3/3/2558

MagicQuadrantforUnifiedThreatManagement

MagicQuadrantforUnifiedThreat
Management
7August2014ID:G00261973
Analyst(s):JeremyD'Hoinne,AdamHils,GregYoung

VIEWSUMMARY
Unifiedthreatmanagementdevicesprovidesmallandmidsizebusinesseswithmultiplenetworksecurity
functionsinasingleappliance.Buyersshouldfocusonperformancewhenmanysecurityfunctionsare
enabled,andontheskillsetoftheassociatedchannelpartner.

STRATEGICPLANNINGASSUMPTIONS
ReplacementofUTMbycloudoptionswillremainat
lessthan5%through2016however,bythen,most
UTMdeviceswillleveragecloudassistedsecurityor
managementfeatures.
By2016,15%ofSMBswillusemobilitymanagement
capabilitiesfromtheirUTMplatformstoenforce
distinctivepoliciesupfromlessthan5%today.

MarketDefinition/Description
Gartnerdefinestheunifiedthreatmanagement(UTM)marketasmultifunctionnetworksecurityproducts
usedbysmallormidsizebusinesses(SMBs).Typically,midsizebusinesseshave100to1,000employees
(seeNote1).UTMproductsmustcontinuallyaddnewfunctionsandthereforeencompassthefeatureset
ofmanyothernetworksecuritysolutions,includingnextgenerationfirewall,secureWebgatewayand
secureemailgateway.Whileconsolidationcomeswithcompromisesinperformanceandcapability,these
arecompromisesthatmanySMBsarewillingtoaccept(see"WhatYouShouldExpectFromUnified
ThreatManagementSolutions").
ManyUTMproductscontainvariousothersecuritycapabilities,suchaswirelessoptionsandmodular
Ethernetportdensity,and,lessfrequently,Webapplicationfirewall(WAF)anddatalossprevention(DLP)
softwaremodules.ApplicationcontrolembeddedinUTMisoftenbasic,focusedonInternetapplications
(Facebook,Googleapplications,YouTube)andlooselyintegratedwiththefilteringpolicythroughalistof
applicationsbundledinaprofileandattachedtothefilteringrule.Itisusedmostlytorestricttheuseof
Webapplicationsandcloudservices(suchassocialmedia,filesharingandsoon).Featuresrelatedtothe
managementofmobiledevicescreateapotentiallyattractivedifferentiatorforthismarket(see"How
UnifiedThreatManagementTacklestheConsumerizationofIT").
UTMappliancesareusedbymidsizebusinessestomeettherequirementsforsecureInternet
connectivity.Formanysmallbusinesses,thoserequirementsareoftendrivenbyregulatorydemands
(suchasthePCIDataSecurityStandard),mandatingrudimentarylevelsofsecuritycontrols.Browser
basedmanagement,basicembeddedreporting,andlocalizedsoftwareanddocumentation,whichdon't
specificallyappealtolargeenterprises,arehighlyvaluedbySMBsinthismarket.Gartnerseesvery
differentdemandsfromtheenterpriseandbranchofficefirewallmarkets(see"MagicQuadrantfor
EnterpriseNetworkFirewalls"),whichgenerallyrequiremorecomplexnetworksecurityfeatures,andare
optimizedforverydifferentselectioncriteria.
Thebranchofficesoflargercompanieshaveverydifferentnetworksecuritydemandsfrommidsize
businesses,eventhoughtheymaybeofsimilarsize.Gartnerviewsbranchoffices'firewallsasextensions
ofthecentralfirewallstrategy(see"BringBranchOfficeNetworkSecurityUptotheEnterprise
Standard").Thisdriveslargeenterprisestooftenuselowendenterpriseproductsattheirbranchoffices
toensureinteroperability,andtotakeadvantageofeconomiesofscaleingettinglargerdiscountsfrom
theirfirewallvendors.Forthesereasons,Gartnerallocatesbranchofficefirewallrevenuetotheenterprise
firewallmarket,nottheUTMmarket.
For2013,GartnerestimatesthattheUTMmarketgrewat14.1%toreachatotalofapproximately
$1.54billion(see"MarketShareAnalysis:UnifiedThreatManagement(SMBMultifunctionFirewalls),
Worldwide,2014Update"andNote2).
ManyUTMvendors,whichputastrongfocusondistributedorganizationssuchasretail,ormanaged
securityserviceproviders(MSSPs),arenowheadingtowardplacingthemanagementandmonitoring
consolesfullyinthecloud.Gartnerbelievesthat,althoughit'sconvenientforthevendorstodoso,a
portionoftheSMBmarketwillnotacceptthisexclusivelycloudmodelforreasonsoflatency,andneedto
accesstheconsolewhenunderattack.Insomeregionsandindustryverticals,limitedtrustinaforeign
supplierandotherprivacyconcernswouldbeadditionalreasonstoavoidthecloudmodel.Reportingand
logretentionarewellsuitedtothecloud,butnotexclusively.
SMBsshouldbeskepticaloftheaspirationalmessagefromUTMvendorsabouttheexaggeratedbenefits
offeatureconsolidation.SecuritybuyersshouldinsteadevaluateUTMdevicesbasedonthecontrolsthey
willactuallyuse,theperformancetheywillgetforthosefeatures,andthequalityofvendorandchannel
(andmanagedservices)supportthatisavailable.
ThemarketfornetworkandsecuritysolutionsdesignedtoprotectSMBscontinuestodevelop,andour
expectationsforUTMtechnologyfeaturesincreasewitheachneweditionofthisMagicQuadrant.Asa
result,theMagicQuadrantdepictsashiftupandtotherightwitheachrevision.Consequently,vendors
mustprogresstomaintaintheirpositionsineachnewMagicQuadrant.

MagicQuadrant
http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb

NOTE1
SMALLANDMIDSIZEMARKETDEFINITION
GartnergenerallydefinesSMBsbythenumberof
employeesand/orannualrevenuetheyhave.The
primaryattributethatisusedmostoftenisthe
numberofemployees.Smallbusinessesusuallyhave
fewerthan100employees,whilemidsizebusinesses
areusuallydefinedascompanieswithfewerthan
1,000employees.Thesecondaryattributethatisused
mostoftenisannualrevenue.Smallbusinessesare
usuallydefinedasthosewithlessthan$50millionin
annualrevenue,whilemidsizebusinessesaredefined
asthosewithlessthan$1billioninannualrevenue.
Typically,80%ofthecompaniesthatGartneranalysts
speakwithhavebetween100and999employees,and
revenueof$100millionto$500million(see
"Gartner'sSmallandMidsizeBusinessMarket
Definition,2013Update").

NOTE2
UTMREVENUEDIFFERENTIATION
Gartnerdoesnotincludebranchofficefirewallrevenue
asUTMrevenue.Themarketsizeandgrowthare
estimatedcomparedwithnumbersfromtheprevious
UTMMagicQuadrant.

