Community Safety within the SD-WAN Market

SD-WAN and the Safe Service Edge (SSE)

Safety has emerged as a selected use case for SD-WAN and a manner for suppliers to tell apart themselves in a crowded market. Many suppliers are working to extra seamlessly combine SD-WAN and safety providers right into a single product often known as ‘Safe Entry Service Edge,’ SASE, or ‘Safety Service Edge’ SSE when not built-in with SD-WAN immediately. Enterprise curiosity in SASE providers is excessive, as we element within the determine beneath. In 2025, 53% of WMS respondents had already carried out some SASE parts into their community. That’s up from 8% in 2019 (once we requested particularly about Zero Belief Safety). An additional 23% have been within the processing of adopting some parts of SASE whereas solely 7% had no plans to undertake the safety framework.

SD-WAN safety approaches

SD-WAN distributors and MSPs have taken just a few approaches to integrating these safety features into their service portfolios. A majority have adopted a ‘better of breed’ strategy, working with quite a few safety suppliers primarily based on their background and strengths. Interoperability generally is a concern right here although. Others have opted for a single vendor SASE strategy, selecting to focus extra on seamless integration reasonably than maybe the strongest provider of every service.

In 2025, for SD-WAN distributors, Zscaler, Palo Alto Networks, Examine Level, Netskope, and Microsoft have been the highest 5 cited safety service companions. It’s value noting that a number of the most acquainted names within the safety area, resembling Cisco and Fortinet, don’t fall on this record. These corporations have leveraged their in-house safety experience and built-in it into their very own SD-WAN service. They’ve tended to associate with carriers and managed SD-WAN service suppliers, reasonably than different SD-WAN distributors, to assist them with their safety portfolios. You may see this within the prime safety companions cited by MSPs – Fortinet, Palo Alto Networks, Zscaler, and Cisco.

There was an extended tail of safety distributors cited as a associate by only one SD-WAN vendor or MSP. We have now included them within the ‘different’ column.

SD-WAN safety characteristic availability

Primary safety features can be found from virtually all SD-WAN distributors and MSPs. In actual fact, all of our profiled SD-WAN distributors and MSPs supplied superior community monitoring. Equally, 21 of twenty-two distributors and 66 of 82 MSPs integrated safe entry options for distant employees. The most important focus for SD-WAN suppliers although, is in incorporating safety features related to SASE or SSE. Trying on the determine beneath, you possibly can see that providers included within the SASE structure have vastly elevated in availability, however are nonetheless not supplied by each SD-WAN supplier.

• Subsequent-generation Firewall-as-a-Service (NGFWaaS) NGFWaaS is the SASE or SSE service {that a} majority of enterprise WAN managers (82%) we surveyed indicated that they had already adopted. In 2025, this common service was broadly out there with 15 SD-WAN distributors and all of our profiled MSPs indicating they supplied the service.
• Safe internet gateway (SWG). SWG is positioned between enterprise customers and the online to implement firm safety and blocking insurance policies and guarantee protected internet searching. For distributors this was probably the most broadly out there SASE characteristic (16 suppliers). In 2025, 58 MSPs additionally supplied this service.
• Cloud entry safety dealer (CASB). CASB is positioned between enterprise cloud customers and the cloud suppliers and permits organizations to implement inner safety insurance policies and compliance rules. In 2025, 16 distributors and 77 MSPs indicated they may present the service.
• Zero belief community entry (ZTNA). “Zero Belief” safety focuses on verifying customers, validating gadgets, limiting entry and privileges, and utilizing analytics to adapt insurance policies. ZTNA successfully replaces legacy IPsec VPN applied sciences to permit safe tunneling over public infrastructure. This was the second most generally adopted SASE service by our WMS respondents, and in 2025 15 distributors and 66 MSPs integrated this coverage into their service.

SD-WAN safety service pricing

Whereas a few of these common safety providers are included in the price of an SD-WAN overlay (suppose conventional and next-generation firewalls, community monitoring, and deep packet inspection), others are usually not. Overwhelmingly, SD-WAN suppliers indicated that a number of core options of a SASE stack fell outdoors of those present safety packages and would incur additional fees for purchasers. Zero belief community entry (ZTNA), cloud entry safety dealer (CASB), and safe internet gateways (SWG) have been probably the most generally talked about providers on this class. Most SD-WAN suppliers and MSPs cost for these providers on a per person foundation and several other have created ‘SASE or SSE bundles’ that embrace all three. For choose distributors coming from a background in safety, these options have been already baked into their NRC fees and didn’t symbolize a further value to the client.

