On September 29, 2026, CyberRatings.org and NSS Labs published the results of a test of nine cloud network firewalls. Four products earned a "Recommended" rating with security effectiveness of 99.7% or higher. The native AWS and Azure firewalls scored 0%. In the spring 2025 round the hyperscalers also scored zero. Equally important: the methodology is public, and a test like this can be reproduced on a customer's own testbed or in an independent lab, on your own traffic and your own policies.
Zero for AWS and Azure does not mean the firewall blocks no attacks at all. In the 2025 round, AWS Network Firewall blocked 0.59% of exploits and Azure Firewall 55.28% of exploits and 78% of evasion attempts. The final zero is the result of the penalty scheme: a missed evasion at L3 cuts the category score by 50%, at L4 by 20%, at L7 by 1%. The logic is straightforward: if an attack can be hidden with IP fragmentation or TCP segment manipulation, L7 signatures no longer help. Azure also has an architectural reason: the firewall does not decrypt TLS itself, and roughly 80% of internet traffic is encrypted. For the methodology, that is a complete blind spot.
The key principle of the methodology is that security and performance are measured together, on the same testbed and the same DUT. The test starts with "clean" background traffic: HTTP/HTTPS, DNS, SaaS applications, TLS 1.2/1.3 with a real handshake. Exploits are then mixed into that stream, along with the same exploits with evasions applied. In parallel, the test tracks how throughput, connections per second and latency change with IPS, TLS decryption and application identification enabled. This is the same approach as RFC 9411 (IETF, March 2023): KPIs are measured only with security features active, and every disabled feature is recorded in the report.
CyPerf is designed for exactly this scenario. Its agents are deployed in VMs, Kubernetes and directly in AWS, Azure and GCP, so a cloud firewall is tested in its native environment rather than on a lab replica. Every attack receives a blocked or allowed status, and packet captures can be exported and shared with the vendor.
A cloud-native firewall is convenient and often already included in the subscription. But the test shows that as a perimeter defense it does not replace a third-party NGFW. At the same time, a third-party NGFW in the cloud comes at a cost: the license plus every Mbit/s it actually inspects. The product with the highest protection score received a "Neutral" precisely because of price. So choosing a firewall and sizing it is a calculation: how much traffic you need to decrypt, what performance you will get with protection enabled, and what that will cost per month. Without measurements, that calculation rests on assumptions, and an error in either direction means either a gap in protection or overspending.
There is no need to wait for the next public round. The methodology can be reproduced on a customer's testbed or in an independent lab: exploits, L3–L7 evasion techniques, false positives, TLS inspection, performance under a realistic traffic mix. The difference is the profile: your applications, your TLS volume, your policies and your candidates, including cloud-native firewalls side by side with vSRX, VM-Series or FortiGate.
Typical scenarios: compare two or three candidates before buying; check peak load with IPS and decryption enabled; confirm before a migration that the cloud configuration is no weaker than on-prem. The result is measurements on your traffic and packet captures to support the conversation with the vendor.
If you are choosing a cloud NGFW or preparing a migration, contact TEST4NET: we will discuss your traffic profile and propose a test program.