Expanding the scope of an offering risks steering it away from buyers’ real needs.
Gartner identifies this trend among the leading SASE solution providers, noting it in the latest Magic Quadrant dedicated to this market and describing it as “over-platforming.”
Logically, the same observation appears in another Magic Quadrant published almost in parallel: the SSE quadrant, i.e., the security portion of SASE, as opposed to the networking portion.
If Gartner maintains the distinction, it is because the sourcing of these two components still largely comes from different vendors (65% of purchases in 2026, it estimates).
A Specific Criterion for Protecting Generative AI
The move toward integrated SSE offerings isn’t new. Along the way, many components have become commoditized: RBI (remote browser isolation) and DLP (data loss prevention) are part of this trend. The same goes for cloud firewalls, which “no longer constitute a differentiating element.”
In this context, vendors have begun to bundle products that, in Gartner’s terminology, fall into adjacent markets. For example, EPP (endpoint protection) and DSPM (data security posture management). As a consequence, it becomes harder to compare them on the SSE core, especially when functional links form with these adjacent products—and licensing models are adjusted to encourage adoption.
There are still differentiating elements, including the ability to protect “generative AI applications.” Gartner made this one of the criteria to qualify for the Magic Quadrant. Specifically, vendors needed to provide visibility and basic controls (block, allow, alert) for sensitive data across at least three services among ChatGPT, Claude, Copilot, DeepSeek, Gemini, Grok and Perplexity.
Although many vendors now offer a unified console, this element was optional—just like the firewall cloud, RBI, UEBA (user and entity behavior analytics), and SaaS security posture management.
8 Vendors, 3 “Leaders”
Of the nine vendors named in the SASE Magic Quadrant, seven appear in the SSE one. With the exception of Cato Networks, all those classified as “leaders” in the first are also Leaders in the second. Specifically, Netskope, Palo Alto Networks, and Zscaler. Two players present in 2025 are no longer on the list this year: Fortinet and Versa Networks. Cisco, on the other hand, enters the SSE Magic Quadrant.
The standing on the “Execution” axis, which reflects the ability to meet demand (customer experience, financial viability, product/service quality, etc.):
| Rank | Vendor | Yearly Change |
| 1 | Palo Alto Networks | + 2 |
| 2 | Netskope | = |
| 3 | Zscaler | – 2 |
| 4 | Cisco | new entrant |
| 5 | Skyhigh Security | + 1 |
| 6 | Cloudflare | + 1 |
| 7 | iboss | + 1 |
| 8 | Broadcom | + 1 |
The standing on the “Vision” axis, which reflects strategies (market perception, innovation, product development):
| Rank | Vendor | Yearly Change |
| 1 | Palo Alto Networks | + 2 |
| 2 | Zscaler | = |
| 3 | Netskope | – 2 |
| 4 | Cloudflare | = |
| 5 | iboss | + 2 |
| 6 | Cisco | new entrant |
| 7 | Skyhigh Security | – 1 |
| 8 | Broadcom | = |
High Price and Complex Pricing at Netskope
Last year Gartner highlighted Netskope’s prominence, frequently appearing on shortlists. It praised its technical capabilities (coverage across all SSE segments) and its market understanding (covering most use cases). The American firm, however, noted the console’s lack of language localization, Netskope’s relatively slow pace in adding “advanced” features, and its less effective mid-market targeting (organizations of 100 to 1,000 employees).
This year again, Netskope is commended for its visibility. It is also recognized for a customer experience level “above average,” and for the opportunities opened by the AgentSkope architecture. Its pricing, however, remains complex, and prices tend to run above the market average. The focus on AI security and governance may not resonate with SSE buyers, Gartner adds. More broadly, competition narrows the gap.
AI as a Driver of “Over-Platforming” at Palo Alto Networks
Last year Gartner highlighted Palo Alto Networks’ financial viability, as well as its innovations (notably in AI) and its integration with on-premise firewalls. The firm also pointed to complex, high pricing and an RBI component that effectively covered only a smaller set of use cases. It also noted that support localization, the interface, and technical documentation were largely English-only.
This year, Palo Alto Networks again earns praise for financial viability. Gartner adds visibility (frequent SSE shortlists) and a broad market understanding—whether in balancing autonomous SSE with SASE or in reducing administrative complexity. Pricing remains complex and high. As for planned innovations, such as autonomous defense focused on OT and legacy, they align more with SASE platforms than with the SSE segment alone. The movement toward “platformization” will also be watched, as buyers are urged to invest in tools beyond the traditional SSE perimeter, such as AI runtimes protection and non-human identity management.
At Zscaler, Watchfulness on Packaging
Last year Zscaler was praised for its visibility, as well as its pricing that “simplifies purchasing for new customers.” Gartner also appreciated the overall market understanding, coupled with a track record of early delivery. Zscaler remains one of the more expensive players, the firm cautioned. It also flagged more frequent performance issues than competitors, and warned about diversification into SecOps… and its potential impact on the SSE strategy.
The visibility edge remains this year as well. Zscaler earns another point for AI, both for its integration within its solutions and for its usage-control capabilities. Gartner adds innovations on the AgenticOps front and the development of a separate platform for AI security. With customer experience rated “below average,” Zscaler tends to package capabilities from adjacent segments and to require add-ons for certain “advanced” core SSE features.
