6/19/2015

MagicQuadrantforSecureWebGateways

MagicQuadrantforSecureWebGateways
28May2015ID:G00267241
Analyst(s):LawrenceOrans,PeterFirstbrook

VIEWSUMMARY
ThemarketforSWGsolutionsisstilldominatedbytraditionalonpremisesappliances.But,theuseof
cloudbasedservicesisgrowingrapidly,andadvancedthreatprotectionfunctionalityremainsan
importantdifferentiator.

EVALUATIONCRITERIADEFINITIONS
AbilitytoExecute

MarketDefinition/Description

Product/Service:Coregoodsandservicesofferedby
thevendorforthedefinedmarket.Thisincludes
currentproduct/servicecapabilities,quality,feature
sets,skillsandsoon,whetherofferednativelyor
throughOEMagreements/partnershipsasdefinedin
themarketdefinitionanddetailedinthesubcriteria.

SecureWebgateways(SWGs)utilizeURLfiltering,advancedthreatdefense,legacymalwareprotection
andapplicationcontroltechnologiestodefendusersfromInternetbornethreatsandtohelpenterprises
enforceInternetpolicycompliance.SWGsareimplementedasonpremisesappliances(hardwareand
virtual),cloudbasedservicesorinhybridmode(combinedonpremisesappliancesandcloudbased
services).Vendorscontinuetodiffergreatlyinthematurityandfeaturesoftheircloudbasedservicesand
intheirabilitytoprotectenterprisesfromadvancedthreats.

OverallViability:Viabilityincludesanassessmentof
theoverallorganization'sfinancialhealth,thefinancial
andpracticalsuccessofthebusinessunit,andthe
likelihoodthattheindividualbusinessunitwillcontinue
investingintheproduct,willcontinueofferingthe
productandwilladvancethestateoftheartwithinthe
organization'sportfolioofproducts.

Ashighlightedin"MarketGuideforNetworkSandboxing,"SWGvendorsarecompetingagainstfirewall,
intrusionpreventionsystem(IPS)andunifiedthreatmanagement(UTM)vendorsthatalsosell
sandboxingasanoptionalfeature.Thefirewallvendors,PaloAltoNetworksinparticular,havebenefited
fromanearlymoveradvantageinnetworksandboxing.In2015,GartnerexpectsthatSWGvendorswill
competemoreaggressivelyagainstthefirewall/IPS/UTMvendors,andagainststandalonesandboxing
solutions,asmorevendorsoffernetworksandboxingsolutionsthatintegratewithSWGs.
OrganizationsthatareconsideringamovetoSWGbasedcloudserviceshavemanyoptions,butwillfind
significantdifferencesduringthesalesprocess.Somevendors,suchasBlueCoatandZscaler,have
strongpartnershipswithcarriersandISPs,whichhasproventobeasuccessfulgotomarketstrategy
becauseserviceproviderscanupsellsecureInternetaccesswithbandwidthcontracts.Othervendors,
suchasBarracudaNetworksandIntelSecurity,havestillnotdemonstratedthevisioninbuildingan
effectivesaleschannelforcloudservices.Thetraditionalvalueaddedreseller(VAR)channelthatmany
vendorsrelyuponforSWGappliancesaleshasbeenlargelyineffectiveinsellingcloudbasedservices.
Becauseoftherequirementtodefendagainstadvancedthreats,itisnolongerenoughforacloudbased
SWGtoonlyofferthetraditionalSWGservices(forexample,URLfilteringandbasicmalwaredetection).
Enterprisesthatconnectremoteoffices(andheadquartersoffices)directlytotheInternet,without
backhaulingtraffictoacentralizeddatacenter,willneedcloudbasedadvancedthreatservices.Vendors
thatoffercloudbasedSWGs,andonlyofferonpremisesappliancebasedadvancedthreatproducts,need
toquicklyporttheiradvancedthreatofferingstoacloudplatformanddeliverthisfunctionalityasa
service.VendorssuchasBlueCoat,IntelSecurityandothersfallintothiscategory.

MagicQuadrant
Figure1.MagicQuadrantforSecureWebGateways

SalesExecution/Pricing:Thevendor'scapabilitiesin
allpresalesactivitiesandthestructurethatsupports
them.Thisincludesdealmanagement,pricingand
negotiation,presalessupport,andtheoverall
effectivenessofthesaleschannel.
MarketResponsiveness/Record:Abilitytorespond,
changedirection,beflexibleandachievecompetitive
successasopportunitiesdevelop,competitorsact,
customerneedsevolveandmarketdynamicschange.
Thiscriterionalsoconsidersthevendor'shistoryof
responsiveness.
MarketingExecution:Theclarity,quality,creativity
andefficacyofprogramsdesignedtodeliverthe
organization'smessagetoinfluencethemarket,
promotethebrandandbusiness,increaseawareness
oftheproducts,andestablishapositiveidentification
withtheproduct/brandandorganizationintheminds
ofbuyers.This"mindshare"canbedrivenbya
combinationofpublicity,promotionalinitiatives,
thoughtleadership,wordofmouthandsalesactivities.
CustomerExperience:Relationships,productsand
services/programsthatenableclientstobesuccessful
withtheproductsevaluated.Specifically,thisincludes
thewayscustomersreceivetechnicalsupportor
accountsupport.Thiscanalsoincludeancillarytools,
customersupportprograms(andthequalitythereof),
availabilityofusergroups,servicelevelagreements
andsoon.
Operations:Theabilityoftheorganizationtomeet
itsgoalsandcommitments.Factorsincludethequality
oftheorganizationalstructure,includingskills,
experiences,programs,systemsandothervehicles
thatenabletheorganizationtooperateeffectivelyand
efficientlyonanongoingbasis.
CompletenessofVision
MarketUnderstanding:Abilityofthevendorto
understandbuyers'wantsandneedsandtotranslate
thoseintoproductsandservices.Vendorsthatshow
thehighestdegreeofvisionlistentoandunderstand
buyers'wantsandneeds,andcanshapeorenhance
thosewiththeiraddedvision.
MarketingStrategy:Aclear,differentiatedsetof
messagesconsistentlycommunicatedthroughoutthe
organizationandexternalizedthroughthewebsite,
advertising,customerprogramsandpositioning
statements.
SalesStrategy:Thestrategyforsellingproductsthat
usestheappropriatenetworkofdirectandindirect
sales,marketing,service,andcommunication
affiliatesthatextendthescopeanddepthofmarket
reach,skills,expertise,technologies,servicesandthe
customerbase.
Offering(Product)Strategy:Thevendor'sapproach
toproductdevelopmentanddeliverythatemphasizes
differentiation,functionality,methodologyandfeature
setsastheymaptocurrentandfuturerequirements.
BusinessModel:Thesoundnessandlogicofthe
vendor'sunderlyingbusinessproposition.
Vertical/IndustryStrategy:Thevendor'sstrategy
todirectresources,skillsandofferingstomeetthe
specificneedsofindividualmarketsegments,including
verticalmarkets.
Innovation:Direct,related,complementaryand
synergisticlayoutsofresources,expertiseorcapital
forinvestment,consolidation,defensiveorpre
emptivepurposes.
GeographicStrategy:Thevendor'sstrategytodirect
resources,skillsandofferingstomeetthespecific
needsofgeographiesoutsidethe"home"ornative

http://www.gartner.com/technology/reprints.do?id=12GM8JZK&ct=150529&st=sb

10/19

6/19/2015

MagicQuadrantforSecureWebGateways
geography,eitherdirectlyorthroughpartners,
channelsandsubsidiariesasappropriateforthat
geographyandmarket.

