For the first time since Dell’Oro Group began tracking the secure access service edge (SASE) market in the first quarter of 2019, Zscaler has surpassed Cisco to claim the No. 1 revenue spot in the first quarter of 2023, according to the firm’s recent report.

Zscaler claims it provides a best-of-breed SASE security stack that includes its security services edge (SSE) solution that consolidates Cloud Access Security Broker, data loss protection, secure web gateways and zero-trust capabilities, while partnering with most of the leading SD-WAN vendors. It was named as one of the leaders in the SSE market.

The company has so far focused entirely on the SSE segment and has yet to offer SD-WAN, Dell’Oro Group Research Director Mauricio Sanchez pointed out. He added that many other industry players are incorporating both networking and security into their SASE portfolio; for example, Check Point Software Technologies, HPE/Aruba and Netskope have become single-vendor SASE players.

And Zscaler has started to feel the pressure to follow this trend. Sanchez noted some Zscaler customers have expressed concerns about the company's current networking capability, including its IP architecture limitations and certain challenges of getting traffic to or from Zscaler. That’s why the company is trying to make it easy to on-ramp traffic into its cloud.

“We can't just rely on the networking equipment to service the on-ramp for much longer because there are too many corner cases. It's just not the easy button,” he said. “Now if Zscaler chose to bring that appliance into a wider family in the style of a CPE [customer-premises equipment], to truly go after the ISR [integrated service Router] access Router, then I would consider Zscaler an SD-WAN vendor.”

Yet Zscaler also faces a paradoxical challenge: As soon as it moves toward offering networking, its relationships with existing SD-WAN vendors could turn competitive. And for now, a fair degree of Zscaler’s SASE sales go through its networking partners. “It’s like a damned if you do, damned if you don’t” scenario, Sanchez told SDxCentral.

On the other hand, Cisco has been recognized as a single-vendor SASE provider, offering both SD-WAN and SSE. The vendor’s Cisco+ Secure Connect Now product combines Meraki SD-WAN and Umbrella security capabilities.

Sanchez noted that currently, Cisco and Palo Alto Networks are more balanced SASE vendors who have similar levels of success for both SD-WAN and SSE. The latter overtook Broadcom (Symantec) for the No. 3 overall SASE revenue position in the first quarter.

Earlier this month, Cisco introduced its SSE solution, dubbed Cisco Secure Access, which can be coupled with customers’ existing SD-WAN for a SASE architecture.

However, this product won’t be released until October. Sanchez argues, “In my view, they pre-announced that in order to kind of stop the hemorrhaging, or at least put some doubt in people's minds about whether they should jump into Zscaler right away versus waiting for Cisco to show up with their new product.”

He added SSE is a larger market and Cisco’s slow SSE technology integration opens up opportunities for Zscaler to enjoy larger growth and revenue.

But, as the SASE market matures, it remains to be seen whether Zscaler's “Switzerland” approach will continue to be successful in the long term, Sanchez pointed out. “I got my popcorn.”

Dell’Oro Group’s report also showed overall SASE market revenue grew by more than 30% for the fifth consecutive quarter, approaching the $2 billion mark.

A complete SASE offering often combines network edge capabilities – most notably SD-WAN – and a set of cloud-centric SSE capabilities, most notably secure web access gateway, cloud access security broker and zero-trust network access.

The report found both SSE and SD-WAN revenue increased more than 30% year over year and unified SASE solutions — defined as SASE solutions where SD-WAN and SSE are tightly integrated into a single technology stack — surpassed $200 million for the third consecutive quarter, representing more than 140% growth.

“I would say that we're still in the early stages of SASE. And I think it varies in terms of the way you look at the market and the size of the customer that's deploying it,” Sanchez said. “There's still a lot of innovation. I think SSE basically killed off most of the traditional on-prem appliance secure web gateways. And now they're starting to move into replacing part of the firewall category.”

“And then the feature sets on top of SASE continue to flourish. So now that you've got this cloud platform, and people are adding a bunch of different functions. I think people are still dreaming up new functions, whether it be visibility or all aspects of artificial intelligence (AI) being applied to that picture,” he added.