Community Safety within the SD-WAN Market

SD-WAN and the Safe Service Edge (SSE)

Safety has emerged as a selected use case for SD-WAN and a approach for suppliers to differentiate themselves in a crowded market. Many suppliers are working to extra seamlessly combine SD-WAN and safety providers right into a single product referred to as ‘Safe Entry Service Edge,’ SASE, or ‘Safety Service Edge’ SSE when not built-in with SD-WAN instantly. Enterprise curiosity in SASE providers is excessive, as we element within the determine beneath. In 2025, 53% of WMS respondents had already applied some SASE parts into their community. That’s up from 8% in 2019 (after we requested particularly about Zero Belief Safety). An additional 23% have been within the processing of adopting some parts of SASE whereas solely 7% had no plans to undertake the safety framework.

SD-WAN safety approaches

SD-WAN distributors and MSPs have taken just a few approaches to integrating these safety features into their service portfolios. A majority have adopted a ‘better of breed’ strategy, working with quite a few safety suppliers primarily based on their background and strengths. Interoperability generally is a concern right here although. Others have opted for a single vendor SASE strategy, selecting to focus extra on seamless integration reasonably than maybe the strongest provider of every service.

In 2025, for SD-WAN distributors, Zscaler, Palo Alto Networks, Test Level, Netskope, and Microsoft have been the highest 5 cited safety service companions. It’s value noting that among the most acquainted names within the safety house, corresponding to Cisco and Fortinet, don’t fall on this listing. These firms have leveraged their in-house safety experience and built-in it into their very own SD-WAN service. They’ve tended to companion with carriers and managed SD-WAN service suppliers, reasonably than different SD-WAN distributors, to assist them with their safety portfolios. You’ll be able to see this within the high safety companions cited by MSPs – Fortinet, Palo Alto Networks, Zscaler, and Cisco.

There was a protracted tail of safety distributors cited as a companion by only one SD-WAN vendor or MSP. Now we have included them within the ‘different’ column.

SD-WAN safety characteristic availability

Fundamental safety features can be found from virtually all SD-WAN distributors and MSPs. The truth is, all of our profiled SD-WAN distributors and MSPs provided superior community monitoring. Equally, 21 of twenty-two distributors and 66 of 82 MSPs integrated safe entry options for distant staff. The main focus for SD-WAN suppliers although, is in incorporating safety features related to SASE or SSE. Wanting on the determine beneath, you possibly can see that providers included within the SASE structure have enormously elevated in availability, however are nonetheless not provided by each SD-WAN supplier.

• Subsequent-generation Firewall-as-a-Service (NGFWaaS) NGFWaaS is the SASE or SSE service {that a} majority of enterprise WAN managers (82%) we surveyed indicated they’d already adopted. In 2025, this fashionable service was broadly out there with 15 SD-WAN distributors and all of our profiled MSPs indicating they provided the service.
• Safe net gateway (SWG). SWG is positioned between enterprise customers and the online to implement firm safety and blocking insurance policies and guarantee secure net shopping. For distributors this was probably the most broadly out there SASE characteristic (16 suppliers). In 2025, 58 MSPs additionally provided this service.
• Cloud entry safety dealer (CASB). CASB is positioned between enterprise cloud customers and the cloud suppliers and permits organizations to implement inner safety insurance policies and compliance laws. In 2025, 16 distributors and 77 MSPs indicated they may present the service.
• Zero belief community entry (ZTNA). “Zero Belief” safety focuses on verifying customers, validating units, limiting entry and privileges, and utilizing analytics to adapt insurance policies. ZTNA successfully replaces legacy IPsec VPN applied sciences to permit safe tunneling over public infrastructure. This was the second most generally adopted SASE service by our WMS respondents, and in 2025 15 distributors and 66 MSPs integrated this coverage into their service.

SD-WAN safety service pricing

Whereas a few of these fashionable safety providers are included in the price of an SD-WAN overlay (suppose conventional and next-generation firewalls, community monitoring, and deep packet inspection), others will not be. Overwhelmingly, SD-WAN suppliers indicated that a number of core options of a SASE stack fell outdoors of those present safety packages and would incur additional prices for purchasers. Zero belief community entry (ZTNA), cloud entry safety dealer (CASB), and safe net gateways (SWG) have been probably the most generally talked about providers on this class. Most SD-WAN suppliers and MSPs cost for these providers on a per consumer foundation and a number of other have created ‘SASE or SSE bundles’ that embrace all three. For choose distributors coming from a background in safety, these options have been already baked into their NRC prices and didn’t characterize an extra price to the shopper.