Source:Gartner(May2015)

VendorStrengthsandCautions
BarracudaNetworks
BasedinCampbell,California,Barracudaprovidesabroadarrayofcosteffectivenetworkandapplication
securityproducts,aswellasstorageandproductivitysolutions.Barracuda'sWebFilterappliancesare
complementedbyitscloudbasedproxyservice(WebSecurityService).Barracudacustomerstypically
implementitsappliancesintransparentbridgemodetoviewallnetworktraffic,buttheappliancescan
alsobeimplementedinproxymode.Barracudaistransitioningthepolicyenforcementmodelofitscloud
servicefromcloudbasedenforcementtoagentbasedenforcement(basedonacloudlookup
mechanism).BarracudalicensesLastline'scloudbasedsandboxtechnologyandhasintegratedthe
solutionwithitsfirewallproducts.IntegrationwithBarracuda'sSWGproductswillbedeliveredlaterin
2015.Thisyear,BarracudamovesfromtheChallengersquadranttotheNichePlayersquadrant,duein
parttoitsstagnantmarketshare.Its2009acquisitionofcloudbasedSWGservicesvendorPurewirehas
addedonlymarginalrevenuegrowth.Barracuda'sWebFilterappliancesaregoodcandidatesforSMBsand
costconsciousenterprises.
Strengths
Barracuda'sInstantReplacementprogram,whichprovidesnextbusinessdayshippingof
replacementunits,includesafreeappliancereplacementuniteveryfouryears.
Applicationcontroliscomprehensiveandincludesgranularsocialmediacontrolsandsocialmedia
archiving.InlinedeploymentsofBarracuda'sSWGenableittofilterallportsandprotocols.
Barracudaprovidesafree,lightweightmobiledatamanagementcapabilitytosimplifythe
deploymentofitssafebrowserandthemanagementofpoliciesonmobiledevicesrunningAppleiOS
andAndroid.
Barracudareferencescommentedfavorablyregardingtheeaseofdeploymentandmanagementof
theWebFilterappliances.
Cautions
DedicatedfocusonSMBstypicallyresultsinsolutionsthataremissingfeaturesfavoredbylarge
enterprisecustomers.LackofsupportforauthenticationviaSecurityAssertionMarkupLanguage
(SAML)isanexampleofthistradeoff.
Atthetimeofthiswriting,malwaredetectiontechniquesonBarracuda'sSWGappliancesare
primarilysignaturebased.ThereisverylittlerealtimeanalysisofWebcontent,suchasstaticcode
analysis.
Barracuda'sadvancedthreatdefensestrategyisheavilydependentonthetechnologythatithas
licensedfromLastline,whichisasmallcompany.IfLastlinegetsacquiredbyanothersecurity
vendor,thenBarracudamayneedtorevisititsadvancedthreatdefensestrategy.

BlueCoat
BasedinSunnyvale,California,BlueCoatoffersappliancebasedSWGsandacloudbasedSWGservice.In
additiontoitsSWGsolutions,BlueCoatalsoofferstheseappliancebasedproducts:anetworksandbox
(MalwareAnalysisAppliance),anetworkforensicstool(SecurityAnalyticsPlatform),andamalware
detectionappliance(ContentAnalysisSystem)thatanalyzestrafficforwardedtoitbyBlueCoatproxies.A
partnershipwithAT&TenablesthecarriertoresellBlueCoat'scloudbasedSWGservice.InMay2015,
privateequityfirmBainCapitalcompleteditsacquisitionofBlueCoatfromThomaBravo(alsoaprivate
equityfirm)for$2.4billion.BainCapital'sstatedintentistoprepareBlueCoatforareturntopublic

http://www.gartner.com/technology/reprints.do?id=12GM8JZK&ct=150529&st=sb

11/19

6/19/2015

MagicQuadrantforSecureWebGateways

markets.BlueCoat'sappliancesaregoodcandidatesformostlargeenterprisecustomers,particularly
thoserequiringhighlyscalableSWGs.BlueCoat'scloudserviceisagoodoptionformostenterprises.
Strengths
TheProxySGisthestrongestproxyinthemarketintermsofbreadthofprotocolsandthenumber
ofadvancedfeatures.Itsupportsabroadsetofprotocolsaswellasextensiveauthenticationand
directoryintegrationoptions.
BlueCoat'shybridoffering(cloudserviceandonpremisesappliances)enablesoperationsteamsto
managepoliciesfromasingleconsole(althoughpoliciescanbepushedonlyinonedirectionfrom
thecloudtoonpremisesappliances).
ByintegratingthedetectioncapabilitiesoftheMalwareAnalysisAppliancewiththeforensics
capabilitiesoftheSecurityAnalyticsPlatform,BlueCoatgivessecurityoperationsteamstheability
toshortentheincidentresponsewindow.
BlueCoatprovidesstrongsupportforSSL.AllProxySGmodelsincludeSSLhardwareassisttooffload
processingfromthemainCPU.ThestandaloneSSLVisibilityAppliancecanbeusedtodecryptSSL
trafficandfeedittoBlueCoatandnonBlueCoatsecuritysolutions(forexample,dataloss
prevention[DLP]andnetworksandboxes).
Cautions
BecauseBlueCoat'sadvancedthreatdefensesolutionrequiresmultiplecomponents,itisexpensive.
TheProxySGdoesnotdepositsuspiciousfilesdirectlyintotheMalwareAnalysisAppliance.
CustomersmustpurchasetheContentAnalysisSystemiftheywanttoautomaticallydetect
suspiciousfilesandanalyzethemintheMalwareAnalysisAppliance.
BlueCoatlacksacloudbasedsandbox.CustomersthathavemigratedtoacompleteBlueCoat
cloudbasedSWG(noonpremisesSWGs)areunabletousenetworksandboxingtechnologyto
detectthreatsandtargetedattacks.
TheProxySGcannotmonitorallnetworktraffic(whichisusefulfordetectingoutboundmalware)
whenimplementedinexplicitproxymode,whichishowitismostcommonlydeployed.

