magic quadrant for unified threat management 2014

12
3/3/2558 Magic Quadrant for Unified Threat Management http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 1/12 Magic Quadrant for Unified Threat Management 7 August 2014 ID:G00261973 Analyst(s): Jeremy D'Hoinne, Adam Hils, Greg Young VIEW SUMMARY Unified threat management devices provide small and midsize businesses with multiple network security functions in a single appliance. Buyers should focus on performance when many security functions are enabled, and on the skill set of the associated channel partner. Market Definition/Description Gartner defines the unified threat management (UTM) market as multifunction network security products used by small or midsize businesses (SMBs). Typically, midsize businesses have 100 to 1,000 employees (see Note 1). UTM products must continually add new functions and therefore encompass the feature set of many other network security solutions, including nextgeneration firewall, secure Web gateway and secure email gateway. While consolidation comes with compromises in performance and capability, these are compromises that many SMBs are willing to accept (see "What You Should Expect From Unified Threat Management Solutions"). Many UTM products contain various other security capabilities, such as wireless options and modular Ethernet port density, and, less frequently, Web application firewall (WAF) and data loss prevention (DLP) software modules. Application control embedded in UTM is often basic, focused on Internet applications (Facebook, Google applications, YouTube) and loosely integrated with the filtering policy through a list of applications bundled in a profile and attached to the filtering rule. It is used mostly to restrict the use of Web applications and cloud services (such as social media, file sharing and so on). Features related to the management of mobile devices create a potentially attractive differentiator for this market (see "How Unified Threat Management Tackles the Consumerization of IT"). UTM appliances are used by midsize businesses to meet the requirements for secure Internet connectivity. For many small businesses, those requirements are often driven by regulatory demands (such as the PCI Data Security Standard), mandating rudimentary levels of security controls. Browser based management, basic embedded reporting, and localized software and documentation, which don't specifically appeal to large enterprises, are highly valued by SMBs in this market. Gartner sees very different demands from the enterprise and branch office firewall markets (see "Magic Quadrant for Enterprise Network Firewalls"), which generally require morecomplex network security features, and are optimized for very different selection criteria. The branch offices of larger companies have very different network security demands from midsize businesses, even though they may be of similar size. Gartner views branch offices' firewalls as extensions of the central firewall strategy (see "Bring Branch Office Network Security Up to the Enterprise Standard"). This drives large enterprises to often use lowend enterprise products at their branch offices to ensure interoperability, and to take advantage of economies of scale in getting larger discounts from their firewall vendors. For these reasons, Gartner allocates branch office firewall revenue to the enterprise firewall market, not the UTM market. For 2013, Gartner estimates that the UTM market grew at 14.1% to reach a total of approximately $1.54 billion (see "Market Share Analysis: Unified Threat Management (SMB Multifunction Firewalls), Worldwide, 2014 Update" and Note 2). Many UTM vendors, which put a strong focus on distributed organizations such as retail, or managed security service providers (MSSPs), are now heading toward placing the management and monitoring consoles fully in the cloud. Gartner believes that, although it's convenient for the vendors to do so, a portion of the SMB market will not accept this exclusively cloud model for reasons of latency, and need to access the console when under attack. In some regions and industry verticals, limited trust in a foreign supplier and other privacy concerns would be additional reasons to avoid the cloud model. Reporting and log retention are wellsuited to the cloud, but not exclusively. SMBs should be skeptical of the aspirational message from UTM vendors about the exaggerated benefits of feature consolidation. Security buyers should instead evaluate UTM devices based on the controls they will actually use, the performance they will get for those features, and the quality of vendor and channel (and managed services) support that is available. The market for network and security solutions designed to protect SMBs continues to develop, and our expectations for UTM technology features increase with each new edition of this Magic Quadrant. As a result, the Magic Quadrant depicts a shift up and to the right with each revision. Consequently, vendors must progress to maintain their positions in each new Magic Quadrant. Magic Quadrant STRATEGIC PLANNING ASSUMPTIONS Replacement of UTM by cloud options will remain at less than 5% through 2016; however, by then, most UTM devices will leverage cloudassisted security or management features. By 2016, 15% of SMBs will use mobility management capabilities from their UTM platforms to enforce distinctive policies — up from less than 5% today. NOTE 1 SMALL AND MIDSIZE MARKET DEFINITION Gartner generally defines SMBs by the number of employees and/or annual revenue they have. The primary attribute that is used most often is the number of employees. Small businesses usually have fewer than 100 employees, while midsize businesses are usually defined as companies with fewer than 1,000 employees. The secondary attribute that is used most often is annual revenue. Small businesses are usually defined as those with less than $50 million in annual revenue, while midsize businesses are defined as those with less than $1 billion in annual revenue. Typically, 80% of the companies that Gartner analysts speak with have between 100 and 999 employees, and revenue of $100 million to $500 million (see "Gartner's Small and Midsize Business Market Definition, 2013 Update"). NOTE 2 UTM REVENUE DIFFERENTIATION Gartner does not include branch office firewall revenue as UTM revenue. The market size and growth are estimated compared with numbers from the previous UTM Magic Quadrant. EVALUATION CRITERIA DEFINITIONS Ability to Execute Product/Service: Core goods and services offered by the vendor for the defined market. This includes current product/service capabilities, quality, feature sets, skills and so on, whether offered natively or through OEM agreements/partnerships as defined in the market definition and detailed in the subcriteria. Overall Viability: Viability includes an assessment of the overall organization's financial health, the financial and practical success of the business unit, and the likelihood that the individual business unit will continue investing in the product, will continue offering the product and will advance the state of the art within the organization's portfolio of products. Sales Execution/Pricing: The vendor's capabilities in all presales activities and the structure that supports them. This includes deal management, pricing and negotiation, presales support, and the overall effectiveness of the sales channel. Market Responsiveness/Record: Ability to respond, change direction, be flexible and achieve competitive success as opportunities develop, competitors act, customer needs evolve and market dynamics change. This criterion also considers the vendor's history of responsiveness. Marketing Execution: The clarity, quality, creativity and efficacy of programs designed to deliver the organization's message to influence the market, promote the brand and business, increase awareness of the products, and establish a positive identification with the product/brand and organization in the minds of buyers. This "mind share" can be driven by a combination of publicity, promotional initiatives,

Upload: ao-cpe

Post on 20-Nov-2015

29 views

Category:

Documents


2 download

DESCRIPTION

Uni fi ed threat management devi ces provi de smal l and mi dsi ze busi nesses wi th mul ti pl e network securi tyfuncti ons i n a si ngl e appl i ance. Buyers shoul d focus on performance when many securi ty functi ons areenabl ed, and on the ski l l set of the associ ated channel partner

TRANSCRIPT

  • 3/3/2558 MagicQuadrantforUnifiedThreatManagement

    http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 1/12

    MagicQuadrantforUnifiedThreatManagement7August2014ID:G00261973

    Analyst(s):JeremyD'Hoinne,AdamHils,GregYoung

    VIEWSUMMARY

    Unifiedthreatmanagementdevicesprovidesmallandmidsizebusinesseswithmultiplenetworksecurityfunctionsinasingleappliance.Buyersshouldfocusonperformancewhenmanysecurityfunctionsareenabled,andontheskillsetoftheassociatedchannelpartner.

    MarketDefinition/DescriptionGartnerdefinestheunifiedthreatmanagement(UTM)marketasmultifunctionnetworksecurityproductsusedbysmallormidsizebusinesses(SMBs).Typically,midsizebusinesseshave100to1,000employees(seeNote1).UTMproductsmustcontinuallyaddnewfunctionsandthereforeencompassthefeaturesetofmanyothernetworksecuritysolutions,includingnextgenerationfirewall,secureWebgatewayandsecureemailgateway.Whileconsolidationcomeswithcompromisesinperformanceandcapability,thesearecompromisesthatmanySMBsarewillingtoaccept(see"WhatYouShouldExpectFromUnifiedThreatManagementSolutions").

    ManyUTMproductscontainvariousothersecuritycapabilities,suchaswirelessoptionsandmodularEthernetportdensity,and,lessfrequently,Webapplicationfirewall(WAF)anddatalossprevention(DLP)softwaremodules.ApplicationcontrolembeddedinUTMisoftenbasic,focusedonInternetapplications(Facebook,Googleapplications,YouTube)andlooselyintegratedwiththefilteringpolicythroughalistofapplicationsbundledinaprofileandattachedtothefilteringrule.ItisusedmostlytorestricttheuseofWebapplicationsandcloudservices(suchassocialmedia,filesharingandsoon).Featuresrelatedtothemanagementofmobiledevicescreateapotentiallyattractivedifferentiatorforthismarket(see"HowUnifiedThreatManagementTacklestheConsumerizationofIT").

