IT AI Index
September 2026 Edition · The permanent record of this edition. The unqualified address always carries the latest edition.
Index Network and edge SASE › Small business September 2026 Edition

SASE platforms for small business buyers

Asked as “SASE platform”, and as “secure access service edge solution”, on behalf of a small B2B company. 48 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
Standing
Clear leader
54% of first choices, clear leader.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a small B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
01Cloudflare One54%2%54endorsed leader
02Cato Networks12%9%32accepted challenger
03Fortinet FortiSASE6%25%36criticized challenger
04Check Point Harmony SASE6%19%26accepted challenger
05Cato SASE Cloud2%18%11accepted challenger
06Netskope One2%58%19criticized challenger
07Zscaler Zero Trust Exchange2%62%39criticized challenger
Show the two products at 0%, ordered by negative rate
09Palo Alto Networks Prisma SASE0%88%16criticized challenger
08NordLayer0%0%14accepted challenger
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

One product takes 54% of first choices here, so the chart would put eight markers in one corner and one at the far edge. The two measurements it plots are columns in the standing above: share, and the negative label rate. Four products carry a negative rate above 25% in this category. Jump to the standing

02What they warned about

Seven of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Perplexity Sonar, Mistral Small and Qwen 3.7 Flash changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Palo Alto Networks Prisma SASE
88%
14 of 16 labels negative · 10 of 12 models · 2 hard negative
“Often called out as "expensive compared with most other vendors" in Gartner cautions... Not ideal for simple setups.” Grok 4.1 Fast, negative prompt
Zscaler Zero Trust Exchange
62%
24 of 39 labels negative · 9 of 12 models · 4 hard negative
“What to Avoid - **Zscaler** ... Zscaler in particular is expensive and complex for small teams” Kimi K2, paraphrase prompt
Fortinet FortiSASE
25%
9 of 36 labels negative · 6 of 12 models · 2 hard negative
“often criticized for requiring extensive setup and partner involvement... may be overkill for very small businesses” Mistral Small, negative prompt
Netskope One
58%
11 of 19 labels negative · 6 of 12 models · 2 hard negative
“avoid "Full SASE" platforms like **Zscaler**, **Netskope**, or **Cato Networks**” GLM 4.7 FlashX, budget prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

62 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 859 links across 178 sites, every framing counted. Ranked by the number of answers carrying the site or page.

