magic quadrant for unified threat management 2014
DESCRIPTION
Uni fi ed threat management devi ces provi de smal l and mi dsi ze busi nesses wi th mul ti pl e network securi tyfuncti ons i n a si ngl e appl i ance. Buyers shoul d focus on performance when many securi ty functi ons areenabl ed, and on the ski l l set of the associ ated channel partnerTRANSCRIPT
-
3/3/2558 MagicQuadrantforUnifiedThreatManagement
http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 1/12
MagicQuadrantforUnifiedThreatManagement7August2014ID:G00261973
Analyst(s):JeremyD'Hoinne,AdamHils,GregYoung
VIEWSUMMARY
Unifiedthreatmanagementdevicesprovidesmallandmidsizebusinesseswithmultiplenetworksecurityfunctionsinasingleappliance.Buyersshouldfocusonperformancewhenmanysecurityfunctionsareenabled,andontheskillsetoftheassociatedchannelpartner.
MarketDefinition/DescriptionGartnerdefinestheunifiedthreatmanagement(UTM)marketasmultifunctionnetworksecurityproductsusedbysmallormidsizebusinesses(SMBs).Typically,midsizebusinesseshave100to1,000employees(seeNote1).UTMproductsmustcontinuallyaddnewfunctionsandthereforeencompassthefeaturesetofmanyothernetworksecuritysolutions,includingnextgenerationfirewall,secureWebgatewayandsecureemailgateway.Whileconsolidationcomeswithcompromisesinperformanceandcapability,thesearecompromisesthatmanySMBsarewillingtoaccept(see"WhatYouShouldExpectFromUnifiedThreatManagementSolutions").
ManyUTMproductscontainvariousothersecuritycapabilities,suchaswirelessoptionsandmodularEthernetportdensity,and,lessfrequently,Webapplicationfirewall(WAF)anddatalossprevention(DLP)softwaremodules.ApplicationcontrolembeddedinUTMisoftenbasic,focusedonInternetapplications(Facebook,Googleapplications,YouTube)andlooselyintegratedwiththefilteringpolicythroughalistofapplicationsbundledinaprofileandattachedtothefilteringrule.ItisusedmostlytorestricttheuseofWebapplicationsandcloudservices(suchassocialmedia,filesharingandsoon).Featuresrelatedtothemanagementofmobiledevicescreateapotentiallyattractivedifferentiatorforthismarket(see"HowUnifiedThreatManagementTacklestheConsumerizationofIT").
UTMappliancesareusedbymidsizebusinessestomeettherequirementsforsecureInternetconnectivity.Formanysmallbusinesses,thoserequirementsareoftendrivenbyregulatorydemands(suchasthePCIDataSecurityStandard),mandatingrudimentarylevelsofsecuritycontrols.Browserbasedmanagement,basicembeddedreporting,andlocalizedsoftwareanddocumentation,whichdon'tspecificallyappealtolargeenterprises,arehighlyvaluedbySMBsinthismarket.Gartnerseesverydifferentdemandsfromtheenterpriseandbranchofficefirewallmarkets(see"MagicQuadrantforEnterpriseNetworkFirewalls"),whichgenerallyrequiremorecomplexnetworksecurityfeatures,andareoptimizedforverydifferentselectioncriteria.
Thebranchofficesoflargercompanieshaveverydifferentnetworksecuritydemandsfrommidsizebusinesses,eventhoughtheymaybeofsimilarsize.Gartnerviewsbranchoffices'firewallsasextensionsofthecentralfirewallstrategy(see"BringBranchOfficeNetworkSecurityUptotheEnterpriseStandard").Thisdriveslargeenterprisestooftenuselowendenterpriseproductsattheirbranchofficestoensureinteroperability,andtotakeadvantageofeconomiesofscaleingettinglargerdiscountsfromtheirfirewallvendors.Forthesereasons,Gartnerallocatesbranchofficefirewallrevenuetotheenterprisefirewallmarket,nottheUTMmarket.
For2013,GartnerestimatesthattheUTMmarketgrewat14.1%toreachatotalofapproximately$1.54billion(see"MarketShareAnalysis:UnifiedThreatManagement(SMBMultifunctionFirewalls),Worldwide,2014Update"andNote2).
ManyUTMvendors,whichputastrongfocusondistributedorganizationssuchasretail,ormanagedsecurityserviceproviders(MSSPs),arenowheadingtowardplacingthemanagementandmonitoringconsolesfullyinthecloud.Gartnerbelievesthat,althoughit'sconvenientforthevendorstodoso,aportionoftheSMBmarketwillnotacceptthisexclusivelycloudmodelforreasonsoflatency,andneedtoaccesstheconsolewhenunderattack.Insomeregionsandindustryverticals,limitedtrustinaforeignsupplierandotherprivacyconcernswouldbeadditionalreasonstoavoidthecloudmodel.Reportingandlogretentionarewellsuitedtothecloud,butnotexclusively.
SMBsshouldbeskepticaloftheaspirationalmessagefromUTMvendorsabouttheexaggeratedbenefitsoffeatureconsolidation.SecuritybuyersshouldinsteadevaluateUTMdevicesbasedonthecontrolstheywillactuallyuse,theperformancetheywillgetforthosefeatures,andthequalityofvendorandchannel(andmanagedservices)supportthatisavailable.
ThemarketfornetworkandsecuritysolutionsdesignedtoprotectSMBscontinuestodevelop,andourexpectationsforUTMtechnologyfeaturesincreasewitheachneweditionofthisMagicQuadrant.Asaresult,theMagicQuadrantdepictsashiftupandtotherightwitheachrevision.Consequently,vendorsmustprogresstomaintaintheirpositionsineachnewMagicQuadrant.
MagicQuadrant
STRATEGICPLANNINGASSUMPTIONS
ReplacementofUTMbycloudoptionswillremainatlessthan5%through2016however,bythen,mostUTMdeviceswillleveragecloudassistedsecurityormanagementfeatures.
By2016,15%ofSMBswillusemobilitymanagementcapabilitiesfromtheirUTMplatformstoenforcedistinctivepoliciesupfromlessthan5%today.
NOTE1SMALLANDMIDSIZEMARKETDEFINITION
GartnergenerallydefinesSMBsbythenumberofemployeesand/orannualrevenuetheyhave.Theprimaryattributethatisusedmostoftenisthenumberofemployees.Smallbusinessesusuallyhavefewerthan100employees,whilemidsizebusinessesareusuallydefinedascompanieswithfewerthan1,000employees.Thesecondaryattributethatisusedmostoftenisannualrevenue.Smallbusinessesareusuallydefinedasthosewithlessthan$50millioninannualrevenue,whilemidsizebusinessesaredefinedasthosewithlessthan$1billioninannualrevenue.Typically,80%ofthecompaniesthatGartneranalystsspeakwithhavebetween100and999employees,andrevenueof$100millionto$500million(see"Gartner'sSmallandMidsizeBusinessMarketDefinition,2013Update").
NOTE2UTMREVENUEDIFFERENTIATION
GartnerdoesnotincludebranchofficefirewallrevenueasUTMrevenue.ThemarketsizeandgrowthareestimatedcomparedwithnumbersfromthepreviousUTMMagicQuadrant.
EVALUATIONCRITERIADEFINITIONS
AbilitytoExecuteProduct/Service:Coregoodsandservicesofferedbythevendorforthedefinedmarket.Thisincludescurrentproduct/servicecapabilities,quality,featuresets,skillsandsoon,whetherofferednativelyorthroughOEMagreements/partnershipsasdefinedinthemarketdefinitionanddetailedinthesubcriteria.
OverallViability:Viabilityincludesanassessmentoftheoverallorganization'sfinancialhealth,thefinancialandpracticalsuccessofthebusinessunit,andthelikelihoodthattheindividualbusinessunitwillcontinueinvestingintheproduct,willcontinueofferingtheproductandwilladvancethestateoftheartwithintheorganization'sportfolioofproducts.
SalesExecution/Pricing:Thevendor'scapabilitiesinallpresalesactivitiesandthestructurethatsupportsthem.Thisincludesdealmanagement,pricingandnegotiation,presalessupport,andtheoveralleffectivenessofthesaleschannel.
