Community Safety within the SD-WAN Market

SD-WAN and the Safe Service Edge (SSE)

Safety has emerged as a particular use case for SD-WAN and a approach for suppliers to tell apart themselves in a crowded market. Many suppliers are working to extra seamlessly combine SD-WAN and safety providers right into a single product generally known as ‘Safe Entry Service Edge,’ SASE, or ‘Safety Service Edge’ SSE when not built-in with SD-WAN immediately. Enterprise curiosity in SASE providers is excessive, as we element within the determine beneath. In 2025, 53% of WMS respondents had already applied some SASE parts into their community. That’s up from 8% in 2019 (once we requested particularly about Zero Belief Safety). An additional 23% have been within the processing of adopting some parts of SASE whereas solely 7% had no plans to undertake the safety framework.

SD-WAN safety approaches

SD-WAN distributors and MSPs have taken just a few approaches to integrating these safety features into their service portfolios. A majority have adopted a ‘better of breed’ method, working with quite a few safety suppliers primarily based on their background and strengths. Interoperability generally is a concern right here although. Others have opted for a single vendor SASE method, selecting to focus extra on seamless integration moderately than maybe the strongest provider of every service.

In 2025, for SD-WAN distributors, Zscaler, Palo Alto Networks, Verify Level, Netskope, and Microsoft have been the highest 5 cited safety service companions. It’s value noting that a number of the most acquainted names within the safety house, similar to Cisco and Fortinet, don’t fall on this checklist. These firms have leveraged their in-house safety experience and built-in it into their very own SD-WAN service. They’ve tended to companion with carriers and managed SD-WAN service suppliers, moderately than different SD-WAN distributors, to assist them with their safety portfolios. You possibly can see this within the high safety companions cited by MSPs – Fortinet, Palo Alto Networks, Zscaler, and Cisco.

There was an extended tail of safety distributors cited as a companion by only one SD-WAN vendor or MSP. We now have included them within the ‘different’ column.

SD-WAN safety characteristic availability

Fundamental safety features can be found from nearly all SD-WAN distributors and MSPs. Actually, all of our profiled SD-WAN distributors and MSPs supplied superior community monitoring. Equally, 21 of twenty-two distributors and 66 of 82 MSPs included safe entry options for distant staff. The main focus for SD-WAN suppliers although, is in incorporating safety features related to SASE or SSE. Wanting on the determine beneath, you may see that providers included within the SASE structure have significantly elevated in availability, however are nonetheless not supplied by each SD-WAN supplier.

• Subsequent-generation Firewall-as-a-Service (NGFWaaS) NGFWaaS is the SASE or SSE service {that a} majority of enterprise WAN managers (82%) we surveyed indicated they’d already adopted. In 2025, this widespread service was broadly out there with 15 SD-WAN distributors and all of our profiled MSPs indicating they supplied the service.
• Safe internet gateway (SWG). SWG is positioned between enterprise customers and the net to implement firm safety and blocking insurance policies and guarantee protected internet shopping. For distributors this was essentially the most broadly out there SASE characteristic (16 suppliers). In 2025, 58 MSPs additionally supplied this service.
• Cloud entry safety dealer (CASB). CASB is positioned between enterprise cloud customers and the cloud suppliers and permits organizations to implement inner safety insurance policies and compliance laws. In 2025, 16 distributors and 77 MSPs indicated they might present the service.
• Zero belief community entry (ZTNA). “Zero Belief” safety focuses on verifying customers, validating units, limiting entry and privileges, and utilizing analytics to adapt insurance policies. ZTNA successfully replaces legacy IPsec VPN applied sciences to permit safe tunneling over public infrastructure. This was the second most generally adopted SASE service by our WMS respondents, and in 2025 15 distributors and 66 MSPs included this coverage into their service.

SD-WAN safety service pricing

Whereas a few of these widespread safety providers are included in the price of an SD-WAN overlay (suppose conventional and next-generation firewalls, community monitoring, and deep packet inspection), others will not be. Overwhelmingly, SD-WAN suppliers indicated that a number of core options of a SASE stack fell outdoors of those present safety packages and would incur additional prices for patrons. Zero belief community entry (ZTNA), cloud entry safety dealer (CASB), and safe internet gateways (SWG) have been essentially the most generally talked about providers on this class. Most SD-WAN suppliers and MSPs cost for these providers on a per person foundation and a number of other have created ‘SASE or SSE bundles’ that embody all three. For choose distributors coming from a background in safety, these options have been already baked into their NRC prices and didn’t characterize a further value to the client.