Cisco
Cisco,basedinSanJose,California,isaleadingsupplierofnetworkinginfrastructuretolargeenterprises.
Itoffersonpremisesappliances,theWebSecurityAppliance(WSA)andacloudbasedservice,CloudWeb
Security(CWS).RecentacquisitionsincludeSourcefire(2013),CognitiveSecurity(2013)andThreatGRID
(2014).Sourcefire'sprimaryfocuswasonintrusionprevention.Cognitive'sfocuswasonthreatanalytics,
andThreatGRIDwasofferingacloudbasedsandbox.Thisyear,CiscomovedfromtheLeadersquadrant
intotheChallengersquadrant,dueinparttoitsslowprogressindevelopingahybrid(onpremises
equipmentandcloudbasedservices)strategy.Bynotofferingatruehybridsolution,Ciscoismissingan
opportunitytohelpitsWSAcustomersselectivelyaddcloudservicesandtoprovideasmoothtransitionto
ahybridorallcloudoffering.CiscoalsolostCompletenessofVisionpointsduetononuniformthreat
detectioncapabilitiesbetweenitsonpremisesandcloudbasedservices.AsnotedintheCautionssection,
CognitiveThreatAnalytics(CTA)isintegratedonlywithCisco'scloudservice.Ithasnotyetbeen
integratedwithCisco'sappliances,eventhoughCiscoacquiredCognitiveSecurityinFebruary2013.
Cisco'sWSAisagoodsolutionformostmidsizeorlargeenterprises,whiletheCWSserviceisagood
optionformostenterprises.
Strengths
TheWSAprovidesmultiplesecuritylayersonasingleappliance.Adaptivescanningdirectssuspicious
contenttotheantimalwareenginethatisbestoptimizedtoscanthecontent.AdvancedMalware
Protection(AMP)technologyfromSourcefireprovidesfilereputation,fileanalysisandretrospective
alerts(toreceivemaximumvaluefromAMP,CiscorecommendsinstallingtheFireAMPConnector
agentonendpoints).TheThreatGRIDtechnologywillimproveAMP'ssandboxingcapabilityonceit
hasbeenfullyintegrated.
TheLayer4TrafficMonitorfeatureontheWSAenablesvisibilityacrossallportsandprotocolsby
connectingtoaSwitchedPortAnalyzer(SPAN)mirroredportonaLANswitch.Bymonitoringall
traffic(notjustWebtraffic),Ciscoimprovesitsmalwaredetectioncapability.
TheCWSservicebenefitsfromanumberoftrafficredirectionoptionsthatareintegratedinto
existingCiscoproducts.TheAdaptiveSecurityAppliance(ASA)firewall,IntegratedServicesRouter
(ISR)Generation2andWSAallsupportCisco's"connector"software,whichdirectstraffictothe
CWSservice.
MobileplatformsupportisastrengthoftheCWSserviceforcustomersthathavealready
implementedCisco'spopularAnyConnectclient.ThecloudservicesupportsWindows,MacOSX,
AppleiOS,Android,WindowsPhone8andBlackBerry.
Cautions
Despiteitsobviousnetworkexpertiseandrelationships,Ciscohasnotdemonstratedsignificantfocus
ontheSWGmarket.Overallmarketshare(onpremisesappliancesandcloudservices)hasbeenflat
since2009,theyearthatCiscoacquiredScanSafe.Cisco'scloudservicehasasurprisinglysmall
globalfootprint(15countries)givenCisco'sresourcesandthenumberofyearsithasbeeninthe
SWGmarket.Newerrivalshavebeenmoreaggressiveinglobalexpansion.
CiscohasbeenslowtointegrateitscloudbasedSWGwithitsonpremisesSWG(IronPort
acquisitionin2007).Customersseekingahybridcloud/onpremisessolutionwillneedtwoconsoles.
Theconsoleslackautomatedpolicysynchronization(tosharepoliciesbetweencloudandon
premisesusers).
TheCTAservice,whichdetectsthreatsbasedonWebloganalysis,isnotavailabletoWSA
customers.OnlyCWScustomerscanusetheCTAfunctionality.

ContentKeeper
ContentKeeperisbasedinAustralia,whereithasmanylargegovernment,educationandcommercial
customers.ItoffersafamilyofSWGappliances,whichdeployintransparentbridgemode,anditalso
providesahostedcloudbasedservice.ContentKeeper'sadvancedthreatsolutionscanbeimplemented
onpremisesorinitshostedcloudservice.ContentKeeperhasbeenexpandingitspresenceinNorth
America.ItssolutionsareagoodoptionformidsizeorlargeorganizationsandforK12schoolsin
supportedgeographies.

http://www.gartner.com/technology/reprints.do?id=12GM8JZK&ct=150529&st=sb

12/19

6/19/2015

MagicQuadrantforSecureWebGateways

Strengths
ThebridgebasedSecureInternetGatewayhasbeendesignedforhighthroughput.Reference
customersreportthroughputupto5Gbps.
StrongsupportformobiledevicesenablesContentKeepertoappealtoK12schooldistrictsand
otherorganizationsthatissuetabletstoendusers.
ContentKeeperappliancessupporttheabilitytoinspectSSLtraffic.
ReferencecustomerscommentedfavorablyonContentKeeper'sserviceandsupport.
Cautions
ContentKeeperlacksashared,multitenant,IPsecbasedcloudSWGservice.Itprovidesahosted
cloudoffering,wherecustomersrunvirtualapplianceshostedinAmazon'scloudservice(andin
someContentKeepermanageddatacenters).Hostedofferingsdonotscaleasdynamicallyasshared
multitenantclouds.
ContentKeeperhasyettoearnrecognitionasaleadingadvancedthreatdefensecompany.
Prospectivecustomersshouldcarefullytesttheefficacyofitsadvancedthreatcapabilitiesagainst
competingsolutions.
Theworkflowtoolsforrespondingtomalwareincidentsneedimprovement.Thelackofseverity
indicatorsonContentKeeper'sdashboardmakesitdifficulttoprioritizemalwarealerts.