EVALUATIONCRITERIADEFINITIONS
AbilitytoExecute
Product/Service:Coregoodsandservicesofferedby
thevendorforthedefinedmarket.Thisincludes
currentproduct/servicecapabilities,quality,feature
sets,skillsandsoon,whetherofferednativelyor
throughOEMagreements/partnershipsasdefinedin
themarketdefinitionanddetailedinthesubcriteria.
OverallViability:Viabilityincludesanassessmentof
theoverallorganization'sfinancialhealth,thefinancial
andpracticalsuccessofthebusinessunit,andthe
likelihoodthattheindividualbusinessunitwillcontinue
investingintheproduct,willcontinueofferingthe
productandwilladvancethestateoftheartwithinthe
organization'sportfolioofproducts.
SalesExecution/Pricing:Thevendor'scapabilitiesin
allpresalesactivitiesandthestructurethatsupports
them.Thisincludesdealmanagement,pricingand
negotiation,presalessupport,andtheoverall
effectivenessofthesaleschannel.
MarketResponsiveness/Record:Abilitytorespond,
changedirection,beflexibleandachievecompetitive
successasopportunitiesdevelop,competitorsact,
customerneedsevolveandmarketdynamicschange.
Thiscriterionalsoconsidersthevendor'shistoryof
responsiveness.
MarketingExecution:Theclarity,quality,creativity
andefficacyofprogramsdesignedtodeliverthe
organization'smessagetoinfluencethemarket,
promotethebrandandbusiness,increaseawareness
oftheproducts,andestablishapositiveidentification
withtheproduct/brandandorganizationintheminds
ofbuyers.This"mindshare"canbedrivenbya
combinationofpublicity,promotionalinitiatives,

1/12

3/3/2558

MagicQuadrantforUnifiedThreatManagement

Figure1.MagicQuadrantforUnifiedThreatManagement

thoughtleadership,wordofmouthandsalesactivities.
CustomerExperience:Relationships,productsand
services/programsthatenableclientstobesuccessful
withtheproductsevaluated.Specifically,thisincludes
thewayscustomersreceivetechnicalsupportor
accountsupport.Thiscanalsoincludeancillarytools,
customersupportprograms(andthequalitythereof),
availabilityofusergroups,servicelevelagreements
andsoon.
Operations:Theabilityoftheorganizationtomeet
itsgoalsandcommitments.Factorsincludethequality
oftheorganizationalstructure,includingskills,
experiences,programs,systemsandothervehicles
thatenabletheorganizationtooperateeffectivelyand
efficientlyonanongoingbasis.
CompletenessofVision
MarketUnderstanding:Abilityofthevendorto
understandbuyers'wantsandneedsandtotranslate
thoseintoproductsandservices.Vendorsthatshow
thehighestdegreeofvisionlistentoandunderstand
buyers'wantsandneeds,andcanshapeorenhance
thosewiththeiraddedvision.
MarketingStrategy:Aclear,differentiatedsetof
messagesconsistentlycommunicatedthroughoutthe
organizationandexternalizedthroughthewebsite,
advertising,customerprogramsandpositioning
statements.
SalesStrategy:Thestrategyforsellingproductsthat
usestheappropriatenetworkofdirectandindirect
sales,marketing,service,andcommunication
affiliatesthatextendthescopeanddepthofmarket
reach,skills,expertise,technologies,servicesandthe
customerbase.
Offering(Product)Strategy:Thevendor'sapproach
toproductdevelopmentanddeliverythatemphasizes
differentiation,functionality,methodologyandfeature
setsastheymaptocurrentandfuturerequirements.
BusinessModel:Thesoundnessandlogicofthe
vendor'sunderlyingbusinessproposition.

Source:Gartner(August2014)

VendorStrengthsandCautions
AkerSecuritySolutions
BasedinBrazil,AkerSecuritySolutionsisanetworksecurityvendor.ItsportfoliohasincludedUTM
solutions(AkerFirewallUTM)since1997,aswellassecureWebgatewayandsecureemailgateway.Aker
FirewallUTMiscomposedof14models,withtwomodelswithwirelesscapabilities.Itcanalsorunasa
virtualapplianceonVMware,CitrixXenandMicrosoftHyperV.
Inthepast12months,AkerreneweditsentirehardwareapplianceproductlineandaddedKaspersky
AntiVirusasanoption.

Vertical/IndustryStrategy:Thevendor'sstrategy
todirectresources,skillsandofferingstomeetthe
specificneedsofindividualmarketsegments,including
verticalmarkets.
Innovation:Direct,related,complementaryand
synergisticlayoutsofresources,expertiseorcapital
forinvestment,consolidation,defensiveorpre
emptivepurposes.
GeographicStrategy:Thevendor'sstrategytodirect
resources,skillsandofferingstomeetthespecific
needsofgeographiesoutsidethe"home"ornative
geography,eitherdirectlyorthroughpartners,
channelsandsubsidiariesasappropriateforthat
geographyandmarket.

AkerFirewallUTMisagoodshortlistcandidateforsmallandmidsizeorganizationsinBrazil.
Strengths
AkerFirewallUTMprovidesacomprehensivesetofUTMfeatures,includingapplicationcontrol,
wirelesssecurity,SSLVPN,andtwochoiceseachforanantivirusengineandanintrusion
preventionsystem(IPS)signatureset.
AkerprovidesarentaloptionforitsUTMappliances,whichreducescapitalexpenditure(capex)costs.
Aker'sclientsanditschannelpartnersvaluetheavailabilityof24/7vendorsupport.
Akerisoneofthefewvendorsthatprovidegraphicaluserinterface(GUI),documentationand
supportinPortuguese.
Cautions
AkerFirewallUTMlacksalowendappliance(lessthan$1,000)thatcouldbecosteffectiveforsmall
offices.
AkerdoesnotprovideanembeddedWebinterface,butinsteadalwaysrequirestheinstallationofa
managementsoftwarecomponent(AkerControlCenter).Clientsreportthatinstallationcouldbe
easier.
AkerisnotvisibleinclientshortlistsoutsideofBrazil,andisnotreadyforinternationalizationyet.

BarracudaNetworks
BasedinCampbell,California,BarracudaNetworksisalargevendorprovidingnetworksecurity,backup
andinfrastructuresolutions,including,amongotherthings,Webandemailsecurity,Webapplication
firewall,anddatabackup.IthasastrongfocusonSMBs,butuntilrecentlywaslackingadedicatedUTM
offering.InFebruary2013,Barracudareleasedanewproductline,theBarracudaFirewall(Xseries),to
complementBarracudaNGFirewall(Fseries),itsincumbentrangeoffirewalls,whichareorientedtoward
largerenterprises'needs.BarracudaFirewalliscomposedofsevenmodels,includingtwowithwireless
capabilities,butisnotavailableyetasavirtualappliance.ItembedsaWebinterface,designedforsimpler
usecases,andleveragesclouddatabasesandenginesforkeycontentfiltering.
Attheendof2013,Barracudaexecutedaninitialpublicoffering(IPO).Inthepastfewmonths,it

http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb

2/12

3/3/2558

MagicQuadrantforUnifiedThreatManagement

expandedtheBarracudaFirewallproductrangestowardsmallerofficesandaddedsoftwarefeaturesto
easetheinstallationprocess.
TheBarracudaFirewallseriesisagoodshortlistcandidateforSMBsthatalreadyuseotherBarracuda
products,haveanexistingtrustfulrelationshipwithresellersofBarracudasolutionsorhavestringent
budgetconstraints.
Strengths
BarracudahasstrongmarketshareamongSMBs,andcustomersbenefitfromgoodglobalsalesand
supportpresence,especiallyinEurope.
Gartnerclientsreportthattheylikethesimplelicensing,andthatunlikemanycompetitors,the
priceforsoftwareoptionsisreasonable.
BarracudaNetworksoffersa30dayrefundplanandareplacementprogramthatincludesanew
applianceeveryfouryears.
Cautions
TheBarracudaXSerieswasonlyrecentlyreleasedsomeintegratedmodulesandthecloudbased
centralizedmanagementareyetunproven.Barracuda'schannelisunevenlytrainedonthesolution
insomeregions.
TheBarracudaXSerieshasnotbeenscrutinizedbyanymajorthirdpartytestinglabsandhasa
limitednumberofcertifications.
Gartnerbelievesthat,whileBarracudahascorrectlyassessedthatSMBandenterprisehave
differentneeds,customersandchannelpartnerscouldbeconfusedbecausethetwofirewalllines
havemoreoverlapsthandifferences.