So how a lot do these further safety providers value on high of the price of an SD-WAN overlay?

Within the following evaluation we assume {that a} SSE bundle contains ZTNA, CASB, SWG, DLP, and MFA. NGFWaaS prices have been included for these suppliers who indicated it was not baked into their primary SD-WAN overlay value. In 2025, the median value per person for a SSE bundle throughout distributors for a small to medium sized enterprise (at midnight blue columns within the determine beneath) was $7.21 per 30 days, or $87 per yr. Particular person vendor bundle costs ranged from $4 to $14 per person, per 30 days. Sourcing a SSE bundle from a managed service supplier or provider was dearer, with a median per person value of $18.13 per 30 days or $218 per yr. Particular person MSP costs ranged from $5 to $60 per person per 30 days.

Wanting on the determine beneath, you may see that some SD-WAN distributors and MSPs supply quantity reductions, discounting safety bundle costs for big enterprise clients. In 2025, the median SSE bundle value for a big enterprise from MSPs was $15.57 per person per 30 days. That’s 14% lower than the median value for a small to medium enterprise. And whereas the median SSE value ($7.21) is similar for SD-WAN distributors no matter firm measurement, a a lot bigger variety of SD-WAN distributors reported quantity reductions for safety providers than MSPs. For distributors, reductions for bigger clients ranged from 17% to 40%.

• In 2025, the median variety of workers throughout our WAN Supervisor Survey respondents’ firms was 46,891. For this many customers (depicted within the column on the left) the median annual value for a SSE bundle can be $4,057,009 from an SD-WAN vendor and $10,201,606 from an MSP. Not an insignificant value when you add all of it up.
• However not each firm must safe units for each worker. In an business similar to Auto & Vehicles, the place various workers may go in factories or in dealerships and never want safe units, maybe solely 20% of customers should be secured. The second column in our determine makes this assumption and takes 20% of our median WAN Supervisor Survey worker rely (so 9,379 workers). On this situation, safety prices are a lot decrease, a median value of $811,471 per yr. That’s 80% lower than our baseline worker rely. The median annual value from an MSP was $2,040,495, roughly 2.5 instances dearer than sourcing from an SD-WAN vendor.
• On the opposite finish of the spectrum, an business similar to Enterprise Companies might have to safe a bigger portion of its workforce, say 80%. That is the situation we’ve modeled within the final column. Right here the annual value of the SASE bundle can be $3,245,607 from an SD-WAN vendor and $8,161,285 from a MSP.

SD-WAN  market outlook

SD-WAN is a vital part of the fashionable hybrid WAN. However with a shift in buyer focus from site-to-site connectivity to cloud and information heart interconnects, questions have arisen about whether or not the service is as related because it as soon as was. Significantly as these providers usually include inbuilt safety over dependable web connections.

Consequently, SD-WAN suppliers look to tell apart themselves with distinctive service options. Integrating safety providers (notably these included within the SASE stack) into their platforms and forming partnerships with CSPs to offer seamless and safe entry to enterprise functions have been two areas of focus. Managed service suppliers present choices for patrons trying to reap the benefits of the advantages of SD-WAN, however outsource the administration of each the overlay and underlay. These suppliers supply quite a lot of service tiers to accommodate clients preferences and community necessities.

SD-WAN vendor pricing has clearly change into extra aggressive because the service matures and pricing schemes evolve. Whereas there may be nonetheless a wide variety of costs reported available in the market, median value factors proceed to say no because the market consolidates round a small group of established distributors and suppliers refine their pricing fashions to reposition themselves in a aggressive market. General, the price of an SD-WAN overlay contains a small portion of the whole value of the WAN, making it a worthwhile funding for patrons in areas the place web entry is much less dependable, with on premise information facilities, or these nonetheless trying to modernize their WAN. Consequently, SD-WAN revenues proceed to develop, notably as DIA utilization surges and enterprise port pace necessities proceed to extend.