Researchers reported major disparity in security effectiveness of security service edge (SSE) protection across major vendors.

Non-profit CyberRatings.org (CyberRatings) found security effectiveness ranged from less than 3% to 100% in its testing of vendor products, with only Fortinet, Palo Alto Networks, Versa Networks, and Zscaler earning a "recommended" rating.

In contrast, SSE products from Cisco, Cloudflare, and Skyhigh were tagged with a "caution" label, indicating "below-average" security effectiveness with the recommendation that end users “should consider seeking other solutions." The ratings were put down due to “failures in critical tests."

Cato Networks and Netskope were absent from the report, with the former “explicit in their refusal to engage” with CyberRatings and a “lack of responsiveness” associated with Netskope, who remained atop of Gartner’s latest ranking of SSE vendors, alongside Palo Alto Networks, and Zscaler.

Testing was carried out by the recently relaunched NSS Labs, the official testing partner of CyberRatings. The tests were designed to map a product's security effectiveness to gauge relative capabilities and measuring false-positive accuracy in the context of operational overhead.

CyberRatings found the biggest impact on security effectiveness came from blocking evasions, which are used by threat actors to disguise or modify attacks to bypass defenses. Three of the tested products failed to stop evasions, according to the researchers.

CyberRatings noted that the cloud-based nature of SSE, which uses continuous integration/continuous deployment (CI/CD) practices that can reduce customer visibility or influence over release quality or change management, makes independent testing operations more of a challenge.

Dell’Oro Group research found a 15% increase in SSE-related revenues during the first quarter of this year, highlighting healthy market growth and the increased importance of periodic testing to guarantee consistent protection and compliance of networks.

SDxCentral has contacted Cisco, Cloudflare, Skyhigh, Cato Networks, and Netskope for comment on the report.