Palo Alto Networks Ranks #1: Leading the 2026 URL Filtering Benchmark in Security and Efficiency Across NGFW and SSE

[tuvu01]

Two independent 2026 validation reports by SecureIQLab confirm Palo Alto Networks leads across both Next-Generation Firewall (VM-Series) and Security Service Edge (Prisma Access) deployments on overall security efficacy, operational efficiency, and protection against sophisticated, custom-crafted web attack techniques not yet represented in public threat intelligence feeds. 

Whether deployed as cloud-delivered Prisma Access (SSE) or software-defined VM-Series (NGFW), Palo Alto Networks achieved #1 ranking in Security Efficacy (94.5% SSE / 93.0% NGFW) and 100.0% Operational Efficiency in both benchmarks. While vendors perform adequately on known threat feeds, Palo Alto Networks Advanced URL Filtering provides a massive performance gap on unknown, evasive Patient-Zero attacks.

Vendors Can Block Threats They Already Know About. What About the Ones They Haven't Seen Yet?

URL filtering solutions on the market perform reasonably well against known threats. Vendors train on the same public threat intelligence feeds, and scores reflect it. What separates vendors is their ability to block sophisticated, custom-crafted attacks that no threat intelligence feed has cataloged yet: AI-generated phishing campaigns, LLM-obfuscated JavaScript, adversary-in-the-middle (AitM) attacks, deepfake-enabled lures, and HTTP refresh-based redirects.

These are Patient Zero attacks, meaning attacks that reach your users before any threat intelligence feed has had a chance to catalog them. They are the attacks that separate Palo Alto Networks from every other vendor tested.

Between April and July 2026, SecureIQLab, a U.S.-based independent, third-party cybersecurity solution validation and advisory provider, evaluated leading NGFW and SSE solutions in two separate comparative reports on their ability to block both known threats and Patient Zero attacks. The gap is significant.

Palo Alto Networks Blocked 82.7%–83.2% of Patient Zero Attacks. No Competitor Broke 58% in Either Evaluation.

The Patient Zero evaluation tested each solution against 81 unique malicious URLs, custom-built by SecureIQLab to replicate modern attack techniques that are not yet represented in public threat intelligence feeds. The test covered eight categories:

• QR code phishing
• Phishing kits
• Command-and-control (C2) infrastructure
• Open redirects
• Adversary-in-the-middle (AitM) attacks
• Deepfake-enabled attacks
• HTTP refresh-based attacks
• LLM-obfuscated JavaScript

In the NGFW evaluation, Palo Alto Networks VM-Series was tested against three competitors.

Vendor	Patient Zero Efficacy (NGFW)
Palo Alto Networks VM-Series	82.7%
Fortinet FortiGate VM	51.2%
Cisco Secure Firewall Threat Defense	47.2%
Check Point Security Gateway	29.0%
Group Average	52.5%

Palo Alto Networks scored 30.2 percentage points above the group average. Fortinet, the next-ranked vendor, trailed by 31.5 points. The lowest-ranked vendor detected fewer than one in three Patient Zero attacks. The gap is clear.

In the SSE evaluation, Palo Alto Networks Prisma Access was tested against four competitors across the same eight Patient Zero categories.

Vendor	Patient Zero Efficacy (SSE)
Palo Alto Networks Prisma Access	83.2%
Fortinet FortiSASE	57.4%
Zscaler Zero Trust Exchange	55.6%
Netskope One	37.0%
Cisco Secure Access	35.2%
Group Average	53.7%

Palo Alto Networks scored 29.5 percentage points above the group average. Fortinet, the next-ranked vendor, trailed by 25.8 points. The two lowest-ranked SSE vendors each blocked fewer than 4 in 10 Patient Zero attacks. The gap is clear.

In both evaluations, SecureIQLab notes that Palo Alto Networks achieved its scores using URL Filtering, while other evaluated solutions supplemented their coverage to varying degrees through non-URL filtering controls.

Even on Known Web Threats, Competitors Fall Short

While known threat protection is often treated as table stakes across the industry, the data shows that not all vendors deliver the same level of protection against known web threats. In the NGFW evaluation, Palo Alto Networks still led the category, proving that even when relying on known threat intelligence, efficacy is simply not equal across vendors.

In the NGFW evaluation, Palo Alto Networks still ranked first. Known-threat scores ranged from 78.9% to 94.4%, a 15.5 percentage-point spread.

Vendor	Known Threats (NGFW)
Palo Alto Networks VM-Series	94.4%
Fortinet FortiGate VM	90.7%
Cisco Secure Firewall Threat Defense	83.6%
Check Point Security Gateway	78.9%

In the SSE evaluation, the same pattern held: known-threat scores ranged from 76.7% to 95.9%, a 19.2 percentage-point spread.

