Why I Built a Firewall Change Management Tool (From Security Consultant to Founder)

After 15 years as an enterprise security consultant, I kept seeing the same problem. Companies spent millions on firewalls but couldn’t answer basic audit questions: Who requested this rule? Why does it exist? Who approved it?

I’ve conducted hundreds of firewall audits across Germany and Europe. TISAX assessments for automotive suppliers. PCI-DSS audits for retailers. ISO 27001 certifications for manufacturers. The technology was always fine. The documentation was always a disaster.

That’s why I built a firewall change management tool. Not because the world needed another security product, but because the existing solutions didn’t solve the actual problem mid-market companies face.

The Problem I Kept Seeing

Every audit started the same way. I’d ask to see firewall change records. The IT team would produce a mix of:

The firewall itself worked perfectly. Palo Alto, Check Point, Fortinet — all properly configured, all protecting the network. But when auditors asked “show me the change history for this rule,” everything fell apart.

I’d watch companies fail audits not because their security was weak, but because they couldn’t prove their security was strong. Documentation gaps turned passing grades into major findings.

The BSI doesn’t accept “we think someone approved this in 2019” as evidence. Neither does any serious auditor.

Why Existing Tools Don’t Work for Mid-Market

Enterprise firewall change management tool options exist. AlgoSec, Tufin, FireMon — they’re excellent products. I’ve implemented all of them for large enterprises. But they share common problems for mid-market companies:

I watched a 200-person manufacturer spend €150,000 on an enterprise solution, struggle through 6 months of implementation, and still fail their TISAX audit because nobody actually used it. The tool sat there while changes happened via SSH and manual documentation.

The Moment I Decided to Build

The breaking point came during a TISAX assessment in 2024. A Tier-1 automotive supplier — good security team, modern infrastructure, real commitment to compliance. They’d done everything right except document their firewall changes.

The auditor asked for 6 months of change history. The IT manager produced a spreadsheet with 40 entries. The firewall logs showed 200+ changes in that period. The gap was inexplicable.

Emergency changes. After-hours modifications. Rules added during incidents. All undocumented because the process was too cumbersome to follow under pressure.

They failed. Not because their firewall was insecure — it was excellent. They failed because they couldn’t prove governance over their change management process. A BMW contract hung in the balance while they scrambled to remediate.

I’d seen this pattern too many times. Talented teams, solid security, failed audits. The tools weren’t the problem. The process was the problem. And the existing solutions made the process worse, not better.

What FwChange Does Differently

I built FwChange around one principle: documentation should happen automatically, not as extra work. When you make a change through FwChange, documentation is the byproduct. You’re not filling out forms after the fact. You’re making the change, and the audit trail generates itself.

When auditors ask for change history, you generate a report. Everything’s there. No spreadsheet archaeology required.

Designed for Real IT Teams

A firewall change management tool only works if people use it. I designed FwChange for the IT teams I’d worked with for 15 years:

The goal was simple: make the right thing to do also the easy thing to do. If documentation requires extra effort, it won’t happen. If documentation is automatic, it always happens.

Solving Real Audit Problems

Every feature in FwChange traces back to an audit problem I encountered:

The ENISA guidelines on network security management informed much of this design. I wanted a firewall change management tool that auditors would love as much as IT teams.

From Consultant to Founder

Building a product is different from consulting. As a consultant, I identified problems and recommended solutions. As a founder, I have to solve problems completely. The transition taught me things I couldn’t learn as a consultant:

I’m still a consultant at heart. I still do audits and assessments. But now I can offer clients a solution I built specifically for the problems I’ve spent 15 years documenting.

What’s Next

NIS2 takes effect in 2026. TISAX requirements keep tightening. The demand for firewall change management solutions will only grow as mid-market companies face compliance requirements previously reserved for enterprises.

FwChange is ready. Built by someone who’s failed audits, passed audits, and knows exactly what evidence auditors need. Built for IT teams who need solutions that work, not products that promise.

If you’re facing TISAX, NIS2, PCI-DSS, or ISO 27001 compliance — and your firewall documentation is held together with spreadsheets and hope — I built FwChange for you. Try the free rulebase scanner and see why documentation should be automatic, not additional work.