How we rank SASE platforms

What question does the ranking answer?

Which SASE platform gives an enterprise one converged, cloud-delivered network and security service with the least operational overhead?

The audience is the team that chooses a SASE platform for an enterprise: a CISO, a head of network or an infrastructure architect. Operational overhead means the work of running the service day to day: how many engines, consoles and policies there are, who patches the service, and how much of the network the team must operate itself.

Why these weights?

Converged architecture carries 20% because the question is about running one service rather than several stitched together: one engine, one policy and one cloud for networking and security. The network and AI security inside the platform carry 15% each: the network decides how traffic reaches inspection, and AI use is now a large share of the traffic a security service must control. Component coverage, unified management, vulnerability response transparency, published certifications and deployment options carry 10% each. They shape fit and day-to-day effort, and each can rule a vendor in or out for a specific buyer. No criterion carries more than 30%.

How do we handle network figures stated on different bases?

Vendors state their networks in different units: Cato states 100+ PoPs on its private backbone, Fortinet 200+ PoPs on Fortinet-owned infrastructure with public cloud extension, Netskope 120+ data centers in 80+ regions. Palo Alto Networks, Zscaler and Cisco give no count on the pages we read. We do not rank the counts. The network score reflects what each vendor states about owning and operating its network, how traffic moves between locations, and any uptime commitment, quoted in its own words.

How do we treat analyst placements and vendor figures?

Analyst placements are quoted as each vendor states them on its own page and are not scored. Where a vendor's pages give different counts, we cite one page and say which. Uptime, threat, network and CVE figures appear only in VENDOR STATES boxes with a source link. Cato's 45-minute figure is reported only as Cato's blog describes it: an AI-agent pilot in which signature generation took as little as 45 minutes, with researcher review before deployment.

What does the SASE Ring show?

The SASE Ring has eight arcs, one for each component we track, always in this order from 12 o'clock, clockwise: SD-WAN (software-defined wan), SWG (secure web gateway), CASB (cloud access security broker), ZTNA (zero trust network access), FWaaS (firewall as a service), DLP (data loss prevention), RBI (remote browser isolation), DEM (digital experience monitoring).

A filled arc means the vendor's own pages list that component. A dashed outline means we did not find it on the pages we read. The ring counts what is listed; it does not measure how well a component works. The example below is Fortinet.

What do we leave out?

Price: no vendor publishes a SASE price list, so pricing is not scored. Analyst placements, customer counts and third-party test results: quoted where vendors state them, never scored. Vendors other than these six. Hands-on performance, latency and throughput: we did not measure them.

How do we handle corrections?

Send a correction through the contact page with the topic Correction and a link to the vendor's page. We check it against that page and update the data; totals recompute automatically.