MarketResponsiveness/Record:Abilitytorespond,changedirection,beflexibleandachievecompetitivesuccessasopportunitiesdevelop,competitorsact,customerneedsevolveandmarketdynamicschange.Thiscriterionalsoconsidersthevendor'shistoryofresponsiveness.
MarketingExecution:Theclarity,quality,creativityandefficacyofprogramsdesignedtodelivertheorganization'smessagetoinfluencethemarket,promotethebrandandbusiness,increaseawarenessoftheproducts,andestablishapositiveidentificationwiththeproduct/brandandorganizationinthemindsofbuyers.This"mindshare"canbedrivenbyacombinationofpublicity,promotionalinitiatives,
http://www.gartner.com/technology/contact/bac/http://www.gartner.com/technology/contact/bac/?cm_sp=bac-_-reprint-_-banner
-
3/3/2558 MagicQuadrantforUnifiedThreatManagement
http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 2/12
Figure1.MagicQuadrantforUnifiedThreatManagement
Source:Gartner(August2014)
VendorStrengthsandCautionsAkerSecuritySolutionsBasedinBrazil,AkerSecuritySolutionsisanetworksecurityvendor.ItsportfoliohasincludedUTMsolutions(AkerFirewallUTM)since1997,aswellassecureWebgatewayandsecureemailgateway.AkerFirewallUTMiscomposedof14models,withtwomodelswithwirelesscapabilities.ItcanalsorunasavirtualapplianceonVMware,CitrixXenandMicrosoftHyperV.
Inthepast12months,AkerreneweditsentirehardwareapplianceproductlineandaddedKasperskyAntiVirusasanoption.
AkerFirewallUTMisagoodshortlistcandidateforsmallandmidsizeorganizationsinBrazil.
Strengths
AkerFirewallUTMprovidesacomprehensivesetofUTMfeatures,includingapplicationcontrol,wirelesssecurity,SSLVPN,andtwochoiceseachforanantivirusengineandanintrusionpreventionsystem(IPS)signatureset.
AkerprovidesarentaloptionforitsUTMappliances,whichreducescapitalexpenditure(capex)costs.
Aker'sclientsanditschannelpartnersvaluetheavailabilityof24/7vendorsupport.
Akerisoneofthefewvendorsthatprovidegraphicaluserinterface(GUI),documentationandsupportinPortuguese.
Cautions
AkerFirewallUTMlacksalowendappliance(lessthan$1,000)thatcouldbecosteffectiveforsmalloffices.
AkerdoesnotprovideanembeddedWebinterface,butinsteadalwaysrequirestheinstallationofamanagementsoftwarecomponent(AkerControlCenter).Clientsreportthatinstallationcouldbeeasier.
AkerisnotvisibleinclientshortlistsoutsideofBrazil,andisnotreadyforinternationalizationyet.
BarracudaNetworksBasedinCampbell,California,BarracudaNetworksisalargevendorprovidingnetworksecurity,backupandinfrastructuresolutions,including,amongotherthings,Webandemailsecurity,Webapplicationfirewall,anddatabackup.IthasastrongfocusonSMBs,butuntilrecentlywaslackingadedicatedUTMoffering.InFebruary2013,Barracudareleasedanewproductline,theBarracudaFirewall(Xseries),tocomplementBarracudaNGFirewall(Fseries),itsincumbentrangeoffirewalls,whichareorientedtowardlargerenterprises'needs.BarracudaFirewalliscomposedofsevenmodels,includingtwowithwirelesscapabilities,butisnotavailableyetasavirtualappliance.ItembedsaWebinterface,designedforsimplerusecases,andleveragesclouddatabasesandenginesforkeycontentfiltering.
Attheendof2013,Barracudaexecutedaninitialpublicoffering(IPO).Inthepastfewmonths,it
thoughtleadership,wordofmouthandsalesactivities.
CustomerExperience:Relationships,productsandservices/programsthatenableclientstobesuccessfulwiththeproductsevaluated.Specifically,thisincludesthewayscustomersreceivetechnicalsupportoraccountsupport.Thiscanalsoincludeancillarytools,customersupportprograms(andthequalitythereof),availabilityofusergroups,servicelevelagreementsandsoon.
Operations:Theabilityoftheorganizationtomeetitsgoalsandcommitments.Factorsincludethequalityoftheorganizationalstructure,includingskills,experiences,programs,systemsandothervehiclesthatenabletheorganizationtooperateeffectivelyandefficientlyonanongoingbasis.
CompletenessofVisionMarketUnderstanding:Abilityofthevendortounderstandbuyers'wantsandneedsandtotranslatethoseintoproductsandservices.Vendorsthatshowthehighestdegreeofvisionlistentoandunderstandbuyers'wantsandneeds,andcanshapeorenhancethosewiththeiraddedvision.
MarketingStrategy:Aclear,differentiatedsetofmessagesconsistentlycommunicatedthroughouttheorganizationandexternalizedthroughthewebsite,advertising,customerprogramsandpositioningstatements.
SalesStrategy:Thestrategyforsellingproductsthatusestheappropriatenetworkofdirectandindirectsales,marketing,service,andcommunicationaffiliatesthatextendthescopeanddepthofmarketreach,skills,expertise,technologies,servicesandthecustomerbase.
Offering(Product)Strategy:Thevendor'sapproachtoproductdevelopmentanddeliverythatemphasizesdifferentiation,functionality,methodologyandfeaturesetsastheymaptocurrentandfuturerequirements.
BusinessModel:Thesoundnessandlogicofthevendor'sunderlyingbusinessproposition.
Vertical/IndustryStrategy:Thevendor'sstrategytodirectresources,skillsandofferingstomeetthespecificneedsofindividualmarketsegments,includingverticalmarkets.
Innovation:Direct,related,complementaryandsynergisticlayoutsofresources,expertiseorcapitalforinvestment,consolidation,defensiveorpreemptivepurposes.
GeographicStrategy:Thevendor'sstrategytodirectresources,skillsandofferingstomeetthespecificneedsofgeographiesoutsidethe"home"ornativegeography,eitherdirectlyorthroughpartners,channelsandsubsidiariesasappropriateforthatgeographyandmarket.
http://www.aker.com.br/https://www.barracuda.com/
-
3/3/2558 MagicQuadrantforUnifiedThreatManagement
http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 3/12
expandedtheBarracudaFirewallproductrangestowardsmallerofficesandaddedsoftwarefeaturestoeasetheinstallationprocess.
TheBarracudaFirewallseriesisagoodshortlistcandidateforSMBsthatalreadyuseotherBarracudaproducts,haveanexistingtrustfulrelationshipwithresellersofBarracudasolutionsorhavestringentbudgetconstraints.
Strengths
BarracudahasstrongmarketshareamongSMBs,andcustomersbenefitfromgoodglobalsalesandsupportpresence,especiallyinEurope.
Gartnerclientsreportthattheylikethesimplelicensing,andthatunlikemanycompetitors,thepriceforsoftwareoptionsisreasonable.
BarracudaNetworksoffersa30dayrefundplanandareplacementprogramthatincludesanewapplianceeveryfouryears.
Cautions
TheBarracudaXSerieswasonlyrecentlyreleasedsomeintegratedmodulesandthecloudbasedcentralizedmanagementareyetunproven.Barracuda'schannelisunevenlytrainedonthesolutioninsomeregions.
TheBarracudaXSerieshasnotbeenscrutinizedbyanymajorthirdpartytestinglabsandhasalimitednumberofcertifications.
Gartnerbelievesthat,whileBarracudahascorrectlyassessedthatSMBandenterprisehavedifferentneeds,customersandchannelpartnerscouldbeconfusedbecausethetwofirewalllineshavemoreoverlapsthandifferences.
CheckPointSoftwareTechnologiesCheckPointSoftwareTechnologies,withheadquartersinTelAviv,Israel,andSanCarlos,California,isoneofthelargestpureplaysecuritycompanies,andhasbeenpresentinthesecuritymarketformorethan20years.Initiallyexclusivelyfocusedonenterprises,CheckPointhaslaterinvestedintheUTMsegment,specificallytargetingSMBusecases.ItsSMBproductlineincludes11appliances,includingwirelessandDSLmodels.UTMcanalsobedeliveredasavirtualapplianceoronAmazonWebServices(AWS).FundamentaltoCheckPointfirewallofferingsisthesetofsoftwareoptionsreferredtoasSoftwareBladesthatcanbegroupedtogetherinbundles.
