This is not a forum for product recommendation. But to give you some things to look out for:
- Phrases and Buzzwords: UTM, NGFW, IPS, IDS, Firewall, Secure gateway... are just words and say nothing about the technology used and of their limitations. And there are lots of limitations: sometimes because of the underlying technology and sometimes to make it faster and cheaper.
- Marketing: Everybody claims to be the most secure, the fastest and the cheapest. Often not the best product wins but the one with the best marketing or the lowest price, because normal users can't tell the difference anyway: it's a lemon market.
And what product is best depends on what level of security you need. If you are not dealing with sensitive data it might be enough to protect against ransomware and against malware which integrates your company into a botnet. As soon as you deal with customer data, do interesting research, maybe have connections to government organizations you get more interesting for an attacker because it might be worth to steal data from you or to use you as a trampoline for attacking some more important organization.
Protection against low level DOS is different from protecting users surfing the web. For the first a fast packet filter is needed and for the second you need application level filtering. And it is not only important if the device can do web (or even web 2.0 like lots claim) but how deep they look into the traffic. Simply blacklisting URL's is much easier than actually analyzing the payload but also provides less security. The deeper a device looks into the traffic the more protection it can offer but the slower it will get and the more it will cost. There is no magic sprinkling around this simple fact, even if it is called "next generation firewall" or "unified threat management", "cloud security"...
No NGFW, UTM, whatever will fully protect the network. Thus you need to use isolation between different parts of the network to limit the impact of malware. Do not simply let mobile devices into the critical production network, because you don't know how infected they are. Simply think how you would behave if you know that somebody visiting you might have an infectious disease.
The more you know about your network the better you can protect it, because you can restrict it to what it should do in your opinion and detect any violations. Security is not simply installing some device and forget it, but monitor what's going on in your network, adjust the rules so that they are as tight as possible etc. And you probably must hire somebody to do this for you or outsource the management of the firewall. The best firewall will not help if the person maintaining it has no real understanding of the problems.
Maybe you better don't buy directly from a vendor but go to an independent security company which sells competing products and often also can do the management for you. They will know more about the abilities and limitations of each of the products than a single vendor is willing to tell you. But of course some will simply try to sell you the product where they make the most profit instead the one best suited to your environment.
Sounds hard and expensive? It is. You only know that it might have been smarter to invest in better security (products and also training) if your data are lost, your identity is compromised and the customers look somewhere else in the hope that somebody can keep their data more secure.
I have Googled a lot on the effectiveness of UTMs, but I can't seem to find neutral write-ups, ...
There is no general effectiveness of UTM, because UTM differ a lot both in features and quality. Today you will not find much products which don't claim to be either a UTM or NGFW (or even both) even though they don't differ that much from the previous firewall, IPS or secure gateway products of the same company. Technologically you will often find at the lower end simple packet filters (like Linux iptables) with maybe some IDS (like Snort) and maybe some proxies (like Squid) with added Antivirus and blacklists but there are also more advanced solutions. They differ a lot between the quality of AV which range from open source ClamAV to commercial products of different quality. Same is true for the quality of blacklists, IDS signatures and how fast the vendor responds to new threats.
Bypassing the components of an UTM is often trivial because in edge cases of the protocols the data are interpreted differently in the UTM and the clients (browser etc) - this is a general problem of perimeter firewalls. Sometimes such bypasses can be done at the packet layer already (see Stonesoft Evader 2013), sometimes at the application layer (see my research 2015) or also at the layer of antivirus analysis as in this research from 2012.
Thus you should not expect too much security from these devices and better implement defense in depth, i.e. use additionally host based antivirus and isolation between networks with different security levels. But in any case most of them will probably be an improvement to what you have now.
