X-Industry

 The single-vendor SASE market is immature and dynamic but developing rapidly. I&O leaders responsible for networking should work with their security colleagues when selecting SASE vendors and use this research to cut through marketing hype to determine which vendors best suit their needs.

Strategic Planning Assumptions - By 2025, there will be over a 50% increase in vendors with generally available single-vendor SASE offerings compared to mid-2023.  By 2026, 60% of new SD-WAN purchases will be part of a single-vendor SASE offering, up from 15% in 2023.

Market Definition/Description - This Magic Quadrant for Single-Vendor SASE is the first version of this Magic Quadrant.  It replaces the Market Guide for Single-Vendor SASE.  Gartner defines single-vendor secure access service edge (SASE) offerings as those that deliver multiple converged-network and security-as-a-service capabilities, such as software-defined WAN, secure web gateway, cloud access security broker, network firewalling, and zero trust network access.  These offerings use a cloud-centric architecture and are delivered by one vendor.  SASE supports branch offices, remote workers, and on-premises general internet security, private application access, and cloud service consumption use cases.[1]

The standard capabilities for this market include:

• Secure web access via proxy
• In-line SaaS access controls
• Identity-, context- and policy-based secure remote access to private applications

A branch appliance that supports dynamic traffic steering out of multiple physical, locally attached WAN interfaces, with steering based on applications (not IPs/ports).

Firewalling services - The optional capabilities for this market include:

• Security capabilities such as remote browser isolation, network sandboxing, DNS protection, API-based access to SaaS for data context and configuration information, web applications, and API protection
• Advanced network functionality, including enhanced internet and/or private backbone transport, content delivery networks, external DNS services, cloud onramps (simplified and automated integration with public cloud networking services), or branch routing

Magic Quadrant

Figure 1: Magic Quadrant for Single-Vendor SASE

Vendor Strengths and Cautions:

Cato Networks - Cato Networks is a Challenger in this Magic Quadrant. Its primary offering in this market is Cato SASE Cloud, which is a unified SASE platform.  Its operations are primarily focused in North America, Europe, and Asia, and its SASE customers tend to be enterprises and small and midsize businesses (SMBs) across all verticals.  Researchers expect the vendor to make future investments in this market, address adjacent security functions, and enhance support for the Internet of Things (IoT)/operational technology (OT).

Strengths—The Cato SASE Cloud user interface is simple and intuitive and addresses all product functionality via a single console. Cato’s customers, via multiple sources, including reference surveys, Gartner Peer Insights, and client inquiries, report excellent overall customer experience. Cato was a pioneer in this market and helped drive and shape customer expectations.

Cautions—Compared to other vendors in this research, Cato’s offering lacks certain capabilities around SaaS control and visibility, data security, and SD-WAN features locally on its appliance. Cato’s go-forward sales and geographic strategies are limited, which can restrict its ability to grow in the market. Cato’s planned product innovations are unlikely to disrupt or shape the broad enterprise market, as they’re more aligned with midmarket and SMB customers’ needs.

Cisco - Cisco is a Visionary in this Magic Quadrant.  Its primary offering in this market is Cisco+ Secure Connect, which is integrated with Cisco Meraki SD-WAN.  In addition, the vendor also offers Umbrella Secure Internet Gateway (SIG) integrated with both Cisco Catalyst SD-WAN and Cisco Meraki SD-WAN to create additional single-vendor SASE offerings.  The vendor also positions Duo for specific requirements. Cisco’s operations are geographically diversified, and its SASE customers tend to be SMBs and enterprises across all verticals.  Analysts expect the vendor to make future investments in this market, focused on expanding the POP footprint for Cisco+ Secure Connect and making comprehensive enhancements to its cloud-delivered security portfolio.

Strengths—Cisco provides strong threat intelligence capabilities across its multiple offerings. Compared to other vendors, Cisco offers very cost-effective pricing in this market for its primary offering (Cisco+ Secure Connect integrated with Cisco Meraki SD-WAN). Cisco’s product roadmap is well-aligned with emerging enterprise customer needs and has strong potential to shape and drive the market.