CheckPointSoftwareTechnologies
CheckPointSoftwareTechnologies,withheadquartersinTelAviv,Israel,andSanCarlos,California,is
oneofthelargestpureplaysecuritycompanies,andhasbeenpresentinthesecuritymarketformore
than20years.Initiallyexclusivelyfocusedonenterprises,CheckPointhaslaterinvestedintheUTM
segment,specificallytargetingSMBusecases.ItsSMBproductlineincludes11appliances,including
wirelessandDSLmodels.UTMcanalsobedeliveredasavirtualapplianceoronAmazonWebServices
(AWS).FundamentaltoCheckPointfirewallofferingsisthesetofsoftwareoptionsreferredtoas
SoftwareBladesthatcanbegroupedtogetherinbundles.
OncethehardwareandOSconsolidationworkwasachievedin2013,CheckPointmoveditseffortsback
tonewthreatpreventionfeaturesandperformanceimprovements.Ithasalsorecentlymadeavailablea
marketplaceofthreatfeedsfromthirdpartiesthatitsclientscanpurchaseseparatelyassoftwareoptions
(ThreatCloudIntelliStore).
CheckPointisagoodchoiceforSMBorganizationsthatdonotconsiderlowpriceasthemostimportant
criterion.
Strengths
CheckPoint'sreportingandmanagementconsoleisconsistentlyhighlyratedbymidsizecompanies.
CheckPointmanagedtosimplifyitsmanagementconsoleforitsentrylevelapplianceswithout
compromisingtheflexibilityanddepthofprotection.
CheckPoint'sUTMsolutionsbenefitfromitsenterpriselevelsecurityfeatures,suchasThreatCloud
andAntiBotsoftwareoptions,inadditiontothestrongIPSmodule,whichareallbackedupby
CheckPoint'slargethreatresearchteam.
CheckPointprovidesanoptionforsandboxing(ThreatEmulation),andrecentlyreleasedacloud
basedsecurityserviceformobileandremoteusers,inadditiontohavingexistingpartnershipswith
mobiledevicemanagement(MDM)solutions.
CheckPointisastrong,stableorganizationwithaconsistentstrategyandprovenabilitytoexecute
onitsroadmap.
Cautions
GartnerseesCheckPointmostlysellingtoitsexistingbaseofdistributedenterprises,butitdoeslag
behindotherLeadersinbuildingadedicatedchannelofpurelySMBresellers.
GartnerclientsoftencitepriceastheprimaryreasonfornotselectingCheckPointsolutions.
GartnerSMBclientsreportthatthequalityofLevel1supportfromchannelvaries,andGartnerhas
observedthatSMBcustomerproblemescalationstakemoretimetoresolvethanthosefromlarge
enterprisecustomers.
CheckPointoffersmanySoftwareBladesandkeepsaddingnewones.Ithasmadegoodprogressin
simplifyingthesalesofferingwithbundles,butresellersandclientsreportthattheyfinditdifficultto
assesstheoverallimpactofenablingmorethanafewoptionssimultaneously.

Cisco
Cisco,basedinSanJose,California,isthelargestnetworkinfrastructureprovider.Foralongtime,itused
itsglobalpresencetocrosssellsecuritysolutionstoitsexistingcustomerbase.Cisconowdedicates
renewedeffortstotheenterprisesecuritymarket,withtheacquisitionofSourcefirein2013,andfocuses
onsecurityfordistributedSMBswithcloudmanagedMerakiMXappliances(sevenmodels).Itsportfolio
stillprovidetheISA500Seriesforsmallbusinesses(fourmodels,includingtwowithwirelesscapabilities),
andtheASA5500XSeriesformidsizecompanies(fivemodels).CiscoAdaptivitySecurityAppliance(ASA)
isalsoavailableasavirtualappliance(ASAv).Inadditiontothededicatedsecuritysolutions,Ciscohasa
largeportfolioofnetworksolutionsthatcanprovidesecurityfeatures,suchasIntegratedServices
Routers(ISRs).
Duringthepast12months,CiscopredominantlypromotedandimproveditsMerakiMXproductlinewith
theintegrationofSourcefireIPSandtheadditionofuseridentityfilteringcapabilities.

http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb

3/12

3/3/2558

MagicQuadrantforUnifiedThreatManagement

CiscoisagoodchoiceforexistingSMBcustomersusingotherCiscotechnology,andfordistributed
organizationsinNorthAmerica.
Strengths
Cisco'sGartnercustomersgenerallyofferpositivereviewsofCiscohardwarerobustness.
ThelearningcurveforCiscotrainedstaffonitssecuritytechnologyisshort,especiallyforcustomers
alreadyfamiliarwiththeCiscocommandlineinterface.
CiscoMerakiMXincludescontextualfeedsfromSourcefire,integratedWiFi/4Gmanagement,and
integrationwithMDMsolutionsformobileusers.
CiscoMerakiMXcloudbasedcentralizedmanagementoffersaunifiedviewformanagingUTMs,
Meraki'swirelessAPandswitches.Customerscancreateconfigurationtemplatestoaddnew
locationsandtocreatesitetositeVPNmoreeasily.
Cautions
CiscoMerakiMXlacksemailsecurity,SSLVPNforremoteusersandSSLdecryptionforHTTPthat
areavailableinmanyofitscompetitors'UTMs.
Cisco'sdualproductlinestrategyfortheUTMmarketmightcreatecomplexityforsomeclientsthat
couldleveragetheirCiscoknowledgewithCiscoASAonthecorenetwork,butcouldalsobenefit
fromsomeoftheMerakiMXfeaturesfordistributedoffices.
CiscodoesnotgeneratemanyinquiriesfromSMBclients,andwhenitdoes,itisoftenthe
incumbentsolutionthatisconsideredforreplacement.

Clavister
Clavister,headquarteredinSweden,primarilytargetsenterprisesandISPswithitsappliancesandcloud
services.ThevendoraddressesSMBsthroughitsbrandedsecurityappliances,theEagleSeriesandthe
WolfSeries,thatcanbedeliveredasvirtualappliances,too.Itsoperatingsystem(cOS)isprovidedeither
asafullfledgedsoftwarestack(cOSCore)orasastreamlinedversionfocusedonnetworkneeds(cOS
Stream).ClavisteralsooffersadedicatedportaltoMSSPsforthemanagementofitsUTM.
In2014,thecompanyappointedanewCEOandshifteditsstrategyevenmoretowardtelecomoperators
withLTEcellsecurity.InMay2014,ClavisterenteredtheStockholmstockmarket.
ClavisterisagoodshortlistcandidateformunicipalitiesanddistributedpublicadministrationinNorthern
Europe,orfororganizationinneedofruggedUTMappliances.
Strengths
Clientsciteveryfunctionalsecuritymodulesandqualityvendorsupportasreasonforremaining
faithfultoClavister.
TheISO9001:2008certificationandatwoyearstandardreturnandrepairwarrantyappealto
specificmidsizeverticalindustriesortoclientsthathaveexperiencedhardwareissueswithother
UTMprovidersinthepast.
TheClavisterX8seriesofruggedappliancesisagoodalternativefororganizationsfromspecific
verticalindustries,suchasdefense,orwhentheexternalconditionswheretheUTMapplianceneeds
tobelocatedareadverse.
Cautions
WhileClavistercontinuestoservetheSMBmarketwithsoftwarefeaturesthatweredevelopedin
thepast,itscurrentgotomarketapproachisnowprimarilyfocusedoncarrierandenterprise
needs.
Clavister'ssales,supportandchannelpartnerresourcesarefocusedpredominantlyonNorthern
Europe,andmightbeunevenlyavailableforcustomersfromotherregions.
ClavisterrarelyappearsonGartnerclients'shortlists.

