Try our new research platform with insights from 80,000+ expert users

Hillstone S-Series Network Intrusion Prevention System vs KerioControl vs Palo Alto Networks Advanced Threat Prevention comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Mindshare comparison

As of February 2026, in the Intrusion Detection and Prevention Software (IDPS) category, the mindshare of Hillstone S-Series Network Intrusion Prevention System is 1.5%, up from 0.5% compared to the previous year. The mindshare of KerioControl is 2.7%, down from 3.8% compared to the previous year. The mindshare of Palo Alto Networks Advanced Threat Prevention is 5.4%, up from 5.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Intrusion Detection and Prevention Software (IDPS) Market Share Distribution
ProductMarket Share (%)
Palo Alto Networks Advanced Threat Prevention5.4%
KerioControl2.7%
Hillstone S-Series Network Intrusion Prevention System1.5%
Other90.4%
Intrusion Detection and Prevention Software (IDPS)
 

Featured Reviews

reviewer1080873 - PeerSpot reviewer
Senior Consultant at a tech services company with 51-200 employees
Complements any firewall
The core processors are there and it's able to generate reports for that. It also complements any kind of firewall. For example, if an end user is using Palo Alto as a firewall, they'd need another layer of firewall like the S-Series that will protect internal servers. It's something that complements any firewall in the market.
MM
Senior Systems Tech/Admin at Samco Software Inc.
Comprehensive Security Features and High Ease of Setup Elevate User Experience
The best features for KerioControl are its proprietary VPN protocol, which does not connect easily with other firewalls unless you enable IPsec. It will only connect to KerioControl. KerioControl is very valuable for business. Key points where KerioControl is valuable include its own anti-spam, intrusion prevention, and antivirus, which is included in the yearly subscription renewals. The VPN capabilities are helpful in managing my remote or distributed workforce, as we create documents and set up a location for clients to download. Clients can download KerioControl's VPN client online, and they just have to log in from the VPN client, which connects easily. I assess the firewall function in filtering both incoming and outgoing network traffic with KerioControl as excellent. Everything is logged, and any intrusion, antivirus, virus, or anything foreign to the system trying to hack in gets logged, and we can easily block those IPs.
Partha Dash - PeerSpot reviewer
Global Network Tech Lead at a tech vendor with 10,001+ employees
Advanced protection enables us to confidently secure against evolving threats
Palo Alto Networks can improve Advanced Threat Prevention by catering to the growing adoption of AI and agentic tooling. The Threat Protection modules should have the necessary intelligence to protect against those types of threats, as AI will be there to do a human job; this is an evolving area. From an Advanced Threat Protection perspective, the technology associated with Palo Alto Networks, such as their sandboxing environment, is quite good. However, Palo Alto needs to focus on how to bring that technology to end users and how easy it is to use, especially in a hybrid environment where users work from various locations. While Palo Alto excels in certain setups, they need to improve the user experience in distributed working conditions.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Setup is straightforward with the same reliability and scalability as the firewall series."
"The most valuable feature is the reliability of VPN capabilities. The VPN has been very reliable and secure. The security has been very good and the VPN connections are reliable in that they stay up. We don't have a lot of problems with downtime and that type of thing."
"I like intrusion detection and prevention and bandwidth management. The routing part is also awesome. It is a good firewall. We never had a major breach from outside. We've never been impacted by ransomware, and our systems have never been infiltrated."
"I love the VPN that we set up. A few of us have it on our computers so that if we leave, we can still access the stores. And we can work from home if needed. When I sign into that Kerio VPN, it links me like I'm sitting in the store. It puts me in our secure network so that I can sign on to each individual store and I can run numbers... If I have to work from home, it's so much faster than the way we used to do it."
"Its support is very good, and it is stable product.​"
"Compared to other solutions, accounting and live monitoring of firewall status are very good features in KerioControl."
"In terms of the comprehensiveness of the security features, it does a great job of laying out what it does. It's fairly easy to edit and research. Some of the features were turned on by our IT company and I was able to easily find other features on my own by searching for videos on the internet. I've been able to block certain websites, and content filter, as well as manage some of our bandwidth because we live stream on Sunday. I'm able to dedicate bandwidth for the encoder that goes to the internet. It always has enough bandwidth, no matter how many people are on the network. That's really helpful."
"The user interface and the ease of use are pretty good. Everything fits together so nicely."
"The flexibility of the system, the capacity to provide the right level of security, and the ability to be integrated into different kinds of infrastructures are the most valuable features."
"It's a monster, it's got so many beautiful features. We do deal with other firewalls and we've got a better idea of what other firewalls' capabilities are, any comparison with the Palo Alto I liked the quality of service on the applications that you can control the amount of bandwidth an application is allowed to consume. The best feature is the quality of the application quality of service."
"A strong point of Palo Alto Networks Advanced Threat Prevention is their product called GlobalProtect VPN, where if you enable this service, there is no other firewall available for this security profile because when you go outside of the computer network, you must connect to the Palo Alto VPN before accessing the internet, which means there will be complete security visibility."
"It effectively prevents malware, ransomware, and other attacks."
"The user interface is a bit more professional than some free products."
"The most valuable features are the simplicity, transparency, and overall ease of management."
"Everything has been okay with the solution. We are using all of the features."
"Palo Alto Networks Threat Prevention is the market leader as far as security gateways and endpoint protection. Additionally, the threat database that is used is one of the best."
"The application control and vulnerability protection are the most valuable features."
 