27 answers · 40 citations · 9 models
26 answers · 26 citations · 9 models
vendor site · OpenVPN25 answers · 25 citations · 9 models
22 answers · 22 citations · 9 models
21 answers · 23 citations · 8 models
20 answers · 45 citations · 7 models
20 answers · 32 citations · 9 models
19 answers · 19 citations · 7 models
15 answers · 19 citations · 7 models
15 answers · 15 citations · 9 models
vendor site · Fortinet14 answers · 23 citations · 7 models
14 answers · 15 citations · 7 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best SASE platform for a small B2B company?”Paraphrase“Which secure access service edge solution would you recommend to a small business that sells to other businesses?”Comparative“What are the top SASE platforms for a small team and how do they differ?”Budget-constrained“What is the best SASE platform for a small company with a tight budget?”Scale-constrained“We are a 30 person company evaluating a SASE platform. What should we look at?”Negative“Which SASE platforms should a small business avoid or be cautious about?”
Claude Haiku 4.5Cato SASE Cloud, Check Point Harmony SASE
Two alternativesCloudflare One, NordLayer
Cloudflare OneChanged
Two alternativesCheck Point Harmony SASE, Zscaler Zero Trust Exchange
Cato Networks
Four alternativesCheck Point Harmony SASE, Cloudflare One, Fortinet FortiSASE, NordLayer
Cloudflare One
Two alternativesAryaka, OpenVPN CloudConnexa
no first choicenothing named
GPT-5.4 miniCloudflare One
Two alternativesCato SASE Cloud, Zscaler Zero Trust Exchange
Cato Networks, Zscaler Zero Trust ExchangeChanged
Three alternativesCloudflare One, Netskope One, Palo Alto Networks Prisma Access
Cloudflare One
Four alternativesCheck Point Harmony SASE, Fortinet FortiSASE, Netskope One, Zscaler Zero Trust Exchange
Cloudflare Oneagainst: Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchangeno first choiceagainst: Broadcom / Symantec SSE / SASE, Cato SASE Cloud, Open Systems, Palo Alto Networks Prisma SASE
Gemini 3.5 FlashCheck Point Harmony SASE
Three alternativesCato SASE Cloud, Cloudflare One, Todyl
against: Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
Check Point Harmony SASEHeld
Two alternativesCloudflare One, NordLayer
against: Cisco, Prisma Cloud
Cloudflare One
Three alternativesCheck Point Harmony SASE, NordLayer, Twingate
against: Cisco, Prisma Cloud, Zscaler Zero Trust Exchange
Cloudflare One
Three alternativesFortinet FortiSASE, NordLayer, Twingate
against: Cisco Secure Connect, Prisma Cloud, Zscaler Zero Trust Exchange
Cloudflare One
Three alternativesCheck Point Harmony SASE, NordLayer, Twingate
against: Netskope One, Prisma Cloud, Zscaler Zero Trust Exchange
against: Broadcom / Symantec SASE, Cisco Secure Connect / Cisco SASE, Netskope One, Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
Perplexity SonarCato Networks
Three alternativesCloudflare One, Fortinet FortiSASE, NordLayer
Cisco Meraki, Cisco Secure AccessChanged
Three alternativesDatto Secure Edge, Fortinet FortiSASE, Zscaler Zero Trust Exchange
Cloudflare One
Four alternativesCato SASE Cloud, Check Point Harmony SASE, Fortinet FortiSASE, OpenVPN CloudConnexa
Cloudflare One
Three alternativesCisco Umbrella, NordLayer, OpenVPN CloudConnexa
no first choiceagainst: Cisco Secure Access, Fortinet FortiSASE, Palo Alto Networks Prisma SASE, Versa SASE, Zscaler Zero Trust Exchange
Grok 4.1 FastCloudflare One
Four alternativesCato SASE Cloud, Cisco Secure Access, Fortinet FortiSASE, Zscaler Zero Trust Exchange
against: Netskope One, Prisma Cloud
Cloudflare OneHeld
One alternativeCato Networks
against: Check Point Harmony SASE, Fortinet FortiSASE, Zscaler Zero Trust Exchange
Cloudflare One
Two alternativesCato SASE Cloud, Check Point Harmony SASE
against: Fortinet FortiSASE, Zscaler Zero Trust Exchange
Cloudflare One
One alternativeCisco Umbrella
against: Cato SASE Cloud
Cato Networks, Cloudflare Oneagainst: Fortinet FortiSASE, Netskope One, Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
Mistral SmallCato Networks, Cloudflare Oneno first choiceChangedCato SASE Cloud, Cloudflare One
Two alternativesNordLayer, Zscaler Zero Trust Exchange
Fortinet FortiSASE
Two alternativesCato Networks, Cloudflare One
no first choice
One alternativeCheck Point Harmony SASE
against: Check Point Harmony SASE, Fortinet FortiSASE, Palo Alto Networks Prisma Access, VMware SASE
DeepSeek V4 FlashCloudflare One
Two alternativesCato Networks, Check Point Harmony SASE
against: Netskope One, Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
Cloudflare OneHeld
Six alternativesCato Networks, Check Point Harmony SASE, Fortinet FortiSASE, NordLayer, Tailscale, Twingate
Cloudflare One, Tailscale
Two alternativesCato Networks, Fortinet FortiSASE
against: Check Point Harmony SASE, Cisco, Netskope One, OpenVPN CloudConnexa, Prisma Cloud, Zscaler Zero Trust Exchange
Cisco Umbrella
Three alternativesCloudflare One, Exium, NordLayer
no first choiceagainst: Cisco, Fortinet FortiSASE, Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
