A firewall nobody manages is furniture.
Most small businesses own a firewall. Far fewer can say who last reviewed its rules, whether its firmware is current, or what it logged last Tuesday. Managed means those questions have answers.
The most dangerous rule on any firewall is the temporary one from 2023.
Every unmanaged firewall we inherit tells the same story: an any-any rule someone added during an outage, a vendor’s remote-access hole that outlived the vendor, port forwards to servers that no longer exist. None of it malicious — all of it reachable from the internet. Management is not the box; it is the discipline of knowing what every rule is for and deleting the ones that no longer have an answer.
The box is the cheap part.
Six obligations that turn a firewall from purchased hardware into an operated control. This is the checklist we run against every perimeter we take over.
| The obligation | What we do | Unmanaged reality |
|---|---|---|
| 01Know every rule | What we doEach rule carries an owner, a reason and a date; unknowns get investigated, then deleted | Unmanaged realityRules accrete for years; nobody dares touch them |
| 02Patch the firmware | What we doUpdates applied in maintenance windows, release notes actually read | Unmanaged realityShipped firmware, three CVEs old, internet-facing |
| 03Watch the logs | What we doShipped off-box, retained, and correlated with endpoint telemetry through XDR | Unmanaged realityLogs rotate into oblivion on the device itself |
| 04Close the temporary | What we doExceptions get expiry dates at creation — they die by default | Unmanaged reality“Temporary” becomes permanent the day it is forgotten |
| 05Do VPN properly | What we doPer-user identity with MFA; access ends when employment does | Unmanaged realityOne shared key, known to every ex-employee |
| 06Segment what matters | What we doGuest, staff and payment traffic separated at the perimeter | Unmanaged realityOne flat network; the thermostat can reach the file server |
Segmentation is where this layer earns most for retail and clinics — the design work is a one-time project that shrinks PCI scope and audit effort permanently. What a managed firewall includes, and why patch lag on an unmanaged one is the real risk, is set out in what a managed firewall actually is. Segmentation earns most in retail and clinics.
The ones people actually ask.
If yours isn’t here, ask it directly — you’ll get an answer from an engineer, not a form letter.
Not if it is supportable. We take over management of decent existing hardware and tell you plainly when it is end-of-life or undersized. Replacement happens on a lifecycle plan, not as a surprise.
Because the firewall then shares telemetry with the endpoint agent — a machine behaving badly can be cut off at the perimeter automatically. Single-vendor correlation is worth more than a marginally better standalone box.
Configuration is backed up off-box, so recovery is hardware swap plus restore rather than reconstruction from memory. For sites where hours of downtime are unacceptable, high-availability pairs are quoted at the design stage.
Monitoring and alerting run continuously as part of the baseline. Human overnight response follows your support tier — and if the answer needs to be “someone acts at 3am,” that is the MDR conversation.
Yes — per-user VPN bound to your identity provider with MFA, so access is granted and revoked with the account. Shared pre-shared keys are the first thing we remove.
Next
Every rule has a reason.
Twenty minutes. Tell us who last reviewed your firewall rules — if the answer is “not sure,” the first audit will be interesting reading.