Download - Magic Quadrant for Unified Threat Management 2014

3/3/2558 MagicQuadrantforUnifiedThreatManagement

http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb 1/12

MagicQuadrantforUnifiedThreatManagement7August2014ID:G00261973

Analyst(s):JeremyD'Hoinne,AdamHils,GregYoung

VIEWSUMMARY

Unifiedthreatmanagementdevicesprovidesmallandmidsizebusinesseswithmultiplenetworksecurityfunctionsinasingleappliance.Buyersshouldfocusonperformancewhenmanysecurityfunctionsareenabled,andontheskillsetoftheassociatedchannelpartner.

MarketDefinition/DescriptionGartnerdefinestheunifiedthreatmanagement(UTM)marketasmultifunctionnetworksecurityproductsusedbysmallormidsizebusinesses(SMBs).Typically,midsizebusinesseshave100to1,000employees(seeNote1).UTMproductsmustcontinuallyaddnewfunctionsandthereforeencompassthefeaturesetofmanyothernetworksecuritysolutions,includingnextgenerationfirewall,secureWebgatewayandsecureemailgateway.Whileconsolidationcomeswithcompromisesinperformanceandcapability,thesearecompromisesthatmanySMBsarewillingtoaccept(see"WhatYouShouldExpectFromUnifiedThreatManagementSolutions").

ManyUTMproductscontainvariousothersecuritycapabilities,suchaswirelessoptionsandmodularEthernetportdensity,and,lessfrequently,Webapplicationfirewall(WAF)anddatalossprevention(DLP)softwaremodules.ApplicationcontrolembeddedinUTMisoftenbasic,focusedonInternetapplications(Facebook,Googleapplications,YouTube)andlooselyintegratedwiththefilteringpolicythroughalistofapplicationsbundledinaprofileandattachedtothefilteringrule.ItisusedmostlytorestricttheuseofWebapplicationsandcloudservices(suchassocialmedia,filesharingandsoon).Featuresrelatedtothemanagementofmobiledevicescreateapotentiallyattractivedifferentiatorforthismarket(see"HowUnifiedThreatManagementTacklestheConsumerizationofIT").

UTMappliancesareusedbymidsizebusinessestomeettherequirementsforsecureInternetconnectivity.Formanysmallbusinesses,thoserequirementsareoftendrivenbyregulatorydemands(suchasthePCIDataSecurityStandard),mandatingrudimentarylevelsofsecuritycontrols.Browserbasedmanagement,basicembeddedreporting,andlocalizedsoftwareanddocumentation,whichdon'tspecificallyappealtolargeenterprises,arehighlyvaluedbySMBsinthismarket.Gartnerseesverydifferentdemandsfromtheenterpriseandbranchofficefirewallmarkets(see"MagicQuadrantforEnterpriseNetworkFirewalls"),whichgenerallyrequiremorecomplexnetworksecurityfeatures,andareoptimizedforverydifferentselectioncriteria.

Thebranchofficesoflargercompanieshaveverydifferentnetworksecuritydemandsfrommidsizebusinesses,eventhoughtheymaybeofsimilarsize.Gartnerviewsbranchoffices'firewallsasextensionsofthecentralfirewallstrategy(see"BringBranchOfficeNetworkSecurityUptotheEnterpriseStandard").Thisdriveslargeenterprisestooftenuselowendenterpriseproductsattheirbranchofficestoensureinteroperability,andtotakeadvantageofeconomiesofscaleingettinglargerdiscountsfromtheirfirewallvendors.Forthesereasons,Gartnerallocatesbranchofficefirewallrevenuetotheenterprisefirewallmarket,nottheUTMmarket.

For2013,GartnerestimatesthattheUTMmarketgrewat14.1%toreachatotalofapproximately$1.54billion(see"MarketShareAnalysis:UnifiedThreatManagement(SMBMultifunctionFirewalls),Worldwide,2014Update"andNote2).

ManyUTMvendors,whichputastrongfocusondistributedorganizationssuchasretail,ormanagedsecurityserviceproviders(MSSPs),arenowheadingtowardplacingthemanagementandmonitoringconsolesfullyinthecloud.Gartnerbelievesthat,althoughit'sconvenientforthevendorstodoso,aportionoftheSMBmarketwillnotacceptthisexclusivelycloudmodelforreasonsoflatency,andneedtoaccesstheconsolewhenunderattack.Insomeregionsandindustryverticals,limitedtrustinaforeignsupplierandotherprivacyconcernswouldbeadditionalreasonstoavoidthecloudmodel.Reportingandlogretentionarewellsuitedtothecloud,butnotexclusively.

SMBsshouldbeskepticaloftheaspirationalmessagefromUTMvendorsabouttheexaggeratedbenefitsoffeatureconsolidation.SecuritybuyersshouldinsteadevaluateUTMdevicesbasedonthecontrolstheywillactuallyuse,theperformancetheywillgetforthosefeatures,andthequalityofvendorandchannel(andmanagedservices)supportthatisavailable.

ThemarketfornetworkandsecuritysolutionsdesignedtoprotectSMBscontinuestodevelop,andourexpectationsforUTMtechnologyfeaturesincreasewitheachneweditionofthisMagicQuadrant.Asaresult,theMagicQuadrantdepictsashiftupandtotherightwitheachrevision.Consequently,vendorsmustprogresstomaintaintheirpositionsineachnewMagicQuadrant.

MagicQuadrant

STRATEGICPLANNINGASSUMPTIONS

ReplacementofUTMbycloudoptionswillremainatlessthan5%through2016however,bythen,mostUTMdeviceswillleveragecloudassistedsecurityormanagementfeatures.

By2016,15%ofSMBswillusemobilitymanagementcapabilitiesfromtheirUTMplatformstoenforcedistinctivepoliciesupfromlessthan5%today.

NOTE1SMALLANDMIDSIZEMARKETDEFINITION

GartnergenerallydefinesSMBsbythenumberofemployeesand/orannualrevenuetheyhave.Theprimaryattributethatisusedmostoftenisthenumberofemployees.Smallbusinessesusuallyhavefewerthan100employees,whilemidsizebusinessesareusuallydefinedascompanieswithfewerthan1,000employees.Thesecondaryattributethatisusedmostoftenisannualrevenue.Smallbusinessesareusuallydefinedasthosewithlessthan$50millioninannualrevenue,whilemidsizebusinessesaredefinedasthosewithlessthan$1billioninannualrevenue.Typically,80%ofthecompaniesthatGartneranalystsspeakwithhavebetween100and999employees,andrevenueof$100millionto$500million(see"Gartner'sSmallandMidsizeBusinessMarketDefinition,2013Update").

NOTE2UTMREVENUEDIFFERENTIATION

GartnerdoesnotincludebranchofficefirewallrevenueasUTMrevenue.ThemarketsizeandgrowthareestimatedcomparedwithnumbersfromthepreviousUTMMagicQuadrant.

EVALUATIONCRITERIADEFINITIONS

AbilitytoExecuteProduct/Service:Coregoodsandservicesofferedbythevendorforthedefinedmarket.Thisincludescurrentproduct/servicecapabilities,quality,featuresets,skillsandsoon,whetherofferednativelyorthroughOEMagreements/partnershipsasdefinedinthemarketdefinitionanddetailedinthesubcriteria.

OverallViability:Viabilityincludesanassessmentoftheoverallorganization'sfinancialhealth,thefinancialandpracticalsuccessofthebusinessunit,andthelikelihoodthattheindividualbusinessunitwillcontinueinvestingintheproduct,willcontinueofferingtheproductandwilladvancethestateoftheartwithintheorganization'sportfolioofproducts.

SalesExecution/Pricing:Thevendor'scapabilitiesinallpresalesactivitiesandthestructurethatsupportsthem.Thisincludesdealmanagement,pricingandnegotiation,presalessupport,andtheoveralleffectivenessofthesaleschannel.

