What happened:

• Fully patched and end of life SMA 100 appliances were actively exploited for several months.
• Threat actors, including UNC6148 and Akira linked ransomware groups, targeted SonicWall VPN infrastructure.
• Exploitation likely included credential theft, one time password seed theft and MFA bypass techniques.
• Multiple vulnerabilities were chained to achieve remote code execution and session hijacking.
• CISA and other agencies issued warnings about active exploitation against SonicWall appliances.

Operational impact on MSPs:

• Weekly cycles of SSL VPN policy resets, password resets and MFA hardening.
• Late night and weekend war room calls to analyze logs and investigate suspicious activity.
• Client escalations about why patched systems were still exposed to exploitation.
• Internal teams forced to prioritize SonicWall incidents over standard service delivery.

What happened:

• SonicWall confirmed unauthorized access to configuration backups stored in its cloud backup system.
• These backups included firewall policies, VPN configuration secrets and administrative credentials.
• Partners were forced to rotate credentials and secrets across many tenants.

A mid crisis rebuild caused significant partner friction:

• A new Service Provider Plan launched while MSPs were still handling incident fallout.
• A new Managed Security Services division was created in the same timeframe.
• The stack felt disconnected, combining CSE, Capture Client, SES EDR and MSS workflows.

Endpoint strategy confusion:

• Capture Client is a SentinelOne OEM product and requires separate processes and migration overhead.
• The new SES EDR appears to be Falcon based, which adds a second OEM agent to the ecosystem.
• MDR requires portal migration and process changes.
• Partners had to rebuild scripts, automation and operations.

Price increases at the wrong time:

• Gen 6 and Gen 6.5 renewal SKUs increased by up to 20% on May 1, 2025.
• Partners perceived that they were paying more during the most difficult year in recent memory.

Individually, each incident strained partners. Combined, they created deep structural frustration that remains today.

• Loss of client trust due to recurring SonicWall related incidents.
• Loss of weekends to repeated emergency response cycles.
• Loss of margin because emergency work could not be fully billed.
• Loss of confidence in SonicWall’s engineering velocity, roadmap and QA.

Overview:

SonicWall remote access is still based on SSL VPN delivered through the firewall. This model creates inherent risk because VPN endpoints are among the most attacked surfaces on the internet.

• SSL VPN remains one of the most targeted initial access vectors for ransomware operators.
• SonicWall requires open inbound listener ports on the firewall, which attackers continuously probe and attempt to exploit.
• A successful SSL VPN exploit provides access to the management plane, which allows modification of policies, NAT rules and access control.
• VPN sessions typically drop users into broad internal networks that contain high value protocols such as RDP and SMB.

Partner impact:

• Constant tuning of SSL VPN policies and MFA requirements.
• High incident load caused by attempted credential stuffing and brute force attacks.
• Difficulty maintaining secure remote access without disrupting end users.

Overview:

SonicWall’s visibility depends on network traffic passing through the firewall. In a remote first world, most traffic bypasses the firewall entirely, which means SonicWall cannot see or control SaaS or web activity.

• Remote workers on home WiFi, hotels or mobile networks operate outside SonicWall inspection.
• Cloud applications such as Microsoft 365, Google Workspace and Salesforce do not traverse the SonicWall appliance.
• SonicWall cannot enforce URL filtering, application controls, SaaS policies or DLP when users are off network.
• Modern attacks such as token theft, cookie replay and adversary in the middle phishing live inside browser and SaaS workflows, not at the network boundary.

Partner impact:

• Difficulty tracking SaaS access behavior, especially when users work remotely.
• No inspection of outbound web traffic unless users manually connect to VPN.
• Increased risk of account takeover and business email compromise.

Overview:

Most modern attacks succeed inside the network after initial access. SonicWall has minimal insight into internal device behavior, east west traffic or lateral movement.

• IoT and OT devices such as printers, cameras, phones, badge readers and manufacturing equipment cannot run endpoint agents.
• These devices often run outdated or unknown firmware, and they frequently sit on flat networks.
• Internal protocols such as SMB, RDP and proprietary OT traffic rarely pass through SonicWall appliances.
• Once an attacker is inside, lateral movement does not trigger SonicWall inspection.

Overview:

SonicWall markets Cloud Secure Edge as its ZTNA solution, but most MSPs find it difficult to deploy and manage, which results in limited real world adoption.

• CSE requires connector deployment, routing updates and additional firewall policy changes.
• Management occurs in separate consoles with different configuration workflows.
• CSE is not directly integrated with SonicWall's endpoint agents.
• MSPs often revert to VPN because the ZTNA stack adds complexity without clear operational benefits.

Overview:

More than 90% of traffic is encrypted. SonicWall requires complex certificate and SNI configurations for decryption, which frequently break applications and result in MSPs disabling inspection.

• Decryption requires distribution and trust of CA certificates on every endpoint.
• MSPs must tune SNI and bypass lists for compatibility, which becomes costly.
• Inspection frequently breaks business applications, forcing MSPs to disable it.
• SonicWall often ends up providing only basic stateful filtering rather than deep inspection.

SonicWall's endpoint offerings rely on OEM products. Capture Client is a SentinelOne OEM product and SES EDR appears to be based on Falcon. This results in multiple agents, portals and telemetry silos, which prevents unified detection and response.

