Gartner Markets, M-19-6535 J. Girard Research Note 8 April 2003 SSL VPN 1H03 Magic Quadrant
The emerging Secure Sockets Layer virtual private network market is standards-based, with good short-term return on investment potential for enterprises to mitigate the risks of using unproven products and vendors.
Many enterprises implement complete virtual private networks (VPNs) where simpler, easier, less-expensive private access could be created by using Secure Sockets Layer (SSL). In 4Q02, popular awareness of SSL VPNs surged, giving growth opportunities to various vendors from different backgrounds and markets. Gartner has been writing about SSL VPNs for at least five years as a thinner method of establishing private remote-access sessions over the Internet, and we have validated the benefits enjoyed by early adopters. SSL VPNs do not require the installation and management of full, registered software clients on users' workstations.
SSL VPN vendors originate from several markets. Dedicated SSL VPN products and services are being offered from startups that are seizing the Hype Cycle opportunity. Several legacy VPN vendors have realized that conservative arguments for Internet Protocol Security (IPsec) are causing them to lose business. Vendors from the Web gateway, host gateway, Windows Terminal Server (WTS), application firewall and File Transfer Protocol (FTP) markets have extended their solution strategies to capture segments of the SSL VPN market.
The 14 vendors on the SSL VPN 1H03 Magic Quadrant (see Figure 1) represent a combination of software servers, appliance gateways and managed services. These vendors were ranked according to four execution and four vision criteria (see "SSL VPN 1H03 Magic Quadrant Evaluation Criteria") as solutions for enterprise intranet remote access, using SSL as a replacement for legacy VPN. Two vendors qualify as leaders, several are visionaries and many are good-value niche players.
Core Topics
Enterprise Networking: Network Equipment Vendors and Technologies
Security and Privacy: Security Tools, Technologies and Tactics
Key Issue
Which remote access technologies will best meet growing end-user demands? Strategic Planning Assumption
By YE04, 60 percent of corporate users will regularly use a thin-client VPN, instead of a full, fat-client VPN, for access to business data (0.7 probability).
Figure 1 SSL VPN 1H03 Magic Quadrant Neoteris Aventail Aspelle OpenReach Lemon Planet URoam Citrix Systems Nortel Networks InfoExpress Seagull Tarantella Whale Netilla Array Visionaries Niche Players Challengers Leaders As of April 2003 Array Networks Netilla Networks
Seagull Software Systems Whale Communications
Completeness of Vision Ability
to Execute
Source: Gartner Research Leaders
Startups Aventail and Neoteris earned leadership by achieving a strong balance of vision and execution.
Aventail is an older company than Neoteris and has a broader
set of features and services that contribute to its vision. Aventail has the widest range of client, server and managed-service options in the market. It added a hardware appliance to its portfolio at YE02 to stay competitive as appliance vendors become more influential. Aventail's challenge for 2003 is to make the transition from a software/service company to a product vendor.
Neoteris is a newer company and has less revenue than
Aventail, but it has a solid, well-explained appliance, as well as effective and aggressive sales tactics.
These vendors' revenue in the SSL VPN market places them above most others. Because SSL VPN total sales amount to less
than $25 million, the majority of potential worldwide revenue for IPsec replacements and new SSL access is untouched. Aventail and Neoteris will "slug it out" in competitive bouts until they are threatened by a compelling strategy from a major networking vendor or rapidly improving visionary. However, as of 1Q03, the major players are not strong competitors. Check Point Software Technologies' offering has not gathered momentum, and Nortel Networks' SSL VPN is not available in Contivity, its mainstream enterprise VPN. Cisco Systems and other legacy VPN vendors are quiet. However, we believe that they will introduce SSL VPN support in 2004. When large network vendors make a concerted move into SSL, Aventail and Neoteris will be challenged to partner or find different reasons to justify for their products.
Challengers
No vendor was ranked as a challenger in 1H03. However, by 2H04, Microsoft will assert its native and acquired SSL capabilities (0.8 probability); it will enter the Challengers quadrant by 1H05 (0.7 probability).