MarketResponsiveness/Record:Abilitytorespond,changedirection,beflexibleandachievecompetitivesuccessasopportunitiesdevelop,competitorsact,customerneedsevolveandmarketdynamicschange.Thiscriterionalsoconsidersthevendor'shistoryofresponsiveness.

MarketingExecution:Theclarity,quality,creativityandefficacyofprogramsdesignedtodelivertheorganization'smessagetoinfluencethemarket,promotethebrandandbusiness,increaseawarenessoftheproducts,andestablishapositiveidentificationwiththeproduct/brandandorganizationinthemindsofbuyers.This"mindshare"canbedrivenbyacombinationofpublicity,promotionalinitiatives,

http://www.gartner.com/technology/contact/bac/http://www.gartner.com/technology/contact/bac/?cm_sp=bac-_-reprint-_-banner



Figure1.MagicQuadrantforUnifiedThreatManagement

Source:Gartner(August2014)

VendorStrengthsandCautionsAkerSecuritySolutionsBasedinBrazil,AkerSecuritySolutionsisanetworksecurityvendor.ItsportfoliohasincludedUTMsolutions(AkerFirewallUTM)since1997,aswellassecureWebgatewayandsecureemailgateway.AkerFirewallUTMiscomposedof14models,withtwomodelswithwirelesscapabilities.ItcanalsorunasavirtualapplianceonVMware,CitrixXenandMicrosoftHyperV.

Inthepast12months,AkerreneweditsentirehardwareapplianceproductlineandaddedKasperskyAntiVirusasanoption.

AkerFirewallUTMisagoodshortlistcandidateforsmallandmidsizeorganizationsinBrazil.

Strengths

AkerFirewallUTMprovidesacomprehensivesetofUTMfeatures,includingapplicationcontrol,wirelesssecurity,SSLVPN,andtwochoiceseachforanantivirusengineandanintrusionpreventionsystem(IPS)signatureset.

AkerprovidesarentaloptionforitsUTMappliances,whichreducescapitalexpenditure(capex)costs.

Aker'sclientsanditschannelpartnersvaluetheavailabilityof24/7vendorsupport.

Akerisoneofthefewvendorsthatprovidegraphicaluserinterface(GUI),documentationandsupportinPortuguese.

Cautions

AkerFirewallUTMlacksalowendappliance(lessthan$1,000)thatcouldbecosteffectiveforsmalloffices.

AkerdoesnotprovideanembeddedWebinterface,butinsteadalwaysrequirestheinstallationofamanagementsoftwarecomponent(AkerControlCenter).Clientsreportthatinstallationcouldbeeasier.

AkerisnotvisibleinclientshortlistsoutsideofBrazil,andisnotreadyforinternationalizationyet.

BarracudaNetworksBasedinCampbell,California,BarracudaNetworksisalargevendorprovidingnetworksecurity,backupandinfrastructuresolutions,including,amongotherthings,Webandemailsecurity,Webapplicationfirewall,anddatabackup.IthasastrongfocusonSMBs,butuntilrecentlywaslackingadedicatedUTMoffering.InFebruary2013,Barracudareleasedanewproductline,theBarracudaFirewall(Xseries),tocomplementBarracudaNGFirewall(Fseries),itsincumbentrangeoffirewalls,whichareorientedtowardlargerenterprises'needs.BarracudaFirewalliscomposedofsevenmodels,includingtwowithwirelesscapabilities,butisnotavailableyetasavirtualappliance.ItembedsaWebinterface,designedforsimplerusecases,andleveragesclouddatabasesandenginesforkeycontentfiltering.

Attheendof2013,Barracudaexecutedaninitialpublicoffering(IPO).Inthepastfewmonths,it

thoughtleadership,wordofmouthandsalesactivities.

CustomerExperience:Relationships,productsandservices/programsthatenableclientstobesuccessfulwiththeproductsevaluated.Specifically,thisincludesthewayscustomersreceivetechnicalsupportoraccountsupport.Thiscanalsoincludeancillarytools,customersupportprograms(andthequalitythereof),availabilityofusergroups,servicelevelagreementsandsoon.

Operations:Theabilityoftheorganizationtomeetitsgoalsandcommitments.Factorsincludethequalityoftheorganizationalstructure,includingskills,experiences,programs,systemsandothervehiclesthatenabletheorganizationtooperateeffectivelyandefficientlyonanongoingbasis.

CompletenessofVisionMarketUnderstanding:Abilityofthevendortounderstandbuyers'wantsandneedsandtotranslatethoseintoproductsandservices.Vendorsthatshowthehighestdegreeofvisionlistentoandunderstandbuyers'wantsandneeds,andcanshapeorenhancethosewiththeiraddedvision.

MarketingStrategy:Aclear,differentiatedsetofmessagesconsistentlycommunicatedthroughouttheorganizationandexternalizedthroughthewebsite,advertising,customerprogramsandpositioningstatements.

SalesStrategy:Thestrategyforsellingproductsthatusestheappropriatenetworkofdirectandindirectsales,marketing,service,andcommunicationaffiliatesthatextendthescopeanddepthofmarketreach,skills,expertise,technologies,servicesandthecustomerbase.

Offering(Product)Strategy:Thevendor'sapproachtoproductdevelopmentanddeliverythatemphasizesdifferentiation,functionality,methodologyandfeaturesetsastheymaptocurrentandfuturerequirements.

BusinessModel:Thesoundnessandlogicofthevendor'sunderlyingbusinessproposition.

Vertical/IndustryStrategy:Thevendor'sstrategytodirectresources,skillsandofferingstomeetthespecificneedsofindividualmarketsegments,includingverticalmarkets.

Innovation:Direct,related,complementaryandsynergisticlayoutsofresources,expertiseorcapitalforinvestment,consolidation,defensiveorpreemptivepurposes.

GeographicStrategy:Thevendor'sstrategytodirectresources,skillsandofferingstomeetthespecificneedsofgeographiesoutsidethe"home"ornativegeography,eitherdirectlyorthroughpartners,channelsandsubsidiariesasappropriateforthatgeographyandmarket.

http://www.aker.com.br/https://www.barracuda.com/



expandedtheBarracudaFirewallproductrangestowardsmallerofficesandaddedsoftwarefeaturestoeasetheinstallationprocess.

TheBarracudaFirewallseriesisagoodshortlistcandidateforSMBsthatalreadyuseotherBarracudaproducts,haveanexistingtrustfulrelationshipwithresellersofBarracudasolutionsorhavestringentbudgetconstraints.

Strengths

BarracudahasstrongmarketshareamongSMBs,andcustomersbenefitfromgoodglobalsalesandsupportpresence,especiallyinEurope.

Gartnerclientsreportthattheylikethesimplelicensing,andthatunlikemanycompetitors,thepriceforsoftwareoptionsisreasonable.

BarracudaNetworksoffersa30dayrefundplanandareplacementprogramthatincludesanewapplianceeveryfouryears.

Cautions

TheBarracudaXSerieswasonlyrecentlyreleasedsomeintegratedmodulesandthecloudbasedcentralizedmanagementareyetunproven.Barracuda'schannelisunevenlytrainedonthesolutioninsomeregions.

TheBarracudaXSerieshasnotbeenscrutinizedbyanymajorthirdpartytestinglabsandhasalimitednumberofcertifications.

Gartnerbelievesthat,whileBarracudahascorrectlyassessedthatSMBandenterprisehavedifferentneeds,customersandchannelpartnerscouldbeconfusedbecausethetwofirewalllineshavemoreoverlapsthandifferences.

CheckPointSoftwareTechnologiesCheckPointSoftwareTechnologies,withheadquartersinTelAviv,Israel,andSanCarlos,California,isoneofthelargestpureplaysecuritycompanies,andhasbeenpresentinthesecuritymarketformorethan20years.Initiallyexclusivelyfocusedonenterprises,CheckPointhaslaterinvestedintheUTMsegment,specificallytargetingSMBusecases.ItsSMBproductlineincludes11appliances,includingwirelessandDSLmodels.UTMcanalsobedeliveredasavirtualapplianceoronAmazonWebServices(AWS).FundamentaltoCheckPointfirewallofferingsisthesetofsoftwareoptionsreferredtoasSoftwareBladesthatcanbegroupedtogetherinbundles.

