In this article
A purchased firewall is a device the company installs and then manages on its own; a managed firewall is the same kind of device configured, updated, monitored and operated by an external team, for a monthly fee and with an SLA. The difference is not in the box: it is in who reads the alerts and reacts when one of them is serious. We compare the two models without assuming one size fits all.
"We have a firewall" — and then what?
It is the line we hear in almost every first meeting, and it is usually true: there is a device from a security vendor in the rack. What matters is what comes next. Who configured it? When was it last updated? Who receives the alerts?
Four things that do not come in the box
An enterprise firewall filters traffic between the internet and the network, inspects connections, blocks risky categories, terminates VPNs and separates segments. To do this well it needs:
- Tailored configuration The factory rules are generic.
- Updates To the system and the threat signatures, on a regular basis.
- Active subscriptions They expire without visible warning and inspection stops.
- Someone paying attention Who reads the logs and reacts to alerts.
Without these four, a firewall is an expensive router.
The picture of a purchased firewall
The company pays for the equipment and subscriptions, someone configures it at installation and responsibility becomes internal. The advantages are a known upfront cost, ownership and no monthly fee beyond the subscriptions.
What we often find: configuration never reviewed, firmware two or three years old, subscriptions expired months ago (traffic still passes, but is no longer inspected), rules added "to fix a problem" and never removed, and alerts going to a mailbox nobody opens. The equipment is not to blame; what is missing is management.
The picture of a managed firewall
The equipment — owned by the company or included in the service — is operated by an external team. Updates and subscriptions are taken care of, alerts are read by people, rules are reviewed and incident response has defined times. Knowledge does not disappear when a technician leaves.
The downsides are the monthly cost and dependence on the provider, which is controlled by contract: a written SLA, with the credentials and configuration owned by the company.
Six criteria compared
| Criterion | Purchased | Managed |
|---|---|---|
| Cost | High upfront, low monthly | Low upfront, higher monthly; after three years the totals converge |
| Updates | Depend on someone remembering | Included, in scheduled windows |
| Alerts | Are generated | Are dealt with — a VPN alert at 3 a.m. is only worth something if someone sees it at 3.05 |
| Configuration | Stays as it was installed | Reviewed when the business changes |
| Incidents | Depends on finding someone who knows | Written response times |
| Knowledge | In one person | Documented and held by a team |
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
Which to choose
- Purchased — when there is an in-house team with the skills and time for security, usually above 150 to 200 workstations, or a simple, stable environment without remote working, VPN or exposed services.
- Managed — when nobody in the company is dedicated to security, when there is remote working, VPN or published services, when NIS2 or a cyber insurance policy requires ongoing management, or when an incident has already shown that alerts were not being read. This is the case for most Portuguese SMEs with 10 to 150 workstations.
What to demand in a managed firewall contract
- Ownership Equipment and configuration belong to the company, with administrator credentials in a sealed envelope or digital vault.
- Monthly report What was blocked, updated and changed.
- Top priority For security events, with written response times.
- Rule review At least twice a year.
- Clean exit If the contract ends, the firewall keeps working and the company keeps everything.
These are the rules of our managed firewalls: installation, configuration and monitoring by DataRoad, with alerts handled by people.
Two published projects
FreshDesign — a next-generation firewall with SSL VPN for remote working, load balancing and failover across two internet connections, real-time alerting and ongoing maintenance. Read the FreshDesign project.
Ventask — more than 350 workstations, with firewalls, switches and access points managed under IT Unlimited. Read the Ventask case.
Frequently asked questions
We have already bought a firewall. Can it become managed?
In most cases, yes. We assess the equipment, firmware and subscriptions; if it is within the manufacturer's lifecycle, we take over its management. If it is at end of life, we propose a phased replacement.
Isn't the ISP's router enough?
It separates the network from the internet, but it does not inspect traffic, filter categories, manage VPN with MFA or segment the network. In a business, it is the first piece of equipment to replace.
How much does it cost?
It depends on throughput, users and active services. Under IT Unlimited contracts, firewall management is included in the monthly fee; we do not provide it as a standalone service outside a contract.
Is it enough to comply with NIS2?
It is one of the measures. NIS2 also calls for access management, backups, incident response and training; see what NIS2 requires in Portugal.
Next step: the real state of your firewall
We check firmware, subscriptions, rules and alerts and tell you in writing what is exposed, with no obligation.
More than 10 workstations · support contract · remote, on-site and telephone support. Call +351 211 459 950* or write to sales@dataroad.pt.
*Call to a Portuguese landline.