OncethehardwareandOSconsolidationworkwasachievedin2013,CheckPointmoveditseffortsbacktonewthreatpreventionfeaturesandperformanceimprovements.Ithasalsorecentlymadeavailableamarketplaceofthreatfeedsfromthirdpartiesthatitsclientscanpurchaseseparatelyassoftwareoptions(ThreatCloudIntelliStore).
CheckPointisagoodchoiceforSMBorganizationsthatdonotconsiderlowpriceasthemostimportantcriterion.
Strengths
CheckPoint'sreportingandmanagementconsoleisconsistentlyhighlyratedbymidsizecompanies.CheckPointmanagedtosimplifyitsmanagementconsoleforitsentrylevelapplianceswithoutcompromisingtheflexibilityanddepthofprotection.
CheckPoint'sUTMsolutionsbenefitfromitsenterpriselevelsecurityfeatures,suchasThreatCloudandAntiBotsoftwareoptions,inadditiontothestrongIPSmodule,whichareallbackedupbyCheckPoint'slargethreatresearchteam.
CheckPointprovidesanoptionforsandboxing(ThreatEmulation),andrecentlyreleasedacloudbasedsecurityserviceformobileandremoteusers,inadditiontohavingexistingpartnershipswithmobiledevicemanagement(MDM)solutions.
CheckPointisastrong,stableorganizationwithaconsistentstrategyandprovenabilitytoexecuteonitsroadmap.
Cautions
GartnerseesCheckPointmostlysellingtoitsexistingbaseofdistributedenterprises,butitdoeslagbehindotherLeadersinbuildingadedicatedchannelofpurelySMBresellers.
GartnerclientsoftencitepriceastheprimaryreasonfornotselectingCheckPointsolutions.
GartnerSMBclientsreportthatthequalityofLevel1supportfromchannelvaries,andGartnerhasobservedthatSMBcustomerproblemescalationstakemoretimetoresolvethanthosefromlargeenterprisecustomers.
CheckPointoffersmanySoftwareBladesandkeepsaddingnewones.Ithasmadegoodprogressinsimplifyingthesalesofferingwithbundles,butresellersandclientsreportthattheyfinditdifficulttoassesstheoverallimpactofenablingmorethanafewoptionssimultaneously.
CiscoCisco,basedinSanJose,California,isthelargestnetworkinfrastructureprovider.Foralongtime,ituseditsglobalpresencetocrosssellsecuritysolutionstoitsexistingcustomerbase.Cisconowdedicatesrenewedeffortstotheenterprisesecuritymarket,withtheacquisitionofSourcefirein2013,andfocusesonsecurityfordistributedSMBswithcloudmanagedMerakiMXappliances(sevenmodels).ItsportfoliostillprovidetheISA500Seriesforsmallbusinesses(fourmodels,includingtwowithwirelesscapabilities),andtheASA5500XSeriesformidsizecompanies(fivemodels).CiscoAdaptivitySecurityAppliance(ASA)isalsoavailableasavirtualappliance(ASAv).Inadditiontothededicatedsecuritysolutions,Ciscohasalargeportfolioofnetworksolutionsthatcanprovidesecurityfeatures,suchasIntegratedServicesRouters(ISRs).
Duringthepast12months,CiscopredominantlypromotedandimproveditsMerakiMXproductlinewiththeintegrationofSourcefireIPSandtheadditionofuseridentityfilteringcapabilities.
http://www.checkpoint.com/http://www.cisco.com/
-
3/3/2558 MagicQuadrantforUnifiedThreatManagement
http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 4/12
CiscoisagoodchoiceforexistingSMBcustomersusingotherCiscotechnology,andfordistributedorganizationsinNorthAmerica.
Strengths
Cisco'sGartnercustomersgenerallyofferpositivereviewsofCiscohardwarerobustness.
ThelearningcurveforCiscotrainedstaffonitssecuritytechnologyisshort,especiallyforcustomersalreadyfamiliarwiththeCiscocommandlineinterface.
CiscoMerakiMXincludescontextualfeedsfromSourcefire,integratedWiFi/4Gmanagement,andintegrationwithMDMsolutionsformobileusers.
CiscoMerakiMXcloudbasedcentralizedmanagementoffersaunifiedviewformanagingUTMs,Meraki'swirelessAPandswitches.CustomerscancreateconfigurationtemplatestoaddnewlocationsandtocreatesitetositeVPNmoreeasily.
Cautions
CiscoMerakiMXlacksemailsecurity,SSLVPNforremoteusersandSSLdecryptionforHTTPthatareavailableinmanyofitscompetitors'UTMs.
Cisco'sdualproductlinestrategyfortheUTMmarketmightcreatecomplexityforsomeclientsthatcouldleveragetheirCiscoknowledgewithCiscoASAonthecorenetwork,butcouldalsobenefitfromsomeoftheMerakiMXfeaturesfordistributedoffices.
CiscodoesnotgeneratemanyinquiriesfromSMBclients,andwhenitdoes,itisoftentheincumbentsolutionthatisconsideredforreplacement.
ClavisterClavister,headquarteredinSweden,primarilytargetsenterprisesandISPswithitsappliancesandcloudservices.ThevendoraddressesSMBsthroughitsbrandedsecurityappliances,theEagleSeriesandtheWolfSeries,thatcanbedeliveredasvirtualappliances,too.Itsoperatingsystem(cOS)isprovidedeitherasafullfledgedsoftwarestack(cOSCore)orasastreamlinedversionfocusedonnetworkneeds(cOSStream).ClavisteralsooffersadedicatedportaltoMSSPsforthemanagementofitsUTM.
In2014,thecompanyappointedanewCEOandshifteditsstrategyevenmoretowardtelecomoperatorswithLTEcellsecurity.InMay2014,ClavisterenteredtheStockholmstockmarket.
ClavisterisagoodshortlistcandidateformunicipalitiesanddistributedpublicadministrationinNorthernEurope,orfororganizationinneedofruggedUTMappliances.
Strengths
ClientsciteveryfunctionalsecuritymodulesandqualityvendorsupportasreasonforremainingfaithfultoClavister.
TheISO9001:2008certificationandatwoyearstandardreturnandrepairwarrantyappealtospecificmidsizeverticalindustriesortoclientsthathaveexperiencedhardwareissueswithotherUTMprovidersinthepast.
TheClavisterX8seriesofruggedappliancesisagoodalternativefororganizationsfromspecificverticalindustries,suchasdefense,orwhentheexternalconditionswheretheUTMapplianceneedstobelocatedareadverse.
Cautions
WhileClavistercontinuestoservetheSMBmarketwithsoftwarefeaturesthatweredevelopedinthepast,itscurrentgotomarketapproachisnowprimarilyfocusedoncarrierandenterpriseneeds.
Clavister'ssales,supportandchannelpartnerresourcesarefocusedpredominantlyonNorthernEurope,andmightbeunevenlyavailableforcustomersfromotherregions.
ClavisterrarelyappearsonGartnerclients'shortlists.
CyberoamBasedinIndia,Cyberoam,nowaSophoscompany,isapureplayvendorfortheUTMmarket,primarilyfocusingonSMBsandattemptingtoexpandtolargerenterprises.Cyberoamprovides18differentUTMhardwaremodelsandfivevirtualappliances.CyberoammarketsitsLayer8useridentitycontrolfeaturesasakeydifferentiatortootherUTMproducts,andovertheyearsithasbuiltseveralfeaturesleveragingthisconcept.
InFebruary2014,CyberoamwasacquiredbySophos.ThecompanyannouncedthatCyberoamwouldcontinuetosellitsUTMproductlinewithoutanyshorttermdisruption.RecentCyberoamupdatesincludefeaturestargetingtheindustrialsecurityusecase.
CyberoamisagoodchoiceforSMBorganizationsintheAsia/PacificandMiddleEastregions.SMBbuyersfromotherregionsshouldfirstevaluatelocalchannelexpertiseonUTMandcustomerreferenceswithsimilarusecases.
