The Best Unified Threat Management Software

Unified Threat Management (UTM) offers a complete security protection system that leaves no gaps for hackers to exploit. Replacing your anti-virus and firewall systems with a full UTM package makes sense because those separate cybersecurity services should be working together in order to address the serious system threats that are constantly evolving.

Here is our list of the best Unified Threat Management software packages:

1. ManageEngine Log360 EDITOR’S CHOICE This on-premises SIEM collects data from many different systems, including cloud platforms. Runs on Windows Server. Start 30-day free trial.
2. Datadog Security Monitoring (FREE TRIAL) This Cloud-based cybersecurity system collected event data from every part of your system and identifies any activity that is suspicious. AI-based detection methods narrow down threat identification, so you don’t get overwhelmed by false-positive reporting. Start a 14-day free trial.
3. Heimdal Threat Hunting and Action Center (FREE TRIAL) This cloud-based SaaS platform implements security measures for desktops and for mobile devices. Desktops can be running Windows, macOS, or Linux, and mobile devices running Android are catered for. Start a 30-day free trial.
4. ESET Protect MDR This threat detection and response package is managed by a team of cybersecurity experts. Endpoint agents run on Windows, Linux, macOS, iOS, and Android.
5. Fortinet FortiGate UTM This physical appliance is produced by a leading network security provider and creates a “security fabric” for the entire organization. SD-WAN options are also available to extend protection over several sites.
6. Check Point Quantum NGFW This range of firewall appliances has units for all sizes of businesses. It is positioned as the network gateway and can detect all external threats by examining incoming and outgoing traffic.
7. Sophos SG UTM This total cybersecurity package covers all of your IT assets with a range of deployment options that include on-site virtual and physical appliances and a cloud-based service.
8. Cisco UTM This package is offered by the network equipment giant and so is particularly strong on network security but also offers monitoring for endpoints. Offered as a physical or virtual appliance or as a cloud service.
9. SonicWall UTM A system security package that can be built into SonicWall appliances that connect to the network and monitor all activity. Also offered as a virtual appliance.
10. Huawei Unified Security Gateway (USG) A series of network appliances that include onboard system security software. That software can also be run separately as a virtual appliance.
11. WatchGuard Firebox UTM This is a range of physical appliances that implement system-wide security monitoring. Also available as a cloud-based service or a virtual appliance.

UTMs and NextGen-Firewalls

The traditional approach is to deploy several single-function security products from different vendors. However, this method requires installing and integrating several products, which of course involves individual familiarity, learning different management consoles, and managing updates and upgrades from several vendors. Next-generation firewalls (NGFWs) are also a viable option as they are much more effective than traditional firewalls, but still lack important features that are critical to detecting and responding to all the latest threats. But in recent times, organizations are embracing a concept known as Unified Threat Management (UTM) solution that combines two or more security services into one application or appliance.

UTM is a term used to describe an all-in-one approach to information security, where a single converged platform ( software or hardware) provides multiple security functions such as network firewalls, intrusion detection and prevention, gateway anti-virus, business VPN, email and web content filtering, etc. UTM’s seemingly appeal stems from the fact that it simplifies information security management by providing a single management and reporting point for the security administrator rather than managing multiple products from different vendors. Instead of having several single-function applications or appliances, network administrators can centrally administer their security defenses from one box.

Evaluating UTM tools

When evaluating a UTM product, you need to ensure that the device’s different functionalities address your security risks and policy requirements. You don’t want to get caught up in the sales and marketing hype that tends to surround most security products. There are key questions you need to consider, such as: What security problem are you trying to solve? Is a UTM solution right for your organization? What security features are most important? Do you require the UTM to support geographically dispersed branch locations and remote workers? What is the infrastructure bandwidth for your environment, and how many users and devices does the organization need to support today and in the future? Is it easy to deploy, manage and maintain? Other factors to consider include performance, scalability, vendor support, and of course cost.

The best UTM Software:

Unified Threat Management breaks down the silos between security services for different system elements. We discover the best UTM software available on the market today.

With these selection criteria in mind, we identified a shortlist of centralized UTM packages that provide excellent cybersecurity protection at a reasonable price.