Vendor	Known Threats (SSE)
Palo Alto Networks Prisma Access	95.9%
Fortinet FortiSASE	87.5%
Zscaler Zero Trust Exchange	86.4%
Cisco Secure Access	77.2%
Netskope One	76.7%

The Overall Verdict: #1 Leader Across Every Dimension

SecureIQLab positions each evaluated product on a CyberRisk Ripple, a benchmark chart showing relative positioning across two dimensions: Security Efficacy and Operational Efficiency. The Leader designation reflects the strongest combined performance across both.

In the NGFW evaluation, Palo Alto Networks earned the Leader designation, achieving the highest scores across all evaluated categories. Fortinet and Cisco were positioned as Contenders. Check Point was positioned as a Visionary.

Vendor	Security Efficacy (NGFW)	Operational Efficiency (NGFW)
Palo Alto Networks VM-Series	93.0%	100.0%
Fortinet FortiGate VM	85.9%	95.8%
Cisco Secure Firewall Threat Defense	79.1%	93.8%
Check Point Security Gateway	74.0%	93.8%
Group Average	83.0%	95.9%

In the SSE evaluation, Palo Alto Networks Prisma Access again earned the Leader designation. Fortinet FortiSASE and Zscaler Zero Trust Exchange were positioned as Contenders. Cisco Secure Access and Netskope One were positioned as Visionaries.

Vendor	Security Efficacy (SSE)	Operational Efficiency (SSE)
Palo Alto Networks Prisma Access	94.5%	100.0%
Fortinet FortiSASE	83.8%	95.8%
Zscaler Zero Trust Exchange	82.5%	77.1%
Cisco Secure Access	72.0%	87.5%
Netskope One	71.7%	91.7%
Group Average	80.9%	90.4%

In both evaluations, Palo Alto Networks is the only vendor to achieve 100% Operational Efficiency, assessed across 16 features in four categories: Security Policy Configuration, Security Policy Management, Security Metrics Reporting, and Configuration and Policy Backup and Restore.

Strong Protection With Zero Operational Trade-Offs

A common concern with advanced URL filtering is whether stronger blocking creates friction: false positives, disrupted workflows, and administrative overhead. The data shows this is not the case with Palo Alto Networks.

False Positive Avoidance measures whether the solution incorrectly blocks legitimate websites. Categorization Accuracy measures whether legitimate websites are correctly classified into the right category, which matters for policy enforcement and access controls.

Vendor	False Positive Avoidance (NGFW)	Categorization Accuracy (NGFW)
Palo Alto Networks VM-Series	100.0%	95.9%
Fortinet FortiGate VM	99.9%	93.5%
Cisco Secure Firewall Threat Defense	97.8%	95.7%
Check Point Security Gateway	99.7%	78.9%

Vendor	False Positive Avoidance (SSE)	Categorization Accuracy (SSE)
Palo Alto Networks Prisma Access	100.0%	96.2%
Cisco Secure Access	99.9%	93.4%
Fortinet FortiSASE	99.7%	91.7%
Zscaler Zero Trust Exchange	99.2%	89.9%
Netskope One	100.0%	59.8%

In both evaluations, Palo Alto Networks blocked zero legitimate URLs incorrectly and achieved the highest categorization accuracy of any vendor tested. Maximum security with no disruption to legitimate business traffic.

Protection Before the Feed Catches Up

Patient Zero attacks reach your organization before any threat intelligence feed has cataloged them. Across two independent evaluations covering both NGFW and SSE deployments, Palo Alto Networks is the only vendor to earn the Leader designation, with zero false positives and no disruption to legitimate traffic.

Read the full SecureIQLab report to review the complete methodology, scoring criteria, and per-category results.

• 2026 Advanced URL Filtering CyberRisk Comparative Validation, Next-Generation Firewalls
• 2026 Advanced URL Filtering CyberRisk Comparative Validation – Security Service Edge (SSE)

Note: The percentage-point gap figures (30.2, 31.5, 15.5) are calculations derived from NGFW source data, and (29.5, 25.8, 19.2) are calculations derived from SSE source data. None of these figures are stated verbatim in either report. All other numbers are directly from the SecureIQLab NGFW and SSE reports. Reported scores reflect SecureIQLab's proprietary weighting methodology. Readers are encouraged to refer to Section 05 (Scoring Criteria, p. 9) and Section 8.1 (Operational Efficiency Scoring, p. 15) of the individual NGFW and SSE reports for the complete weighting criteria and scoring approach.