Secure Access Service Edge Solutions

Secure Access Service Edge Solutions is the new name of the category Forrester last scored as Zero Trust Edge Solutions, and the first edition under the new name has been out for eleven months. The planned flag on this category is that far out of date: The Forrester Wave: Secure Access Service Edge Solutions, Q3 2025 published on September 8, 2025.

The most consequential vendor in that report is the one that is not in it. Cisco, the largest enterprise networking vendor on earth, did not make an eight-vendor field. Forrester excluded it because its SASE services do not share a single management console. The vendor list tells you who competes. The exclusion tells you what the category has become.

The vendor that did not make the field

The entry bar for this Wave was narrow on purpose. Vendors had to deliver SD-WAN, security service edge, and ZTNA as one cohesive platform with one console. Not APIs gluing three products together. Not cross-launched portals with different logins. One console, or no score.

That bar did the work of a definition. Forrester says more than 20 vendors now offer all-in-one SASE platforms, yet only eight cleared the integration standard. Cisco, for all its market weight, failed it on fragmented management. The other big networking names are absent for the same structural reason. Arista Networks and Extreme Networks still sell SASE through partnerships rather than owning the stack, and the report calls that out by name.

The networking incumbents spent a decade adding security to networks. The category now scores networks built around security. That reversal is the whole report.

Eleven months on: The Forrester Wave: Secure Access Service Edge Solutions, Q3 2025

The report that corrected the planned flag was written by Andre Kindness, Forrester's principal analyst for networking, with Joseph Blankenship, Caroline Provost, Michael Belden, and Drew Zalucky. Vendor materials were evaluated as of June 26, 2025. The companion blog, published September 10, 2025, carries the subtitle "A Market Transformed."

The eight that made the field: Cato Networks, Cloudflare, Fortinet, Netskope, Palo Alto Networks, SonicWall, Versa Networks, and Zscaler. Three Leaders. Four Strong Performers. One Contender.

The report's own summary is three words: "Platforms are winning." Buyers consolidated SD-WAN, SSE, ZTNA, and monitoring under one provider for capital and subscription savings, and the most cited benefit was not cost. It was observability: networking and security teams finally working from the same traffic data. The operational center of gravity moved from security teams to networking teams, which Forrester flags as a real organizational shift, not a footnote.

Two names for one architecture

Forrester introduced Zero Trust Edge as its own term for this market, and held onto it through the Q3 2023 Wave, published August 2023. That edition was the industry's first full evaluation of all-in-one ZTE platforms, with an entry bar that reads like a maturity test: at least 75 million dollars in annual ZTE revenue, a ZTNA product plus a cloud security gateway, 30 percent or more of revenue from outside the home region, points of presence on every continent except Antarctica, a remote-site WAN appliance, and cloud-based administration.

Ten vendors made that field, and 76 percent of customer references told Forrester they replaced their entire legacy networking and security stack when they adopted the product. The category has always been a replacement sale. What changed is which firms are allowed to sell it.

By the 2025 edition the Zero Trust Edge name was gone from the title, and Forrester adopted the industry's word. Two names for one architecture, and the losing name was the analyst's own.

Six of ten did not return

Set the 2023 roster next to the 2025 one and the market's consolidation shows itself. Palo Alto Networks, Versa Networks, Fortinet, and Cato Networks led the 2023 edition. VMware and Forcepoint were Strong Performers. Juniper, HPE, Cisco, and Barracuda sat in the Contender band.

Four of those ten names returned in 2025. VMware vanished into Broadcom weeks after the 2023 report published. Juniper was absorbed by HPE, which then did not return either. Cisco failed the console test. Forcepoint and Barracuda dropped out.

Three of the four returnees came back a tier lower. Palo Alto Networks is the only vendor that held its Leader seat. The security-first vendors entered the field while the networking-first vendors left it, and the tiers moved to match.

The three Leaders are three different products

The Leader tier contains three companies selling barely overlapping architectures.

Netskope leads with Netskope One, and it arrived with a data-first posture. It crossed into this Wave from Forrester's security service edge evaluation, and its DLP depth reads as the report's most rewarded trait.