Cautions - Cisco positions multiple options for different use cases, which increases the number of consoles needed if your requirements span numerous use cases.  It also increases the likelihood of a suboptimal deployment and/or limits investment protection as customer requirements change.  As of April 2023, Cisco’s POP footprint for Cisco+ Secure Connect was limited geographically.  Cisco has been less responsive in this market than others in this research in terms of promptly delivering a unified experience with comprehensive security.

Forcepoint - Forcepoint is a Visionary in this Magic Quadrant. Its primary offering in this market is Forcepoint ONE, which is integrated with FlexEdge Secure SD-WAN.  Its operations are in North America, South America, Europe, and Asia, and its SASE customers tend to be enterprises across all verticals.  Gartner expects the vendor to make future investments in this market, focused on unifying all networking and security functionality via a single management console.

Strengths - Forcepoint has powerful security capabilities, including web proxy, SaaS control/visibility, and data security, combined with a robust POP infrastructure.  Forcepoint has a go-forward solid marketing and sales strategy, which should help it grow in the market.  Forcepoint’s product roadmap is well-aligned with customer enterprise requirements.

Cautions - Forcepoint’s customers, via multiple sources, including reference surveys, Gartner Peer Insights, and client inquiry, report lower customer experience than other vendors in this research.  Customers have limited awareness of Forcepoint in this market, including among its existing installed base, which can impact its ability to grow.  Limited financial information is available about the vendor, which creates uncertainty over its long-term viability in this market compared to other vendors.

Fortinet - Fortinet is a Challenger in this Magic Quadrant.  Its primary offering in this market is the integration of FortiSASE with FortiGate Secure SD-WAN, managed by FortiManager.  The vendor also positions FortiCASB, FortiMonitor, FortiIsolater, and FortiWeb for specific requirements.  Its operations are geographically diversified, and its SASE customers tend to be enterprises and SMBs across all verticals. We expect the vendor to make future investments in this market, focused on simplifying licensing and expanding its POP footprint.

Strengths—Fortinet delivers vital branch networking and security capabilities via FortiGate appliances. It also provides highly cost-effective offerings compared to other vendors. Fortinet has strong corporate financial viability and well-established global channels. These reduce the risk of purchasing from the vendor, which is particularly important in this market, where multiple functionalities are converged.

Cautions - Fortinet requires multiple products, including FortiManager, FortiSASE, FortiGate, FortiIsolator, FortiMonitor, and others, to address multiple use cases requiring customers to administer various components.  Fortinet’s POP footprint is limited geographically compared to other vendors.  Fortinet was late to market with the integration of FortiSASE with FortiGate SD-WAN, its core offering in this market.

Juniper Networks - Juniper is a Niche Player in this Magic Quadrant.  Its primary offering in this market is the integration of Juniper Secure Edge with AI-driven SD-WAN.  Its operations are mostly focused in North America and Europe, and its SASE customers tend to be large enterprises across all verticals.  Analysts expect the vendor to make future investments in this market, focused on addressing adjacent security functions.

Strengths—Juniper’s offering provides solid branch firewalling and SD-WAN functionality, as well as strong, secure web access and data security functionality. Juniper has a large installed base of existing networking and security customers to cross-sell into, which increases its viability and growth potential in this market.

Cautions—Compared to other vendors in this market, Juniper has a small installed base of single-vendor SASE customers and limited visibility. It is new to both the SASE and security services edge (SSE) markets. Juniper’s POP infrastructure lags competitors in this research in terms of geographic distribution, availability, a public status page, and public SLAs. Juniper's pricing is very expensive compared to other vendors in this market.

Palo Alto Networks—Palo Alto Networks is a Leader in this Magic Quadrant. Its primary offering in this market is Prisma SASE, a unified SASE platform. Its operations are geographically diversified, and its SASE customers tend to be enterprises across all verticals. We expect the vendor to make future investments in this market focused on improving operational efficiency via AI and conversational interfaces.

Strengths—The vendor’s SASE offering provides solid functionality via a single, straightforward user interface. Palo Alto Networks’ go-forward product roadmap and planned innovation investments are well-aligned with emerging enterprise customer needs and have strong potential to shape and drive the market. Palo Alto Networks has a large and loyal installed base that should help the vendor grow in this market.