Cyberoam
BasedinIndia,Cyberoam,nowaSophoscompany,isapureplayvendorfortheUTMmarket,primarily
focusingonSMBsandattemptingtoexpandtolargerenterprises.Cyberoamprovides18differentUTM
hardwaremodelsandfivevirtualappliances.CyberoammarketsitsLayer8useridentitycontrolfeatures
asakeydifferentiatortootherUTMproducts,andovertheyearsithasbuiltseveralfeaturesleveraging
thisconcept.
InFebruary2014,CyberoamwasacquiredbySophos.ThecompanyannouncedthatCyberoamwould
continuetosellitsUTMproductlinewithoutanyshorttermdisruption.RecentCyberoamupdatesinclude
featurestargetingtheindustrialsecurityusecase.
CyberoamisagoodchoiceforSMBorganizationsintheAsia/PacificandMiddleEastregions.SMBbuyers
fromotherregionsshouldfirstevaluatelocalchannelexpertiseonUTMandcustomerreferenceswith
similarusecases.
Strengths
Cyberoaminvestsheavilyonitschannel,providesacomprehensiveknowledgebase,andallows
directaccesstochatandphonesupportforitspartnersthatshouldoftenbetranslatedintoquick
resolutionofsupportissuesforitsclients.
Cyberoamconsistentlyexecutesonitsroadmap.
Cyberoamincludesmatureembeddedreportinganduseridentitycontrolsthatareattractiveto
midsizeorganizations.
Cyberoam'sfilteringpolicyembedsdownloadanduploadstatisticsforeachrule,whichhelps
determineduplicateandunusedrules.ItalsoprovidesaflexiblewaytorestrictrecreationalInternet
usagewiththeabilitytosetupquotasforusersorgroupsofusers.

http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb

4/12

3/3/2558

MagicQuadrantforUnifiedThreatManagement

Cautions
CyberoamhaslowvisibilityintheAmericasandappearslessoftenthanleadingUTMvendorsin
EuropeincompetitiveshortlistsfromGartnerclients.
Gartnerbelievesthat,whilenomajorchangehasbeenobservedyet,Cyberoam'schannelmight
sufferinthefuturefromtheoffensivepostacquisitionmessagingfromcompetitioninEuropeandin
theU.S.,andmightbechallengedinitshomecountrybylocalUTMvendors.Thiscouldtranslatein
localsupportdisruptionsifsomechannelpartnersswitchtootherbrands.
SMBclientsshouldfirstobtainclarificationfromCyberoamonoverlapsbetweenSophosand
Cyberoam'sUTMproductlines.

Dell
Dell,withheadquartersinRoundRock,Texas,isaleadingcomputermanufacturerthathasdiversifiedits
activityininfrastructureandsecurity.ItsUTMportfolioisbrandedDellSonicWALLandincludes13
models.ItiscomposedoftwoproductlinesthataresoldtotheSMBmarket:theSonicWALLTZSeriesfor
thesmallestbusinessesandtheSonicWALLNSASeriesforsmallandmidsizecompanies.Despitethe
recentchangeinname,Dell'sUTMproducthasbeenonthemarketforalongtime,andbenefitsfrom
extendedsalesandsupportchannels.DelltargetstheenterprisemarketwithitsSonicWALL
SuperMassiveSeries.Dellalsoprovidesothernetworksecuritysolutions,suchasSSLVPNandemail
securitygateway.
DellisagoodshortlistcandidateforU.S.basedSMBsandforcurrentDellcustomersinotherregions.
Strengths
DellSonicWALLTZappliancescontinuallygetgoodscoresfromsmallorganizationsfortheirabilityto
combinesecuritymodulesandwirelessconnectivity,inadditiontoothernetworkfeatures.
ClientsreportthatlowpriceandacomprehensivesetoffeaturesaredifferentiatorsforDell
SonicWALLincompetitiveevaluations.
Dellleveragesitsbroadlogisticalcapabilitiestoassistwithdeploymentsinvolvingmultiple
geographies.
Dellcontinuestoinvestinitssecuritydivisions,andDellSonicWALLhasasubstantialR&Dteam,
includingalargeinhousesecuritylabthatcreatesallitsIPSsignatures.
Cautions
Dell'sroadmapforthepast24monthsdemonstratesaswitchinprioritytowardenterpriseusecase
attheexpenseofSMBneedsforconsolidatednetworkandsecurityfeatures.
GartnerhasobservedthatsincetheacquisitionofSonicWALLbyDell,manyUTMvendorsexploit
Dell'srecentmarketfocusswitchandaggressivelytargetDell'sresellersandgivethemstrong
incentivetoswitch.Clientscouldbeaffectedbyachangingrelationshipbetweentheirlocalchannel
partnerandtheUTMtechnologyvendor.
DellstillholdsagoodshareoftheUTMmarket,buttheDellSonicWALLproductlineappearsmuch
lessofteninrecentUTMshortlists.
Gartnerclientsreportthatthemanagementinterfacecanbeconfusingbecauseoftoomany
availableoptions.

Fortinet
FortinetisalargesecurityvendorwithheadquartersinSunnyvale,California.Itoffersmorethan40
differentUTMappliancemodels(FortiGate)aimedatthesmallandmidsizemarket,includingwireless,
DSLandPOEversions.FortiGateisalsoavailableasavirtualappliancewithfivemodelsthatarepriced
basedonCPUcorecount.Onpremisescentralizedmanagement(FortiManager)andreporting
(FortiAnalyzer)solutionscomplementtheUTMoffering.Thecomprehensivesecurityproductportfolio,
composedoftokensandhostagents(FortiClient),isdesignedtoappealtoVARsandMSSPsastheroute
tosales.
Fortinet'sroadmapcontinuestobedrivenbyregularhardwareandsoftwareupdates,with10new
FortiGateappliancesin2013andalready12modelsin2014.FortinetalsomadeFortiGate,FortiManager,
FortiAnalyzerandFortiWebavailableontheAWSplatform.Itwasalsooneofthefirstvendorstoofferfile
sandboxingonaUTM.
FortinetisagoodcandidateforeveryorganizationinneedofaUTM.
Strengths
FortinetcontinuestobeahighlyvisibleUTMprovideramongGartnerclients.Italsoownsthe
largestmarketshare,growingfasterthanthemarketaverage,andhasthelargestbaseofcertified
channelpartnersforUTMtechnology.
FortinethasaverylargeR&Dteamandsupportcentersacrossallregions.Gartnercontinuesto
viewFortinetassettingthecadenceintheUTMmarket,drivingitscompetitorstoreact.
FortiGateintegratesfilesandboxingcapabilities,backedupbythelargeFortiGuardLabsthreat
researchteam.
Fortinetprovidesaveryaggressiveprice/performanceproposition,whichisoftenadecisivefactorfor
budgetconstrainedSMBs.
Thecombinationofwirelessaccesspointmanagement,WiFianalytics,highportdensityandpower
onEthernetalongwiththeavailabilityofpricecompetitiveUTMappliancesappealstosmall
businesseslookingformorethanasecuritygateway,aswellastodistributedretailorganizations.
Cautions
Thefrequenthardwareandsoftwareupdatesmakeitmoredifficulttomaintainaconsistentlevelof
expertiseacrossFortinet'swidelydistributedchannel,whichsometimescausesdiscrepanciesin
presalesandsupportquality.

http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb

5/12

3/3/2558

MagicQuadrantforUnifiedThreatManagement

GartnerclientsreportissuesrelatedtoFortinetUTMregardingtheusabilityoftheFortiManager
centralizedmanagement,orbecauseoflowerthanexpectedperformancewhenenablingsecurity
features.
Fortinethasnotyetinvestedasmuchassomeofitsdirectcompetitorsinitsnativecloudbased
centralizedmanagementandreporting(FortiCloud).Whilemarketneedshavenotfullyformed,this
willproveacompetitivedisadvantageiftheresellersandMSSPsstarttousecloudmanagementasa
standardplatform.

gateprotect
Germanybasedgateprotectisapureplaysecurityvendor.ItsUTMportfolioincludesnineappliances.
Virtualappliancesandcentralizedmanagementarealsoavailable.Gateprotect'smanagementinterface
(eGUI)implementsagraphical(iconbased)visualizationofthenetworktopologyasawaytosimplifythe
configurationofthesecuritypolicy.InJuly2014,gateprotectwasacquiredbyRohde&Schwarz,alarge
Germanelectronicsgroup.
Gateprotectrecentlyreleasedanapplianceforsmalloffices(GPO110),includingwirelessoptionsand
addedapplicationandendpointcontrolfeatures.
Gateprotectisagoodshortlistcandidateforsmallorganizations,especiallyinEurope.
Strengths
Gateprotect'seGUIprovidessmallanddistributedorganizationswithasimplifieddeployment
experience.
GateprotectmakesastronginvestmentinR&Dforavendorofitssize.
Clientsreportthattheycangetquickanswersfromvendorsupportwhenneeded.
GateprotectisgrowingquicklyinLatinAmericaandSouthernAfrica.
Cautions
Gateprotecthasasloweroverallgrowththanmostofitsdirectcompetitors.Itsresultsstill
predominantlydependonthematuremarketofsmallandlowermidsizeorganizationsinGermany.
Gateprotecthaslimitedcoveragefromindependenttestinglabs.
Layer7applicationcontrolisnotfullyintegratedinthecoreviewofthegraphicalsecuritypolicy
representation,butattachedasaprofile.