    UTMappliancesareusedbymidsizebusinessestomeettherequirementsforsecureInternetconnectivity.Formanysmallbusinesses,thoserequirementsareoftendrivenbyregulatorydemands(suchasthePCIDataSecurityStandard),mandatingrudimentarylevelsofsecuritycontrols.Browserbasedmanagement,basicembeddedreporting,andlocalizedsoftwareanddocumentation,whichdon'tspecificallyappealtolargeenterprises,arehighlyvaluedbySMBsinthismarket.Gartnerseesverydifferentdemandsfromtheenterpriseandbranchofficefirewallmarkets(see"MagicQuadrantforEnterpriseNetworkFirewalls"),whichgenerallyrequiremorecomplexnetworksecurityfeatures,andareoptimizedforverydifferentselectioncriteria.

    Thebranchofficesoflargercompanieshaveverydifferentnetworksecuritydemandsfrommidsizebusinesses,eventhoughtheymaybeofsimilarsize.Gartnerviewsbranchoffices'firewallsasextensionsofthecentralfirewallstrategy(see"BringBranchOfficeNetworkSecurityUptotheEnterpriseStandard").Thisdriveslargeenterprisestooftenuselowendenterpriseproductsattheirbranchofficestoensureinteroperability,andtotakeadvantageofeconomiesofscaleingettinglargerdiscountsfromtheirfirewallvendors.Forthesereasons,Gartnerallocatesbranchofficefirewallrevenuetotheenterprisefirewallmarket,nottheUTMmarket.

    For2013,GartnerestimatesthattheUTMmarketgrewat14.1%toreachatotalofapproximately$1.54billion(see"MarketShareAnalysis:UnifiedThreatManagement(SMBMultifunctionFirewalls),Worldwide,2014Update"andNote2).

    ManyUTMvendors,whichputastrongfocusondistributedorganizationssuchasretail,ormanagedsecurityserviceproviders(MSSPs),arenowheadingtowardplacingthemanagementandmonitoringconsolesfullyinthecloud.Gartnerbelievesthat,althoughit'sconvenientforthevendorstodoso,aportionoftheSMBmarketwillnotacceptthisexclusivelycloudmodelforreasonsoflatency,andneedtoaccesstheconsolewhenunderattack.Insomeregionsandindustryverticals,limitedtrustinaforeignsupplierandotherprivacyconcernswouldbeadditionalreasonstoavoidthecloudmodel.Reportingandlogretentionarewellsuitedtothecloud,butnotexclusively.

    SMBsshouldbeskepticaloftheaspirationalmessagefromUTMvendorsabouttheexaggeratedbenefitsoffeatureconsolidation.SecuritybuyersshouldinsteadevaluateUTMdevicesbasedonthecontrolstheywillactuallyuse,theperformancetheywillgetforthosefeatures,andthequalityofvendorandchannel(andmanagedservices)supportthatisavailable.

    ThemarketfornetworkandsecuritysolutionsdesignedtoprotectSMBscontinuestodevelop,andourexpectationsforUTMtechnologyfeaturesincreasewitheachneweditionofthisMagicQuadrant.Asaresult,theMagicQuadrantdepictsashiftupandtotherightwitheachrevision.Consequently,vendorsmustprogresstomaintaintheirpositionsineachnewMagicQuadrant.

    MagicQuadrant

    STRATEGICPLANNINGASSUMPTIONS

    ReplacementofUTMbycloudoptionswillremainatlessthan5%through2016however,bythen,mostUTMdeviceswillleveragecloudassistedsecurityormanagementfeatures.

    By2016,15%ofSMBswillusemobilitymanagementcapabilitiesfromtheirUTMplatformstoenforcedistinctivepoliciesupfromlessthan5%today.

    NOTE1SMALLANDMIDSIZEMARKETDEFINITION

    GartnergenerallydefinesSMBsbythenumberofemployeesand/orannualrevenuetheyhave.Theprimaryattributethatisusedmostoftenisthenumberofemployees.Smallbusinessesusuallyhavefewerthan100employees,whilemidsizebusinessesareusuallydefinedascompanieswithfewerthan1,000employees.Thesecondaryattributethatisusedmostoftenisannualrevenue.Smallbusinessesareusuallydefinedasthosewithlessthan$50millioninannualrevenue,whilemidsizebusinessesaredefinedasthosewithlessthan$1billioninannualrevenue.Typically,80%ofthecompaniesthatGartneranalystsspeakwithhavebetween100and999employees,andrevenueof$100millionto$500million(see"Gartner'sSmallandMidsizeBusinessMarketDefinition,2013Update").

    NOTE2UTMREVENUEDIFFERENTIATION

    GartnerdoesnotincludebranchofficefirewallrevenueasUTMrevenue.ThemarketsizeandgrowthareestimatedcomparedwithnumbersfromthepreviousUTMMagicQuadrant.

    EVALUATIONCRITERIADEFINITIONS

    AbilitytoExecuteProduct/Service:Coregoodsandservicesofferedbythevendorforthedefinedmarket.Thisincludescurrentproduct/servicecapabilities,quality,featuresets,skillsandsoon,whetherofferednativelyorthroughOEMagreements/partnershipsasdefinedinthemarketdefinitionanddetailedinthesubcriteria.

    OverallViability:Viabilityincludesanassessmentoftheoverallorganization'sfinancialhealth,thefinancialandpracticalsuccessofthebusinessunit,andthelikelihoodthattheindividualbusinessunitwillcontinueinvestingintheproduct,willcontinueofferingtheproductandwilladvancethestateoftheartwithintheorganization'sportfolioofproducts.

    SalesExecution/Pricing:Thevendor'scapabilitiesinallpresalesactivitiesandthestructurethatsupportsthem.Thisincludesdealmanagement,pricingandnegotiation,presalessupport,andtheoveralleffectivenessofthesaleschannel.

    MarketResponsiveness/Record:Abilitytorespond,changedirection,beflexibleandachievecompetitivesuccessasopportunitiesdevelop,competitorsact,customerneedsevolveandmarketdynamicschange.Thiscriterionalsoconsidersthevendor'shistoryofresponsiveness.

    MarketingExecution:Theclarity,quality,creativityandefficacyofprogramsdesignedtodelivertheorganization'smessagetoinfluencethemarket,promotethebrandandbusiness,increaseawarenessoftheproducts,andestablishapositiveidentificationwiththeproduct/brandandorganizationinthemindsofbuyers.This"mindshare"canbedrivenbyacombinationofpublicity,promotionalinitiatives,

    http://www.gartner.com/technology/contact/bac/http://www.gartner.com/technology/contact/bac/?cm_sp=bac-_-reprint-_-banner

  • 3/3/2558 MagicQuadrantforUnifiedThreatManagement

    http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 2/12

    Figure1.MagicQuadrantforUnifiedThreatManagement

    Source:Gartner(August2014)

    VendorStrengthsandCautionsAkerSecuritySolutionsBasedinBrazil,AkerSecuritySolutionsisanetworksecurityvendor.ItsportfoliohasincludedUTMsolutions(AkerFirewallUTM)since1997,aswellassecureWebgatewayandsecureemailgateway.AkerFirewallUTMiscomposedof14models,withtwomodelswithwirelesscapabilities.ItcanalsorunasavirtualapplianceonVMware,CitrixXenandMicrosoftHyperV.

    Inthepast12months,AkerreneweditsentirehardwareapplianceproductlineandaddedKasperskyAntiVirusasanoption.

    AkerFirewallUTMisagoodshortlistcandidateforsmallandmidsizeorganizationsinBrazil.

    Strengths

    AkerFirewallUTMprovidesacomprehensivesetofUTMfeatures,includingapplicationcontrol,wirelesssecurity,SSLVPN,andtwochoiceseachforanantivirusengineandanintrusionpreventionsystem(IPS)signatureset.

    AkerprovidesarentaloptionforitsUTMappliances,whichreducescapitalexpenditure(capex)costs.

    Aker'sclientsanditschannelpartnersvaluetheavailabilityof24/7vendorsupport.

    Akerisoneofthefewvendorsthatprovidegraphicaluserinterface(GUI),documentationandsupportinPortuguese.

    Cautions

    AkerFirewallUTMlacksalowendappliance(lessthan$1,000)thatcouldbecosteffectiveforsmalloffices.

    AkerdoesnotprovideanembeddedWebinterface,butinsteadalwaysrequirestheinstallationofamanagementsoftwarecomponent(AkerControlCenter).Clientsreportthatinstallationcouldbeeasier.

    AkerisnotvisibleinclientshortlistsoutsideofBrazil,andisnotreadyforinternationalizationyet.

    BarracudaNetworksBasedinCampbell,California,BarracudaNetworksisalargevendorprovidingnetworksecurity,backupandinfrastructuresolutions,including,amongotherthings,Webandemailsecurity,Webapplicationfirewall,anddatabackup.IthasastrongfocusonSMBs,butuntilrecentlywaslackingadedicatedUTMoffering.InFebruary2013,Barracudareleasedanewproductline,theBarracudaFirewall(Xseries),tocomplementBarracudaNGFirewall(Fseries),itsincumbentrangeoffirewalls,whichareorientedtowardlargerenterprises'needs.BarracudaFirewalliscomposedofsevenmodels,includingtwowithwirelesscapabilities,butisnotavailableyetasavirtualappliance.ItembedsaWebinterface,designedforsimplerusecases,andleveragesclouddatabasesandenginesforkeycontentfiltering.