Cautions - Customers using Panorama and/or PAN-OS-based products have expressed frustration because they need a separate management platform to use Prisma Access features.  In addition, this platform does not fully manage their existing firewall estate.  Based on client feedback and Gartner’s analysis, the vendor’s pricing is much higher than others.  The vendor lacks a native remote browser isolation (RBI) capability and has minimal support in its UI and documentation for non-English languages.

Versa Networks - Versa Networks is a Challenger in this Magic Quadrant.  Its primary offering in this market is Versa Secure Access Fabric (VSAF), a unified SASE platform.  The vendor also positions Titan as a secondary offering for specific use cases, including price-sensitive customers looking for more minor features.  Its operations are in North America, Europe, and Asia, and its SASE customers tend to be midsize enterprises across all verticals.  Gartner expects the vendor to make future investments in this market focused on enhancing its digital experience monitoring (DEM) and extending its support to mobile use cases.

Strengths - VSAF provides all functionality via a single, unified console.  Versa provides robust SD-WAN functionality.  Versa was an early mover in the market and is heavily focused and committed to it.

Cautions—Versa’s threat detection capabilities lag behind those of other vendors in this research. Versa’s sales strategy is limited compared to that of other vendors in this market, which can impact its ability to grow in the market. Versa’s product roadmap and planned investments are less likely to drive, shape, or disrupt the market than those of other vendors in this research.

VMware - VMware is a Niche Player in this Magic Quadrant.  Its primary offering in this market is VMware SASE.  The vendor also positions Workspace ONE to meet specific requirements. Its operations are geographically diversified, and its SASE customers tend to be enterprises across all verticals. Researchers expect the vendor to make future investments in this market, including enhancing its private backbone to improve application performance.

Broadcom announced its intention to acquire VMware on 26 May 2022.  However, Broadcom and VMware operate as separate entities at the time of this evaluation. Gartner will provide further insight as more details become available.

Strengths—VMware’s customers, via multiple sources, including Gartner Peer Insights and client inquiry, report excellent overall customer experience. VMware provides strong SD-WAN functionality and cost-effective pricing in this market compared to other vendors.

Cautions - VMware’s offering lags competitors in security functionality, including SaaS control/visibility and data security.  Workspace ONE is required to address advanced security use cases, which is another product and console to administer.  VMware’s planned product enhancements will unlikely disrupt or shape the broader enterprise single-vendor SASE market.  The pending Broadcom acquisition was not factored into this analysis.

Inclusion and Exclusion Criteria

General:

Provide a generally available (GA) single-vendor SASE offering as of 12 April 2023.  All components must be publicly available and shipped and be included on the vendors’ published price list as of this date.  Products shipping after this date and any publicly available marketing information may only influence the Completeness of Vision axis.  Provide commercial support and maintenance for its enterprise SASE offering (24/7) to support deployments on multiple continents.  This includes hardware/software support, access to software upgrades, security patches, troubleshooting, and technical assistance.  Participate in the enterprise SASE market, including actively selling and publicly marketing SASE to enterprises.

Gartner defines “general availability” as the release of a product to all customers. When a product reaches GA, it becomes available through the company’s general sales channel — as opposed to a limited or controlled release or beta version, used primarily for testing and user feedback.

Product - Vendors must have a SASE offering that includes all the following functionality, generally available as of 12 April 2023:

• The ability to secure web access via proxy.
• The ability to enforce SaaS access controls in-line. This requires in-line malware scanning and data security support to cover at least three SaaS enterprise suites (e.g., M365, Salesforce, Google Workspace).
• The ability to provide identity—and context-based secure remote policy-based access to private applications (not network-level access) is often referred to as zero-trust network access (ZTNA).
• All of the above functionalities must be operated as a service and primarily delivered as a cloud service to customers.
• Firewall capability to secure traffic bidirectionally across networks.
• A branch appliance that supports dynamic traffic steering out multiple physical locally attached WAN interfaces; management/administration of traffic steering based on well-known applications (not IPs/ports); and be deployed at a customer’s physical branch location to support direct WAN connectivity.
• Centralized management for the offering (with both GUI and API) that provides reporting and troubleshooting and allows for granular configuration and policy changes.
• Customers can directly manage and administer the full offering themselves, including granular configuration and policy of all SASE functions (commonly referred to as do-it-yourself [DIY]).
• Single-pass scanning for malware/sensitive data (maybe parallelized).
• Support single sign-on (SSO) integration with third-party identity providers.
• There must be at least three POPs on two continents each. Each POP must be in a highly secure facility, offer a full suite of SASE services locally (intra-POP), including firewall, web proxy, private access, and in-line SaaS control in a highly available fashion, and be generally available to all enterprise customers.

