Palo Alto Tops Preference but Trails Zscaler on SASE Spending

ETR Observatory for Secure Access Service Edge (SASE) Security 

This is a summary of the full report. ETR clients receive the complete findings; use the form at the bottom to request access to the complete findings.

Key Takeaways

• Zscaler leads the 2026 SASE Observatory study with both the highest Net Score (61%) and Net Usage (62%), and ties for third with 58% of users expecting to remain on the platform for at least three years; the vendor also ranks second in most-innovative mindshare (20%), trailing only Palo Alto Networks.
• Palo Alto Networks leads by a comfortable margin on rebuild-from-scratch preference (25%, up from 18% in 2025), more narrowly beats Zscaler in most innovative votes (22%, up from 15%), and received the field's highest three year usage expectation (70%, followed by Akamai at 62%).
• Top feature priorities among the 317 respondents for a SASE tool are led by Comprehensive Security (44%), Zero Trust Network Access (40%), and Performance and Scalability (28%); Cost Efficiency ranks last (9%).
• Symantec and Aruba Networks post the sharpest Net Score improvements, gaining 21 ppts and 19 ppts y/y respectively, with Aruba moving from Pursuing to Advancing, while Netskope downshifted from the Leading to the Advancing group on the back of a lower Presence in the survey, despite a still-solid 53% Net Score.
• Cato Networks, which posted the highest Net Score of any vendor in ETR's 2025 SASE Observatory, saw a sharp decline in citations in this iteration, falling below the threshold for Scope inclusion, alongside three newly surveyed vendors (Lookout, VeloCloud, Versa Networks) also short of the bar in their first appearance.

Executive Summary

The 2026 ETR Observatory for Secure Access Service Edge (SASE) surveyed 317 IT decision makers in July 2026 on spending intentions and product perceptions across the SASE security market. The respondent base skews upmarket, with 60% of respondents from Large organizations, and includes 53 Fortune 500 and 85 Global 2000 members. North America represents 68% of respondents, filled out by EMEA at 22%, APAC at 9%, and Latin America at 2%. Top industries represented include Services/Consulting (24%), IT/TelCo (18%), and Financials/Insurance (16%). The study covers 12 vendors meeting the N≥15 citation threshold for analysis and narrative discussion; four additional vendors (Cato Networks, Lookout, VeloCloud (Arista Networks), and Versa Networks) were polled in the underlying study.

Zscaler holds the highest Net Score (61%) and Net Usage (62%) in the 2026 study, anchoring the Leading vector alongside Palo Alto Networks, Cloudflare, and Fortinet. Palo Alto Networks posts the sharpest gains in strategic mindshare, leading the field on rebuild-from-scratch preference (25%, up from 18% in 2025) and most innovative selection (22%, up from 15%). Symantec (Broadcom) and Aruba Networks (HPE) show the largest year-over-year Net Score improvement among continuing vendors, with Aruba moving into the Advancing vector, while Netskope and Cloudflare each post double-digit Net Usage declines despite retaining solid Net Scores. Of note, Cato Networks, which posted the highest Net Score of any vendor in the ETR SASE Observatory for SASE, fell below the citation threshold for scope inclusion, representing a sharp decline in Presence for an up-and-coming name in this area of cybersecurity, in our view.

Introduction

Distributed enterprises continue to use digital transformation as a vehicle for structural changes to IT architecture. Secure Access Service Edge (SASE) combines Software-Defined Wide Area Networking (SD-WAN) with Secure Service Edge (SSE) capabilities, including Secure Web Gateway (SWG), Firewall-as-a-Service (FWaaS), Zero-Trust Network Access (ZTNA), and Cloud Access Security Broker (CASB), into a single, cloud-delivered framework that unifies networking and security under a Zero Trust model. As workloads continue to migrate into SaaS and IaaS environments, the demand for integrated networking and security continues to accelerate, and the vendor ecosystem has moved quickly to consolidate point solutions into broader platforms.

This report covers 12 vendors meeting the N≥15 inclusion threshold: Akamai, Aruba Networks (HPE), Barracuda Networks, Check Point Software, Cisco, Cloudflare, Forcepoint, Fortinet, Netskope, Palo Alto Networks, Symantec (Broadcom), and Zscaler. Four additional vendors are included in the underlying study but do not meet the threshold for chart inclusion or vendor-level discussion this cycle: Cato Networks, Lookout, VeloCloud (Arista Networks), and Versa Networks, with the latter three vendors joining the SASE study for the first time.

The Observatory Report

The ETR Observatory is a structured survey research program designed to track vendor-level momentum and product perception across key enterprise technology markets. Unlike the ETR Technology Spending Intentions Survey (TSIS), which measures macro-level spending intentions across thousands of respondents, the Observatory focuses on a defined subsector and solicits product-specific responses from practitioners who actively use or evaluate the tools in scope. Momentum is a composite of two primary signals. Net Score reflects estimated spending intent, calculated as the sum of respondents who are Adopting plus those planning to Increase spend, minus those planning to Decrease spend or Replace the product. Net Usage measures the direction of actual usage change over the prior 12 months, calculated as the share reporting increased usage minus those reporting decreased usage.

Conclusion – SASE Consolidation Continues, but Rankings Remain Fluid 

The 2026 SASE Observatory reflects a market still consolidating around a smaller set of platform vendors, even as the specific ranking of those vendors continues to shift survey-to-survey. Leading vendors anchor the field from different angles, with Zscaler on Net Score and Net Usage, Palo Alto Networks on strategic mindshare, Cloudflare on stickiness, and Fortinet rounding out the group with more moderate but still solid readings. Aruba Networks (HPE) and Netskope demonstrate idiosyncratic movements and that spending intentions in this subfield can diverge sharply across the field of vendors. At the low end of the study, Symantec (Broadcom) continues to hold the field's worst Net Score despite some y/y improvement, while Check Point Software's decline moves it into the Pursuing vector. Four additional vendors, including Cato Networks, fell short of this cycle's citation threshold, with the updated positioning reflective of the highly dynamic nature of cybersecurity responding to an ever-growing threat landscape.

About ETR

ETR, A Futurum company, is an enterprise technology market research firm that delivers actionable, transparent, and unbiased insights to institutional investors and a trusted community of technology leaders, empowering them to make smarter, faster decisions. ETR’s proprietary approach is grounded in their vision to reinvent technology market research so that business leaders can strategically position their organizations to outperform the competition. In fact, no other firm harnesses the same scale and makeup of their vetted community to quickly deliver the unbiased data and analysis that financial organizations need to achieve better outcomes.

We use our two quarterly surveys (Technology Spending Intentions Survey and the Macro Views Survey) to collect data and insights directly from the ETR Community. Use this data and insights to navigate the complex enterprise technology landscape and our proprietary visualizations and models to mine insights and unearth predictors of enterprise technology performance.

Beyond our core surveys, we also offer custom market research surveys. These can be commissioned with a targeted group and are guided by our expert content team to determine the best audience, topics, and questions. Additionally, the target group cannot only be based on their organization size, sector, and title, but also on our proprietary research around a firm’s spending intentions and technology stack.

Methodology
If you’re interested in the process behind the data, you’ll find it in the methodology section on our website.