Zero Trust: platforms consolidate and centralize security controls

Organizations are developing strategies and creating roadmaps to implement and evolve Zero Trust (ZT) architecture. Many of these organizations suffer from vendor sprawl, overlapping capabilities and security gaps. There is a need to consolidate controls, enable interoperability and integrate technologies without compromising capabilities. Zero Trust platforms (ZTPs) deliver ZT business and security outcomes by offering a unified, comprehensive approach to operationalizing the ZT technology ecosystem. Whether in the early stages of the ZT journey or while maturing key domains, ZTPs unite disjointed functions and provide additional capabilities and services to enrich cross-functional operations and simplify ZT adoption. No single solution can provide all the functionality needed for an effective ZT architecture. ZTPs combine key ZT capabilities instead of requiring individual bolted-on tools. This establishes a more harmonious architecture through native and third-party integrations that seek not to rip and replace but rather to anchor and focus.

Because of these trends, ZTP customers should look for vendors that:

Simplify centralized management and usability. Many vendors claim centralized management, but few offer a universal user interface and user experience (UX) shared across multiple ZT components. Security and risk (S&R) professionals benefit from uniform visibility, management and enforcement of controls that improve analysis, reduce complexity and improve the analyst experience (AX). Improving AX relies on streamlining the analyst workflow and providing valuable training on tools and processes. Ease of use through centralized management allows S&R professionals and security analysts to discover, explore, classify, determine and execute without having to launch multiple user interfaces or other disparate consoles. Consolidation not only creates a unified control plane but also provides native tools and services to help, train and raise cyber hygiene awareness, ensuring that ZT best practices align with industry standards and requirements.
Offer flexible deployment models supporting various hybrid architectures. Gone are the days when organizations lived and operated within the confines of a traditional perimeter-based network defense. Organizations continue to adopt cloud-based software and services and to migrate their resources to the cloud. Other organizations cannot migrate to the cloud or wish to retain a level of control by managing resources on premises. Most organizations will manage and secure hybrid architectures comprising on-premises and virtual environments for the foreseeable future. ZTP vendors are curating their offerings to meet cloud, virtual and on-premises needs by offering flexible deployment modes for key security components that are manageable from a cloud-hosted or locally deployed user interface to meet organizations’ individual needs.
Natively integrate ZTNA and/or microsegmentation capabilities. As foundational technologies or capabilities, Zero Trust network access (ZTNA) and microsegmentation implement the fundamental principles of ZT: enforce least privilege, implicitly deny access and enforce complete visibility. ZTNA reduces dependence on legacy VPNs by providing secure end-to-end access to cloud-based, as-a-service (SaaS) and on-premises resources. Microsegmentation enables granular access control to assets and applications by creating microperimeters. These technologies allow organizations to deploy ZT controls without negatively impacting the workforce and business operations.

Evaluation summary

The Forrester Wave™ evaluation highlights Leaders, Strong Performers, Contenders and Challengers. It is an assessment of the top vendors in the market; it does not represent the entire vendor landscape. You will find more information about this market in the reports on ZTPs and ZT eXtended.

We intend this evaluation to be a starting point only and encourage clients to view product evaluations and adapt criteria weightings using the Excel-based vendor comparison tool (see Figures 1 and 2).

Download the report here

Vendor offerings

Vendor profiles

Forrester’s analysis uncovered the following strengths and weaknesses of each vendor.

Leaders

Palo Alto Networks makes the convergence of networking and security a no-brainer. Since its founding more than 18 years ago, Palo Alto Networks has shunned conformity in favor of innovation, starting with the introduction of the industry’s first next-generation firewall in 2008. The vendor continues this strategy by delivering networking and security capabilities through its Zero Trust Framework, which leverages the Prisma, Strata and Cortex solutions with unified management and a touch of AI for IT operations. Palo Alto Networks’ superior vision of helping organizations start their ZT journey addresses the difficulties organizations face in moving from planning to implementation. Its roadmap, however, is bolder, relying heavily on a long-term commitment to more AI/ML capabilities to go beyond automated policy creation.

Palo Alto Networks’ Zero Trust Framework encapsulates the need to enable and protect a hybrid workforce. A reference customer praised the value of enabling a dynamic, agile workforce to enroll, authenticate and securely access resources with Prisma Access, deployed as a service through the platform. Agent-based and agentless deployment options offer single sign-on (SSO) functionality that can support attributes from multiple identity and access management (IAM) solutions to organize and simplify the way users enter credentials and authenticate. The vendor’s centralized management, however, is not as consolidated as its competitors’, and it is sometimes difficult to know what can and cannot be managed from a single user interface. Palo Alto’s Zero Trust Framework suits large enterprises established in a ZT journey with a budget for high-end networking and security capabilities.

Microsoft’s ZT advocacy shines through its products and support services. Microsoft’s modern, holistic approach to ZT has been years in the making. The vendor, like other participants in this evaluation, positions its cloud business as a ZTP, emphasizing its efforts to integrate ZT principles and methodology into Azure features. Its Copilot theme continues towards a notable vision of providing end-to-end, step-by-step guidance for ZT implementation while leveraging AI. This means customers can follow their ZT journey alongside Microsoft. Microsoft further illustrates its vision through its roadmap, which includes Security Copilot and public previews of its ZTNA. ZT pricing and licensing that account for individual, disparate components within Azure, such as Sentinel, remain convoluted and require significant time and effort to budget effectively.

