How to choose a firewall for a small business
A practical buying guide: what actually matters, what to ignore, and the traps that catch people out.
Every firewall vendor's website says the same things: fast, secure, easy. That is not useful when you are the one signing the invoice. Here is what actually separates a good choice from a bad one, and it is not always the thing you assumed.
Speed with inspection turned on, not off
Every box lists a top speed, its throughput. That number is almost always measured with every security feature switched off. Turn on threat detection, and real-world speed can drop sharply, sometimes by more than half.
Ask the vendor directly for the speed with inspection turned on, matching your actual internet connection. If they only give you the bare number, treat that as a warning sign, not a selling point.
The licence model, and what it hides
Some vendors sell the box cheaply and then charge yearly for the features that make it worth buying. VPN, threat detection, and support can each be a separate add-on, priced separately, renewed separately.
- Ask exactly what the sticker price includes, and what is a separate subscription.
- Ask what happens to features you rely on if you choose not to renew a licence.
- Ask whether the price changes if you add a second location or a VPN user.
A box that looks cheap on day one can cost far more over three years once every useful feature turns out to need its own renewal.
Whether VPN costs extra
A VPN is not a luxury feature for most small businesses anymore. Staff working from home, a second office, or a contractor who needs occasional access, all of these need one. Some vendors bundle it in. Others charge per user, per month, forever.
Work out roughly how many people will actually use a VPN, and multiply that by whatever per-user fee is quoted, over a few years. The gap between vendors here can be large.
Who actually supports it when something breaks
A firewall is not decoration. It is the thing standing between your business and the internet. When it breaks, or when a rule needs changing at short notice, who actually answers the phone matters.
- Is support included, or a separate paid tier?
- Does the company that made the box provide support, or only a reseller with limited knowledge?
- Is there a real person to call, or only a ticket system with no stated response time?
What happens when it fails
Every appliance eventually has a bad day, a power failure, a hardware fault, an update that goes wrong. What matters is what happens next.
- Does it have an anti-lockout safeguard, so one bad rule cannot lock you out of managing it yourself?
- Does it keep config snapshots, so a bad change can be undone with one click instead of rebuilt from memory?
- Is a spare or a repair genuinely available quickly, or does a hardware fault mean days offline?
Buying the right size, not the biggest one
It is easy to assume bigger is safer. In practice, a firewall sized well beyond your internet connection just costs more without doing more, since it can never use the extra capacity you are paying for.
Match the appliance to your actual internet speed and roughly how many devices connect at once, with a little headroom for growth. A ten-person office with a modest internet plan rarely needs the same box as a hundred-person warehouse, no matter what a sales page implies.
What to actually prioritise
For most small businesses, the order of importance looks like this: real throughput with inspection on, a VPN that is not a per-user tax, support you can reach, and a way to undo a mistake without driving to the office. Everything else is a nice-to-have on top.
Where Firecradle fits this list
Firecradle includes threat detection, VPN, and support in a single price, with no per-user VPN fee and no feature locked behind a separate renewal. It also keeps config snapshots and an anti-lockout safeguard by default, so a bad change is never a permanent one.