Top 10 Next-Generation Firewall Solutions for 2026

Key Takeaways

• Next-Generation Firewalls (NGFWs) are essential for modern network security, offering deep packet inspection, application awareness, and advanced threat prevention beyond traditional firewalls.
• Top NGFW solutions for 2026 are evaluated based on security efficacy, performance, manageability, ecosystem integration, and total cost of ownership.
• Palo Alto Networks PA-Series leads for comprehensive application control, Fortinet FortiGate offers superior value and integrated SD-WAN, and Check Point Quantum excels in threat prevention accuracy.
• Several vendors, including Fortinet and SonicWall, have faced actively exploited vulnerabilities, emphasizing the critical need for diligent patching and robust security hygiene.
• When selecting an NGFW, prioritize threat-prevention throughput, consider TLS inspection capabilities, evaluate multi-year total cost, and ensure management aligns with your team’s expertise.

The Evolving Landscape of Next-Generation Firewalls in 2026

As cyber threats grow in sophistication, the role of the Next-Generation Firewall (NGFW) has become more critical than ever. These advanced security solutions move beyond basic port and protocol filtering, delving into application-layer inspection, intrusion prevention, and integrating cloud-delivered threat intelligence to defend against modern attacks. This comprehensive analysis evaluates the top NGFW solutions poised to dominate the market in 2026.

Methodology for NGFW Evaluation

Our assessment of leading NGFW solutions is based on a structured, research-driven methodology, rather than hands-on lab testing. Each next-generation firewall was scored across five key criteria, leveraging independent reports, public documentation, and analyst insights:

1. Security Efficacy: This includes performance in independent tests (e.g., CyberRatings), the breadth of prevention capabilities such as Intrusion Prevention Systems (IPS), sandboxing, TLS 1.3 inspection, and DNS security.
2. Performance and Scalability: We focused on threat-prevention throughput, which measures performance with all security features active, rather than raw firewall throughput. Hardware acceleration and support for virtual/cloud form factors were also considered.
3. Manageability: Evaluation covered single-console policy management, the maturity of cloud management platforms, and robust automation and API support.
4. Ecosystem and Integrations: This criterion assessed integration capabilities with SD-WAN, Zero Trust Network Access (ZTNA), SIEM/XDR platforms, and identity providers.
5. Total Cost of Ownership (TCO): Analysis included hardware costs, subscription fees, historical renewal pricing behavior, and the overall complexity of licensing.

All vendor claims were rigorously cross-referenced against publicly available documentation and reputable analyst or peer-review sources. Unverifiable facts were noted rather than estimated, ensuring accuracy and transparency.

Leading Next-Generation Firewall Solutions for 2026

1. Palo Alto Networks PA-Series — Best Overall NGFW

Ideal for: Large enterprises and organizations with mature security operations requiring granular application-layer control.

Palo Alto Networks is widely recognized for pioneering the NGFW category, and its PA-Series, alongside the VM-Series and cloud-delivered offerings, continues to set the industry benchmark for application visibility. Their proprietary App-ID technology intelligently classifies network traffic by application, not just port, while inline machine learning proactively blocks emerging cyber threats without reliance on traditional signature updates.

• Key Capabilities: App-ID, User-ID, and Content-ID enable identity- and application-aware policy enforcement. Inline ML-based prevention targets zero-day file and web threats. Cloud-Delivered Security Services include Advanced Threat Prevention, WildFire sandboxing, and DNS Security. Centralized management is provided through Panorama and Strata Cloud Manager, ensuring consistent policy across hardware, virtual, and containerized deployments.
• Advantages: Unparalleled application visibility, robust threat intelligence from Unit 42, a unified policy model spanning on-premise and cloud environments, and a comprehensive ZTNA/SASE strategy via Prisma Access.
• Considerations: Commands a premium price point, often resulting in higher cost per protected Mbps. The layered subscription model can increase TCO, and the depth of management features may present a learning curve for smaller teams.
• Pricing: Hardware is combined with per-subscription licensing. The entry-level PA-440 is typically priced around $1,750 (hardware only) through authorized resellers. Larger appliances and Cloud-Delivered Security Services are quote-based. Palo Alto Networks was recognized as a Leader in the inaugural 2025 Gartner Magic Quadrant for Hybrid Mesh Firewall, noted for its strong “Completeness of Vision.”
• Distinguishing Feature: The advanced maturity of App-ID, which enables policy creation based on applications and users rather than ports, provides the most streamlined approach to implementing least-privilege network access at scale.

