WatchGuard said it acquired ActZero to add capacity, scalability and technology to its managed detection and response (MDR) service. CEO Prakash Panjwani said the goal was to help the company serve a larger partner base and expand MDR across WatchGuard products and third-party security tools. The deal was announced on January 8, 2025; WatchGuard says it signed and closed the transaction on December 17, 2024.
Why WatchGuard acquired ActZero
WatchGuard presented the acquisition as a way to scale a service that was gaining traction. Panjwani said: “We realized the need to scale rapidly as we have gained traction throughout the year with our MDR service.” He added: “The acquisition of ActZero allows WatchGuard to add capacity, scalability, and new technology that will enable our MDR service to expand to the full WatchGuard portfolio and third-party security products.” (WatchGuard’s January 8, 2025 announcement.)
WatchGuard described ActZero as an MDR provider with proactive threat response and cross-platform, AI-driven threat analysis. It said ActZero’s people and services would become the foundation of WatchGuard’s MDR product line. Those are the company’s descriptions of the rationale and intended product direction, not independent findings about service performance.
What the deal was intended to mean for MSPs
WatchGuard framed its MDR offering as a way for managed service providers (MSPs) to offer round-the-clock security monitoring without building and maintaining their own security operations center. That is the company’s stated value proposition; the acquisition announcement does not establish customer outcomes or show that every MSP can dispense with internal security resources.
#1 Best Overall
- WatchGuard Firebox T45 tabletop appliances bring enterprise-level network security to small office/branch office and retail environments. These appliances are small-footprint, cost-effective security powerhouses that deliver all the features present in WatchGuard’s higher-end UTM appliances, including all security capabilities, such as AI-powered anti-malware, threat correlation, and DNS-filtering.
- 5G and Wi-Fi 6 enabled models available. Up to 3.94 Gbps firewall throughput, 5 x 1Gb ports, 30 Branch Office VPNs
- Zero-touch deployment makes it possible to eliminate much of the labor involved in setting up a Firebox to connect to your network - all without having to leave your office. A robust, Cloud-based deployment and configuration tool comes standard with WatchGuard Firebox appliances. Local staff connects the device to power and the Internet, and the appliance connects to the Cloud for all its configuration settings.
- Firebox T45 models make network optimization easy. With integrated SD-WAN and optional 5G technology, you can ensure failover to the cellular network, minimize disruptive connectivity, and establish secure and reliable connections for small offices.
- Standard Support includes 24x7 access to technical support, with an unlimited number of incidents with a targeted response time of 24 hours for low priority, 8 hours for medium priority, 4 hours for high priority, and live calls for critical priority. Support is Web-Based and Phone-Based.
WatchGuard said it introduced MDR in October 2023. Its January 2025 announcement described monitoring for endpoints and Microsoft 365 activity, alongside threat hunting, detection, investigation, containment and guided remediation recommendations. This is an announcement-period description, not a complete or verified current service specification.
Integrations: announced capability versus completed work
In a January 2025 interview, CRN reported that ActZero supported endpoint tools including CrowdStrike Falcon and Microsoft Defender. The interview also reported WatchGuard’s plan to integrate its own endpoint protection into the offering during the first half of 2025. That was a plan at the time, not confirmation that the integration was completed. The available announcement-period reporting does not establish WatchGuard MDR’s current integration list or service terms.
Rank #2
- The Firebox NV5 utilizes the same platform as other WatchGuard Firebox, Wi-Fi, authentication, and endpoint solutions. Whether scheduling firmware upgrades or monitoring access points, technicians have one user experience.
- Designed to support remote VPN connections back to a corporate virtual or physical Firebox, the NV5 can route traffic back to the corporate security appliance using WatchGuard Branch Office VPN (BOVPN) capabilities to provide the same level of protection as a device sitting at the corporate office.
- Streamline network setup for the NV5 in WatchGuard Cloud. You can easily define network segments, keeping things like VoIP systems or IoT devices separate from your business-critical applications. Creating a VPN deployment is a breeze. With pre-configured policies you can get up and running quickly ‒ and securely. With Live Status, WatchGuard Cloud provides visibility into your network so that you can make timely, informed, and effective decisions about your network and security configurations.
- Includes SD-WAN and VPN capabilities - Up to 200 Mbps VPN throughput, 3 x 1 GbE ports, Up to 5 users
- WatchGuard RapidDeploy makes it possible to eliminate much of the labor involved in setting up a Firebox to work for your network ‒ all without having to leave your office. RapidDeploy is a powerful, Cloud-based deployment and configuration tool that comes standard with the Firebox NV5. Local staff simply connect the device to power and the Internet, and the NV5 automatically downloads and applies the pre-determined configuration.
For an MSP assessing an MDR service, the useful questions are practical:
- Coverage: Which endpoints, cloud services and third-party products are supported?
- Response scope: Does the service detect and investigate threats, contain them, and provide remediation guidance—or perform remediation directly?
- Operating model: What does 24/7 coverage include, and what security work remains with the MSP or its customer?
- Integration status: Is a needed product supported now, and is that support documented in current service materials?
What the announcement-period figures do—and do not—show
The deal coverage gave different partner counts, with different wording and sources. They should not be read as directly comparable or as current totals.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
- Watchguard T125 Firebox with 1 Year Standard Support License (WGT125001) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- Standard Support covers software updates and round-the-clock emergency help. Add a Basic or Total Security Suite to activate IPS, gateway antivirus, and web filtering so threats are blocked before they reach users.
- Standard Support provides reliable technical assistance and software updates for WatchGuard Firebox appliances. Offering 24x7 help for emergencies and business-hours support for routine needs, it ensures your network stays secure and operational.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
| Figure | Source and qualification |
|---|---|
| More than 25,000 MSPs and over 1.5 million customers worldwide | WatchGuard-reported figures in its January 8, 2025 acquisition announcement; not independently verified or presented as current totals. |
| 17,000 active MSP partners | CRN’s January 2025 report of Panjwani’s remarks. “Active” is narrower wording than WatchGuard’s broader MSP figure. |
| 40 ActZero employees and nearly 1,300 WatchGuard employees after the acquisition | CRN’s January 2025 report of Panjwani’s remarks; announcement-period headcounts, not current staffing figures. |
What ActZero’s leadership said
ActZero co-founder and CEO Sameer Bhalotra said the integration would expand the team’s AI-powered MDR solution and expert analysis worldwide. His description included the phrase “unmatched protection against cyber threats”; that is a promotional characterization, not an independently established comparison with other services.
What is known about the transaction date
WatchGuard publicly announced the acquisition on January 8, 2025. In a separate announcement published the same day, the company said the transaction had been signed and closed on December 17, 2024. The distinction matters: January 8 was the public announcement date, not the stated closing date. (WatchGuard’s transaction announcement.)
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
