Web traffic, SaaS data, and private-app access still sit on three controls in a lot of shops: a proxy, a CASB, and a VPN. Three tickets, three consoles, three policy languages. Secure Service Edge is the attempt to put those three on one cloud edge. One login is not one product. SWG, CASB, and ZTNA can share a console and still be three SKUs.
The shortlist is Zscaler for scale, Netskope when data is the reason, Prisma Access if Palo Alto is already the firewall, and Cloudflare One when a published price matters more than CASB depth.
Gartner published the 2026 SSE Magic Quadrant on 29 Jul (Zscaler's copy also cites 30 Jul; the SASE Platforms report is dated 28 Jul). Zscaler and Netskope announced Leaders status on 4 Aug. Zscaler is a SASE Leader for the first time. That badge will get used to sell you WAN. If the branches already have a circuit, still buy SSE.
SWG / CASB / ZTNA: three controls, one console
Uncategorized web, isolate, TLS inspect
The file leaving personal Drive
The private app that used to be a VPN
Zscaler
Zscaler Internet Access plus Private Access is still the default large-enterprise SSE: a global proxy, no VPN to a corporate segment, one policy engine for web, SaaS, and private apps. The cloud is the Zero Trust Exchange. You steer users there with the Client Connector, or with an explicit proxy, and the rest is policy.
On 10 Jun 2026 at Zenith Live, Zscaler shipped the ZAgent Framework (policy drift, root-cause, autonomous ops), a Zero Trust Browser extension and enterprise browser, and B2B Exchange for partner app access without exposing a network. Cloud Browser Isolation stays the clientless form factor for risky sites and unmanaged devices.
On 4 Aug 2026 Zscaler was named a Leader in the 2026 Gartner SSE Magic Quadrant (fifth year) and, for the first time, a Leader in SASE Platforms (SSE report dated 30 Jul 2026).
Best for: Enterprises replacing a Blue Coat / legacy proxy and a VPN at the same time, who need a dense PoP footprint and will staff the policy model.
Key Features:
- ZIA SWG plus inline and API CASB, ZPA for private apps, DLP, cloud firewall, optional Cloud Browser Isolation.
- ZAgent Framework and Zero Trust Browser form factors since 10 Jun 2026.
- ZDX for digital experience when the ticket is "Slack is slow" and the answer might be the last mile.
- FedRAMP High path for US federal work.
Why we like it: If the job is "every user, every destination, one enforcement layer," Zscaler is still the grown-up proxy. The new browser form factors exist so they stop losing BYOD deals to Island.
Notable Limitations:
- Policy order and the admin learning curve are the consistent public complaint. A first rollout without a dedicated owner fails in the same way every time.
- Sandbox, DLP, isolation, and ZDX are commonly add-ons. A cheap ZIA quote leaves those lines on the table.
- Default portal log retention without a SIEM export is short. Export before the first investigation.
Pricing: AWS Marketplace, 12-month: Business Edition, 50 users: $15,750; Zero Trust Platform, 50 users: $20,000; Transformation Edition, 500 users: $312,000. 24- and 36-month tabs discount the longer term. Isolation, sandbox, and advanced DLP are separate quote lines. Most enterprises take a private offer. The Marketplace table is the proxy seat. It does not say whether Cloud Browser Isolation is inside Business.
Netskope One SSE
Netskope One SSE is the data-first SSE. SWG, CASB (inline and API), ZTNA, DLP, FWaaS, and RBI share one client, one console, and one policy engine. The network is NewEdge, a private security cloud: 120-plus data centers in 80-plus regions, including mainland China, full stack in every location. The March 2026 NewEdge datasheet is the current public spec.
That private backbone is the performance argument. TLS 1.3 and HTTP/2 inspection happen at the edge you landed on. If the buying reason is "do not slow Salesforce," this is the demo.
