Comparing Secure Access Service Edge (SASE) Solutions
As IT decision-makers engage with Comport, discussions often cover many topics. However, the integration of new technologies into a business invariably brings the issue of cybersecurity to the forefront. Comport has noted a significant trend toward adopting Secure Access Service Edge (SASE) solutions for crucial network security as organizations manage the challenges of expanded remote workforces and devices, growing data breaches, and a rise in ransomware incidents.
As IT decision-makers engage with Comport, discussions often cover many topics. However, the integration of new technologies into a business invariably brings the issue of cybersecurity to the forefront. Comport has noted a significant trend toward adopting Secure Access Service Edge (SASE) solutions for crucial network security as organizations manage the challenges of expanded remote workforces and devices, growing data breaches, and a rise in ransomware incidents.
SASE is increasingly becoming the preferred method for modernizing secure access in today’s connected world. Comport has compiled a list of SASE vendors to assist IT decision-makers in selecting a suitable SASE vendor that meets their specific requirements, taking into account security, cost-efficiency, and network performance.
When navigating the SASE vendor landscape, it’s important to recognize that each vendor category provides distinct advantages and disadvantages. This guide offers a summary, key features, and pros and cons of each vendor to assist your decision-making. This document compares the following vendors alphabetically: Cloudflare, Fortinet, Palo Alto, and Zscaler. We have also added Aruba SASE as another option, as we believe it’s strong for those who want to build their own solutions and those already leveraging Aruba Networking.
Cloudflare One: Entry-Level SASE Option
Cloudflare is widely recognized for its content delivery network and services that mitigate distributed denial-of-service (DDoS) attacks. Cloudflare One is a Zero Trust Network-as-a-Service (NaaS) platform enabling IT to connect users to enterprise resources using identity-based security controls, regardless of location.
The solution integrates network connectivity services with Zero Trust security solutions on a purpose-built global network. The offering includes support for Zero Trust Network Access (ZTNA), Cloud Access Security Broker (CASB), Secure Web Gateway (SWG), and Firewall-as-a-Service (FaaS).
Furthermore, Cloudflare One offers WAN-as-a-Service in collaboration with Software-Defined Wide Area Networking (SD-WAN) vendors. The service enables enterprises to connect data centers and branch offices directly with Cloudflare Network Interconnect (CNI) for better reliability and performance.
Cloudfare One Features
- A private backbone with 200+ access points across 100+ countries.
- 100% uptime guaranteed in the SLA with 67 Tbps network capacity.
- All SASE tiers include verified device security posture and contextual features.
- Clientless access for web apps and browser-based SSH on non-corporate devices.
- Deployment and self-enrollment via MDM tools or direct access to Cloudflare.
- Agent support for Windows, macOS, iOS, Android, Linux, and ChromeOS.
Pros
- ZTNA applies to all traffic, users, and devices by default.
- Top-rated DDoS protection integrated into the Magic Transit NaaS as part of SASE.
- Comprehensive automation supports traffic management and DDoS mitigation.
- IoT isolation through Magic Transit NaaS to protect IoT and network resources.
- Comprehensive free tier available for up to 50 users, making it an attractive option for small businesses or those exploring SASE.
- Easy setup and integration for Cloudflare One, as well as a user-friendly interface.
- Users frequently praise Cloudflare’s quality of customer support.
Cons
- Lacks direct network controls typically managed by SD-WAN owners.
- Some customers prefer email notifications for rule violations, which are not currently provided.
- Customers evaluating against more established CASB and firewall vendors desire additional enhancements.
- Some users find the interface confusing or cluttered at times.
Fortinet FortiSASE: Best Option for Fortinet Upgrades
Fortinet, renowned for its security capabilities, provides FortiSASE, a solution incorporating Fortinet’s threat intelligence from FortiGuard Labs. FortiSASE uses Artificial Intelligence to analyze data and provide proactive security throughout its SASE solution. With over 30 global Points of Presence, Fortinet demonstrates its commitment to connectivity alongside security, even if it doesn’t have the largest backbone on this list.
FortiSASE offers cloud-based security and networking for remote users, with features like SWG, Universal ZTNA, CASB, FWaaS, and secure SD-WAN integration, all managed through one UI. FortiSASE allows enterprises to opt for security implementation either through a local FortiGate (the company’s firewall solution) or by connecting branch offices to FortiSASE for cloud-based security inspection via FortiGate Next Generation Firewall (NGFW) and Fortinet Secure SD-WAN.
Deploying FortiSASE may be more complex than other solutions, requiring configuration of segments, tunnels, and policies within the FortiSASE management console. FortiSASE integrates options favored by long-term customers, though it may lead to more complex and time-consuming deployments. Current customers will avoid many setup and training challenges that other organizations could face when introducing new systems. Organizations that already use Fortinet appliances and have experience with them will likely benefit the most from upgrading to FortiSASE and obtaining the greatest ROI.
