Why focus on SD-WAN?
SASE joins networking and security. Most SSE vendors started on the security side, and the networking side is where offers differ most. For a buyer, how the SD-WAN is delivered decides whether a branch needs one configuration or two, and whether routing and security policy live in one place.
How does each vendor ship it?
Cato states it runs "SD-WAN as a cloud service, with sites and cloud resources managed from a single Cato" console, with traffic carried on its private backbone after it enters a PoP.
Source: Cato SD-WAN
Fortinet states Unified SASE "merges FortiSASE with Fortinet Secure SD-WAN to create a single, integrated platform" built on one operating system, policy engine and management plane.
Source: Fortinet Unified SASE
Palo Alto Networks lists Prisma SD-WAN as part of its Prisma SASE product family, alongside Prisma Access.
Source: Palo Alto Networks SASE
Netskope lists Secure SD-WAN, SASE Branch and Endpoint SD-WAN in its navigation for Netskope One.
Source: Netskope One
Zscaler positions Zero Trust Branch and Zero Trust SD-WAN and states that "Legacy SD-WAN architectures have too much implicit trust".
Source: Zscaler SASE
Cisco's SASE page pairs Secure Access with Cisco SD-WAN or Cisco Meraki SD-WAN, listed as separate products.
Source: Cisco SASE solution
What are the three patterns?
The first pattern is SD-WAN as part of one cloud service, where the branch device connects to the vendor's cloud and both routing and inspection happen there. The second is an SD-WAN product line joined to the security service through a shared operating system or management plane. The third rethinks the branch around zero trust, connecting users and devices to applications rather than joining sites into a network. Each can work; they differ in how many systems you run and how familiar the model is to your network team.
What should a network team check?
Ask how a new branch is brought online, and how many configuration steps sit in the networking product and how many in the security product. Ask how path selection works when a link degrades, and whether that decision is visible next to security events. Ask what happens at the branch if the connection to the cloud is lost. Ask how many hardware models you must stock.
What about existing SD-WAN investments?
If you deployed SD-WAN recently, you may not want to replace it. Most vendors let you add their security service to an existing SD-WAN, and some, like Cisco, offer two SD-WAN lines to choose from. Plan the end state: do you expect to converge to one vendor when the SD-WAN contract ends, or to keep two products? The answer changes how you should weight convergence.
How does this affect the ranking?
SD-WAN is one of the eight components in the SASE ring, and every vendor in our set lists it in some form. How it is delivered counts under converged architecture, which carries 20% of the total. On our weights, the three highest-ranked platforms are Cato Networks, Netskope and Fortinet.
What should you test?
Bring up a test branch on each shortlisted platform and time it. Fail one link and watch the failover in the console. Change one security rule and one routing rule, and count the screens you touch. Those numbers will tell you more about long-term effort than any diagram.
How does SD-WAN affect AI and security traffic?
Branch users now send a growing share of their traffic to SaaS and AI tools. If the SD-WAN breaks that traffic out locally to the internet, the security service must still see it. If it sends everything to the vendor's cloud first, the path to the nearest location matters more. Ask each vendor how branch traffic to AI tools is steered, inspected and logged, and whether that differs from remote users.
The short version
SD-WAN is on every list, but it ships three ways. Check how many systems a branch depends on, where policy lives, and what your network team will run day to day.