• Purpose-built physical, virtual or software appliances
• WAF modules embedded in application delivery controllers (ADCs; see "Magic Quadrant for Application Delivery Controllers")
• Cloud services or virtual appliances available on infrastructure as a service (IaaS) platforms

• Maximizes the detection and catch rate for known and unknown threats
• Minimizes false alerts (false positives) and adapts to continually evolving Web applications
• Ensures broader adoption through ease of use and minimal performance impact

Vendor Strengths and Cautions

AdNovum

Strengths

• The Nevis Suite includes robust authentication and SSO features. Its centralized management (nevisAdmin) is available at no additional charge and is multitenancy-capable.
• AdNovum has proven experience with large organizations in Switzerland, including financial institutions. It provides free licensing for test servers and unlimited flat-rate agreements for very large deals.
• Surveyed clients like the automatic policy learning module and the advanced security features, like URL encryption, CSRF token injection and form signature.

Cautions

• AdNovum's vision of WAF is as an integrated component, serving more than application security needs, with a stronger focus on WAM features. This limits the efforts devoted to the WAF roadmap and could impact the future ability to defend against advanced threats.
• AdNovum does not appear on Gartner clients' shortlists for WAF outside of Switzerland. The maturity of its channel program lags behind other vendors. Prospective customers should verify the availability of local technical support and request references from peer organizations.
• AdNovum lacks a standard hardware appliance offering that many of its competitors provide. A hardware appliance can, however, be provided by the vendor upon request. Clients report that initial configuration can be complex, but they cite recent improvements.
• Protections against SQL injection and cross-site scripting (XSS) are focused primarily on ModSecurity open-source or commercial signatures, with no complementary threat research or reputation/threat intelligence feeds. Surveyed clients report that fine-tuning of the default signature set is necessary to avoid frequent false positives.

Akamai

Strengths

• Combining application and volumetric DDoS protection with a Web application firewall is a differentiator, allowing for a "one-stop" Web server security platform.
• Kona Site Defender is well-suited for use cases where detection and alerting are the priorities. Akamai leverages its visibility into a substantial share of Internet traffic, with multiple steps for anomaly detection that feed a scoring mechanism, including IP reputation scoring.
• Akamai has a growing presence on WAF shortlists. Clients cite ease of deployment, low maintenance workload and performance as reasons to select the vendor's WAF.
• Akamai has increased its security credibility recently through continued visibility and threat research into high-profile Web-based attacks.

Cautions

• Akamai's WAF is available as a cloud service only. It does not provide the on-premises appliance option that many of its competitors offer to protect internal applications, or to maintain Secure Sockets Layer (SSL) secrets on the clients' corporate network.
• Although all cloud-based WAFs are less configurable and have less behavioral detection, Gartner clients consistently rate Kona as having the least capability. They also cite the high price, compared to other cloud WAFs, as a major reason to discard Akamai during evaluation.
• Akamai lacks lower-price WAF subscriptions to reach smaller enterprises and midsize organizations, which is a conflict given that both small and midsize businesses (SMBs) have a greater preference for cloud-based WAFs than do large enterprises.
• Kona Site Defender security still relies primarily on signatures and reputation scoring. It is, in general, less suited to use cases primarily requiring blocking or active response. It lags behind competitors in other capabilities, such as an automatic learning engine and the degree of custom configuration of Web application behavior.
• The Akamai-owned Prolexic DDoS service is viewed as a premium service overlapping with cloud DDoS protection service from Akamai. This can make deciding on a DDoS protection solution more difficult for enterprise clients with high-security requirements already using Kona WAF.

Barracuda Networks

Strengths

• Barracuda has a very broad range of platform options, and is one of the only vendors to offer a WAF on the Azure and vCloud Air platforms. Having an XML firewall on the same platform is likely of interest to SMBs (which are more likely to combine Web and application servers).
• Barracuda's WAF provides strong IP reputation, cookie protection and client fingerprinting capabilities. It also combines embedded authentication features and integration with several third-party authentication solutions.
• Barracuda customers rate its geographically distributed support capabilities quite highly. Clients also like the availability of a free evaluation unit and the Instant Replacement Service program that facilitate the upgrade of WAF appliances after four years.
• The vendor offers a wide range of foreign language support in its management interface, including many European languages that others local vendors don't provide, but also Mandarin, Cantonese, Japanese and Korean.

Cautions

• Gartner observes a consistent critique that the management interface is challenging to use. we have yet to receive client feedback on the updated management console introduced with WAF v.7.9.
• Barracuda's WAF lags behind its leading competitors in security automation. The result of vulnerability scans must be imported manually. Automatic learning capabilities are disabled by default and need to be re-enabled after an application change.
• Gartner has observed very few mentions of the Barracuda WAF on Gartner enterprise client shortlists, but it is frequently cited as the legacy WAF in WAF upgrade selections.
• There is currently no 5 Gbps or 10 Gbps models to support enterprise use cases.