2. Fortinet FortiGate — Best Value NGFW

Ideal for: Organizations seeking high throughput-per-dollar, particularly those with distributed sites requiring integrated SD-WAN capabilities.

FortiGate firewalls leverage FortiOS in conjunction with purpose-built ASICs (NP7/SP5) to deliver industry-leading cost-efficiency per protected Mbps. Its integrated SD-WAN solution is a core feature, not an add-on, making FortiGate a preferred choice for branch office and retail deployments.

• Key Capabilities: Custom ASIC acceleration for firewalling and TLS inspection. Integrated, license-inclusive SD-WAN with intelligent application steering. FortiGuard AI-powered security services cover IPS, web filtering, DNS security, and sandboxing. Management is centralized via FortiManager or FortiCloud. The Fortinet Security Fabric offers a broad ecosystem including switches, access points, endpoint security, and Network Access Control (NAC).
• Advantages: Exceptional price-performance ratio, a consistent operating system across all appliance sizes, SD-WAN functionality included at no extra license cost, and an extensive range of models.
• Considerations: The vast product portfolio can lead to complex licensing decisions. Fortinet products have experienced several high-profile exploited vulnerabilities requiring prompt patching, including a FortiCloud authentication-bypass flaw added to CISA’s Known Exploited Vulnerabilities catalog in January 2026. This underscores the necessity of rigorous patch management. Some advanced features can be challenging to locate within the user interface.
• Pricing: Entry-level desktop models are among the most affordable branded NGFWs, with the FortiGate 40F typically ranging from $300–$700 (hardware only). FortiCare/FortiGuard bundles add an additional 60–90% of the hardware cost annually. Fortinet was named a Leader in the 2025 Gartner Magic Quadrant for Hybrid Mesh Firewall, achieving the highest placement for “Ability to Execute.”
• Distinguishing Feature: Hardware acceleration via ASICs, enabling smaller, more cost-effective appliances to maintain inspection throughput that competitors often require larger, more expensive units to match.

3. Check Point Quantum — Best Threat Prevention Accuracy

Ideal for: Regulated industries where the financial or regulatory consequences of a security breach are severe.

Check Point’s extensive firewall heritage is evident in its consistently high threat prevention record. In CyberRatings.org’s Q1 2025 cloud network firewall testing, Check Point demonstrated a perfect 100% exploit block rate and 100% false-positive accuracy across 2,028 exploits and 2,500 evasion techniques. Its ThreatCloud AI platform aggregates global telemetry to deliver real-time threat verdicts to all connected gateways.

• Key Capabilities: ThreatCloud AI utilizes numerous machine learning engines for real-time threat analysis. SandBlast provides zero-day sandboxing and threat extraction (file sanitization). Unified policy management is handled through SmartConsole and Quantum Smart-1 management. Maestro hyperscale clustering offers elastic capacity, and the platform boasts a strong legacy in VPN and remote access solutions.
• Advantages: Industry-leading prevention accuracy, mature centralized management preferred by large security teams, and a hyperscale option that avoids disruptive forklift upgrades.
• Considerations: Total cost of ownership typically falls between Fortinet and Palo Alto Networks. Interface modernization efforts are ongoing in some areas. The SD-WAN offering is less comprehensive compared to Fortinet.
• Pricing: Quote-based, varying by appliance and software package. Quantum Spark targets SMBs, while the Quantum Force line serves enterprise needs. Quotes are available through Check Point partners. Check Point was named a Leader in the 2025 Gartner Magic Quadrant for Hybrid Mesh Firewall.
• Distinguishing Feature: A prevention-first philosophy where threat extraction immediately delivers a sanitized version of a file to the user while the original undergoes detonation in a sandbox, ensuring security does not impede business operations.

4. Cisco Secure Firewall — Best for Cisco-Standardized Enterprises

Ideal for: Enterprises with existing investments in Cisco networking, identity solutions (ISE), and other Cisco security products.