1. ManageEngine Log360 (FREE TRIAL)

ManageEngine Log360 is an on-premises system that runs on Windows Server. The service isn’t limited to examining events on its host because it can ingest log messages from all other endpoints on the network and also on cloud platforms. This means that Log360 can unify threat hunting for many platforms. The package includes a library of agents for all of the major operating systems, including Linux and cloud systems, such as AWS and Azure. The agents interact with the operating system and more than 700 software packages to collect log messages, which are forwarded to a central log server, where they are converted into a unified format.

Key Features:

• A threat intelligence feed
• Centralizes cloud and premises threat hunting
• File integrity monitoring
• Customizable

Why do we recommend it?

ManageEngine Log360 is a bundle of ManageEngine packages that relate to log file management and scanning. There is a SIEM at the heart of this system, which is the main threat management tool in the bundle. Other elements provide cloud security, automated threat response, and compliance reporting.

While all of the tools in this list centralize threat management, most of the options available today are cloud-based. Not everyone is comfortable with cloud services and if you are someone that prefers to host your security software in-house, this is the best option.

The Log360 package provides many security features, which include file integrity monitoring. The tool records all data access and file change events, which is greater for data security standards compliance. This system also produces compliance reports for GDPR, GLBA, HIPAA, PCI DSS, FISMA, and SOX.

Who is it recommended for?

This is a large bundle of services that includes user activity tracking and account auditing to protect against insider threats and account takeovers. Therefore, it is way more than small businesses need. Companies that used Active Directory for their access rights management are particularly suited to this system. The tool is an on-premises package for Windows Server.

ManageEngine Log360 is available for a 30-day free trial.

2. Datadog Security Monitoring (FREE TRIAL)

Datadog is a SaaS platform of monitoring and system management services that are charged for by subscription. The service includes a Security Monitoring package, which is part of a wider Security Monitoring Platform.

Key Features:

• Monitor multiple sites
• Monitor security for cloud platforms
• SIEM package
• A cloud-based service
• Orchestrates with third-party tools

Why do we recommend it?

Datadog Security Monitoring provides protection for on-premises systems and cloud services. This unifies the security services for hybrid environments. The package includes a SIEM for all environments, Cloud Security Posture Management for cloud systems hardening, and a Cloud Workload Protection Platform that implements continuous threat detection for cloud services.

The Security Monitoring system is appropriate for use by IT Operations departments for supervising the security of the enterprise’s entire IT infrastructure. The Security Monitoring Platform includes extra testing band protection services for DevOps environments.

The Datadog Security Management service is a SIEM system. This means that it collects log messages and system monitor outputs, such as SNMP reports, and gathers them together into a single pool of data for threat detection. This means that activity data from every part of your IT system – endpoints, networks, and applications, is included in the protection system.

While the Datadog Security Monitoring service doesn’t replace your existing firewall, it will integrate that service into its unified security management system. Activity data from the firewall feeds into the SIEM and automated response instructions can be sent back to it.

By coordinating existing services, Datadog Security Monitoring creates efficiency. The system gets even more cost-effective if you combine the security features with other services offered by Datadog, such as its Network Monitoring packages because all of the Datadog systems use the same on-site agent for data collection.

Datadog Security Monitoring efficiently provides monitoring for any resource no matter where it is located, giving you the ability to centralize the security protection for all of your IT assets, including on-premises systems and cloud resources. The ability of this service to gather activity information from all of your IT assets creates an easy way to implement security management without having to re-install software or alter system settings. Combining the Security Monitoring service with other Datadog packages increases value for money and efficiency.

Who is it recommended for?

You would need to be using cloud services to really benefit from this package. If you use both on-premises services and cloud platforms, then even better. Businesses that work with only a few SaaS systems would probably be better off with a system that focuses more attention on protecting on-premises assets.

Datadog offers a menu of services that are all run from its cloud platform and you can try all of them on a 14-day free trial.

Datadog Access 14-day FREE Trial

3. Heimdal Threat Hunting and Action Center (FREE TRIAL)

Heimdal Threat Hunting and Action Center offers different strategies for protecting desktops and mobile devices. The system is based in the cloud and administrators access its console through any standard Web browser. The endpoint protection system is implemented as a hybrid system with an on-device agent providing local protection.

You sign up for the endpoint protection system with a subscription on the Heimdal SaaS platform. This enables you to register your fleet of endpoints. Each enrolled device gets an agent installed on it. This program is available for Windows, macOS, and Linux. The local agent performs a signature-based check on all files on the device and it also sweeps ports for vulnerabilities and for signs of attack. The agent also gathers all log messages from the operating system and software packages on the device and uploads those to the Heimdal server.