iboss
IbossisaprivatelyheldcompanybasedinSanDiego,California.Itoffersafamilyofappliancebased
platforms,whicharetypicallydeployedintransparentbridgemode.Italsooffersacloudbasedservice.In
2014,ibossannouncedFireSphere,aninternallydevelopedcloudbasedserviceformalwaredetection.
IbossisagoodoptionformidsizeorlargeenterprisesandforK12schoolsinsupportedgeographies.
Strengths
TheFireSphereservicecombinesmultiplemalwaredetectioncapabilities,includingNetFlowanalysis
andsandboxingtechnology.
FullSSLcontentinspectionisprovidedagentlessatthegateway,orwithanoptionalagentbased
solutiononendpoints.Theagentisascalableapproachthatrelievestheibossapplianceofthe
burdenofmanagingcertificatesandofterminatinganddecryptingSSLtraffic.
Bandwidthcontrolsareveryflexible.Forexample,bandwidthquotascanbeappliedtoaspecific
organizationalunitinActiveDirectory,andtheyalsocanbeassignedtoaspecificdomain.
Ibosscustomerscommentedonthestrengthofitsreportingcapabilities.
Cautions
Prospectivecustomersofiboss'cloudbasedSWGserviceshouldtestitcarefully.Gartnerrarelysees
customersadoptingibossasapureplaycloudservice.Mostimplementationsoftheibosscloud
serviceareinhybridmode(deployedinconjunctionwithanibossappliance).
TheibosscloudbasedservicelackssupportforSAML,apopularauthenticationtechniquethatmany
enterprisesalreadyhaveadoptedtoauthenticateuserstoSaaSapplications.
IbosshasonlyalimitedsetofcustomersoutsideNorthAmerica.Prospectivecustomersoutside
NorthAmericashouldvalidatethatibosspartnersarequalifiedtoprovidesalesandtechnical
support.

IntelSecurity(McAfee)
IntelSecurity,basedinSantaClara,California,offersafamilyofonpremisesSWGappliances(McAfee
WebProtection)andcloudbasedSWGservices(McAfeeSaaSWebProtection).TheSWGappliancesare
mostcommonlyimplementedasproxies,althoughtheyalsocanbedeployedinothermodes,including
inlinetransparentbridges.IntelSecurityalsooffersanappliancebasedsandbox(McAfeeAdvanced
ThreatDefense).Thisyear,IntelSecuritymovedfromtheLeadersquadrantintotheChallengers
quadrant,dueinparttoitslackofCompletenessofVisioninbuildingastrongsalesanddistribution
channelforitscloudbasedservice.Forexample,itlacksstrongpartnershipswithcarriersandInternet
serviceproviders(ISPs),whichhaveprovedtobehighlyeffectivesaleschannelsforcloudbasedSWG
services.IntelSecurityalsolostCompletenessofVisionpointsbecauseithasbeenslowtoemphasize
networkbasedtrafficredirectiontoitscloud,whilefocusingmorestronglyonendpointbasedredirection
(viatheMcAfeeClientProxyagent).Theindustrytrendistheopposite:Theprimarydriverofcloudbased
SWGservicesisforenablingdirecttonetconnectivityfromremoteoffices(vianetworkbased
redirection),whereasprotectingmobiledevicesisadistantsecondarydriver.IntelSecurity'sappliance
solutionsaregoodcandidatesformostenterprisecustomers,particularlythosethatarealreadyMcAfee
ePolicyOrchestratorusers.Prospectivecustomersofthecloudserviceshouldtestitcarefully.
Strengths
TheMcAfeeWebProtectionapplianceintegrateswiththeAdvancedThreatDefenseappliance.It
automaticallydepositssuspiciousfilesinthesandboxforanalysis.
McAfeeWebProtectionhasstrongmalwareprotectionduetoitsonboxbrowsercodeemulation
capabilities.Thesolutionprovidestheabilitytoadjustthesensitivityofmalwaredetection.Arule
basedpolicyengineenablesflexiblepolicycreation.
IntelSecurityhasagoodimplementationofahybridcloud/onpremisessolution.Whilepolicy
synchronizationisonlyunidirectional(fromonpremisestothecloud),flexiblecontrolsenablesome
policiestobesynced,whereasothersarenot.Logfilesynchronizationcanbeconfiguredinspecified
timeintervals.
IntelSecurityprovidesstrongsupportforscanningSSLtrafficwithitsMcAfeeWebProtection
applianceanditscloudbasedservice.Forexample,thesolutionscanbeconfiguredtoautomatically
enforceSSLcertificatedecisionssothatendusersdon'thavetheoptiontoacceptanunknownor
expiredcertificate.
Cautions
IntelSecuritylacksacloudbasedsandbox.Customersthathavemigratedcompletelytoanall
cloudbasedservice(noonpremisesSWGs)areunabletouseIntelSecurity'snetworksandboxing
technologytodetectthreatsandtargetedattacks.

http://www.gartner.com/technology/reprints.do?id=12GM8JZK&ct=150529&st=sb

13/19

6/19/2015

MagicQuadrantforSecureWebGateways
SomeofIntelSecurity'sreferencecustomersreporteddissatisfactionwithitscloudservice.Adoption
oftheservicehasbeenslowduetoIntelSecuritybeinglatewithkeyfeatures,suchasIPsec
support(availablesinceJanuary2015).IntelSecurityalsohasbeenslowtogrowitsglobalfootprint
(13datacentersasof2014).
IntelSecurity'spreferredapproachforprotectingAppleiOSandAndroiddevicesviaitscloudservice
usesproxysettings.Thisapproachcanbeeasilydefeatedbyknowledgeableusers.
ThelackofastrongpartnershipwithaleadingISPortelecomcarrierlimitsIntelSecurity'sabilityto
targetlargeenterpriseswithitscloudbasedservice.

Sangfor
SangforisanetworkoptimizationandsecurityvendorbasedinChina.Approximatelyhalfofitsrevenue
comesfromitsSWGproductstheremainingrevenuecomesfromitsnextgenerationfirewall,VPN,WAN
optimizationcontrollersandapplicationdeliverycontrollerproducts.Sangfor'sSWGcomesinahardware
applianceformfactor,anditisimplementedasaninlinetransparentbridge.In2014,Sangforenhanced
itsSWGbyaddingDLPsupportandwirelessnetworkingfunctionsandenhanceditsapplication
recognitioncapabilities.ThecompanyofferstwoversionsofitsSWGproduct:oneaimedattheChinese
market,andoneaimedatEnglishspeakingcountries.Nearlyallthecompany'srevenuecomesfromthe
Asia/Pacificregion.SangforisacandidatefororganizationsthatarebasedinChinaandinsupported
countriesintheAsia/Pacificregion.
Strengths
Sangforhasstrongapplicationcontrolfeatures.ItcanapplygranularpoliciestoWeibo,Facebook
andotherWebbasedapplications,anditalsohasdevelopednetworksignaturestoblockport
evasiveapplicationslikeBitTorrentandSkype.
Sangfor'sSWGincludesawirelesscontroller,whichiscapableofmanagingSangforwirelessaccess
points.ThecontrollerincludesafeaturetodetectandblockunauthorizedWiFihotspotsinan
enterprisewirelessenvironment.
Sangforoffersacloudbasedsandbox.Sangfor'sSWGautomaticallyfeedssuspiciousobjectstothe
sandbox.
Sangfor'sinlinetransparentbridgemodeenablesflexibleandgranularbandwidthcontrol
capabilities.Bandwidthutilizationparameterscanbespecifiedforuplinkanddownlinktraffic.
Cautions
SangfordoesnotofferacloudbasedSWGservice.
Theconsoledashboardformalwaredetectionisbasicandlacksseverityindicatorstoprioritizealerts.