HillstoneNetworks
HillstoneNetworksisapurenetworksecurityplayer,withheadquartersinBeijingandoperationsin
Sunnyvale,California.ItsUTMportfolioincludes12hardwaremodels(theMSeries).Virtualappliances
arenotavailable,buttheUTMsoftwarecanbedeployedonanopenstackenvironment.Hillstonedoes
notyetofferavirtualUTMappliance,butseveralinstancesofUTMscanruninasinglephysicalchassis.
Hillstonealsoprovidesarangeoffirewalls(theXSeries)thatisspecializedforthedatacenterusecase
RecentsoftwareupdatesincludedimprovementsonVPN,authenticationandnetworkfeatures.
HillstoneisagoodshortlistcandidateforSMBorganizationsintheAsia/Pacificregion.Organizationsfrom
otherregionsshouldfirstcheckthelocalchannelandvendorpresences.
Strengths
Hillstone'sUTMincludeshostreputationandnetworkmonitoringfeaturesthatcanhelpdetect
infectedhosts.
ClientsreportthattheUTMmaintainsexpectedperformancewhenrunningmultiplesecurity
modules.
Asapureplaynetworksecurityvendor,HillstoneNetworkshasagoodhistoryofexecutingonits
roadmap,whichgivescredibilitytoitsannouncementsonfutureimprovements.
Cautions
Hillstonetargetsprimarilythelargeenterprisemarket.Itlagsitscompetitorsinautomatedactivity
reportsforSMBorMSSPoperationteams.
HillstoneNetworksisnotvisibleinUTMcompetitiveshortlistsoutsideofChina.HalfofHillstone's
revenuecomefromdirectsales,andthevendorhasyettobuildaninternationalchannelofactive
UTMresellers.

Huawei
HuaweiisalargenetworkinfrastructuresupplierheadquarteredinShenzhen,China.In2009,Huawei
launcheditsUnifiedSecurityGateway(USG)productline,whichnowiscomposedof24models,including
alargenumberofapplianceswithwirelesscapabilities,toaddresstheSMBmarket.Centralized
managementsoftwareisavailable.LargeUTMappliancescanrunseveralUTMsoftwareinstances,butthe
vendordoesnotprovidevirtualUTMappliancestorunonthetopofleadinghypervisors.
Recentupdatesincludenewhardwaremodels,aproprietaryVPNmode(DSVPN)andSSLdecryption.
Huawei'sUTMisagoodcontenderforSMBsinChina,andforitscurrentlargeenterprisecustomersin
othercountries.
Strengths
HuaweiUTMhasagoodmixoflocalcertificationsandindependenttestsfromlargeinternational
labs.
Clientsoftencitegoodprices,especiallyforsupportservice,asadecisivefactorinselectingHuawei's
solutions.

http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb

6/12

3/3/2558

MagicQuadrantforUnifiedThreatManagement

HuaweihasalargenumberofclientsusingIPv6.
Cautions
Likemostinfrastructurevendors,Huawei'sleverageisinitsexistingcustomerbaseoflarge
enterprisesandcarriers.Thisfocusonothermarketsmightdivertdevelopmentprioritiesawayfrom
SMBneeds.
HuaweisellsamajorityofitsUTMinChinaandstrugglestogrowmarketshareoutsideof
Asia/Pacific.SMBcustomersshouldfirstassessthelevelofcommitmentofHuawei'slocalchannel
partnerstotheSMBmarket.

JuniperNetworks
JuniperNetworksisanetworkinfrastructurevendorbasedinSunnyvale,California.Ithasabroad
portfoliothatcoversnetworkandsecuritysolutions.ItsUTMoffering(SRXSeries)includes13modelsand
reliesontheJunosOS,whichisthecommonplatformfornetworkandsecurityappliancesinJuniper's
portfolio.OtherproductlinescansupportUTMcapabilities(SSGSeriesandISGSeries),andtwovirtual
appliancesareavailable.
Juniperrecentlyannouncedaunifiedcentralizedmanagementandreportingsolution,improved
applicationcontrolengineandsimplifiedusersinglesignon.
JuniperUTMisagoodchoiceforexistingJunipercustomers.OtherSMBcustomersshouldfirstverifythe
experienceoftheirlocalchannelwithJunipersecuritysolutionsforanSMBusecase.
Strengths
UTMbuyersthatalreadyuseJunipertechnologycanleveragetheirexistingrelationshipwiththe
vendortogetalowerpriceandquicklylearnhowtomanageitsUTM.
Juniperhasabroadrangeofhardwareappliancestosupportawidevarietyofscalabilityand
performancerequirements.
Juniper'sunderstandingofdiversecustomerenvironmentsmakesitagoodchoiceforcomplex
networkinfrastructureorwhensupportisacriticalcomponentofthepurchasedecision.
Cautions
JuniperrarelyappearsonGartnerSMBcustomershortlistsforUTM.
RecentstaffcutsinJunipersecurityteamsmightdivertevenmoreofitsresourcesfromtheSMB
market.
Exceptforthesupportofnewhardwaremodels,Juniperhasnotreleasednewfeaturesprimarily
targetingSMBinthepast12months.

Sophos
BasedinBoston,Massachusetts,andOxford,U.K.,Sophosisalargesecurityvendorthatinitiallyprovided
endpointsecuritybeforeaddingnetworkandmobilesecuritysolutionstoitsportfolio.TheSophosUTM
portfolioincludes11models(theSGSeries).SophosUTMisalsoavailableasavirtualapplianceonAWS,
withaconsistentcustomerbase.ItalsooffersitsRemoteEthernetDevice(RED)appliancesforsmall
branchesthatarecentrallymanagedusingaSophosUTM.
Inrecentmonths,SophosacquiredCyberoam,anotherUTMvendor(reviewedearlierinthisresearch),
startedahardwareappliancesrefreshandreleasedversion9.2ofitsUTMsoftware,whichincludescloud
basedsandboxing,automatedemailencryptionandintegrationwithSophos'MDMproduct.
SophosisagoodUTMshortlistcontenderforSMBs,especiallyinEuropeandJapan,andforcurrent
Sophoscustomers.Customersoutsideoftheseregionsshouldverifytheexperienceofthelocalchannel
fortheselectedUTMtechnology.
Strengths
Sophos'easeofuseconsistentlyrateshigh.Theinterfacecontainsgeneralguidanceonwhateach
featuredoes,whichisusefulforSMBoperators,whoarenotallsecurityexperts.
SophosshowscommitmenttotheUTMmarketwithtworecentacquisitionsandstrongmarketing
andR&Dinvestment.
Sophos'UTMcommunityofresellersandclientsremainsfaithfultothebrandandcontributesto
regularspotonimprovementsofthetechnology.
SophossupportisavailableinavarietyofEuropeanlanguages,anditslocalpresaleandsupport
presencereceivedpositivescoresfromGartnercustomers.
Cautions
TheintegrationofCyberoam'stechnologywillbethemainchallengeforSophosduringthenext24
months.Gartnerbelievesthat,despitesomesynergies,managingsignificantoverlapsinUTM
productportfolioscouldbedifficultforSophos'channel.
SophosUTM'suseridentityintegrationandvoiceoverIP(VoIP)managementlagbehindsomeofits
directcompetition.
ExceptforGermanyandtheU.K.,SophosisnotasvisibleinGartnerclientinquiriesasother
Leaders.