Strengths
Cyberoaminvestsheavilyonitschannel,providesacomprehensiveknowledgebase,andallowsdirectaccesstochatandphonesupportforitspartnersthatshouldoftenbetranslatedintoquickresolutionofsupportissuesforitsclients.
Cyberoamconsistentlyexecutesonitsroadmap.
Cyberoamincludesmatureembeddedreportinganduseridentitycontrolsthatareattractivetomidsizeorganizations.
Cyberoam'sfilteringpolicyembedsdownloadanduploadstatisticsforeachrule,whichhelpsdetermineduplicateandunusedrules.ItalsoprovidesaflexiblewaytorestrictrecreationalInternetusagewiththeabilitytosetupquotasforusersorgroupsofusers.
http://www.cyberoam.com/http://www.clavister.com/
-
3/3/2558 MagicQuadrantforUnifiedThreatManagement
http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 5/12
Cautions
CyberoamhaslowvisibilityintheAmericasandappearslessoftenthanleadingUTMvendorsinEuropeincompetitiveshortlistsfromGartnerclients.
Gartnerbelievesthat,whilenomajorchangehasbeenobservedyet,Cyberoam'schannelmightsufferinthefuturefromtheoffensivepostacquisitionmessagingfromcompetitioninEuropeandintheU.S.,andmightbechallengedinitshomecountrybylocalUTMvendors.Thiscouldtranslateinlocalsupportdisruptionsifsomechannelpartnersswitchtootherbrands.
SMBclientsshouldfirstobtainclarificationfromCyberoamonoverlapsbetweenSophosandCyberoam'sUTMproductlines.
DellDell,withheadquartersinRoundRock,Texas,isaleadingcomputermanufacturerthathasdiversifieditsactivityininfrastructureandsecurity.ItsUTMportfolioisbrandedDellSonicWALLandincludes13models.ItiscomposedoftwoproductlinesthataresoldtotheSMBmarket:theSonicWALLTZSeriesforthesmallestbusinessesandtheSonicWALLNSASeriesforsmallandmidsizecompanies.Despitetherecentchangeinname,Dell'sUTMproducthasbeenonthemarketforalongtime,andbenefitsfromextendedsalesandsupportchannels.DelltargetstheenterprisemarketwithitsSonicWALLSuperMassiveSeries.Dellalsoprovidesothernetworksecuritysolutions,suchasSSLVPNandemailsecuritygateway.
DellisagoodshortlistcandidateforU.S.basedSMBsandforcurrentDellcustomersinotherregions.
Strengths
DellSonicWALLTZappliancescontinuallygetgoodscoresfromsmallorganizationsfortheirabilitytocombinesecuritymodulesandwirelessconnectivity,inadditiontoothernetworkfeatures.
ClientsreportthatlowpriceandacomprehensivesetoffeaturesaredifferentiatorsforDellSonicWALLincompetitiveevaluations.
Dellleveragesitsbroadlogisticalcapabilitiestoassistwithdeploymentsinvolvingmultiplegeographies.
Dellcontinuestoinvestinitssecuritydivisions,andDellSonicWALLhasasubstantialR&Dteam,includingalargeinhousesecuritylabthatcreatesallitsIPSsignatures.
Cautions
Dell'sroadmapforthepast24monthsdemonstratesaswitchinprioritytowardenterpriseusecaseattheexpenseofSMBneedsforconsolidatednetworkandsecurityfeatures.
GartnerhasobservedthatsincetheacquisitionofSonicWALLbyDell,manyUTMvendorsexploitDell'srecentmarketfocusswitchandaggressivelytargetDell'sresellersandgivethemstrongincentivetoswitch.ClientscouldbeaffectedbyachangingrelationshipbetweentheirlocalchannelpartnerandtheUTMtechnologyvendor.
DellstillholdsagoodshareoftheUTMmarket,buttheDellSonicWALLproductlineappearsmuchlessofteninrecentUTMshortlists.
Gartnerclientsreportthatthemanagementinterfacecanbeconfusingbecauseoftoomanyavailableoptions.
FortinetFortinetisalargesecurityvendorwithheadquartersinSunnyvale,California.Itoffersmorethan40differentUTMappliancemodels(FortiGate)aimedatthesmallandmidsizemarket,includingwireless,DSLandPOEversions.FortiGateisalsoavailableasavirtualappliancewithfivemodelsthatarepricedbasedonCPUcorecount.Onpremisescentralizedmanagement(FortiManager)andreporting(FortiAnalyzer)solutionscomplementtheUTMoffering.Thecomprehensivesecurityproductportfolio,composedoftokensandhostagents(FortiClient),isdesignedtoappealtoVARsandMSSPsastheroutetosales.
Fortinet'sroadmapcontinuestobedrivenbyregularhardwareandsoftwareupdates,with10newFortiGateappliancesin2013andalready12modelsin2014.FortinetalsomadeFortiGate,FortiManager,FortiAnalyzerandFortiWebavailableontheAWSplatform.ItwasalsooneofthefirstvendorstoofferfilesandboxingonaUTM.
FortinetisagoodcandidateforeveryorganizationinneedofaUTM.
Strengths
FortinetcontinuestobeahighlyvisibleUTMprovideramongGartnerclients.Italsoownsthelargestmarketshare,growingfasterthanthemarketaverage,andhasthelargestbaseofcertifiedchannelpartnersforUTMtechnology.
FortinethasaverylargeR&Dteamandsupportcentersacrossallregions.GartnercontinuestoviewFortinetassettingthecadenceintheUTMmarket,drivingitscompetitorstoreact.
FortiGateintegratesfilesandboxingcapabilities,backedupbythelargeFortiGuardLabsthreatresearchteam.
Fortinetprovidesaveryaggressiveprice/performanceproposition,whichisoftenadecisivefactorforbudgetconstrainedSMBs.
Thecombinationofwirelessaccesspointmanagement,WiFianalytics,highportdensityandpoweronEthernetalongwiththeavailabilityofpricecompetitiveUTMappliancesappealstosmallbusinesseslookingformorethanasecuritygateway,aswellastodistributedretailorganizations.
Cautions
ThefrequenthardwareandsoftwareupdatesmakeitmoredifficulttomaintainaconsistentlevelofexpertiseacrossFortinet'swidelydistributedchannel,whichsometimescausesdiscrepanciesinpresalesandsupportquality.
http://www.dell.com/http://www.fortinet.com/
-
3/3/2558 MagicQuadrantforUnifiedThreatManagement
http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 6/12
GartnerclientsreportissuesrelatedtoFortinetUTMregardingtheusabilityoftheFortiManagercentralizedmanagement,orbecauseoflowerthanexpectedperformancewhenenablingsecurityfeatures.
Fortinethasnotyetinvestedasmuchassomeofitsdirectcompetitorsinitsnativecloudbasedcentralizedmanagementandreporting(FortiCloud).Whilemarketneedshavenotfullyformed,thiswillproveacompetitivedisadvantageiftheresellersandMSSPsstarttousecloudmanagementasastandardplatform.
gateprotectGermanybasedgateprotectisapureplaysecurityvendor.ItsUTMportfolioincludesnineappliances.Virtualappliancesandcentralizedmanagementarealsoavailable.Gateprotect'smanagementinterface(eGUI)implementsagraphical(iconbased)visualizationofthenetworktopologyasawaytosimplifytheconfigurationofthesecuritypolicy.InJuly2014,gateprotectwasacquiredbyRohde&Schwarz,alargeGermanelectronicsgroup.
Gateprotectrecentlyreleasedanapplianceforsmalloffices(GPO110),includingwirelessoptionsandaddedapplicationandendpointcontrolfeatures.
Gateprotectisagoodshortlistcandidateforsmallorganizations,especiallyinEurope.
Strengths
Gateprotect'seGUIprovidessmallanddistributedorganizationswithasimplifieddeploymentexperience.
GateprotectmakesastronginvestmentinR&Dforavendorofitssize.
Clientsreportthattheycangetquickanswersfromvendorsupportwhenneeded.
GateprotectisgrowingquicklyinLatinAmericaandSouthernAfrica.