Microsoft’s ubiquity requires it to align its SaaS capabilities with global standards, regulations and mandates. The vendor simplifies governance, notably with comprehensive data security, through its classification and visibility of threats and risks. Microsoft complements the ZT ecosystem’s capabilities through integration and interoperability with third-party vendors to provide granular control over data use and transmission. Microsoft’s ZTP is a modest coupling of key solutions that do not fall entirely under its E5 license, as reference customers noted, and it currently lacks compelling microsegmentation or a true ZTNA solution. The vendor plans to complete the development of these capabilities in its roadmap. Organizations already leveraging Microsoft E5 licenses for their security features are well placed to quickly start their ZT journey with add-ons through Microsoft.

Check Point Software sets the bar for centralized management and usability. The network security titan has been securing networks for just over 30 years with its hardware and software solutions. While many vendors are moving to an all-cloud offering, Check Point Software Technologies has kept an eye on current and future needs for supporting ZT in a hybrid architecture. Its ZTP components are deployed on premises as hardware or software, in the SaaS cloud and virtually to meet unique architectural requirements. Although its innovation investments are substantial, the vendor focuses on mergers and acquisitions, which leaves in-house R&D murky compared with its well-rooted beginnings. Check Point’s roadmap highlights networking and security plans to develop AI and deep learning to improve detection and prevention of threat vectors.

Check Point’s user interface offers a consistent experience, whether the administrator operates in the Infinity portal or within individual components. Check Point Infinity Portal offers ease of use and simplicity to network and security professionals without the need to open multiple windows or tabs to perform daily tasks. Each component is centrally managed in a single management console and categorized into pillars to reduce complexity when navigating between different solutions. Check Point’s microsegmentation capability leverages Azure to simplify network-level deployments, but it lacks noticeable host-level microsegmentation. The vendor provided a reference customer that has not yet implemented the ZTP. Large enterprises with existing Check Point installations would do well to consider the additional capabilities offered by the platform.

Strong Performers

Zscaler offers seamless product security but lacks a consistent customer experience. At the height of the COVID-19 pandemic, Zscaler enjoyed great success with ZTNA and providing secure access to enterprises’ remote workers, but struggled to defend on-premises use cases. The vendor’s strategy for increasing customer and market penetration aims to help customers maximize the value of their Zscaler deployments through training, customer success, product configuration and security audits, as well as by introducing advanced features into entry-level bundles. The vendor offers split messaging that includes providing seamless, secure information exchange and “zero touch, zero trust”, the former representing a more realistic and achievable strategy. Its roadmap highlights improvements spanning several goals, such as stopping cyberattacks by using AI/ML to automate quarantine with remote browser isolation (RBI) and sandboxing.

Zscaler’s ZTP, Zero Trust Exchange, combines its secure web gateway (SWG), data loss prevention (DLP), ZTNA and cloud access security broker (CASB) offerings. Its willingness to provide a software bill of materials upon contract signature allows customers to maintain product security with detailed information including SKUs, subcomponents and licenses. Zscaler has made consolidation efforts through its Client Connector, which controls and manages Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) through a single agent. However, ZIA and ZPA are still treated as separate components rather than a single solution, which creates a tedious customer experience: reference customers lament having to deal with two separate consoles with “some overlap”. In addition, Zscaler’s Zero Trust Exchange remains a cloud-first solution with no true on-premises deployment options outside its Branch Connector. Organizations on a cloud migration path with little or no need to support legacy systems can turn to Zscaler to start or advance their ZT journey.

Trend Micro’s Vision One improves AX through analytics but undersells ZTNA. Trend Micro has come a long way since its humble beginnings as an antivirus solution. The cybersecurity software vendor has become something of an unsung hero of security control and visibility across networks, endpoints and applications/workloads. The cost/value ratio Trend offers through its native solutions and extensive integrations makes it a viable solution for budget-conscious customers. The vendor has been methodical with its Vision One strategy to operationalize ZT through advanced analytics. However, the vendor’s secure access capabilities are underutilized. Trend Micro’s roadmap complements its vision by continually emphasizing improved visibility and analytics with modest secure access updates.

Visibility and advanced analytics are the strengths of Trend Micro’s Vision One, allowing the vendor to deliver a robust AX. Reference customers appreciate Vision One’s value in optimizing visibility and control. Most of the information an analyst needs is accessible in a single console. This console provides a risk scoring measure based on user and device behavior that makes it possible to create precise risk-based policies in the platform or in third-party solutions through integrations. Its ZTNA and SWG capabilities enable network-level microsegmentation for user-to-application control. The solution lacks the ability to take geolocation into account beyond IP-based and application-to-application communication to effectively enforce microperimeters. Organizations starting their ZT journey that need an advanced visibility and analytics solution to establish a baseline should evaluate Trend Micro.