Visionaries
Lemon Planet, based in Sweden, was a surprise because
although it is known to us through research, it is barely visible in the U.S. market. Lemon Planet has done well in European markets by specializing in secure access on wireless and mobile personal digital assistants and smartphones. It has scaled down its thin-client firewall and dynamic policy rules to limit information that is exposed on small wireless devices. Lemon Planet may become a leader in our 2004 Magic Quadrant if it improves execution, increases prices (to bolster revenue per seat) and selects a more-appropriate company name for the U.S. market.
OpenReach is a recurring entrant in remote-access Magic
Quadrants, which recognizes its broad, managed VPN service. In 2002, OpenReach was the first full-service IPsec VPN provider to announce SSL as a transparent alternative to IPsec. OpenReach's clout is growing in extranet markets, but its enterprise intranet execution is weak because it lacks visibility. OpenReach should aggressively cultivate "mind share" and resellers to stay competitive.
Aspelle is new to the Magic Quadrant and could quickly become
a leader. Aspelle is supported by investment and expertise from Dresdner Bank; it has an appealing business strategy for European financial industry prospects. Aspelle's vision is strengthened by its ability to dynamically move users between gateways in multiple locations for load balancing, equipment failures and disaster backup routing. Its pricing by concurrent
users is not unusual, but it allows buyers to use its software to create as many servers as buyers want, at no additional charge.
Niche Players
Niche players have lower visibility, but they can win business if enterprises give them an opportunity. These vendors have good technology, but they are not driving industry behavior by example.
InfoExpress is included in the ranking due to its legacy product,
VTCP. Arguably the oldest product in the SSL VPN space, it is reliable, but obscure. InfoExpress makes most of its revenue selling personal firewalls.
Nortel Networks is ranked as a niche player for its Alteon SSL
VPN. Execution is low because the Alteon SSL VPN was not available until the end of March 2003. A stronger vision ranking will follow when Nortel migrates full support for SSL to Contivity platforms.
Tarantella, Netilla Networks and Citrix Systems compete in
the Microsoft WTS connectivity market, for which Gartner clients know them. SSL VPNs are an outgrowth of secure host access over the Internet. Tarantella and Netilla have expanded their host connectivity products to provide general SSL VPN access, but they are still known primarily as WTS enhancers, not VPN vendors. Citrix is a strong niche player in this market, selling security to augment MetaFrame, which controls the majority share of WTS enhancement seats and revenue.
URoam is similar to Neoteris, but less visible in execution. It is
not recognized as a vision leader compared to the clout of Neoteris and Aventail.
Array Networks, Seagull Software Systems and Whale Communications are examples of vendors that come from the
application firewall and FTP security appliance markets. They offer good value for SSL support.
Vendors Not on the Magic Quadrant
Three vendors asked not to be included on the Magic Quadrant. Check Point is trying to understand how best to bring its SSL option to market. NetSilica, a minor niche player with a solution based on a server software agent, and SafeWeb, an appliance vendor with a managed service option, were also withheld. Because of a lack of survey responses or direct feedback from Gartner clients, these vendors were not ranked: Authentor
Systems, Blue Ridge Networks, Novell (iFolder), Plumtree Software, Positive Networks, Sun Microsystems (iPlanet), TrueDisk and V-One.
Selection Advice
Enterprises that want easier and more-flexible ways to deploy secure remote access should consider SSL VPNs for new investments, and as upgrades for legacy VPNs. All vendors on the SSL VPN 1H03 Magic Quadrant have viable products and should be considered for requests for information.
IS managers must gain experience in SSL front ends and anticipate increased demands, even if they don't expect to implement an SSL VPN in the near term. Enterprises should use this Magic Quadrant research to help them compare vendors. Leadership denotes a vendor with a balance of strengths. However, vendors from any quadrant, as well as those not ranked, may suit an enterprise's requirements. Enterprises should consider any vendor that offers a superior price and solution for a well-defined problem.
Bottom Line: The simplicity and portability of Secure Sockets
Layer virtual private networks can lower the cost to implement remote-user VPNs for corporate workstations, as well as access from noncorporate systems such as personal computers. Where traditional VPNs are not required, enterprises should expect immediate value from investments in SSL VPNs in the form of easier deployment and support.
Acronym Key
FTP File Transfer Protocol IPsec Internet Protocol Security SSL Secure Sockets Layer VPN Virtual private network WTS Windows Terminal Server