Cons

"Lack of tools to help educate end users"
"Kerio Control could improve by having higher availability and adding a mobile VPN channel. These additions are needed. The VPN is working fine on the Kerio Control but there needs to be a VPN client on the mobile phones, both for iOS and Android. This would be very good for us."
"The security part of the software, like virus scanning, website, traffic monitoring, things like that, can take a beating on the appliance. And when there's a lot of things going on, the system can get bogged down. The actual security functionality of it needs a little bit more work, which I believe they are remedying or attempting to remedy at this time, but that's the downfall at this time."
"The Kerio hardware devices look cheap and could be improved. Some of our clients are switching to Sophos because their hardware has a more sleek design."
"Their support is getting better but still needs improvement."
"There's also room for improvement in the Traffic Rules. We define networks to use a specific outgoing interface, say VSAT, shore, or marine WiFi, which is okay. But then all we have is a checkbox that says "Use other internet interfaces if this one is unavailable." What we would prefer would be to have a priority list. So if VSAT is unavailable, try to use 4G, etc. We haven't really found a reliable way of doing that in the current release."
"I would like to see them develop a bit more flexibility creating VLANs."
"The solution should offer more dashboards."
"KerioControl has met some of the network infrastructure needs yet could improve in terms of scalability, which I rate four out of ten."
"Generally, to deploy it will take some downtime, about a day."
"The cost involves the price of the hardware, which is expensive. However, most of the Palo Alto solutions are expensive."
"The installation was complicated."
"It's not so easy to set up a test environment, because it's not so easy to get the test license. The vendor only gives you 90 days for a test license; it's a tough license to get."
"There is a potential drawback with the lack of support for the ICAP protocol."
"The price of licenses should be lowered to make it less costly to scale our solution."
"We are attempting to improve the use of URL filtering beyond threat protection."
"I think they can use some improvement on FID."
 

Pricing and Cost Advice

Information not available
"The fixed model of users and devices is a bit of a problem for us. We want to be able to expand it fast and not have to contact our supplier first to get a license... If they had a larger fixed price with unlimited users or devices, that would help. Now, it's five users each time. A pack of 100 or 200 users for a certain price would make it more dynamic and user-scalable."
"The biggest advice that I could probably give people is when you buy the solution be prepared to either buy the unlimited license or buy more licenses than you think. Each user license gives you one employee and each a user gives you five devices. In the world nowadays where everybody has a cellphone, tablet, desktop, and laptop, that's four devices. You still get one more device per person. That covers your servers and back-ends."
"The yearly maintenance fee is a bit high for the Kerio Control Boxes. The end of life for the devices is kind of short. It seems like they're making you upgrade within a short period of time. They should at least allow five years, but it seems like they are changing their end of life to be shorter to generate revenue."
"The price of Kerio Control could be better, it is a bit overpriced compared to other solutions."
"It gives us a lot. It does prove to be a very robust product for the cost."
"There's a one-time fee. For KerioConnect, it's just a server. With KerioControl, you have an option. You can virtualize it on a VMware system or have the hardware. I think mid-range or desktop KerioControl hardware could cost around 2000 dollars for a 25 user client. You need annual renewal for additional features like antivirus."
"Its price is fair. There are no additional costs."
"Pricing is good, but the licensing took a lot of time."
"From one to ten, with one being the most expensive, I would rate the pricing of Palo Alto Networks Threat Prevention a one out of ten. It is my understanding that Palo Alto Networks Threat Prevention is the most expensive one."
"The cost involves the price of the hardware, which is expensive. However, most of the Palo Alto solutions are expensive."
"If you want to have all of the good features then you have to pay extra for licensing."
"The price of the solution is higher than others on the market. A price reduction would be beneficial if it does not impact their database quality."
"It's not too expensive."
"It is an expensive solution and I would like to see a drop in price."
"The pricing has improved with the newer generation of their Firewalls, but the price could always be lower."
"Palo Alto Networks Advanced Threat Prevention is quite competitive, offering extensive threat detection and prevention capabilities, though it is priced higher than some alternatives."
report
Use our free recommendation engine to learn which Intrusion Detection and Prevention Software (IDPS) solutions are best for your needs.
881,928 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
No data available
Computer Software Company
18%
Comms Service Provider
8%
Manufacturing Company
7%
Media Company
7%
Computer Software Company
9%
Financial Services Firm
9%
Manufacturing Company
8%
Performing Arts
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business44
Midsize Enterprise9
Large Enterprise3
By reviewers
Company SizeCount
Small Business9
Midsize Enterprise4
Large Enterprise14
 

Questions from the Community

Ask a question
Earn 20 points
What is your experience regarding pricing and costs for KerioControl?
KerioControl offers good pricing as one license covers all features needed without extra payment. The price for the p...
What needs improvement with KerioControl?
Regarding KerioControl's application awareness and control feature, I have not used it much.
What is your primary use case for KerioControl?
With KerioControl, we usually use them for site-to-site VPNs for most of our clients. With multiple offices, we use K...
Which is the best DDoS protection solution for a big ISP for monitoring and mitigating?
Arbor would be the best bid, apart from Arbor, Palo Alto and Fortinet have good solutions. As this is an ISP, I would...
What is your experience regarding pricing and costs for Palo Alto Networks Threat Prevention?
Palo Alto Networks Advanced Threat Prevention requires an add-on license and is considered expensive compared to comp...
What needs improvement with Palo Alto Networks Threat Prevention?
Palo Alto Networks can improve Advanced Threat Prevention by catering to the growing adoption of AI and agentic tooli...
 

Also Known As

Hillstone S-Series NIPS
No data available
No data available
 

Overview

 

Sample Customers

Information Not Available
Triton Technical, McDonald's
University of Arkansas, JBG SMITH, SkiStar AB, TRI-AD, Temple University, Telkom Indonesia
Find out what your peers are saying about Fortinet, Darktrace, Check Point Software Technologies and others in Intrusion Detection and Prevention Software (IDPS). Updated: January 2026.
881,928 professionals have used our research since 2012.