OncethehardwareandOSconsolidationworkwasachievedin2013,CheckPointmoveditseffortsbacktonewthreatpreventionfeaturesandperformanceimprovements.Ithasalsorecentlymadeavailableamarketplaceofthreatfeedsfromthirdpartiesthatitsclientscanpurchaseseparatelyassoftwareoptions(ThreatCloudIntelliStore).

CheckPointisagoodchoiceforSMBorganizationsthatdonotconsiderlowpriceasthemostimportantcriterion.

Strengths

CheckPoint'sreportingandmanagementconsoleisconsistentlyhighlyratedbymidsizecompanies.CheckPointmanagedtosimplifyitsmanagementconsoleforitsentrylevelapplianceswithoutcompromisingtheflexibilityanddepthofprotection.

CheckPoint'sUTMsolutionsbenefitfromitsenterpriselevelsecurityfeatures,suchasThreatCloudandAntiBotsoftwareoptions,inadditiontothestrongIPSmodule,whichareallbackedupbyCheckPoint'slargethreatresearchteam.

CheckPointprovidesanoptionforsandboxing(ThreatEmulation),andrecentlyreleasedacloudbasedsecurityserviceformobileandremoteusers,inadditiontohavingexistingpartnershipswithmobiledevicemanagement(MDM)solutions.

CheckPointisastrong,stableorganizationwithaconsistentstrategyandprovenabilitytoexecuteonitsroadmap.

Cautions

GartnerseesCheckPointmostlysellingtoitsexistingbaseofdistributedenterprises,butitdoeslagbehindotherLeadersinbuildingadedicatedchannelofpurelySMBresellers.

GartnerclientsoftencitepriceastheprimaryreasonfornotselectingCheckPointsolutions.

GartnerSMBclientsreportthatthequalityofLevel1supportfromchannelvaries,andGartnerhasobservedthatSMBcustomerproblemescalationstakemoretimetoresolvethanthosefromlargeenterprisecustomers.

CheckPointoffersmanySoftwareBladesandkeepsaddingnewones.Ithasmadegoodprogressinsimplifyingthesalesofferingwithbundles,butresellersandclientsreportthattheyfinditdifficulttoassesstheoverallimpactofenablingmorethanafewoptionssimultaneously.

CiscoCisco,basedinSanJose,California,isthelargestnetworkinfrastructureprovider.Foralongtime,ituseditsglobalpresencetocrosssellsecuritysolutionstoitsexistingcustomerbase.Cisconowdedicatesrenewedeffortstotheenterprisesecuritymarket,withtheacquisitionofSourcefirein2013,andfocusesonsecurityfordistributedSMBswithcloudmanagedMerakiMXappliances(sevenmodels).ItsportfoliostillprovidetheISA500Seriesforsmallbusinesses(fourmodels,includingtwowithwirelesscapabilities),andtheASA5500XSeriesformidsizecompanies(fivemodels).CiscoAdaptivitySecurityAppliance(ASA)isalsoavailableasavirtualappliance(ASAv).Inadditiontothededicatedsecuritysolutions,Ciscohasalargeportfolioofnetworksolutionsthatcanprovidesecurityfeatures,suchasIntegratedServicesRouters(ISRs).

Duringthepast12months,CiscopredominantlypromotedandimproveditsMerakiMXproductlinewiththeintegrationofSourcefireIPSandtheadditionofuseridentityfilteringcapabilities.

http://www.checkpoint.com/http://www.cisco.com/



CiscoisagoodchoiceforexistingSMBcustomersusingotherCiscotechnology,andfordistributedorganizationsinNorthAmerica.

Strengths

Cisco'sGartnercustomersgenerallyofferpositivereviewsofCiscohardwarerobustness.

ThelearningcurveforCiscotrainedstaffonitssecuritytechnologyisshort,especiallyforcustomersalreadyfamiliarwiththeCiscocommandlineinterface.

CiscoMerakiMXincludescontextualfeedsfromSourcefire,integratedWiFi/4Gmanagement,andintegrationwithMDMsolutionsformobileusers.

CiscoMerakiMXcloudbasedcentralizedmanagementoffersaunifiedviewformanagingUTMs,Meraki'swirelessAPandswitches.CustomerscancreateconfigurationtemplatestoaddnewlocationsandtocreatesitetositeVPNmoreeasily.

Cautions

CiscoMerakiMXlacksemailsecurity,SSLVPNforremoteusersandSSLdecryptionforHTTPthatareavailableinmanyofitscompetitors'UTMs.

Cisco'sdualproductlinestrategyfortheUTMmarketmightcreatecomplexityforsomeclientsthatcouldleveragetheirCiscoknowledgewithCiscoASAonthecorenetwork,butcouldalsobenefitfromsomeoftheMerakiMXfeaturesfordistributedoffices.

CiscodoesnotgeneratemanyinquiriesfromSMBclients,andwhenitdoes,itisoftentheincumbentsolutionthatisconsideredforreplacement.

ClavisterClavister,headquarteredinSweden,primarilytargetsenterprisesandISPswithitsappliancesandcloudservices.ThevendoraddressesSMBsthroughitsbrandedsecurityappliances,theEagleSeriesandtheWolfSeries,thatcanbedeliveredasvirtualappliances,too.Itsoperatingsystem(cOS)isprovidedeitherasafullfledgedsoftwarestack(cOSCore)orasastreamlinedversionfocusedonnetworkneeds(cOSStream).ClavisteralsooffersadedicatedportaltoMSSPsforthemanagementofitsUTM.

In2014,thecompanyappointedanewCEOandshifteditsstrategyevenmoretowardtelecomoperatorswithLTEcellsecurity.InMay2014,ClavisterenteredtheStockholmstockmarket.

ClavisterisagoodshortlistcandidateformunicipalitiesanddistributedpublicadministrationinNorthernEurope,orfororganizationinneedofruggedUTMappliances.

Strengths

ClientsciteveryfunctionalsecuritymodulesandqualityvendorsupportasreasonforremainingfaithfultoClavister.

TheISO9001:2008certificationandatwoyearstandardreturnandrepairwarrantyappealtospecificmidsizeverticalindustriesortoclientsthathaveexperiencedhardwareissueswithotherUTMprovidersinthepast.

TheClavisterX8seriesofruggedappliancesisagoodalternativefororganizationsfromspecificverticalindustries,suchasdefense,orwhentheexternalconditionswheretheUTMapplianceneedstobelocatedareadverse.

Cautions

WhileClavistercontinuestoservetheSMBmarketwithsoftwarefeaturesthatweredevelopedinthepast,itscurrentgotomarketapproachisnowprimarilyfocusedoncarrierandenterpriseneeds.

Clavister'ssales,supportandchannelpartnerresourcesarefocusedpredominantlyonNorthernEurope,andmightbeunevenlyavailableforcustomersfromotherregions.

ClavisterrarelyappearsonGartnerclients'shortlists.

CyberoamBasedinIndia,Cyberoam,nowaSophoscompany,isapureplayvendorfortheUTMmarket,primarilyfocusingonSMBsandattemptingtoexpandtolargerenterprises.Cyberoamprovides18differentUTMhardwaremodelsandfivevirtualappliances.CyberoammarketsitsLayer8useridentitycontrolfeaturesasakeydifferentiatortootherUTMproducts,andovertheyearsithasbuiltseveralfeaturesleveragingthisconcept.

InFebruary2014,CyberoamwasacquiredbySophos.ThecompanyannouncedthatCyberoamwouldcontinuetosellitsUTMproductlinewithoutanyshorttermdisruption.RecentCyberoamupdatesincludefeaturestargetingtheindustrialsecurityusecase.

CyberoamisagoodchoiceforSMBorganizationsintheAsia/PacificandMiddleEastregions.SMBbuyersfromotherregionsshouldfirstevaluatelocalchannelexpertiseonUTMandcustomerreferenceswithsimilarusecases.