    Attheendof2013,Barracudaexecutedaninitialpublicoffering(IPO).Inthepastfewmonths,it

    thoughtleadership,wordofmouthandsalesactivities.

    CustomerExperience:Relationships,productsandservices/programsthatenableclientstobesuccessfulwiththeproductsevaluated.Specifically,thisincludesthewayscustomersreceivetechnicalsupportoraccountsupport.Thiscanalsoincludeancillarytools,customersupportprograms(andthequalitythereof),availabilityofusergroups,servicelevelagreementsandsoon.

    Operations:Theabilityoftheorganizationtomeetitsgoalsandcommitments.Factorsincludethequalityoftheorganizationalstructure,includingskills,experiences,programs,systemsandothervehiclesthatenabletheorganizationtooperateeffectivelyandefficientlyonanongoingbasis.

    CompletenessofVisionMarketUnderstanding:Abilityofthevendortounderstandbuyers'wantsandneedsandtotranslatethoseintoproductsandservices.Vendorsthatshowthehighestdegreeofvisionlistentoandunderstandbuyers'wantsandneeds,andcanshapeorenhancethosewiththeiraddedvision.

    MarketingStrategy:Aclear,differentiatedsetofmessagesconsistentlycommunicatedthroughouttheorganizationandexternalizedthroughthewebsite,advertising,customerprogramsandpositioningstatements.

    SalesStrategy:Thestrategyforsellingproductsthatusestheappropriatenetworkofdirectandindirectsales,marketing,service,andcommunicationaffiliatesthatextendthescopeanddepthofmarketreach,skills,expertise,technologies,servicesandthecustomerbase.

    Offering(Product)Strategy:Thevendor'sapproachtoproductdevelopmentanddeliverythatemphasizesdifferentiation,functionality,methodologyandfeaturesetsastheymaptocurrentandfuturerequirements.

    BusinessModel:Thesoundnessandlogicofthevendor'sunderlyingbusinessproposition.

    Vertical/IndustryStrategy:Thevendor'sstrategytodirectresources,skillsandofferingstomeetthespecificneedsofindividualmarketsegments,includingverticalmarkets.

    Innovation:Direct,related,complementaryandsynergisticlayoutsofresources,expertiseorcapitalforinvestment,consolidation,defensiveorpreemptivepurposes.

    GeographicStrategy:Thevendor'sstrategytodirectresources,skillsandofferingstomeetthespecificneedsofgeographiesoutsidethe"home"ornativegeography,eitherdirectlyorthroughpartners,channelsandsubsidiariesasappropriateforthatgeographyandmarket.

    http://www.aker.com.br/https://www.barracuda.com/

  • 3/3/2558 MagicQuadrantforUnifiedThreatManagement

    http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 3/12

    expandedtheBarracudaFirewallproductrangestowardsmallerofficesandaddedsoftwarefeaturestoeasetheinstallationprocess.

    TheBarracudaFirewallseriesisagoodshortlistcandidateforSMBsthatalreadyuseotherBarracudaproducts,haveanexistingtrustfulrelationshipwithresellersofBarracudasolutionsorhavestringentbudgetconstraints.

    Strengths

    BarracudahasstrongmarketshareamongSMBs,andcustomersbenefitfromgoodglobalsalesandsupportpresence,especiallyinEurope.

    Gartnerclientsreportthattheylikethesimplelicensing,andthatunlikemanycompetitors,thepriceforsoftwareoptionsisreasonable.

    BarracudaNetworksoffersa30dayrefundplanandareplacementprogramthatincludesanewapplianceeveryfouryears.

    Cautions

    TheBarracudaXSerieswasonlyrecentlyreleasedsomeintegratedmodulesandthecloudbasedcentralizedmanagementareyetunproven.Barracuda'schannelisunevenlytrainedonthesolutioninsomeregions.

    TheBarracudaXSerieshasnotbeenscrutinizedbyanymajorthirdpartytestinglabsandhasalimitednumberofcertifications.

    Gartnerbelievesthat,whileBarracudahascorrectlyassessedthatSMBandenterprisehavedifferentneeds,customersandchannelpartnerscouldbeconfusedbecausethetwofirewalllineshavemoreoverlapsthandifferences.

    CheckPointSoftwareTechnologiesCheckPointSoftwareTechnologies,withheadquartersinTelAviv,Israel,andSanCarlos,California,isoneofthelargestpureplaysecuritycompanies,andhasbeenpresentinthesecuritymarketformorethan20years.Initiallyexclusivelyfocusedonenterprises,CheckPointhaslaterinvestedintheUTMsegment,specificallytargetingSMBusecases.ItsSMBproductlineincludes11appliances,includingwirelessandDSLmodels.UTMcanalsobedeliveredasavirtualapplianceoronAmazonWebServices(AWS).FundamentaltoCheckPointfirewallofferingsisthesetofsoftwareoptionsreferredtoasSoftwareBladesthatcanbegroupedtogetherinbundles.

    OncethehardwareandOSconsolidationworkwasachievedin2013,CheckPointmoveditseffortsbacktonewthreatpreventionfeaturesandperformanceimprovements.Ithasalsorecentlymadeavailableamarketplaceofthreatfeedsfromthirdpartiesthatitsclientscanpurchaseseparatelyassoftwareoptions(ThreatCloudIntelliStore).

    CheckPointisagoodchoiceforSMBorganizationsthatdonotconsiderlowpriceasthemostimportantcriterion.

    Strengths

    CheckPoint'sreportingandmanagementconsoleisconsistentlyhighlyratedbymidsizecompanies.CheckPointmanagedtosimplifyitsmanagementconsoleforitsentrylevelapplianceswithoutcompromisingtheflexibilityanddepthofprotection.

    CheckPoint'sUTMsolutionsbenefitfromitsenterpriselevelsecurityfeatures,suchasThreatCloudandAntiBotsoftwareoptions,inadditiontothestrongIPSmodule,whichareallbackedupbyCheckPoint'slargethreatresearchteam.

    CheckPointprovidesanoptionforsandboxing(ThreatEmulation),andrecentlyreleasedacloudbasedsecurityserviceformobileandremoteusers,inadditiontohavingexistingpartnershipswithmobiledevicemanagement(MDM)solutions.

    CheckPointisastrong,stableorganizationwithaconsistentstrategyandprovenabilitytoexecuteonitsroadmap.

    Cautions

    GartnerseesCheckPointmostlysellingtoitsexistingbaseofdistributedenterprises,butitdoeslagbehindotherLeadersinbuildingadedicatedchannelofpurelySMBresellers.

    GartnerclientsoftencitepriceastheprimaryreasonfornotselectingCheckPointsolutions.

    GartnerSMBclientsreportthatthequalityofLevel1supportfromchannelvaries,andGartnerhasobservedthatSMBcustomerproblemescalationstakemoretimetoresolvethanthosefromlargeenterprisecustomers.

    CheckPointoffersmanySoftwareBladesandkeepsaddingnewones.Ithasmadegoodprogressinsimplifyingthesalesofferingwithbundles,butresellersandclientsreportthattheyfinditdifficulttoassesstheoverallimpactofenablingmorethanafewoptionssimultaneously.

    CiscoCisco,basedinSanJose,California,isthelargestnetworkinfrastructureprovider.Foralongtime,ituseditsglobalpresencetocrosssellsecuritysolutionstoitsexistingcustomerbase.Cisconowdedicatesrenewedeffortstotheenterprisesecuritymarket,withtheacquisitionofSourcefirein2013,andfocusesonsecurityfordistributedSMBswithcloudmanagedMerakiMXappliances(sevenmodels).ItsportfoliostillprovidetheISA500Seriesforsmallbusinesses(fourmodels,includingtwowithwirelesscapabilities),andtheASA5500XSeriesformidsizecompanies(fivemodels).CiscoAdaptivitySecurityAppliance(ASA)isalsoavailableasavirtualappliance(ASAv).Inadditiontothededicatedsecuritysolutions,Ciscohasalargeportfolioofnetworksolutionsthatcanprovidesecurityfeatures,suchasIntegratedServicesRouters(ISRs).

    Duringthepast12months,CiscopredominantlypromotedandimproveditsMerakiMXproductlinewiththeintegrationofSourcefireIPSandtheadditionofuseridentityfilteringcapabilities.

    http://www.checkpoint.com/http://www.cisco.com/

  • 3/3/2558 MagicQuadrantforUnifiedThreatManagement

    http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 4/12

    CiscoisagoodchoiceforexistingSMBcustomersusingotherCiscotechnology,andfordistributedorganizationsinNorthAmerica.

    Strengths

    Cisco'sGartnercustomersgenerallyofferpositivereviewsofCiscohardwarerobustness.

    ThelearningcurveforCiscotrainedstaffonitssecuritytechnologyisshort,especiallyforcustomersalreadyfamiliarwiththeCiscocommandlineinterface.