Google’s BeyondCorp is the very embodiment of ZT, but organizations must buy into the vision. Tech titan Google has evolved from a simple search engine into a leading cloud hyperscaler, security vendor and ZT advocate that pioneered BeyondCorp. The vendor’s commitment to innovation is supported by the continued expansion of its partner ecosystem and its commitment to advancing native capabilities. Its pricing and transparency are cumbersome. It has several models that force customers investing in Google’s ZT vision to decide whether BeyondCorp Enterprise suits an organization that is not cloud-first, or whether separate pay-as-you-go components of the overall Google Cloud platform are sufficient for hybrid and on-premises environments. Google’s roadmap focuses on the continued expansion of compliance coverage, partner integrations, cloud-native security capabilities and secure enterprise browsers.

Google’s ZT approach demonstrates the effective application of the information security model’s fundamental principles. The vendor enables and protects hybrid workforces by using Chrome on every device, offering an agentless capability to secure and protect users and their interactions regardless of their location. Reference customers highlight the simplicity of supporting and managing Bring Your Own Device, especially when combined with the IAM and DLP offerings. With BeyondCorp Enterprise, administrators use disparate solutions under a single console to monitor and perform in-depth investigative actions. Google’s ability to extend on premises depends on the presence of Chrome or the ability to deploy an application connector to route traffic to its cloud business. Google BeyondCorp Enterprise is ideal for organizations looking for cloud security solutions that leverage Google’s cloud infrastructure and Chrome to secure the hybrid workforce.

Cloudflare’s innovation is limitless, but change management is counterintuitive. As one of the youngest vendors in this evaluation, Cloudflare has shown continued growth, from a humble online honeypot solution in 2009 to its official launch in 2010 and now a fully cloud-native ZTP. The vendor’s ZTP, Cloudflare One, unifies visibility and management of ZTNA, CASB, DLP and web application firewall (WAF), with plans to keep adding and integrating more functions and capabilities. Cloudflare’s roadmap reflects the company’s commitment to innovation, taking a customer-centric approach to meet growing trends and unique demands. The vendor’s vision, however, is a rather familiar story: becoming the control plane of choice for organizations. As an access broker and domain name system reverse proxy, Cloudflare One succeeds in providing a centralized, consolidated platform to manage and orchestrate many of its cloud-native solutions for ease of use and faster deployments. Various network, DLP and access control policies are managed from a single console, allowing customers to deploy quickly and protect themselves against Internet-borne threats. Cloudflare’s deployment modes are 100% SaaS only, with connections to other cloud and on-premises resources facilitated only through application connectors running parallel to the existing architecture. Audit configuration management is cumbersome and unintuitive, with one reference customer describing it as “not having full scope” and having to sift through audit trails. Mid-size and large organizations with a cloud-first initiative to actively migrate their resources and replace legacy WAN and VPN solutions should evaluate Cloudflare One.
Akamai Technologies leads in microsegmentation, but its integrations lag behind. Akamai Technologies’ acquisition of Guardicore in 2021 helped position the vendor as a viable ZTP vendor. The company continues its mergers and acquisitions strategy to integrate more capabilities and complement existing ones, realizing its common, if standard, vision of simplifying ZT. Most attractive is the company’s decision to create a business unit (BU) dedicated to ZT, led by Guardicore’s former CEO, to improve Akamai Technologies’ capabilities and integrations with a ZT mindset. This BU mainly addresses in-house R&D and does not offer much in terms of a dedicated support team for organizations starting or actively implementing a ZT architecture. Akamai Technologies’ roadmap reflects planned improvements to its products to enhance integration, coverage, scalability, ease of use and security. Akamai Technologies’ Zero Trust Security platform consists of its ZTNA, SWG and microsegmentation technologies, with integrations including its multi-factor authentication (MFA) and WAF (web application and API protection) solutions. Its Akamai Guardicore segmentation continues to be a winning asset for organizations that value visibility and native firewall capabilities for microsegmentation. Reference customers noted an improved UX for DevOps and security, as it “puts segmentation on top of something without having to re-architect the system”. Akamai Technologies’ technology ecosystem also integrates with third-party solutions. However, full native integration and feature parity have yet to surface. Reference customers expressed dissatisfaction with the need to maintain multiple agents and separate support services. Organizations looking to reduce the stress of microsegmentation can leverage Akamai Technologies’ Zero Trust Security platform.
Cisco Systems has a broad product portfolio but lacks true centralized management. Cisco, a pillar of networking and security, has a long history of serving its customers. Its vast partner ecosystem allows the vendor to expand purchasing opportunities for customers while generating the bulk of its SaaS bookings and revenue. Cisco’s vision is to offer organizations better access control and security in order to thwart attackers. However, the vendor has not yet truly embodied this vision in its broader platform, which ultimately frustrates administrators trying to integrate the existing architecture. Cisco’s community strategy is remarkable, but it struggles to gain influence: its ZT coverage is not as consistent or as impactful as others’. Its roadmap hints at the eventual delivery of a consistent UX but fails to deliver consolidation and centralized management. Cisco’s ZTP includes Duo, Identity Services Engine (ISE), Secure Client, Secure Workload, Umbrella and other Cisco solutions integrated through its pxGrid and product APIs. Duo effectively enforces least privilege on all entities through contextual policies. It now integrates with ISE without the need for a proxy, enabling consistent SSO with passwordless MFA support for on-site and remote staff. The solution, however, lacks true centralized management. Unlike the other companies in this evaluation, Cisco still has a fragmented control plane that requires significant time and skill to manage and maintain. Third-party integrations are notoriously difficult and have become a theme over the years, with one reference customer stating that it is “still” a challenge. The integration process is not as smooth for third-party products that do not support pxGrid. Organizations heavily invested in the Cisco technology ecosystem should consider the vendor for ZTP.

