Managed or purchased firewall: cost, risk and effort over 3 years

Four conditions, none of them included with the equipment. The firewall filters traffic between the internet and the network, hunts for threats, blocks dangerous categories, terminates VPNs and isolates segments. But only if:

1. The rules are designed for the company: factory rules serve everyone and no one in particular.
2. Firmware and signatures are up to date: every delay is a known door.
3. Security licences are valid: they expire silently.
4. Someone follows the logs: and acts when an alert is serious.

Miss one of these conditions and you pay for a security appliance but get a router.

Almost always the same thing. The company buys the equipment and licences, an engineer configures it on installation day and, from then on, nobody looks at it again.

• Firmware frozen For two or three years.
• Inspection switched off Because subscriptions expired months earlier.
• Accumulated exceptions Rules opened to fix an emergency and never closed.
• Alerts with no reader Sent to a forgotten mailbox.

In this model's favour: predictable upfront investment, owned equipment and no monthly fee beyond the licences. The problem is not the brand. It is that nobody owns it.

It gets a team responsible for it, for a monthly fee. The equipment can belong to the company or come with the service.

• Licences and updates Handled without reminders.
• Alerts analysed by engineers Not just filed in reports.
• Rules reviewed At fixed intervals.
• Incidents with a deadline A contracted response time.
• Documented know-how That stays even when someone in the internal team leaves.

The price is the monthly fee and dependence on the partner. It is kept in check with a written SLA and a contractual guarantee that credentials and configuration belong to the company.

A purchased firewall works when…

…there is an in-house IT team with the skills and availability for security, which usually happens from 150 to 200 workstations upwards. Or when the environment is simple and stable: no remote working, no VPN and no services exposed to the internet.

A managed firewall is the right choice when…

…nobody in-house has security as their job, there is remote access or published services, NIS2 or the cyber insurance policy calls for continuous management, or an incident has already revealed unread alerts. That is the reality for most Portuguese SMEs with 10 to 150 workstations.

• Ownership The configuration and equipment are yours; administrator credentials are kept in a digital vault or sealed envelope.
• Accountability A monthly report on what was blocked, updated and changed.
• Real urgency Security events at the top of the queue, with a committed deadline.
• Rule audit At least every six months.
• Reversibility If the contract ends, the firewall stays active and everything remains with you.

These are the terms of DataRoad's managed firewalls, with installation, configuration and monitoring handled by our team. In 11 years, DataRoad has never suffered a security incident.

• FreshDesign: next-generation firewall, SSL VPN for remote work, two internet links with load balancing and automatic failover, real-time alerts and ongoing maintenance. See the project.
• Ventask: an organisation with more than 350 workstations where firewalls, switches and access points are managed within IT Unlimited. See the case study.

We analyse firmware, licences, rules and alerts and deliver in writing what is exposed. Request a no-commitment proposal.

More than 10 workstations · support contract · remote, on-site and telephone support. Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.