# Managed firewall services

Last reviewed: July 2026

What the service covers, how delivery models differ, and which contract terms decide whether a provider is worth signing.

A managed firewall service transfers firewall operation to a third-party provider under a service-level agreement (SLA). The provider designs policy, processes rule changes, monitors traffic around the clock, applies patches, and responds to incidents. The client keeps approval authority over business rules.

Managed firewall services split across two enforcement models. One model manages firewall appliances at a physical network perimeter. The other enforces policy at a cloud edge, ahead of origin infrastructure. Traffic shape decides which one fits, not company size.

## What managed firewall services include

A managed firewall service is an operating contract, not a product license. Six components appear in almost every scope of work:

- **Policy design.** The provider translates business requirements into firewall rules and documents the reasoning.
- **Rule change management.** Requests follow a defined process with a stated turnaround, not an ad-hoc ticket queue.
- **Continuous monitoring.** A network operations center (NOC) or security operations center (SOC) triages alerts against agreed escalation thresholds.
- **Patch and firmware management.** Updates follow a tested release schedule, with out-of-band handling for critical disclosures.
- **Incident response.** The provider investigates and contains, within the response times the contract specifies.
- **Reporting.** Scheduled reports document rule changes, blocked traffic, and open risks.

The responsibility line matters more than the component list. The provider owns administration and the on-call rotation. The client owns business-rule approval: which traffic should be allowed, and why. A provider that changes access policy without client sign-off has exceeded its mandate.

Everything above is governed by the SLA. Scope described in a sales deck but absent from the SLA is not part of the service.

## Managed next-generation firewall services

A next-generation firewall (NGFW) inspects the content of traffic, not only its source and destination. Traditional firewalls filter on address, port, and connection state. An NGFW adds application-layer inspection on top of that base.

Managed next generation firewall services typically cover five capabilities:

- **Deep packet inspection (DPI)**, which examines packet payloads rather than headers alone.
- **Intrusion prevention (IPS)**, which matches traffic against known attack signatures.
- **Transport Layer Security (TLS) inspection**, which decrypts traffic for inspection and re-encrypts it downstream.
- **Application control**, which permits or blocks specific applications rather than whole ports.
- **Identity-based policy**, which binds rules to users and groups through a directory service.

Underneath those five sits the stateful filtering base: address, port, and connection state. That layer is present in every firewall, next-generation or not.

Each capability requires tuning against real traffic. Signature sets need updating. TLS inspection needs exception lists for traffic that must not be decrypted. Application rules need review as software changes.

An untuned NGFW keeps filtering on ports and addresses. The organization pays for application-layer capability and operates a stateful firewall instead. Next-gen firewall managed services exist mainly to close that gap, which makes tuning cadence a fair question to ask any provider.

## In-house, co-managed, or fully managed

Three operating models are available, and they differ in who holds the console.

| Model | Coverage | Console access | Change turnaround | Suits |
|---|---|---|---|---|
| In-house | Limited by team size and working hours | Client only | Depends on internal capacity | Teams with dedicated security staff and continuous cover |
| Co-managed | Provider covers monitoring and patching | Shared | Provider handles platform changes, client handles application rules | Teams with security skills but no round-the-clock rotation |
| Fully managed | Provider covers all hours | Provider, with client visibility | Defined in the SLA | Teams without a security engineering function |

### A week contains 168 hours

Continuous coverage is the honest dividing line. A single weekday shift covering standard working hours reaches 45 of those 168 hours. The remaining 123 hours are unattended unless someone is rostered for them.

Covering all of them with trained staff, allowing for leave, sickness, and handover, takes several engineers rather than one or two. Firewall managed services exist largely because that arithmetic does not work for small teams.

Co-managed deployments deserve more attention than they usually get. The provider owns the platform, patching, and monitoring. The client keeps console visibility and control of application-level rules. Teams that fear losing sight of their own perimeter usually want this model rather than the fully managed one.

In-house management remains a reasonable choice. A team with security engineers, a documented change process, and genuine on-call rotation does not need a provider. Outsourcing solves a staffing problem, not a competence problem.

## Not sure which model fits your traffic

Coverage requirements look different for a single-site network than for a platform serving many regions. A short review of your current setup usually settles the question faster than an RFP.

[Request a setup review](https://prime-formation.com/)

## Appliance-based or cloud-delivered enforcement

Enforcement location is the decision that shapes everything else. Two models exist, and many organizations run both.

Appliance-based traffic path: users and branch offices, then a firewall appliance at the site perimeter where policy is enforced, then internal systems and the demilitarized zone. One unit per site, and policy is enforced where the hardware sits.

