NSS Labs Releases Latest Next-Generation IPS Report – Palo Alto Networks Achieves Superior Security Efficacy

Rick Howard

Category: Firewall, Reports

NSS Labs just released its latest Next-Generation Intrusion Prevention System (NGIPS) Test Report. As expected, the report recognizes the Palo Alto Networks Intrusion Prevention System (IPS) service for its strong security efficacy.  Here’s a nice quote from Mr. Vikram Phatak, the CEO of NSS Labs.

“Exploits being used by Threat Actors in active campaigns are the most likely source of compromise that enterprises face every day.  The Palo Alto Networks PA-5020 was the only product that blocked 100% of these live exploits during our test, and 98.8% against all exploits, earning a recommendation by NSS Labs for security effectiveness.”


There’s a lot of deep-level technical security information inside the report but I wanted to pull out a few highlights to give you a taste of what’s included.  Of course I invite anyone to read through the detailed report, which is posted at http://go.paloaltonetworks.com/nss.  And, as an aside, if you want to read a primer on how bad guys attempt to sneak past IPS systems, the NSS Report is an excellent starting point.

The NSS Labs NGIPS Test Report focuses on five specific areas – security effectiveness, performance, stability and reliability, management and configuration, and total cost of ownership.  As Mr. Phatak points out in his quote, Palo Alto Networks has achieved an overall exploit block rate of 98.8%.

NSS Labs employs a number of tests in order to evaluate a product’s overall exploit block rate. The first grouping of tests taps into a library of over 1800 exploits that exercise different attack vectors, impact types, and older exploits to make sure vendors don’t age out signatures in order to preserve performance levels.  For this first grouping of tests Palo Alto Networks successfully blocked 1852 of 1898 exploits to achieve an overall rate of 97.6%.

The next group of tests produced some results that I am particularly proud of.  Mr. Phatak makes a reference to a live exploit test in his quote.  This is a very interesting exercise that focuses on active threats and attack methods discovered by the NSS global threat intelligence network over the course of many months during the test window for the overall NGIPS evaluation of the Palo Alto Networks IPS service.  In other words, these are exploits that each vendor must block without any prior testing or planning.  During this time window, the NSS researchers hurled 613 previously unknown exploit at the Palo Alto Networks IPS service and the service blocked all 613. Palo Alto Networks is the only company that achieved a 100% block rate.

Other highlights include performance where the PA-5020 delivered 2.97 Gbps of NGIPS throughput, nearly 50% above our documented rate of 2 Gbps.  And we cruised through all resistance to evasion, stability and reliability, and application control tests.

As a CSO, I look at these results as a strong testament to my long-held belief that prevention isn’t futile. With the right approach across people, process and technology, organizations can in fact prevent the bulk of advanced threats.  While the focus of this particular evaluation is on our own IPS’s ability to block known exploits — which we clearly excel at – it is but one element of preventing known and unknown attacks down the attack life cycle that also includes stopping the delivery and installation of malware through malicious domains and URLs and foiling the establishment of command and control activity channels. This latest NSS NGIPS Test Report validates a key and essential component to the Palo Alto Networks system of systems approach and I am very proud.

8 Reader Comments

  1. Once again Palo Alto Networks is demonstrating to the world all the benefits of have a real NGF applying the strongest security! The report can demonstrate the efficiency of PA 5020 and how does it works into a hard environment and/or with a heavy traffic needs.
    Palo Alto is the best solution to your network!

    Try it!


    Palo Alto Networks!

  2. Well done Folks ! Nice Report from NSS clearly stating the strong Security Platform from Plao Alto Networks. Adding Traps to the game we come very very close to 99.999999% protection 🙂

    Keep it going PAN !

  3. Looks like PA is going to dominate the NG IPS domain, look at my article

  4. Did you use the DSRI functionality in order to achieve that throughput?

  5. I do not understand: in this list there are FW and IPS.
    PA5020 is a FW, not an IPS.
    May be I missed something?

  6. I just went through the report and you are got a “Neutral Rating” did I miss something…. ?

  7. Rick Howard

    Since we bring a Next-Generation Firewall (a platform that performs a lot of functions up and down the Kill Chain) to an IPS ‘battle’, we expect to do ‘neutrally’ on cost, but we showed amazing security. The NSS CEO confirms.

  8. Rick Howard

    The configuration that we used for the NSS performance testing had a full threat prevention policy/profile enabled for checking traffic in all directions. We did not use DSRI (Disable Server Response Inspection) in any part of our configuration. For those not familiar with DSRI, it is a per-rule configuration option (off by default) to only scan traffic in the direction the session was initiated while ignoring any response traffic. This configuration option is sometimes used when deploying our Next-Generation Firewall in front of a public-facing datacenter where you are only focused on protecting your servers/applications and don’t need to scan the response traffic, and would result in higher performance.

Got something to say?

Get updates: Unit 42

Sign up to receive the latest news, cyber threat intelligence and research from Unit42

By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.