Security suites, WatchGuard Cloud and local management, jurisdiction, end-of-life policy, exploit record, FlexPay billing and the retired on-box DLP, from WatchGuard's own documents, each with its source.
| Topic | WatchGuard — from their own documents | Zedmos |
|---|---|---|
| Licensing model | Firebox hardware plus a Standard Support, Basic Security Suite or Total Security Suite subscription; Total Security Suite is mandatory on the M270 to M670 rackmount line, FireboxV and Firebox Cloud. Resellers list terms from one to five years.Sources: watchguard.com: security services · WatchGuard help: Firebox Cloud licensing | Software, licensed per firewall. It installs as a package on the OPNsense or pfSense CE box you already run, or from an image as ZedmosOS on x86 hardware you own. No hardware in the licence. |
| Management console | WatchGuard Cloud for cloud-managed Fireboxes, or WatchGuard System Manager and Dimension on-premises for locally managed ones; the WSM Management Server went into maintenance mode in December 2024. Every Firebox is activated against a WatchGuard account, and adding one to WatchGuard Cloud needs an active Basic or Total Security Suite. WatchGuard Cloud is multi-tenant and multi-tier, up to five tiers deep.Sources: WatchGuard help: cloud vs local management · WatchGuard blog: Firebox management options · WatchGuard help: service providers · WatchGuard help: device licenses | One console, multi-tenant from the first firewall. Run it as a container on your server under your domain, or use ours at console.zedmos.com, operated from Frankfurt. If it is unreachable, every firewall keeps enforcing. |
| Jurisdiction | WatchGuard Technologies, Inc., Seattle, Washington, majority-owned by the private-equity firm Vector Capital since April 2022. WatchGuard Cloud data is hosted in the customer-selected AWS instance in Frankfurt, the United States or Japan, operated by WatchGuard Technologies, Inc., its subsidiaries and the sub-processors AWS and Microsoft; EU–US transfers rely on the Data Privacy Framework and standard contractual clauses.Sources: WatchGuard privacy policy · WatchGuard data transfers FAQ · Vector Capital majority ownership, April 2022 | A German company. A self-hosted console keeps firewall logs, personal data under the GDPR (CJEU C-582/14), in your own controllership. Our licence and threat-intelligence services run in Frankfurt. |
| Hardware lifecycle | End-of-Sale may come up to five years before End-of-Life and is announced at least 60 days ahead; software downloads stay available for 90 days after End-of-Life. The Firebox T35, T55 and T70 reached End-of-Life on 31 December 2025; the M590 and M690 went End-of-Sale on 1 June 2026 and the M290 on 1 August 2026, with End-of-Life in July 2031.Sources: WatchGuard end-of-life policy · WatchGuard blog: T35/T55/T70 end of life · WatchGuard blog: M590/M690 end of sale · WatchGuard blog: M290 end of sale | The support period is the software's: at least five years from placing on the market (CRA Art. 13(8)), published, and independent of any box. The hardware is yours to keep or replace. |
| Exploit record | 4 entries in the CISA Known Exploited Vulnerabilities catalogue (version 2026.09.11), 1 of them flagged for known ransomware use, all concerning Firebox or XTM appliances. None were added in 2026.Sources: CISA KEV — WatchGuard | 0 entries. Published, with our CRA class, an SBOM per release, the disclosure path and the support period, on a page that stays up whatever the number becomes. |
| MSP billing | WatchGuardONE with FlexPay: month-to-month subscriptions billed monthly, term contracts, or prepaid points. The MSSP Prepaid Points programme is open to WatchGuardONE MSSPs only and deducts points per managed device and service at the start of each month. No minimum commitment is published.Sources: WatchGuard help: purchase options · watchguard.com: FlexPay | MSP tier: multi-tenant, unlimited firewalls, billed monthly in arrears on the month-end count. Your brand on the console and on the box. |
| AI and data loss prevention | IntelligentAV, a machine-learning anti-malware engine, runs on the Firebox; ThreatSync (XDR), cloud sandboxing and DNS filtering are delivered from WatchGuard Cloud. The on-box Fireware Data Loss Prevention service was deprecated and removed from Firebox feature keys on 26 February 2025; the remaining data-control product is an endpoint module available in sixteen European countries.Sources: watchguard.com: IntelligentAV · WatchGuard help: about ThreatSync · WatchGuard blog: end of life of Fireware DLP · watchguard.com: Data Control | DLP and the AI gateway run on the box. 61 content detectors; prompts, uploads and files checked before they leave; the model that decides runs on your hardware. |
| Price changes, 2025–2026 | No list-price increase for 2025 or 2026 was found in public sources. The most recent published action is a renewal-price increase on the T35, T55 and T70 family effective 1 October 2024.Sources: WatchGuard blog: price adjustment, 2024 | No hardware in the price. The licence is not tied to an appliance list, so a hardware price change does not propagate into a renewal. |
| What WatchGuard has that Zedmos does not | More than 25,000 MSPs and 1.5 million customers after thirty years in business, a CRN 5-Star partner-programme rating for the tenth consecutive year, the WatchGuard Threat Lab and its quarterly Internet Security Report, 24/7 support, an MDR line of its own, and a place among the Niche Players in the 2025 Gartner Magic Quadrant for Hybrid Mesh Firewall.Sources: WatchGuard press release: Total MDR, June 2025 · WatchGuard blog: CRN 5-Star, 2026 · SDxCentral on the 2025 Hybrid Mesh Firewall Magic Quadrant | None of those. A small German vendor with a published exploit record, a console you own, and a licence that does not care which box it runs on. |
WatchGuard has thirty years in the market and an MSP base Zedmos does not. The comparison is about how the two products are licensed, where they are managed from, under whose law, and what the public record says. Every claim on the left carries its source; if one is wrong, write to us and it will be corrected.
Checked: 2026-09-13
Zedmos is compared with WatchGuard above on licensing, management, jurisdiction, exploit record and what each is delivered as. Zedmos is software on hardware you own, managed from a console you host yourself or use hosted from Frankfurt, licensed per firewall, from a German vendor under EU law, with zero entries in the CISA Known Exploited Vulnerabilities catalogue. The last row of the table is what WatchGuard has that Zedmos does not.