Filling the Gaps: How Should Vendors Look to Consolidate Their SASE Solutions?

A hybrid workforce, a reliance on cloud applications, a sprawling Wide Area Network (WAN), and a demand for enterprise digitalization are just some of the drivers behind an on-going shift in data-consumption patterns and increasing demand for Secure Access Service Edge (SASE). SASE is viewed by many as the next big step in WAN management and security. With it, networking and security converge within a cloud-native platform, extending security services to the edge of enterprise WAN. This convergence reduces cloud application latency, ensures real-time network provisioning to remote knowledge workers, and limits security gaps within an enterprise’s WAN through zero-trust principles. SASE theoretically includes Software Defined-WAN (SD-WAN) and various security services converged in a single software stack, delivered as either on-premises hardware or on within a cloud native platform. However, current SASE solution immaturity means that for all vendors, theory does not match reality. As architectural gaps continue to pervade vendor solutions creating WAN friction and negatively impacting enterprise network security mesh contributing to a worse quality of service (QoS).

Week in week out, news article and press releases emerge highlighting new security or networking features being incorporated into SASE services. To fill these gaps, vendors have mostly chosen in recent years to acquire solutions, alongside technology partnerships aimed at leveraging best-in-class point solutions. But a limited number of well-established vendors, such as Cato Networks and Versa Networks, have stuck to their guns and continued to develop SASE components organically. This dichotomous market activity has led ABI Research to question: which is the most effective strategy for vendors to consolidate their SASE solution and extend it by integrating enterprise-grade 5G?

Filling architectural gap is critical to competition, as each strategy has proven successes already, but going forward changing time frames, client expectations, vendors characteristics, and, above all, the pressure of competition, means that vendors must continuously reassess their consolidation strategy.

M&A will be the easiest strategy to pursue to consolidate SASE architecture. This is especially true given that networking and security vendors are not light on capital investment, as networking and cybersecurity funding seems to continue to grow year-on-year, with an unprecedented US$21 billion in venture capital poured into cybersecurity in 2021 alone. While interest rates remain relatively low, vendors will be in a strong position to pursue a heavily acquisition-based consolidation strategy. This trend towards M&A has been particularly evident from key players over the past two years: Palo Alto acquiring Cloud Genix (2020), VMware acquiring Nyansa (2020), Cloudflare acquiring S2 Systems (2020), McAfee acquiring Light Point (2020), Aryaka acquiring SecuCloud (2021), and Forcepoint acquires Bitglass (2021). The principal difficulty in M&A lies in the market value inflation driven by cybersecurity and networking ‘hype’ and consolidation efforts from other vendors. This is likely to continue, making it harder and harder to acquire solutions at a ‘good price’.

Although M&A can be a valuable tool, it is evident that it is in the best interest of some vendors to organically develop their solution. Organic development is not only perceived as ‘best-in-class’ but has become a key selling point (KSP) for some vendors as they expound the potential for greater convergence, as their developed solution will mesh perfectly with their existing framework. For established vendors with a strong track record in organic development, adequate human capital/skills, and a nearly complete solution, developing services will grow the value proposition of their SASE solution, which is likely to correspond to enterprise vertical demand. Cato Networks and Versa Networks are two key vendors that highlight their sole focus on development, and the benefit this brings to their framework. It is not a coincidence that Managed Service Providers (MSPs) and enterprises have sung the praises of these vendors, highlighting their market leading, but still incomplete, SASE services.

As some vendors (VMware, Versa Networks, Exium) have already demonstrated, organic development is critical to the integration of enterprise-grade 5G into SASE. Integrating 5G will be beneficial for enterprises, and drive synergies in terms of performance and network slice visibility. To maximize these synergies, tight integration that can only be achieved through development is required between 5G core and SASE architecture. Some vendors go as far to say that that SASE need to be re-built on 5G standards to realize these synergies.

ABI Research recommends that strategic decision is made based upon three vendor specific areas:

1. Track record in organic development: Vendors that have well-established organic development should stick to this strategy, as tight convergence will be vital to long-term value proposition.
2. Existing human capital/skills: This is one of the key factors that determines strategy—how difficult will it be for a vendor to develop a new service in-house? For cybersecurity specialists, this means that filling networking gaps may require acquisition, whilst filling security gaps will be far simpler. Vendor human capital is essential to strategy.
3. Perception of short-run SASE market conditions and where the vendors skills gap lies: As vendors scramble to fill SASE framework gaps, it is likely that the value of start-ups and acquisition targets will be inflated. For this reason, if vendors are more focused on long-run convergence, then organic development may be a more prudent strategy.

Overall, any strategic decision within this space is difficult, as SASE remains undefined and competition, even within this immature market, is high. ABI Research recommends that as SASE is a demand driven market, vendors should align their strategy with enterprise perception of so-called ‘best-in-class’ strategies, as this will contribute to growth. However, taking a wider, more pragmatic approach for the majority of vendors, a three-pronged approach will be the best way to fill their service gaps and drive their value proposition to enterprise verticals (without ‘breaking the bank’) in the short (partnership), medium (M&A), and long (organic development) run.