Community is a working firewall at $0. Preview each change before it goes live and undo it in one step. The AI layer proposes; a human commits. Your license is checked on the firewall itself, so your network keeps running even if it can't reach us.
SonicWall sells capable NGFWs (TZ, NSa, NSv) inside a subscription and services model. That is especially clear on TZ80: SonicWall documents no hardware-only SKU, an active subscription required to function, and after a 90-day grace the device stops passing data traffic until renewed. Other listed Gen 8 TZ models (TZ280 through TZ680) can have a hardware-only SKU and can operate without a subscription. SecureGuard is self-hosted on hardware you own, Community is $0, and it keeps your policy in one validated configuration, with a preview before each change and one-step undo. We do not sell MDR, and we do not claim Capture ATP feature parity.
| Topic | SonicWall (public docs) | SecureGuard (Hub / live site) |
|---|---|---|
| Positioning | Entry/mid NGFW line includes TZ; Gen 8 TZ80 is a subscription-based NGFW for SOHO/IoT (SonicWall TZ80 FAQ, fetched 2026-09-29). | Self-hosted BYO NGFW/UTM; Community perpetual free. |
| Must subscription run? | TZ80: no hardware-only SKU; active subscription required. Other listed Gen 8 TZ (TZ280–TZ680) can have hardware-only SKU / operate without subscription (SonicOS 8 TZ licensing, fetched 2026-09-29). | Community $0 works at small scale. Your license is checked on the firewall itself, so your network keeps running even if it can't reach us. |
| License expiry | TZ80: 90-day grace, then stops forwarding data traffic until renewed (TZ80 FAQ + License Expiry doc, fetched 2026-09-29). | An expired paid license slows down; it does not cut off your traffic. (/pricing) |
| Security services | Capture ATP and service suites are SonicWall product features; we do not claim parity. | Suricata IPS + Web Filter/Safe Search/DoH on Community; threat feeds Home+. AI proposes; human commits — not MDR. |
| Config / rollback | (SonicOS management tools — see vendor docs.) | Your policy in one validated configuration, with a preview before each change and one-step undo. |
| HA | HA appears among firewall features in TZ licensing materials. | Active/passive HA on Business+ (/pricing). |
| Pricing | Public price not verified. | Community $0 · Home $149/yr · Business $589/yr · Enterprise $1,495/yr. |
Community $0 · Home $149/yr · Business $589/yr · Enterprise $1,495/yr.
Yes. Community is a working next-generation firewall / UTM at $0: named objects, zones, one canonical document, preview, commit, rollback by id. Same image as paid tiers, at small scale. It is not a trial timer. We do not claim Capture ATP feature parity.
Only if you turn it on. By default, AI suggests changes and a person approves each one. On Business and Enterprise you can turn on automatic blocks, which act only when two signals agree, are rate-limited, and expire on their own. This is not MDR.
SonicWall documents TZ80 as subscription-required: there is no hardware-only SKU, and after a 90-day grace the device stops forwarding data traffic until renewed. Other listed Gen 8 TZ models (TZ280 through TZ680) can have a hardware-only SKU and can operate without a subscription. SecureGuard Community at $0 is a working appliance at small scale. An expired paid license slows down; it does not cut off your traffic. See /pricing. We do not claim Capture ATP parity.
Generic UTM-to-appliance move: UTM replacement. FortiGate contrast: FortiGate alternative. How rollback works: rollback is an id.