IT AI Index
September 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index Network and edge SASE › Enterprise September 2026 Edition

SASE platforms for enterprise buyers

Asked as “SASE platform”, and as “secure access service edge solution”, on behalf of an enterprise B2B company. 42 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Contested
31% of first choices, contested.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Palo Alto Networks Prisma SASE31%14%49endorsed leader
02Cato Networks17%9%35accepted challenger
03Zscaler Zero Trust Exchange17%24%58accepted challenger
04Cato SASE Cloud10%19%16accepted challenger
05Netskope One7%11%45accepted challenger
06Cloudflare One7%26%34criticized challenger
07Fortinet FortiSASE2%12%43accepted challenger
08Cisco Secure Access2%23%13accepted challenger
09Cisco2%25%12criticized challenger
Show the two products at 0%, ordered by negative rate
11Check Point Harmony SASE0%46%13criticized challenger
10Versa SASE0%7%14accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11
Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative50%
Key
01Palo Alto Networks Prisma SASE31%
02Cato Networks17%
03Zscaler Zero Trust Exchange17%
04Cato SASE Cloud10%
05Netskope One7%
06Cloudflare One7%
07Fortinet FortiSASE2%
08Cisco Secure Access2%
09Cisco2%
10Versa SASE0%
11Check Point Harmony SASE0%

02What they warned about

One of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Zscaler Zero Trust Exchange
24%
14 of 58 labels negative · 8 of 12 models
“Scalability/performance issues in reviews: Limited effective PoPs (40-60 despite 150+ claims), regional surcharges, latency from traffic hairpinning” Grok 4.1 Fast, negative prompt
Cloudflare One
26%
9 of 34 labels negative · 7 of 12 models · 1 hard negative
“**Cloudflare One** | Complex onboarding, steep learning curve, limited features, opaque pricing.” GLM 4.7 FlashX, negative prompt
Check Point Harmony SASE
46%
6 of 13 labels negative · 6 of 12 models · 3 hard negative
“**Check Point SASE** | Slow connections, complex management, user‑experience degradation.” GLM 4.7 FlashX, negative prompt
Palo Alto Networks Prisma SASE
14%
7 of 49 labels negative · 6 of 12 models
“"expensive compared with most other vendors" ... Not an "avoid" — but ... budget approval and localization need serious scrutiny.” DeepSeek V4 Flash, negative prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

65 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 5 of those lists are Google grounding redirects that name no site and are left out of the counts. 863 links across 186 sites, every framing counted. Ranked by the number of answers carrying the site or page.