Strengths

Cyberoaminvestsheavilyonitschannel,providesacomprehensiveknowledgebase,andallowsdirectaccesstochatandphonesupportforitspartnersthatshouldoftenbetranslatedintoquickresolutionofsupportissuesforitsclients.

Cyberoamconsistentlyexecutesonitsroadmap.

Cyberoamincludesmatureembeddedreportinganduseridentitycontrolsthatareattractivetomidsizeorganizations.

Cyberoam'sfilteringpolicyembedsdownloadanduploadstatisticsforeachrule,whichhelpsdetermineduplicateandunusedrules.ItalsoprovidesaflexiblewaytorestrictrecreationalInternetusagewiththeabilitytosetupquotasforusersorgroupsofusers.

http://www.cyberoam.com/http://www.clavister.com/



Cautions

CyberoamhaslowvisibilityintheAmericasandappearslessoftenthanleadingUTMvendorsinEuropeincompetitiveshortlistsfromGartnerclients.

Gartnerbelievesthat,whilenomajorchangehasbeenobservedyet,Cyberoam'schannelmightsufferinthefuturefromtheoffensivepostacquisitionmessagingfromcompetitioninEuropeandintheU.S.,andmightbechallengedinitshomecountrybylocalUTMvendors.Thiscouldtranslateinlocalsupportdisruptionsifsomechannelpartnersswitchtootherbrands.

SMBclientsshouldfirstobtainclarificationfromCyberoamonoverlapsbetweenSophosandCyberoam'sUTMproductlines.

DellDell,withheadquartersinRoundRock,Texas,isaleadingcomputermanufacturerthathasdiversifieditsactivityininfrastructureandsecurity.ItsUTMportfolioisbrandedDellSonicWALLandincludes13models.ItiscomposedoftwoproductlinesthataresoldtotheSMBmarket:theSonicWALLTZSeriesforthesmallestbusinessesandtheSonicWALLNSASeriesforsmallandmidsizecompanies.Despitetherecentchangeinname,Dell'sUTMproducthasbeenonthemarketforalongtime,andbenefitsfromextendedsalesandsupportchannels.DelltargetstheenterprisemarketwithitsSonicWALLSuperMassiveSeries.Dellalsoprovidesothernetworksecuritysolutions,suchasSSLVPNandemailsecuritygateway.

DellisagoodshortlistcandidateforU.S.basedSMBsandforcurrentDellcustomersinotherregions.

Strengths

DellSonicWALLTZappliancescontinuallygetgoodscoresfromsmallorganizationsfortheirabilitytocombinesecuritymodulesandwirelessconnectivity,inadditiontoothernetworkfeatures.

ClientsreportthatlowpriceandacomprehensivesetoffeaturesaredifferentiatorsforDellSonicWALLincompetitiveevaluations.

Dellleveragesitsbroadlogisticalcapabilitiestoassistwithdeploymentsinvolvingmultiplegeographies.

Dellcontinuestoinvestinitssecuritydivisions,andDellSonicWALLhasasubstantialR&Dteam,includingalargeinhousesecuritylabthatcreatesallitsIPSsignatures.

Cautions

Dell'sroadmapforthepast24monthsdemonstratesaswitchinprioritytowardenterpriseusecaseattheexpenseofSMBneedsforconsolidatednetworkandsecurityfeatures.

GartnerhasobservedthatsincetheacquisitionofSonicWALLbyDell,manyUTMvendorsexploitDell'srecentmarketfocusswitchandaggressivelytargetDell'sresellersandgivethemstrongincentivetoswitch.ClientscouldbeaffectedbyachangingrelationshipbetweentheirlocalchannelpartnerandtheUTMtechnologyvendor.

DellstillholdsagoodshareoftheUTMmarket,buttheDellSonicWALLproductlineappearsmuchlessofteninrecentUTMshortlists.

Gartnerclientsreportthatthemanagementinterfacecanbeconfusingbecauseoftoomanyavailableoptions.

FortinetFortinetisalargesecurityvendorwithheadquartersinSunnyvale,California.Itoffersmorethan40differentUTMappliancemodels(FortiGate)aimedatthesmallandmidsizemarket,includingwireless,DSLandPOEversions.FortiGateisalsoavailableasavirtualappliancewithfivemodelsthatarepricedbasedonCPUcorecount.Onpremisescentralizedmanagement(FortiManager)andreporting(FortiAnalyzer)solutionscomplementtheUTMoffering.Thecomprehensivesecurityproductportfolio,composedoftokensandhostagents(FortiClient),isdesignedtoappealtoVARsandMSSPsastheroutetosales.

Fortinet'sroadmapcontinuestobedrivenbyregularhardwareandsoftwareupdates,with10newFortiGateappliancesin2013andalready12modelsin2014.FortinetalsomadeFortiGate,FortiManager,FortiAnalyzerandFortiWebavailableontheAWSplatform.ItwasalsooneofthefirstvendorstoofferfilesandboxingonaUTM.

FortinetisagoodcandidateforeveryorganizationinneedofaUTM.

Strengths

FortinetcontinuestobeahighlyvisibleUTMprovideramongGartnerclients.Italsoownsthelargestmarketshare,growingfasterthanthemarketaverage,andhasthelargestbaseofcertifiedchannelpartnersforUTMtechnology.

FortinethasaverylargeR&Dteamandsupportcentersacrossallregions.GartnercontinuestoviewFortinetassettingthecadenceintheUTMmarket,drivingitscompetitorstoreact.

FortiGateintegratesfilesandboxingcapabilities,backedupbythelargeFortiGuardLabsthreatresearchteam.

Fortinetprovidesaveryaggressiveprice/performanceproposition,whichisoftenadecisivefactorforbudgetconstrainedSMBs.

Thecombinationofwirelessaccesspointmanagement,WiFianalytics,highportdensityandpoweronEthernetalongwiththeavailabilityofpricecompetitiveUTMappliancesappealstosmallbusinesseslookingformorethanasecuritygateway,aswellastodistributedretailorganizations.

Cautions

ThefrequenthardwareandsoftwareupdatesmakeitmoredifficulttomaintainaconsistentlevelofexpertiseacrossFortinet'swidelydistributedchannel,whichsometimescausesdiscrepanciesinpresalesandsupportquality.

http://www.dell.com/http://www.fortinet.com/



GartnerclientsreportissuesrelatedtoFortinetUTMregardingtheusabilityoftheFortiManagercentralizedmanagement,orbecauseoflowerthanexpectedperformancewhenenablingsecurityfeatures.

Fortinethasnotyetinvestedasmuchassomeofitsdirectcompetitorsinitsnativecloudbasedcentralizedmanagementandreporting(FortiCloud).Whilemarketneedshavenotfullyformed,thiswillproveacompetitivedisadvantageiftheresellersandMSSPsstarttousecloudmanagementasastandardplatform.

gateprotectGermanybasedgateprotectisapureplaysecurityvendor.ItsUTMportfolioincludesnineappliances.Virtualappliancesandcentralizedmanagementarealsoavailable.Gateprotect'smanagementinterface(eGUI)implementsagraphical(iconbased)visualizationofthenetworktopologyasawaytosimplifytheconfigurationofthesecuritypolicy.InJuly2014,gateprotectwasacquiredbyRohde&Schwarz,alargeGermanelectronicsgroup.

Gateprotectrecentlyreleasedanapplianceforsmalloffices(GPO110),includingwirelessoptionsandaddedapplicationandendpointcontrolfeatures.

Gateprotectisagoodshortlistcandidateforsmallorganizations,especiallyinEurope.

Strengths

Gateprotect'seGUIprovidessmallanddistributedorganizationswithasimplifieddeploymentexperience.

GateprotectmakesastronginvestmentinR&Dforavendorofitssize.

Clientsreportthattheycangetquickanswersfromvendorsupportwhenneeded.

GateprotectisgrowingquicklyinLatinAmericaandSouthernAfrica.

