Tag: Gartner

Rapid AI adoption and emerging supplier sovereignty requirements are shaping buyer priorities for endpoint protection products. Buyers should factor in sovereignty objectives, as well as requirements for AI discovery and usage control on corporate endpoints, when selecting vendors.

Strategic Planning Assumptions

• By 2028, 90% of endpoint protection vendors will offer AI discovery and usage control features.
• By 2029, 30% of midsize organizations will converge endpoint, data security and identity security capabilities into a workspace security platform, enabling holistic protection and centralized policy management.
• By 2029, organizations that integrate endpoint security tools, management processes and operations teams will reduce incident response times by at least 40%.

Download the full report: Gartner Reprint

Customer experience and vendor trust are key drivers for provider selection due to the maturity and mainstream adoption of EPPs. Buyers should assess solutions in the context of a broader integrated workspace security strategy as part of their cybersecurity technology optimization efforts.

Strategic Planning Assumptions

By 2029, 30% of midsize organizations will converge workspace, data security and identity security capabilities into a workspace security platform, enabling holistic protection and centralized policy management.

By 2030, 25% of enterprises will adopt a continuous assessment and optimization process to assess and remediate workspace security controls in a targeted fashion to reduce the attack surface.

Market Definition/Description

Gartner defines an endpoint protection platform (EPP) as security software designed to protect managed endpoints — including desktop PCs, laptop PCs, virtual desktops, mobile devices and, in some cases, servers — against known and unknown malicious attacks. EPPs provide capabilities for security teams to investigate and remediate incidents that evade prevention controls. EPP products are delivered as software agents, deployed to endpoints, and connected to centralized security analytics and management consoles.

EPPs provide a defensive security control to protect end-user endpoints against known and unknown malware infections and file-less attacks using a combination of security techniques (such as static and behavioral analysis) and attack surface reduction capabilities (such as device control, host firewall management and application control). EPP prevention and protection capabilities are deployed as a part of a defense-in-depth strategy to help reduce the endpoint attack surface and minimize the risk of compromise. EPP detection and response capabilities are used to uncover, investigate and respond to endpoint threats that evade security protection, often as a part of broader threat detection, investigation and response (TDIR) capable products.

Mandatory Features

– Protection against malware and file-less attacks using endpoint real-time scanning and anti-malware techniques
– Endpoint attack surface reduction capabilities, such as device control, host firewall, exploit protection or application control
– Detection and blocking of endpoint threats using behavioral analysis of endpoint, application and end-user activity

Common Features

– Integrated endpoint detection and response (EDR) functionality enabling real-time telemetry collection, detection customization, postincident investigation and response
– Assessment of endpoints for software and OS vulnerabilities and misconfigurations, as well as built-in or integrated patch management and virtual patching capabilities
– Capabilities for continuous assessment and optimization of EPP policies and settings against configuration best practices and emerging threats
– Workspace security platform integrations with email security, security service edge, identity protection, data security controls and endpoint management tools
– Integrations with native and third-party TDIR capable products enabling telemetry collection, correlation, investigation and remediation across multiple security controls
– Extended support for end-of-life, uncommon operating systems or legacy server workloads
– Partner- and vendor-delivered service wrappers, such as managed detection and response (MDR) and co-managed security monitoring services

Read the full report: https://www.gartner.com/doc/reprints?id=1-2LFIK3DH&ct=250711&st=sb

Security service edge is a dynamic market that consolidates multiple access-related point offerings into a single cloud-centric converged offering. This Magic Quadrant will help buyers evaluate key vendors ideally in the context of a SASE strategy.

Market Definition/Description

Gartner defines security service edge (SSE) as an offering that secures access to the web, cloud services and private applications regardless of the location of the user, the device they are using or where that application is hosted. SSE protects users from malicious and inappropriate content on the web and provides enhanced security and visibility for the SaaS and private applications accessed by end users.

Security service edge provides a primarily cloud-delivered solution to control access from end users and devices to applications, as well as websites and the internet. It provides a range of security capabilities, including adaptive access based on identity and context, malware protection, data security and threat prevention, as well as the associated analytics and visibility. It enables more direct connectivity for hybrid users by reducing latency and providing the potential for improved user experience. Capabilities that are integrated across multiple traffic types and destinations allow a more seamless experience for both users and administrators while maintaining a consistent security stance.

