Next-generation firewall · Engineered in Germany
Application control, TLS inspection, IDS/IPS, DLP and AI governance in one engine — installed as a package on the OPNsense or pfSense CE boxes you already run, or from an image as ZedmosOS. Every firewall in one multi-tenant console on your server, or ours in Frankfurt. Under German and EU law.
Free tier: 3 firewalls for 30 days. After that read-only — never blocked. FreeBSD-based operating system · WireGuard and GRE in the engine · CycloneDX SBOM per release · EU Cyber Resilience Act · Self-hosted management
Integration and automation
Inspection, connectivity and operations are not three products bolted together. They read the same policy, produce the same records and are configured from the same console.
Classification, inspection and one verdict per session, produced on the box that carries the traffic.
Learn moreEncrypted overlays between sites, per-application egress across uplinks, and failover that moves traffic before anyone notices.
Learn moreOne console for every organisation you manage, scoped access down to a single firewall, and records your SOC already ingests.
Learn moreWhy switch
Four reasons, each with its source. The full comparisons are a page each.
The market
Incumbent firewalls are sold as hardware plus an annual security bundle, on a five-year clock after which updates and support stop. Appliance prices rose 5–20 % at one vendor in March 2026 and 10 % at another in July.
Zedmos
Zedmos is software. It runs on x86 hardware you own, and the support period is the software's — published, at least five years, and independent of any box.
Source: Vendor earnings calls and price notices, 2026
The market
The CISA catalogue of vulnerabilities known to be exploited lists 29 entries for the largest firewall vendor and 17 for another. It is a public record, counted from the catalogue itself.
Zedmos
Ours is zero, and we publish it — together with our Cyber Resilience Act class, an SBOM per release and the support period. The page stays up whatever the number becomes.
Source: CISA KEV catalogue v2026.09.01
The market
Most incumbent management consoles are cloud services operated by US-headquartered companies. US law obliges them to disclose customer data regardless of where it is stored; an EU hosting region does not change that. Firewall logs are personal data under the GDPR.
Zedmos
The Zedmos Console is a container on your server, under your domain. Nothing in it leaves. Our own licence and threat-intelligence services run in Frankfurt, under German and EU law.
Source: 18 U.S.C. § 2713; CJEU C-582/14
The market
The one request MSPs running OPNsense and pfSense have repeated since 2017 is central management. What arrived is tied to one platform's paid edition, priced per device, and blocks third-party packages.
Zedmos
Zedmos installs as a package on the OPNsense or pfSense CE box you already run, and manages both from one multi-tenant console. Evaluate it before you touch any hardware.
Source: r/msp, 2017–2026; vendor product pages
The product line
The firewall
Our operating system and our inspection engine, installed from an image onto your hardware. Routing, filtering, inspection and policy in one system.
Learn moreManagement
One console for a thousand firewalls across a thousand organisations — installed on your own server, under your own domain.
Learn moreOn OPNsense
The same engine as a package on an OPNsense box you already run, so you can evaluate it before you change any hardware.
Learn moreOn pfSense
The same engine again, packaged for pfSense. One policy model and one console, whichever of the two you standardised on.
Learn moreHardware
Zedmos does not make hardware. These are the three configurations it is validated on, so you can build to a known-good specification, buy one built to it, or ship it under your own brand.
Z-200 Branch
Z-800 Campus
Z-2400 Datacenter
What is inside
Operating system
A FreeBSD-based system built for one job. The engine is attached directly to the interfaces — no hairpin to a proxy host, no second appliance in the path.
Control plane
A container you run yourself. It holds the tenancy tree, the policy sets and the counters — and nothing leaves it.
Intelligence
Curated feeds with confidence scoring and a datacentre-aware exception list, so a cloud ASN does not break Microsoft 365.
Compliance
A CycloneDX SBOM per release, a published disclosure policy, and a five-year security-update commitment under the CRA.
Zedmos Threat Intelligence
Indicators are gathered, cross-checked against an allowlist of the domains the internet actually runs on, tiered by how much corroboration each one has, and shipped to your firewalls. The figures below are read from the service as this page loads.
Figures read from the service
How the catalogue is builtFor service providers
The console runs on your server, under your domain. Your customers' traffic records never transit a vendor platform — which is a materially easier conversation in a procurement review.
MSP
Onboard a customer without a site visit, and keep their records on infrastructure you control.
Learn moreMSSP
Every verdict carries the rule and the finding behind it, in the formats your pipeline already reads.
Learn moreOEM
Your brand, your interface prefix, your update channel. Nothing in the running system names a supplier.
Learn moreThe console
The real interface, photographed from a working system. Site names, addresses and people are stand-ins, and the example estate is shown fully connected — your own console shows the state your own links are actually in.
Every site on one map
Fleet · 1 of 9
The console opens on the whole estate: organisations, branches and gateways in one tree, and every site placed on a live map with its current health.
Trust
Process
Cyber Resilience Act obligations, the support-period table, and how a release reaches a firewall.
Disclosure
Where to send a vulnerability, what happens next, and the window we commit to.
Engineering
One codebase behind both packages, judged on precision against real traffic rather than on rule count.
References
References on request under mutual non-disclosure. No customer is named without written consent.
A demonstration runs on your topology rather than ours. For pricing, a partner conversation or a technical walkthrough, one email is enough.