So how a lot do these further safety providers price on high of the price of an SD-WAN overlay?

Within the following evaluation we assume {that a} SSE bundle contains ZTNA, CASB, SWG, DLP, and MFA. NGFWaaS prices have been included for these suppliers who indicated it was not baked into their fundamental SD-WAN overlay worth. In 2025, the median worth per consumer for a SSE bundle throughout distributors for a small to medium sized enterprise (at the hours of darkness blue columns within the determine beneath) was $7.21 monthly, or $87 per yr. Particular person vendor bundle costs ranged from $4 to $14 per consumer, monthly. Sourcing a SSE bundle from a managed service supplier or provider was costlier, with a median per consumer worth of $18.13 monthly or $218 per yr. Particular person MSP costs ranged from $5 to $60 per consumer monthly.

Wanting on the determine beneath, you possibly can see that some SD-WAN distributors and MSPs provide quantity reductions, discounting safety bundle costs for giant enterprise clients. In 2025, the median SSE bundle worth for a big enterprise from MSPs was $15.57 per consumer monthly. That’s 14% lower than the median worth for a small to medium enterprise. And whereas the median SSE worth ($7.21) is identical for SD-WAN distributors no matter firm dimension, a a lot bigger variety of SD-WAN distributors reported quantity reductions for safety providers than MSPs. For distributors, reductions for bigger clients ranged from 17% to 40%.

• In 2025, the median variety of workers throughout our WAN Supervisor Survey respondents’ firms was 46,891. For this many customers (depicted within the column on the left) the median annual worth for a SSE bundle can be $4,057,009 from an SD-WAN vendor and $10,201,606 from an MSP. Not an insignificant price when you add all of it up.
• However not each firm must safe units for each worker. In an business corresponding to Auto & Vans, the place numerous workers may go in factories or in dealerships and never want safe units, maybe solely 20% of customers have to be secured. The second column in our determine makes this assumption and takes 20% of our median WAN Supervisor Survey worker rely (so 9,379 workers). On this situation, safety prices are a lot decrease, a median worth of $811,471 per yr. That’s 80% lower than our baseline worker rely. The median annual worth from an MSP was $2,040,495, roughly 2.5 occasions costlier than sourcing from an SD-WAN vendor.
• On the opposite finish of the spectrum, an business corresponding to Enterprise Companies could must safe a bigger portion of its workforce, say 80%. That is the situation we’ve modeled within the final column. Right here the annual price of the SASE bundle can be $3,245,607 from an SD-WAN vendor and $8,161,285 from a MSP.

SD-WAN  market outlook

SD-WAN is a essential element of the fashionable hybrid WAN. However with a shift in buyer focus from site-to-site connectivity to cloud and information middle interconnects, questions have arisen about whether or not the service is as related because it as soon as was. Significantly as these providers usually include in-built safety over dependable web connections.

In consequence, SD-WAN suppliers look to differentiate themselves with distinctive service options. Integrating safety providers (significantly these included within the SASE stack) into their platforms and forming partnerships with CSPs to supply seamless and safe entry to enterprise purposes have been two areas of focus. Managed service suppliers present choices for purchasers seeking to benefit from the advantages of SD-WAN, however outsource the administration of each the overlay and underlay. These suppliers provide a wide range of service tiers to accommodate clients preferences and community necessities.

SD-WAN vendor pricing has clearly turn into extra aggressive because the service matures and pricing schemes evolve. Whereas there may be nonetheless a wide range of costs reported available in the market, median worth factors proceed to say no because the market consolidates round a small group of established distributors and suppliers refine their pricing fashions to reposition themselves in a aggressive market. Total, the price of an SD-WAN overlay contains a small portion of the entire price of the WAN, making it a worthwhile funding for purchasers in areas the place web entry is much less dependable, with on premise information facilities, or these nonetheless seeking to modernize their WAN. In consequence, SD-WAN revenues proceed to develop, significantly as DIA utilization surges and enterprise port pace necessities proceed to extend.