Sophos
BasedintheU.K.,Sophosprovidesabroadrangeofnetworkandapplicationgatewaysandanendpoint
protectionplatformthatitisconvergingintoaunifiedsecuritysolutionaimedprimarilyatsmallor
midmarketenterprises.TheSophosWebAppliance(SWA)canbedeployedinproxyortransparentinline
bridgemode,andSophosoffersSWGfunctionalityintegratedintoitsUTMappliances.Sophos'acquisition
ofMojaveNetworks(2014)formsthebasisofitsmultitenantcloudWebfilteringservice.Midsize
organizations,particularlythosethatareSophosdesktopcustomers,shouldconsiderSophos'SWG
solutions.
Strengths
EaseofuseisakeydesigncriterionforSophos.Featuresincludeautomatednetworkanddirectory
discovery,contextualhelpfunctions,andsimplepolicyconfiguration.
Sophosisanestablishedplayerinthemalwaredetectionmarket.TheSWAusesSophosdeveloped
technologytoperformapreexecutionanalysisofalldownloadedcode,includingbinaryfilesand
JavaScript.Theappliancealsoprovidesoutboundcommandandcontrol(C&C)trafficdetectionwith
linkagetoknownmalwareremovaltools.
Sophosplacesstrongemphasisonserviceandsupport.Itoptionallymonitorscustomers'appliances
andprovidesalertsforcriticalhardwareconditions,suchashightemperaturesorfaultydiskdrives.
MobileuserswhoarerunningtheSophosendpointprotectionplatformbenefitfromDNSbased
enforcementofURLfilteringpolicyandloggingwhenclientsareoffLAN.TheMojaveacquisition
providesSophoswithadedicatedcloudfilteringnetwork.
Cautions
Sophos'focusoneaseofuseandoutoftheboxfunctionalitycanbelimitingforlargeenterprise
customersthatvaluemoregranularcontrols.Forexample,theMojavecloudiscapableof
integratingonlywithasingledirectory,andreferencecustomersnotedthatadvancedreportingand
multidestinationsyslogsupportwerelacking.
Sophosisinmidtransitiontoamoreunifiedoffering.Capabilitiesarevastlydifferentbetweenthe
threeprimaryofferings(UTM,cloudandSWGappliances),andintegrationisstillindevelopment.For
example,proxyappliancesandcloudofferingsareincapableofinspectingnonproxiedtraffic,while
UTMappliancescaninspectallportsandprotocols,buthavefeweradvancedSWGfunctions.
Sophosdoesnotyetofferasandboxingsolutionforadvancedtargetedthreats.

Symantec
SymantecisbasedinMountainView,California.IthastwoofferingsintheSWGmarket:(1)the
Symantec.cloudserviceand(2)theSymantecWebGatewayappliance,whichmaybedeployedasanin
linetransparentbridge,asaproxyorinSPANmode.Symanteccontinuestoworktowarddeliveringthe
advancedthreatprotectionproductandservicesuitethatitannouncedinMay2014.InSeptember
2014,SymantecannouncedtheappointmentofMichaelA.Brownasthecompany'sCEO(hehadbeen
servingasinterimCEO).InOctober2014,Symantecannouncedthatitwillsplitintotwopubliclytraded
companiesonesellingsecuritysoftware,andtheotherprovidingdatamanagement.Thesecurity
companywillretaintheSymantecname,andBrownwillcontinuetoleadit.Symantec'scloudbased
SWGofferingisagoodoptionforSMBsthatdonotneedahybridapproach.Althoughtheappliancemay
beappropriateforsomeSMBs,ithassignificantlimitationsforlargeenterprises.
Strengths

http://www.gartner.com/technology/reprints.do?id=12GM8JZK&ct=150529&st=sb

14/19

6/19/2015

MagicQuadrantforSecureWebGateways
Symantec.cloudprovidesstrongDLPsupport(aseparatelicenseisrequired)withtheabilityto
configureflexiblepolicies.
SupportformultiplelanguagesbroadensSymantec.cloud'sappealinmanynonEnglishspeaking
countries.
Symantec'sSWGofferingsbenefitfromitsstrongmalwareresearchlabsanditsInsightfile
reputationengine.

Cautions
SymantechasnotintegrateditscloudbasedSWG(MessageLabsacquisitionof2008)withitson
premisesSWG(Mi5Networksacquisitionof2009).Customersseekingahybridcloud/onpremises
solutionwillneedtwoconsoles,andtheconsoleslackpolicysynchronizationandlog
synchronization.
Symanteclacksanetworksandboxandothertechnologiesfordetectingadvancedthreatsand
targetedattacks.
Symantec'scloudservicedoesnotsupportIPsecorGenericRoutingEncapsulation(GRE)tunnels,
thetwomostcommontechniquesforredirectingtrafficfromremoteofficestoanSWGcloud
service.
Symantec'sstrategyforsupportingmobiledevicesneedsimprovement.ItsSmartConnectagentis
astrongsolutionforWindowslaptops,butSymantecdoesnotofferasimilaragentforMacOSX.
Proxyautoconfiguration(PAC)files,whichknowledgeableuserscaneasilysubvert,areneededto
redirecttrafficfromAppleiOS,AndroidandMacOSXdevicestotheSymantec.cloudSWGservice.

TrendMicro
BasedinTokyo,TrendMicro("Trend")isaproviderofendpointprotection,contentprotectionand
applicationgatewaysolutions.Trendoffersanonpremisesvirtualappliancesolution(InterScanWeb
SecurityVirtualAppliance[IWSVA])andacloudservice(InterScanWebSecurityasaService[IWSaaS]).
IWScanbeimplementedasatransparentbridgeoraproxy,andcanbeoptionallyenhancedbyTrend
Micro'sDeepDiscoverynetworksandbox.TrendMicroisacandidateprimarilyfororganizationsthat
alreadyhaveastrategicrelationshipwiththecompany.
Strengths
TheIWSVAandIWSaaSsolutionsarestrengthenedbyTrendMicro'sglobalthreatintelligence,script
analyzercapabilitiesandbotnetdetection.OptionalofferingsincludetheDeepDiscoverysandboxfor
onpremisesmalwareanalysisandtheDamageCleanupServicesforremediationofcompromised
endpoints.
Asinglelicensingmodelallowscustomerstomixcloudandonpremisessolutions,andaspecific
hybridconsoleprovidesanintegrationpointforsynchronizingpoliciesandreportingforcloudand
onpremisesusers.
ApplicationcontrolisstrongwithIWSVA,andincludestheabilitytosettimeofdayandbandwidth
quotapolicies.
TrendMicro'scloudbasedSWGservicehasgoodgeographiccoveragefortheAsia/Pacificregion.
Cautions
TheIWSaaScloudserviceismissingsomeenterpriseclassfeatures,suchascloudbasedmalware
sandboxing,securityinformationandeventmanagement(SIEM)integrationandDLPsupport.Data
centersarelimitedtoninecountries.
Outboundmalwaredetectionlacksdetailedinformationonthreats.
TrendMicrohasthreeconsolesforitsSWGofferings:anonpremisesonlyconsoleforIWSVA,a
cloudonlyconsoleforIWSaaSandaseparateconsoleforthehybridoffering.Thisapproachadds
operationalcomplexityasenterprisesgrowandevolvewiththeTrendMicrooffering.