• There is no single SonicWall agent that unifies network, identity, ZTNA and endpoint signals.
• MDR teams must manually combine data across consoles, slowing response.
• OEM licensing and roadmap dependencies limit SonicWall’s XDR capabilities.

Effective MDR requires unified telemetry across all layers and the ability to take fast automated action. SonicWall's MDR is slowed by fragmented data sources and limited cross control orchestration.

• MDR analysts must pull endpoint data from OEM consoles and firewall logs from separate systems.
• Lack of a unified agent slows triage.
• Response actions such as account disable, device isolation or flow blocking require manual steps.
• SonicWall struggles to deliver sub ten minute containment.

SonicWall's architecture assumes the firewall is the core of the environment. Modern environments center on users, identity, SaaS, remote work and distributed devices that may never cross the firewall.

• Users work remotely and applications live in SaaS environments.
• IoT, OT and BYOD devices expand the internal attack surface dramatically.
• Attackers rely on identity compromise and lateral movement rather than perimeter attacks.
• SonicWall relies on the firewall being in the path, which is not realistic today.

Overview:

• The cyber warranty is not insurance. It is a limited warranty tied to specific service bundles.
• Coverage applies to a narrow list of incidents such as ransomware, business email compromise, limited regulatory fines and partial business interruption.
• Payouts typically range from fifty thousand to two hundred fifty thousand dollars per category.
• Only one qualifying event per customer per year is allowed.

The warranty is not a comprehensive risk transfer program. It is an incentive mechanism tied to tightly defined conditions.

To file a valid claim, MSPs must maintain perfect compliance with a long list of technical conditions. These are detailed in a twenty eight page document and include:

• MSPs often struggle to maintain full compliance across all tenants.
• Evidence requirements are extensive and must be retained in the correct format.
• SonicWall retains full discretion to approve or deny claims.
• Real world MSP feedback indicates that successful claims are uncommon.

SonicWall includes its cyber warranty only in certain service bundles such as Managed Protection and Advanced Protection. These bundles are significantly more expensive than previous licensing tiers.

• Price increases of 175-215% are common for eligible SKUs.
• The cost is not tied to enhanced security features but to the warranty itself.
• Most MSPs never claim the benefit yet pay the increased cost every renewal cycle.

WatchGuard focuses on reducing risk through unified security, automated detection and fast response rather than offering a narrowly scoped warranty with strict conditions.

• No hidden warranty premiums are included in licensing.
• Total Security Suite provides comprehensive UTM and XDR capabilities.
• ThreatSync reduces incident probability through coordinated response.
• Total MDR offers continuous detection and response rather than reimbursement.
• FlexPay aligns with MSP billing practices and supports cash flow.

• More than 120K SonicWall firewalls are active globally.
• 40-60% of these devices are managed by MSPs.
• 20-30K will be renewing through 2025/2026.
• Gen 6 and 6.5 appliances are aging and approaching end of life.

These factors, combined with SonicWall's trust challenges, create predictable switching windows that are ideal for WatchGuard competitive displacement.

• North America: Largest concentration of SonicWall MSPs and greatest exposure to twenty twenty five incidents.
• United Kingdom and Ireland: Dense SonicWall reseller presence and high adoption among SMBs.
• DACH: Conservative buyers with decreased trust in SonicWall.
• Latin America: Flexible MSP billing and lower cost of ownership is attractive in this market.
• Australia and New Zealand: Rapid consolidation trends create strong replatforming opportunities.

• Even a 5% displacement translates to several thousand devices and millions in recurring revenue.
• Attachment opportunities across FireCloud, EPDR, AuthPoint and MDR multiply revenue per partner.
• Customer acquisition cost is lower because partners already have switching intent.

• If users are not on SonicWall VPN, SonicWall is not protecting anything.
• SonicWall cannot stop session hijacking and cookie theft, FireCloud can.
• Most SonicWall firewalls do not decrypt traffic because certificate setup is difficult.
• SonicWall has minimal visibility into IoT, OT and flat networks, which is where attackers frequently move.
• CSE ZTNA is available but rarely deployed successfully.
• SonicWall MDR rarely achieves fast containment, WatchGuard targets minutes.
• SonicWall is firewall first, WatchGuard is platform first.

First 30 Days, Stabilize and Prove Value

• Run a risk workshop covering SSL VPN incidents, cloud breach exposure and SaaS blind spots.
• Deploy a no cost pilot that includes Firebox, FireCloud, EPDR, AuthPoint and ThreatSync.
• Provide a twenty four hour incident playbook to show measurable improvements in response efficiency.

Next 60 Days, Migrate Noisy and Exposed Clients

• Target clients who rely heavily on SSL VPN or who experienced recent SonicWall related issues.
• Use FlexPay to avoid double billing during transitions.
• Begin retiring VPN in favor of FireCloud ZTNA.
• Deploy MDR to reduce after hours escalations and security noise.

By 90 Days, Standardize and Scale

• Create a standard MSP security catalog that includes:
  • Firebox for network security
  • FireCloud for SSE and ZTNA
  • EPDR for endpoint protection
  • AuthPoint for identity and MFA
  • ThreatSync and MDR for XDR and response
• Use NFR, MDF and SPIFFs to encourage sales teams to drive SonicWall switch out campaigns.