SonicWall
Maker of firewalls and VPN appliances sold mainly to small and midsize businesses.
On the record
Checkpoint: MSP renewal and churn data after the June 2026 SMA1000 zero-day patch cycle
The call
SonicWall is absorbing breach fallout, zero-day exploits, and a rival's partner poaching campaign while its PE owner installs new leadership from inside the firm.
SonicWall makes security firewalls that protect small and medium-sized businesses and their branch offices from cyberattacks. The company's main advantage has always been that customers and their technology partners stick with it once installed, but that advantage is weakening fast. Two things are breaking it: major security breaches in 2025 and 2026 that make customers question whether SonicWall can protect anyone, and a rival company called WatchGuard that is actively convincing SonicWall's partners to switch to them instead. Customers and partners are also seeing that other companies like Fortinet, Sophos, and Cisco offer similar products and are not blocked from taking share. The one thing that could change the picture is whether SonicWall's new leadership announces a clear turnaround plan or a sale within the next six months, or if the breaches stop triggering partner defections.
Why
01
AI pressure: AI security copilots, including SonicWall's own SAMI. AI copilots now auto-triage alerts and write rules, squeezing the MSP service margins that keep partners selling SonicWall gear. Could AI do the core job? Only partly.
02
Bigger players: WatchGuard Technologies. WatchGuard runs an active campaign to pull SonicWall's 17,000 MSP partners over after two major breaches in a row. Could a giant copy it? Yes, easily.
03
What protects it. Thousands of MSPs have SonicWall boxes wired into client networks, and ripping out a firewall fleet is slow and costly.
What would change this call
SonicWall reports MSP/partner renewal rates for Q3-Q4 2026. Would show whether WatchGuard's displacement campaign is converting into real partner losses.
Another Tier-1 SonicWall breach or zero-day disclosure within 12 months. Would confirm security credibility keeps eroding, accelerating channel defection.
Francisco Partners announces a SonicWall sale or restructuring within 12-24 months. Would confirm the PE sponsor is exiting rather than investing in a turnaround.
Another Tier-1 SonicWall breach or zero-day disclosure within 12 months. Would confirm security credibility keeps eroding, accelerating channel defection.
Francisco Partners announces a SonicWall sale or restructuring within 12-24 months. Would confirm the PE sponsor is exiting rather than investing in a turnaround.
Key numbers
- 2025 cloud-backup breach hit 100% of cloud-backup users
- CVSS 10.0 zero-day exploited on SMA1000 VPNs
- Headcount fell to 2,179, down 4% year over year
Named risks
- Repeated high-severity breaches (state-sponsored 2025 breach, CVSS 10.0 zero-day July 2026) erode trust in a security vendor.
- WatchGuard's active displacement campaign could drive measurable MSP partner churn.
- Ongoing exploitation of older firewalls (CVE-2024-40766) with sub-hour ransomware dwell times.
- Headcount decline (4.0% YoY to 2,179 by Dec 2025) and PE-insider CEO/COO turnover suggest cost tightening or exit prep.
- AI-assisted SOC copilots may compress MSSP triage margins that channel partners rely on.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| WatchGuard Technologies | gaining on | Running active MSP-poaching campaign against SonicWall's breach-scarred base since April 2025 |
| Fortinet | contesting | Dominates mid-market to enterprise NGFW/SASE segment, directly overlapping SonicWall's target market |
| Palo Alto Networks | contesting | Far larger scale (~17,755 employees per Revelio) competing in adjacent enterprise/SASE tiers |
| Sophos | contesting | Competes directly for SMB/branch UTM and firewall customers |
| Cisco (Meraki/Secure Firewall) | contesting | Channel-led competitor in same SMB/mid-market firewall segment |
| Barracuda Networks | contesting | Peer competitor in SMB/branch firewall and UTM space |
Questions people ask
- Is SonicWall profitable in 2026?
- SonicWall is privately held under Francisco Partners and Elliott Management since 2016, so no audited profit figures are public. Third-party estimates put revenue near $355.5 million annually as of July 2026, but this is an unaudited ZoomInfo estimate, not a confirmed profitability figure.
- Has SonicWall been hacked?
- Yes. A September 2025 cloud-backup breach, initially reported as affecting under 5% of customers, was found by Mandiant/SonicWall in November 2025 to affect 100% of cloud-backup users and was attributed to a state-sponsored actor.
- Who owns SonicWall?
- SonicWall has been owned by private equity firms Francisco Partners and Elliott Management since they bought it from Dell in June 2016 for a reported $2 billion-plus. Francisco Partners holds the majority stake, with Elliott as minority owner.
- Who is SonicWall's biggest competitor?
- WatchGuard Technologies is running an active, named campaign to poach SonicWall's MSP partner base following its 2025 breach fallout, as of April 2025. Fortinet, Sophos, Barracuda, and Cisco Meraki also directly contest SonicWall's SMB/branch firewall segment.
- Could AI replace SonicWall's products or services?
- Not directly; SonicWall's hardware install base, 17,000-plus channel partners, and Capture ATP telemetry are hard for AI to disintermediate. But AI-driven SOC copilots, including SonicWall's own SAMI (shipped August 2025), risk compressing the MSSP triage margins its partner channel depends on.
- Is SonicWall being sold or going public?
- A sale process targeting over $2.5 billion was reported around 2021 via Morgan Stanley, but no completed transaction has surfaced since. In 2026, Francisco Partners installed two of its own operating partners as CEO and COO, which some read as pre-sale positioning.
Timeline
- 2026-07-19SonicWall SMA1000 zero-days (CVSS 10.0 and 7.2) confirmed exploited by UTA0533 for root access
- 2026-06-22Akira/Fog ransomware still exploiting CVE-2024-40766 on Gen 5/6/7 firewalls, 55-min dwell time
- 2026Francisco Partners installs Paul Ilse as CEO and Carolyn McCarthy as COO, replacing Bob VanKirk
- 2025-11-06Cloud-backup breach confirmed state-sponsored, scope escalated to 100% of cloud-backup users
- 2025-08-14SonicWall launches Generation 8 firewalls with SAMI AI assistant and expanded cyber warranty
- 2025-07-17Rajnish Mishra appointed SVP/Chief Development Officer for cloud-native MSP strategy
- 2025-04-30WatchGuard begins active MSP-poaching campaign against SonicWall's partner base
- 2025-03-27Cloud Secure Edge ZTNA reports 54% YoY bookings growth, 20x partner adoption increase (vendor-claimed)
- 2021Francisco Partners/Elliott reportedly explore sale of SonicWall at $2.5 billion-plus valuation
- 2016-10-31Francisco Partners and Elliott Management complete acquisition of SonicWall from Dell
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- SonicWall cloud backup hack was the work of a state actor (2025-11-06)
- SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access (2026-07-19)
- SonicWall Number of Employees 2026 (2026-06-29)
- SonicWall's ZTNA Solutions Driving Success (2025-03-27)
- SonicWall Competitive Knockout, WatchGuard Internal Resource (2025-04-30)
- SonicWall - Overview, News & Similar companies (2026-07-14)
- Francisco Partners and Elliott Management Complete Acquisition of Dell Software Group (2016-10-31)
- Francisco Partners and Elliott Management eye $2.5 billion SonicWall sale
- SonicWall Taps New CEO, COO
- SonicWall rolls out eight new firewalls, expands cyber warranty (2025-08-14)
- The Patch Fixed the Bug. Nobody Fixed the Configuration. (2026-06-22)
- SonicWall's New CEO On M&A, Channel Commitment And The Biggest Cyber Threats