Cisco Secure Firewall, building on the Firepower lineage, has significantly matured, offering unified management through the Secure Firewall Management Center (FMC) and its cloud-delivered counterpart, cdFMC. Its primary strength lies in Cisco Talos, one of the world’s largest commercial threat intelligence organizations, which continuously feeds IPS rules and reputation data to the platform.

• Key Capabilities: Snort 3-based IPS powered by Talos intelligence. Encrypted Visibility Engine can classify TLS traffic without full decryption. Tight integration with Cisco ISE, SecureX/XDR, and Umbrella. Management options include on-premise, cloud (cdFMC), and multicloud defense. Offers a broad range of appliances from branch offices to data centers.
• Advantages: Detections are backed by the extensive Talos intelligence. Strong capabilities for identity-based segmentation when integrated with ISE. Provides single-vendor accountability for both network and security infrastructure.
• Considerations: Historically, management has been perceived as cumbersome; while improved, it remains more complex than some competitors. Licensing involves multiple SKUs and tiers. The best value is typically realized only within a broader Cisco ecosystem.
• Pricing: Quote-based, with tiered security subscriptions (threat, malware, URL filtering) layered on top of appliance costs. Pricing is handled through Cisco partners and can vary significantly with enterprise-agreement discounts.
• Distinguishing Feature: The Encrypted Visibility Engine, which enables intelligent policy decisions on encrypted traffic flows without the performance overhead or privacy concerns associated with full decryption.

5. Sophos Firewall (XGS) — Best NGFW for Small Business

Ideal for: Small to medium-sized businesses (SMBs) and environments managed by Managed Service Providers (MSPs) that also utilize Sophos endpoint protection.

Sophos Firewall’s Synchronized Security offers a unique differentiator: the firewall and Intercept X endpoints share real-time health telemetry. This enables automatic isolation of a compromised laptop at the network layer. The Xstream architecture, with a dedicated flow processor on XGS appliances, efficiently handles TLS 1.3 inspection.

• Key Capabilities: Synchronized Security heartbeat for automated containment with Sophos endpoints. Xstream TLS 1.3 inspection and FastPath offloading. Sophos Central cloud management unifies firewall, endpoint, email, and Managed Detection and Response (MDR). Supports zero-touch deployment and includes built-in SD-WAN/ZTNA gateway options. Provides strong out-of-the-box reporting.
• Advantages: Genuine automatic containment when both endpoint and firewall are Sophos products. A single cloud console simplifies management across the entire security stack. MSP-friendly licensing and an intuitive user interface.
• Considerations: Maximum value is achieved within the Sophos ecosystem. Less suitable for very large data center deployments. Some enterprise routing features are not as mature as those offered by Fortinet or Palo Alto.
• Pricing: Consists of appliance costs (current XGS “Gen 2” desktop line includes models like the XGS 88) plus Xstream/Standard Protection bundles, sold exclusively through Sophos partners and MSPs. Quotes are available upon request. Sophos offers a free 30-day trial.
• Distinguishing Feature: The endpoint heartbeat, which provides network-level auto-isolation of compromised hosts—a capability many competitors cannot natively match.

6. SonicWall (Gen 7 / TZ & NSa) — Best Budget NGFW for SMB and Branch

Ideal for: Budget-conscious small businesses and distributed offices seeking proven security without enterprise-level pricing.

SonicWall’s Generation 7 lineup, including the TZ series for desktop environments and NSa for mid-range deployments, delivers a robust NGFW feature set at competitive price points. Its patented Real-Time Deep Memory Inspection (RTDMI) effectively detects evasive malware by analyzing code behavior directly in memory.

• Key Capabilities: RTDMI and Capture ATP multi-engine cloud sandboxing. Supports TLS 1.3 decryption across the Gen 7 series. Network Security Manager (NSM) provides cloud-based central management. Integrated SD-WAN is included without additional license costs. Offers wireless-integrated TZ models for small sites.
• Advantages: Strong value proposition, straightforward deployment for non-specialist IT teams, a long track record in the SMB market, and an extensive MSP channel.
• Considerations: The brand has recently experienced a series of actively exploited vulnerabilities. CISA added SonicWall CVE-2025-23006 (January 2025) and CVE-2025-40602 (December 2025), both impacting remote-access products, to its Known Exploited Vulnerabilities catalog. This necessitates aggressive patching as a non-negotiable requirement. The management user experience lags behind market leaders, and the platform has fewer enterprise-scale reference deployments.
• Pricing: Among the lowest entry costs in this category. The TZ470 typically sells for approximately $1,015 (hardware only), or around $1,764 with a one-year TotalSecure protection bundle. Smaller TZ models are available at lower price points.
• Distinguishing Feature: RTDMI, which provides memory-level inspection to catch threats designed to evade traditional sandboxes, is available even on desktop-class appliances.

