In the third year since Gartner termed secure access service edge (SASE) as a cloud-delivered convergence of networking and security, the framework has steadily taken hold of the market. SASE in 2022 initiated industrywide M&A activity, Gartner's first-ever guide to a “single-vendor SASE” approach, new product launches, partnerships, and more.

Analyst Andrew Lerner spoke with SDxCentral to reflect on the year the SASE and security services edge (SSE) markets had in 2022, and gave his predictions for both heading into the new year.

SDxCentral: I think in order to look forward, we have to look back for a second. So a good place to start would be, are there any trends that you've seen from the past year that you can point to and say, that was really the theme of SASE 2022?

Lerner: I would have to say the theme of SASE in 2022 is confused or was confused. Unfortunately, a lot of the calls we get from end-user clients are asking about vendor offerings. And a lot of the vendor offerings are incomplete or immature, but they market themselves as SASE anyways.

So for example, there are several vendors who don't have SD-WAN that prominently market SASE. There are vendors that don't connect their SD-WAN to their cloud security but prominently market SASE. And so, end users would be like, “hey, we want a cloud-delivered security that follows end users and can go into the branch, support remote branches — that's what SASE is — but when we talk to our vendor, our vendors propose this other thing.” And so there's a lot of confusion in the market about what is SASE, [and] what is cloud security.

I would say that was the general theme. You might even say overzealous marketing on the supply side. But on the demand side, it was, unfortunately, confused. The good news is though, I sense a slight shift with time, both from the demand and the supply side. From the supply side, the vendors are getting their act together. They're getting their offers to market. They're getting more mature capabilities, or they're getting true SASE offerings into the market, not just SASE marketing. And then from the end-user perspective, they are starting to get a sense of what SASE is, but it's early days.

SDxCentral: So with that backdrop, a lot of vendors like you said are pitching SASE. They're getting closer, but from what you said they're still not quite there yet. Are there any vendors in the past year that have stood out to you as making bigger strides toward a full SASE solution than others?

Lerner: There's a couple vendors out there that, based on the feedback we get from the market, have very strong offerings. The most notable vendor from a software architecture perspective out there today is probably Cato Networks. They have a very strong, unified software architecture and they were actually probably one of, if not the first, vendors doing SASE, and so they started with SASE.

Most of the other vendors that I cover have made really good progress in terms of bringing their different pieces of their portfolio together to deliver something closer to SASE than what they had at the beginning of the year. We've seen VMware make significant investments in their SASE platform, in which they utilize some of their own organic capability. We've seen Cisco make significant improvements in the management plane associated with their SASE offering. They launched in June, at their user conference, Cisco Secure Plus Connect based on a Meraki UI. We've seen Palo Alto [Networks] unify a common data lake for their different components.

So yeah, a lot of vendors have made strides to get to a unified software architecture, but they still have room to grow.

SDxCentral: The term unified or single-vendor seems just as buzz-worthy as SASE itself. And I've seen this statistic from Gartner that one-third of SASE deployments by 2022 will be based on single-vendor offerings. Should all enterprises be trying to move toward that? Is two vendors in some scenarios a better option?

Lerner: Yeah, so I definitely see a consolidation toward fewer vendors. And we see the market ultimately trending toward one or two vendors. It's our strong opinion that in order to really have a strong SASE, the implementation is ideally done with one or two vendors. But not just any two vendors, right? You can't just pick two vendors that hate each other and don't work together. You've got to pick two vendors that have strong integration between each other, not just at the management plane, but at the data plane and with common Application Programming Interface and telemetry sharing.

So it's our opinion that a single-vendor SASE solution, or a dual-vendor SASE solution with vendors that have done deep integration between them, adds significant value. However, we do believe that there will be a significant increase in the number of enterprises who want to go to a single vendor, simply for the fact of unified procurement, unified management and interface. But it doesn't necessarily mean it's architecturally superior, because two vendors invested in strong integration and again, common API and telemetry, sharing between them can be a very strong SASE offering.

SDxCentral: So that's consolidation on the Enterprise side of things — simplifying networking and security operations. On the market side, do you see that consolidation playing out in a lot of mergers and acquisitions coming up?

Lerner: There has been a lot of M&A activities recently. I mean, you've got Broadcom in the process of acquiring VMware. Broadcom has cloud security, VMware has SD-WAN. Those two huge organizations are coming together and that certainly has very strong potential for a very robust single SASE architecture.

You also have Netskope which bought an SD-WAN company called Infiot to help complete their stack.

So you definitely have situations where vendors are consolidating to build out their stack. We also have a situation in the capital markets right now where it's not a great environment to be a startup, not a great environment to be a private company that's not profitable. So there's going to be some M&A just because of capital markets, which could drive some interesting behavior. So there's going to be a good bit of movement in the market due to M&A.

SDxCentral: Dell'Oro Group is predicting big growth for the SSE market specifically. What do you anticipate for the SSE market moving into 2023?

Lerner: SSE is poised for big growth as well. So think about it this way, SSE is a convergence of multiple security functionality, and SASE is a convergence of SSE with SD-WAN. So, both of those convergences are happening in conjunction with one another, and they're both poised for high growth. Because the way most enterprises secure their stuff today, they use disparate solutions from multiple vendors, which is inefficient from a management perspective, it's been efficient from a policy and security perspective, and from a traffic routing, performance perspective.

So whether you invest in SSE and just consolidate your cloud security stack under one platform, or whether you go one more step and bring the SD-WAN vendor and the networking capability, you're still moving toward convergence. So we expect huge growth for both SSE and SASE.