So how a lot do these further safety providers value on prime of the price of an SD-WAN overlay?

Within the following evaluation we assume {that a} SSE bundle consists of ZTNA, CASB, SWG, DLP, and MFA. NGFWaaS fees have been included for these suppliers who indicated it was not baked into their fundamental SD-WAN overlay worth. In 2025, the median worth per person for a SSE bundle throughout distributors for a small to medium sized enterprise (at midnight blue columns within the determine beneath) was $7.21 monthly, or $87 per yr. Particular person vendor bundle costs ranged from $4 to $14 per person, monthly. Sourcing a SSE bundle from a managed service supplier or service was dearer, with a median per person worth of $18.13 monthly or $218 per yr. Particular person MSP costs ranged from $5 to $60 per person monthly.

Trying on the determine beneath, you possibly can see that some SD-WAN distributors and MSPs supply quantity reductions, discounting safety bundle costs for big enterprise clients. In 2025, the median SSE bundle worth for a big enterprise from MSPs was $15.57 per person monthly. That’s 14% lower than the median worth for a small to medium enterprise. And whereas the median SSE worth ($7.21) is similar for SD-WAN distributors no matter firm measurement, a a lot bigger variety of SD-WAN distributors reported quantity reductions for safety providers than MSPs. For distributors, reductions for bigger clients ranged from 17% to 40%.

• In 2025, the median variety of staff throughout our WAN Supervisor Survey respondents’ corporations was 46,891. For this many customers (depicted within the column on the left) the median annual worth for a SSE bundle could be $4,057,009 from an SD-WAN vendor and $10,201,606 from an MSP. Not an insignificant value when you add all of it up.
• However not each firm must safe gadgets for each worker. In an business resembling Auto & Vans, the place quite a lot of staff may go in factories or in dealerships and never want safe gadgets, maybe solely 20% of customers must be secured. The second column in our determine makes this assumption and takes 20% of our median WAN Supervisor Survey worker depend (so 9,379 staff). On this situation, safety prices are a lot decrease, a median worth of $811,471 per yr. That’s 80% lower than our baseline worker depend. The median annual worth from an MSP was $2,040,495, roughly 2.5 occasions dearer than sourcing from an SD-WAN vendor.
• On the opposite finish of the spectrum, an business resembling Enterprise Providers could must safe a bigger portion of its workforce, say 80%. That is the situation we’ve modeled within the final column. Right here the annual value of the SASE bundle could be $3,245,607 from an SD-WAN vendor and $8,161,285 from a MSP.

SD-WAN  market outlook

SD-WAN is a vital element of the trendy hybrid WAN. However with a shift in buyer focus from site-to-site connectivity to cloud and knowledge middle interconnects, questions have arisen about whether or not the service is as related because it as soon as was. Significantly as these providers typically include in-built safety over dependable web connections.

Consequently, SD-WAN suppliers look to tell apart themselves with distinctive service options. Integrating safety providers (significantly these included within the SASE stack) into their platforms and forming partnerships with CSPs to offer seamless and safe entry to enterprise purposes have been two areas of focus. Managed service suppliers present choices for purchasers trying to benefit from the advantages of SD-WAN, however outsource the administration of each the overlay and underlay. These suppliers supply quite a lot of service tiers to accommodate clients preferences and community necessities.

SD-WAN vendor pricing has clearly develop into extra aggressive because the service matures and pricing schemes evolve. Whereas there’s nonetheless a wide variety of costs reported out there, median worth factors proceed to say no because the market consolidates round a small group of established distributors and suppliers refine their pricing fashions to reposition themselves in a aggressive market. General, the price of an SD-WAN overlay includes a small portion of the whole value of the WAN, making it a worthwhile funding for purchasers in areas the place web entry is much less dependable, with on premise knowledge facilities, or these nonetheless trying to modernize their WAN. Consequently, SD-WAN revenues proceed to develop, significantly as DIA utilization surges and enterprise port pace necessities proceed to extend.