    CiscoMerakiMXincludescontextualfeedsfromSourcefire,integratedWiFi/4Gmanagement,andintegrationwithMDMsolutionsformobileusers.

    CiscoMerakiMXcloudbasedcentralizedmanagementoffersaunifiedviewformanagingUTMs,Meraki'swirelessAPandswitches.CustomerscancreateconfigurationtemplatestoaddnewlocationsandtocreatesitetositeVPNmoreeasily.

    Cautions

    CiscoMerakiMXlacksemailsecurity,SSLVPNforremoteusersandSSLdecryptionforHTTPthatareavailableinmanyofitscompetitors'UTMs.

    Cisco'sdualproductlinestrategyfortheUTMmarketmightcreatecomplexityforsomeclientsthatcouldleveragetheirCiscoknowledgewithCiscoASAonthecorenetwork,butcouldalsobenefitfromsomeoftheMerakiMXfeaturesfordistributedoffices.

    CiscodoesnotgeneratemanyinquiriesfromSMBclients,andwhenitdoes,itisoftentheincumbentsolutionthatisconsideredforreplacement.

    ClavisterClavister,headquarteredinSweden,primarilytargetsenterprisesandISPswithitsappliancesandcloudservices.ThevendoraddressesSMBsthroughitsbrandedsecurityappliances,theEagleSeriesandtheWolfSeries,thatcanbedeliveredasvirtualappliances,too.Itsoperatingsystem(cOS)isprovidedeitherasafullfledgedsoftwarestack(cOSCore)orasastreamlinedversionfocusedonnetworkneeds(cOSStream).ClavisteralsooffersadedicatedportaltoMSSPsforthemanagementofitsUTM.

    In2014,thecompanyappointedanewCEOandshifteditsstrategyevenmoretowardtelecomoperatorswithLTEcellsecurity.InMay2014,ClavisterenteredtheStockholmstockmarket.

    ClavisterisagoodshortlistcandidateformunicipalitiesanddistributedpublicadministrationinNorthernEurope,orfororganizationinneedofruggedUTMappliances.

    Strengths

    ClientsciteveryfunctionalsecuritymodulesandqualityvendorsupportasreasonforremainingfaithfultoClavister.

    TheISO9001:2008certificationandatwoyearstandardreturnandrepairwarrantyappealtospecificmidsizeverticalindustriesortoclientsthathaveexperiencedhardwareissueswithotherUTMprovidersinthepast.

    TheClavisterX8seriesofruggedappliancesisagoodalternativefororganizationsfromspecificverticalindustries,suchasdefense,orwhentheexternalconditionswheretheUTMapplianceneedstobelocatedareadverse.

    Cautions

    WhileClavistercontinuestoservetheSMBmarketwithsoftwarefeaturesthatweredevelopedinthepast,itscurrentgotomarketapproachisnowprimarilyfocusedoncarrierandenterpriseneeds.

    Clavister'ssales,supportandchannelpartnerresourcesarefocusedpredominantlyonNorthernEurope,andmightbeunevenlyavailableforcustomersfromotherregions.

    ClavisterrarelyappearsonGartnerclients'shortlists.

    CyberoamBasedinIndia,Cyberoam,nowaSophoscompany,isapureplayvendorfortheUTMmarket,primarilyfocusingonSMBsandattemptingtoexpandtolargerenterprises.Cyberoamprovides18differentUTMhardwaremodelsandfivevirtualappliances.CyberoammarketsitsLayer8useridentitycontrolfeaturesasakeydifferentiatortootherUTMproducts,andovertheyearsithasbuiltseveralfeaturesleveragingthisconcept.

    InFebruary2014,CyberoamwasacquiredbySophos.ThecompanyannouncedthatCyberoamwouldcontinuetosellitsUTMproductlinewithoutanyshorttermdisruption.RecentCyberoamupdatesincludefeaturestargetingtheindustrialsecurityusecase.

    CyberoamisagoodchoiceforSMBorganizationsintheAsia/PacificandMiddleEastregions.SMBbuyersfromotherregionsshouldfirstevaluatelocalchannelexpertiseonUTMandcustomerreferenceswithsimilarusecases.

    Strengths

    Cyberoaminvestsheavilyonitschannel,providesacomprehensiveknowledgebase,andallowsdirectaccesstochatandphonesupportforitspartnersthatshouldoftenbetranslatedintoquickresolutionofsupportissuesforitsclients.

    Cyberoamconsistentlyexecutesonitsroadmap.

    Cyberoamincludesmatureembeddedreportinganduseridentitycontrolsthatareattractivetomidsizeorganizations.

    Cyberoam'sfilteringpolicyembedsdownloadanduploadstatisticsforeachrule,whichhelpsdetermineduplicateandunusedrules.ItalsoprovidesaflexiblewaytorestrictrecreationalInternetusagewiththeabilitytosetupquotasforusersorgroupsofusers.

    http://www.cyberoam.com/http://www.clavister.com/

  • 3/3/2558 MagicQuadrantforUnifiedThreatManagement

    http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 5/12

    Cautions

    CyberoamhaslowvisibilityintheAmericasandappearslessoftenthanleadingUTMvendorsinEuropeincompetitiveshortlistsfromGartnerclients.

    Gartnerbelievesthat,whilenomajorchangehasbeenobservedyet,Cyberoam'schannelmightsufferinthefuturefromtheoffensivepostacquisitionmessagingfromcompetitioninEuropeandintheU.S.,andmightbechallengedinitshomecountrybylocalUTMvendors.Thiscouldtranslateinlocalsupportdisruptionsifsomechannelpartnersswitchtootherbrands.

    SMBclientsshouldfirstobtainclarificationfromCyberoamonoverlapsbetweenSophosandCyberoam'sUTMproductlines.

    DellDell,withheadquartersinRoundRock,Texas,isaleadingcomputermanufacturerthathasdiversifieditsactivityininfrastructureandsecurity.ItsUTMportfolioisbrandedDellSonicWALLandincludes13models.ItiscomposedoftwoproductlinesthataresoldtotheSMBmarket:theSonicWALLTZSeriesforthesmallestbusinessesandtheSonicWALLNSASeriesforsmallandmidsizecompanies.Despitetherecentchangeinname,Dell'sUTMproducthasbeenonthemarketforalongtime,andbenefitsfromextendedsalesandsupportchannels.DelltargetstheenterprisemarketwithitsSonicWALLSuperMassiveSeries.Dellalsoprovidesothernetworksecuritysolutions,suchasSSLVPNandemailsecuritygateway.

    DellisagoodshortlistcandidateforU.S.basedSMBsandforcurrentDellcustomersinotherregions.

    Strengths

    DellSonicWALLTZappliancescontinuallygetgoodscoresfromsmallorganizationsfortheirabilitytocombinesecuritymodulesandwirelessconnectivity,inadditiontoothernetworkfeatures.

    ClientsreportthatlowpriceandacomprehensivesetoffeaturesaredifferentiatorsforDellSonicWALLincompetitiveevaluations.

    Dellleveragesitsbroadlogisticalcapabilitiestoassistwithdeploymentsinvolvingmultiplegeographies.

    Dellcontinuestoinvestinitssecuritydivisions,andDellSonicWALLhasasubstantialR&Dteam,includingalargeinhousesecuritylabthatcreatesallitsIPSsignatures.

    Cautions

    Dell'sroadmapforthepast24monthsdemonstratesaswitchinprioritytowardenterpriseusecaseattheexpenseofSMBneedsforconsolidatednetworkandsecurityfeatures.

    GartnerhasobservedthatsincetheacquisitionofSonicWALLbyDell,manyUTMvendorsexploitDell'srecentmarketfocusswitchandaggressivelytargetDell'sresellersandgivethemstrongincentivetoswitch.ClientscouldbeaffectedbyachangingrelationshipbetweentheirlocalchannelpartnerandtheUTMtechnologyvendor.

    DellstillholdsagoodshareoftheUTMmarket,buttheDellSonicWALLproductlineappearsmuchlessofteninrecentUTMshortlists.

    Gartnerclientsreportthatthemanagementinterfacecanbeconfusingbecauseoftoomanyavailableoptions.

    FortinetFortinetisalargesecurityvendorwithheadquartersinSunnyvale,California.Itoffersmorethan40differentUTMappliancemodels(FortiGate)aimedatthesmallandmidsizemarket,includingwireless,DSLandPOEversions.FortiGateisalsoavailableasavirtualappliancewithfivemodelsthatarepricedbasedonCPUcorecount.Onpremisescentralizedmanagement(FortiManager)andreporting(FortiAnalyzer)solutionscomplementtheUTMoffering.Thecomprehensivesecurityproductportfolio,composedoftokensandhostagents(FortiClient),isdesignedtoappealtoVARsandMSSPsastheroutetosales.

    Fortinet'sroadmapcontinuestobedrivenbyregularhardwareandsoftwareupdates,with10newFortiGateappliancesin2013andalready12modelsin2014.FortinetalsomadeFortiGate,FortiManager,FortiAnalyzerandFortiWebavailableontheAWSplatform.ItwasalsooneofthefirstvendorstoofferfilesandboxingonaUTM.