34 answers · 41 citations · 9 models
vendor site · Fortinet24 answers · 35 citations · 10 models
23 answers · 46 citations · 6 models
19 answers · 19 citations · 9 models
18 answers · 29 citations · 9 models
18 answers · 18 citations · 9 models
18 answers · 18 citations · 8 models
18 answers · 18 citations · 8 models
vendor site · Guideflow16 answers · 16 citations · 9 models
15 answers · 21 citations · 6 models
14 answers · 16 citations · 8 models
vendor site · Cyberhaven14 answers · 14 citations · 8 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best SASE platform for an enterprise B2B company?”Paraphrase“Which secure access service edge solution would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade SASE platforms and how do they differ?”Budget-constrained“What is the best SASE platform for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a SASE platform. What should we look at?”Negative“Which SASE platforms should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5Cisco
Four alternativesCato Networks, Check Point Harmony SASE, Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
no first choiceChangedCato Networks, Palo Alto Networks Prisma SASE
Two alternativesCisco, Cloudflare One
no first choice
One alternativeCato SASE Cloud
no first choicenothing named
GPT-5.4 miniPalo Alto Networks Prisma SASE
Three alternativesCato Networks, Netskope One, Zscaler Zero Trust Exchange
Zscaler Zero Trust ExchangeChanged
Three alternativesCloudflare One, Netskope One, Palo Alto Networks Prisma Access
no first choice
Six alternativesCato Networks, Cloudflare One, Fortinet FortiSASE, Netskope One, Palo Alto Networks Prisma Access, Zscaler Zero Trust Exchange
Cloudflare Oneagainst: Fortinet FortiSASE, Palo Alto Networks Prisma SASEno first choiceagainst: Arista Networks, Cisco, Cloudflare One, Extreme Networks, Skyhigh Security
Gemini 3.5 FlashNetskope One, Zscaler Zero Trust Exchange
Three alternativesCato Networks, Fortinet FortiSASE, Palo Alto Networks Prisma SASE
Palo Alto Networks Prisma SASEChanged
Three alternativesCato Networks, Fortinet FortiSASE, Netskope One
Cato Networks
Four alternativesFortinet FortiSASE, Netskope One, Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
Cato Networks
Two alternativesCloudflare One, Fortinet FortiSASE
against: Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
no first choiceagainst: Check Point Harmony SASE, Cisco Secure Access, Fortinet FortiSASE, VMware SASE, Zscaler Zero Trust Exchange
Perplexity SonarCato Networks
Five alternativesCisco Secure Access, Fortinet FortiSASE, Netskope One, Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
Cisco Secure AccessChanged
Two alternativesFortinet FortiSASE, Zscaler Zero Trust Exchange
Zscaler Zero Trust Exchange
Six alternativesCato SASE Cloud, Cloudflare One, Fortinet FortiSASE, Netskope One, Palo Alto Networks Prisma SASE, Versa SASE
Cato Networks, Cloudflare Oneagainst: Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchangeno first choiceagainst: Check Point Harmony SASE, Cisco Secure Access, Cloudflare One, Netskope One
Grok 4.1 FastPalo Alto Networks Prisma SASE
Five alternativesCato SASE Cloud, Cisco Secure Connect, Fortinet FortiSASE, Netskope One, Zscaler Zero Trust Exchange
Zscaler Zero Trust ExchangeChanged
Three alternativesCisco, Netskope One, Palo Alto Networks Prisma SASE
against: Cato Networks
no first choiceCato SASE Cloud
One alternativeCloudflare One
against: Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
Cato SASE Cloud, Netskope One, Prisma Cloud
Three alternativesCisco Secure Access, Fortinet FortiSASE, Zscaler Zero Trust Exchange
against: Cato SASE Cloud, Check Point Harmony SASE, Cloudflare One, Palo Alto Networks Prisma SASE, Versa SASE, Zscaler Zero Trust Exchange
Mistral SmallPalo Alto Networks Prisma SASE
Three alternativesCato Networks, Netskope One, Zscaler Zero Trust Exchange
Zscaler Private Access (ZPA) + Zscaler Internet AccessChanged
Six alternativesCisco Secure Access, Cisco Umbrella, Cloudflare One, Fortinet FortiSASE, Fortinet Secure SD-WAN, Palo Alto Networks Prisma SASE
Palo Alto Networks Prisma SASE
Two alternativesCato Networks, Netskope One
Zscaler Zero Trust Exchange
One alternativeCato SASE Cloud
no first choiceagainst: Cato SASE Cloud
DeepSeek V4 FlashNetskope One
Two alternativesCato Networks, Palo Alto Networks Prisma SASE
Zscaler Zero Trust ExchangeChanged
Three alternativesCato SASE Cloud, Netskope One, Palo Alto Networks Prisma SASE
Palo Alto Networks Prisma SASE
Five alternativesCato Networks, Cisco, Fortinet FortiSASE, Netskope One, Zscaler Zero Trust Exchange
Cato Networks
Two alternativesFortinet FortiSASE, Zscaler Zero Trust Exchange
against: Palo Alto Networks Prisma Access
no first choiceagainst: Broadcom, Cato Networks, Check Point Harmony SASE, Cisco, Cloudflare One, Fortinet FortiSASE, Netskope One, Palo Alto Networks Prisma SASE
Llama 4 MaverickPalo Alto Networks Prisma SASE
Two alternativesCato Networks, Zscaler Zero Trust Exchange
no first choiceChangedno first choiceCato SASE Cloud
One alternativeCloudflare One
against: Zscaler Zero Trust Exchange
no first choiceagainst: Cato SASE Cloud, Cloudflare One with Cloudflare WAN
Qwen 3.7 FlashPalo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
Two alternativesCato Networks, Netskope One
Zscaler Zero Trust ExchangeChanged
Three alternativesCisco Secure Access, Netskope One, Palo Alto Networks Prisma SASE
Cato Networks, Netskope One, Zscaler Zero Trust Exchange
Two alternativesCisco Secure Access, Palo Alto Networks Prisma SASE
Cato Networks
Two alternativesCloudflare One, Palo Alto Networks Prisma Access
against: Zscaler Zero Trust Exchange
no first choiceagainst: AWS, Azure, Cisco Meraki, CrowdStrike, Google Cloud, SentinelOne, VMware/Broadcom
Kimi K2Palo Alto Networks Prisma SASE
Four alternativesCato Networks, Cisco Secure Connect, Fortinet FortiSASE, Netskope One
Palo Alto Networks Prisma SASEHeld
Two alternativesCato Networks, Zscaler Zero Trust Exchange
Cato SASE Cloud, Zscaler Zero Trust Exchange
Five alternativesCisco Secure Connect, Cloudflare One, Fortinet FortiSASE, Netskope One, Palo Alto Networks Prisma SASE
Cato SASE Cloud
One alternativeCloudflare One
against: Netskope One, Palo Alto Networks Prisma Access, Zscaler Zero Trust Exchange
Palo Alto Networks Prisma SASE
Two alternativesCato Networks, Netskope One
against: Cisco
against: Cisco Secure Connect / Cisco SASE, Cloudflare One, Fortinet FortiSASE, Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
GLM 4.7 FlashXCato Networks, Palo Alto Networks Prisma SASE
Four alternativesCisco Secure Access, Fortinet FortiSASE, Netskope One, Zscaler Zero Trust Exchange
Palo Alto Networks Prisma SASEChanged
Three alternativesCato Networks, Cisco Secure Access, Fortinet FortiSASE
against: Cloudflare One, Zscaler Zero Trust Exchange
Cato Networks, Netskope One, Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
