VMware has a gaping hole in its secure access service edge (SASE) stack. And while VMware has been happy to partner with security vendors to plug these holes, Sanjay Uppal, SVP and general manager of VeloCloud, has said the company plans to acquire a secure web gateway, cloud access security broker, and remote browser isolation.

So who will VMware acquire next on its SASE journey?

According to Zeus Kerravala, founder and principal analyst at ZK Research, VMware could go in one of two directions: acquire an established security vendor or commit to cloud-native security and get a leg up on the competition.

"I think they will go after a more traditional security company," said Kerravala. "Somebody like Zscaler would be ideal."

However, Zscaler's extremely high valuation means an acquisition, however perfect, is likely unrealistic.

"If they want to ease themselves into SASE, they could buy something like Cato Networks or Aryaka, which would give them security needed, plus they could get cloud-delivered networking," he said.

While this would give them a more traditional architecture — Cato offers firewalls, intrusion protection systems, and threat hunting — Kerravala argues that it wouldn't really address the needs of a pure cloud native, distributed cloud workload.

According to Kerravala, it's going to take thinking outside the virtual machine for VMware to get ahead of the pack. "Agility doesn't come from virtual machines," he said.

"If VMware really wants to be kind of a next-gen SASE vendor, I'd like to see them take a look ahead at some of these smaller security vendors that are really born in the cloud, they're cloud native, or they're built on microservices," he said. "I think they need to start thinking about a world where the hypervisor isn't there."

Instead, Kerravala would like to see VMware move toward a cloud-native security stack.

"For that, you need to look at vendors like Volterra, Traceable, Aqua. They have good security stacks and in fact, Volterra has a networking component as well," he said.

Companies like Volterra and Traceable have another advantage. They are able to secure the network at the API layer, where a lot of applications are now being built and a lot of the attacks are now being targeted, explained Kerravala.

"Those are the types of companies that I think they should look at, not ones that will catch them up but will actually take them a step ahead."

VMware's VMworld virtual conference is slated to kick off tomorrow morning, however, Kerravala remains skeptical of an announcement.

"It would create some interesting buzz around it because these virtual events are frankly getting a little boring," he said, added that the more likely timing of a SASE announcement would be sometime around Dell Technology World late next month.

However, short of an acquisition, Kerravala said it wouldn't surprise him to see VMware announce a deeper partnership with a vendor like Zscaler at VMworld.

According to Kerravala, traditional hardware vendors need to evolve if they want to survive the changing workforce dynamics.

"VMware, Cisco, Palo Alto [Networks], Fortinet — they all sell stuff that goes into corporate offices. People aren't going back to corporate offices," he said. "That means the next refresh they do is going to be 20% of the network ports, 20% of the security tools, 20% of the WiFi. So if you're selling that stuff, all of a sudden your market has been cut by 80%."

SASE, which is often delivered as a service, helps to address these challenges by enabling consistent security policy across the board regardless of where the user or application resides.