Stormshield
FrancebasedStormshieldisasubsidiaryofAirbusDefenceandSpace,andtheresultofanoperational
mergerbetweentwoFrenchfirewallvendorsin2013(ArkoonandNetasq).Inadditiontofirewallsand
UTM,thevendorprovidesendpointanddatasecuritysolutions.ItsUTMproductline(Stormshield
NetworkSecurity)ismadeofnineappliances,andsevenvirtualappliances,andisalsoavailableonAWS.
StormshielddevelopeditsownIPS,whichisenabledinthedefaultUTMconfiguration.

http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb

7/12

3/3/2558

MagicQuadrantforUnifiedThreatManagement

Recentchangesincludethebrandingupdate,tunnelbasedSSLVPN,significantimprovementsintheURL
filtering,embeddedreportsandlogviewer,andsinglesignonauthenticationmodules.
StormshieldisagoodUTMcontenderforSMBsinEuropeandtheMiddleEast.Otherregionsshouldfirst
monitortheavailabilityandexperienceofthelocalchannel.
Strengths
Stormshieldhasasimpleserviceofferingwithtwomainbundles:alowcostbundleandapremium
bundlethatincludesKasperskyAntiVirusandvulnerabilitydetectionmodules.
Customersliketheeaseofinstallation,theintegratedrulecollisionmechanism,andtheavailability
oflocalandglobalcertifications.
Stormshield'scustomerswilleventuallybenefitfromthelargerscaleandgreaterresourcesofthe
combinedentity.ThevendorisstartingtobeseenasagrowingcompetitivethreatbyotherUTM
vendorsinEurope.
Cautions
Despitelongtimeefforts,Stormshieldhasnotmanagedtotakesignificantmarketshareoutsideof
France.EuropeisamuchmorefragmentedmarketthanNorthAmericaorotherregionswithlarge
countries,andassuch,requiresstronginvestmentforeachnewtargetedcountryoutsideofthe
vendor'shomemarket.
GartnerhasobservedthattheStormshieldmarketingmessageandannouncedroadmapshifted
fromSMBstowardlargeenterprisesjustafterthemerger,andthatroadmapexecutionstalledfora
fewmonths.ThelatestversionsnowtargetSMBclients,butSMBbuyersshouldrequirevisibility
regardingfutureroadmapdevelopments.
StormshieldUTMlackstheabilitytoapplyqualityofservice(QoS)rulesbasedonapplication
detection.

WatchGuard
SeattlebasedWatchGuardisawellestablishedUTMvendor.ItprovidesUTM,secureemailgatewaysand
remotemanageablewirelessAPs.TheUTMproductlines(XTMandFirebox),include19physical
appliances,includingthreeapplianceswithembeddedwirelesscapabilitiesandfourvirtualappliances.
WatchGuardrecentreleasesincludeanewcloudbasedreportingandmonitoringsolution(WatchGuard
Dimension),aDLPaswellascloudbasedsandboxingmodules,andwirelessaccesspointmanagement.
WatchGuardisagoodshortlistcandidateforSMBorganizationsinneedofabroadsetoffeaturesor
relyingonanMSSPformanagingandmonitoringtheirUTM.
Strengths
WatchGuardprovidescloudbasedsandboxing(APTBlocker),andreportsaredirectlyintegratedinits
centralizeddashboardcloudservice(WatchGuardDimension).
WatchGuard'scustomersindicatethatcompletenessoffeaturesandlowpricearereasonstoselect
WatchGuard.
WatchGuardhasdemonstratedastrongabilitytoexecuteonitsroadmap,leveragingitsplatform
modularitytoquicklyaddnewmodules.
TheWatchGuardDimensionreportingtoolincludesaninteractiveheatmapview(FireWatch)thatis
usefultoquicklyidentifynetworkissuescreatedbyaspecificuserorapplication.
Cautions
WatchGuardappearsmorerarelyinGartnerclientshortlistsformidsizeordistributedorganizations
thanitsdirectcompetitors.
GartnerdoesnotseeWatchGuarddisplacingotherLeadersbasedontechnicalrequirements.
ClientsreportthattheonpremisescentralizedmanagementconsoleforWatchGuardUTMscouldbe
improved.

VendorsAddedandDropped
WereviewandadjustourinclusioncriteriaforMagicQuadrantsandMarketScopesasmarketschange.As
aresultoftheseadjustments,themixofvendorsinanyMagicQuadrantorMarketScopemaychange
overtime.Avendor'sappearanceinaMagicQuadrantorMarketScopeoneyearandnotthenextdoes
notnecessarilyindicatethatwehavechangedouropinionofthatvendor.Itmaybeareflectionofa
changeinthemarketand,therefore,changedevaluationcriteria,orofachangeoffocusbythatvendor.

Added
AkerSecuritySolutions,HillstoneNetworksandBarracudaNetworkshavebeenadded.

Dropped
KeriowasdroppedbecauseitdidnotmeetGartner'sinclusioncriteriaforthisMagicQuadrant.

InclusionandExclusionCriteria
InclusionCriteria
UTMcompaniesthatmeetthemarketdefinitionanddescriptionwereconsideredforthisreportunderthe
followingconditions:
TheyshippedUTMsoftwareand/orhardwareproductstargetedtoSMBsthatincluded
capabilitiesinthefollowingfeatureareasataminimum:

http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb

8/12

3/3/2558

MagicQuadrantforUnifiedThreatManagement
Networksecurity(statefulfirewallandintrusionprevention)
Websecuritygateway
Remoteaccessformobileemployees(VPNs)
Emailsecurity

TheyregularlyappearedonGartnermidsizeclientshortlistsforfinalselection.
TheyachievedUTMproductsales(notincludingmaintenanceorotherservicefees)ofmorethan$7
millionin2013,andwithinacustomersegmentthat'svisibletoGartner.Theyalsoachievedthis
revenueonthebasisofproductsales,exclusiveofmanagedsecurityservice(MSS)revenue.
ThevendorcanprovideatleastthreereferencecustomerswillingtotalktoGartner,orGartnerhas
hadsufficientinputfromGartnerclientsontheproduct.
ExclusionCriteria
Therewasinsufficientinformationforassessment,andthecompanydidn'totherwisemeetthe
inclusioncriteriaorisn'tactivelyshippingproductsyet.
Productsaren'tusuallydeployedastheprimary,Internetfacingfirewall(forexampleproxy
serversandnetworkintrusionpreventionsystem[IPS]solutions).
Productsarebuiltaroundpersonalfirewalls,hostbasedfirewalls,hostbasedIPSsandWeb
applicationfirewallsallofwhicharedistinctmarkets.
SolutionsaretypicallydeliveredasMSS,totheextentthatproductsalesdidnotreachthe$7
millionthreshold.
Inadditiontothevendorsincludedinthisreport,Gartnertracksothervendorsthatdidnotmeetour
inclusioncriteriabecauseofaspecificverticalmarketfocusand/orUTMrevenueand/orcompetitive
visibilitylevels,includingAdytonSystems,eSoft,GajShield,ilemGroup,MyDigitalShield,Netgear,North
CoastSecurityGroup,QuickHeal,Sangfor,SecPoint,Secui,Smoothwall,TrustwaveandZyXEL.