Why do we recommend it?

Heimdal Threat Hunting and Action Center is a hybrid solution that operates from the cloud and scans your sites and cloud services. This tool has a sophisticated console, which is accessed through any Web browser. It scans your IT assets to identify security weaknesses, producing recommendations for system hardening it also provides constant threat detection.

The Heimdal system implements threat hunting on standardized log messages. This is an anomaly-based search and it records actions per user and per device. This is a process that is known as user and entity behavior analytics (UEBA). When activity patterns deviate from the standard established for each user and device, the system raises an alert.

The Heimdal Threat Hunting and Action Center tool can be set up to implement automated responses. These are implemented by the endpoint agent and can involve sending instructions to third-party security tools, such as access rights managers and firewalls.

The mobile device security measures provide tracking and also on-demand locking and wiping in the event of a device being lost or stolen. This function is only available for devices running Android.

Who is it recommended for?

The Heimdal service includes a vulnerability service as well as a SIEM and cloud protection services. This is a close competitor to the Datadog package and you would need to be a fairly large business that uses a lot of cloud services and SaaS packages to fully benefit from it.

Heimdal Threat Hunting and Action Center doesn’t publish a price list, so you have to request a consultation to find out more. You can get a 30-day free trial of the Next-Gen Endpoint Antivirus system or any other Heimdal Security package.

Heimdal Threat Hunting and Action Center Get a 30-day FREE Trial

4. ESET Protect MDR

ESET Protect MDR is a centralized XDR system that is hosted on the cloud but draws source data for threat hunting from endpoint protection software. That anti-virus package will run on Windows, macOS, Linux, iOS, and Android. While that AV will detect and stop malware and human threats, the central XDR can identify company-wide attacks.

Key Features:

• A managed security service
• Dual-layer threat detection
• Automated responses

Why do we recommend it?

ESET Protect MDR is a managed security service. It provides the technicians to run the ESET Protect software, which includes endpoint protection, centralized threat hunting, automated responses, vulnerability scanning, and patch management. This service can also protect cloud resources and email systems.

MDR stands for Managed Detection and Response. This is an add-on to one of the ESET Protect XDR packages and includes technicians to monitor the security software. The lowest edition of ESET Protect is an AV. This won’t give you endpoint detection and response but it acts as a device agent for the higher plans. Those three upper plans each offer successively longer lists of services.

The ESET Protect Advanced system is the entry-level SIEM service that supplements the abt-virus activities of the endpoint units. ESET Protect Complete plan provides automated responses to detected threats. This edition also includes email security and protection for cloud services. This plan also provides a vulnerability scanner and a patch manager.

While the ESET Protect Complete system will send response instructions back to the ESET endpoint agents, the top plan, ESET Protect Elite will interface with third-party security tools as well.

Although these plans provide automated responses, there will always be borderline situations that need to be assessed. The vulnerability can fix out-of-date through its connection to the patch manager in the ESET package, but it won’t fix other detected weaknesses. For these reasons, buyers of the ESET system will need cybersecurity experts on their staff. Those companies that do not have such expertise available would benefit from the ESET Protect MDR system.

The top plans of ESET Protect don’t just detect threats, they also scan for system vulnerabilities. The package will fix some of those weaknesses with a patch manager or issue guidance on what system changes need to be made. ESET Protect MDR provides security management for these tasks.

Who is it recommended for?

The ESET Protect MDR plan is ideal for those businesses that can’t source suitably qualified cybersecurity experts and those that are too small to provide full-time employment for such technicians. The managed security service provider is able to provide a round-the-clock security operations center for businesses of all sizes.

The MDR system is a technician add-on service to your choice of ESET Protect plan, so there isn’t a free trial for this system. You need to contact ESET to discuss your requirements.

ESET Protect Contact ESET

5. Fortinet FortiGate UTM

The Fortinet FortiGate UTM is among the leading UTM products or applications in the market. It has been recognized by Gartner as a leader in its annual UTM Magic Quadrant report since 2008. It has also been named a 2020 Gartner Peer Insights Customers’ Choice. FortiGate UTM supports deployments across physical, virtual, and cloud environments. It’s available in different models ranging from entry-level hardware appliances targeted at small offices, to ultra-high-end appliances designed for data centers and multi-tenant cloud environments, as well as a software virtual appliance for deployment on your own hardware.

