In short
Check Point AI Network Firewall is AI security delivered from Check Point firewalls customers already run, announced on 30 July 2026 in firewall software release R82.20. It discovers and governs employee AI use, discovers MCP communication and enforces access, and blocks prompt injection aimed at AI applications. It can act as an additional enforcement point for Workforce AI Security.
Get a quote for Check Point AI Network Firewall
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What the AI Network Firewall is
On 30 July 2026 Check Point announced the AI Network Firewall, delivered as part of Check Point firewall software release R82.20. Check Point's point is that AI has created a new kind of network traffic (prompts, agent actions and sensitive business context) that traditional firewalls were not designed to understand, and that the firewall is where much of that traffic already passes.
Rather than adding a separate appliance, the capability runs on the physical or virtual Check Point firewalls customers already operate, across branches, data centres, cloud and multi-cloud environments. Check Point's FAQ says no new hardware or additional infrastructure is needed. It forms part of Check Point's AI Defense Plane: see our Check Point AI Security overview.
R82.20 is a software release, not a hardware model. Whether and when your firewalls can run it is one of the first things we check.
What it covers: three domains
| Domain | What Check Point says the AI Network Firewall does |
|---|---|
| Employee AI use | Discovers AI apps, agents and tools in use, both shadow and sanctioned; gives visibility of how AI is used, including prompt use cases and intent; governs access to approved tools; stops sensitive data leaving based on the prompt's use case |
| AI agents and MCP | Discovers Model Context Protocol communication, gives visibility of MCP servers and the tools used, and enforces policies to control access |
| AI applications and LLMs | Prevents prompt injection and adversarial inputs inline, blocking malicious prompts before they reach the model, with no application changes required |
Check Point's R82.20 release notes describe the building blocks: Workforce AI Security on the firewall inspects prompts and files uploaded to AI applications, and firewalls can use Check Point AI Guardrails to protect generative and agentic AI traffic, with prompt injection protection, content moderation and protection for MCP tool responses.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Workforce AI Security on the firewall
In August 2026 Check Point explained that organisations can now use their existing Check Point firewall infrastructure as an additional enforcement point for Workforce AI Security, gaining visibility of employee AI use and applying controls to AI interactions from the firewall.
Check Point's FAQ makes two useful points:
- The AI Network Firewall delivers Workforce AI capabilities from the firewall with no agent, browser extension or client installation required.
- It still adds value if you already detect AI tools another way, because the firewall sees unmanaged devices, shadow AI and network-level AI traffic.
That makes it a good complement to the browser extension and desktop agent rather than a replacement. Device-based enforcement sees what happens on managed laptops wherever they are; the firewall sees what crosses your network, including devices you cannot install software on. Read how Workforce AI Security works for the endpoint side.
Where it sits in the AI Defense Plane
Check Point positions the AI Network Firewall as one enforcement point in a wider architecture. In its July 2026 announcement it described the AI Defense Plane as delivering:
- discovery, governance and protection for AI across web, desktop, coding assistants and AI agents;
- runtime protection and governance for AI applications; and
- risk detection and guardrails for home-grown and deployed AI.
It also listed other enforcement points across the AI Defense Plane: a standalone API for self-managed applications, the endpoint for employees, a containerised firewall for AI data centres, and WAF. The practical upshot is that policy decisions made for Workforce AI Security and Check Point AI Agent Security can be enforced in more than one place.
Is Check Point AI Network Firewall the right fit for you?
We will check it against your systems and requirements and recommend the right option.
What is an AI firewall?
"AI firewall" is used loosely across the industry. It usually means a control that inspects AI-specific traffic (prompts, responses, file uploads, agent tool calls) rather than only addresses, ports and applications, and applies policy to that content: blocking unapproved AI apps, stopping sensitive data in prompts, or filtering malicious input heading for a model.
Some products sit in front of a single AI application; others are separate virtual appliances. Check Point's approach is to build AI inspection into the firewall estate you already manage, with policy shared across the rest of its AI Defense Plane. Whichever approach you take, AI firewalls reduce prompt injection risk rather than remove it, as the NCSC has stressed.
Firewall, browser extension or desktop agent?