    FortinetisagoodcandidateforeveryorganizationinneedofaUTM.

    Strengths

    FortinetcontinuestobeahighlyvisibleUTMprovideramongGartnerclients.Italsoownsthelargestmarketshare,growingfasterthanthemarketaverage,andhasthelargestbaseofcertifiedchannelpartnersforUTMtechnology.

    FortinethasaverylargeR&Dteamandsupportcentersacrossallregions.GartnercontinuestoviewFortinetassettingthecadenceintheUTMmarket,drivingitscompetitorstoreact.

    FortiGateintegratesfilesandboxingcapabilities,backedupbythelargeFortiGuardLabsthreatresearchteam.

    Fortinetprovidesaveryaggressiveprice/performanceproposition,whichisoftenadecisivefactorforbudgetconstrainedSMBs.

    Thecombinationofwirelessaccesspointmanagement,WiFianalytics,highportdensityandpoweronEthernetalongwiththeavailabilityofpricecompetitiveUTMappliancesappealstosmallbusinesseslookingformorethanasecuritygateway,aswellastodistributedretailorganizations.

    Cautions

    ThefrequenthardwareandsoftwareupdatesmakeitmoredifficulttomaintainaconsistentlevelofexpertiseacrossFortinet'swidelydistributedchannel,whichsometimescausesdiscrepanciesinpresalesandsupportquality.

    http://www.dell.com/http://www.fortinet.com/

  • 3/3/2558 MagicQuadrantforUnifiedThreatManagement

    http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 6/12

    GartnerclientsreportissuesrelatedtoFortinetUTMregardingtheusabilityoftheFortiManagercentralizedmanagement,orbecauseoflowerthanexpectedperformancewhenenablingsecurityfeatures.

    Fortinethasnotyetinvestedasmuchassomeofitsdirectcompetitorsinitsnativecloudbasedcentralizedmanagementandreporting(FortiCloud).Whilemarketneedshavenotfullyformed,thiswillproveacompetitivedisadvantageiftheresellersandMSSPsstarttousecloudmanagementasastandardplatform.

    gateprotectGermanybasedgateprotectisapureplaysecurityvendor.ItsUTMportfolioincludesnineappliances.Virtualappliancesandcentralizedmanagementarealsoavailable.Gateprotect'smanagementinterface(eGUI)implementsagraphical(iconbased)visualizationofthenetworktopologyasawaytosimplifytheconfigurationofthesecuritypolicy.InJuly2014,gateprotectwasacquiredbyRohde&Schwarz,alargeGermanelectronicsgroup.

    Gateprotectrecentlyreleasedanapplianceforsmalloffices(GPO110),includingwirelessoptionsandaddedapplicationandendpointcontrolfeatures.

    Gateprotectisagoodshortlistcandidateforsmallorganizations,especiallyinEurope.

    Strengths

    Gateprotect'seGUIprovidessmallanddistributedorganizationswithasimplifieddeploymentexperience.

    GateprotectmakesastronginvestmentinR&Dforavendorofitssize.

    Clientsreportthattheycangetquickanswersfromvendorsupportwhenneeded.

    GateprotectisgrowingquicklyinLatinAmericaandSouthernAfrica.

    Cautions

    Gateprotecthasasloweroverallgrowththanmostofitsdirectcompetitors.ItsresultsstillpredominantlydependonthematuremarketofsmallandlowermidsizeorganizationsinGermany.

    Gateprotecthaslimitedcoveragefromindependenttestinglabs.

    Layer7applicationcontrolisnotfullyintegratedinthecoreviewofthegraphicalsecuritypolicyrepresentation,butattachedasaprofile.

    HillstoneNetworksHillstoneNetworksisapurenetworksecurityplayer,withheadquartersinBeijingandoperationsinSunnyvale,California.ItsUTMportfolioincludes12hardwaremodels(theMSeries).Virtualappliancesarenotavailable,buttheUTMsoftwarecanbedeployedonanopenstackenvironment.HillstonedoesnotyetofferavirtualUTMappliance,butseveralinstancesofUTMscanruninasinglephysicalchassis.Hillstonealsoprovidesarangeoffirewalls(theXSeries)thatisspecializedforthedatacenterusecase

    RecentsoftwareupdatesincludedimprovementsonVPN,authenticationandnetworkfeatures.

    HillstoneisagoodshortlistcandidateforSMBorganizationsintheAsia/Pacificregion.Organizationsfromotherregionsshouldfirstcheckthelocalchannelandvendorpresences.

    Strengths

    Hillstone'sUTMincludeshostreputationandnetworkmonitoringfeaturesthatcanhelpdetectinfectedhosts.

    ClientsreportthattheUTMmaintainsexpectedperformancewhenrunningmultiplesecuritymodules.

    Asapureplaynetworksecurityvendor,HillstoneNetworkshasagoodhistoryofexecutingonitsroadmap,whichgivescredibilitytoitsannouncementsonfutureimprovements.

    Cautions

    Hillstonetargetsprimarilythelargeenterprisemarket.ItlagsitscompetitorsinautomatedactivityreportsforSMBorMSSPoperationteams.

    HillstoneNetworksisnotvisibleinUTMcompetitiveshortlistsoutsideofChina.HalfofHillstone'srevenuecomefromdirectsales,andthevendorhasyettobuildaninternationalchannelofactiveUTMresellers.

    HuaweiHuaweiisalargenetworkinfrastructuresupplierheadquarteredinShenzhen,China.In2009,HuaweilauncheditsUnifiedSecurityGateway(USG)productline,whichnowiscomposedof24models,includingalargenumberofapplianceswithwirelesscapabilities,toaddresstheSMBmarket.Centralizedmanagementsoftwareisavailable.LargeUTMappliancescanrunseveralUTMsoftwareinstances,butthevendordoesnotprovidevirtualUTMappliancestorunonthetopofleadinghypervisors.

    Recentupdatesincludenewhardwaremodels,aproprietaryVPNmode(DSVPN)andSSLdecryption.

    Huawei'sUTMisagoodcontenderforSMBsinChina,andforitscurrentlargeenterprisecustomersinothercountries.

    Strengths

    HuaweiUTMhasagoodmixoflocalcertificationsandindependenttestsfromlargeinternationallabs.

    Clientsoftencitegoodprices,especiallyforsupportservice,asadecisivefactorinselectingHuawei'ssolutions.

    http://www.hillstonenet.com/http://www.gateprotect.com/enhttp://www.huawei.com/

  • 3/3/2558 MagicQuadrantforUnifiedThreatManagement

    http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 7/12

    HuaweihasalargenumberofclientsusingIPv6.

    Cautions

    Likemostinfrastructurevendors,Huawei'sleverageisinitsexistingcustomerbaseoflargeenterprisesandcarriers.ThisfocusonothermarketsmightdivertdevelopmentprioritiesawayfromSMBneeds.

    HuaweisellsamajorityofitsUTMinChinaandstrugglestogrowmarketshareoutsideofAsia/Pacific.SMBcustomersshouldfirstassessthelevelofcommitmentofHuawei'slocalchannelpartnerstotheSMBmarket.

    JuniperNetworksJuniperNetworksisanetworkinfrastructurevendorbasedinSunnyvale,California.Ithasabroadportfoliothatcoversnetworkandsecuritysolutions.ItsUTMoffering(SRXSeries)includes13modelsandreliesontheJunosOS,whichisthecommonplatformfornetworkandsecurityappliancesinJuniper'sportfolio.OtherproductlinescansupportUTMcapabilities(SSGSeriesandISGSeries),andtwovirtualappliancesareavailable.

    Juniperrecentlyannouncedaunifiedcentralizedmanagementandreportingsolution,improvedapplicationcontrolengineandsimplifiedusersinglesignon.

    JuniperUTMisagoodchoiceforexistingJunipercustomers.OtherSMBcustomersshouldfirstverifytheexperienceoftheirlocalchannelwithJunipersecuritysolutionsforanSMBusecase.

    Strengths

    UTMbuyersthatalreadyuseJunipertechnologycanleveragetheirexistingrelationshipwiththevendortogetalowerpriceandquicklylearnhowtomanageitsUTM.

    Juniperhasabroadrangeofhardwareappliancestosupportawidevarietyofscalabilityandperformancerequirements.

    Juniper'sunderstandingofdiversecustomerenvironmentsmakesitagoodchoiceforcomplexnetworkinfrastructureorwhensupportisacriticalcomponentofthepurchasedecision.

    Cautions

    JuniperrarelyappearsonGartnerSMBcustomershortlistsforUTM.

    RecentstaffcutsinJunipersecurityteamsmightdivertevenmoreofitsresourcesfromtheSMBmarket.

    Exceptforthesupportofnewhardwaremodels,JuniperhasnotreleasednewfeaturesprimarilytargetingSMBinthepast12months.