Key features include:

• Monitor physical and virtual systems
• On-premises and cloud resources
• Physical or virtual appliance
• Integrates with Fortinet Security Fabric
• Software-defined wide area network (SD-WAN),
• Next-generation firewall (NGFW)
• Intrusion prevention and detection
• Data loss prevention (DLP)
• Virtual private network (VPN) and tunnel endpoint (SSL & IPSec)
• Email, web, and content filtering
• Advanced persistent threat protection
• Anti-malware, IP reputation, and SSL inspection
• Integrated WLAN controller
• Cloud sand-box

Why do we recommend it?

Fortinet FortiGate UTM is part of a family of FortiGate products that can be loaded onto a hardware firewall. The firewall appliance is Fortinet’s signature product with a special architecture to speed up data processing. Fortinet produces add-on services for this firewall and the UTM is one of them. Fortinet now also produces a virtual appliance and cloud versions of FortiGate.

FortiGate UTM is powered by FortiOS software, which also enables the Fortinet Security Fabric—an adaptive architecture providing integrated detection and automated responses to cybersecurity threats. It utilizes machine learning and AI to provide behavioral-based cyber threat detection and prevention.

Fortinet licenses UTM security features which it calls FortiGuard Services, on a per-device basis. FortiGuard Services are available as a single subscription or software bundle with or without hardware. FortiCare device-based support is the foundation of the support services, providing firmware updates, technical support, and foundational FortiGuard subscriptions. Customers can also purchase advanced premium support services to complement the standard FortiCare support plan.

Who is it recommended for?

The FortiGate firewall has always been a high-end product aimed at large businesses. However, now it is available without the necessity of buying a physical appliance, its appeal has widened to mid-sized businesses as well. This UTM is an add-on to the firewall, so existing owners of FortiGate firewalls are the most likely buyers of this tool.

Related post: The best Fortinet analyzers

6. Check Point Quantum Next-Generation Firewall

Check Point provides a range of hardware firewalls under the Quantum brand. These cater to businesses of different sizes. Each firewall appliance provides additional security services, such as SD-WAN management, data loss prevention, and email filtering.

Key Features:

• SandBlast Zero-Day protection
• Connection security to cloud services
• R81 Unified Security Management

Why do we recommend it?

The Check Point Quantum Next Generation Firewall is a similar product to the Fortinet FortiGate range. You get a piece of hardware that hosts all of your security systems. That removes the need to find server space for your threat management software and it also ensures that no threats can get onto the network and cause havoc before they are detected.

The fit for each product in the range is:

• Quantum Lightspeed Firewall for data centers
• Quantum Security Gateway in capacities for high-end, large, and mid-sized enterprises, and branch offices
• Quantum Spark for small businesses
• Quantum Rugged for industrial environments

Check Point also offers a Cloud Native Security package to add on to your Quantum package and a larger appliance called the Maestro Orchestrator, which is a hardware appliance that coordinates between multiple Lightspeed devices. This is a complicated system but you narrow down the complexity by zooming in on the device that is suitable for your business size.

As it sits as a gateway between the internet and your network, the Quantum device can also act as an endpoint for a secure virtual network. As such, it will manage Site-to-Site VPN connections and offload encryption, to enable boundary packet inspection that gets right into the payload of each packet rather than just their headers.

The Cloud Native Security add-on provides a cloud-based system to check all of your cloud assets and accounts. This can also coordinate with your on-premises Quantum device to implement connection security and application fencing.

The SandBlast module is a sandboxing service that tests unknown executables as they download. The system previews each program by running it in a protected environment and checking its intent before allowing it through to an endpoint on your network.

Who is it recommended for?

Check Point covers all enterprise sizes with its hardware range. However, this means that a Quantum appliance will only be of interest to businesses that want an on-premises network device for a firewall implementation. You would need to have considerable on-site assets to justify this deployment option. Businesses that operate virtual offices or rely heavily on cloud SaaS packages wouldn’t be well served by this system.

7. Sophos SG UTM

Most people usually associate Sophos with just endpoint security services, but the company also offers one of the best UTM products in the market. In fact, Sophos is rated by Gartner as a leader in the UTM market because of its feature-rich security, ease of use, and integration with its endpoint security product.