Global Customer Relevance and Adoption - Vendors must show relevance to Gartner clients by achieving the following as of 12 April 2023:

• At least 100 unique enterprise customers have purchased and deployed the vendor’s primary SASE offering in a production environment and are under an active commercial support license.
• At least 25 unique SASE customers, headquartered in two continents, under active support contracts; for example, 25 customers in Asia and 25 separate customers in North America.
• Support at least two prominent enterprise use cases for single-vendor SASE, as defined by Gartner.

Exclusion Criteria - Vendors will be excluded from this research for any of the following reasons:

• The vendor is exiting the market and/or ceasing development/sales of its enterprise offering.
• The vendor’s offering consists of individual functions that are not integrated beyond the use of standardized protocols.
• The vendor requires a customer to use four or more management consoles to operate its primary SASE offering.
• The vendor cannot provide a single-support experience to customers, meaning customers must engage multiple parties for support.
• The vendor primarily relies on other SASE product vendor(s) to deliver most functionality.

Honorable Mentions:

Check Point Software didn’t meet inclusion criteria, primarily based on enterprise adoption of its offering as of the research cutoff date (12 April 2023).  Cloudflare didn’t meet inclusion criteria, as aspects of its single-vendor SASE offering were not generally available as of the research cutoff date (12 April 2023).

Cradlepoint (which acquired Ericom) didn’t meet inclusion criteria, as aspects of its single-vendor SASE offering were not generally available as of the research cutoff date (12 April 2023).

HPE (Aruba), which acquired Axis Security, didn’t meet inclusion criteria, as aspects of its single-vendor SASE offering were not generally available as of the research cutoff date (12 April 2023).

Netskope didn’t meet inclusion criteria because its single-vendor SASE offering was not generally available as of the research cutoff date (12 April 2023).

Evaluation Criteria

Ability to Execute:

Table 1: Ability to Execute Evaluation Criteria

Source: Gartner (August 2023)

Completeness of Vision

Table 2: Completeness of Vision Evaluation Criteria

Enlarge Table

Source: Gartner (August 2023)

Quadrant Descriptions

Leaders:

A leader can address the single-vendor SASE market's current and future end-user requirements.  Leaders have robust offerings that address multiple use cases via a unified platform providing a single, straightforward, easy-to-use administrative interface.  A Leader’s strategy is aligned with emerging user needs and has the potential to drive, shape, and transform the market going forward.  A Leader typically has strong visibility in the market, a large installed base of customers, and maintains positive relationships with its customers and partners globally.  A Leader generally increases its investments in the single-vendor SASE market.

Challengers:

A Challenger can address current end-user requirements in the single-vendor SASE market. It typically has good visibility and/or a large installed base of customers and solid offerings that address multiple use cases. However, a Challenger’s strategy may not shape and transform the enterprise market going forward.

Visionaries:

Visionaries often help transform the market, driving new ideas/innovations, including new business models, and solving enterprise challenges. While Visionaries often have a strategy that is likely to disrupt, shape, and transform the market, they typically lack visibility, a sizable installed base, global coverage, and/or comprehensive product capabilities to address all enterprise requirements today.

Niche Players:

Niche Players are often focused on specific portion(s) of the market, such as a particular case of use, geography, vertical or technological specialty.  They have a viable product offering but have not shown the ability to drive the broader market or maintain sustained execution in the broad enterprise market.  A Niche Player typically has a near-complete single-vendor SASE offering, with some limitations that manifest outside of their core focus areas.  These limitations include feature depth, usability, geographic reach, market visibility, and installed base.  For example, a Niche Player may focus only on specific use cases and geographies or evolve their existing installed base.  This focus can create limitations in the broader market, reducing their ability to address emerging customer needs.

