XDR, separate	Security Fabric plus EDR	ISE required	No
Same-VLAN isolation	Yes, via endpoints	Via XDR agent	Via EDR agent	Via ISE and switching	No

What do independent reviewers say?

Vendor claims are one input. Third-party signals are another, and they are checkable:

• Sophos Firewall was ranked the number one overall firewall solution by G2 users in the Spring 2026 reports, a review-volume ranking rather than a lab test.
• It holds a Gartner Peer Insights Customers' Choice designation for Network Firewalls (2024) and a Frost & Sullivan Competitive Strategy Leadership Award.
• Palo Alto and Fortinet both sit in the leader tier of most analyst NGFW evaluations, and Fortinet is consistently placed ahead on price-performance.

Read these for what they are. G2 reflects customer sentiment and review volume, not detection efficacy under test. No award substitutes for running a trial on your own traffic, which every vendor here will let you do.

Which firewall should you actually choose?

Nobody should choose a firewall on a feature table alone, so here is how we would actually frame it:

• Palo Alto if application-layer policy granularity is the priority and you have the budget and the team for it. Its policy engine at stages 3 and 4 is the most granular of the five.
• Fortinet if throughput per dollar is the deciding factor, especially across many sites with SD-WAN. Published comparisons consistently put its three-year cost below Palo Alto for equivalent inspection, and the ASIC acceleration behind that is real.
• Cisco if you already run Cisco switching and ISE. File retrospection is a genuine advantage at stage 5.
• pfSense if the site's risk profile is low, budget is the binding constraint, and someone on staff enjoys tuning Suricata rules. Be clear-eyed about the TLS and sandboxing gaps.
• Sophos XGS if you want stages 6 and 7 handled without buying and integrating a separate XDR platform. Automatic host isolation, including on the same VLAN, comes in the Xstream bundle rather than as another product.

The pattern across these five is that the early stages are commodity and the late stages are not. Every commercial platform inspects traffic well. What separates them is what happens in the twenty minutes after something gets through, and whether that response is automatic or waiting for a human to notice.

Frequently asked questions

What is the cyber attack chain?

The attack chain, or cyber kill chain, breaks an attack into seven stages: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives such as lateral movement and data theft. Breaking any single link disrupts the attack, which is why defence in depth works.

Which attack chain stage do most firewalls miss?

Most firewalls miss the lateral movement stage. Once an attacker is inside, traffic between two machines on the same network segment never crosses the firewall, so the firewall cannot see or block it. Sophos addresses this with Synchronized Security, where healthy endpoints refuse traffic from a compromised peer, enforcing isolation the firewall alone cannot.

Why does TLS inspection matter so much?

Encrypted traffic is now the default: Cloudflare Radar measured 98.6% of human web requests as HTTPS in mid-2026, and Google reports around 99% of Chrome page loads. If a firewall cannot decrypt that traffic, its intrusion prevention, antivirus, and web filtering are inspecting an envelope they cannot open. Without TLS inspection, your IPS, antivirus, and web filtering are examining traffic they cannot read. Sophos XGS accelerates this in hardware with a dedicated Xstream Flow Processor, so inspection can stay switched on.

Can pfSense inspect encrypted traffic?

pfSense cannot inspect encrypted traffic natively. Snort and Suricata abandon a session once they detect it is encrypted, falling back to metadata such as SNI and JA3 fingerprints rather than payload inspection. That is a meaningful gap at the delivery stage, since almost all web traffic is now encrypted.

Does Sophos automatic host isolation require extra licensing?

Sophos automatic host isolation needs no extra licence. Lateral Movement Protection, Security Heartbeat, and Synchronized Security are all part of the Xstream Protection bundle. Palo Alto's equivalent runs through Cortex XDR, Fortinet's through the Security Fabric with FortiClient or FortiEDR, and Cisco's through ISE, each licensed separately.

Which firewall is best against ransomware?

Ransomware usually arrives at the delivery stage and does its damage after lateral movement, so those two stages matter most. Any platform with strong TLS inspection and sandboxing covers delivery. For lateral movement, the question to ask a vendor is whether automatic host isolation is included or requires a separate product, and whether it works between two machines on the same VLAN.

What is Sophos Synchronized Security?

Synchronized Security is a real-time link between the Sophos firewall and Sophos endpoints, called the Security Heartbeat. The firewall knows the health of every protected machine, and when one is compromised it isolates that host automatically. Healthy endpoints also refuse traffic from the compromised peer, which enforces isolation between two machines on the same network segment where the firewall has no visibility.

Is Sophos XGS better than FortiGate?

Sophos XGS and FortiGate lead on different things, so neither is universally better. FortiGate delivers more inspection throughput per dollar because its NP and CP security processors accelerate IPS and SSL inspection in hardware. Sophos XGS includes automatic host isolation at the lateral movement stage inside the Xstream bundle, where FortiGate reaches the same outcome through the Security Fabric with FortiClient or FortiEDR. Pick FortiGate for throughput economics across many sites, Sophos for automated response without assembling a second platform.

Does Sophos Firewall include NDR?

Yes. Sophos includes AI-powered Network Detection and Response in the firewall at no extra cost, and it can identify suspicious encrypted traffic without decrypting it. On Palo Alto, Fortinet, and Cisco, comparable network detection is a separate product or appliance. pfSense has no equivalent.

Can a firewall itself be attacked?

Yes, and it has become a common route in. Internet-facing security appliances from several major vendors have had actively exploited vulnerabilities. When comparing platforms, ask how quickly critical patches reach the device, whether it flags risky configurations such as an exposed management interface, and whether the vendor monitors deployed appliances for compromise. Sophos groups these under Secure by Design.

Do I need all seven stages covered by the firewall?

No, and no firewall covers stage 2 at all, since weaponisation happens on the attacker's infrastructure. The practical goal is to break the chain at as many points as you can afford, then make sure the late stages have an automated response rather than relying on someone noticing an alert.

Talk it through with Nuformat

Nuformat sells and supports Sophos and Fortinet, so we are in the odd position of being able to tell you when the other one fits better. Tell us your user count, what you are protecting, and whether you already run an endpoint platform, and we will map it against these stages honestly. Contact Nuformat, or browse Sophos XGS firewalls and Fortinet FortiGate. We serve Canada and the United States.

Sources

• Sophos next-gen firewall product page, including NDR, Secure by Design, Synchronized Security, and Xstream architecture (sophos.com/en-us/products/next-gen-firewall)
• Sophos Firewall Buyer's Guide, which compares Sophos, Fortinet, SonicWall, Cisco, and WatchGuard (sophos.com)
• Sophos XGS Series datasheets, per-model throughput and TLS inspection figures
• Sophos press release, Lateral Movement Protection and Synchronized Security
• Palo Alto Networks: App-ID, single-pass architecture, WildFire, and Cortex XDR licensing documentation
• Fortinet: NP and CP security processors, FortiGuard, FortiSandbox, FortiOS ZTNA
• Cisco: Secure Firewall with Snort 3, Talos, Secure Malware Analytics, ISE
• Netgate pfSense Plus feature documentation, Snort and Suricata packages
• Cloudflare Radar and Google Transparency Report, HTTPS adoption figures
• Lockheed Martin Cyber Kill Chain framework