Contenders

Fortinet offers cost-effective network security but deficient workload security. Best known for its firewalls, Fortinet has since expanded its coverage through strategic acquisitions and some organic growth. Fortinet’s vision focuses on the interoperability of networks and security operations centers (SOCs), emphasizing interoperability among the many components the vendor offers. Fortinet falls short on community, offering little or no peer discussion, guidance or awareness of ZT advancement beyond its product capabilities. Its roadmap is disappointing, providing feature updates and entry-level ZT pillar-focused capabilities tied to what it calls “neural network learning”, which leverages AI/ML and analytics. Although the vendor is known for offering value at low cost, the FortiFlex points-based system lands with a thud for a pricing model that makes sense on paper. Fortinet’s components all leverage FortiOS, which is highly regarded for its ease of use, implementation and management, reducing the need for administrators to relearn disparate user interfaces for multiple components. This translates into its platform, which optimizes network security, allowing administrators to gain greater visibility and control over FortiGates and FortiAnalyzer across cloud, virtual and on-premises environments centrally through FortiManager. Fortinet shines in on-premises environments and can support hybrid networks. However, cloud deployments are not as conclusive, with one reference customer noting that capabilities – such as CASB – are not fully developed, affecting its ability to deliver effective workload and application security. Organizations of any size with multiple Fortinet network security solutions will benefit from the FortiManager component of the vendor’s ZTP offering.
Absolute Software’s self-healing security is promising, but new innovations are scarce. Absolute Software was ahead of its time, becoming the only cybersecurity software embedded at the factory in endpoints. Having found success in the education sector, the company has diversified into other public and private market sectors. Crosspoint Capital completed the acquisition in July 2023, taking the vendor private. Absolute Software’s vision of resilient, self-healing security is as unique as its capabilities for automating the restoration of endpoint and network connectivity. However, the vendor offers little innovation, relying on its reputation rather than aligning with current trends and future needs. Absolute Software’s roadmap is simple and focuses mainly on table-stakes improvements to enhance monitoring with AI, reduce the attack surface and ease deployment. The Absolute Zero Trust solution builds on the vendor’s Secure Endpoint and Secure Access solutions, integrating tightly with its SWG. Because it is embedded by default in devices, the vendor is well placed to provide effective data and device security for managed devices, relying on a single agent to enforce access and compliance policies at the endpoint. Reference customers praise its effectiveness in protecting and securing remote workers and devices. Absolute Software requires endpoints to install and/or register the agent on devices, but unmanaged endpoints have no real agentless or clientless alternative for limited or just-in-time/just-enough access to resources. Absolute Software does not prioritize data-at-rest security and offers full disk encryption only through a third-party integration. Organizations with more restrictive requirements that want to extend network access control capability down to the endpoint should evaluate Absolute Software.
Broadcom offers broad coverage and an ambiguous vision for its platform. Broadcom’s acquisitions of CA Technologies and Symantec effectively created a one-stop shop for all things security. The vendor’s overall go-to-market approach is to focus on a limited set of very large organizations, which initially led to a mass exodus of smaller customers to other vendors. The vendor’s ZTP strategy lacks definitive long-term prospects and maintains a level of segregation of its security offerings into individual segments, with short-term improvements that are more reactionary than innovative. Broadcom’s roadmap, however, seeks to integrate in-house product families into a platform through a unified Symantec console scheduled for release in 2024, in the hope of attracting new customers. Broadcom’s Symantec ZTP includes mature products, such as CASB; cloud security gateway (CSG); ZTNA; identity, credential and access management; endpoint; and DLP, with several deployment options, including cloud, on-premises and hybrid networks. The CSG and CASB components are particularly notable, with a reverse proxy and extensive application coverage available without the need for third-party integrations. The DLP functionality gives customers the ability to perform scans at the endpoint, in the cloud or on premises, creating an opportunity to meet specific deployment requirements in complex environments. The user interface is easy to understand but dated. Broadcom declined to participate in the full Forrester Wave evaluation process.

Challengers

Forcepoint advances with ZTE elements but leaves other aspects aside. Forcepoint, originally founded as a reseller in 1994, has transformed through mergers and acquisitions into a security platform vendor focused on data security, ZTNA, SWG and RBI. More recently, the vendor divested its government business to TPG after its acquisition by Francisco Partners from Raytheon Technologies. Forcepoint’s strategy focuses mainly on improving its Zero Trust Edge (ZTE) offering, while leaving aside other ZTP aspects such as its hardware solutions for maintaining stronger on-premises network security. Forcepoint lags in innovation, focusing on integrating acquisitions and building solutions to meet current market needs.

Forcepoint offers several products in the ZTP space, such as data classification, DLP, user behavior analytics, ZTE and firewalls. The functionality is comparable to that of other vendors in the space but lags from a platform perspective, as it falls to SOC analysts to correlate disparate telemetry information. Several consoles are needed to build a picture, resulting in an extremely manual process for analysts when provisioning or responding to an incident in real time. Mid-size and large organizations and current Forcepoint customers would benefit from evaluating this combined offering. Forcepoint declined to participate in the full Forrester Wave evaluation process.