On 4 Aug 2026 Netskope was named a Leader in the 2026 Gartner SSE Magic Quadrant for the fifth consecutive year (report dated 29 Jul 2026) and a Leader in SASE Platforms, where it also claims the highest Ability to Execute. The companion Critical Capabilities report (3 Aug 2026) is the document to read if you care about use-case scores more than the logo.
Best for: SaaS-heavy and regulated teams whose first question is "where did that file go," not "how do I replace the VPN."
Key Features:
- Inline plus API CASB, DLP with exact-match and classifiers, RBI as an isolate action, ZTNA for private apps.
- NewEdge private backbone, 120-plus DCs, China included, latency SLAs on the datasheet.
- Cloud Confidence Index for the long tail of unsanctioned SaaS and AI apps.
- GovCloud / FedRAMP High for US public sector.
Why we like it: Most SSE pages say CASB. Netskope's useful unit is still the file and the app: this user, this personal Slack, this classifier. If that is the ticket you already have, do not start with a web-proxy specialist and bolt DLP on later.
Notable Limitations:
- The agent and TLS edge cases still appear in public admin threads. Pilot Google Workspace and the IdP as well as a speed test to office.com.
- Modular licensing is what grows the bill. INLINE_SWG on AWS Marketplace is the proxy line. CASB API, NPA, and RBI are separate.
- FWaaS is the thinner part of the story versus a Palo Alto shop that already thinks in App-ID.
Pricing: AWS Marketplace, 12-month, per 100 users unless noted:
| Dimension | Cost / 12 months |
|---|---|
| INLINE_SWG (100 users) | $64,363.00 |
| INLINE_CASB (100 users) | $34,831.00 |
| CASB_API (100 users) | $13,440.00 |
| NPA private access (100 users) | $13,714.80 |
| IaaS storage scan (1 TB) | $11,688.00 |
| IaaS/PaaS CSA (100 resources) | $21,667.20 |
| PS day | $2,400.00 |
RBI, full DLP scope, and NewEdge egress are quote. Add the lines you will actually turn on before you compare the SWG number to Zscaler.
Palo Alto Networks Prisma Access
Prisma Access is SSE for a shop that already speaks PAN-OS: cloud SWG, ZTNA, CASB, FWaaS, threat prevention, optional isolation, managed in Strata Cloud Manager or Panorama. The backbone sits on AWS, Google Cloud, and OCI, with 150-plus locations. Mobile users connect with GlobalProtect or Prisma Agent; branches come in on IPsec or Prisma SD-WAN.
Licensing is the part that surprises first-time buyers. The licensing guide meters three ways: per user per year, per site per year, and per Mbps per year. Editions are Business, Business Premium, and Enterprise. ADEM, DLP, AI Access Security, and Prisma Browser are add-ons. 250 GB of data transfer per year is on the base; bursting is a commercial conversation.
Prisma Browser (the Talon acquisition) is the replacement-browser path for unmanaged devices. Isolation is the other path. They are not the same SKU. If the POC is a contractor laptop, say which one you are buying.
Best for: Palo Alto firewall and Cortex customers who want the same threat stack (WildFire, URL, App-ID) on remote users without standing up another vendor's agent religion.
Key Features:
- Cloud SWG, ZTNA, CASB, FWaaS, Advanced Threat Prevention, optional RBI and Prisma Browser.
- Strata Cloud Manager or Panorama, so existing objects are not a second language.
- ADEM for the "is it us or the path" ticket.
- Per-user, per-site, and per-Mbps meters so a branch-heavy network is not forced onto a seat count.
Why we like it: The switching cost is the product. If Panorama already holds the rules, Prisma Access is the least dishonest way to get SSE without teaching a new policy model to the same six people.
Notable Limitations:
- Setup and documentation for advanced cases are the consistent review complaint. Budget professional services or an engineer who has done one before.
- No usable public list price. Third-party ranges are not a quote. Get the edition, the meter, and the add-ons on one page.
- CASB depth trails Netskope. If the RFP is SaaS DLP first, demo Netskope.
