Why do the words matter?
SASE combines wide-area networking (SD-WAN) and security services (the SSE stack: SWG, CASB, ZTNA, FWaaS, DLP and more) in a cloud service. Every vendor in our set describes its offer as unified or converged in some way. The words alone do not tell you how many products you will run.
What does converged mean in practice?
A converged service has one software stack for networking and security, one policy model and one console. A site connects once, and both routing and inspection happen in the same cloud. Changes to a rule apply to every user and site without a second system to update.
What does integrated usually mean?
Integrated usually means two or more products that share some management or data. The SD-WAN may come from one product line and the security service from another, connected through APIs or a shared portal. This can work well, especially for teams that already run one of the products, but there are more components to upgrade and more places where settings can differ.
How do the six vendors describe themselves?
Cato states one cloud with a single-pass engine, one data lake and one policy. Fortinet states that Unified SASE "merges FortiSASE with Fortinet Secure SD-WAN to create a single, integrated platform" on one operating system. Netskope describes one engine, one client, one console and one network. Zscaler states that it "converges networking and security into a unified, cloud native platform". Palo Alto Networks lists a product family that includes Prisma Access, Prisma SD-WAN and Prisma Browser. Cisco's SASE page pairs Secure Access with Cisco SD-WAN or Cisco Meraki SD-WAN, listed as separate products.
Source: Cato Networks homepage
Source: Fortinet Unified SASE
Source: Netskope One
Source: Zscaler SASE
Source: Palo Alto Networks SASE
Source: Cisco SASE solution
Which questions separate the two?
Ask how many products appear on the order form. Ask whether SD-WAN and security policies live in one rule base. Ask whether one upgrade cycle covers both. Ask whether a new site needs one configuration or two. The answers tell you more than the brochure word.
How does this site score it?
Our converged architecture criterion carries 20% of the total. It rewards one engine, one policy and one cloud for networking and security, as each vendor states it. On our weights the three highest-ranked platforms are Cato Networks, Netskope and Fortinet.
What if you already own an SD-WAN?
Many teams do. In that case the practical choice is between adding a security service that works with the SD-WAN you have, and replacing both with one converged service over time. The first is faster to start; the second removes a product at the end. Write down which you are doing, because it changes how you should weight convergence in the weighting lab. A team that plans to keep its SD-WAN for years may give convergence less weight than our default.