Cautions
Gateprotecthasasloweroverallgrowththanmostofitsdirectcompetitors.ItsresultsstillpredominantlydependonthematuremarketofsmallandlowermidsizeorganizationsinGermany.
Gateprotecthaslimitedcoveragefromindependenttestinglabs.
Layer7applicationcontrolisnotfullyintegratedinthecoreviewofthegraphicalsecuritypolicyrepresentation,butattachedasaprofile.
HillstoneNetworksHillstoneNetworksisapurenetworksecurityplayer,withheadquartersinBeijingandoperationsinSunnyvale,California.ItsUTMportfolioincludes12hardwaremodels(theMSeries).Virtualappliancesarenotavailable,buttheUTMsoftwarecanbedeployedonanopenstackenvironment.HillstonedoesnotyetofferavirtualUTMappliance,butseveralinstancesofUTMscanruninasinglephysicalchassis.Hillstonealsoprovidesarangeoffirewalls(theXSeries)thatisspecializedforthedatacenterusecase
RecentsoftwareupdatesincludedimprovementsonVPN,authenticationandnetworkfeatures.
HillstoneisagoodshortlistcandidateforSMBorganizationsintheAsia/Pacificregion.Organizationsfromotherregionsshouldfirstcheckthelocalchannelandvendorpresences.
Strengths
Hillstone'sUTMincludeshostreputationandnetworkmonitoringfeaturesthatcanhelpdetectinfectedhosts.
ClientsreportthattheUTMmaintainsexpectedperformancewhenrunningmultiplesecuritymodules.
Asapureplaynetworksecurityvendor,HillstoneNetworkshasagoodhistoryofexecutingonitsroadmap,whichgivescredibilitytoitsannouncementsonfutureimprovements.
Cautions
Hillstonetargetsprimarilythelargeenterprisemarket.ItlagsitscompetitorsinautomatedactivityreportsforSMBorMSSPoperationteams.
HillstoneNetworksisnotvisibleinUTMcompetitiveshortlistsoutsideofChina.HalfofHillstone'srevenuecomefromdirectsales,andthevendorhasyettobuildaninternationalchannelofactiveUTMresellers.
HuaweiHuaweiisalargenetworkinfrastructuresupplierheadquarteredinShenzhen,China.In2009,HuaweilauncheditsUnifiedSecurityGateway(USG)productline,whichnowiscomposedof24models,includingalargenumberofapplianceswithwirelesscapabilities,toaddresstheSMBmarket.Centralizedmanagementsoftwareisavailable.LargeUTMappliancescanrunseveralUTMsoftwareinstances,butthevendordoesnotprovidevirtualUTMappliancestorunonthetopofleadinghypervisors.
Recentupdatesincludenewhardwaremodels,aproprietaryVPNmode(DSVPN)andSSLdecryption.
Huawei'sUTMisagoodcontenderforSMBsinChina,andforitscurrentlargeenterprisecustomersinothercountries.
Strengths
HuaweiUTMhasagoodmixoflocalcertificationsandindependenttestsfromlargeinternationallabs.
Clientsoftencitegoodprices,especiallyforsupportservice,asadecisivefactorinselectingHuawei'ssolutions.
http://www.hillstonenet.com/http://www.gateprotect.com/enhttp://www.huawei.com/
-
3/3/2558 MagicQuadrantforUnifiedThreatManagement
http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 7/12
HuaweihasalargenumberofclientsusingIPv6.
Cautions
Likemostinfrastructurevendors,Huawei'sleverageisinitsexistingcustomerbaseoflargeenterprisesandcarriers.ThisfocusonothermarketsmightdivertdevelopmentprioritiesawayfromSMBneeds.
HuaweisellsamajorityofitsUTMinChinaandstrugglestogrowmarketshareoutsideofAsia/Pacific.SMBcustomersshouldfirstassessthelevelofcommitmentofHuawei'slocalchannelpartnerstotheSMBmarket.
JuniperNetworksJuniperNetworksisanetworkinfrastructurevendorbasedinSunnyvale,California.Ithasabroadportfoliothatcoversnetworkandsecuritysolutions.ItsUTMoffering(SRXSeries)includes13modelsandreliesontheJunosOS,whichisthecommonplatformfornetworkandsecurityappliancesinJuniper'sportfolio.OtherproductlinescansupportUTMcapabilities(SSGSeriesandISGSeries),andtwovirtualappliancesareavailable.
Juniperrecentlyannouncedaunifiedcentralizedmanagementandreportingsolution,improvedapplicationcontrolengineandsimplifiedusersinglesignon.
JuniperUTMisagoodchoiceforexistingJunipercustomers.OtherSMBcustomersshouldfirstverifytheexperienceoftheirlocalchannelwithJunipersecuritysolutionsforanSMBusecase.
Strengths
UTMbuyersthatalreadyuseJunipertechnologycanleveragetheirexistingrelationshipwiththevendortogetalowerpriceandquicklylearnhowtomanageitsUTM.
Juniperhasabroadrangeofhardwareappliancestosupportawidevarietyofscalabilityandperformancerequirements.
Juniper'sunderstandingofdiversecustomerenvironmentsmakesitagoodchoiceforcomplexnetworkinfrastructureorwhensupportisacriticalcomponentofthepurchasedecision.
Cautions
JuniperrarelyappearsonGartnerSMBcustomershortlistsforUTM.
RecentstaffcutsinJunipersecurityteamsmightdivertevenmoreofitsresourcesfromtheSMBmarket.
Exceptforthesupportofnewhardwaremodels,JuniperhasnotreleasednewfeaturesprimarilytargetingSMBinthepast12months.
SophosBasedinBoston,Massachusetts,andOxford,U.K.,Sophosisalargesecurityvendorthatinitiallyprovidedendpointsecuritybeforeaddingnetworkandmobilesecuritysolutionstoitsportfolio.TheSophosUTMportfolioincludes11models(theSGSeries).SophosUTMisalsoavailableasavirtualapplianceonAWS,withaconsistentcustomerbase.ItalsooffersitsRemoteEthernetDevice(RED)appliancesforsmallbranchesthatarecentrallymanagedusingaSophosUTM.
Inrecentmonths,SophosacquiredCyberoam,anotherUTMvendor(reviewedearlierinthisresearch),startedahardwareappliancesrefreshandreleasedversion9.2ofitsUTMsoftware,whichincludescloudbasedsandboxing,automatedemailencryptionandintegrationwithSophos'MDMproduct.
SophosisagoodUTMshortlistcontenderforSMBs,especiallyinEuropeandJapan,andforcurrentSophoscustomers.CustomersoutsideoftheseregionsshouldverifytheexperienceofthelocalchannelfortheselectedUTMtechnology.
Strengths
Sophos'easeofuseconsistentlyrateshigh.Theinterfacecontainsgeneralguidanceonwhateachfeaturedoes,whichisusefulforSMBoperators,whoarenotallsecurityexperts.
SophosshowscommitmenttotheUTMmarketwithtworecentacquisitionsandstrongmarketingandR&Dinvestment.
Sophos'UTMcommunityofresellersandclientsremainsfaithfultothebrandandcontributestoregularspotonimprovementsofthetechnology.
SophossupportisavailableinavarietyofEuropeanlanguages,anditslocalpresaleandsupportpresencereceivedpositivescoresfromGartnercustomers.
Cautions
TheintegrationofCyberoam'stechnologywillbethemainchallengeforSophosduringthenext24months.Gartnerbelievesthat,despitesomesynergies,managingsignificantoverlapsinUTMproductportfolioscouldbedifficultforSophos'channel.
SophosUTM'suseridentityintegrationandvoiceoverIP(VoIP)managementlagbehindsomeofitsdirectcompetition.
ExceptforGermanyandtheU.K.,SophosisnotasvisibleinGartnerclientinquiriesasotherLeaders.
