Three SKUs, and the distance between them is a cliff rather than a slope. Basic will tell you about a known malicious address. It cannot stop traffic reaching it.

These are not three rungs on a price and performance ladder. Particular security capabilities are simply missing from Basic altogether, and one of the missing ones happens to be the reason organizations deploy a firewall in the first place.

• On Basic, threat intelligence based filtering runs in alert mode and only alert mode. The documentation states it cannot deny traffic. The identical feature on Standard and Premium both alerts on and denies traffic heading to or arriving from known malicious IP addresses and domains.
• Basic is also without network level FQDN filtering across all ports and protocols, without web categories, without DNS proxy and without forced tunneling. On top of that it runs as a fixed scale unit on two backend instances instead of autoscaling.
• Basic is positioned for small and medium businesses at a throughput of roughly 250 Mbps, and for that audience it is a perfectly legitimate product. It stops being legitimate the moment anybody assumes it does what Standard does.
• The failure we see repeatedly is a Basic deployment selected during a cost exercise, sitting underneath a security architecture document written against Standard capabilities. The mismatch goes unnoticed until an incident review asks why traffic to a known malicious domain was permitted.