    SophosBasedinBoston,Massachusetts,andOxford,U.K.,Sophosisalargesecurityvendorthatinitiallyprovidedendpointsecuritybeforeaddingnetworkandmobilesecuritysolutionstoitsportfolio.TheSophosUTMportfolioincludes11models(theSGSeries).SophosUTMisalsoavailableasavirtualapplianceonAWS,withaconsistentcustomerbase.ItalsooffersitsRemoteEthernetDevice(RED)appliancesforsmallbranchesthatarecentrallymanagedusingaSophosUTM.

    Inrecentmonths,SophosacquiredCyberoam,anotherUTMvendor(reviewedearlierinthisresearch),startedahardwareappliancesrefreshandreleasedversion9.2ofitsUTMsoftware,whichincludescloudbasedsandboxing,automatedemailencryptionandintegrationwithSophos'MDMproduct.

    SophosisagoodUTMshortlistcontenderforSMBs,especiallyinEuropeandJapan,andforcurrentSophoscustomers.CustomersoutsideoftheseregionsshouldverifytheexperienceofthelocalchannelfortheselectedUTMtechnology.

    Strengths

    Sophos'easeofuseconsistentlyrateshigh.Theinterfacecontainsgeneralguidanceonwhateachfeaturedoes,whichisusefulforSMBoperators,whoarenotallsecurityexperts.

    SophosshowscommitmenttotheUTMmarketwithtworecentacquisitionsandstrongmarketingandR&Dinvestment.

    Sophos'UTMcommunityofresellersandclientsremainsfaithfultothebrandandcontributestoregularspotonimprovementsofthetechnology.

    SophossupportisavailableinavarietyofEuropeanlanguages,anditslocalpresaleandsupportpresencereceivedpositivescoresfromGartnercustomers.

    Cautions

    TheintegrationofCyberoam'stechnologywillbethemainchallengeforSophosduringthenext24months.Gartnerbelievesthat,despitesomesynergies,managingsignificantoverlapsinUTMproductportfolioscouldbedifficultforSophos'channel.

    SophosUTM'suseridentityintegrationandvoiceoverIP(VoIP)managementlagbehindsomeofitsdirectcompetition.

    ExceptforGermanyandtheU.K.,SophosisnotasvisibleinGartnerclientinquiriesasotherLeaders.

    StormshieldFrancebasedStormshieldisasubsidiaryofAirbusDefenceandSpace,andtheresultofanoperationalmergerbetweentwoFrenchfirewallvendorsin2013(ArkoonandNetasq).InadditiontofirewallsandUTM,thevendorprovidesendpointanddatasecuritysolutions.ItsUTMproductline(StormshieldNetworkSecurity)ismadeofnineappliances,andsevenvirtualappliances,andisalsoavailableonAWS.StormshielddevelopeditsownIPS,whichisenabledinthedefaultUTMconfiguration.

    http://www.juniper.net/http://www.stormshield.eu/enhttp://www.sophos.com/

  • 3/3/2558 MagicQuadrantforUnifiedThreatManagement

    http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 8/12

    Recentchangesincludethebrandingupdate,tunnelbasedSSLVPN,significantimprovementsintheURLfiltering,embeddedreportsandlogviewer,andsinglesignonauthenticationmodules.

    StormshieldisagoodUTMcontenderforSMBsinEuropeandtheMiddleEast.Otherregionsshouldfirstmonitortheavailabilityandexperienceofthelocalchannel.

    Strengths

    Stormshieldhasasimpleserviceofferingwithtwomainbundles:alowcostbundleandapremiumbundlethatincludesKasperskyAntiVirusandvulnerabilitydetectionmodules.

    Customersliketheeaseofinstallation,theintegratedrulecollisionmechanism,andtheavailabilityoflocalandglobalcertifications.

    Stormshield'scustomerswilleventuallybenefitfromthelargerscaleandgreaterresourcesofthecombinedentity.ThevendorisstartingtobeseenasagrowingcompetitivethreatbyotherUTMvendorsinEurope.

    Cautions

    Despitelongtimeefforts,StormshieldhasnotmanagedtotakesignificantmarketshareoutsideofFrance.EuropeisamuchmorefragmentedmarketthanNorthAmericaorotherregionswithlargecountries,andassuch,requiresstronginvestmentforeachnewtargetedcountryoutsideofthevendor'shomemarket.

    GartnerhasobservedthattheStormshieldmarketingmessageandannouncedroadmapshiftedfromSMBstowardlargeenterprisesjustafterthemerger,andthatroadmapexecutionstalledforafewmonths.ThelatestversionsnowtargetSMBclients,butSMBbuyersshouldrequirevisibilityregardingfutureroadmapdevelopments.

    StormshieldUTMlackstheabilitytoapplyqualityofservice(QoS)rulesbasedonapplicationdetection.

    WatchGuardSeattlebasedWatchGuardisawellestablishedUTMvendor.ItprovidesUTM,secureemailgatewaysandremotemanageablewirelessAPs.TheUTMproductlines(XTMandFirebox),include19physicalappliances,includingthreeapplianceswithembeddedwirelesscapabilitiesandfourvirtualappliances.

    WatchGuardrecentreleasesincludeanewcloudbasedreportingandmonitoringsolution(WatchGuardDimension),aDLPaswellascloudbasedsandboxingmodules,andwirelessaccesspointmanagement.

    WatchGuardisagoodshortlistcandidateforSMBorganizationsinneedofabroadsetoffeaturesorrelyingonanMSSPformanagingandmonitoringtheirUTM.

    Strengths

    WatchGuardprovidescloudbasedsandboxing(APTBlocker),andreportsaredirectlyintegratedinitscentralizeddashboardcloudservice(WatchGuardDimension).

    WatchGuard'scustomersindicatethatcompletenessoffeaturesandlowpricearereasonstoselectWatchGuard.

    WatchGuardhasdemonstratedastrongabilitytoexecuteonitsroadmap,leveragingitsplatformmodularitytoquicklyaddnewmodules.

    TheWatchGuardDimensionreportingtoolincludesaninteractiveheatmapview(FireWatch)thatisusefultoquicklyidentifynetworkissuescreatedbyaspecificuserorapplication.

    Cautions

    WatchGuardappearsmorerarelyinGartnerclientshortlistsformidsizeordistributedorganizationsthanitsdirectcompetitors.

    GartnerdoesnotseeWatchGuarddisplacingotherLeadersbasedontechnicalrequirements.

    ClientsreportthattheonpremisescentralizedmanagementconsoleforWatchGuardUTMscouldbeimproved.

    VendorsAddedandDroppedWereviewandadjustourinclusioncriteriaforMagicQuadrantsandMarketScopesasmarketschange.Asaresultoftheseadjustments,themixofvendorsinanyMagicQuadrantorMarketScopemaychangeovertime.Avendor'sappearanceinaMagicQuadrantorMarketScopeoneyearandnotthenextdoesnotnecessarilyindicatethatwehavechangedouropinionofthatvendor.Itmaybeareflectionofachangeinthemarketand,therefore,changedevaluationcriteria,orofachangeoffocusbythatvendor.

    AddedAkerSecuritySolutions,HillstoneNetworksandBarracudaNetworkshavebeenadded.

    DroppedKeriowasdroppedbecauseitdidnotmeetGartner'sinclusioncriteriaforthisMagicQuadrant.

    InclusionandExclusionCriteriaInclusionCriteria

    UTMcompaniesthatmeetthemarketdefinitionanddescriptionwereconsideredforthisreportunderthefollowingconditions:

    TheyshippedUTMsoftwareand/orhardwareproductstargetedtoSMBsthatincludedcapabilitiesinthefollowingfeatureareasataminimum:

    http://www.watchguard.com/

  • 3/3/2558 MagicQuadrantforUnifiedThreatManagement

    http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 9/12

    Networksecurity(statefulfirewallandintrusionprevention)

    Websecuritygateway

    Remoteaccessformobileemployees(VPNs)

    Emailsecurity

    TheyregularlyappearedonGartnermidsizeclientshortlistsforfinalselection.

    TheyachievedUTMproductsales(notincludingmaintenanceorotherservicefees)ofmorethan$7millionin2013,andwithinacustomersegmentthat'svisibletoGartner.Theyalsoachievedthisrevenueonthebasisofproductsales,exclusiveofmanagedsecurityservice(MSS)revenue.

    ThevendorcanprovideatleastthreereferencecustomerswillingtotalktoGartner,orGartnerhashadsufficientinputfromGartnerclientsontheproduct.

    ExclusionCriteria

    Therewasinsufficientinformationforassessment,andthecompanydidn'totherwisemeettheinclusioncriteriaorisn'tactivelyshippingproductsyet.

    Productsaren'tusuallydeployedastheprimary,Internetfacingfirewall(forexampleproxyserversandnetworkintrusionpreventionsystem[IPS]solutions).

    Productsarebuiltaroundpersonalfirewalls,hostbasedfirewalls,hostbasedIPSsandWebapplicationfirewallsallofwhicharedistinctmarkets.

    SolutionsaretypicallydeliveredasMSS,totheextentthatproductsalesdidnotreachthe$7millionthreshold.