7. WatchGuard Firebox — Best for Small-Business Simplicity and MSPs

Ideal for: Small businesses and their Managed Service Providers (MSPs) who prioritize straightforward bundling and easy management over extensive feature depth.

WatchGuard simplifies the purchasing process with its Total Security Suite, which bundles nearly every security service—including IPS, sandboxing (APT Blocker), DNS filtering, and EDR-lite (ThreatSync)—into a single license. WatchGuard Cloud provides MSPs with genuine multi-tenant management capabilities.

• Key Capabilities: Total Security Suite offers all-in-one licensing. WatchGuard Cloud provides multi-tenant management for MSPs. ThreatSync XDR correlates telemetry from firewalls, endpoints, and Wi-Fi. Features an integrated AuthPoint MFA option. Available in T-series desktop and M-series rackmount appliances (note: the popular Firebox T25 reached end-of-sale in December 2025; current tabletop models include the T115-W, T125, T145, and T185).
• Advantages: Transparent bundle pricing, excellent tools for MSPs, solid security services for the cost, and low administrative overhead.
• Considerations: Not designed for large-enterprise scale or complex routing requirements. TLS inspection throughput on smaller appliances can be modest. Has a smaller threat research footprint compared to larger vendors.
• Pricing: Consists of appliance costs plus Basic or Total Security Suite terms, quoted through WatchGuard’s reseller and MSP channel.
• Distinguishing Feature: The single-SKU Total Security Suite, eliminating complex à-la-carte licensing, which is consistently cited by SMBs and MSPs as a key reason for their loyalty.

8. HPE Juniper SRX Series — Best for Service Providers and Data Centers

Ideal for: Service providers, carriers, and data center operators requiring routing-grade scale combined with NGFW services.

The Juniper SRX line, running on Junos OS, spans from branch office devices to carrier-class chassis. Mist AI extends security operations, while Security Director Cloud unifies policy management across on-premise SRX devices and cloud environments. Following HPE’s ~$13.4B acquisition of Juniper on July 2, 2025, the firewall product line is now sold under HPE Juniper Networking. The SRX portfolio continues to evolve, with new releases like the 1.4 Tbps, quantum-safe SRX4700.

• Key Capabilities: Junos OS provides consistency with carrier-grade routing alongside NGFW services. Advanced Threat Prevention (ATP) includes cloud sandboxing. Security Director Cloud enables unified policy management for on-premise and cloud deployments. Offers very high-end scaling with the SRX5000 line for service provider and data center applications. Strong automation capabilities are provided through APIs and Junos tooling.
• Advantages: Exceptional scale and routing integration, a single operating system across the network, and appealing to teams already familiar with Junos automation.
• Considerations: Enterprise firewall market presence lags behind Palo Alto and Fortinet; Gartner positioned HPE Juniper as a Challenger, not a Leader, in the 2025 Hybrid Mesh Firewall Magic Quadrant. The security service ecosystem is narrower. Post-acquisition portfolio rationalization necessitates a direct roadmap discussion with your representative.
• Pricing: Quote-based, available through HPE Juniper Networking partners.
• Distinguishing Feature: The integration of routing and firewall capabilities within a single Junos platform, capable of operating at scales where most NGFW vendors reach their limits.

9. Barracuda CloudGen Firewall — Best for Cloud-First and Azure-Heavy Teams

Ideal for: Organizations with substantial Azure deployments or numerous small sites needing integrated WAN optimization and security.

Barracuda designed its CloudGen Firewall specifically for dispersed network environments. It natively includes SD-WAN, WAN optimization, and traffic shaping. Its integration with Microsoft Azure is among the deepest offered by any NGFW vendor, featuring tight coupling with Azure Virtual WAN.