Each enforcement point sees something different:
| Enforcement point | Sees | Best for |
|---|---|---|
| Browser extension (Workforce AI Security Essentials and Enterprise) | AI used through web applications on managed browsers, wherever the user is | Web chat tools and SaaS AI features |
| Desktop agent (Workforce AI Security Enterprise) | Desktop AI apps, coding assistants, local agents and MCP on managed devices | Developers and heavy AI users |
| AI Network Firewall (R82.20) | AI traffic crossing your Check Point firewalls, including from unmanaged devices | Offices, branches, data centres and guest or BYOD networks |
| Check Point SASE | AI use by people connecting through Check Point's SASE service | Remote and hybrid users on SASE |
Most organisations combine at least two. If you use Check Point's SASE service, our sister site covers Check Point Harmony SASE.
Who the AI Network Firewall suits
It is most relevant if:
- You already run Check Point firewalls, physical or virtual, and want AI visibility without deploying more software to every device.
- You have unmanaged or shared devices, guest networks or BYOD where you cannot install an extension or agent.
- You want MCP and agent traffic between servers and services discovered and governed at the network level.
- You host AI applications or LLMs and want inline prompt injection prevention in front of them.
If you do not run Check Point firewalls, start with Workforce AI Security, which works through a browser extension and desktop agent regardless of your network vendor. If your firewalls run in public cloud, our sister site covers Check Point CloudGuard Network Security.
What to check before you plan it
A few practical questions shape the project:
- Firewall software version. Which release your firewalls run today, and what an upgrade to R82.20 involves for your estate.
- Licensing. Which AI security licences apply to your firewalls and users; Check Point confirms entitlements and we confirm them at quote.
- Traffic visibility. How your firewalls currently handle encrypted web traffic, since content-level AI controls depend on what the firewall can inspect.
- Policy ownership. Who owns AI policy, and how firewall rules will line up with Workforce AI Security policies on devices.
- Pilot scope. Which site or network segment to start with, in discovery mode, before enforcing.
We help you work through each of these before anything changes on a production firewall.
How Forever Systems helps
We help Check Point firewall customers decide whether the AI Network Firewall is the right next step:
- We review your current Check Point estate and how AI is used across it.
- We help plan where firewall enforcement fits alongside the browser extension, desktop agent and SASE.
- We help scope licences and the R82.20 upgrade path with you and Check Point, and quote; ask us for a quote.
- We help turn your AI acceptable use policy into rules that apply consistently across devices and network.
To discuss the Check Point AI Network Firewall, contact us.
How Forever Systems helps you use AI safely
We are an independent UK IT and cyber security provider. We supply Check Point Workforce AI Security and help organisations put sensible, workable rules around AI at work.
- See what is really in use: we can start with a discovery pilot, so you know which AI tools, browser extensions, coding assistants and agents your people use before anyone writes rules
- Policy you can enforce: we help you decide what to approve, restrict or block, and turn your AI acceptable use policy into Workforce AI Security policies
- The right tier: Essentials for browser-based AI, Enterprise when desktop apps, developer code assistants and agents are in the picture, confirmed at quote
- Staged roll-out: from monitoring to warnings, redaction and blocking at a pace your people can absorb, with reviews along the way
- Around the tool: Microsoft 365 permissions ahead of Copilot, device management for the extension and agent, and safe use of AI training for staff
We work with businesses, schools, charities and public sector organisations. Our guides are general information, not legal advice.
Frequently asked questions
What is the Check Point AI Network Firewall?
It is AI security delivered from the Check Point firewalls organisations already run, announced on 30 July 2026 as part of firewall software release R82.20. It covers employee AI use, MCP discovery and access control, and inline prompt injection prevention for AI applications.
Do I need new hardware for the AI Network Firewall?
Check Point says no: it runs on the physical or virtual Check Point firewalls customers already operate. Your firewalls do need to run the relevant software release, R82.20, and the appropriate licences, which we confirm when scoping.
How is it different from Workforce AI Security?
Workforce AI Security uses a browser extension and, in the Enterprise tier, a desktop agent on managed devices. The AI Network Firewall delivers Workforce AI capabilities from the firewall without installing anything on devices, so it can also see unmanaged devices. Check Point positions the firewall as an additional enforcement point.
Can the AI Network Firewall discover MCP servers?
Yes. Check Point says it can discover MCP servers and communication, give visibility of agent activity and the tools used, and enforce policies controlling access to tools, services and resources.
What is an AI firewall?
An AI firewall is a control that inspects AI-specific traffic, such as prompts, file uploads, responses and agent tool calls, and applies policy to it: blocking unapproved AI apps, stopping sensitive data in prompts or filtering malicious input aimed at AI models.
Still have a question about Check Point AI Network Firewall?
Ask us and a member of our team will reply by email.