Sophos gives you the flexibility to deploy its UTM solution as hardware (SG series), software (UTM image or virtual appliance), or cloud-based appliance, including a free version for home use. One good thing about this product is that Sophos provides a free tool called Sophos UTM Manager (SUM) to centrally manage all your UTM appliances from a single, centralized management console. It’s a good thing because most vendors usually require some form of licensing or subscription to unlock this feature. The Sophos SG series UTM appliance comes in Desktop, 1U, and 2U models, as well as a software virtual machine.

• The Desktop model such as the SG 105/105w, SG 115/115w, SG 125/125w, and SG 135/135w (“W” signifies support for a wireless network) is the entry-level range targeted at SMBs and remote offices.
• The 1U model such as SG 210, SG 230, SG 310, SG 330, SG 430, and SG 450 is the mid-range solution ideal for many medium-sized organizations.
• The 2U model such as SG 550 and SG 650 is the high-end solution targeted at larger organizations and data center environments.

Some of the key features or modules of Sophos UTM include but are not limited to:

• Virtual appliance, physical device, or SaaS platform
• Free for home use
• Includes email protection
• Next-generation firewall (NGFW) protection
• Site-site and remote access VPN
• Mobile network access control
• Endpoint protection
• Data loss prevention (DLP)
• Email Protection, encryption, and anti-spam
• Advanced threat protection

Why do we recommend it?

Sophos SG UTM has some interesting features that few of its rivals provide, such as a secure wireless network manager and encryption management for emails, Web systems, and mobile apps. The package includes a program sandboxing system, called Sandblast, which will trial downloaded software before allowing it onto your endpoints.

Sophos UTM licensing is based on subscription. You can either subscribe individually to those modules or purchase a single pre-packaged FullGuard license. The Sophos standard support provides access to manual updates, knowledge base, community forum, and return and replace services. Premium support gives you 24/7 technical support direct from Sophos Support engineers, automatic updates, and advanced replacements. If you think Sophos UTM is right for your business, follow the steps below to complete the buying process.

1. Choose your deployment model: hardware, software, virtual or cloud-based appliance
2. Choose your license: Pre-packaged license or license modules individually
3. Choose your add-ons: Take advantage of add-ons such as subscription extensions, centralized management, and reporting options, among others.

Who is it recommended for?

Sophos aims its products at mid-sized businesses. As this is a cloud-based system that is easy to deploy and manage, the company might be widening its target market. This system includes some CSPM and CWPP features to protect the SaaS systems that businesses use. Its Web application security is designed for the users of cloud systems rather than their providers.

8. Cisco UTM

Cisco is a household name when it comes to network infrastructure products and services. It is therefore not surprising to know that it is also a force to reckon with in network security, especially in the UTM market. It is recognized as the lead challenger in the most recent Gartner UTM Magic Quadrant published in 2018. It was also named a 2018 Gartner Peer Insights Customers’ Choice for UTM.

Key Features:

• Physical or virtual appliance
• A list of add-on services
• Firewall-centered

Why do we recommend it?

The Cisco Secure Firewall is a hardware appliance and si it competes with the Fortinet and Check Point options on this list. Like those competitors, Cisco produces a range of device sizes that caters to different business sizes. The appliance can host multiple functions, so you can add on extra software.

Cisco offers several UTM hardware appliance options with Firepower series, ASA 5500-X series with FirePOWER services, and Meraki MX series, as well as software virtual appliance for public and private cloud infrastructure. All of these can be managed from a central platform called Firepower Management Center (FMC). Cisco lets customers try out Meraki MX products on their own networks at no charge.

Cisco is a particularly good fit for companies seeking a broad range of security products and services that integrate with the firewall. But incidentally, the sheer number of different products and a wide array of features makes buying decisions cumbersome. Key features include but are not limited to IPS, VPN, URL filtering, DDoS protection, application control, identity services, endpoint protection, web gateway, email security, network access control, and high availability.

All purchases can be made via accredited Cisco partners. Cisco UTM licensing is subscription-based and it comes with standard and premium support. Licensing covers specific security features and services used by the appliances. Customers are required to purchase a license for cloud services on a per-device basis. Existing ASA customers have the opportunity to upgrade the software to the Firepower 9300 without replacing the ASA device. Cisco even provides small businesses with flexible payment options via the Cisco Easy Pay plus. Cisco is well known for its strong support system for customers. As with other products, Cisco provides full online documentation for installing and configuring all of its UTM software and appliances.