EvaluationCriteria
AbilitytoExecute
ProductorService:Keyfeaturessuchaseaseofdeploymentandoperation,consolequality,
price/performance,rangeofmodels,secondaryproductcapabilities(includinglogging,mobiledevice
management,integratedWiFisupportandremoteaccess),andtheabilitytosupportmultifunction
deploymentsareweightedheavily.
OverallViability:Thisincludesavendor'soverallfinancialhealth,prospectsforcontinuingoperations,
companyhistory,anddemonstratedcommitmenttothemultifunctionfirewallandnetworksecurity
market.Growthofthecustomerbaseandrevenuederivedfromsalesarealsoconsidered.Allvendorsare
requiredtodisclosecomparablemarketdata,suchasmultifunctionfirewallrevenue,competitivewins
versuskeycompetitors(whichiscomparedwithGartnerdataonsuchcompetitionsheldbyourclients),
anddevicesindeployment.Thenumberofmultifunctionfirewallsshippedisn'takeymeasureof
execution.Instead,weconsidertheuseofthesefirewallsandthefeaturesdeployedtoprotectthekey
businesssystemsofGartnermidsizebusinessclients.
SalesExecution/Pricing:Thisincludespricing,thenumberofdeals,theinstalledbase,andthe
strengthofsalesanddistributionoperationsofthevendors.Presalesandpostsalessupportareevaluated.
Pricingiscomparedintermsofatypicalmidsizebusinessdeployment,includingthecostofallhardware,
support,maintenanceandinstallation.Lowpricingwon'tguaranteehighexecutionorclientinterest.
Buyerswantvaluemorethantheywantbargains,althoughlowpriceisoftenafactorinbuilding
shortlists.Thetotalcostofownershipduringatypicalmultifunctionfirewalllifecycle(whichisthreeto
fiveyears)isassessed,asisthepricingmodelforaddingsecuritysafeguards.Inaddition,thecostof
refreshingtheproductsisevaluated,asisthecostofreplacingacompetingproductwithoutintolerable
costsorinterruptions.
MarketResponsiveness/Record:Thisincludestheabilitytorespond,changedirection,beflexible,and
achievecompetitivesuccessasopportunitiesdevelop,competitorsact,customerneedsevolveand
marketdynamicschange.Thiscriterionalsoconsiderstheprovider'shistoryofresponsiveness.
MarketingExecution:Thisaddressesawarenessoftheproductinthemarket.Werecognizecompanies
thatareconsistentlyidentifiedbyourclientsandoftenappearontheirpreliminaryshortlists.
CustomerExperienceandOperations:Theseincludemanagementexperienceandtrackrecord,and
thedepthofstaffexperiencespecificallyinthesecuritymarketplace.Thegreatestfactorinthese
categoriesiscustomersatisfactionthroughoutthesalesandproductlifecycle.Alsoimportantiseaseof
use,overallthroughputacrossdifferentdeploymentscenarios,andhowthefirewallfaresunderattack
conditions(seeTable1).

Table1.AbilitytoExecuteEvaluation
Criteria
EvaluationCriteria

Weighting

ProductorService

High

OverallViability

Medium

SalesExecution/Pricing

High

MarketResponsiveness/Record

Medium

MarketingExecution

Low

http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb

9/12

3/3/2558

MagicQuadrantforUnifiedThreatManagement

CustomerExperience

Medium

Operations

Medium

Source:Gartner(August2014)

CompletenessofVision
MarketUnderstandingandMarketingStrategy:Theseincludeprovidingatrackrecordofdelivering
oninnovationthatprecedescustomerdemand,ratherthanan"us,too"roadmapandanoverall
understandingandcommitmenttothesecuritymarket(specificallytheSMBnetworksecuritymarket).
Gartnermakesthisassessmentsubjectivelybyseveralmeans,includinginteractionwithvendorsin
briefingsandfeedbackfromGartnerclientsoninformationtheyreceiveconcerningroadmaps.
Incumbentvendormarketperformanceisreviewedyearlyagainstspecificrecommendationsthathave
beenmadetoeachvendor,andagainstfuturetrendsidentifiedinGartnerresearch.Vendorscan'tmerely
stateanaggressivefuturegoal.Theymustenactaplan,showthatthey'refollowingitandmodifythe
planastheyforecasthowmarketdirectionswillchange.
SalesStrategy:Thisincludespreproductandpostproductsupport,valueforpricing,andclear
explanationsandrecommendationsfordetectioneventsanddeploymentefficacy.Buildingloyalty
throughcredibilitywithafulltimemidsizebusinesssecurityandresearchstaffdemonstratestheability
toassessthenextgenerationofrequirements.
Offering(Product)Strategy:Theemphasisisonthevendor'sproductroadmap,currentfeatures,
leadingedgecapabilities,virtualizationandperformance.Thequalityofthesecurityresearchlabsbehind
thesecurityfeaturesisconsidered.Credible,independentthirdpartycertifications,suchasCommon
Criteria,areincluded.Integrationwithothersecuritycomponentsisalsoweighted,aswellasproduct
integrationwithotherITsystems.Asthreatschangeandbecomemoretargetedandcomplex,weweight
vendorshighlyiftheyhaveroadmapstomovebeyondpurelysignaturebased,deeppacketinspection
techniques.Inaddition,weweightvendorsthataddmobiledevicemanagementtotheirofferingsandare
lookingtosupportSMBorganizationsthatusecloudbasedservices.
BusinessModel:Thisincludestheprocessandsuccessrateofdevelopingnewfeaturesandinnovation,
andR&Dspending.
Innovation:Thisincludesproductinnovation,suchasR&D,andqualitydifferentiators,suchas
performance,virtualization,integrationwithothersecurityproducts,amanagementinterface,andclarity
ofreporting.
GeographicStrategy:Thisincludestheabilityandcommitmenttoservicegeographies.
Themoreaproductmirrorstheworkflowofthemidsizebusinessoperationsscenario,thebetterthe
vision.Productsthataren'tintuitiveindeployment,oroperationsthataredifficulttoconfigureorhave
limitedreporting,arescoredaccordingly.Solvingcustomerproblemsisakeyelementofthiscategory.
Reducingtherulebase,offeringinterproductsupportandbeatingcompetitorstomarketwithnew
featuresareforemost(seeTable2).

Table2.CompletenessofVision
EvaluationCriteria
EvaluationCriteria

Weighting

MarketUnderstanding

High

MarketingStrategy

High

SalesStrategy

Medium

Offering(Product)Strategy

Medium

BusinessModel

Medium

Vertical/IndustryStrategy

NotRated

Innovation

High

GeographicStrategy

Low

Source:Gartner(August2014)

QuadrantDescriptions
Leaders
TheLeadersquadrantcontainsvendorsattheforefrontofmakingandsellingUTMproductsthatarebuilt
formidsizebusinessrequirements.Therequirementsnecessaryforleadershipincludeawiderangeof
modelstocovermidsizebusinessusecases,supportformultiplefeatures,andamanagementand
reportingcapabilitythat'sdesignedforeaseofuse.Vendorsinthisquadrantleadthemarketinoffering
newsafeguardingfeatures,andinenablingcustomerstodeploytheminexpensivelywithoutsignificantly
affectingtheenduserexperienceorincreasingstaffingburdens.Thesevendorsalsohaveagoodtrack
recordofavoidingvulnerabilitiesintheirsecurityproducts.Commoncharacteristicsincludereliability,
consistentthroughput,andproductsthatareintuitivetomanageandadminister.

Challengers
TheChallengersquadrantcontainsvendorsthathaveachievedasoundcustomerbase,buttheyaren't
leadingwithfeatures.ManyChallengershaveothersuccessfulsecurityproductsinthemidsizeworldand
arecountingontheclientrelationshiporchannelstrength,ratherthantheproduct,towindeals.
Challengers'productsareoftenwellpriced,and,becauseoftheirstrengthinexecution,thesevendors

http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb

10/12

3/3/2558

MagicQuadrantforUnifiedThreatManagement

canoffereconomicsecurityproductbundlesthatotherscan't.ManyChallengersholdthemselvesback
frombecomingLeadersbecausethey'reobligatedtosetsecurityorfirewallproductsasalowerpriorityin
theiroverallproductsets.

Visionaries
Visionarieshavetherightdesignsandfeaturesforthemidsizebusiness,butlackthesalesbase,strategy
orfinancialmeanstocompetegloballywithLeadersandChallengers.MostVisionaries'productshave
goodsecuritycapabilities,butlacktheperformancecapabilityandsupportnetwork.Savingsandhigh
touchsupportcanbeachievedfororganizationsthatarewillingtoupdateproductsmorefrequentlyand
switchvendors,ifrequired.Wheresecuritytechnologyisacompetitiveelementforanenterprise,
Visionariesaregoodshortlistcandidates.

NichePlayers
MostvendorsintheNichePlayersquadrantareenterprisecentricorsmallofficecentricintheirapproach
toUTMdevicesforSMBs.SomeNichePlayersfocusonspecificverticalindustriesorgeographies.IfSMBs
arealreadyclientsofthesevendorsforotherproducts,thenNichePlayerscanbeshortlisted.