Trustwave
TrustwaveisbasedinChicago.Itoffersadiversifiedsecurityproductandmanagedsecurityservices
portfolio,includingapplicationsecurity,DLP,emailsecurity,Webapplicationfirewall,SIEMandnetwork
accesscontrol.Inaddition,itoffersnumerousmanagedsecurityservices,includingincidentresponseand
penetrationtesting.ItsSecureWebGatewayapplianceisaproxybasedgatewaythatspecializesinreal
timemalwaredetection.Trustwave'sSWGsolutionsaregoodoptionsforcustomersthatalreadyhave
oneormoreTrustwaveproductsorservices,orforthosethatareseekinganSWGmanagedservice.In
April2015,SingtelannounceditsintenttoacquireTrustwaveandoperateitasastandalonebusiness.
AsofMay2015,thedealispendingregulatoryapproval.
Strengths
TheTrustwaveManagedAntiMalwareServiceprovidesdeployment,policymanagement,security
monitoringandalertingasaserviceforonpremisesSWGinstallations.
Researchandinsightfromincidentresponseinvestigationsandpenetrationtestsenhance
Trustwave'sstrongrealtimebrowsercodeemulation,whichistheprimarytechnologyinits
malwaredetectionstrategy.
Applicationcontrolsupportforinstantmessaging(IM)andsocialmediaallowsgranularpolicy
options.ApplicationcontrolsupportforDropbox,GoogleDrive,MicrosoftOneDrive,AppleiCloudDrive
andBoxenablesgranularpolicycontrolsforuploading,downloading,sharing,anddeletingfilesand
folders.
Trustwave'sDLPengineisfullyintegratedwithitsSecureWebGatewayproduct.
Cautions
TrustwavedoesnotofferacloudonlySWGservice.
TrustwavelacksthenetworksandboxingcapabilitiesthatmanySWGvendorsofferasoptional
features.
Supportformobiledevices(iOSandAndroid)isweakduetoTrustwave'slackofanIPsecbased
multitenantgatewayinitshybridserviceoffering.
Thedashboardconsoleisweakerthanmanycompetingofferings.Itlacksseverityindicatorsto
prioritizemalwarealerts.Dashboardpanelsprovideonlylimitedcustomization.

http://www.gartner.com/technology/reprints.do?id=12GM8JZK&ct=150529&st=sb

15/19

6/19/2015

MagicQuadrantforSecureWebGateways
TheSecureWebGatewayproductlackstheabilitytoblockportevasiveapplications,suchas
BitTorrentandSkype.Portevasiveoutboundtraffictocommandandcontrolcenterscannotbe
blockedeither.

Websense
Websense,whichisbasedinAustin,Texas,isownedbyprivateequityfirmVistaEquityPartners.
WebsenseoffersSWGappliances(hardwareandsoftware)andacloudbasedservice.Italsooffersa
cloudbasednetworksandboxingsolution,knownastheWebSandboxModule,whichwasdevelopedin
house.Websenseappliancesaregoodoptionsformidsizeenterprises,anditscloudserviceisagood
optionformostenterprises.InApril2015,RaytheonenteredintoadefinitiveagreementwithVista
EquityPartnerstoformanewcompany,combiningWebsensewithitsRaytheonCyberProductsbusiness
unit.Atthetimeofthiswriting,thedealispendingregulatoryapproval.
Strengths
WebsensehasastrongofferingfororganizationsthatareinterestedinahybridSWGstrategy(on
premisesandcloudbased).ItsTritonmanagementconsoleprovidesacommonpointforpolicy
management,reportingandlogginginhybridenvironments.
Websense'sTritonAPWebautomaticallydepositssuspiciousfilesinthecloudbasedWebSandbox
Module.
WebsenseusesitsDLPtechnologyinitsappliancesandcloudservicetoinspectsuspiciousoutbound
trafficpatterns.Thisfeatureusesdeeppacketinspection,anditdoesnotrequireanadditional
licensingfee.
Websensehasagoodstrategyformobilesupport.AWebsenseclientforWindowsandMacOSX
endpointshandlestrafficredirectionandauthenticationtotheWebsensecloudservice.AirWatch
customerswillbenefitfromanintegrationwithWebsensethatprovisionscertificatesonmobile
devices(AppleiOSandAndroid)anddirectstraffictotheWebsensecloud(viaIPsec)whentheuser
generatesWebtraffic.
Cautions
Theconsoleforthecloudonlyservice(CloudTritonManager)isdifferentfromtheconsolethatis
usedtomanagethehybridandonpremisessolutions(TritonManager).Customersthatbeginwith
acloudonlyserviceandaddVSeriesapplianceslaterwouldneedtoswitchtotheTritonManager
console.
GartnerrarelyseesWebsense'sX10G,abladeserverapplianceaimedatlargeenterprises,in
competitivebids.EnterprisesthatareconsideringtheX10Gshouldcarefullycheckreferences.
ThelackofastrongpartnershipwithanISPortelecomcarrierlimitsWebsense'sabilitytotarget
largeenterpriseswithitscloudbasedservice.
AsWebsenseformsanewcompanyandintegratestechnologyfromRaytheon,itsincreasedfocus
onthreatdefensemayresultinreducedfocusonitscoreSWGfunctionality.