VMware has strong workload protection but needs a more cohesive offering. VMware is best known for providing the flexibility to deploy virtual machines just about anywhere. The vendor’s vision is tied to ZT and the ability to provide coverage across several pillars of the ZT model. VMware’s installed base in most organizational departments (e.g., security, enterprise IT and vendors’ virtual machine-based offerings) provides deep insight into virtual networks and endpoints through network security solutions that include its NSX software-based firewalls. Its acquisition of Carbon Black allowed it to add an endpoint detection and response (EDR) component to its offering, expanding its endpoint security coverage. The roadmap lags behind other evaluations and brings some improvements to VMware-specific features, including additional third-party integrations and EDR improvements for Carbon Black. Broadcom’s imminent acquisition of VMware could also impact the vendor’s strategy, roadmap and go-to-market approach, if Broadcom’s previous acquisitions are any indication of the path ahead.

VMware’s workload protection capabilities are widely used in cloud, multicloud and hybrid deployments and have become the de facto standard for cloud migrations. Cloud configuration management, security, governance and lifecycle management all feature prominently in its product offerings. However, VMware offers no true ZTP solution that unifies its disparate solutions. Organizations using VMware solutions, especially for virtualized environments or with self-hosting requirements, should look into VMware’s ZTP offering. VMware declined to participate in the full Forrester Wave evaluation process.

Evaluation overview

Forrester grouped the evaluation criteria into three high-level categories:

Current offering. Each vendor’s position on the vertical axis of the Forrester Wave graphic indicates the strength of its current offering. Key criteria for these solutions include network security, ecosystem totality, centralized management, visibility and analytics, automation and orchestration, device security, AX and integrations.
Strategy. Placement on the horizontal axis indicates the strength of the vendors’ strategies. We evaluated vision, innovation, roadmap, partner ecosystem, adoption, and pricing flexibility and transparency.
Market presence. Represented by the size of the markers on the graphic, our market presence scores reflect each vendor’s total revenue for the product and number of current customers.

Vendor inclusion criteria

Each of the vendors we included in this evaluation has:

Strong enterprise support for ZTP functionality. Vendors must natively provide the core functions of a ZTP across a minimum of four ZT domains (pillars) and must include ZTNA and/or microsegmentation capability. Vendors must also have recent and ongoing adoption among enterprise customers of ZT features that can operate in on-premises, cloud and hybrid environments.
A generally available ZT product as of May 25, 2023. Forrester did not consider any features released after May 25, 2023. All features were generally available for purchase, not in beta or limited release. The platform was delivered as a product or as software-as-a-service, not as a managed service.
A platform that addresses at least three core ZT use cases. The ZTP must offer a solid foundation to address three or more core use cases in a heterogeneous environment, including enabling and protecting hybrid workforces, monitoring and securing network traffic across the enterprise, preventing lateral movement of unauthorized activity, enforcing least privilege on all entities, and centrally managing key security controls.
Mindshare among Forrester’s enterprise clients. The solution has generated interest, in the form of mentions and inquiries, among Forrester’s client base over the past 12 months; end users frequently mention shortlisting the product; and other vendors mention the evaluated vendor as a frequent competitor in the market.
Substantial ZT revenue. We required vendors to have generated at least $200 million in annual revenue in the ZT platform market over the past four quarters in at least two geographic regions.
ZT advocacy. Vendors advance, engage with and leverage the operationalization of ZT as an ecosystem to meet growing customer needs and challenges, including applying ZT concepts and principles internally through solutions that are part of a commercialized ZTP.

Sources: Forrester

Because of these trends, ZTP customers should look for vendors that:

Simplify centralized management and usability. Many vendors claim centralized management, but few offer a universal user interface and user experience (UX) shared across multiple ZT components. Security and risk (S&R) professionals benefit from uniform visibility, management and enforcement of controls that improve analysis, reduce complexity and improve the analyst experience (AX). Improving AX relies on streamlining the analyst workflow and providing valuable training on tools and processes. Ease of use through centralized management allows S&R professionals and security analysts to discover, explore, classify, determine and execute without having to launch multiple user interfaces or other disparate consoles. Consolidation not only creates a unified control plane but also provides native tools and services to help, train and raise cyber hygiene awareness, ensuring that ZT best practices align with industry standards and requirements.
Offer flexible deployment models supporting various hybrid architectures. Gone are the days when organizations lived and operated within the confines of a traditional perimeter-based network defense. Organizations continue to adopt cloud-based software and services and to migrate their resources to the cloud. Other organizations cannot migrate to the cloud or wish to retain a level of control by managing resources on premises. Most organizations will manage and secure hybrid architectures comprising on-premises and virtual environments for the foreseeable future. ZTP vendors are curating their offerings to meet cloud, virtual and on-premises needs by offering flexible deployment modes for key security components that are manageable from a cloud-hosted or locally deployed user interface to meet organizations’ individual needs.
Natively integrate ZTNA and/or microsegmentation capabilities. As foundational technologies or capabilities, Zero Trust network access (ZTNA) and microsegmentation implement the fundamental principles of ZT: enforce least privilege, implicitly deny access and enforce complete visibility. ZTNA reduces dependence on legacy VPNs by providing secure end-to-end access to cloud-based, as-a-service (SaaS) and on-premises resources. Microsegmentation enables granular access control to assets and applications by creating microperimeters. These technologies allow organizations to deploy ZT controls without negatively impacting the workforce and business operations.