Cautions

Gateprotecthasasloweroverallgrowththanmostofitsdirectcompetitors.ItsresultsstillpredominantlydependonthematuremarketofsmallandlowermidsizeorganizationsinGermany.

Gateprotecthaslimitedcoveragefromindependenttestinglabs.

Layer7applicationcontrolisnotfullyintegratedinthecoreviewofthegraphicalsecuritypolicyrepresentation,butattachedasaprofile.

HillstoneNetworksHillstoneNetworksisapurenetworksecurityplayer,withheadquartersinBeijingandoperationsinSunnyvale,California.ItsUTMportfolioincludes12hardwaremodels(theMSeries).Virtualappliancesarenotavailable,buttheUTMsoftwarecanbedeployedonanopenstackenvironment.HillstonedoesnotyetofferavirtualUTMappliance,butseveralinstancesofUTMscanruninasinglephysicalchassis.Hillstonealsoprovidesarangeoffirewalls(theXSeries)thatisspecializedforthedatacenterusecase

RecentsoftwareupdatesincludedimprovementsonVPN,authenticationandnetworkfeatures.

HillstoneisagoodshortlistcandidateforSMBorganizationsintheAsia/Pacificregion.Organizationsfromotherregionsshouldfirstcheckthelocalchannelandvendorpresences.

Strengths

Hillstone'sUTMincludeshostreputationandnetworkmonitoringfeaturesthatcanhelpdetectinfectedhosts.

ClientsreportthattheUTMmaintainsexpectedperformancewhenrunningmultiplesecuritymodules.

Asapureplaynetworksecurityvendor,HillstoneNetworkshasagoodhistoryofexecutingonitsroadmap,whichgivescredibilitytoitsannouncementsonfutureimprovements.

Cautions

Hillstonetargetsprimarilythelargeenterprisemarket.ItlagsitscompetitorsinautomatedactivityreportsforSMBorMSSPoperationteams.

HillstoneNetworksisnotvisibleinUTMcompetitiveshortlistsoutsideofChina.HalfofHillstone'srevenuecomefromdirectsales,andthevendorhasyettobuildaninternationalchannelofactiveUTMresellers.

HuaweiHuaweiisalargenetworkinfrastructuresupplierheadquarteredinShenzhen,China.In2009,HuaweilauncheditsUnifiedSecurityGateway(USG)productline,whichnowiscomposedof24models,includingalargenumberofapplianceswithwirelesscapabilities,toaddresstheSMBmarket.Centralizedmanagementsoftwareisavailable.LargeUTMappliancescanrunseveralUTMsoftwareinstances,butthevendordoesnotprovidevirtualUTMappliancestorunonthetopofleadinghypervisors.

Recentupdatesincludenewhardwaremodels,aproprietaryVPNmode(DSVPN)andSSLdecryption.

Huawei'sUTMisagoodcontenderforSMBsinChina,andforitscurrentlargeenterprisecustomersinothercountries.

Strengths

HuaweiUTMhasagoodmixoflocalcertificationsandindependenttestsfromlargeinternationallabs.

Clientsoftencitegoodprices,especiallyforsupportservice,asadecisivefactorinselectingHuawei'ssolutions.

http://www.hillstonenet.com/http://www.gateprotect.com/enhttp://www.huawei.com/



HuaweihasalargenumberofclientsusingIPv6.

Cautions

Likemostinfrastructurevendors,Huawei'sleverageisinitsexistingcustomerbaseoflargeenterprisesandcarriers.ThisfocusonothermarketsmightdivertdevelopmentprioritiesawayfromSMBneeds.

HuaweisellsamajorityofitsUTMinChinaandstrugglestogrowmarketshareoutsideofAsia/Pacific.SMBcustomersshouldfirstassessthelevelofcommitmentofHuawei'slocalchannelpartnerstotheSMBmarket.

JuniperNetworksJuniperNetworksisanetworkinfrastructurevendorbasedinSunnyvale,California.Ithasabroadportfoliothatcoversnetworkandsecuritysolutions.ItsUTMoffering(SRXSeries)includes13modelsandreliesontheJunosOS,whichisthecommonplatformfornetworkandsecurityappliancesinJuniper'sportfolio.OtherproductlinescansupportUTMcapabilities(SSGSeriesandISGSeries),andtwovirtualappliancesareavailable.

Juniperrecentlyannouncedaunifiedcentralizedmanagementandreportingsolution,improvedapplicationcontrolengineandsimplifiedusersinglesignon.

JuniperUTMisagoodchoiceforexistingJunipercustomers.OtherSMBcustomersshouldfirstverifytheexperienceoftheirlocalchannelwithJunipersecuritysolutionsforanSMBusecase.

Strengths

UTMbuyersthatalreadyuseJunipertechnologycanleveragetheirexistingrelationshipwiththevendortogetalowerpriceandquicklylearnhowtomanageitsUTM.

Juniperhasabroadrangeofhardwareappliancestosupportawidevarietyofscalabilityandperformancerequirements.

Juniper'sunderstandingofdiversecustomerenvironmentsmakesitagoodchoiceforcomplexnetworkinfrastructureorwhensupportisacriticalcomponentofthepurchasedecision.

Cautions

JuniperrarelyappearsonGartnerSMBcustomershortlistsforUTM.

RecentstaffcutsinJunipersecurityteamsmightdivertevenmoreofitsresourcesfromtheSMBmarket.

Exceptforthesupportofnewhardwaremodels,JuniperhasnotreleasednewfeaturesprimarilytargetingSMBinthepast12months.

SophosBasedinBoston,Massachusetts,andOxford,U.K.,Sophosisalargesecurityvendorthatinitiallyprovidedendpointsecuritybeforeaddingnetworkandmobilesecuritysolutionstoitsportfolio.TheSophosUTMportfolioincludes11models(theSGSeries).SophosUTMisalsoavailableasavirtualapplianceonAWS,withaconsistentcustomerbase.ItalsooffersitsRemoteEthernetDevice(RED)appliancesforsmallbranchesthatarecentrallymanagedusingaSophosUTM.

Inrecentmonths,SophosacquiredCyberoam,anotherUTMvendor(reviewedearlierinthisresearch),startedahardwareappliancesrefreshandreleasedversion9.2ofitsUTMsoftware,whichincludescloudbasedsandboxing,automatedemailencryptionandintegrationwithSophos'MDMproduct.

SophosisagoodUTMshortlistcontenderforSMBs,especiallyinEuropeandJapan,andforcurrentSophoscustomers.CustomersoutsideoftheseregionsshouldverifytheexperienceofthelocalchannelfortheselectedUTMtechnology.

Strengths

Sophos'easeofuseconsistentlyrateshigh.Theinterfacecontainsgeneralguidanceonwhateachfeaturedoes,whichisusefulforSMBoperators,whoarenotallsecurityexperts.

SophosshowscommitmenttotheUTMmarketwithtworecentacquisitionsandstrongmarketingandR&Dinvestment.

Sophos'UTMcommunityofresellersandclientsremainsfaithfultothebrandandcontributestoregularspotonimprovementsofthetechnology.

SophossupportisavailableinavarietyofEuropeanlanguages,anditslocalpresaleandsupportpresencereceivedpositivescoresfromGartnercustomers.

Cautions

TheintegrationofCyberoam'stechnologywillbethemainchallengeforSophosduringthenext24months.Gartnerbelievesthat,despitesomesynergies,managingsignificantoverlapsinUTMproductportfolioscouldbedifficultforSophos'channel.

SophosUTM'suseridentityintegrationandvoiceoverIP(VoIP)managementlagbehindsomeofitsdirectcompetition.

ExceptforGermanyandtheU.K.,SophosisnotasvisibleinGartnerclientinquiriesasotherLeaders.