Zscaler
Zscaler,whichisbasedinSanJose,California,isapureplayproviderofcloudbasedSWGservices.In
2014,Zscaleraddednetworksandboxingandnextgenerationfirewallingservices.Zscaleralsooffersa
DNSbasedWebfilteringservice.Zscalercontinuestobethefastestgrowingvendorinthismarket,as
wellasoneofthemostinnovativevendors.Zscalerisagoodoptionformostenterprisesthatareseeking
acloudbasedSWG.
Strengths
Zscalerappliesallitsmalwaredetectionenginestoallcontent,includingSSLtrafficthatitdecrypts
viaSSL,regardlessofsitereputation.Thisapproachyieldsuptodatemalwareratingsonwebsites.
Zscalerhasthelargestglobalcloudfootprint,withmorethan100enforcementnodesin30
countries.
ZscalerleadstheSWGmarketinseveralcloudinnovations,includingcolocatinganddirectpeering
withpopularcloudservices(suchasAmazon,Microsoft,SalesforceandAkamai)inordertoreduce
latency.Itprovidesflexibleimplementationoptionsbyofferingabroadsetofchoicesfortraffic
redirectionandauthentication.Itwasthefirsttoexposeitsclouduptimeandeventstatisticstothe
publicviaitstrust.zscaler.comportal.
Zscaler'supdatedconsoledisplay(basedonHTML5)enablesrolebasedadministrativeaccess.Views
canbecustomizedaccordingtoadministrativerightsandprivileges.
Anoptionalstreaminglogserviceprovidesnearrealtimeexportoflogsfromthecloudtoon
premisesservers,wheretheycanbeanalyzedbyaSIEMsolution.Enterprisesthathavemorethan
oneSIEMsolutioncanfilterlogeventsfromtheZscalerconsoleanddirectlogentriestospecific
SIEMsolutions.
Cautions
ZscalerencouragestheuseofPACfilesforWindowsandMacOSXsystemsformobileemployees,
butknowledgeableuserscansubvertPACfiletrafficredirection.Also,portevasiveapplications(such
asSkype,BitTorrentandsomemalware)willnotbeforwardedtotheZscalernetworkfrom
endpointsthatrelyonlyonPACfiles.
Themanagementconsolelacksseverityindicatorstoprioritizeoutboundmalwarealerts.Also,
informationtoaidinremediationislacking.
ZscaleroffersacloudbasednextgenerationfirewallasanaddontoitsSWGservice.Thefirewall
serviceisnotintendedtoreplaceenterprisefirewallsprotectingcorporatedatacenters.Itis
primarilysuitableforbranchandremoteofficesandroaminglaptops.

VendorsAddedandDropped
WereviewandadjustourinclusioncriteriaforMagicQuadrantsandMarketScopesasmarketschange.As
aresultoftheseadjustments,themixofvendorsinanyMagicQuadrantorMarketScopemaychange
overtime.Avendor'sappearanceinaMagicQuadrantorMarketScopeoneyearandnotthenextdoes
notnecessarilyindicatethatwehavechangedouropinionofthatvendor.Itmaybeareflectionofa
changeinthemarketand,therefore,changedevaluationcriteria,orofachangeoffocusbythatvendor.

http://www.gartner.com/technology/reprints.do?id=12GM8JZK&ct=150529&st=sb

16/19

6/19/2015

MagicQuadrantforSecureWebGateways

Added
None

Dropped
None

InclusionandExclusionCriteria
ThesecriteriamustbemetforvendorstobeincludedinthisMagicQuadrant:
VendorsmustprovideallthreecomponentsofanSWG:
URLfiltering
Antimalwareprotection
Webapplicationcontrolcapabilities
PureplayURLfilteringsolutionshavebeenexcluded.
Thevendor'sURLfilteringcomponentmustbeprimarilyfocusedoncategorizingEnglishlanguage
websites.
Vendorsmusthaveatleast$15millioninSWGproductrevenueintheirlatestcompletefiscalyears.
Vendorsmusthaveaninstalledbaseofatleast2,000customersoraggregateendpointcoverageof
atleast5millionseats.
UTMdevicesandnextgenerationfirewalldevicesthatofferURLfilteringandmalwareprotectionhave
beenexcluded.ThisMagicQuadrantanalyzessolutionsthatareoptimizedforSWGfunctionality.
VendorsthatlicensecompleteSWGproductsandservicesfromothervendorshavebeenexcluded.For
example,ISPsandotherserviceprovidersthatoffercloudbasedSWGserviceslicensedfromother
providershavebeenexcluded.

EvaluationCriteria
AbilitytoExecute
Productorservice:Thisisanevaluationofthefeaturesandfunctionsofthevendor'sSWGsolution.
Malwaredetectionandadvancedthreatdefensefunctionalitywillbeweightedheavilytoreflectthe
significancethatenterprisesplaceonthesecapabilities.
Overallviability:Thisincludesanassessmentoftheoverallorganization'sfinancialhealth,the
financialandpracticalsuccessofthebusinessunit,andthelikelihoodthatthebusinessunitwill
continuetoinvestintheproduct.
Salesexecution/pricing:Thisisacomparisonofpricingrelativetothemarket.
Marketresponsiveness/record:Thiscriterionreflectshowquicklythevendorhasspottedamarket
shiftandproducedaproductthatpotentialcustomersarelookingforitisalsothesizeofthe
vendor'sinstalledbaserelativetotheamountoftimetheproducthasbeenonthemarket.
Marketingexecution:Thisistheeffectivenessofthevendor'smarketingprograms,anditsabilityto
createawarenessandmindshareintheSWGmarket.
Customerexperience:Thisisthequalityofthecustomerexperiencebasedonreferencecallsand
Gartnerclientteleconferences.

Table1.AbilitytoExecuteEvaluation
Criteria
EvaluationCriteria

Weighting

ProductorService

High

OverallViability

High

SalesExecution/Pricing

NotRated

MarketResponsiveness/Record

Medium

MarketingExecution

Medium

CustomerExperience

Medium

Operations

NotRated

Source:Gartner(May2015)

CompletenessofVision
Marketunderstanding:ThisistheSWGvendor'sabilitytounderstandbuyers'needsandtranslate
themintoproductsandservices.
Salesstrategy:Thisisthevendor'sstrategyforsellingtoitstargetaudience,andincludesan
analysisoftheappropriatemixofdirectandindirectsaleschannels.
Offering(product)strategy:Thisisanevaluationofthevendor'sstrategicproductdirectionandits
roadmapforSWG.TheproductstrategyshouldaddresstrendsthatarereflectedinGartner'sclient
inquiries.
Innovation:Thiscriterionincludesproductleadershipandtheabilitytodeliverfeaturesand
functionsthatdistinguishthevendorfromitscompetitors.Innovationinareassuchasadvanced
threatdefenseandcloudbasedserviceswasratedhighlybecausethesecapabilitiesareevolving
quicklyandarehighlydifferentiatedamongthevendors.
Geographicstrategy:Thisisthevendor'sstrategyforpenetratinggeographiesoutsideitshomeor
nativemarket.

http://www.gartner.com/technology/reprints.do?id=12GM8JZK&ct=150529&st=sb

17/19

6/19/2015

MagicQuadrantforSecureWebGateways

Table2.CompletenessofVision
EvaluationCriteria
EvaluationCriteria

Weighting

MarketUnderstanding

Medium

MarketingStrategy

NotRated

SalesStrategy

Medium

Offering(Product)Strategy

High

BusinessModel

NotRated

Vertical/IndustryStrategy

NotRated

Innovation

High

GeographicStrategy

Low

Source:Gartner(May2015)

QuadrantDescriptions
Leaders
Leadersarehighmomentumvendors(basedonsalesandmindsharegrowth)withestablishedtrack
recordsinSWGs,aswellaswithvisionandbusinessinvestmentsindicatingthattheyarewellpositioned
forthefuture.InadditiontoofferingstrongSWGproductsand/orservices,Leadershavebuilteffective
salesanddistributionchannelsfortheirentireproductportfolio.Leadersthatofferonpremisesandcloud
serviceshaverecognizedthestrategicimportanceofatwoprongedsalesanddistributionchannel.They
haveestablishedatraditionalVARchanneltosellonpremisesappliances,andtheyhavealso
demonstratedtheability,usuallythroughpartnershipswithISPsandcarriers,tosellcloudservices.