Evaluation summary

Download the report here

Vendor offerings

Vendor profiles

Forrester’s analysis uncovered the following strengths and weaknesses of each vendor.

Leaders

Microsoft’s ZT advocacy shines through its products and support services. Microsoft’s modern, holistic approach to ZT has been years in the making. The vendor, like other participants in this evaluation, positions its cloud business as a ZTP, emphasizing its efforts to integrate ZT principles and methodology into Azure features. Its Copilot theme continues towards a notable vision of providing end-to-end, step-by-step guidance for ZT implementation while leveraging AI. This means customers can follow their ZT journey alongside Microsoft. Microsoft further illustrates its vision through its roadmap, which includes Security Copilot and public previews of its ZTNA. ZT pricing and licensing that account for individual, disparate components within Azure, such as Sentinel, remain convoluted and require significant time and effort to budget effectively.

Check Point Software sets the bar for centralized management and usability. The network security titan has been securing networks for just over 30 years with its hardware and software solutions. While many vendors are moving to an all-cloud offering, Check Point Software Technologies has kept an eye on current and future needs for supporting ZT in a hybrid architecture. Its ZTP components are deployed on premises as hardware or software, in the SaaS cloud and virtually to meet unique architectural requirements. Although its innovation investments are substantial, the vendor focuses on mergers and acquisitions, which leaves in-house R&D murky compared with its well-rooted beginnings. Check Point’s roadmap highlights networking and security plans to develop AI and deep learning to improve detection and prevention of threat vectors.

Strong Performers

Zscaler offers seamless product security but lacks a consistent customer experience. At the height of the COVID-19 pandemic, Zscaler enjoyed great success with ZTNA and providing secure access to enterprises’ remote workers, but struggled to defend on-premises use cases. The vendor’s strategy for increasing customer and market penetration aims to help customers maximize the value of their Zscaler deployments through training, customer success, product configuration and security audits, as well as by introducing advanced features into entry-level bundles. The vendor offers split messaging that includes providing seamless, secure information exchange and “zero touch, zero trust”, the former representing a more realistic and achievable strategy. Its roadmap highlights improvements spanning several goals, such as stopping cyberattacks by using AI/ML to automate quarantine with remote browser isolation (RBI) and sandboxing.

Trend Micro’s Vision One improves AX through analytics but undersells ZTNA. Trend Micro has come a long way since its humble beginnings as an antivirus solution. The cybersecurity software vendor has become something of an unsung hero of security control and visibility across networks, endpoints and applications/workloads. The cost/value ratio Trend offers through its native solutions and extensive integrations makes it a viable solution for budget-conscious customers. The vendor has been methodical with its Vision One strategy to operationalize ZT through advanced analytics. However, the vendor’s secure access capabilities are underutilized. Trend Micro’s roadmap complements its vision by continually emphasizing improved visibility and analytics with modest secure access updates.

Google’s BeyondCorp is the very embodiment of ZT, but organizations must buy into the vision. Tech titan Google has evolved from a simple search engine into a leading cloud hyperscaler, security vendor and ZT advocate that pioneered BeyondCorp. The vendor’s commitment to innovation is supported by the continued expansion of its partner ecosystem and its commitment to advancing native capabilities. Its pricing and transparency are cumbersome. It has several models that force customers investing in Google’s ZT vision to decide whether BeyondCorp Enterprise suits an organization that is not cloud-first, or whether separate pay-as-you-go components of the overall Google Cloud platform are sufficient for hybrid and on-premises environments. Google’s roadmap focuses on the continued expansion of compliance coverage, partner integrations, cloud-native security capabilities and secure enterprise browsers.