While endpoint protection prevents breaches, FortiSASE’s Secure Socket Layer (SSL) inspection detects breaches in encrypted network traffic. Fortinet’s SSL inspection capabilities revealed and mitigated threats concealed within encrypted communications, without significantly degrading connection speeds. This is a familiar challenge with SSL inspection technologies, and its effectiveness was notable.
We highly recommend Fortinet FortiSASE for large enterprises prioritizing security or businesses with numerous branch offices requiring access to networked resources.
Fortinet FortiSASE: Fortinet Upgrade Option
- Agentless connections and an endpoint agent for Windows, macOS, Linux, iOS, and Android.
- AI-enhanced security analysis and response.
- FortiSASE includes Secure Edge options for local FortiGate traffic inspection or cloud-hosted FortiGate capabilities.
- Robust security and network features built on Fortinet’s firewall, gateway, ZTNA, CASB, and SD-WAN technology.
Pros
- Recognized as a SASE Challenger in Gartner’s 2024 Single Vendor SASE Magic Quadrant.
- Cloud-native architecture enables easy scaling and adaptation to business needs.
- FortiSASE cloud-hosted services are SOC 2 certified.
- Sandboxing available for investigating suspicious files.
- ASIC-designed SD-WAN hardware delivers higher throughput.
Cons
- High upfront costs, especially for organizations without existing Fortinet infrastructure.
- No private backbone for high-speed SD-WAN; customers rely on public backbone resources or third-party providers.
- Agentless connections do not support UDP, as the access proxy only accommodates HTTP, HTTPS, and other TCP traffic.
- Each locally installed appliance may require manual updates and patch management.
- More limited PoP coverage than competitors, with no access in South America or Africa.
- Advanced configuration options may introduce complexity, leading to potential security gaps or conflicts.
- As a cloud-based solution, FortiSASE may not be suitable for organizations with strict data residency requirements or cloud-related concerns.
Palo Alto Prisma: Multi-Tenant Option
Palo Alto Networks began as a network security vendor and fully incorporates the SASE model. The Prisma Access platform incorporates FWaaS, threat prevention, DNS security, and data loss prevention (DLP) capabilities to safeguard edge resources. It provides comprehensive features and options expected from an established network security provider.
Palo Alto Networks’ SASE solution combines CloudGenix SD-WAN, which the company acquired last year, with Palo Alto’s Prisma Access security service. CloudGenix is available as a physical appliance in different sizes for data centers and branch offices, featuring ML analytics and automation for enhanced performance and manageability. Prisma Access is a cloud-based SASE service that includes NGFW-as-a-service, SWG, CASB, DLP content filtering, ZTNA, SSL inspection, sandboxing of suspicious code, and DNS security (automatic blocklisting of suspicious domains). Palo Alto has streamlined CloudGenix and Prisma Access integration, enabling deployment and configuration in a single operation.
Palo Alto Networks offers extensive security services featuring cloud-based next-generation firewalls. These advanced threat protection technologies are designed to detect known threats and zero-day exploits in real time for all network applications. Additional security features include application-layer firewalls, traffic shaping, and VLAN management.
According to a recent survey, businesses across all industries spent an average of 7% of their IT budget on IoT projects in 2025, and they plan to increase this to 10% in the near future.
Keep in mind that the deployment process of Prisma Access involves configuring network segmentation, setting up IPsec tunnels, and routing both remote and mobile connections through cloud providers.
In contrast to other SASE vendors in this comparison, Prisma Access doesn’t provide its own private backbone. Consequently, Prisma relies on a public backbone of Points of Presence (PoPs) utilizing cloud services for connectivity. Being public may pose scalability limits and restrict regulatory compliance in certain sectors. Therefore, Prisma Access is recommended for large enterprises that require Industry 4.0 or IoT integrations.
Palo Alto Prisma Features
- Rigorous ZTNA 2.0 controls with continuous trust verification, security inspection, and data protection.
- Precise access control at the app and sub-app levels.
- Multi-tenant deployment option for service providers.
- ML-enhanced SWG improves static analysis, security, and user onboarding.
- SaaS security misconfiguration detection and drift prevention via Prisma SASE next-gen CASB.
- Agentless and agent-based (GlobalProtect app) remote user protection and security.
- Wide OS support: GlobalProtect agent supports Windows, macOS, iOS, Android, ChromeOS, and Linux.
Pros
- Recognized as a SASE Leader in Gartner’s 2024 Single Vendor SASE Magic Quadrant.
- Feature-rich with extensive licensing and technology add-on options.
- Well-established security brand with a strong track record of customer success.
- Granular control over devices, assets, users, and security settings.
- Automated IT operations through AIOps and Autonomous Digital Experience Management (ADEM) for predictive problem detection and faster issue resolution.
- A Forrester Consulting study found an average ROI of 107% over three years with Prisma SASE.
Cons
- Key SASE security controls, such as next-gen CASB or DLP, require add-ons.
- No private backbone for high-speed SD-WAN; customers rely on public backbone resources or third-party providers.