Challengers
ChallengersareestablishedvendorsthatofferSWGproducts.Challengers'productsperformwellfora
significantmarketsegment,butmaynotshowfeaturerichnessorparticularinnovation.IntheSWG
market,Challengersmayalsolackanestablisheddistributionchanneltooptimallytargetcustomersfor
cloudbasedservices.BuyersofChallengers'productsandservicestypicallyhavelesscomplex
requirementsand/oraremotivatedbystrategicrelationshipswiththesevendorsratherthan
requirements.

Visionaries
Visionariesaredistinguishedbytechnicaland/orproductinnovation,buthavenotyetachievedtherecord
ofexecutionintheSWGmarkettogivethemthehighvisibilityofLeadersortheylackthecorporate
resourcesofChallengers.BuyersshouldexpectstateofthearttechnologyfromVisionaries,butbewary
ofastrategicrelianceonthesevendorsandcloselymonitortheirviability.Visionariesrepresentgood
acquisitioncandidates.Challengersthatmayhaveneglectedtechnologyinnovationand/orvendorsin
relatedmarketsarelikelybuyersofVisionaries'products.Thus,thesevendorsrepresentaslightlyhigher
riskofbusinessdisruptions.

NichePlayers
NichePlayers'productstypicallyaresolidsolutionsforoneofthethreeprimarySWGrequirementsURL
filtering,malwareandapplicationcontrolbuttheylackthecomprehensivefeaturesofVisionariesand
themarketpresenceorresourcesofChallengers.CustomersthatarealignedwiththefocusofaNiche
Playersvendoroftenfindsuchprovider'sofferingstobe"bestofneed"solutions.NichePlayersmayalso
haveastrongpresenceinaspecificgeographicregion,butlackaworldwidepresence.

Context
TheURLfilteringaspectofSWGshasbecomeacommodity,andenterprisesarenowfocusingonsecurity
featuresasimportantcriteriainvendorselection.Becauseofthesemarkettrends,this2015Magic
Quadrantplacesastrongemphasisonmalwaredetection,particularlyadvancedthreatdetection.
Implementationoptionsareanotherimportantconsiderationwhenselectingvendors.Forexample,
enterprisesthatexpecttoremaincompletelywithonpremisesappliancescanselectfromthelargestset
ofvendors.Enterprisesthatexpecttomigratecompletelytoanallcloudserviceoptionhaveaslightly
smallersetofchoices.Enterprisesthatexpecttorequireahybridapproachhavethesmallestsetof
optionsbecausefewvendorshavetrulyintegratedtheironpremisesproductswiththeircloudbased
services.

MarketOverview
AlthoughcloudbasedSWGservicesareasourceofinnovationandrapidgrowth,theoverallSWGmarket
isstilldominatedbythesaleofonpremisesappliances.Gartnerestimatesthat,in2014,72%ofthe
revenueinthe$1.44billionmarketwasattributedtoappliances,andtheother28%wasattributedto
cloudservices.In2013,Gartnerestimatesthatthe77%ofthemarketwasattributedtoappliancesand
23%wasattributedtocloudservices.Theoverallmarketgrewapproximately10%during2014,andwe
anticipatethatthemarketwillgrow8%to10%in2015.
Thisyear,theVisionariesquadrantremainsemptyagain.BecauseofthegrowthincloudbasedSWG
services,weheavilyweightedtheseserviceswhenscoringtheCompletenessofVisioncriteria.Vendors
thathaveastrongstrategyfortheircloudserviceandthatalsohaveacloudfocusedsalesand
distributionchannelscoredwellinCompletenessofVision.StrategiesforSWGcloudservicesneedto
includeacloudbasedadvancedthreatdefenseservice.Successfulsalesanddistributionchannelsinclude
carriersandISPsbecausetheyhaveproventobeeffectivepartnersinsellingcloudSWGservices.It's
challengingforvendorstodevelopastrongcloudservicestrategyandastrongcloudsalesand
distributionchannel.NoneoftheNichePlayersinthe2014versionoftheMagicQuadrantimproved
enoughinCompletenessofVisionscoringtomoveintotheVisionariesquadrantthisyear.

2015Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.oritsaffiliates.Thispublicationmaynotbe

http://www.gartner.com/technology/reprints.do?id=12GM8JZK&ct=150529&st=sb

18/19

6/19/2015

MagicQuadrantforSecureWebGateways

2015Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.oritsaffiliates.Thispublicationmaynotbe
reproducedordistributedinanyformwithoutGartnerspriorwrittenpermission.Ifyouareauthorizedtoaccessthispublication,youruseofitissubjecttothe
UsageGuidelinesforGartnerServicespostedongartner.com.Theinformationcontainedinthispublicationhasbeenobtainedfromsourcesbelievedtobereliable.
Gartnerdisclaimsallwarrantiesastotheaccuracy,completenessoradequacyofsuchinformationandshallhavenoliabilityforerrors,omissionsorinadequacies
insuchinformation.ThispublicationconsistsoftheopinionsofGartnersresearchorganizationandshouldnotbeconstruedasstatementsoffact.Theopinions
expressedhereinaresubjecttochangewithoutnotice.AlthoughGartnerresearchmayincludeadiscussionofrelatedlegalissues,Gartnerdoesnotprovidelegal
adviceorservicesanditsresearchshouldnotbeconstruedorusedassuch.Gartnerisapubliccompany,anditsshareholdersmayincludefirmsandfundsthat
havefinancialinterestsinentitiescoveredinGartnerresearch.GartnersBoardofDirectorsmayincludeseniormanagersofthesefirmsorfunds.Gartnerresearch
isproducedindependentlybyitsresearchorganizationwithoutinputorinfluencefromthesefirms,fundsortheirmanagers.Forfurtherinformationonthe
independenceandintegrityofGartnerresearch,seeGuidingPrinciplesonIndependenceandObjectivity.

AboutGartner|Careers|Newsroom|Policies|SiteIndex|ITGlossary|ContactGartner

http://www.gartner.com/technology/reprints.do?id=12GM8JZK&ct=150529&st=sb

19/19