StormshieldFrancebasedStormshieldisasubsidiaryofAirbusDefenceandSpace,andtheresultofanoperationalmergerbetweentwoFrenchfirewallvendorsin2013(ArkoonandNetasq).InadditiontofirewallsandUTM,thevendorprovidesendpointanddatasecuritysolutions.ItsUTMproductline(StormshieldNetworkSecurity)ismadeofnineappliances,andsevenvirtualappliances,andisalsoavailableonAWS.StormshielddevelopeditsownIPS,whichisenabledinthedefaultUTMconfiguration.
http://www.juniper.net/http://www.stormshield.eu/enhttp://www.sophos.com/
-
3/3/2558 MagicQuadrantforUnifiedThreatManagement
http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 8/12
Recentchangesincludethebrandingupdate,tunnelbasedSSLVPN,significantimprovementsintheURLfiltering,embeddedreportsandlogviewer,andsinglesignonauthenticationmodules.
StormshieldisagoodUTMcontenderforSMBsinEuropeandtheMiddleEast.Otherregionsshouldfirstmonitortheavailabilityandexperienceofthelocalchannel.
Strengths
Stormshieldhasasimpleserviceofferingwithtwomainbundles:alowcostbundleandapremiumbundlethatincludesKasperskyAntiVirusandvulnerabilitydetectionmodules.
Customersliketheeaseofinstallation,theintegratedrulecollisionmechanism,andtheavailabilityoflocalandglobalcertifications.
Stormshield'scustomerswilleventuallybenefitfromthelargerscaleandgreaterresourcesofthecombinedentity.ThevendorisstartingtobeseenasagrowingcompetitivethreatbyotherUTMvendorsinEurope.
Cautions
Despitelongtimeefforts,StormshieldhasnotmanagedtotakesignificantmarketshareoutsideofFrance.EuropeisamuchmorefragmentedmarketthanNorthAmericaorotherregionswithlargecountries,andassuch,requiresstronginvestmentforeachnewtargetedcountryoutsideofthevendor'shomemarket.
GartnerhasobservedthattheStormshieldmarketingmessageandannouncedroadmapshiftedfromSMBstowardlargeenterprisesjustafterthemerger,andthatroadmapexecutionstalledforafewmonths.ThelatestversionsnowtargetSMBclients,butSMBbuyersshouldrequirevisibilityregardingfutureroadmapdevelopments.
StormshieldUTMlackstheabilitytoapplyqualityofservice(QoS)rulesbasedonapplicationdetection.
WatchGuardSeattlebasedWatchGuardisawellestablishedUTMvendor.ItprovidesUTM,secureemailgatewaysandremotemanageablewirelessAPs.TheUTMproductlines(XTMandFirebox),include19physicalappliances,includingthreeapplianceswithembeddedwirelesscapabilitiesandfourvirtualappliances.
WatchGuardrecentreleasesincludeanewcloudbasedreportingandmonitoringsolution(WatchGuardDimension),aDLPaswellascloudbasedsandboxingmodules,andwirelessaccesspointmanagement.
WatchGuardisagoodshortlistcandidateforSMBorganizationsinneedofabroadsetoffeaturesorrelyingonanMSSPformanagingandmonitoringtheirUTM.
Strengths
WatchGuardprovidescloudbasedsandboxing(APTBlocker),andreportsaredirectlyintegratedinitscentralizeddashboardcloudservice(WatchGuardDimension).
WatchGuard'scustomersindicatethatcompletenessoffeaturesandlowpricearereasonstoselectWatchGuard.
WatchGuardhasdemonstratedastrongabilitytoexecuteonitsroadmap,leveragingitsplatformmodularitytoquicklyaddnewmodules.
TheWatchGuardDimensionreportingtoolincludesaninteractiveheatmapview(FireWatch)thatisusefultoquicklyidentifynetworkissuescreatedbyaspecificuserorapplication.
Cautions
WatchGuardappearsmorerarelyinGartnerclientshortlistsformidsizeordistributedorganizationsthanitsdirectcompetitors.
GartnerdoesnotseeWatchGuarddisplacingotherLeadersbasedontechnicalrequirements.
ClientsreportthattheonpremisescentralizedmanagementconsoleforWatchGuardUTMscouldbeimproved.
VendorsAddedandDroppedWereviewandadjustourinclusioncriteriaforMagicQuadrantsandMarketScopesasmarketschange.Asaresultoftheseadjustments,themixofvendorsinanyMagicQuadrantorMarketScopemaychangeovertime.Avendor'sappearanceinaMagicQuadrantorMarketScopeoneyearandnotthenextdoesnotnecessarilyindicatethatwehavechangedouropinionofthatvendor.Itmaybeareflectionofachangeinthemarketand,therefore,changedevaluationcriteria,orofachangeoffocusbythatvendor.
AddedAkerSecuritySolutions,HillstoneNetworksandBarracudaNetworkshavebeenadded.
DroppedKeriowasdroppedbecauseitdidnotmeetGartner'sinclusioncriteriaforthisMagicQuadrant.
InclusionandExclusionCriteriaInclusionCriteria
UTMcompaniesthatmeetthemarketdefinitionanddescriptionwereconsideredforthisreportunderthefollowingconditions:
TheyshippedUTMsoftwareand/orhardwareproductstargetedtoSMBsthatincludedcapabilitiesinthefollowingfeatureareasataminimum:
http://www.watchguard.com/
-
3/3/2558 MagicQuadrantforUnifiedThreatManagement
http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 9/12
Networksecurity(statefulfirewallandintrusionprevention)
Websecuritygateway
Remoteaccessformobileemployees(VPNs)
Emailsecurity
TheyregularlyappearedonGartnermidsizeclientshortlistsforfinalselection.
TheyachievedUTMproductsales(notincludingmaintenanceorotherservicefees)ofmorethan$7millionin2013,andwithinacustomersegmentthat'svisibletoGartner.Theyalsoachievedthisrevenueonthebasisofproductsales,exclusiveofmanagedsecurityservice(MSS)revenue.
ThevendorcanprovideatleastthreereferencecustomerswillingtotalktoGartner,orGartnerhashadsufficientinputfromGartnerclientsontheproduct.
ExclusionCriteria
Therewasinsufficientinformationforassessment,andthecompanydidn'totherwisemeettheinclusioncriteriaorisn'tactivelyshippingproductsyet.
Productsaren'tusuallydeployedastheprimary,Internetfacingfirewall(forexampleproxyserversandnetworkintrusionpreventionsystem[IPS]solutions).
Productsarebuiltaroundpersonalfirewalls,hostbasedfirewalls,hostbasedIPSsandWebapplicationfirewallsallofwhicharedistinctmarkets.
SolutionsaretypicallydeliveredasMSS,totheextentthatproductsalesdidnotreachthe$7millionthreshold.
Inadditiontothevendorsincludedinthisreport,Gartnertracksothervendorsthatdidnotmeetourinclusioncriteriabecauseofaspecificverticalmarketfocusand/orUTMrevenueand/orcompetitivevisibilitylevels,includingAdytonSystems,eSoft,GajShield,ilemGroup,MyDigitalShield,Netgear,NorthCoastSecurityGroup,QuickHeal,Sangfor,SecPoint,Secui,Smoothwall,TrustwaveandZyXEL.
EvaluationCriteriaAbilitytoExecuteProductorService:Keyfeaturessuchaseaseofdeploymentandoperation,consolequality,price/performance,rangeofmodels,secondaryproductcapabilities(includinglogging,mobiledevicemanagement,integratedWiFisupportandremoteaccess),andtheabilitytosupportmultifunctiondeploymentsareweightedheavily.
OverallViability:Thisincludesavendor'soverallfinancialhealth,prospectsforcontinuingoperations,companyhistory,anddemonstratedcommitmenttothemultifunctionfirewallandnetworksecuritymarket.Growthofthecustomerbaseandrevenuederivedfromsalesarealsoconsidered.Allvendorsarerequiredtodisclosecomparablemarketdata,suchasmultifunctionfirewallrevenue,competitivewinsversuskeycompetitors(whichiscomparedwithGartnerdataonsuchcompetitionsheldbyourclients),anddevicesindeployment.Thenumberofmultifunctionfirewallsshippedisn'takeymeasureofexecution.Instead,weconsidertheuseofthesefirewallsandthefeaturesdeployedtoprotectthekeybusinesssystemsofGartnermidsizebusinessclients.