Pricing: Quote-only. Three meters (user, site, Mbps) and three editions. ADEM, DLP, isolation, and Prisma Browser are extra. Ask for the edition and the meter in writing; a "per user" number that hides remote-network Mbps is not a number.
Which meter wins if we have mobile users and branch circuits? The licensing guide names per-user, per-site, and per-Mbps. It does not say which one governs a mixed estate. Get it in writing.
Cloudflare One
Cloudflare One is the SSE you can price without a meeting. Access (ZTNA), Gateway (SWG), CASB, device posture, DNS and HTTP filtering, and Browser Isolation as an add-on, delivered on the same edge that already serves the public website. The Zero Trust plans page is public: Free for a first proof, Pay-as-you-go for teams over 50 doing a narrow SSE job, Contract for the rest.
On 7 Jul 2026 Browser Isolation started honoring identity-based Isolate policies on authorization proxy endpoints, so PAC-file traffic does not need the WARP client for isolate. Canvas Remoting (10 Apr 2026) is on by default for HTML5 Canvas apps. Email security, full DLP profiles, unlimited out-of-band CASB, and Magic WAN sit on the Contract plan as add-ons.
Cloudflare's own 2026 Gartner read is Visionary on both SASE and SSE. That is the honest placement: fast edge, published price, CASB and DLP still catching up.
Best for: Engineering-led orgs and mid-market teams that will replace a VPN with Access this quarter, and who will isolate a few categories rather than rebuild a full DLP program on day one.
Key Features:
- Access + Gateway on a published Pay-as-you-go seat. Free plan for the first proof.
- Browser Isolation add-on, with identity-aware PAC isolation since 7 Jul 2026.
- WARP client, or clientless Access for the apps that can live behind a Cloudflare hostname.
- Log Explorer: first 10 GB free, then a per-GB meter. Contract adds longer retention and Logpush.
Why we like it: It is the only SSE here a 80-person company can turn on this afternoon and put a real number in the budget. The edge is the product. The missing CASB depth is the trade.
Notable Limitations:
- Full DLP, unlimited CASB, email security, and Magic WAN are Contract add-ons. Pay-as-you-go is Gateway and Access.
- Pay-as-you-go log retention is short. An investigation that starts on day 12 will not have day 1.
- Support on the lower plans is the other public complaint. Do not buy PAYG and expect a phone bridge.
Pricing: Official plans: Free; Pay-as-you-go $7 / user / month (annual); Contract is custom. Browser Isolation, email security, dedicated egress, full DLP, and Magic WAN are add-ons. Log Explorer $1 / GB / month after 10 GB. The $7 tile is Gateway and Access. Isolation is still quote.
Is the $7 seat the stack? No. Full DLP, unlimited CASB, email security, and Magic WAN sit on Contract as add-ons. If the demo cannot name which of SWG, CASB, or ZTNA you are actually buying, you are not buying SSE yet.
What we left out
Skyhigh Security still exists as the STG / McAfee Enterprise cloud line, and it is data-first, but it is no longer a first-round shortlist against these four. Cato and FortiSASE are SASE buys (they include the WAN). Cisco Secure Access if Talos and an existing Cisco estate are the reason. iboss for mid-market and education. Start with the four above unless one of those is already in the building.
SSE or SASE, and the add-on trap
SSE is SWG + CASB + ZTNA + DLP, cloud-delivered. SASE is SSE plus the WAN. If the branches already have a circuit and a firewall you like, buy SSE. If you are ripping MPLS, Cato or Prisma SASE (Access plus SD-WAN) is the other conversation.
The quote that looks cheap is the base seat. Isolation, sandbox, exact-match DLP, ZDX/ADEM, and log export show up in the year-two number. Put those lines on the first commercial paper, then pilot in the worst region.
One console is not one product. Buy the plane that matches the ticket you already have. Internet-first at scale: Zscaler. File leaving SaaS: Netskope. Palo Alto already on the wall: Prisma Access. A published price and a VPN to kill this quarter: Cloudflare.
