AWS Network Firewall Exploit Block Rate: Analysis of CyberRatings 2025 Test Results

AWS Network Firewall blocked 0.59% of exploits in independent testing - what this means for your cloud

CyberRatings.org published a Q1 2025 comparison of ten cloud firewall providers where AWS Network Firewall blocked only 0.59% of 2,028 tested exploits. This effectiveness dropped to 0% when researchers applied standard security bypass techniques at layers 3, 4, and 7.

Why This Matters

There is a significant architectural disconnect between marketing claims of ‘intrusion prevention’ and the reality of cloud-native firewall implementations. While AWS utilizes Suricata, its implementation lacks critical capabilities such as Lua scripting, file extraction, and protocol-level normalization, making it vulnerable to standard evasion techniques like IP fragmentation and TCP segmentation. For organizations in regulated industries, relying solely on native firewalls for IPS functionality creates a dangerous security gap compared to dedicated third-party NGFWs which achieved 99.61-100% block rates in the same tests.

Key Insights

• AWS Network Firewall achieved a 0.59% block rate against 2,028 exploits and 0% against 2,500 bypass attacks in the CyberRatings Q1 2025 report.
• Native Suricata functionality is limited in AWS NFW, lacking support for Lua scripts, IKEv2 detection, and custom dataset matching (AWS Documentation, 2025).
• Stateless rules often interfere with stateful inspection due to higher priority, leading to a recommendation to forward all traffic to stateful groups (CyberRatings, 2024).
• Hyperscale providers generally prioritize data storage and distribution over high-tier cybersecurity, with Azure and GCP also failing bypass tests (SDxCentral, 2025).
• Third-party NGFWs like Palo Alto and Fortinet maintain block rates near 100% by performing expensive protocol normalization and continuous signature updates (CyberRatings, 2025).

Practical Applications

• Use AWS Network Firewall for domain-based outbound filtering and basic VPC-to-VPC segmentation to utilize its low operational overhead and native logging.
• Pitfall: Using AWS NFW as the sole IPS for PCI-DSS or HIPAA compliance without acknowledging its failure to detect 99% of signature-based CVE exploits.
• Deploy a third-party NGFW like Palo Alto VM-Series in a centralized VPC for deep packet inspection of high-risk, regulated traffic flows.
• Pitfall: Configuring stateless rules that block Suricata’s stateful engine, effectively disabling the firewall’s more advanced inspection capabilities.

References:

• https://dev.to/haitmg/aws-network-firewall-blocked-059-of-exploits-in-independent-testing-what-this-means-for-your-51p6