Mandatory Features

The mandatory features of this market include:

– Management and data planes that are primarily cloud-delivered
– Identity-aware forward proxy with decryption and protection capabilities
– In-line protection of data in SaaS and private apps
– Out of band protection of data in SaaS apps via API integration
– Adaptive and granular access control supporting both devices with an SSE agent (or similar traffic steering method) and devices with no local SSE software or configurations
– Integration with external identity providers

Common Features

The common features of this market include:

– Single integrated console supporting all features and functions of the platform
– Ability to apply controls consistently across multiple network and application destinations
– Support for managing and securing traffic from all common endpoints (such as Windows, macOS, iOS and Android devices)
– Integration with key enterprise technologies such as security information and event management (SIEM), extended detection and response (XDR), SD-WAN and other adjacent technologies
– Support for published and documented APIs that are accessible to the customer and that allow automation of common tasks and integration with other security platforms
– Curated, managed and risk-scored catalogs of SaaS applications
– Control of traffic on all ports and protocols
– Remote browser isolation (RBI) to enhance security across all network destinations and channels
– SaaS security posture management for visibility and remediation of SaaS configurations and visibility into SaaS plug-in applications
– Continuous adaptive access controls across all channels based on initial connection status and any change in state during connection
– Read, write and act upon labels from common data classification platforms
– Embedded user entity behavior analytics (UEBA) to provide automated detection and response for anomalous and risky device and user behaviors
– Ability to apply advanced data protection capabilities

Read the full report: https://www.gartner.com/doc/reprints?id=1-2L1V48AF&ct=250521&st=sb

The SASE platform market is evolving as more vendors enter the market and offerings mature. Still, there is differentiation in vendor capabilities and strategies. I&O leaders responsible for networking and cybersecurity should use this research to help determine the right vendor for their needs.

Strategic Planning Assumption

By 2028, 70% of SD-WAN purchases will be part of a single-vendor SASE Platform offering, up from 25% in 2025.

By 2028, 50% of new SASE deployments will be based on a single-vendor SASE Platform offering, up from 30% in 2025.

Market Definition/Description

Gartner defines single-vendor secure access service edge (SASE) offerings as those that deliver multiple converged-network and security-as-a-service capabilities, such as software-defined wide-area network (SD-WAN), secure web gateway (SWG), cloud access security broker (CASB), network firewalling and zero trust network access (ZTNA). These offerings use a cloud-centric architecture and are delivered by one vendor.

SASE securely connects users and devices with applications. It supports branch office, remote worker and on-premises general internet security, private application access and cloud service consumption use cases.

Must-Have Capabilities

The must-have capabilities for this market include the following functionalities, primarily delivered as a cloud service:

• Secure web access via proxy
• In-line SaaS visibility and access controls
• Identity-, context- and policy-based secure remote access to private applications
• A branch appliance that supports dynamic traffic steering out of multiple physical, locally attached WAN interfaces, with steering based on applications (not just IPs/ports)
• Firewalling to secure traffic bidirectionally across networks
• Centralized management that covers all of the above capabilities of the offering (with both GUI and API) enabling visibility, troubleshooting, reporting and enables granular configuration and policy changes

Standard Capabilities

The standard capabilities for this market include:

• Unified management delivered by a single console covering all capabilities of the offering (with GUI and API) enabling visibility, troubleshooting, reporting, and enabling granular configuration and policy changes
• The ability to secure end-user browsing via RBI or a secure enterprise browser
• Sensitive data visibility and control

Optional Capabilities

The optional capabilities for this market include:

Advanced network functionality, including enhanced internet, private backbone transport, content delivery networks, external DNS services, cloud onramps (simplified and automated integration with public cloud networking services), or advanced branch networking features

Security capabilities, such as network sandboxing, DNS protection, SaaS security posture management (SSPM), API-based access to SaaS for data context and configuration information, application layer visibility and protection, and continuous adaptive risk scoring.

Read the report: https://www.gartner.com/doc/reprints?id=1-2LEQDK91&ct=250708&st=sb