The original headline asked how AI is used inside NGFW solutions in 2026, comparing Russian products with international offerings. The text clarifies that simply claiming “AI inside” is meaningless because vendors implement very different capabilities.
Four practical AI scenarios in NGFW
The article compares four concrete scenarios and lists what customers should verify for each:
- ML threat detection – evaluates files, connections or DNS queries for malicious indicators; buyers must check detection quality, false-positive rates, latency and cloud dependency.
- AI-driven operations analytics – explains events, validates configuration and offers recommendations; verification points include traceability to raw data and accuracy of advice.
- Administrator assistant or agent – answers configuration questions and can execute permitted actions; key controls are privilege scope, change approval workflow and full audit logging.
- Protection of AI usage – discovers AI services and enforces access policies; advanced gateways can also inspect prompts and agent-to-agent traffic.
The final scenario does not always require an LLM; URL categories or application signatures suffice for basic visibility, as implemented by UserGate and Ideco.
Global vendor landscape
Palo Alto Networks combines on-box deep learning with cloud analysis inside Advanced Threat Prevention to detect unknown C2 channels. Juniper offers both cloud and on-premises Advanced Threat Prevention for SRX devices. Generative assistants appear in management planes: Cisco AI Assistant inside Secure Firewall Management Center, Check Point AI Assist in SmartConsole R82, and Juniper Security Director Copilot (beta, July 2026). Fortinet adds Shadow AI visibility, AI-aware Application Control and MCP/A2A agent monitoring in FortiOS 8.0, while Palo Alto Networks introduced the separate Prisma AIRS AI Gateway in July 2026 for prompt inspection.
Russian market offerings
Kaspersky NGFW uses machine learning for heuristic file analysis and integrates with Kaspersky Security Network. UserGate applies the URL category “Chat-bot AI” for content-filtering rules. Ideco stands out by combining 83 recognized AI protocols in the Application Control module of Ideco NGFW Novum v23, a dedicated AI dashboard, and two read-only AI services available through technical support: IPS/DNS Security log analysis and firewall rule auditing. Both services run via REST API in read-only mode and never alter configuration. Planned v24 features include an LLM Proxy for logging and filtering LLM requests.
The article concludes that AI in NGFW is becoming essential because autonomous agents now access corporate data and attackers increasingly automate reconnaissance and exploitation. Effective solutions must accelerate detection and response while keeping final control with human administrators.
