Imagine a set of company accounts in which 45% of the entries had no owner and no explanation: no record of who made them, or why, or on whose authority. No finance director would sign those accounts off, and no auditor would pass them. But in enterprise firewall policy, that same figure can pass without comment.

It is one of several figures in a recent large-scale analysis by FireMon, covering more than 9.2 million anonymized device-level policy checks collected since January 2025, and it is presented, as such figures usually are, so that security leaders can see how they compare with their peers.

That comparison is the trap. Holding your own against your peers feels like passing muster, but consider what you are being measured against. The benchmark describes an industry in which most policy is no longer governed and most rules do nothing at all. Being roughly average in that context is no reassurance: it just means you're failing in much the same way everyone else is failing.

It is worth looking at what these numbers actually describe, one at a time – not as a verdict on how an organization compares but as a plain account of how much trouble the ordinary state of affairs now conceals.

Most of What You Maintain is Doing Nothing

Take the biggest number first: 69% of firewall rules are unused. A rule counts as unused when no traffic matches it over the measurement period: it sits on the firewall, but nothing actually reaches it. So more than two-thirds of the rules a security team maintains and is accountable for are not controlling any traffic. That is not harmless. Many of those dormant rules still allow connections that nothing uses any more, and because no one can be certain which are safe to remove, they stay. The rule base only grows.

Every review means working through more of it, which makes the few genuinely misconfigured rules harder to find among the many that do nothing. This is policy complexity in its plainest form: not one bad decision but the accumulated weight of rules no one can fully account for, each one making the next harder to judge.

When Failure is the Average, Being Normal is the Risk

This is where comparing yourself with the field is most misleading. The analysis found that 58% of firewalls failed a high-severity check, and 48% failed at critical severity. A security leader whose estate sits close to that average might feel briefly reassured to be no worse than anyone else. But a failed check does not mean the firewall is the wrong product or badly built; it means the policy running on it is no longer enforcing what it was configured to enforce. More than half the estates measured are carrying policy in that state.

Average, here, is not a clean bill of health. It describes policy that is no longer being governed consistently, and it invites an organization to measure itself against a field that is, collectively, not governing its own policy. 

One Rule in Six is Overruling Another

This is the figure that explains why the failures go unseen. Some 17% of rules are redundant or shadowed: they overlap or override one another in ways the administrators managing them cannot readily see. A control can look healthy on inspection while a shadowed rule beneath it changes what actually happens.

So the failure rate and the unused-rule rate are not separate problems. The sheer volume of rules is what lets a shadowed one override a working control without anyone noticing, and a failure buried that way will not surface in an inspection that takes each device on its own terms. The more rules an estate accumulates, the more places a failure has to hide.

A shadowed rule stays hidden precisely because policy is read one firewall at a time, console by console. Whether any single rule is doing its job depends on the others it interacts with across the estate, and examined device by device, those contradictions cannot be reconciled because nothing holds the whole estate in a single view.

This is the case for treating policy as a control plane: a single governing layer that defines and reconciles intent across every enforcement point, rather than a set of device configurations each administered on its own. Read as one system, a shadowed rule has nowhere left to hide.

The One Number that is Actually Good News

Every other figure describes damage already done. This one is different: it points to something you can still control. In FireMon's analysis, organizations using automated change workflows saw 67% fewer change-related policy risks than those relying mainly on manual processes. Most new risk gets in when rules are changed, and a person changing a rule by hand cannot see everything else it touches across the estate. Automation can: it checks each change against the rules already in place before the change goes live, so one that would open an unintended path is stopped first, rather than found at the next audit.

A Single Audit Tells You Nothing

There is one more problem with these figures: they are taken once a year, at audit time. A number measured once is a snapshot: it tells you where you stood on that day. It cannot tell you whether you are improving or slipping throughout the rest of the year – which is what actually matters.

The alternative is to measure continuously: score the whole estate, watch the figures month to month, and catch recurring failures as they happen. Done continuously rather than once for a report, this is what shows which controls are failing, where failures recur, and how change requests actually move through the workflow. Policy posture is something to watch, not something to photograph once a year.

Moving to Governing, Not Benchmarking

Seeing the problem clearly does not, by itself, solve it. The aim is to retire unused rules and track down the owners of the rest, but this state of affairs will not hold while the conditions that produced them remain. Within a year, the estate will be refilled again. The figures will only improve when policy is governed as a single system rather than a collection of devices: when every change is validated against intent before it is deployed, and the running estate is kept continuously reconciled to deliberate decisions across every enforcement point. 

Treating policy as a control plane – one governing layer that defines, validates and maintains intent across firewalls, cloud security groups, microsegmentation, SASE and ZTNA, rather than device by device and console by console – is what turns a page of benchmarks into something an organization can act on. 

The real measure of a policy program, then, is not how it compares with the field, and certainly not the number of rules it maintains. It is whether the organization can say, at any point and not only at audit, what access is permitted, what has changed, whether that change broke policy, and whether access still reflects a genuine business need. A firewall estate that can only be ranked against its peers is being judged by the wrong measurement. One governed as a single, deliberate system can answer for itself.