Enterprise customers are looking for secure access service edge (SASE) products that include endpoint security and management, such as the bundling of endpoint protection detection and response (EPDR) and unified endpoint management (UEM) with SASE agents, according to KuppingerCole.

The analyst firm’s latest Leadership Compass report for SASE claims that customers expect better endpoint security integrated in these products will help “reduce the number of software agents deployed and complexity of enterprise IT security and asset management.”

Analyst John Tolbert said that this will be a “stretch goal” for innovative SASE vendors to differentiate their products and services moving forward. “If you can get more functionality in a single agent, that's great from a CIO or security staff at an enterprise perspective,” he told SDxCentral.

While there are some vendors who also have EPDR and UEM products, Tolbert pointed out “not many of them have full on endpoint security and endpoint management built in right now. That's an area that we are going to see more explicit need for.”

On the data protection side, many vendors have some capabilities such as cloud access service broker (CASB) functionality to protect data as it traverses the cloud, Tolbert explained. But many still lack adequate tools to control data at the endpoint, and rely on VPNs as primary gatekeepers for remote user activity.

“Can we also protect the endpoint when the user is on a customer site such that somebody can’t transfer data off of that endpoint,” Tolbert said, adding that he sees the need for “bigger emphasis on data protection, especially at the endpoint and then just broader endpoint security integration.”

KuppingerCole listed Cisco, Lookout, Palo Alto Networks, and Versa Networks as innovation leaders.

Tolbert said innovation is key to leadership in the SASE space, and specified in the report that innovation is not just rolling out new releases often. Instead, innovative companies take a “customer-oriented upgrade approach,” and deliver cutting-edge features that are high in demand while maintaining compatibility with existing products.

“You really need to be innovative, not only because it's a brand new field, but innovation is what makes the product strong in this case,” he added.

“It’s a little bit different than some established fields within security, where you can have a really strong product that might not be quite as innovative as some of the others that are out there, and people will be happy to buy. But I think for SASE, I see a pretty strong tie between those who have strong products right now, and those who are also doing the most innovation.”

The foundational features KuppingerCole cites as necessary to a SASE integration suite include SD-WAN (including VPN for endpoints), firewall, secure web gateway (SWG), zero-trust network access (ZTNA), remote browser isolation, data protection, including data loss protection (DLP) and cloud access security brokers (CASB); and customer support and experience management.

The report noted that many of the vendors surveyed do not offer a complete range of SASE functions fully integrated within their suites yet. Rather, many vendors’ SASE integration suites include functions as add-ons from their own products or service portfolios. Some SASE providers integrate capabilities through partnerships with other vendors.

“Maybe you are on the security side but you don't really have SD-WAN, so if you want a full-fledged SASE offering, then you need to have a partnership with somebody who does or embed that into your product,” Tolbert explained.

There are also providers that leave it up to the customer to acquire such functionality as needed, and many whose SASE offerings are currently incomplete have missing functions on their SASE roadmap.

“I don't think, except for a few cases, we’re completely there yet as far as having everything in a single package,” Tolbert said. “But I think that to a degree that's coming and that will be the direction that it will continue to go in as vendors are trying to put more functionality into a single product solution offering.”