Small Business Firewall: FortiGate, Sophos, WatchGuard or UniFi

The firewall is often the first security device a small business buys, and the last one anyone looks at afterwards. It sits on a shelf next to the modem until the licence renewal notice shows up, or a vulnerability bulletin lands for that exact model.

Choosing between Fortinet, Sophos, WatchGuard and Ubiquiti isn't just a hardware comparison. You're picking a licensing model you'll pay for over five years or more, a console your IT provider has to know well, and an update cadence you'll need to keep up with.

The real cost: the box or the subscription?

Three of the four vendors sell hardware paired with subscriptions, and those subscriptions unlock the protections that matter most.

• Fortinet groups its FortiGuard services into three bundles. ATP includes IPS, antivirus, FortiSandbox SaaS and application control. URL and DNS filtering require the UTP bundle; the Enterprise bundle includes everything.
• Sophos ships a Base Licence with the hardware: networking, unlimited remote access VPN, site-to-site VPN and reporting. The Xstream Protection bundle adds Network Protection (IPS), Web Protection, Zero-Day Protection, Central Orchestration and DNS Protection, which is only sold in the bundle.
• WatchGuard offers four tiers. Standard Support covers the firewall, VPN and SD-WAN; Basic Security Suite adds IPS, gateway antivirus and WebBlocker filtering; Prime adds APT Blocker and DNSWatch; Total adds ThreatSync XDR and EDR Core.
• Ubiquiti requires no licence for baseline IPS and content filtering. The optional CyberSecure subscription adds richer signatures (Proofpoint) and filtering (Cloudflare).

The practical advice: compare total cost over five years, renewals included. A quote should never show only the first-year price. Our guide to a small business cybersecurity budget helps put that line item in context.

Management and logs: who's watching?

A firewall nobody checks protects less than you think. All four vendors offer a cloud console, on different terms.

FortiGate Cloud has a free basic tier limited to seven days of logs and one default report; the Standard subscription adds management, analytics and a year of logs, and requires a FortiCare Premium contract. Sophos includes cloud management at no extra charge with its protection bundles. WatchGuard includes centralized management in WatchGuard Cloud from Standard Support up. Ubiquiti describes Site Manager as a licence-free dashboard for every UniFi site.

Those logs are often the first source investigators use to piece together a ransomware attack. Check how long they're kept and who gets the alerts.

Remote access VPN: the most exposed feature

VPN gateways and management interfaces exposed to the internet are prime targets. The joint advisory from CISA and its partners, including the Canadian Centre for Cyber Security, on the most exploited vulnerabilities of 2023 lists flaws in products from several firewall and VPN manufacturers. None of them is immune; what matters is how fast you patch.

One recent change deserves attention from Fortinet customers: as of FortiOS 7.6.3, SSL VPN tunnel mode has been removed, and models with 2 GB of RAM or less no longer support SSL VPN at all. Fortinet recommends migrating to IPsec VPN before upgrading. If your staff connect through SSL VPN, plan that migration with your IT provider.

Whatever the brand, require multi-factor authentication on the VPN, turn off management access from the internet, and follow a patch management policy that covers emergencies.

How to choose

Ask these questions in order:

1. Who will run it? If your IT provider already knows one brand well, that outweighs any single feature. A misconfigured firewall is no better than an ordinary router.
2. How many sites? Beyond one office, SD-WAN and centralized management start to matter. All four offer them, at different licence levels.
3. What do you already have? Sophos endpoints, UniFi Wi-Fi or Fortinet access points: integration makes management easier.
4. Which protections do you need? If web filtering and sandboxing are essential, confirm they're actually in the bundle you're quoted.
5. What's the five-year budget? Hardware, subscriptions, support and admin hours.

In short: UniFi suits small offices with simple needs, FortiGate suits multi-site networks that want a full ecosystem, Sophos suits companies already using that vendor, and WatchGuard suits businesses that want a clear all-in-one tier.

Already have a firewall? Our cybersecurity audit reviews its configuration, including overly permissive rules, exposed management ports, outdated firmware and VPN access without multi-factor authentication.