--- title: "Managed or purchased firewall | DataRoad IT" description: "Managed or purchased firewall? Three-year cost, updates, alerts and incident response compared for SMEs with 10 to 150 seats. No-obligation proposal." language: en url: https://www.dataroad-it.com/en/managed-vs-purchased-firewall-comparison/ source: https://www.dataroad-it.com/en/managed-vs-purchased-firewall-comparison/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > Managed or purchased firewall? Three-year cost, updates, alerts and incident response compared for SMEs with 10 to 150 seats. No-obligation proposal. # Managed or purchased firewall: cost, risk and effort over 3 years At a glance For decision-makers short on time. - 01 Without configuration, updates, valid licences and alerts read, a firewall is just a pricey router. - 02 Buying pays off with an in-house security team, usually above 150 to 200 workstations. - 03 For SMEs with 10 to 150 workstations and VPN or remote work, managed is the right choice. - 04 Demand ownership of the configuration, monthly reports, written deadlines, a clean exit. ### In this article A firewall with expired subscriptions keeps letting traffic through, but stops inspecting it. The company believes it is protected and is not. The choice between a **managed firewall or a purchased firewall** is decided right there: not on the price of the box, but on who keeps it updated, reads the alerts and reacts at 3am. We compare the two models on cost, risk and effort, with objective criteria. ## What has to happen for a firewall to actually protect? Four conditions, none of them included with the equipment. The firewall filters traffic between the internet and the network, hunts for threats, blocks dangerous categories, terminates VPNs and isolates segments. But only if: - **The rules are designed for the company**: factory rules serve everyone and no one in particular. - **Firmware and signatures are up to date**: every delay is a known door. - **Security licences are valid**: they expire silently. - **Someone follows the logs**: and acts when an alert is serious. Miss one of these conditions and you pay for a security appliance but get a router. ## What goes wrong with a purchased, unmanaged firewall? Almost always the same thing. The company buys the equipment and licences, an engineer configures it on installation day and, from then on, nobody looks at it again. - **Firmware frozen** For two or three years. - **Inspection switched off** Because subscriptions expired months earlier. - **Accumulated exceptions** Rules opened to fix an emergency and never closed. - **Alerts with no reader** Sent to a forgotten mailbox. In this model's favour: predictable upfront investment, owned equipment and no monthly fee beyond the licences. The problem is not the brand. It is that nobody owns it. ## What changes when the firewall becomes managed? It gets a team responsible for it, for a monthly fee. The equipment can belong to the company or come with the service. - **Licences and updates** Handled without reminders. - **Alerts analysed by engineers** Not just filed in reports. - **Rules reviewed** At fixed intervals. - **Incidents with a deadline** A contracted response time. - **Documented know-how** That stays even when someone in the internal team leaves. The price is the monthly fee and dependence on the partner. It is kept in check with a written SLA and a contractual guarantee that credentials and configuration belong to the company. ## How do they compare side by side? | Dimension | Purchased firewall | Managed firewall | | --- | --- | --- | | Investment | Heavier upfront, light afterwards | Light upfront, higher monthly fee; over three years, similar totals | | Patches | Only if someone remembers | Scheduled and guaranteed | | Alerts | Generated | Resolved, a 3am VPN alert read at noon is of little use | | Rules | Frozen on installation day | Adjusted for every new office, remote working arrangement or new software | | Incident | A search for someone who knows the kit | Written response deadline | | Technical memory | In one person's head | Documented and shared across a team | ## Which one suits your company? ### A purchased firewall works when… …there is an in-house IT team with the skills and availability for security, which usually happens from 150 to 200 workstations upwards. Or when the environment is simple and stable: no remote working, no VPN and no services exposed to the internet. ### A managed firewall is the right choice when… …nobody in-house has security as their job, there is remote access or published services, NIS2 or the cyber insurance policy calls for continuous management, or an incident has already revealed unread alerts. That is the reality for most Portuguese SMEs with 10 to 150 workstations. ## Which clauses should you demand in a managed firewall contract? - **Ownership** The configuration and equipment are yours; administrator credentials are kept in a digital vault or sealed envelope. - **Accountability** A monthly report on what was blocked, updated and changed. - **Real urgency** Security events at the top of the queue, with a committed deadline. - **Rule audit** At least every six months. - **Reversibility** If the contract ends, the firewall stays active and everything remains with you. These are the terms of [DataRoad's managed firewalls](https://www.dataroad-it.com/en/managed-firewall-services-portugal/), with installation, configuration and monitoring handled by our team. In 11 years, DataRoad has never suffered a security incident. ## Which clients already run a managed firewall? - **FreshDesign**: next-generation firewall, SSL VPN for remote work, two internet links with load balancing and automatic failover, real-time alerts and ongoing maintenance. [See the project](https://www.dataroad-it.com/en/freshdesign-ngfw-ssl-vpn-failover/). - **Ventask**: an organisation with more than 350 workstations where firewalls, switches and access points are managed within IT Unlimited. [See the case study](https://www.dataroad-it.com/en/ventask-managed-firewalls-350-workstations/). ## Quick answers for decision-makers ### Can we convert the firewall we already have to managed? Yes, almost always. If the equipment still has vendor support, we take over its management; if it is end-of-life, we plan a phased replacement. ### Does the ISP router do the same job? No. It separates the network from the internet, but it does not inspect, filter by category, manage VPNs with MFA or segment. It is the first device to replace in a business. ### What does a managed firewall cost? Under an IT Unlimited contract, management is included in the monthly fee. The final price depends on throughput, number of users and active features; we do not provide this service on a one-off basis. ### Does a managed firewall meet NIS2? It helps, but it is not enough. The directive also calls for access control, backups, incident response and training; the summary is in [NIS2 for Portuguese companies](https://www.dataroad-it.com/en/nis2-compliance-portugal/). ## Is your firewall really protecting you? We analyse firmware, licences, rules and alerts and deliver in writing what is exposed. Request a no-commitment proposal. **More than 10 workstations · support contract · remote, on-site and telephone support.** Call **+351 211 459 950 *** or write to sales@dataroad.pt. **Call to a Portuguese landline.* Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed cybersecurity ## One StepAhead of IT. Security is proven over years, not promises. Managed firewalls, MFA, endpoint protection and tested backups, the same standard for every client. - **M365** backed up off-site - **5 ★** on Google · 52 reviews - **Top 5%** SMEs · scoring.pt We do **IT** right. DataRoad IT Unlimited ## Does your IT depend on a single person? Documentation, inventory and one contact who answers for everything. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/managed-vs-purchased-firewall-comparison/