    Inadditiontothevendorsincludedinthisreport,Gartnertracksothervendorsthatdidnotmeetourinclusioncriteriabecauseofaspecificverticalmarketfocusand/orUTMrevenueand/orcompetitivevisibilitylevels,includingAdytonSystems,eSoft,GajShield,ilemGroup,MyDigitalShield,Netgear,NorthCoastSecurityGroup,QuickHeal,Sangfor,SecPoint,Secui,Smoothwall,TrustwaveandZyXEL.

    EvaluationCriteriaAbilitytoExecuteProductorService:Keyfeaturessuchaseaseofdeploymentandoperation,consolequality,price/performance,rangeofmodels,secondaryproductcapabilities(includinglogging,mobiledevicemanagement,integratedWiFisupportandremoteaccess),andtheabilitytosupportmultifunctiondeploymentsareweightedheavily.

    OverallViability:Thisincludesavendor'soverallfinancialhealth,prospectsforcontinuingoperations,companyhistory,anddemonstratedcommitmenttothemultifunctionfirewallandnetworksecuritymarket.Growthofthecustomerbaseandrevenuederivedfromsalesarealsoconsidered.Allvendorsarerequiredtodisclosecomparablemarketdata,suchasmultifunctionfirewallrevenue,competitivewinsversuskeycompetitors(whichiscomparedwithGartnerdataonsuchcompetitionsheldbyourclients),anddevicesindeployment.Thenumberofmultifunctionfirewallsshippedisn'takeymeasureofexecution.Instead,weconsidertheuseofthesefirewallsandthefeaturesdeployedtoprotectthekeybusinesssystemsofGartnermidsizebusinessclients.

    SalesExecution/Pricing:Thisincludespricing,thenumberofdeals,theinstalledbase,andthestrengthofsalesanddistributionoperationsofthevendors.Presalesandpostsalessupportareevaluated.Pricingiscomparedintermsofatypicalmidsizebusinessdeployment,includingthecostofallhardware,support,maintenanceandinstallation.Lowpricingwon'tguaranteehighexecutionorclientinterest.Buyerswantvaluemorethantheywantbargains,althoughlowpriceisoftenafactorinbuildingshortlists.Thetotalcostofownershipduringatypicalmultifunctionfirewalllifecycle(whichisthreetofiveyears)isassessed,asisthepricingmodelforaddingsecuritysafeguards.Inaddition,thecostofrefreshingtheproductsisevaluated,asisthecostofreplacingacompetingproductwithoutintolerablecostsorinterruptions.

    MarketResponsiveness/Record:Thisincludestheabilitytorespond,changedirection,beflexible,andachievecompetitivesuccessasopportunitiesdevelop,competitorsact,customerneedsevolveandmarketdynamicschange.Thiscriterionalsoconsiderstheprovider'shistoryofresponsiveness.

    MarketingExecution:Thisaddressesawarenessoftheproductinthemarket.Werecognizecompaniesthatareconsistentlyidentifiedbyourclientsandoftenappearontheirpreliminaryshortlists.

    CustomerExperienceandOperations:Theseincludemanagementexperienceandtrackrecord,andthedepthofstaffexperiencespecificallyinthesecuritymarketplace.Thegreatestfactorinthesecategoriesiscustomersatisfactionthroughoutthesalesandproductlifecycle.Alsoimportantiseaseofuse,overallthroughputacrossdifferentdeploymentscenarios,andhowthefirewallfaresunderattackconditions(seeTable1).

    Table1.AbilitytoExecuteEvaluationCriteria

    EvaluationCriteria Weighting

    ProductorService High

    OverallViability Medium

    SalesExecution/Pricing High

    MarketResponsiveness/Record Medium

    MarketingExecution Low

  • 3/3/2558 MagicQuadrantforUnifiedThreatManagement

    http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 10/12

    CustomerExperience Medium

    Operations Medium

    Source:Gartner(August2014)

    CompletenessofVisionMarketUnderstandingandMarketingStrategy:Theseincludeprovidingatrackrecordofdeliveringoninnovationthatprecedescustomerdemand,ratherthanan"us,too"roadmapandanoverallunderstandingandcommitmenttothesecuritymarket(specificallytheSMBnetworksecuritymarket).Gartnermakesthisassessmentsubjectivelybyseveralmeans,includinginteractionwithvendorsinbriefingsandfeedbackfromGartnerclientsoninformationtheyreceiveconcerningroadmaps.Incumbentvendormarketperformanceisreviewedyearlyagainstspecificrecommendationsthathavebeenmadetoeachvendor,andagainstfuturetrendsidentifiedinGartnerresearch.Vendorscan'tmerelystateanaggressivefuturegoal.Theymustenactaplan,showthatthey'refollowingitandmodifytheplanastheyforecasthowmarketdirectionswillchange.

    SalesStrategy:Thisincludespreproductandpostproductsupport,valueforpricing,andclearexplanationsandrecommendationsfordetectioneventsanddeploymentefficacy.Buildingloyaltythroughcredibilitywithafulltimemidsizebusinesssecurityandresearchstaffdemonstratestheabilitytoassessthenextgenerationofrequirements.

    Offering(Product)Strategy:Theemphasisisonthevendor'sproductroadmap,currentfeatures,leadingedgecapabilities,virtualizationandperformance.Thequalityofthesecurityresearchlabsbehindthesecurityfeaturesisconsidered.Credible,independentthirdpartycertifications,suchasCommonCriteria,areincluded.Integrationwithothersecuritycomponentsisalsoweighted,aswellasproductintegrationwithotherITsystems.Asthreatschangeandbecomemoretargetedandcomplex,weweightvendorshighlyiftheyhaveroadmapstomovebeyondpurelysignaturebased,deeppacketinspectiontechniques.Inaddition,weweightvendorsthataddmobiledevicemanagementtotheirofferingsandarelookingtosupportSMBorganizationsthatusecloudbasedservices.

    BusinessModel:Thisincludestheprocessandsuccessrateofdevelopingnewfeaturesandinnovation,andR&Dspending.

    Innovation:Thisincludesproductinnovation,suchasR&D,andqualitydifferentiators,suchasperformance,virtualization,integrationwithothersecurityproducts,amanagementinterface,andclarityofreporting.

    GeographicStrategy:Thisincludestheabilityandcommitmenttoservicegeographies.

    Themoreaproductmirrorstheworkflowofthemidsizebusinessoperationsscenario,thebetterthevision.Productsthataren'tintuitiveindeployment,oroperationsthataredifficulttoconfigureorhavelimitedreporting,arescoredaccordingly.Solvingcustomerproblemsisakeyelementofthiscategory.Reducingtherulebase,offeringinterproductsupportandbeatingcompetitorstomarketwithnewfeaturesareforemost(seeTable2).

    Table2.CompletenessofVisionEvaluationCriteria

    EvaluationCriteria Weighting

    MarketUnderstanding High

    MarketingStrategy High

    SalesStrategy Medium

    Offering(Product)Strategy Medium

    BusinessModel Medium

    Vertical/IndustryStrategy NotRated

    Innovation High

    GeographicStrategy Low

    Source:Gartner(August2014)

    QuadrantDescriptionsLeadersTheLeadersquadrantcontainsvendorsattheforefrontofmakingandsellingUTMproductsthatarebuiltformidsizebusinessrequirements.Therequirementsnecessaryforleadershipincludeawiderangeofmodelstocovermidsizebusinessusecases,supportformultiplefeatures,andamanagementandreportingcapabilitythat'sdesignedforeaseofuse.Vendorsinthisquadrantleadthemarketinofferingnewsafeguardingfeatures,andinenablingcustomerstodeploytheminexpensivelywithoutsignificantlyaffectingtheenduserexperienceorincreasingstaffingburdens.Thesevendorsalsohaveagoodtrackrecordofavoidingvulnerabilitiesintheirsecurityproducts.Commoncharacteristicsincludereliability,consistentthroughput,andproductsthatareintuitivetomanageandadminister.

    ChallengersTheChallengersquadrantcontainsvendorsthathaveachievedasoundcustomerbase,buttheyaren'tleadingwithfeatures.ManyChallengershaveothersuccessfulsecurityproductsinthemidsizeworldandarecountingontheclientrelationshiporchannelstrength,ratherthantheproduct,towindeals.Challengers'productsareoftenwellpriced,and,becauseoftheirstrengthinexecution,thesevendors

  • 3/3/2558 MagicQuadrantforUnifiedThreatManagement

    http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 11/12

    canoffereconomicsecurityproductbundlesthatotherscan't.ManyChallengersholdthemselvesbackfrombecomingLeadersbecausethey'reobligatedtosetsecurityorfirewallproductsasalowerpriorityintheiroverallproductsets.

    VisionariesVisionarieshavetherightdesignsandfeaturesforthemidsizebusiness,butlackthesalesbase,strategyorfinancialmeanstocompetegloballywithLeadersandChallengers.MostVisionaries'productshavegoodsecuritycapabilities,butlacktheperformancecapabilityandsupportnetwork.Savingsandhightouchsupportcanbeachievedfororganizationsthatarewillingtoupdateproductsmorefrequentlyandswitchvendors,ifrequired.Wheresecuritytechnologyisacompetitiveelementforanenterprise,Visionariesaregoodshortlistcandidates.