• Key Capabilities: Native SD-WAN with adaptive session balancing and WAN optimization. Deep integration with Microsoft Azure, including Virtual WAN deployments. Advanced Threat Protection provides cloud sandboxing. Supports zero-touch deployment for extensive multi-site rollouts. Firewall Control Center offers centralized management.
• Advantages: Excellent for topologies with numerous branches, strong credentials in Azure environments, straightforward central provisioning, and competitive pricing.
• Considerations: Less brand recognition among enterprise security teams. Has a smaller footprint in independent security tests. The ecosystem of integrations is narrower compared to the top four vendors.
• Pricing: Available in appliance, virtual, and cloud consumption models, including pay-as-you-go deployment via the Azure Marketplace. Quotes are provided through Barracuda partners.
• Distinguishing Feature: Its deep, native integration with Azure, making CloudGen a more seamless fit than most rivals for networks with a primary focus on Azure.

10. Forcepoint NGFW — Best for Multi-Site High Availability

Ideal for: Organizations prioritizing uptime across multiple sites and robust defense against advanced evasion techniques.

Forcepoint NGFW, originating from the Stonesoft lineage, is engineered for high availability through clustering. It supports up to 16 active-active nodes, allows for mixed appliance generations, and boasts sub-second failover capabilities. Its research into advanced evasion techniques (AETs)—attacks designed to bypass inspection—remains a significant differentiator.

• Key Capabilities: Native active-active clustering supporting mixed hardware generations. Anti-evasion inspection normalizes traffic before analysis. Security Management Center (SMC) can manage hundreds of nodes. Includes built-in multi-link SD-WAN and VPN provisioning. Integrates with human-risk and data-security solutions across the Forcepoint portfolio.
• Advantages: Outstanding high-availability architecture, efficient management for large fleets, strong defense against evasion techniques, and a policy hierarchy well-suited for multi-tenant/multi-site designs.
• Considerations: Has a smaller market presence and community. Ownership has changed twice in recent years—Francisco Partners acquired Forcepoint from Raytheon in 2021, then sold the government/critical-infrastructure (G2CI) business to TPG in 2023, with the commercial business (including NGFW) remaining under Francisco Partners. Customers should inquire directly about the NGFW roadmap commitment. Offers fewer third-party integrations.
• Pricing: Quote-based, available through Forcepoint partners.
• Distinguishing Feature: A clustering architecture that treats high availability as a fundamental design principle, rather than an add-on. This enables upgrades without requiring maintenance windows.

Full NGFW Comparison Table (2026)

Choosing the Right Next-Generation Firewall

Selecting the appropriate NGFW is a critical decision that impacts your organization’s security posture and operational efficiency. Here are key considerations:

• Prioritize Threat-Prevention Throughput: Datasheet figures for “firewall throughput” often represent performance with security features disabled. The crucial metric is throughput with IPS, anti-malware, and TLS inspection fully enabled, which can be 5–10 times lower. Undersizing your appliance based on raw throughput is a common and costly mistake.
• Define Your TLS Inspection Strategy: With over 90% of web traffic now encrypted, an NGFW unable to decrypt at your traffic volume acts largely as an expensive port filter. Verify TLS 1.3 support and understand the performance impact of full decryption.
• Analyze 3-5 Year Total Cost of Ownership (TCO): Beyond the initial purchase price, annual security subscriptions (IPS, sandboxing, URL filtering) typically surpass hardware costs over the appliance’s lifespan. Renewal price increases can vary significantly between vendors. Always request renewal caps in writing.
• Match Management to Team Expertise: An overly complex enterprise console can overwhelm a small IT team, while a simplified interface might be insufficient for a mature Security Operations Center (SOC). Demand a proof-of-value in your specific environment, not just a generic demo.
• Assess SASE/ZTNA Roadmap: Most organizations will adopt a hybrid security model, utilizing hardware at physical sites and cloud-delivered security for remote users. Favor vendors offering a consistent policy model across both deployment types. Gartner refers to this as the “hybrid mesh firewall,” with Fortinet, Palo Alto Networks, and Check Point identified as Leaders in its inaugural August 2025 Magic Quadrant. For foundational architectural guidance, refer to NIST SP 800-207 on zero trust architecture. Furthermore, regularly monitor actively exploited firewall vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog, as edge devices, including NGFWs, remain prime targets for attackers.