- Multiple licensing options can complicate decision-making.
- Limited non-English international documentation.
- Higher prices cited by customers.
- Some critics argue Palo Alto’s SASE is not a true cloud service, as it processes packets and security in separate appliances rather than a single, multi-tenant, cloud-native engine.
Zscaler: Strong ZTNA Option
Zscaler has over 150 global Points of Presence, which enable secure connectivity from various sites and locations. Zscaler SASE is recognized for its implementation of Zero Trust architecture. Additionally, Zscaler employs micro-segmentation to prevent unauthorized access between applications.
The deployment process of Zscaler involves several steps compared to other solutions on this list. To set up the SASE solution, you need to configure the private access (ZPA) and internet access (ZIA) policies, as well as the security services. These services include Zscaler’s full network security stack, SWG, CASB, DLP, and NGFW.
Zscaler offers sandboxing and browser isolation, similar to sandboxing, enabling malware to be investigated within an isolated segment. Browser isolation protects the end user’s web sessions by segmenting traffic from each webpage and application traffic. This helps to prevent session hijacking and other malicious exploits that risk web applications may attempt. Combining these features highlights Zscaler’s ability to protect users from breaches and their effects, reducing Zscaler’s vulnerabilities by reducing the attack plane.
Within the market, Zscaler has faced scalability and performance issues with its Zscaler Private Access (ZPA) feature. Users have reported latency problems impacting large-scale deployments. Therefore, we recommend Zscaler for large multinational enterprises that can handle these potential concerns.
Palo Alto Prisma Features
- Cloud-native architecture with 150+ global points of presence (PoPs).
- Integrated security features, including SWG, FWaaS, DLP, CASB, and Zero Trust Network Access (ZTNA).
- Supports full network virtualization or seamless integration for remote workers.
Pros
- As a cloud-native SaaS solution, Zscaler eliminates the need for physical hardware, enabling easy scaling for teams.
- Proxy architecture enables large-scale encrypted traffic inspection.
- Security and policy enforcement are brought closer to users, reducing unnecessary backhauling.
- One of the first and most established providers of ZTNA.
Cons
- As a cloud-native SaaS solution, Zscaler eliminates the need for physical hardware, enabling easy scaling for teams.
- Proxy architecture enables large-scale encrypted traffic inspection.
- Security and policy enforcement are brought closer to users, reducing unnecessary backhauling.
- One of the first and most established providers of ZTNA.
Aruba SASE: Bring Your Own (BYO) Option
With industry-leading SD-WAN and award-winning SSE, HPE Aruba Networking offers a comprehensive, unified approach to SASE. Aruba provides reliable, high-performance connectivity for distributed enterprise networks, which is ideal for larger enterprises that need optimized WAN, orchestration, and integration with top-tier security providers.
With HPE Aruba Networking EdgeConnect SD-WAN, IT teams can deliver WAN and cloud security controls directly to the application at the network edge—rather than routing data through the data center—while SSE ensures that Zero Trust security controls can be applied to all people and devices, no matter where they connect—on campus, in branch, at home, or on the road. AI-powered network and security insights can help you manage and protect at scale, freeing network and security teams to focus on creating business advantage.
The management interface is incredibly comprehensive, coupled with powerful features that support a use case for medium to large Enterprise network requirements. We recommend HPE Aruba as a vendor that suits the needs of larger organizations with requirements that lean toward the more complex side of WAN capability.
Aruba SASE Features
- Aruba SASE integrates SD-WAN with security functions like firewall, ZTNA, SWG, and CASB into a single solution, simplifying architecture and reducing security tool complexity.
- Combines SD-WAN with SSE for a cohesive solution.
- Utilizes a cloud-native management platform for centralized orchestration, streamlining deployment and ongoing management.
- Aggregates multiple WAN links into a single logical connection, enhancing performance and reliability.
Pros
- Aruba’s BIO technology prioritizes traffic based on application needs, ensuring critical applications receive optimal resources.
- Delivers zero trust and SASE frameworks through the Edge-to-Cloud Security service.
- Integrates well with cloud security vendors, simplifying the adoption of cloud-based security services.
- Extends identity-based access control across all network types, including wired, wireless, WAN, remote, campus, and branch networks.
- Eliminates blind spots by providing full visibility into network devices through ClearPass Device Insight.
- Enables centralized creation of role-based policies for monitoring and enforcing access across locations and connection methods.
Cons
- Limited functionality and resources allocated to remote users.
- Limited support in certain regions, such as Europe, Africa, and Asia, due to a lean market presence.
- As an emerging technology, some features, such as automated configurations and advanced troubleshooting tools, are less developed than those of competitors.
- Can complicate network configuration, particularly for businesses that have recently implemented SD-WAN or edge systems that are not Aruba-based.
Before making any final decisions, it’s essential to assess your specific needs, budget, and technical capabilities. The Comport team is here to help. Our experts will work closely with you to identify an SASE solution tailored to your business and technical requirements.
