Abstract

Zyxel’s USG FLEX H-Series is positioned as a Unified Threat Management firewall platform that combines traditional firewall controls with embedded anti-malware protection to help stop malicious files, ransomware, and related threats before they spread across the network. In Tolly’s anti-malware efficacy evaluation, Zyxel’s USG FLEX H-Series was compared with the Ubiquiti Dream Machine Special Edition in a controlled malware-download test designed to measure real detection and blocking effectiveness. 

The test used two Zyxel models, the USG FLEX 500H and USG FLEX 100H, and one Ubiquiti UDM SE. Malware samples were stored on a server and downloaded by a test client via HTTP GET through the device under test. Engineers determined blocked samples by reviewing device logs and checking whether files in the destination folder matched the original malware files. The report defines anti-malware efficacy as the number of malware samples blocked divided by the total number of malware samples tested.   

Results strongly favored Zyxel. Across testing dates from July 3 through July 16, 2025, Zyxel’s anti-malware efficacy remained above 87% every day, with an average of 91.6%. By comparison, the Ubiquiti Dream Machine Special Edition averaged 2%. Out of 6,426 malware samples tested, the Zyxel USG FLEX 500H blocked 5,886 and the USG FLEX 100H blocked 5,902, while the UDM SE blocked 131. These results indicate a substantial difference in malware detection and blocking performance between the two platforms. 

The report also highlights architectural differences. Zyxel’s USG FLEX H-Series, when licensed with its Gold UTM pack, enables antivirus and anti-malware, sandboxing, intrusion detection, application control, content filtering, anti-spam, and related security functions in one appliance. The Ubiquiti Dream Machine does not provide a full UTM suite and lacks services such as sandboxing and spam filtering. In this evaluation, Zyxel used VuOS-fw 2025-0806 and 2025-08-14 builds, while Ubiquiti used UniFi OS UDM SE 4.3.6 with CyberSecure by Proofpoint and Cloudflare enabled.