One alternativeFortinet FortiSASE
against: Cisco Secure Access, Cloudflare One
Fortinet FortiSASE
Two alternativesCisco Secure Access, Cloudflare One
against: Palo Alto Networks Prisma Access, Zscaler Zero Trust Exchange
no first choiceagainst: Cato Networks, Check Point Harmony SASE, Cloudflare One, Fortinet FortiSASE, Netskope One
MiniMax M2.5Cato Networks, Palo Alto Networks Prisma SASE
One alternativeFortinet FortiSASE
against: Cloudflare One, Zscaler Zero Trust Exchange
Palo Alto Networks Prisma SASEChanged
Two alternativesCato Networks, Netskope One
Palo Alto Networks Prisma SASE
Three alternativesCato Networks, Netskope One, Zscaler Zero Trust Exchange
Cloudflare One
One alternativeCato Networks
against: Zscaler Zero Trust Exchange
no first choiceagainst: Check Point Harmony SASE, Netskope One, Zscaler Zero Trust Exchange
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:41yes1511 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:47yes29 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:46yes1525 s
Direct recommendationPerplexity Sonarsonar2026-09-17 07:21yes206 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:34yes3718 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 07:24yes106 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:45yes1011 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:44yes52 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:45yes1054 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:48yes1032 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:42yes1640 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:41yes1345 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:46no05 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:30yes37 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:49yes922 s
ParaphrasePerplexity Sonarsonar2026-09-17 07:47yes205 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:26yes3816 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 07:39no09 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:32yes1011 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:41yes53 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:41no041 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:37yes1939 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:27yes947 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:29yes1036 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:43yes1513 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:41yes725 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:41yes1734 s
ComparativePerplexity Sonarsonar2026-09-17 07:37yes208 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:36yes3117 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 07:36yes58 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:38yes1619 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:24yes52 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:31yes1182 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:37yes2288 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:29yes19270 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:35yes1025 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:34yes1810 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:25yes36 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:23yes2326 s
Budget constrainedPerplexity Sonarsonar2026-09-17 07:27yes206 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:34yes3019 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 07:22yes55 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:35yes2524 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:47yes54 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:27yes945 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:43yes2041 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:32yes13131 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:34yes1448 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:42yes1811 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:48yes17 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:22no022 s
Scale constrainedPerplexity Sonarsonar2026-09-17 07:43yes209 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:25yes1813 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 07:38no08 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:24yes616 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:39yes54 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:27no040 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:40yes2444 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:28yes1344 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:47yes1424 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:24yes159 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:21yes48 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:43yes1930 s
Negative framingPerplexity Sonarsonar2026-09-17 07:45yes207 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:32yes2315 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 07:31yes55 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:23yes2244 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:43yes53 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:39no047 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:31yes25130 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:40yes1959 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:41yes2149 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
Cato read as Cato SASE Cloud
Cato Networks SASE Cloud read as Cato SASE Cloud
Check Point read as Check Point Harmony SASE
Check Point Software Technologies read as Check Point Harmony SASE
Cloudflare read as Cloudflare One
Fortinet read as Fortinet FortiSASE
Fortinet (FortiSASE) read as Fortinet FortiSASE
Fortinet (Fortinet Unified SASE) read as Fortinet FortiSASE
Fortinet (Unified SASE) read as Fortinet FortiSASE
HPE read as HPE Aruba
Netskope read as Netskope One
Netskope (Intelligent SSE) read as Netskope One
Netskope (Netskope One) read as Netskope One
OpenVPN read as OpenVPN CloudConnexa
Palo Alto read as Palo Alto Networks Prisma SASE
Palo Alto (Prisma SD-WAN) read as Palo Alto Networks Prisma SASE
Palo Alto Networks read as Palo Alto Networks Prisma SASE
Palo Alto Networks (Prisma Access) read as Palo Alto Networks Prisma SASE
Palo Alto Networks (Prisma SASE) read as Palo Alto Networks Prisma SASE
Versa read as Versa SASE
Zscaler read as Zscaler Zero Trust Exchange
Zscaler (SSE) read as Zscaler Zero Trust Exchange
Zscaler (Zero Trust Exchange) read as Zscaler Zero Trust Exchange
Zscaler (Zero Trust SASE) read as Zscaler Zero Trust Exchange
Zscaler Zero Trust read as Zscaler Zero Trust Exchange
Unresolved, counted raw
Cloudflare One with Cloudflare WAN
VMware Skyward
VMware/Bitglass
Discontinued, still offered
No shut-down product was recommended here.
← FirewallsSD-WAN →