    NichePlayersMostvendorsintheNichePlayersquadrantareenterprisecentricorsmallofficecentricintheirapproachtoUTMdevicesforSMBs.SomeNichePlayersfocusonspecificverticalindustriesorgeographies.IfSMBsarealreadyclientsofthesevendorsforotherproducts,thenNichePlayerscanbeshortlisted.

    ContextSMBshavesignificantlydifferentnetworksecurityrequirementsfromthoseoflargeenterprises,duetodifferentthreatenvironmentsanddifferentbusinesspressures.Althoughthebranchofficesofsomelargerenterpriseshaverequirementsthataresimilartomidsizebusinesses,thisisnotalwaysthecase.TheUTMmarketconsistsofawiderangeofsuppliersthatmeetthecommoncoresecurityrequirementsofSMBs,butbusinessesneedtomaketheirdecisionsbymappingtheirthreatanddeploymentpatternstooptimalofferings.

    MarketOverviewTheUTMmarketismatureandmanySMBorganizationsarenowrenewingtheirUTMtechnology,ratherthanacquiringitforthefirsttime.Themarketisstillgrowingfasterthanothernetworksecuritymarkets,buthighermarketpenetrationwillslowlydrivetheUTMmarketgrowthratedown.In2014,SophosacquiredCyberoam,continuingtherecenttrendofconsolidationintheUTMmarket.

    TheprimarycharacteristicofmidsizecompaniesisthattheyareorganizationswithresourceconstrainedITdepartments.Theyhavearelativelimitoncapitalexpenditures,operationalbudgets,numberofITstaffersanddepthofITskillswhencomparedwithlargeenterprises.Inkeepingwiththis,UTMappliancesarefrequentlyusedacrossmidsizebusinessesasalowcostwayofmeetingtheirnetworksecurityrequirements.Midsizebusinesseslookatsecuritydifferently,andshowdifferentbuyingbehaviorscomparedwithlargerenterprises.Theprimaryareasofdifferenceare(inorderofimportance):

    Alimitedornonexistentskilledsecuritystaffdrivestheneedforeaseofinstallation,configurationanduseofchannelmanagedsolutions.

    LesscomplexuseoftheInternetresultsinlowerdemandforhighendsecurityfeatures,suchasapplicationlevelsecurityandcustomintrusionpreventionfilters.

    Limitedsecuritybudgetsdriveacquisitioncoststorepresentmorethan60%oftheoveralldecisionweighting.

    Smallbusinessesoftenperceivethattheyarenotvisibletoattackersand,therefore,don'trequireasmuchsecurity.However,financiallymotivatedattackershavetargetedsmallbusinesses,andthepublicityoversuccessfulattackshaschangedthesebusinesses'perceptions.

    Smallbusinesseswithfewerthan100employeeshaveevenmorebudgetarypressuresandevenfewersecuritypressures.Mostsecurityprocurementdecisionsaredrivenbynontechnicalfactorsandrarelyfeaturecompetitivecomparisons.Forthesereasons,thisMagicQuadrantfocusesontheUTMproductsusedbymidsizebusinesses,asdefinedabove.

    ThesedifferencesbetweenSMBandlargeenterpriseexpectationsareoneofthemajorreasonswhymanyoffirewallvendorsthatsellsuccessfullytotheenterpriseandSMBmarketstendtohaveseparatesoftwareorevenproductlinesforeachmarket.

    UTMVendorsTargetLargeEnterprisesWithDifferentApproaches

    AllofthevendorssurveyedagreeonthedifferentgotomarketapproacheswhentargetingSMBsversuslargeenterpriseclients.SMBsmoreoftenrelyontheirchannelpartnertochoosethecorrectallinoneUTMplatform,whereaslargeenterprisesecuritybuyersconducttheirownselectionprocess.SMBresellersalsohandleLevel1andLevel2supportsomealsobecomelocalLevel3supportcentersonbehalfofthevendor.

    ThemarketpenetrationforSMBsishigh,anddisplacingactivechannelpartnersfromanotherUTMvendorisdifficultbecauseitmeansthesepartnerswillhavetomaintainthelegacytechnologyofexistingcustomers,andalsolearnthevendor'sreplacementtechnology.Evenifsomechanneldisplacementhappensfollowinganacquisitionormergerannouncement,GartnerobservesthatmanyUTMvendorsconsiderSMBsasamature,lowgrowthmarketandfocusonnewtargetcustomers.

    Themostbasictacticistoreleasemorepowerfulappliances,runthesamesoftwarestackandselltheUTMcorevalueofallinonesecurity.Thisshortsightedapproachdoomsthevendorstonicheusecases,suchasbudgetconstrainedlowersizelargeenterprises,whicharecomposedofslightlymorethan1,000employees.SomeofthelargerUTMvendorsimproveonthisinitialapproachwithanoptimizedsoftwarestackthatisdevelopedtoprovideanenhancedofferfortheusecaseofahighperformancefirewall.Despitethemanagementinterfacebeingcrowdedwithunnecessaryfeatures,thegoodpriceofferedbyvendorsthatareaggressivelywillingtotakemarketshareawayfromtheincumbententerprisefirewallvendorsisattractivetomanyenterprises.However,UTMvendorsthatdonottakeamoredifferentiatedproductapproachwon'tdisplaceleadingenterprisevendorsatlarge,TypeAorganizations(see"MagicQuadrantforEnterpriseNetworkFirewalls").

  • 3/3/2558 MagicQuadrantforUnifiedThreatManagement

    http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 12/12

    Alternatively,afewprovidersnowtargetdistributedorganizationsthathaveneedsclosetothoseofmidsizeorganizations.ThisincludesMSSPsforSMBsanddistributedenterpriseslikeretailers,healthorganizationsandsmallgovernmentalagencies.Despitecentralizedpurchaseandmaintenancecenters,eachofficeissimilartoanautonomousorganization.Recentlyreleasedoffersincludecentralizedcloudbasedmanagementandreportingandwirelessaccesspointmanagement,sometimeswithadditionalfeaturestargetingorganizationsfromtheretailindustry,suchaswirelessanalytics,butalsosmallerappliancesoflessthan$500.

    UTMvendorsincreasinglyarefightingoverinitialpurchaseprices,andallvendorsmanagetowindealsonthestrengthofthissoleadvantage,basedonthetargetedverticalandgeographicarea.Inthelongerterm,thesecuritymarketforSMBmightbeinfluencedbytheincreasedadoptionofmobiletechnology,cloudservicesandforuppermidsizebusinessesvirtualizeddemilitarizedzone(DMZ)anddatacenter.WhilethereisnovisibleactorthatcoulddisrupttheUTMmarketyet,alternateapproaches,suchasendpointandmobiledevicemanagementorsecureWebgatewayhostedinthecloud,couldbecomemoreseriouscontenders.

    2014Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.oritsaffiliates.ThispublicationmaynotbereproducedordistributedinanyformwithoutGartnerspriorwrittenpermission.Ifyouareauthorizedtoaccessthispublication,youruseofitissubjecttotheUsageGuidelinesforGartnerServicespostedongartner.com.Theinformationcontainedinthispublicationhasbeenobtainedfromsourcesbelievedtobereliable.Gartnerdisclaimsallwarrantiesastotheaccuracy,completenessoradequacyofsuchinformationandshallhavenoliabilityforerrors,omissionsorinadequaciesinsuchinformation.ThispublicationconsistsoftheopinionsofGartnersresearchorganizationandshouldnotbeconstruedasstatementsoffact.Theopinionsexpressedhereinaresubjecttochangewithoutnotice.AlthoughGartnerresearchmayincludeadiscussionofrelatedlegalissues,Gartnerdoesnotprovidelegaladviceorservicesanditsresearchshouldnotbeconstruedorusedassuch.Gartnerisapubliccompany,anditsshareholdersmayincludefirmsandfundsthathavefinancialinterestsinentitiescoveredinGartnerresearch.GartnersBoardofDirectorsmayincludeseniormanagersofthesefirmsorfunds.Gartnerresearchisproducedindependentlybyitsresearchorganizationwithoutinputorinfluencefromthesefirms,fundsortheirmanagers.ForfurtherinformationontheindependenceandintegrityofGartnerresearch,seeGuidingPrinciplesonIndependenceandObjectivity.

    AboutGartner|Careers|Newsroom|Policies|SiteIndex|ITGlossary|ContactGartner

    http://www.gartner.com/technology/about.jsphttp://www.gartner.com/technology/about/policies/guidelines_ov.jsphttp://www.gartner.com/technology/about/policies/usage_guidelines.jsphttp://www.gartner.com/technology/it-glossaryhttp://www.gartner.com/technology/site-index.jsphttp://www.gartner.com/technology/about/ombudsman/omb_guide2.jsphttp://www.gartner.com/technology/careershttp://www.gartner.com/technology/contact/contact_gartner.jsphttp://www.gartner.com/it/products/newsroom