Cloudflare’s innovation is limitless, but change management is counterintuitive. As one of the youngest vendors in this evaluation, Cloudflare has shown continued growth, from a humble online honeypot solution in 2009 to its official launch in 2010 and now a fully cloud-native ZTP. The vendor’s ZTP, Cloudflare One, unifies visibility and management of ZTNA, CASB, DLP and web application firewall (WAF), with plans to keep adding and integrating more functions and capabilities. Cloudflare’s roadmap reflects the company’s commitment to innovation, taking a customer-centric approach to meet growing trends and unique demands. The vendor’s vision, however, is a rather familiar story: becoming the control plane of choice for organizations. As an access broker and domain name system reverse proxy, Cloudflare One succeeds in providing a centralized, consolidated platform to manage and orchestrate many of its cloud-native solutions for ease of use and faster deployments. Various network, DLP and access control policies are managed from a single console, allowing customers to deploy quickly and protect themselves against Internet-borne threats. Cloudflare’s deployment modes are 100% SaaS only, with connections to other cloud and on-premises resources facilitated only through application connectors running parallel to the existing architecture. Audit configuration management is cumbersome and unintuitive, with one reference customer describing it as “not having full scope” and having to sift through audit trails. Mid-size and large organizations with a cloud-first initiative to actively migrate their resources and replace legacy WAN and VPN solutions should evaluate Cloudflare One.
Akamai Technologies leads in microsegmentation, but its integrations lag behind. Akamai Technologies’ acquisition of Guardicore in 2021 helped position the vendor as a viable ZTP vendor. The company continues its mergers and acquisitions strategy to integrate more capabilities and complement existing ones, realizing its common, if standard, vision of simplifying ZT. Most attractive is the company’s decision to create a business unit (BU) dedicated to ZT, led by Guardicore’s former CEO, to improve Akamai Technologies’ capabilities and integrations with a ZT mindset. This BU mainly addresses in-house R&D and does not offer much in terms of a dedicated support team for organizations starting or actively implementing a ZT architecture. Akamai Technologies’ roadmap reflects planned improvements to its products to enhance integration, coverage, scalability, ease of use and security. Akamai Technologies’ Zero Trust Security platform consists of its ZTNA, SWG and microsegmentation technologies, with integrations including its multi-factor authentication (MFA) and WAF (web application and API protection) solutions. Its Akamai Guardicore segmentation continues to be a winning asset for organizations that value visibility and native firewall capabilities for microsegmentation. Reference customers noted an improved UX for DevOps and security, as it “puts segmentation on top of something without having to re-architect the system”. Akamai Technologies’ technology ecosystem also integrates with third-party solutions. However, full native integration and feature parity have yet to surface. Reference customers expressed dissatisfaction with the need to maintain multiple agents and separate support services. Organizations looking to reduce the stress of microsegmentation can leverage Akamai Technologies’ Zero Trust Security platform.
Cisco Systems has a broad product portfolio but lacks true centralized management. Cisco, a pillar of networking and security, has a long history of serving its customers. Its vast partner ecosystem allows the vendor to expand purchasing opportunities for customers while generating the bulk of its SaaS bookings and revenue. Cisco’s vision is to offer organizations better access control and security in order to thwart attackers. However, the vendor has not yet truly embodied this vision in its broader platform, which ultimately frustrates administrators trying to integrate the existing architecture. Cisco’s community strategy is remarkable, but it struggles to gain influence: its ZT coverage is not as consistent or as impactful as others’. Its roadmap hints at the eventual delivery of a consistent UX but fails to deliver consolidation and centralized management. Cisco’s ZTP includes Duo, Identity Services Engine (ISE), Secure Client, Secure Workload, Umbrella and other Cisco solutions integrated through its pxGrid and product APIs. Duo effectively enforces least privilege on all entities through contextual policies. It now integrates with ISE without the need for a proxy, enabling consistent SSO with passwordless MFA support for on-site and remote staff. The solution, however, lacks true centralized management. Unlike the other companies in this evaluation, Cisco still has a fragmented control plane that requires significant time and skill to manage and maintain. Third-party integrations are notoriously difficult and have become a theme over the years, with one reference customer stating that it is “still” a challenge. The integration process is not as smooth for third-party products that do not support pxGrid. Organizations heavily invested in the Cisco technology ecosystem should consider the vendor for ZTP.

Contenders

Fortinet offers cost-effective network security but deficient workload security. Best known for its firewalls, Fortinet has since expanded its coverage through strategic acquisitions and some organic growth. Fortinet’s vision focuses on the interoperability of networks and security operations centers (SOCs), emphasizing interoperability among the many components the vendor offers. Fortinet falls short on community, offering little or no peer discussion, guidance or awareness of ZT advancement beyond its product capabilities. Its roadmap is disappointing, providing feature updates and entry-level ZT pillar-focused capabilities tied to what it calls “neural network learning”, which leverages AI/ML and analytics. Although the vendor is known for offering value at low cost, the FortiFlex points-based system lands with a thud for a pricing model that makes sense on paper. Fortinet’s components all leverage FortiOS, which is highly regarded for its ease of use, implementation and management, reducing the need for administrators to relearn disparate user interfaces for multiple components. This translates into its platform, which optimizes network security, allowing administrators to gain greater visibility and control over FortiGates and FortiAnalyzer across cloud, virtual and on-premises environments centrally through FortiManager. Fortinet shines in on-premises environments and can support hybrid networks. However, cloud deployments are not as conclusive, with one reference customer noting that capabilities – such as CASB – are not fully developed, affecting its ability to deliver effective workload and application security. Organizations of any size with multiple Fortinet network security solutions will benefit from the FortiManager component of the vendor’s ZTP offering.
Absolute Software’s self-healing security is promising, but new innovations are scarce. Absolute Software was ahead of its time, becoming the only cybersecurity software embedded at the factory in endpoints. Having found success in the education sector, the company has diversified into other public and private market sectors. Crosspoint Capital completed the acquisition in July 2023, taking the vendor private. Absolute Software’s vision of resilient, self-healing security is as unique as its capabilities for automating the restoration of endpoint and network connectivity. However, the vendor offers little innovation, relying on its reputation rather than aligning with current trends and future needs. Absolute Software’s roadmap is simple and focuses mainly on table-stakes improvements to enhance monitoring with AI, reduce the attack surface and ease deployment. The Absolute Zero Trust solution builds on the vendor’s Secure Endpoint and Secure Access solutions, integrating tightly with its SWG. Because it is embedded by default in devices, the vendor is well placed to provide effective data and device security for managed devices, relying on a single agent to enforce access and compliance policies at the endpoint. Reference customers praise its effectiveness in protecting and securing remote workers and devices. Absolute Software requires endpoints to install and/or register the agent on devices, but unmanaged endpoints have no real agentless or clientless alternative for limited or just-in-time/just-enough access to resources. Absolute Software does not prioritize data-at-rest security and offers full disk encryption only through a third-party integration. Organizations with more restrictive requirements that want to extend network access control capability down to the endpoint should evaluate Absolute Software.
Broadcom offers broad coverage and an ambiguous vision for its platform. Broadcom’s acquisitions of CA Technologies and Symantec effectively created a one-stop shop for all things security. The vendor’s overall go-to-market approach is to focus on a limited set of very large organizations, which initially led to a mass exodus of smaller customers to other vendors. The vendor’s ZTP strategy lacks definitive long-term prospects and maintains a level of segregation of its security offerings into individual segments, with short-term improvements that are more reactionary than innovative. Broadcom’s roadmap, however, seeks to integrate in-house product families into a platform through a unified Symantec console scheduled for release in 2024, in the hope of attracting new customers. Broadcom’s Symantec ZTP includes mature products, such as CASB; cloud security gateway (CSG); ZTNA; identity, credential and access management; endpoint; and DLP, with several deployment options, including cloud, on-premises and hybrid networks. The CSG and CASB components are particularly notable, with a reverse proxy and extensive application coverage available without the need for third-party integrations. The DLP functionality gives customers the ability to perform scans at the endpoint, in the cloud or on premises, creating an opportunity to meet specific deployment requirements in complex environments. The user interface is easy to understand but dated. Broadcom declined to participate in the full Forrester Wave evaluation process.

