As AI reshapes cloud traffic and the threat landscape, independent testing of nine leading cloud firewalls shows that protection, performance, and cost no longer have to be traded against each other.
The perimeter didn’t disappear when enterprises moved to the cloud. It multiplied. Today’s applications run across AWS, Azure, Google Cloud, and private data centers, and a growing share of them now call AI models and services. Every one of those environments needs a firewall that can inspect traffic and stop threats without slowing traffic or inflating cloud costs. Understanding how well the many firewall options on the market perform in each of these dimensions is important, but knowing if they force effective trade-offs between protection, performance, and cost, under realistic conditions, is what really matters.
The just-released 2026 NSS Labs Comparative Test Report on cloud network firewalls, updating their April 2025 report, offers an independent side-by-side look at how leading solutions actually perform under the same rigorous conditions. Download a complimentary copy of the full NSS Labs test results here. Below I give a quick overview and point to some contextual factors to help interpret the results and understand the current world in which cloud firewalls operate.
A Level Playing Field for Nine Leading Solutions
NSS Labs evaluated nine cloud firewall offerings, spanning cloud-native services and third-party platforms: Amazon Web Services, Check Point, Cisco, Fortinet, Google Cloud Platform, HPE Juniper Networking, Microsoft Azure, Palo Alto Networks, and Versa.
Each solution went through a battery of tests and evaluation across security effectiveness, performance, false-positive management, TLS support, stability and reliability, and cost of the tested configuration. NSS Labs then plotted each vendor on its Security Value Map. The result is a clear picture of which solutions deliver strong protection at a reasonable cost, and which fall short.
Cloud Firewall Challenges in the AI Era
NSS Labs didn’t test AI traffic specifically. But read against today’s market, the report’s test categories map closely onto the pressures AI is putting on cloud security. Things I believe are important to keep in mind in evaluating one’s firewall requirements are:
AI is driving traffic up, and nearly all of it is encrypted. AI workloads move large volumes of data between applications, models, and APIs, and autonomous agents are adding machine-to-machine traffic at a remarkable pace. Virtually all of this runs over TLS. NSS Labs reflected this encrypted reality by testing performance against a mix of 95% TLS and just 5% plain HTTP. Decrypting and inspecting traffic takes heavy compute resources, and it is where many firewalls lose most of their throughput.
Attackers are using AI to evade defenses. Generative AI makes it cheap to produce endless variants of malware and exploits, each disguised a little differently. Blocking a known threat is “table stakes.” The harder test is whether a firewall still catches it once it has been obfuscated, fragmented, or otherwise altered. Evasion resistance is what separates solutions that pass a checklist from those that protect in the real world.
Shadow AI makes visibility essential. Employees and applications increasingly send sensitive data to external AI services, and they do it over encrypted connections. Organizations can only see and govern that traffic if their firewall can decrypt and inspect it at speed.
In the cloud, performance is cost. Cloud firewalls consume compute that is billed by consumption. A solution that delivers more inspected throughput per instance needs fewer instances and results in a smaller bill at the end of the month. With AI initiatives competing for the same budgets, efficiency is a financial requirement, not just a technical one, and the price-per-Mbps metric deserves close attention.
Stability matters too. A firewall that fails under load or when it meets malformed traffic creates exposure precisely when the network is most stressed.
Versa NGFW: Recommended for the Second Year Running
Against this demanding backdrop, Versa NGFW earned NSS Labs’ top “Recommended” rating for the second consecutive year. The results show a solution that doesn’t force customers to choose between security, speed, and cost:
- High Security Effectiveness. Versa achieved an overall Security Effectiveness rating of 99.91%, scoring a perfect 100% in six of the eight security tests: Routing & Access Control, Stability & Reliability, TLS/SSL support, Exploit Evasion Resistance, Malware Block Rate, and Malware Evasion Resistance.
- Fastest Rated Throughput. Across the tested mix of 95% encrypted TLS and 5% HTTP traffic, Versa delivered a rated throughput of 3,201 Mbps, which was 66% to 1,382% faster than every other vendor tested.
- Highly Cost-Effective. Versa NGFW posted the second-lowest cost per Mbps among the nine vendors, turning its performance lead into real savings for customers.
These results speak directly to the pressures above. Leading throughput on a heavily encrypted traffic mix shows Versa can absorb growing AI-driven volumes without giving up deep inspection. Perfect scores on exploit and malware evasion resistance show its protection holds up against the disguised, rapidly mutating attacks AI makes possible. A 100% TLS/SSL score means encrypted traffic, including traffic bound for AI services, doesn’t become a blind spot. And a low cost per Mbps shows that efficiency turns into value customers can see in their cloud invoice.
What This Means for Enterprise Security and Network Leaders
Cloud firewall decisions often come down to perceived trade-offs: more inspection means less speed, and more speed means more cost. As AI raises traffic volumes and the sophistication of attacks, those trade-offs only get sharper. The 2026 NSS Labs results show they aren’t inevitable.
When evaluating options, leaders should ask vendors hard questions. How does the firewall perform with decryption turned on? How does it handle evasion techniques? What does protected throughput actually cost per Mbps in production, and how will that scale as AI traffic grows?
Independent testing provides a foundation for getting to the answers.
Download a complimentary copy of the 2026 NSS Labs Comparative Test Report for Cloud Network Firewalls to review the full results for all nine vendors.
Kevin Sheu leads product marketing for Versa's Universal SASE portfolio, a role he stepped into in 2023. He previously held senior product marketing and product management roles at Bitglass, Vectra, Okta, FireEye, and Barracuda Networks, and began his career as a management consultant at Booz Allen Hamilton and L.E.K. Consulting. He holds bachelor's and master's degrees in computer science from Johns Hopkins University and an MBA from the MIT Sloan School of Management.