SalesExecution/Pricing:Thisincludespricing,thenumberofdeals,theinstalledbase,andthestrengthofsalesanddistributionoperationsofthevendors.Presalesandpostsalessupportareevaluated.Pricingiscomparedintermsofatypicalmidsizebusinessdeployment,includingthecostofallhardware,support,maintenanceandinstallation.Lowpricingwon'tguaranteehighexecutionorclientinterest.Buyerswantvaluemorethantheywantbargains,althoughlowpriceisoftenafactorinbuildingshortlists.Thetotalcostofownershipduringatypicalmultifunctionfirewalllifecycle(whichisthreetofiveyears)isassessed,asisthepricingmodelforaddingsecuritysafeguards.Inaddition,thecostofrefreshingtheproductsisevaluated,asisthecostofreplacingacompetingproductwithoutintolerablecostsorinterruptions.
MarketResponsiveness/Record:Thisincludestheabilitytorespond,changedirection,beflexible,andachievecompetitivesuccessasopportunitiesdevelop,competitorsact,customerneedsevolveandmarketdynamicschange.Thiscriterionalsoconsiderstheprovider'shistoryofresponsiveness.
MarketingExecution:Thisaddressesawarenessoftheproductinthemarket.Werecognizecompaniesthatareconsistentlyidentifiedbyourclientsandoftenappearontheirpreliminaryshortlists.
CustomerExperienceandOperations:Theseincludemanagementexperienceandtrackrecord,andthedepthofstaffexperiencespecificallyinthesecuritymarketplace.Thegreatestfactorinthesecategoriesiscustomersatisfactionthroughoutthesalesandproductlifecycle.Alsoimportantiseaseofuse,overallthroughputacrossdifferentdeploymentscenarios,andhowthefirewallfaresunderattackconditions(seeTable1).
Table1.AbilitytoExecuteEvaluationCriteria
EvaluationCriteria Weighting
ProductorService High
OverallViability Medium
SalesExecution/Pricing High
MarketResponsiveness/Record Medium
MarketingExecution Low
-
3/3/2558 MagicQuadrantforUnifiedThreatManagement
http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 10/12
CustomerExperience Medium
Operations Medium
Source:Gartner(August2014)
CompletenessofVisionMarketUnderstandingandMarketingStrategy:Theseincludeprovidingatrackrecordofdeliveringoninnovationthatprecedescustomerdemand,ratherthanan"us,too"roadmapandanoverallunderstandingandcommitmenttothesecuritymarket(specificallytheSMBnetworksecuritymarket).Gartnermakesthisassessmentsubjectivelybyseveralmeans,includinginteractionwithvendorsinbriefingsandfeedbackfromGartnerclientsoninformationtheyreceiveconcerningroadmaps.Incumbentvendormarketperformanceisreviewedyearlyagainstspecificrecommendationsthathavebeenmadetoeachvendor,andagainstfuturetrendsidentifiedinGartnerresearch.Vendorscan'tmerelystateanaggressivefuturegoal.Theymustenactaplan,showthatthey'refollowingitandmodifytheplanastheyforecasthowmarketdirectionswillchange.
SalesStrategy:Thisincludespreproductandpostproductsupport,valueforpricing,andclearexplanationsandrecommendationsfordetectioneventsanddeploymentefficacy.Buildingloyaltythroughcredibilitywithafulltimemidsizebusinesssecurityandresearchstaffdemonstratestheabilitytoassessthenextgenerationofrequirements.
Offering(Product)Strategy:Theemphasisisonthevendor'sproductroadmap,currentfeatures,leadingedgecapabilities,virtualizationandperformance.Thequalityofthesecurityresearchlabsbehindthesecurityfeaturesisconsidered.Credible,independentthirdpartycertifications,suchasCommonCriteria,areincluded.Integrationwithothersecuritycomponentsisalsoweighted,aswellasproductintegrationwithotherITsystems.Asthreatschangeandbecomemoretargetedandcomplex,weweightvendorshighlyiftheyhaveroadmapstomovebeyondpurelysignaturebased,deeppacketinspectiontechniques.Inaddition,weweightvendorsthataddmobiledevicemanagementtotheirofferingsandarelookingtosupportSMBorganizationsthatusecloudbasedservices.
BusinessModel:Thisincludestheprocessandsuccessrateofdevelopingnewfeaturesandinnovation,andR&Dspending.
Innovation:Thisincludesproductinnovation,suchasR&D,andqualitydifferentiators,suchasperformance,virtualization,integrationwithothersecurityproducts,amanagementinterface,andclarityofreporting.
GeographicStrategy:Thisincludestheabilityandcommitmenttoservicegeographies.
Themoreaproductmirrorstheworkflowofthemidsizebusinessoperationsscenario,thebetterthevision.Productsthataren'tintuitiveindeployment,oroperationsthataredifficulttoconfigureorhavelimitedreporting,arescoredaccordingly.Solvingcustomerproblemsisakeyelementofthiscategory.Reducingtherulebase,offeringinterproductsupportandbeatingcompetitorstomarketwithnewfeaturesareforemost(seeTable2).
Table2.CompletenessofVisionEvaluationCriteria
EvaluationCriteria Weighting
MarketUnderstanding High
MarketingStrategy High
SalesStrategy Medium
Offering(Product)Strategy Medium
BusinessModel Medium
Vertical/IndustryStrategy NotRated
Innovation High
GeographicStrategy Low
Source:Gartner(August2014)
QuadrantDescriptionsLeadersTheLeadersquadrantcontainsvendorsattheforefrontofmakingandsellingUTMproductsthatarebuiltformidsizebusinessrequirements.Therequirementsnecessaryforleadershipincludeawiderangeofmodelstocovermidsizebusinessusecases,supportformultiplefeatures,andamanagementandreportingcapabilitythat'sdesignedforeaseofuse.Vendorsinthisquadrantleadthemarketinofferingnewsafeguardingfeatures,andinenablingcustomerstodeploytheminexpensivelywithoutsignificantlyaffectingtheenduserexperienceorincreasingstaffingburdens.Thesevendorsalsohaveagoodtrackrecordofavoidingvulnerabilitiesintheirsecurityproducts.Commoncharacteristicsincludereliability,consistentthroughput,andproductsthatareintuitivetomanageandadminister.
ChallengersTheChallengersquadrantcontainsvendorsthathaveachievedasoundcustomerbase,buttheyaren'tleadingwithfeatures.ManyChallengershaveothersuccessfulsecurityproductsinthemidsizeworldandarecountingontheclientrelationshiporchannelstrength,ratherthantheproduct,towindeals.Challengers'productsareoftenwellpriced,and,becauseoftheirstrengthinexecution,thesevendors
-
3/3/2558 MagicQuadrantforUnifiedThreatManagement
http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 11/12
canoffereconomicsecurityproductbundlesthatotherscan't.ManyChallengersholdthemselvesbackfrombecomingLeadersbecausethey'reobligatedtosetsecurityorfirewallproductsasalowerpriorityintheiroverallproductsets.
VisionariesVisionarieshavetherightdesignsandfeaturesforthemidsizebusiness,butlackthesalesbase,strategyorfinancialmeanstocompetegloballywithLeadersandChallengers.MostVisionaries'productshavegoodsecuritycapabilities,butlacktheperformancecapabilityandsupportnetwork.Savingsandhightouchsupportcanbeachievedfororganizationsthatarewillingtoupdateproductsmorefrequentlyandswitchvendors,ifrequired.Wheresecuritytechnologyisacompetitiveelementforanenterprise,Visionariesaregoodshortlistcandidates.
NichePlayersMostvendorsintheNichePlayersquadrantareenterprisecentricorsmallofficecentricintheirapproachtoUTMdevicesforSMBs.SomeNichePlayersfocusonspecificverticalindustriesorgeographies.IfSMBsarealreadyclientsofthesevendorsforotherproducts,thenNichePlayerscanbeshortlisted.
ContextSMBshavesignificantlydifferentnetworksecurityrequirementsfromthoseoflargeenterprises,duetodifferentthreatenvironmentsanddifferentbusinesspressures.Althoughthebranchofficesofsomelargerenterpriseshaverequirementsthataresimilartomidsizebusinesses,thisisnotalwaysthecase.TheUTMmarketconsistsofawiderangeofsuppliersthatmeetthecommoncoresecurityrequirementsofSMBs,butbusinessesneedtomaketheirdecisionsbymappingtheirthreatanddeploymentpatternstooptimalofferings.