Cloud-delivered traffic path: users in every region, then policy enforced at the nearest edge location, then origin infrastructure. No per-site hardware, and one policy applies wherever traffic arrives.

| Attribute | Appliance-based | Cloud-delivered |
|---|---|---|
| Where policy applies | At a site perimeter | At a global edge, ahead of origin |
| Hardware | One unit per site, with refresh cycles | None |
| Firmware lifecycle | Managed per device | Handled by the platform |
| Multi-region traffic | Backhauled or replicated per site | Enforced at the nearest edge location |
| Typical companions | Demilitarized zone (DMZ), site-to-site virtual private network (VPN), software-defined wide area network (SD-WAN) | Web application firewall (WAF), rate limiting, bot management |

Appliance-based management still fits offices, warehouses, and regulated on-premises systems. A DMZ and a site VPN do not disappear because workloads moved. They serve a different traffic path than a public web platform does.

Cloud-delivered enforcement, sometimes sold as firewall as a service (FWaaS), fits differently. Policy applies at an edge network before traffic reaches origin infrastructure. For a platform serving many regions across hundreds of domains, per-site appliances cannot enforce a consistent policy. Edge enforcement can.

The two models answer different questions. Appliances protect a place. Cloud enforcement protects a service, wherever its users are.

## When a company needs managed firewall services

Six signals reliably precede the decision to hand firewall operation to a provider:

- No trained coverage outside business hours, so alerts wait until morning.
- A volumetric distributed denial of service (DDoS) attack timed to a peak traffic event.
- Credential stuffing against public application programming interfaces (APIs).
- Automated traffic distorting analytics and inflating acquisition cost.
- An audit finding on firewall change control.
- Appliance support contracts approaching expiry with no upgrade plan.

Rule sprawl sits underneath most of these. Firewall rules accumulate faster than anyone removes them. Old rules stay because nobody knows what depends on them. Shadowed rules sit behind broader rules and never match, while permissive temporary rules quietly become permanent.

The result is a policy nobody fully understands, which widens exposure and surfaces during an audit rather than during an attack. Managed firewall services address this through scheduled review, not through better technology.

Not every organization needs one yet. A single-site company with a stable ruleset and one competent administrator can defer the decision honestly.

## Digital Entertainment, FinTech, and digital-native platforms

Threat patterns differ enough by vertical that default vendor templates rarely fit. Two verticals show this clearly.

**Digital Entertainment.** Digital Entertainment platforms, including iGaming operators, face volumetric attacks timed to live events, when downtime costs most. Promotion abuse and affiliate fraud arrive as traffic that resembles legitimate players, so signature-based rules miss it. These operators frequently run hundreds of domains under one brand estate, which makes per-domain policy management impractical.

**FinTech.** FinTech platforms face credential stuffing and API abuse against authentication and payment endpoints. They also carry regulatory obligations that shape firewall requirements directly. The [Payment Card Industry Data Security Standard](https://www.pcisecuritystandards.org/) requires documented firewall rule review and change control. In the European Union, the [Digital Operational Resilience Act (DORA)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj) sets operational resilience requirements for financial entities and their technology providers.

The practical distinction is tuning. Rate limits and bot rules calibrated against measured traffic behave differently from vendor defaults, because abuse in these verticals resembles normal use. A provider that has not seen the traffic pattern before will tune it wrong in both directions: blocking real customers, or missing coordinated abuse.

## Traffic that looks legitimate is the hard case

Promotion abuse, credential stuffing, and coordinated automation defeat default rule sets because they resemble ordinary use. Tuning against measured traffic is the part that takes experience.

[Discuss your traffic profile](https://prime-formation.com/)

## How managed firewall pricing is structured

Managed firewall providers price on four models, and the model shapes what a quote hides.

| Pricing model | What it suits | What it obscures |
|---|---|---|
| Per device | Stable appliance estates | Rule complexity on any single device |
| Per site | Multi-branch networks | Wide variation in traffic volume between sites |
| Per user | Predictable headcount | Traffic that scales with customers, not staff |
| Bandwidth-tiered | Public-facing platforms | Cost behavior during a traffic spike or attack |

Five variables move a quote more than anything else: number of sites, ruleset complexity, log retention period, incident response tier, and the volume of rule changes included before overage applies.

Quotes commonly exclude items buyers assume are covered. Hardware refresh sits outside most management fees. Emergency response beyond the contracted tier is often billed separately. Log retention past the base term costs extra, which matters when an audit requires longer history. Third-party license increases usually pass through.

Two quotes are not comparable until response tier, retention period, and included change volume are held constant. Normalize those three first, then compare totals. A cheaper contract with a business-hours response tier is a different product, not a better deal.

## How to choose a managed firewall provider

The SLA answers the questions a sales conversation will not. Read for these clauses specifically:

- Incident response time, stated in clock hours rather than business hours.
- Change turnaround, separated into standard and emergency requests.
- Escalation contacts, named by role, with a defined path beyond first line.
- Service credit, with the mechanism for claiming it.
- Change management, documented as a process rather than described as a practice.
- Exit and data portability, covering configuration export and log handover.

Response measured in business hours is the clearest weak signal. An eight-hour target on a business-hours clock can mean the next working day. Attacks do not schedule themselves accordingly.