Context:

Adopting cloud and edge computing and work-from-anywhere initiatives has radically shifted access requirements.  For most organizations, more users, applications, and data are located outside of an enterprise than inside.  Attempts to use traditional perimeter-based approaches to securing anywhere, anytime access have resulted in a patchwork of vendors, policies, consoles, and complicated traffic routing, creating complexity for security administrators and users.

Network and network security leaders looking to support the anywhere, anytime access requirements of a distributed, hybrid workforce (including branch offices and edge locations) should invest in SASE.  The rationale is that SASE can improve the end-user experience by enabling the same access to digital capabilities, regardless of their location or the application location they are accessing.

SASE can help organizations adopt a zero trust security posture by applying consistent identity- and context-based policies, regardless of the type of resource the user is accessing (i.e., internet, cloud services, private applications).  Security policy management can be simplified by applying the same inspection mechanisms for sensitive data and malware across all access mechanisms and by shifting toward identity-centric policies rather than network location.

Market Direction:

The market for single-vendor SASE (SVSASE) is evolving rapidly.  Gartner expects at least five (and as many as 10) new vendors to enter the market with a single vendor SASE offering over the next 18 months.

As the hype around generative AI peaks, we expect several vendors will add AI-enabled policy creation and troubleshooting to improve the operational experience.  Analysts also expect vendors to expand their offerings into logical adjacencies, including extended detection and response (XDR)/managed detection and response (MDR) monitoring, expanded endpoint security options, edge computing, and east/west micro-segmentation within campus and branch networks.  As a result, Gartner believes that in the next 18 months, more than 40% of SVSASE vendors will offer XDR or MDR services as an add-on to their platform.  Also, over the next four years, over 25% of SVSASE offerings will expand to provide local computing options addressing edge computing scenarios.

Vendors will begin leveraging their POPs for a native WAN backbone to provide more options to connect to the cloud and other enterprise locations.  This is a potential for nonproduct innovations taking place in this market.  Individually, networking and cloud security have two different consumption models that are basically “stapled together” today within SVSASE offerings.  Single SKU-consumption models will be seen within the next 18 months.

Market Overview—There are three primary options for SASE adoption: a single-vendor offering, explicit pairing of two vendors (one for network services and one for security services), and managed SASE. This research exclusively focuses on single-vendor SASE.

Gartner estimates there are 7,500 enterprise single-vendor SASE customers.  The market for well-architected single-vendor SASE offerings is immature but developing quickly, and SASE interest among our clients has been proliferating. Multiple providers now have a single-vendor SASE offering (eight qualify for this research). Still, few offer the required breadth and depth of functionality with integration across all components, a single management plane, and a unified data model and data lake.

Increased interest is seen in single-vendor SASE from organizations that want to simplify their branch technology stacks.  It is particularly compelling for organizations making SD-WAN investments and extending the project to include firewalling, remote access and other security capabilities.  This trend has also expanded to SSE, as many buyers will switch from a best-of-breed purchasing motion to a default position that a single vendor is preferred, even if they aren’t best of breed in all areas.

As a result, security and networking vendors have aggressively expanded their offerings to address single-vendor SASE.  This has led to major investments, including partnerships, organic development, and external acquisitions such as:

• Aryaka acquiring Secucloud
• Cloudflare and Zscaler launching branch appliances
• Check Point Software adding SD-WAN
• Cradlepoint acquiring Ericom
• Fortinet acquiring OPAQ
• HPE (Aruba) acquiring Axis Security
• Netskope acquiring Infiot
• Palo Alto Networks acquiring CloudGenix

Further developments from existing SD-WAN and SSE vendors are expected to expand or accelerate their single-vendor SASE investments. Factoring in this with end-user demand, analysts expect that a majority of SD-WAN and SSE new purchases after 2025 will be in the form of an SVSASE, even if a full SASE solution isn’t initially deployed.