Context
SMBshavesignificantlydifferentnetworksecurityrequirementsfromthoseoflargeenterprises,dueto
differentthreatenvironmentsanddifferentbusinesspressures.Althoughthebranchofficesofsome
largerenterpriseshaverequirementsthataresimilartomidsizebusinesses,thisisnotalwaysthecase.
TheUTMmarketconsistsofawiderangeofsuppliersthatmeetthecommoncoresecurityrequirements
ofSMBs,butbusinessesneedtomaketheirdecisionsbymappingtheirthreatanddeploymentpatterns
tooptimalofferings.

MarketOverview
TheUTMmarketismatureandmanySMBorganizationsarenowrenewingtheirUTMtechnology,rather
thanacquiringitforthefirsttime.Themarketisstillgrowingfasterthanothernetworksecuritymarkets,
buthighermarketpenetrationwillslowlydrivetheUTMmarketgrowthratedown.In2014,Sophos
acquiredCyberoam,continuingtherecenttrendofconsolidationintheUTMmarket.
Theprimarycharacteristicofmidsizecompaniesisthattheyareorganizationswithresourceconstrained
ITdepartments.Theyhavearelativelimitoncapitalexpenditures,operationalbudgets,numberofIT
staffersanddepthofITskillswhencomparedwithlargeenterprises.Inkeepingwiththis,UTMappliances
arefrequentlyusedacrossmidsizebusinessesasalowcostwayofmeetingtheirnetworksecurity
requirements.Midsizebusinesseslookatsecuritydifferently,andshowdifferentbuyingbehaviors
comparedwithlargerenterprises.Theprimaryareasofdifferenceare(inorderofimportance):
Alimitedornonexistentskilledsecuritystaffdrivestheneedforeaseofinstallation,configuration
anduseofchannelmanagedsolutions.
LesscomplexuseoftheInternetresultsinlowerdemandforhighendsecurityfeatures,suchas
applicationlevelsecurityandcustomintrusionpreventionfilters.
Limitedsecuritybudgetsdriveacquisitioncoststorepresentmorethan60%oftheoveralldecision
weighting.
Smallbusinessesoftenperceivethattheyarenotvisibletoattackersand,therefore,don'trequire
asmuchsecurity.However,financiallymotivatedattackershavetargetedsmallbusinesses,andthe
publicityoversuccessfulattackshaschangedthesebusinesses'perceptions.
Smallbusinesseswithfewerthan100employeeshaveevenmorebudgetarypressuresandevenfewer
securitypressures.Mostsecurityprocurementdecisionsaredrivenbynontechnicalfactorsandrarely
featurecompetitivecomparisons.Forthesereasons,thisMagicQuadrantfocusesontheUTMproducts
usedbymidsizebusinesses,asdefinedabove.
ThesedifferencesbetweenSMBandlargeenterpriseexpectationsareoneofthemajorreasonswhy
manyoffirewallvendorsthatsellsuccessfullytotheenterpriseandSMBmarketstendtohaveseparate
softwareorevenproductlinesforeachmarket.
UTMVendorsTargetLargeEnterprisesWithDifferentApproaches
AllofthevendorssurveyedagreeonthedifferentgotomarketapproacheswhentargetingSMBsversus
largeenterpriseclients.SMBsmoreoftenrelyontheirchannelpartnertochoosethecorrectallinone
UTMplatform,whereaslargeenterprisesecuritybuyersconducttheirownselectionprocess.SMB
resellersalsohandleLevel1andLevel2supportsomealsobecomelocalLevel3supportcenterson
behalfofthevendor.
ThemarketpenetrationforSMBsishigh,anddisplacingactivechannelpartnersfromanotherUTM
vendorisdifficultbecauseitmeansthesepartnerswillhavetomaintainthelegacytechnologyofexisting
customers,andalsolearnthevendor'sreplacementtechnology.Evenifsomechanneldisplacement
happensfollowinganacquisitionormergerannouncement,GartnerobservesthatmanyUTMvendors
considerSMBsasamature,lowgrowthmarketandfocusonnewtargetcustomers.
Themostbasictacticistoreleasemorepowerfulappliances,runthesamesoftwarestackandsellthe
UTMcorevalueofallinonesecurity.Thisshortsightedapproachdoomsthevendorstonicheusecases,
suchasbudgetconstrainedlowersizelargeenterprises,whicharecomposedofslightlymorethan1,000
employees.SomeofthelargerUTMvendorsimproveonthisinitialapproachwithanoptimizedsoftware
stackthatisdevelopedtoprovideanenhancedofferfortheusecaseofahighperformancefirewall.
Despitethemanagementinterfacebeingcrowdedwithunnecessaryfeatures,thegoodpriceofferedby
vendorsthatareaggressivelywillingtotakemarketshareawayfromtheincumbententerprisefirewall
vendorsisattractivetomanyenterprises.However,UTMvendorsthatdonottakeamoredifferentiated
productapproachwon'tdisplaceleadingenterprisevendorsatlarge,TypeAorganizations(see"Magic
QuadrantforEnterpriseNetworkFirewalls").

http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb

11/12

3/3/2558

MagicQuadrantforUnifiedThreatManagement

Alternatively,afewprovidersnowtargetdistributedorganizationsthathaveneedsclosetothoseof
midsizeorganizations.ThisincludesMSSPsforSMBsanddistributedenterpriseslikeretailers,health
organizationsandsmallgovernmentalagencies.Despitecentralizedpurchaseandmaintenancecenters,
eachofficeissimilartoanautonomousorganization.Recentlyreleasedoffersincludecentralizedcloud
basedmanagementandreportingandwirelessaccesspointmanagement,sometimeswithadditional
featurestargetingorganizationsfromtheretailindustry,suchaswirelessanalytics,butalsosmaller
appliancesoflessthan$500.
UTMvendorsincreasinglyarefightingoverinitialpurchaseprices,andallvendorsmanagetowindealson
thestrengthofthissoleadvantage,basedonthetargetedverticalandgeographicarea.Inthelonger
term,thesecuritymarketforSMBmightbeinfluencedbytheincreasedadoptionofmobiletechnology,
cloudservicesandforuppermidsizebusinessesvirtualizeddemilitarizedzone(DMZ)anddata
center.WhilethereisnovisibleactorthatcoulddisrupttheUTMmarketyet,alternateapproaches,such
asendpointandmobiledevicemanagementorsecureWebgatewayhostedinthecloud,couldbecome
moreseriouscontenders.

2014Gartner,Inc.and/oritsaffiliates.Allrightsreserved.GartnerisaregisteredtrademarkofGartner,Inc.oritsaffiliates.Thispublicationmaynotbe
reproducedordistributedinanyformwithoutGartnerspriorwrittenpermission.Ifyouareauthorizedtoaccessthispublication,youruseofitissubjecttothe
UsageGuidelinesforGartnerServicespostedongartner.com.Theinformationcontainedinthispublicationhasbeenobtainedfromsourcesbelievedtobereliable.
Gartnerdisclaimsallwarrantiesastotheaccuracy,completenessoradequacyofsuchinformationandshallhavenoliabilityforerrors,omissionsorinadequacies
insuchinformation.ThispublicationconsistsoftheopinionsofGartnersresearchorganizationandshouldnotbeconstruedasstatementsoffact.Theopinions
expressedhereinaresubjecttochangewithoutnotice.AlthoughGartnerresearchmayincludeadiscussionofrelatedlegalissues,Gartnerdoesnotprovidelegal
adviceorservicesanditsresearchshouldnotbeconstruedorusedassuch.Gartnerisapubliccompany,anditsshareholdersmayincludefirmsandfundsthat
havefinancialinterestsinentitiescoveredinGartnerresearch.GartnersBoardofDirectorsmayincludeseniormanagersofthesefirmsorfunds.Gartnerresearch
isproducedindependentlybyitsresearchorganizationwithoutinputorinfluencefromthesefirms,fundsortheirmanagers.Forfurtherinformationonthe
independenceandintegrityofGartnerresearch,seeGuidingPrinciplesonIndependenceandObjectivity.

AboutGartner|Careers|Newsroom|Policies|SiteIndex|ITGlossary|ContactGartner

http://www.gartner.com/technology/reprints.do?id=11Z6XAOO&ct=140807&st=sb

12/12