Vendor credentials are worth verifying rather than accepting. Many providers resell a platform and route support back to the vendor, which leaves the client managing two relationships during an incident. Ask which party holds the operational relationship, and what the provider does that the vendor's own support does not.

Partner-model providers sit between the client and a platform vendor, and the arrangement varies more than the marketing suggests. A reseller invoices and hands support back. An operating partner configures the platform, holds the escalation, and stays accountable for the outcome. Establish which one you are talking to before the contract, not during the first incident.

## Onboarding and migration

Migration is where managed firewall projects break traffic, so the sequence matters. A defensible onboarding runs in seven steps:

1. **Discovery.** Inventory assets, traffic paths, and existing enforcement points.
2. **Ruleset audit.** Document every existing rule, its purpose, and whether anything still depends on it.
3. **Traffic baseline.** Measure normal behavior before changing anything, so anomalies are recognizable later.
4. **Policy design.** Draft the target ruleset, mapped back to the audit findings.
5. **Monitor mode.** Run the new policy in log-only mode, matching traffic without blocking it.
6. **Cutover.** Switch to enforcement inside a maintenance window, with a documented rollback path.
7. **Hypercare.** Watch closely for a defined period, with faster response than the steady-state SLA.

Monitor mode is the step that prevents outages. Running the policy without enforcement surfaces false positives before they block a customer. Skipping it saves a few weeks and risks blocking payment traffic on day one.

Timelines vary with ruleset size and how quickly the client organization approves changes. A provider that quotes a fixed duration before seeing the ruleset is guessing.

The client approves the final policy before enforcement begins. That gate belongs in the contract, not only in the project plan.

## Ongoing operations and compliance evidence

Steady-state operation is what the monthly fee actually buys, and it runs on a cadence.

- **Continuous.** Alert triage happens continuously, with escalation thresholds agreed in advance so routine noise does not reach the client.
- **Scheduled and out-of-band.** Firmware and signature updates follow a tested release schedule, with out-of-band patching when a critical vulnerability is disclosed and actively exploited.
- **Typically quarterly.** Rule review happens on a scheduled cycle, removing shadowed, expired, and overly permissive rules.

Scheduled rule review produces something beyond hygiene. The review record is audit evidence: who changed which rule, when, with whose approval, and why. PCI DSS assessments ask for exactly that. DORA-scope entities need equivalent records covering their technology providers. Organizations that review rules only when an auditor asks end up reconstructing history rather than presenting it.

Reporting should show rule changes made, traffic blocked by category, incidents handled with resolution times, and risks the provider has flagged but the client has not yet approved fixing. That last category reveals whether a provider is being straight with its client.

## Frequently asked questions

### What is included in a managed firewall contract?

A managed firewall contract covers policy design, rule change management, continuous monitoring, patch and firmware management, incident response, and scheduled reporting. The service-level agreement defines response times, change turnaround, and escalation. Scope mentioned in a proposal but missing from the SLA is not contractually included.

### What is a co-managed firewall?

A co-managed firewall splits operation between provider and client. The provider owns the platform, patching, and monitoring. The client keeps console access and control of application-level rules. Teams with security skills but no round-the-clock rotation usually choose this model over fully managed service.

### Does a managed next-generation firewall inspect encrypted traffic?

A managed NGFW inspects encrypted traffic through TLS inspection, which decrypts, examines, and re-encrypts sessions. Inspection requires certificate deployment and an exception list for traffic that must not be decrypted, such as banking or health endpoints. Without those exceptions, TLS inspection causes application failures.

### How long does managed firewall onboarding take?

Onboarding duration depends on ruleset size, the number of enforcement points, and how quickly the client approves changes. The monitor-mode phase usually sets the floor, because it must run long enough to capture normal traffic cycles. A provider quoting a fixed timeline before auditing the ruleset is estimating without evidence.

### Do we still need a hardware firewall if our workloads run in the cloud?

Offices, warehouses, and on-premises systems still need perimeter enforcement, so appliances remain relevant alongside cloud-delivered policy. Cloud enforcement protects public-facing services at the edge, while appliances protect physical sites. Most organizations with both traffic types operate both models rather than replacing one with the other.

### How often should firewall rules be reviewed?

Quarterly review is the common cadence, and PCI DSS requires documented rule review and change control for in-scope environments. Review removes shadowed, expired, and overly permissive rules before they widen exposure. The review record also serves as audit evidence, which is harder to reconstruct later than to maintain continuously.

## Three questions decide the shortlist

Which enforcement model matches your traffic, which delivery model matches your team, and whether the SLA states response in clock hours. Answer those and most vendor conversations get shorter.

[Get a senior technical opinion](https://prime-formation.com/)

---

Managed Firewall Services. An independent reference for technical decision makers. No pricing figures are published.

[About](/about/) · [Contact](/contact/) · [Privacy](/privacy/)