StormshieldFrancebasedStormshieldisasubsidiaryofAirbusDefenceandSpace,andtheresultofanoperationalmergerbetweentwoFrenchfirewallvendorsin2013(ArkoonandNetasq).InadditiontofirewallsandUTM,thevendorprovidesendpointanddatasecuritysolutions.ItsUTMproductline(StormshieldNetworkSecurity)ismadeofnineappliances,andsevenvirtualappliances,andisalsoavailableonAWS.StormshielddevelopeditsownIPS,whichisenabledinthedefaultUTMconfiguration.

http://www.juniper.net/http://www.stormshield.eu/enhttp://www.sophos.com/



Recentchangesincludethebrandingupdate,tunnelbasedSSLVPN,significantimprovementsintheURLfiltering,embeddedreportsandlogviewer,andsinglesignonauthenticationmodules.

StormshieldisagoodUTMcontenderforSMBsinEuropeandtheMiddleEast.Otherregionsshouldfirstmonitortheavailabilityandexperienceofthelocalchannel.

Strengths

Stormshieldhasasimpleserviceofferingwithtwomainbundles:alowcostbundleandapremiumbundlethatincludesKasperskyAntiVirusandvulnerabilitydetectionmodules.

Customersliketheeaseofinstallation,theintegratedrulecollisionmechanism,andtheavailabilityoflocalandglobalcertifications.

Stormshield'scustomerswilleventuallybenefitfromthelargerscaleandgreaterresourcesofthecombinedentity.ThevendorisstartingtobeseenasagrowingcompetitivethreatbyotherUTMvendorsinEurope.

Cautions

Despitelongtimeefforts,StormshieldhasnotmanagedtotakesignificantmarketshareoutsideofFrance.EuropeisamuchmorefragmentedmarketthanNorthAmericaorotherregionswithlargecountries,andassuch,requiresstronginvestmentforeachnewtargetedcountryoutsideofthevendor'shomemarket.

GartnerhasobservedthattheStormshieldmarketingmessageandannouncedroadmapshiftedfromSMBstowardlargeenterprisesjustafterthemerger,andthatroadmapexecutionstalledforafewmonths.ThelatestversionsnowtargetSMBclients,butSMBbuyersshouldrequirevisibilityregardingfutureroadmapdevelopments.

StormshieldUTMlackstheabilitytoapplyqualityofservice(QoS)rulesbasedonapplicationdetection.

WatchGuardSeattlebasedWatchGuardisawellestablishedUTMvendor.ItprovidesUTM,secureemailgatewaysandremotemanageablewirelessAPs.TheUTMproductlines(XTMandFirebox),include19physicalappliances,includingthreeapplianceswithembeddedwirelesscapabilitiesandfourvirtualappliances.

WatchGuardrecentreleasesincludeanewcloudbasedreportingandmonitoringsolution(WatchGuardDimension),aDLPaswellascloudbasedsandboxingmodules,andwirelessaccesspointmanagement.

WatchGuardisagoodshortlistcandidateforSMBorganizationsinneedofabroadsetoffeaturesorrelyingonanMSSPformanagingandmonitoringtheirUTM.

Strengths

WatchGuardprovidescloudbasedsandboxing(APTBlocker),andreportsaredirectlyintegratedinitscentralizeddashboardcloudservice(WatchGuardDimension).

WatchGuard'scustomersindicatethatcompletenessoffeaturesandlowpricearereasonstoselectWatchGuard.

WatchGuardhasdemonstratedastrongabilitytoexecuteonitsroadmap,leveragingitsplatformmodularitytoquicklyaddnewmodules.

TheWatchGuardDimensionreportingtoolincludesaninteractiveheatmapview(FireWatch)thatisusefultoquicklyidentifynetworkissuescreatedbyaspecificuserorapplication.

Cautions

WatchGuardappearsmorerarelyinGartnerclientshortlistsformidsizeordistributedorganizationsthanitsdirectcompetitors.

GartnerdoesnotseeWatchGuarddisplacingotherLeadersbasedontechnicalrequirements.

ClientsreportthattheonpremisescentralizedmanagementconsoleforWatchGuardUTMscouldbeimproved.

VendorsAddedandDroppedWereviewandadjustourinclusioncriteriaforMagicQuadrantsandMarketScopesasmarketschange.Asaresultoftheseadjustments,themixofvendorsinanyMagicQuadrantorMarketScopemaychangeovertime.Avendor'sappearanceinaMagicQuadrantorMarketScopeoneyearandnotthenextdoesnotnecessarilyindicatethatwehavechangedouropinionofthatvendor.Itmaybeareflectionofachangeinthemarketand,therefore,changedevaluationcriteria,orofachangeoffocusbythatvendor.

AddedAkerSecuritySolutions,HillstoneNetworksandBarracudaNetworkshavebeenadded.

DroppedKeriowasdroppedbecauseitdidnotmeetGartner'sinclusioncriteriaforthisMagicQuadrant.

InclusionandExclusionCriteriaInclusionCriteria

UTMcompaniesthatmeetthemarketdefinitionanddescriptionwereconsideredforthisreportunderthefollowingconditions:

TheyshippedUTMsoftwareand/orhardwareproductstargetedtoSMBsthatincludedcapabilitiesinthefollowingfeatureareasataminimum:

http://www.watchguard.com/



Networksecurity(statefulfirewallandintrusionprevention)

Websecuritygateway

Remoteaccessformobileemployees(VPNs)

Emailsecurity

TheyregularlyappearedonGartnermidsizeclientshortlistsforfinalselection.

TheyachievedUTMproductsales(notincludingmaintenanceorotherservicefees)ofmorethan$7millionin2013,andwithinacustomersegmentthat'svisibletoGartner.Theyalsoachievedthisrevenueonthebasisofproductsales,exclusiveofmanagedsecurityservice(MSS)revenue.

ThevendorcanprovideatleastthreereferencecustomerswillingtotalktoGartner,orGartnerhashadsufficientinputfromGartnerclientsontheproduct.

ExclusionCriteria

Therewasinsufficientinformationforassessment,andthecompanydidn'totherwisemeettheinclusioncriteriaorisn'tactivelyshippingproductsyet.

Productsaren'tusuallydeployedastheprimary,Internetfacingfirewall(forexampleproxyserversandnetworkintrusionpreventionsystem[IPS]solutions).

Productsarebuiltaroundpersonalfirewalls,hostbasedfirewalls,hostbasedIPSsandWebapplicationfirewallsallofwhicharedistinctmarkets.

SolutionsaretypicallydeliveredasMSS,totheextentthatproductsalesdidnotreachthe$7millionthreshold.

Inadditiontothevendorsincludedinthisreport,Gartnertracksothervendorsthatdidnotmeetourinclusioncriteriabecauseofaspecificverticalmarketfocusand/orUTMrevenueand/orcompetitivevisibilitylevels,includingAdytonSystems,eSoft,GajShield,ilemGroup,MyDigitalShield,Netgear,NorthCoastSecurityGroup,QuickHeal,Sangfor,SecPoint,Secui,Smoothwall,TrustwaveandZyXEL.

EvaluationCriteriaAbilitytoExecuteProductorService:Keyfeaturessuchaseaseofdeploymentandoperation,consolequality,price/performance,rangeofmodels,secondaryproductcapabilities(includinglogging,mobiledevicemanagement,integratedWiFisupportandremoteaccess),andtheabilitytosupportmultifunctiondeploymentsareweightedheavily.

OverallViability:Thisincludesavendor'soverallfinancialhealth,prospectsforcontinuingoperations,companyhistory,anddemonstratedcommitmenttothemultifunctionfirewallandnetworksecuritymarket.Growthofthecustomerbaseandrevenuederivedfromsalesarealsoconsidered.Allvendorsarerequiredtodisclosecomparablemarketdata,suchasmultifunctionfirewallrevenue,competitivewinsversuskeycompetitors(whichiscomparedwithGartnerdataonsuchcompetitionsheldbyourclients),anddevicesindeployment.Thenumberofmultifunctionfirewallsshippedisn'takeymeasureofexecution.Instead,weconsidertheuseofthesefirewallsandthefeaturesdeployedtoprotectthekeybusinesssystemsofGartnermidsizebusinessclients.