Palo Alto Networks leads with Prisma SASE, the first-mover platform that unified Prisma Access with SD-WAN, and it kept its seat from 2023. Its claim is convergence: one policy, one console in Strata Cloud Manager, performance riding Google's backbone and hyperscaler networks.

Zscaler leads with the Zero Trust Exchange, and it took the highest score in strategy. Zscaler was never a router company, and its bet is that the network is a set of cloud proxies with identity at the edge. The report judges that vision the strongest in the field.

The gate is not the product. The gate is the console, and these three sell three different theories of what the console should govern.

Four strong performers, four gaps

Each Strong Performer carries a specific gap in the citations, and the gaps are the buying guide.

Cato Networks scores on its single console and its consistent global backbone, with service delivery the same from every point of presence. Forrester flags thinner DLP depth and a missing enterprise browser as the holes.

Cloudflare scores on the biggest backbone in the field, including a China option, and on monitoring and performance. It lags on ZTNA agent maturity, DLP, digital experience management, and flexibility for remote-site designs.

Fortinet scores on a broad hardware portfolio and pricing that has been its weapon since the 2023 edition, when Forrester called its value "eye-popping." It is still consolidating management into FortiSASE and trails on digital employee experience, data discovery, and user interface maturity.

Versa Networks scored the maximum in three criteria: innovation, service provider multi-tenancy, and local deployment offerings. Forrester notes it carries the largest array of remote hardware and connectivity options in the field. It is the strongest example of a 2023 Leader downgraded by a harder scorecard, not by a worse product.

SonicWall is the lone Contender, a value play for small business, education, and public sector, with ZTNA underpinned by its Banyan Security acquisition. Forrester's caution is structural: dual consoles and SSE features that trail the field.

DLP is the new battleground

The report names the axis that now decides the tiers: "DLP is the cornerstone of platform differentiation." Not SD-WAN throughput. Not ZTNA architecture. Data loss prevention, extended beyond content filtering into context-aware, identity-driven controls across cloud, web, and private applications.

That sentence would have been strange in 2023, when Forrester chided Fortinet for weak DLP and still made it a Leader. Two editions later, data protection is the differentiator, and the vendors with data heritage took the top. The category rotated from transport to data without changing its name.

What eleven months have already changed

The honest reading is that this scorecard is a photograph of June 2025, and the market has kept moving since. The report itself says AI touched every criterion, with natural-language policy creation, threat detection, and identity governance emerging as vendor features. Emerging in September 2025 means shipping in August 2026.

The edge extension is aging in real time too. Vendors were pushing zero trust into IoT, network access control, and unmanaged devices, some through enterprise browsers. That direction has accelerated, and the next edition's criteria will be written around it.

A year-old scorecard in a category moving this fast should be read for its boundaries and its direction, not for its precise placements. The boundaries hold. The placements will not.

The sibling scorecard is now published

One word separates this category from its sibling, and both reports are now live. The Forrester Wave: Secure Access Service Edge Services, Q3 2026, published July 24, 2026, scores the providers who operate SASE as a managed outcome. This Solutions Wave scores the platforms. Gartner runs its own adjacent evaluation of the platform question, the Magic Quadrant for Single-Vendor SASE.

The platform question is answered. The operating question was not, and that is why the second scorecard exists. An enterprise can win this Wave and still need to decide who runs the thing, and that decision lives one word over.

What to ask before the proof of concept

The report's own findings translate into four tests that decide more than the tiers do.

Count the consoles in the demo. The inclusion bar was one console for networking and security. Have the vendor change a policy across both, live, and count how many portals get opened.

Run the DLP test on your own applications. Data protection is the differentiator. Demos run on demo apps. Insist on your private applications and your SaaS estate, with your classification rules.

Ask for references that replaced the whole stack. The category is a replacement sale, and 76 percent of references did the full swap. A vendor who can only show bolt-on deployments is selling a different product than the one that scored.

Ask what the platform looks like when someone else runs it. The services scorecard now exists for a reason. Platform and operator are separate purchases, and the second one is the one you live with.

Forrester does not endorse any vendor named here, and tier placement should not be read as a recommendation to buy.

The natural next comparison is Secure Access Service Edge Services: forrester now runs two SASE evaluations one word apart, and the services edition grades the operator who answers the phone when the network goes dark, not the platform itself, which sits in a separate scorecard entirely.