Miercom ran a structured, multi‑month lab assessment to understand how the Check Point Enterprise and Hybrid Mesh Firewall performs against modern threats, and then compared it with Cisco, Fortinet, Palo Alto Networks, and Zscaler.

Key elements of the test design:

• Duration: Continuous testing over 90 days.
• Vendors compared: Check Point, Cisco, Fortinet, Palo Alto Networks, Zscaler.
• Deployment models covered:
  • On‑premises NGFW
  • Cloud network firewall
  • Secure Service Edge (SSE) / Firewall‑as‑a‑Service (FWaaS)

Threat and file coverage:

• Malware samples: Repeated downloads of sets of 500 malicious files at a time from VirusTotal, always using the most recently submitted samples with 25+ engines flagging them as malicious.
• File types tested: DOCX, XLSX, PDFs, EXEs, PowerShell and Bash scripts, APKs, DLLs, and archived files (for NGFW); PDFs, EXEs, PowerShell, and DLLs (for SSE).
• Zero 1 Day malware: Focus on malware that was no more than one day old to test protection in the first 24 hours after discovery.
• Variant creation: Samples were slightly modified to change their hash without changing the payload, forcing engines to handle new variants rather than simple known signatures.

Security engines evaluated:

• Anti‑virus and anti‑malware
• Anti‑bot
• URL Filtering (URLF)
• Sandboxing
• AI/ML‑powered detection
• Phishing protection (including AI‑based content analysis)

Additional test components:

• Intrusion Prevention System (IPS): Used Keysight Breaking Point to simulate real‑world traffic and exploits, focusing on high and critical CVEs (CVSS 7–10) from 2022–2024.
• Phishing URLs: Recently discovered (less than 24‑hour known) phishing and malicious URLs, including dynamic detection using AI‑based analysis of page content, logos, spelling, redirects, and other signals.
• CISA KEV analysis: Reviewed each vendor’s presence in the CISA Known Exploited Vulnerabilities (KEV) Catalog to understand both exposure and coverage.
• Advanced offensive testing: Scenario‑driven tests to see if the devices could prevent sensitive data (e.g., patterns like credit card or tax IDs) from leaving the network, while keeping false positives low.

All gateways were configured according to each vendor’s documented best practices, and tests were run concurrently across vendors to keep conditions consistent.

The assessment shows that Check Point’s Enterprise and Hybrid Mesh Firewall is designed to help organizations rethink how they handle the most dangerous early phase of attacks—the first 24 hours.

Zero 1 Day malware prevention (first 24 hours):

• Check Point prevented 99.9% of new malware (no more than one day old) across a broad mix of file types: DOCX, XLSX, PDFs, EXEs, PowerShell and Bash scripts, APKs, DLLs, and archives.
• Comparative prevention rates in this Zero 1 Day test:
  • Check Point: 99.9% prevention
  • Zscaler: 90.9% prevention
  • Fortinet: 87.7–87.8% prevention
  • Cisco: 67.1% prevention
  • Palo Alto Networks: 62.7% prevention
• Some vendors also had a portion of threats in “detect‑only” mode (identified but not blocked). For example, Palo Alto Networks showed 25.2% detect‑only and Fortinet 5.7% detect‑only in the Zero 1 Day test.

This early block capability matters because the report notes that the first 24 hours of a malware campaign are the most dangerous, when attacks can spread quickly and cause operational disruption.

Phishing URL prevention (first 24 hours):

• Check Point achieved a 99.74% prevention rate on newly discovered phishing and malicious URLs, missing only 1 URL in the test set.
• Comparative phishing prevention rates and missed URLs:
  • Check Point: 99.74% prevention, 1 missed URL
  • Palo Alto Networks: 98.69% prevention, 5 missed URLs
  • Fortinet: 97.39% prevention, 10 missed URLs
  • Zscaler: 91.12% prevention, 34 missed URLs
  • Cisco: 55.87% prevention, 169 missed URLs

How Check Point approaches phishing differently:

• Uses a combination of reputation‑based checks and AI‑driven content analysis.
• AI models analyze elements such as corporate logos, icons, suspicious form fields, irregular spellings, redirects, and other obfuscated components.
• This dual approach is designed to keep up with phishing sites that frequently change IP addresses and domains to evade static reputation lists.

Remote user / SSE malware prevention:

• For Secure Service Edge (SSE) / FWaaS scenarios, Check Point recorded a 99% total block rate for malware targeting remote users.
• Comparative SSE malware block rates:
  • Check Point: 99% total block rate
  • Cisco: 96% total block rate
  • Fortinet: 84% total block rate
  • Zscaler: 83% total block rate
  • Palo Alto Networks: 74% total block rate

For security and IT leaders, these results suggest that Check Point can help reimagine early‑stage threat handling across both on‑prem and remote user scenarios, with a particular focus on blocking new malware and phishing attempts before they gain a foothold.

The report highlights two areas that matter for long‑term resilience: how well the IPS blocks real‑world exploits, and how often the vendor’s products appear in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Intrusion Prevention System (IPS) effectiveness:

• Testing used Keysight Breaking Point to simulate real‑world traffic and exploits.
• Focus was on high and critical‑severity CVEs (CVSS 7–10) published between 2022 and 2024.
• Average IPS block rates:
  • Check Point: 98.0% average block rate
  • Fortinet: 94.6% average block rate
  • Palo Alto Networks: 91.6% average block rate
  • Zscaler: 72.5% average block rate
  • Cisco: 42.6% average block rate

For organizations, this IPS performance is relevant to stopping exploit‑driven attacks that target known vulnerabilities in applications and services.

CISA KEV exposure and coverage:

• The CISA KEV Catalog lists vulnerabilities that are actively exploited in the wild and should be prioritized for remediation.
• Miercom looked at two aspects for each vendor:
  • The number of vendor‑specific CVEs in the KEV catalog (indicating known exploited issues in that vendor’s products).
  • The number of KEV CVEs covered/mitigated by the vendor’s solutions.
• Check Point’s KEV profile:
  • 1 known exploited vulnerability listed for Check Point products.
  • ~860–866 KEV CVEs covered (the report references both 860 and 866, indicating broad coverage).
• Other vendors’ KEV figures (vendor‑specific KEVs vs. coverage):
  • Palo Alto Networks: 11 known exploited vulnerabilities; coverage for ~745 KEV CVEs.
  • Fortinet: 16 known exploited vulnerabilities; coverage for ~830 KEV CVEs.
  • Cisco: 21 known exploited vulnerabilities; coverage for ~756 KEV CVEs.
  • Zscaler: Not directly comparable here, as a fully managed SASE service that does not report KEVs in the same way.

From a risk management perspective, Check Point’s combination of a 98.0% IPS block rate and only 1 vendor‑specific KEV in the CISA catalog, alongside coverage for roughly 860+ KEV CVEs, positions it as a way to reshape how organizations think about reducing exposure to actively exploited vulnerabilities.