SalesExecution/Pricing:Thisincludespricing,thenumberofdeals,theinstalledbase,andthestrengthofsalesanddistributionoperationsofthevendors.Presalesandpostsalessupportareevaluated.Pricingiscomparedintermsofatypicalmidsizebusinessdeployment,includingthecostofallhardware,support,maintenanceandinstallation.Lowpricingwon'tguaranteehighexecutionorclientinterest.Buyerswantvaluemorethantheywantbargains,althoughlowpriceisoftenafactorinbuildingshortlists.Thetotalcostofownershipduringatypicalmultifunctionfirewalllifecycle(whichisthreetofiveyears)isassessed,asisthepricingmodelforaddingsecuritysafeguards.Inaddition,thecostofrefreshingtheproductsisevaluated,asisthecostofreplacingacompetingproductwithoutintolerablecostsorinterruptions.

MarketResponsiveness/Record:Thisincludestheabilitytorespond,changedirection,beflexible,andachievecompetitivesuccessasopportunitiesdevelop,competitorsact,customerneedsevolveandmarketdynamicschange.Thiscriterionalsoconsiderstheprovider'shistoryofresponsiveness.

MarketingExecution:Thisaddressesawarenessoftheproductinthemarket.Werecognizecompaniesthatareconsistentlyidentifiedbyourclientsandoftenappearontheirpreliminaryshortlists.

CustomerExperienceandOperations:Theseincludemanagementexperienceandtrackrecord,andthedepthofstaffexperiencespecificallyinthesecuritymarketplace.Thegreatestfactorinthesecategoriesiscustomersatisfactionthroughoutthesalesandproductlifecycle.Alsoimportantiseaseofuse,overallthroughputacrossdifferentdeploymentscenarios,andhowthefirewallfaresunderattackconditions(seeTable1).

Table1.AbilitytoExecuteEvaluationCriteria

EvaluationCriteria Weighting

ProductorService High

OverallViability Medium

SalesExecution/Pricing High

MarketResponsiveness/Record Medium

MarketingExecution Low



CustomerExperience Medium

Operations Medium


CompletenessofVisionMarketUnderstandingandMarketingStrategy:Theseincludeprovidingatrackrecordofdeliveringoninnovationthatprecedescustomerdemand,ratherthanan"us,too"roadmapandanoverallunderstandingandcommitmenttothesecuritymarket(specificallytheSMBnetworksecuritymarket).Gartnermakesthisassessmentsubjectivelybyseveralmeans,includinginteractionwithvendorsinbriefingsandfeedbackfromGartnerclientsoninformationtheyreceiveconcerningroadmaps.Incumbentvendormarketperformanceisreviewedyearlyagainstspecificrecommendationsthathavebeenmadetoeachvendor,andagainstfuturetrendsidentifiedinGartnerresearch.Vendorscan'tmerelystateanaggressivefuturegoal.Theymustenactaplan,showthatthey'refollowingitandmodifytheplanastheyforecasthowmarketdirectionswillchange.

SalesStrategy:Thisincludespreproductandpostproductsupport,valueforpricing,andclearexplanationsandrecommendationsfordetectioneventsanddeploymentefficacy.Buildingloyaltythroughcredibilitywithafulltimemidsizebusinesssecurityandresearchstaffdemonstratestheabilitytoassessthenextgenerationofrequirements.

Offering(Product)Strategy:Theemphasisisonthevendor'sproductroadmap,currentfeatures,leadingedgecapabilities,virtualizationandperformance.Thequalityofthesecurityresearchlabsbehindthesecurityfeaturesisconsidered.Credible,independentthirdpartycertifications,suchasCommonCriteria,areincluded.Integrationwithothersecuritycomponentsisalsoweighted,aswellasproductintegrationwithotherITsystems.Asthreatschangeandbecomemoretargetedandcomplex,weweightvendorshighlyiftheyhaveroadmapstomovebeyondpurelysignaturebased,deeppacketinspectiontechniques.Inaddition,weweightvendorsthataddmobiledevicemanagementtotheirofferingsandarelookingtosupportSMBorganizationsthatusecloudbasedservices.

BusinessModel:Thisincludestheprocessandsuccessrateofdevelopingnewfeaturesandinnovation,andR&Dspending.

Innovation:Thisincludesproductinnovation,suchasR&D,andqualitydifferentiators,suchasperformance,virtualization,integrationwithothersecurityproducts,amanagementinterface,andclarityofreporting.

GeographicStrategy:Thisincludestheabilityandcommitmenttoservicegeographies.

Themoreaproductmirrorstheworkflowofthemidsizebusinessoperationsscenario,thebetterthevision.Productsthataren'tintuitiveindeployment,oroperationsthataredifficulttoconfigureorhavelimitedreporting,arescoredaccordingly.Solvingcustomerproblemsisakeyelementofthiscategory.Reducingtherulebase,offeringinterproductsupportandbeatingcompetitorstomarketwithnewfeaturesareforemost(seeTable2).

Table2.CompletenessofVisionEvaluationCriteria

EvaluationCriteria Weighting

MarketUnderstanding High

MarketingStrategy High

SalesStrategy Medium

Offering(Product)Strategy Medium

BusinessModel Medium

Vertical/IndustryStrategy NotRated

Innovation High

GeographicStrategy Low


QuadrantDescriptionsLeadersTheLeadersquadrantcontainsvendorsattheforefrontofmakingandsellingUTMproductsthatarebuiltformidsizebusinessrequirements.Therequirementsnecessaryforleadershipincludeawiderangeofmodelstocovermidsizebusinessusecases,supportformultiplefeatures,andamanagementandreportingcapabilitythat'sdesignedforeaseofuse.Vendorsinthisquadrantleadthemarketinofferingnewsafeguardingfeatures,andinenablingcustomerstodeploytheminexpensivelywithoutsignificantlyaffectingtheenduserexperienceorincreasingstaffingburdens.Thesevendorsalsohaveagoodtrackrecordofavoidingvulnerabilitiesintheirsecurityproducts.Commoncharacteristicsincludereliability,consistentthroughput,andproductsthatareintuitivetomanageandadminister.

ChallengersTheChallengersquadrantcontainsvendorsthathaveachievedasoundcustomerbase,buttheyaren'tleadingwithfeatures.ManyChallengershaveothersuccessfulsecurityproductsinthemidsizeworldandarecountingontheclientrelationshiporchannelstrength,ratherthantheproduct,towindeals.Challengers'productsareoftenwellpriced,and,becauseoftheirstrengthinexecution,thesevendors



canoffereconomicsecurityproductbundlesthatotherscan't.ManyChallengersholdthemselvesbackfrombecomingLeadersbecausethey'reobligatedtosetsecurityorfirewallproductsasalowerpriorityintheiroverallproductsets.

VisionariesVisionarieshavetherightdesignsandfeaturesforthemidsizebusiness,butlackthesalesbase,strategyorfinancialmeanstocompetegloballywithLeadersandChallengers.MostVisionaries'productshavegoodsecuritycapabilities,butlacktheperformancecapabilityandsupportnetwork.Savingsandhightouchsupportcanbeachievedfororganizationsthatarewillingtoupdateproductsmorefrequentlyandswitchvendors,ifrequired.Wheresecuritytechnologyisacompetitiveelementforanenterprise,Visionariesaregoodshortlistcandidates.

NichePlayersMostvendorsintheNichePlayersquadrantareenterprisecentricorsmallofficecentricintheirapproachtoUTMdevicesforSMBs.SomeNichePlayersfocusonspecificverticalindustriesorgeographies.IfSMBsarealreadyclientsofthesevendorsforotherproducts,thenNichePlayerscanbeshortlisted.

ContextSMBshavesignificantlydifferentnetworksecurityrequirementsfromthoseoflargeenterprises,duetodifferentthreatenvironmentsanddifferentbusinesspressures.Althoughthebranchofficesofsomelargerenterpriseshaverequirementsthataresimilartomidsizebusinesses,thisisnotalwaysthecase.TheUTMmarketconsistsofawiderangeofsuppliersthatmeetthecommoncoresecurityrequirementsofSMBs,butbusinessesneedtomaketheirdecisionsbymappingtheirthreatanddeploymentpatternstooptimalofferings.