Llama 4 Maverickno first choiceno first choiceHeldCloudflare One
Three alternativesCato SASE Cloud, Fortinet FortiSASE, Zscaler Zero Trust Exchange
Cisco Umbrella
Three alternativesCato Networks, Cloudflare One, Fortinet FortiSASE
no first choiceagainst: Palo Alto Networks Prisma SASE, Versa SASE
Qwen 3.7 FlashCato Networks, Cloudflare One
One alternativeFortinet FortiSASE
against: Cisco Secure Edge, Zscaler Zero Trust Exchange
Fortinet FortiSASEChanged
Three alternativesCisco Meraki, Microsoft Defender for Cloud, Zscaler Zero Trust Exchange
Cloudflare One
Three alternativesCisco Meraki, Fortinet FortiSASE, Tailscale
against: Zscaler Zero Trust Exchange
Cloudflare One
One alternativeCisco Umbrella
against: Cato Networks, Fortinet FortiSASE
Defender for Endpoint, Microsoft Entra ID, Microsoft Intune
Three alternativesFortinet FortiSASE, Sophos, Ubiquiti
against: CrowdStrike, Netskope One, Zscaler Zero Trust Exchange
against: Fortinet FortiSASE, Netskope One, Palo Alto Networks Prisma SASE, legacy Cisco stacks
Kimi K2Cloudflare One
Three alternativesCato Networks, Check Point Harmony SASE, Fortinet FortiSASE
Cloudflare OneHeld
One alternativeCato Networks
against: Cisco Secure Access, Palo Alto Networks Prisma Access, Zscaler Zero Trust Exchange
Cloudflare One
Two alternativesCato Networks, Fortinet FortiSASE
Cloudflare One
Four alternativesCheck Point Harmony SASE, Cisco Umbrella, NordLayer, ZTEdge
against: Palo Alto Networks Prisma Access, Zscaler Zero Trust Exchange
Cato Networks, Cloudflare One, Netskope Oneagainst: Cisco, Palo Alto Networks Prisma SASEagainst: Fortinet FortiSASE, Netskope One, Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
GLM 4.7 FlashXCloudflare One
Four alternativesCato Networks, Check Point Harmony SASE, Cisco Secure Access, Fortinet FortiSASE
against: Zscaler Zero Trust Exchange
Cloudflare OneHeld
Two alternativesCisco Secure Access, Fortinet FortiSASE
Zscaler Zero Trust Exchange
Four alternativesCisco Secure Access, Fortinet FortiSASE, Netskope One, Palo Alto Networks Prisma Access
Cloudflare One
Two alternativesCisco Umbrella, NordLayer
against: Cato Networks, Netskope One, Zscaler Zero Trust Exchange
no first choiceagainst: Check Point Harmony SASE, Netskope One, Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
MiniMax M2.5Cloudflare One
One alternativeCato Networks
Cloudflare OneHeld
Two alternativesFortinet FortiSASE, Zscaler Internet Access + Private Access
against: Palo Alto Networks Prisma Access
Cloudflare One
Three alternativesCato Networks, Check Point Harmony SASE, OpenVPN CloudConnexa
against: Palo Alto Networks Prisma Access, Zscaler Zero Trust Exchange
Cloudflare One, Fortinet FortiSASE
Two alternativesCato Networks, OpenVPN CloudConnexa
no first choice
One alternativeCato Networks
against: Palo Alto Networks Prisma SASE, Zscaler Zero Trust Exchange
against: Cato Networks, Check Point Harmony SASE, Cloudflare One
Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
PromptModelVersion stringTime (UTC)SearchedSourcesLatency
Direct recommendationClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:46yes98 s
Direct recommendationGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:36yes36 s
Direct recommendationGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:21yes2022 s
Direct recommendationPerplexity Sonarsonar2026-09-17 07:25yes206 s
Direct recommendationGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:29yes4115 s
Direct recommendationMistral Smallmistral/mistral-small via mistral2026-09-17 07:35yes53 s
Direct recommendationDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:32yes1920 s
Direct recommendationLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:31yes53 s
Direct recommendationQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:41yes596 s
Direct recommendationKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:43yes1464 s
Direct recommendationGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:28yes18103 s
Direct recommendationMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:27yes920 s
ParaphraseClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:23yes1810 s
ParaphraseGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:25no04 s
ParaphraseGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:36yes1422 s
ParaphrasePerplexity Sonarsonar2026-09-17 07:44yes206 s
ParaphraseGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:26yes4015 s
ParaphraseMistral Smallmistral/mistral-small via mistral2026-09-17 07:39no01 s
ParaphraseDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:25yes1816 s
ParaphraseLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:22yes53 s
ParaphraseQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:43no041 s
ParaphraseKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:25yes1546 s
ParaphraseGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:38yes1840 s
ParaphraseMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:33no073 s
ComparativeClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:48yes1611 s
ComparativeGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:23yes58 s
ComparativeGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:43yes2024 s
ComparativePerplexity Sonarsonar2026-09-17 07:32yes207 s
ComparativeGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:21yes3918 s
ComparativeMistral Smallmistral/mistral-small via mistral2026-09-17 07:37yes1512 s
ComparativeDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:33yes1720 s
ComparativeLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:28yes53 s
ComparativeQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:30no044 s
ComparativeKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:23yes2552 s
ComparativeGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:34no0195 s
ComparativeMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:34yes923 s
Budget constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:38yes1710 s
Budget constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:37yes35 s
Budget constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:41yes2021 s
Budget constrainedPerplexity Sonarsonar2026-09-17 07:47yes205 s
Budget constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:47yes3615 s
Budget constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 07:25yes55 s
Budget constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:21yes1010 s
Budget constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:40yes52 s
Budget constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:40yes937 s
Budget constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:35yes940 s
Budget constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:27yes2370 s
Budget constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:32yes516 s
Scale constrainedClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:35no07 s
Scale constrainedGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:29no011 s
Scale constrainedGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:22yes1425 s
Scale constrainedPerplexity Sonarsonar2026-09-17 07:36yes2010 s
Scale constrainedGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:23yes1511 s
Scale constrainedMistral Smallmistral/mistral-small via mistral2026-09-17 07:43no010 s
Scale constrainedDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:43yes814 s
Scale constrainedLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:47yes54 s
Scale constrainedQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:30no037 s
Scale constrainedKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:35yes1027 s
Scale constrainedGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:33yes1334 s
Scale constrainedMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:44yes520 s
Negative framingClaude Haiku 4.5claude-haiku-4-5-202510012026-09-17 07:28yes188 s
Negative framingGPT-5.4 minigpt-5.4-mini-2026-03-172026-09-17 07:28yes59 s
Negative framingGemini 3.5 Flashgemini-3.5-flash2026-09-17 07:48yes2224 s
Negative framingPerplexity Sonarsonar2026-09-17 07:32yes206 s
Negative framingGrok 4.1 Fastspacexai/grok-4.1-fast-non-reasoning via vertex2026-09-17 07:44yes3816 s
Negative framingMistral Smallmistral/mistral-small via mistral2026-09-17 07:48yes1312 s
Negative framingDeepSeek V4 Flashdeepseek/deepseek-v4-flash via fireworks2026-09-17 07:23yes2730 s
Negative framingLlama 4 Maverickmeta/llama-4-maverick via bedrock2026-09-17 07:41yes53 s
Negative framingQwen 3.7 Flashalibaba/qwen3.7-flash via alibaba2026-09-17 07:28yes963 s
Negative framingKimi K2moonshotai/kimi-k2 via novita2026-09-17 07:27yes2840 s
Negative framingGLM 4.7 FlashXzai/glm-4.7-flashx via zai2026-09-17 07:36yes2652 s
Negative framingMiniMax M2.5minimax/minimax-m2.5 via minimax2026-09-17 07:46yes1958 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings
Barracuda read as Barracuda SecureEdge
Cato read as Cato SASE Cloud
Cato Networks SASE Cloud read as Cato SASE Cloud
Check Point read as Check Point Harmony SASE
Cloudflare read as Cloudflare One
Fortinet read as Fortinet FortiSASE
Fortinet (FortiSASE) read as Fortinet FortiSASE
Netskope read as Netskope One
Netskope (Netskope One) read as Netskope One
Palo Alto read as Palo Alto Networks Prisma SASE
Palo Alto Networks read as Palo Alto Networks Prisma SASE
Palo Alto Networks (Prisma SASE / Prisma Access) read as Palo Alto Networks Prisma SASE
Palo Alto Networks (Prisma SASE) read as Palo Alto Networks Prisma SASE
Palo Alto Networks (Prisma) read as Palo Alto Networks Prisma SASE
Versa read as Versa SASE
Zscaler read as Zscaler Zero Trust Exchange
Zscaler (ZIA / ZPA / ZDX) read as Zscaler Zero Trust Exchange
Zscaler Zero Trust read as Zscaler Zero Trust Exchange
Unresolved, counted raw
Broadcom / Symantec SASE
Broadcom / Symantec SSE / SASE
Cisco Secure Edge
Datto Secure Edge
Exium
Jimber
Microsoft 365 E5 / Defender Bundle
Mist
Open Systems
SonicWall ConnectSecure
Verizon Secure Access Service Edge (SASE)
ZTEdge
Zscaler Internet Access + Private Access
legacy Cisco stacks
Discontinued, still offered
No shut-down product was recommended here.
← FirewallsSD-WAN →