Challengers

Forcepoint advances with ZTE elements but leaves other aspects aside. Forcepoint, originally founded as a reseller in 1994, has transformed through mergers and acquisitions into a security platform vendor focused on data security, ZTNA, SWG and RBI. More recently, the vendor divested its government business to TPG after its acquisition by Francisco Partners from Raytheon Technologies. Forcepoint’s strategy focuses mainly on improving its Zero Trust Edge (ZTE) offering, while leaving aside other ZTP aspects such as its hardware solutions for maintaining stronger on-premises network security. Forcepoint lags in innovation, focusing on integrating acquisitions and building solutions to meet current market needs.

VMware has strong workload protection but needs a more cohesive offering. VMware is best known for providing the flexibility to deploy virtual machines just about anywhere. The vendor’s vision is tied to ZT and the ability to provide coverage across several pillars of the ZT model. VMware’s installed base in most organizational departments (e.g., security, enterprise IT and vendors’ virtual machine-based offerings) provides deep insight into virtual networks and endpoints through network security solutions that include its NSX software-based firewalls. Its acquisition of Carbon Black allowed it to add an endpoint detection and response (EDR) component to its offering, expanding its endpoint security coverage. The roadmap lags behind other evaluations and brings some improvements to VMware-specific features, including additional third-party integrations and EDR improvements for Carbon Black. Broadcom’s imminent acquisition of VMware could also impact the vendor’s strategy, roadmap and go-to-market approach, if Broadcom’s previous acquisitions are any indication of the path ahead.

Evaluation overview

Forrester grouped the evaluation criteria into three high-level categories:

Current offering. Each vendor’s position on the vertical axis of the Forrester Wave graphic indicates the strength of its current offering. Key criteria for these solutions include network security, ecosystem totality, centralized management, visibility and analytics, automation and orchestration, device security, AX and integrations.
Strategy. Placement on the horizontal axis indicates the strength of the vendors’ strategies. We evaluated vision, innovation, roadmap, partner ecosystem, adoption, and pricing flexibility and transparency.
Market presence. Represented by the size of the markers on the graphic, our market presence scores reflect each vendor’s total revenue for the product and number of current customers.

Vendor inclusion criteria

Each of the vendors we included in this evaluation has:

Strong enterprise support for ZTP functionality. Vendors must natively provide the core functions of a ZTP across a minimum of four ZT domains (pillars) and must include ZTNA and/or microsegmentation capability. Vendors must also have recent and ongoing adoption among enterprise customers of ZT features that can operate in on-premises, cloud and hybrid environments.
A generally available ZT product as of May 25, 2023. Forrester did not consider any features released after May 25, 2023. All features were generally available for purchase, not in beta or limited release. The platform was delivered as a product or as software-as-a-service, not as a managed service.
A platform that addresses at least three core ZT use cases. The ZTP must offer a solid foundation to address three or more core use cases in a heterogeneous environment, including enabling and protecting hybrid workforces, monitoring and securing network traffic across the enterprise, preventing lateral movement of unauthorized activity, enforcing least privilege on all entities, and centrally managing key security controls.
Mindshare among Forrester’s enterprise clients. The solution has generated interest, in the form of mentions and inquiries, among Forrester’s client base over the past 12 months; end users frequently mention shortlisting the product; and other vendors mention the evaluated vendor as a frequent competitor in the market.
Substantial ZT revenue. We required vendors to have generated at least $200 million in annual revenue in the ZT platform market over the past four quarters in at least two geographic regions.
ZT advocacy. Vendors advance, engage with and leverage the operationalization of ZT as an ecosystem to meet growing customer needs and challenges, including applying ZT concepts and principles internally through solutions that are part of a commercialized ZTP.