MarketOverviewTheUTMmarketismatureandmanySMBorganizationsarenowrenewingtheirUTMtechnology,ratherthanacquiringitforthefirsttime.Themarketisstillgrowingfasterthanothernetworksecuritymarkets,buthighermarketpenetrationwillslowlydrivetheUTMmarketgrowthratedown.In2014,SophosacquiredCyberoam,continuingtherecenttrendofconsolidationintheUTMmarket.

TheprimarycharacteristicofmidsizecompaniesisthattheyareorganizationswithresourceconstrainedITdepartments.Theyhavearelativelimitoncapitalexpenditures,operationalbudgets,numberofITstaffersanddepthofITskillswhencomparedwithlargeenterprises.Inkeepingwiththis,UTMappliancesarefrequentlyusedacrossmidsizebusinessesasalowcostwayofmeetingtheirnetworksecurityrequirements.Midsizebusinesseslookatsecuritydifferently,andshowdifferentbuyingbehaviorscomparedwithlargerenterprises.Theprimaryareasofdifferenceare(inorderofimportance):

Alimitedornonexistentskilledsecuritystaffdrivestheneedforeaseofinstallation,configurationanduseofchannelmanagedsolutions.

LesscomplexuseoftheInternetresultsinlowerdemandforhighendsecurityfeatures,suchasapplicationlevelsecurityandcustomintrusionpreventionfilters.

Limitedsecuritybudgetsdriveacquisitioncoststorepresentmorethan60%oftheoveralldecisionweighting.

Smallbusinessesoftenperceivethattheyarenotvisibletoattackersand,therefore,don'trequireasmuchsecurity.However,financiallymotivatedattackershavetargetedsmallbusinesses,andthepublicityoversuccessfulattackshaschangedthesebusinesses'perceptions.

Smallbusinesseswithfewerthan100employeeshaveevenmorebudgetarypressuresandevenfewersecuritypressures.Mostsecurityprocurementdecisionsaredrivenbynontechnicalfactorsandrarelyfeaturecompetitivecomparisons.Forthesereasons,thisMagicQuadrantfocusesontheUTMproductsusedbymidsizebusinesses,asdefinedabove.

ThesedifferencesbetweenSMBandlargeenterpriseexpectationsareoneofthemajorreasonswhymanyoffirewallvendorsthatsellsuccessfullytotheenterpriseandSMBmarketstendtohaveseparatesoftwareorevenproductlinesforeachmarket.

UTMVendorsTargetLargeEnterprisesWithDifferentApproaches

AllofthevendorssurveyedagreeonthedifferentgotomarketapproacheswhentargetingSMBsversuslargeenterpriseclients.SMBsmoreoftenrelyontheirchannelpartnertochoosethecorrectallinoneUTMplatform,whereaslargeenterprisesecuritybuyersconducttheirownselectionprocess.SMBresellersalsohandleLevel1andLevel2supportsomealsobecomelocalLevel3supportcentersonbehalfofthevendor.

ThemarketpenetrationforSMBsishigh,anddisplacingactivechannelpartnersfromanotherUTMvendorisdifficultbecauseitmeansthesepartnerswillhavetomaintainthelegacytechnologyofexistingcustomers,andalsolearnthevendor'sreplacementtechnology.Evenifsomechanneldisplacementhappensfollowinganacquisitionormergerannouncement,GartnerobservesthatmanyUTMvendorsconsiderSMBsasamature,lowgrowthmarketandfocusonnewtargetcustomers.

Themostbasictacticistoreleasemorepowerfulappliances,runthesamesoftwarestackandselltheUTMcorevalueofallinonesecurity.Thisshortsightedapproachdoomsthevendorstonicheusecases,suchasbudgetconstrainedlowersizelargeenterprises,whicharecomposedofslightlymorethan1,000employees.SomeofthelargerUTMvendorsimproveonthisinitialapproachwithanoptimizedsoftwarestackthatisdevelopedtoprovideanenhancedofferfortheusecaseofahighperformancefirewall.Despitethemanagementinterfacebeingcrowdedwithunnecessaryfeatures,thegoodpriceofferedbyvendorsthatareaggressivelywillingtotakemarketshareawayfromtheincumbententerprisefirewallvendorsisattractivetomanyenterprises.However,UTMvendorsthatdonottakeamoredifferentiatedproductapproachwon'tdisplaceleadingenterprisevendorsatlarge,TypeAorganizations(see"MagicQuadrantforEnterpriseNetworkFirewalls").



Alternatively,afewprovidersnowtargetdistributedorganizationsthathaveneedsclosetothoseofmidsizeorganizations.ThisincludesMSSPsforSMBsanddistributedenterpriseslikeretailers,healthorganizationsandsmallgovernmentalagencies.Despitecentralizedpurchaseandmaintenancecenters,eachofficeissimilartoanautonomousorganization.Recentlyreleasedoffersincludecentralizedcloudbasedmanagementandreportingandwirelessaccesspointmanagement,sometimeswithadditionalfeaturestargetingorganizationsfromtheretailindustry,suchaswirelessanalytics,butalsosmallerappliancesoflessthan$500.

UTMvendorsincreasinglyarefightingoverinitialpurchaseprices,andallvendorsmanagetowindealsonthestrengthofthissoleadvantage,basedonthetargetedverticalandgeographicarea.Inthelongerterm,thesecuritymarketforSMBmightbeinfluencedbytheincreasedadoptionofmobiletechnology,cloudservicesandforuppermidsizebusinessesvirtualizeddemilitarizedzone(DMZ)anddatacenter.WhilethereisnovisibleactorthatcoulddisrupttheUTMmarketyet,alternateapproaches,suchasendpointandmobiledevicemanagementorsecureWebgatewayhostedinthecloud,couldbecomemoreseriouscontenders.

2014Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.oritsaffiliates.ThispublicationmaynotbereproducedordistributedinanyformwithoutGartnerspriorwrittenpermission.Ifyouareauthorizedtoaccessthispublication,youruseofitissubjecttotheUsageGuidelinesforGartnerServicespostedongartner.com.Theinformationcontainedinthispublicationhasbeenobtainedfromsourcesbelievedtobereliable.Gartnerdisclaimsallwarrantiesastotheaccuracy,completenessoradequacyofsuchinformationandshallhavenoliabilityforerrors,omissionsorinadequaciesinsuchinformation.ThispublicationconsistsoftheopinionsofGartnersresearchorganizationandshouldnotbeconstruedasstatementsoffact.Theopinionsexpressedhereinaresubjecttochangewithoutnotice.AlthoughGartnerresearchmayincludeadiscussionofrelatedlegalissues,Gartnerdoesnotprovidelegaladviceorservicesanditsresearchshouldnotbeconstruedorusedassuch.Gartnerisapubliccompany,anditsshareholdersmayincludefirmsandfundsthathavefinancialinterestsinentitiescoveredinGartnerresearch.GartnersBoardofDirectorsmayincludeseniormanagersofthesefirmsorfunds.Gartnerresearchisproducedindependentlybyitsresearchorganizationwithoutinputorinfluencefromthesefirms,fundsortheirmanagers.ForfurtherinformationontheindependenceandintegrityofGartnerresearch,seeGuidingPrinciplesonIndependenceandObjectivity.

AboutGartner|Careers|Newsroom|Policies|SiteIndex|ITGlossary|ContactGartner

http://www.gartner.com/technology/about.jsphttp://www.gartner.com/technology/about/policies/guidelines_ov.jsphttp://www.gartner.com/technology/about/policies/usage_guidelines.jsphttp://www.gartner.com/technology/it-glossaryhttp://www.gartner.com/technology/site-index.jsphttp://www.gartner.com/technology/about/ombudsman/omb_guide2.jsphttp://www.gartner.com/technology/careershttp://www.gartner.com/technology/contact/contact_gartner.jsphttp://www.gartner.com/it/products/newsroom