Fast answer
Replace your firewall if any of these are true: the vendor has ended security updates for the model, it can't inspect modern encrypted traffic (TLS 1.3), your VPN has no multi-factor authentication support, the office internet upgraded but the firewall didn't, or the incident logs are empty because logging was never set up. A firewall past vendor support is a liability with a power cord.
1. It's past end-of-support (check right now)
Every firewall model has an end-of-support date after which the vendor ships no security fixes - even for actively exploited vulnerabilities. Attackers specifically scan the internet for end-of-life firewall models because they're designed unpatched. Look up your model's date today; if it's passed or within a year, replacement planning starts now.
2. It can't see inside modern encryption
Over 95% of web traffic is now encrypted, and TLS 1.3 changed how inspection has to work. Older firewalls either can't inspect it at all - meaning malware rides in on encrypted downloads unseen - or inspect it with such a performance penalty that someone turned inspection off years ago. Either way, the expensive security box is passing traffic it cannot evaluate.
3. Your VPN has no MFA
Stolen VPN credentials are one of the most common ransomware entry points. If your firewall's remote-access VPN can't enforce multi-factor authentication, every phished password is a direct line into the network. Modern firewalls integrate MFA natively; retrofitting it onto old platforms ranges from painful to impossible.
4. The office outgrew it
- Internet upgraded to fibre, but throughput with inspection enabled caps at a fraction of it.
- Headcount doubled; session tables and VPN capacity didn't.
- Cloud apps (Teams, EMR, remote desktops) are latency-sensitive in ways the old box was never sized for.
The symptom is usually "the internet feels slow" despite paying for fast service - measured properly, the firewall is the choke point.
5. Nobody can tell you what it blocked last month
A firewall with no logging, no alerts, and no reports isn't really being operated - it's being owned. If a security incident happened tonight, the logs are the difference between a contained event and a forensic mystery. Replacement projects are the natural moment to fix operations too: logging, alerting, backup configs, and a maintenance schedule.
When we replace a firewall as part of our security service, cutover happens after hours with the old unit kept as instant rollback - typical downtime is under 15 minutes, scheduled, not surprise.