Senior IT and security executives on ETR's Observatory for SASE Feedback Panel described a market where platform breadth, last-mile performance, and proof through pilots anchor customer decisions, and where leaving an incumbent carries steep costs.
With a new Observatory for SASE report releasing soon, we are revisiting the conversation with senior IT and security executives that sets the baseline for the fresh data. Their message: SASE has moved on. Global points of presence are now table stakes. What separates winners from the rest is a harder set of questions: Can one platform replace a dozen tools? Does performance hold up in a pilot, not a pitch deck? And once a vendor is embedded, what would it take to leave?
The panel builds on the 2025 ETR Observatory for SASE study, which surveyed 321 technology leaders with direct utilization and evaluation knowledge of the tools they rated.
Consolidation vs. Best-of-Breed: Enterprises are split between consolidating onto single vendors like Palo Alto Networks for cost and simplicity and running multi-vendor architectures that balance flexibility with legacy technology.
Market Leadership: Palo Alto Networks anchors the conversation on the strength of its integrated ecosystem and acquisition-driven breadth, while Zscaler stands out as a credible, streamlined challenger.
Beyond PoP Counts: Points of presence are now baseline. Differentiation rests on interconnectivity with last-mile providers and architectural efficiency.
Measurable ROI: Buyers demand real-world pilots proving user experience, latency, and operational scalability gains, not vendor marketing claims.
Panelists remain divided between two philosophies. Some have consolidated onto a single vendor, most often Palo Alto Networks. One IT leader chose Prisma Access "largely because it's a deep, integrated ecosystem that we have here in the organization." Another put the economics plainly: "The more things you put into the enterprise agreement, you bring down the per unit cost of the overall agreement."
Others defend a multi-vendor, best-of-breed approach as the pragmatic reality of complex environments and acquisition histories, choosing vendors layer by layer depending on where each "is delivering in a specific space." At one such company, Palo Alto, Zscaler, Cloudflare, and Cato Networks coexist to serve departmental needs.
Even the multi-vendor camp is feeling consolidation pressure. One firm's internal cybersecurity framework ballooned from roughly 300 requirements to almost 400 in 18 months, prompting its security leader to ask: "Can we solve it with maybe a dozen vendors, rather than 25 vendors? Is there basically some appliance decommissioning that can happen?"
Panelists credit Palo Alto Networks' position to breadth, integration, and an aggressive acquisition strategy, including CloudGenix for SD-WAN, QRadar for cybersecurity, and Twistlock for cloud workload protection. "Palo Alto is a little bit more expensive all in, but they're unique," one executive said. "There aren't very many players there that do as many things as Palo Alto does, and certainly as well as they do it."
Asked what one product or vendor they would prioritize in a complete SASE stack rebuild, survey respondents put Palo Alto Networks first at 18%, followed by Zscaler at 15% and Cisco at 12%.
That Zscaler number is worth watching. Panelists describe the market as fragmented, and Zscaler in particular poses a risk: "Zscaler offers a very elegant, simple, easy-to-administer product at a little bit better price point. If anybody could disrupt that space, that's the name that springs to mind for me." Netskope, by contrast, remains more entrenched in its CASB origins and drew skepticism about its pace of adaptation to the SASE framework. In the same Observatory study, Cato Networks, Zscaler, and Netskope posted the top three Net Scores on forward 12-month spending intentions: mindshare leadership and spending momentum are not the same thing.
Global PoP coverage has become a baseline expectation. Real-world performance now depends on the relationships vendors maintain with internet service providers and interconnection partners like Equinix "to really deliver and achieve the efficiency and speed." Architectural details like traffic inspection methods and tunnel behavior draw scrutiny, and China remains a persistent obstacle on both latency and regulatory grounds across every vendor evaluated.
When panelists measure success, the KPIs are operational: user experience, reduced latency, faster mean time to resolution, and simplified policy management. "User experience, we always have that as one of our key performance indicators," one executive noted, "because at the end of the day, those are the things that are going to flood our call center and ticket queues as well."
Modern SASE platforms have advanced beyond traditional VPNs by enforcing zero trust at a granular level. "Authorization really is context aware," one panelist explained, with policies that factor posture, geolocation, and risk score rather than the few static profiles a VPN allowed.
Those capabilities come with steep switching costs. Deployments take months, involve significant partner work, and embed deeply into governance and operations. One executive set the bar bluntly: "A 5% cost savings or something like that sure wouldn't do it. That wouldn't even be close enough to motivate me." Only a major performance failure, a security incident, or a structural change like an acquisition would reshuffle the deck. The ROI drivers that move decisions are operational: scalability to shift rapidly between AWS and GCP without hardware constraints, and, as one panelist put it, "Reduce call volumes, reduce tickets. Seamless integration and implementation, and that seamless user experience, is the biggest ROI driver for us."
Vendor marketing carries far less weight than pilots and trusted peer recommendations: "The test case really helps us confirm whether that latency reduction or user experience improvements were real, versus just a marketing slide or marketing fluff."
For vendors, that is the real story of this panel: win the pilot, prove the operational ROI, and only a significant failure reopens the decision. Next week's Observatory for SASE report will show whether that moat held. Until then, watch the full panel conversation. Also, ETR clients have can access the complete 2025 dataset on the ETR Platform. Dig into where each vendor's spending momentum diverges from its mindshare, then watch who closes the gap next week.