Key Questions to Ask Vendors:

• What is the real-world throughput with full inspection and TLS decryption enabled for our specific traffic mix?
• What features are included in each license tier, and what actions trigger an upsell?
• How are emergency vulnerability patches delivered, and what is the vendor’s track record for timely remediation?
• What does renewal pricing typically look like in year three and beyond?

Common Pitfalls to Avoid:

• Making purchasing decisions solely on sticker price.
• Neglecting the crucial conversation about decryption sizing and its performance implications.
• Underestimating licensing complexity.
• Treating the NGFW as a “set-and-forget” solution instead of an actively managed and tuned control.

Frequently Asked Questions

What is a next-generation firewall (NGFW)?

An NGFW is an advanced network security appliance or service that extends beyond traditional port/protocol filtering. It inspects traffic at the application layer, incorporating application awareness, intrusion prevention (IPS), TLS decryption, user-identity-based policy enforcement, and cloud-delivered threat intelligence into a unified enforcement point.

Which is the best next-generation firewall in 2026?

For 2026, the Palo Alto Networks PA-Series stands out as the best overall NGFW due to its deep application-layer visibility and machine learning-based prevention capabilities. Fortinet FortiGate offers the best value proposition, while Check Point Quantum excels in threat-prevention accuracy. For small businesses, Sophos Firewall XGS is the top recommendation.

What is the difference between an NGFW and a traditional firewall?

A traditional firewall filters network traffic based on basic parameters like ports, protocols, and IP addresses. In contrast, an NGFW can identify specific applications and users, inspect encrypted traffic, actively block intrusions and malware inline, and leverage real-time threat intelligence. This allows an NGFW to stop sophisticated attacks that a port-based firewall would typically allow through.

How much does a next-generation firewall cost?

Entry-level NGFW hardware can start from a few hundred dollars; for example, a FortiGate 40F typically ranges from $300–$700, a SonicWall TZ470 around $1,015, and a Palo Alto PA-440 approximately $1,750. Enterprise-grade appliances can cost anywhere from five to six figures. Annual security subscriptions usually add 60–90% or more to the hardware cost and often exceed the initial hardware investment over a 3–5 year operational lifespan.

Do I still need an NGFW if I’m adopting SASE or zero trust?

In most scenarios, yes. While SASE primarily secures remote users and cloud access, physical sites with local servers, operational technology (OT) equipment, or significant east-west traffic still require on-premise enforcement. Most organizations implement a hybrid approach, using NGFWs at data centers and larger sites, complemented by cloud-delivered security elsewhere, ideally managed under a consistent policy model.

Fortinet vs Palo Alto: which NGFW should I buy?

The choice between Fortinet and Palo Alto Networks depends on specific organizational needs. Opt for Fortinet if price-performance, integrated SD-WAN, and support for distributed sites are primary considerations. Choose Palo Alto Networks for the most granular application control, advanced threat research, and robust operations in large enterprise environments. Both are consistent market leaders, and the optimal decision hinges on your budget, team’s security maturity, and existing technology ecosystem.

Can an NGFW inspect encrypted (TLS/HTTPS) traffic?

Yes, TLS inspection is a fundamental capability of NGFWs. However, it is a computationally intensive process that can significantly reduce throughput, making proper appliance sizing for inspected traffic crucial. Some vendors, such as Cisco with its Encrypted Visibility Engine, also offer methods to classify encrypted traffic without full decryption, which can be beneficial when privacy or performance constraints prohibit deep inspection.

Conclusion: Which NGFW Should You Shortlist?

For most enterprises evaluating next-generation firewall options in 2026, the Palo Alto Networks PA-Series is an excellent starting point. Its superior application-layer control and comprehensive prevention stack often justify the premium cost for organizations with a high level of security maturity. If budget constraints or a distributed site architecture are primary drivers, the Fortinet FortiGate offers exceptional value with its integrated SD-WAN capabilities. Small businesses should initially consider the Sophos Firewall XGS for its simplicity and synchronized security features.

As your next step, we recommend shortlisting two vendors, demanding a proof-of-value test with your actual network traffic (ensuring TLS inspection is enabled), and obtaining written commitments for 3-year renewal pricing before finalizing any agreement.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.