Who is it recommended for?

The Cisco hardware firewall range has advantages for on-site systems. However, if you specialize in providing Web applications or use SaaS systems more than on-premises services, you should look at the Cisco Secure Firewall Cloud Native product. Cisco also offers a cloud-based Web application firewall that provides bot and DDoS protection as well.

9. SonicWall UTM

SonicWall has been in the UTM business from the earliest days. They have produced good value UTM product sets and models to meet the needs of businesses of all sizes. It is recognized as a challenger in the Gartner 2018 UTM Magic Quadrant.

Just like other vendors, SonicWall UTM supports deployments across physical, virtual, and cloud environments. Its appliances are powered by a software called SonicOS that enables all the UTM security and networking features. The SonicWall UTM are grouped under the following categories:

• SonicWall TZ SOHO Series: These are entry-level UTM products (in wired and wireless models) that combine threat prevention and SD-WAN technology, targeted at small to mid-size organizations and remote offices.
• Network Security Appliance (NSA) series: These are hardware appliances that range from NSA 2650 series to NSA 9650 series, and are targeted at mid-sized networks to distributed enterprises and data centers.
• Network Security Services Platform (NSSP) series: These are also hardware appliances made up of NSSP 12400 and NSSP 12800 series that combine cloud intelligence with appliance-based protection, designed for large distributed enterprises, data centers, and service providers.
• Network Security Virtual (NSV) series: These are full-featured SonicWall UTM software applications ranging from NSV 10 to NSV 1600, designed to deal with vulnerabilities within virtual environments.

One notable feature and capability of SonicWall UTM is the availability of an integrated cloud-based centralized management service called Capture Cloud Platform, and online live demos, that helps you experience real product demonstrations without going through the trouble of putting a test box in your environment.

Other key features include:

• Next-generation firewall (NGFW)
• Cloud service or physical or virtual appliance
• Intrusion prevention system
• Virtual private network (VPN)
• Web content filtering
• Anti-malware
• Application identification
• TLS/SSL/SSH decryption and inspection
• Anti-malware, IP reputation, and SSL inspection
• Integrated WLAN controller
• Traffic visualization and analytics
• Networking, Wireless, and VoIP
• Management and monitoring

Why do we recommend it?

The SonicWall product range is centered on a line of hardware firewalls. These devices are constructed in versions that cater to different sizes of enterprises. There is also a cloud-based range of systems for Cloud service protection and a Web application firewall. By combining several products and running them on the firewall appliance, you create a UTM.

SonicWall UTM licensing is subscription-based and it comes with standard and premium support. Before deciding to purchase or renew the SonicWall UTM subscription, you first need to determine the appliance type, model, and subscription that is right for your business.

Who is it recommended for?

If you have decided that you want to implement your threat protection on a network device, then this is one of your options along with Cisco, Check Point, and Fortinet. This route will enable you to construct a range of virtual network configurations by combining site protection with a cloud-based entry point, so you can have an SD-WAN or a SASE with the SonicWasll service.

10. Huawei Unified Security Gateway (USG)

Huawei UTM solution which it brands as Unified Security Gateway (USG) provides integrated security for midsize, large enterprises, chain organizations, cloud service providers, and large data centers. It is recognized as a challenger in Gartner’s most recent UTM Magic Quadrant alongside Cisco and SonicWall in 2018, and it has also earned the coveted NSS Labs’ “Recommended” rating in 2019. Huawei is a well-known brand in Europe, the Middle East, Africa, and Asia (EMEAA) markets.

Key Features:

• Suitable for large data centers
• AI-based threat defense
• Traffic management

Why do we recommend it?

Huawei is another network device provider with a hardware solution for its firewalls. However, the company also offers a number of software-based threat detection systems, which include the HiSec Insight Advanced Threat Analytics System and the SecoManager Security Manager, which is a SOAR solution that optimizes the performance of your existing security systems.

Huawei USG UTM solution comes in desktop, rackmount, data center (DC) chassis, and software virtual appliance model, giving you the flexibility to deploy as hardware or software virtual appliance in a physical, or virtual environment.

