We just released The Forrester Wave™: Secure Access Service Edge Solutions, Q3 2025, and the results mark a dramatic shift from the 2023 Wave on Zero Trust edge solutions. In just two years, the secure access service edge (SASE) market has undergone a significant transformation. Back in 2023, the landscape was dominated by vendor partnerships — typically a security-focused company teaming up with a networking vendor. At the time, we only evaluated vendors that offered all three core components: software-defined WAN (SD-WAN), security service edge (SSE), and Zero Trust network access (ZTNA). The top performers were those beginning to unify these services into a single, user-friendly console.

Fast-forward to today, and the market has evolved. Over 20 vendors now offer all-in-one SASE platforms, converging networking and security capabilities — like SD-WAN and firewall — into cloud-delivered services. Only a few, such as Arista Networks and Extreme Networks, continue to rely on partnerships.

What Vendors Did We Evaluate?

Forrester’s report, The Secure Access Service Edge Landscape, Q4 2024, revealed a split among all-in-one vendors. Some, like Cisco, still separate their management interfaces — using Meraki for networking and Secure Access for security. Others have built unified platforms with a single, consistent interface for all services.

In this evaluative report, we filtered down our inclusion list to only evaluate SASE innovators that had fully integrated SD-WAN, SSE, and ZTNA into cohesive platforms. Admittedly, this is a high bar to set, with only top product teams in this marketplace making the cut for inclusion. Only eight could clear the bar: Cato Networks, Cloudflare, Fortinet, Netskope, Palo Alto Networks, SonicWall, Versa Networks, and Zscaler. Any one of them is able to bring a world-class solution to the table, especially this early in the market. This is an extremely important context when considering our scoring scales of below par, on par, and above par, as these are each in a class above the rest.

Market And Customer Evolution: What Changed Since 2023?

Changes between the last Wave and this one (besides the name) include:

  • Platforms are winning. Customers increasingly prefer unified platforms from a single vendor. Interviewed users expressed a desire to reduce integration complexity, consolidate services, and lower both capital and operational costs. This is one of the major inclusion criterion for the Wave. The solution must have, at a minimum, a single location for administrators to log in and manage the SSE stack and networking services from a single console.
  • SSE vendors became SASE vendors. Netskope and Zscaler, previously focused on SSE, now offer full SASE platforms. The standalone SSE market has largely disappeared, with most vendors now offering SD-WAN and SSE either natively or through partnerships. The current set of vendors will be more than happy to sell SD-WAN or SSE services separately, and some have partnerships with companies that don’t offer them.
  • Differentiation is shifting. While core features such as cloud access security broker services, secure web gateway, SD-WAN, and ZTNA remain essential, differentiation is now driven by AI, data loss prevention, and digital experience management. These capabilities enhance and augment SASE services. The degree that AI helped in each criterion was a major aspect in setting vendors apart.
  • SASE is moving closer to the edge. Whether vendors are trying to differentiate and increase their revenue streams or they believe that SASE is more than managing traffic coming in and out of remote locations and devices, the vendors have started to recognize the need to extend Zero Trust principles further inside remote locations. IoT, network access control (NAC), and unmanaged devices need connectivity and security policies, too. Some vendors have pushed security services down to the SD-WAN appliances within remote locations, while others have added LAN hardware as part of the portfolio. There are various stages of NAC integration.
  • Networking vendors fell behind. Traditional networking vendors like Cisco were not included in this year’s Wave for multiple reasons, such as a lack of a single interface and console to manage all SASE services and functions. Overall, networking vendors have struggled to keep pace with innovation while security-first and pure-play SASE vendors are driving the market forward.

Real Value Is Starting To Emerge

In our 2023 blog, we focused on hardware changes at remote sites. Now, with SASE more widely adopted, the 2025 Wave has surfaced meaningful insights for current and future adopters. While deeper quantitative analysis is coming in future research, here are some early takeaways:

  • Operational shifts. Most customers reported that their networking teams are now managing the SASE solution. Since these teams were already responsible for VPNs, it was a natural — though significant — transition to take on ZTNA, which often led to managing broader SSE functions. Security teams are still involved, but the operational center of gravity has shifted.
  • Cost savings. Organizations cited significant capital and subscription cost reductions by consolidating SD-WAN, SSE, ZTNA, and monitoring tools under a single SASE provider. The move to a unified platform is proving financially beneficial.
  • Improved observability. The most frequently mentioned benefit was enhanced visibility into traffic, users, devices, and remote locations. Even organizations that previously had monitoring tools said SASE platforms provided richer, more consistent data. Both security and networking teams are now working from the same datasets, leading to faster issue resolution.
  • Deployment best practices. Nearly all interviewees recommended using the vendor’s professional services to accelerate deployment. Many reported that this cut implementation time by half or more.

For Forrester clients interested in a deeper dive into any of these areas — whether it’s SSE, ZTNA, or the latest SASE Wave — you can schedule an inquiry or guidance session with me.

Dive Even Deeper Into SASE

I’ll be hosting a SASE roundtable at Forrester’s Security & Risk Summit in Austin, Texas, on November 6. We will dive into best practices for deploying and managing SASE as well as the expected and unexpected benefits of deploying it. Register, come, and see.