MarketOverviewTheUTMmarketismatureandmanySMBorganizationsarenowrenewingtheirUTMtechnology,ratherthanacquiringitforthefirsttime.Themarketisstillgrowingfasterthanothernetworksecuritymarkets,buthighermarketpenetrationwillslowlydrivetheUTMmarketgrowthratedown.In2014,SophosacquiredCyberoam,continuingtherecenttrendofconsolidationintheUTMmarket.
TheprimarycharacteristicofmidsizecompaniesisthattheyareorganizationswithresourceconstrainedITdepartments.Theyhavearelativelimitoncapitalexpenditures,operationalbudgets,numberofITstaffersanddepthofITskillswhencomparedwithlargeenterprises.Inkeepingwiththis,UTMappliancesarefrequentlyusedacrossmidsizebusinessesasalowcostwayofmeetingtheirnetworksecurityrequirements.Midsizebusinesseslookatsecuritydifferently,andshowdifferentbuyingbehaviorscomparedwithlargerenterprises.Theprimaryareasofdifferenceare(inorderofimportance):
Alimitedornonexistentskilledsecuritystaffdrivestheneedforeaseofinstallation,configurationanduseofchannelmanagedsolutions.
LesscomplexuseoftheInternetresultsinlowerdemandforhighendsecurityfeatures,suchasapplicationlevelsecurityandcustomintrusionpreventionfilters.
Limitedsecuritybudgetsdriveacquisitioncoststorepresentmorethan60%oftheoveralldecisionweighting.
Smallbusinessesoftenperceivethattheyarenotvisibletoattackersand,therefore,don'trequireasmuchsecurity.However,financiallymotivatedattackershavetargetedsmallbusinesses,andthepublicityoversuccessfulattackshaschangedthesebusinesses'perceptions.
Smallbusinesseswithfewerthan100employeeshaveevenmorebudgetarypressuresandevenfewersecuritypressures.Mostsecurityprocurementdecisionsaredrivenbynontechnicalfactorsandrarelyfeaturecompetitivecomparisons.Forthesereasons,thisMagicQuadrantfocusesontheUTMproductsusedbymidsizebusinesses,asdefinedabove.
ThesedifferencesbetweenSMBandlargeenterpriseexpectationsareoneofthemajorreasonswhymanyoffirewallvendorsthatsellsuccessfullytotheenterpriseandSMBmarketstendtohaveseparatesoftwareorevenproductlinesforeachmarket.
UTMVendorsTargetLargeEnterprisesWithDifferentApproaches
AllofthevendorssurveyedagreeonthedifferentgotomarketapproacheswhentargetingSMBsversuslargeenterpriseclients.SMBsmoreoftenrelyontheirchannelpartnertochoosethecorrectallinoneUTMplatform,whereaslargeenterprisesecuritybuyersconducttheirownselectionprocess.SMBresellersalsohandleLevel1andLevel2supportsomealsobecomelocalLevel3supportcentersonbehalfofthevendor.
ThemarketpenetrationforSMBsishigh,anddisplacingactivechannelpartnersfromanotherUTMvendorisdifficultbecauseitmeansthesepartnerswillhavetomaintainthelegacytechnologyofexistingcustomers,andalsolearnthevendor'sreplacementtechnology.Evenifsomechanneldisplacementhappensfollowinganacquisitionormergerannouncement,GartnerobservesthatmanyUTMvendorsconsiderSMBsasamature,lowgrowthmarketandfocusonnewtargetcustomers.
Themostbasictacticistoreleasemorepowerfulappliances,runthesamesoftwarestackandselltheUTMcorevalueofallinonesecurity.Thisshortsightedapproachdoomsthevendorstonicheusecases,suchasbudgetconstrainedlowersizelargeenterprises,whicharecomposedofslightlymorethan1,000employees.SomeofthelargerUTMvendorsimproveonthisinitialapproachwithanoptimizedsoftwarestackthatisdevelopedtoprovideanenhancedofferfortheusecaseofahighperformancefirewall.Despitethemanagementinterfacebeingcrowdedwithunnecessaryfeatures,thegoodpriceofferedbyvendorsthatareaggressivelywillingtotakemarketshareawayfromtheincumbententerprisefirewallvendorsisattractivetomanyenterprises.However,UTMvendorsthatdonottakeamoredifferentiatedproductapproachwon'tdisplaceleadingenterprisevendorsatlarge,TypeAorganizations(see"MagicQuadrantforEnterpriseNetworkFirewalls").
-
3/3/2558 MagicQuadrantforUnifiedThreatManagement
http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 12/12
Alternatively,afewprovidersnowtargetdistributedorganizationsthathaveneedsclosetothoseofmidsizeorganizations.ThisincludesMSSPsforSMBsanddistributedenterpriseslikeretailers,healthorganizationsandsmallgovernmentalagencies.Despitecentralizedpurchaseandmaintenancecenters,eachofficeissimilartoanautonomousorganization.Recentlyreleasedoffersincludecentralizedcloudbasedmanagementandreportingandwirelessaccesspointmanagement,sometimeswithadditionalfeaturestargetingorganizationsfromtheretailindustry,suchaswirelessanalytics,butalsosmallerappliancesoflessthan$500.
UTMvendorsincreasinglyarefightingoverinitialpurchaseprices,andallvendorsmanagetowindealsonthestrengthofthissoleadvantage,basedonthetargetedverticalandgeographicarea.Inthelongerterm,thesecuritymarketforSMBmightbeinfluencedbytheincreasedadoptionofmobiletechnology,cloudservicesandforuppermidsizebusinessesvirtualizeddemilitarizedzone(DMZ)anddatacenter.WhilethereisnovisibleactorthatcoulddisrupttheUTMmarketyet,alternateapproaches,suchasendpointandmobiledevicemanagementorsecureWebgatewayhostedinthecloud,couldbecomemoreseriouscontenders.
2014Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.oritsaffiliates.ThispublicationmaynotbereproducedordistributedinanyformwithoutGartnerspriorwrittenpermission.Ifyouareauthorizedtoaccessthispublication,youruseofitissubjecttotheUsageGuidelinesforGartnerServicespostedongartner.com.Theinformationcontainedinthispublicationhasbeenobtainedfromsourcesbelievedtobereliable.Gartnerdisclaimsallwarrantiesastotheaccuracy,completenessoradequacyofsuchinformationandshallhavenoliabilityforerrors,omissionsorinadequaciesinsuchinformation.ThispublicationconsistsoftheopinionsofGartnersresearchorganizationandshouldnotbeconstruedasstatementsoffact.Theopinionsexpressedhereinaresubjecttochangewithoutnotice.AlthoughGartnerresearchmayincludeadiscussionofrelatedlegalissues,Gartnerdoesnotprovidelegaladviceorservicesanditsresearchshouldnotbeconstruedorusedassuch.Gartnerisapubliccompany,anditsshareholdersmayincludefirmsandfundsthathavefinancialinterestsinentitiescoveredinGartnerresearch.GartnersBoardofDirectorsmayincludeseniormanagersofthesefirmsorfunds.Gartnerresearchisproducedindependentlybyitsresearchorganizationwithoutinputorinfluencefromthesefirms,fundsortheirmanagers.ForfurtherinformationontheindependenceandintegrityofGartnerresearch,seeGuidingPrinciplesonIndependenceandObjectivity.
AboutGartner|Careers|Newsroom|Policies|SiteIndex|ITGlossary|ContactGartner
http://www.gartner.com/technology/about.jsphttp://www.gartner.com/technology/about/policies/guidelines_ov.jsphttp://www.gartner.com/technology/about/policies/usage_guidelines.jsphttp://www.gartner.com/technology/it-glossaryhttp://www.gartner.com/technology/site-index.jsphttp://www.gartner.com/technology/about/ombudsman/omb_guide2.jsphttp://www.gartner.com/technology/careershttp://www.gartner.com/technology/contact/contact_gartner.jsphttp://www.gartner.com/it/products/newsroom