Evidence: 

• Gartner analysts conducted over 2,500 interactions with Gartner clients on SASE in the 12 months from 1 July 2022 through 30 June 2023.
• All vendors in this research responded to a prequalification survey to help determine their relevance to enterprise clients.
• All vendors in this research responded to an RFI regarding current and planned capabilities.
• All vendors in this research submitted a video demonstration following a script to show specific product capabilities.
• Gartner analysts reviewed relevant reviews from Gartner Peer Insights.
• Reference customers from seven of eight vendors answered a questionnaire regarding their experience with the vendor’s SASE product.
• Social media analytics.
• Gartner analysts reviewed publicly available information, including blogs, product specification sheets, and financial information.

Evaluation Criteria Definitions

Ability to Execute - Product/Service: Core goods and services offered by the vendor for the defined market.  This includes current product/service capabilities, quality, feature sets, and skills, whether offered natively or through OEM agreements/partnerships as described in the market definition and detailed in the subcriteria.

Overall Viability: Viability includes an assessment of the overall organization's financial health, the financial and practical success of the business unit, and the likelihood that the individual business unit will continue investing in the product, offering the product, and advancing the state of the art within the organization's portfolio of products.

Sales Execution/Pricing: The vendor's capabilities in all presales activities and the structure that supports them.  This includes deal management, pricing and negotiation, presales support, and the overall effectiveness of the sales channel.

Market Responsiveness/Record: Ability to respond, change direction, be flexible, and achieve competitive success as opportunities develop, competitors act, customer needs evolve, and market dynamics change.  This criterion also considers the vendor's history of responsiveness.

Marketing Execution: The clarity, quality, creativity, and efficacy of programs designed to deliver the organization's message to influence the market, promote the brand and business, increase awareness of the products, and establish an identification with the product/brand and organization in the minds of buyers.  This "mind share" can be driven by publicity, promotional initiatives, thought leadership, word of mouth, and sales activities.

Customer Experience: Relationships, products, and services/programs that enable clients to be successful with the products evaluated. Specifically, this includes the ways customers receive technical support or account support. It can also include ancillary tools, customer support programs (and the quality thereof), availability of user groups, service-level agreements, and so on.

Operations: The ability of the organization to meet its goals and commitments. Factors include the quality of the organizational structure, including skills, experiences, programs, systems, and other vehicles that enable the organization to operate effectively and efficiently continuously.

Completeness of Vision

Market Understanding: The ability of the vendor to understand buyers' wants and needs and translate those into products and services. Vendors that show the highest degree of vision listen to and understand buyers' wants and needs and can shape or enhance those with their added vision.

Marketing Strategy: A clear, differentiated set of messages consistently communicated throughout the organization and externalized through the website, advertising, customer programs, and positioning statements.

Sales Strategy: The strategy for selling products that use the appropriate network of direct and indirect sales, marketing, service, and communication affiliates that extend the scope and depth of market reach, skills, expertise, technologies, services, and the customer base.

Offering (Product) Strategy: The vendor's approach to product development and delivery that emphasizes differentiation, functionality, methodology, and feature sets as they map to current and future requirements.

Business Model: The soundness and logic of the vendor's underlying business proposition.

Vertical/Industry Strategy: The vendor's strategy for directing resources, skills, and offerings to meet the specific needs of individual market segments, including vertical markets.

Innovation: Direct, related, complementary, and synergistic layouts of resources, expertise, or capital for investment, consolidation, defensive, or pre-emptive purposes.

Geographic Strategy: The vendor's strategy for directing resources, skills, and offerings to meet the specific needs of geographies outside the "home" or native geography, either directly or through partners, channels, and subsidiaries as appropriate for that geography and market.

This article is shared at no charge and is for educational and informational purposes only.

Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization and, yes, an SASE.  We pride our company on being a small yet nimble collection service that provides indicators of compromised information via a notification service (RedXray) or an analysis service (CTAC).  For questions, comments, or assistance, please get in touch with the office directly at 1-844-492-7225 or feedback@redskyalliance.com    

• Reporting: https://www.redskyalliance.org/
• Website: https://www.redskyalliance.com/
• LinkedIn: https://www.linkedin.com/company/64265941 

REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5378972949933166424

[1] https://www.gartner.com/doc/reprints?id=1-2ERFQZGF&ct=230821&st=sb