• Desktop model: The Huawei HiSecEngine USG6500E series such as USG6510E and USG6530E is the desktop hardware appliance model UTM targeted at SMBs, branch offices, and franchise businesses.
• Rackmount model: HiSecEngine USG6500E series (fixed-configuration), USG6600E series, and USG6700E series (fixed-configuration) are hardware rackmount appliance designed for small and medium-sized enterprises, chain organizations, institutions/campuses, and data centers.
• DC Chassis model: The USG9500 series such as USG9520, USG9560, and USG9580 is an all-in-one data center model that delivers up to 1.92 Tbit/s in firewall throughput to cloud service providers and large-scale enterprise campus networks.
• Software virtual appliance model: The Huawei USG6000V series such as USG6000V1 to USG6000V8 are a software virtual appliance model designed to run in virtual environments, providing virtualized gateway services such as vFW, vIPsec, vLB, vIPS, vAV, and vURL Remote Query.

One of the remarkable features of the Huawei USG UTM solution is the innovative AI capabilities it brings to threat defense. Other features include NGFW, application control, IPS, bandwidth management, URL filtering/web protection, antivirus, VPN, DLP, DDoS mitigation, policy management, among others. All Huawei USG products can be purchased directly from Huawei or via accredited partners.

Who is it recommended for?

These options are aimed at mid-sized and large businesses. Huwawei’s security gateways are particularly suitable for large data centers. The systems are geared towards protecting on-site assets rather than cloud services and they are designed for use by software consumers rather than providers.

11. WatchGuard Firebox UTM

UTM solution from WatchGuard delivers an all-in-one network security platform and protection for mostly small, midsize, and distributed enterprises. It does not directly address large conglomerates or big data centers. It is among the industry’s finest when it comes to performance. WatchGuard is recognized as the only visionary in Gartner’s most recent Magic Quadrant for UTM published in 2018.

Key Features:

• Suitable for small to midsized businesses
• Physical or virtual appliance
• Malware protection

Why do we recommend it?

The WatchGuard Firebox is like a Fortinet FortiGate appliance designed for small businesses. You buy the network device and then choose which security software you want to load onto it. Thus, you assemble your own UTM package. Options include an anti-virus service, application fencing, connection security management, and an intrusion prevention system.

WatchGuard Firebox UTM comes in tabletop, rackmount, and software virtual appliances to give you the flexibility to deploy the solution as a hardware appliance in a physical environment, or as software in a virtual or cloud infrastructure.

• Tabletop Firebox appliances: Just as the name implies, these are small form-factor, high-performance, tabletop hardware appliances ranging from T15 to T80 designed for home office, SMB, and branch office locations.
• Rackmount Firebox appliances: The 1U rack-mount appliance ranging from M270 to M670 is designed for small and growing midsize businesses, and M4600 and M5600 is targeted at distributed enterprise organization.
• Virtual/cloud Firebox solution: FireboxV and Firebox Cloud is the software version of the Firebox UTM with all of the security and performance required for any size organization moving their IT infrastructure to a virtual environment—private or public cloud.

Some of the key features of WatchGuard’s UTM solution include standard IPS, URL filtering, Gateway AV, application control, and antispam, and features for combating advanced threats such as file sandboxing, data loss prevention, ransomware protection, and much more

WatchGuard sells subscriptions for the security software modules for UTM appliances, either individually or as a suite. Your Support license gives you access to updates and enhancements, and all new releases at no cost. All WatchGuard hardware includes a one-year hardware warranty.

All WatchGuard UTM appliances come with a minimum of 90 days subscription and support, which includes software updates and hardware replacement, among other services. WatchGuard also offers one-year, and three-year Basic and Total Security subscriptions to unlock security services. Customers can purchase a subscription to Standard, Plus (24/7), Gold, or Premium that offers a higher priority to your support case. If you are considering WatchGuard UTM solution for your business, the steps below will guide you in your buying decision:

1. Choose your product or appliance type
2. Select your preferred security package—Total Security Suit or Basic Security Suite
3. Contact a WatchGuard certified reseller

Who is it recommended for?

You would need to be interested in protecting a site or sites to use this tool because it is geared towards scanning traffic in and out of a network, so it is no good at protecting cloud assets. WatchGuard produces FireboxV as a virtual appliance for site protection and Firebox Cloud, which is an AWS or Azure-resident software version.

Unified threat management FAQs