Citrix

Strengths

• NetScaler AppFirewall includes mature features for Web security, and can be bundled with SSL VPNs for remote access to internal applications.
• NetScaler's ability to scale appeals to large organizations, especially when massive SSL offloading is required.
• Citrix has started investing more heavily in go-to-market activities, which should enhance an already capable and extensive network of channel partners. Gartner expects Citrix's WAF to become much more visible to a wider range of Gartner clients.
• The vendor offers an extensive range of hardware (MPX/SDX) and virtual (VPX) appliances, and continues to invest, with five new MPX appliances released in 2014.

Cautions

• Like most ADC vendors, Citrix primarily targets enterprise clients with ADC solutions and does not focus its efforts on pure-play security use cases. However, the new MPX releases indicate a potential shift in focus to encompass pure-play security use cases.
• Citrix appears less often on Gartner clients' shortlists than its direct competitors. In a survey of WAF vendors, Citrix is not one of the most-listed competitive threats.
• Despite an adaptive discount strategy, cost is often cited as a reason for midsize organizations to select another WAF vendor, if the target organization is not already using Citrix.
• The vendor does not offer or collaborate with cloud-based DDoS protection services.
• Gartner does not see Citrix's WAF displacing the competition based on its security capabilities, but rather sees it as an accompanying sale for ADC placements.

DBAPPSecurity

Strengths

• DAS-WAF includes automatic policy learning and Web application caching, and it can operate in reverse-proxy, transparent proxy or monitoring mode.
• Clients mention good price and local presence as reasons to select DAS-WAF.
• DAS-WAF can integrate with the vendor's vulnerability scanner and database security products.

Cautions

• DBAPPSecurity's WAF lags behind several competitors' WAFs in areas such as role-based management, detailed activity reports and authentication features. Clients mention that the management and reporting consoles require improvements.
• DBAPPSecurity has very limited market visibility and does not appear on Gartner clients' WAF shortlists outside of China. It serves primarily midsize organizations.
• The vendor did not provide international client and value-added reseller (VAR) references to Gartner. There is limited information available on the international version of its website. Prospective customers considering DBAPPSecurity WAF outside of China should request peer references, check vendor and channel expertise, and perform a proof of concept before purchase.
• DBAPPSecurity's strategic focus is on its security scanners. DAS-WAF's recent updates and roadmap are limited to marginal improvements.

DenyAll

Strengths

• DenyAll's customers list high-quality support and responsiveness to feature requests as a reason to select the vendor.
• DenyAll's technology includes several advanced protection techniques, including JSON traffic analysis/protection, code leakage detection and a lightweight browser agent.
• DenyAll wins deals among Type A security-conscious prospects. Its ambitious roadmap indicates a continued focus on security-first customers.
• The vendor also offers a comprehensive list of anti-evasion techniques and a scoring list feature (a weighted scoring approach in addition to signatures) for protection against attacks, such as SQL injection (SQLi) and cross-site scripting (XSS).
• DenyAll enables correlation between its WAF and dynamic application security testing (DAST) to increase the accuracy of detection and protection.

Cautions

• DenyAll mainly focuses on the French and EU markets, which limits its visibility and adoption in other geographies. Through partners, it has expanded its reach into certain Middle Eastern, South American and Southeast Asian nations, and is looking to increase its U.S. presence.
• Gartner has not yet observed any negative impact coming from the acquisition of BeeWare on DenyAll's WAF security roadmap, but the acquisition has already presented challenges for legacy BeeWare customers. It is difficult to find BeeWare product information on the combined website, and the product life cycle for those products is unclear.
• DenyAll's organic growth is low compared with the Leaders, Challengers and even some Niche Players in this Magic Quadrant.
• DenyAll's reporting and logging are areas that customers say need improvement.
• DenyAll's WAF correlation process between WAF and DAST mainly focuses on WAF integration with its own DAST, but not DAST from other application security testing vendors. Therefore, the value of the integration depends on DenyAll's ability to continually improve its DAST product.

Ergon Informatik

Strengths

• Ergon Informatik's customers give good scores for the efficiency of its support and the robustness of the WAF solution when deployed in production environments.
• Airlock's most recent update made it easier to manage security signatures and improved the visibility over security features for the administrator of the WAF component.
• Airlock includes extensive techniques for Web application parameters, with URL encryption, various cookie protections (including a cookie store) and form parameter integrity checks.
• Airlock's integration of a full IAM solution adds comprehensive authentication and SSO features. Airlock Login — its simplified version — provides a cost-effective alternative.

Cautions

• Airlock lacks some of the advanced security features that enterprises might require, including automatic policy learning and CSRF token injection.
• Airlock does not offer centralized management and has a lower number of WAF deployments protecting a large number of different Web applications than the Leaders and Challengers in this Magic Quadrant.
• Airlock provides only a Splunk App, but the vendor reports that its customers have integrated with the leading SIEM technologies.
• Airlock has very low visibility among Gartner's client base.

F5

Strengths

• Surveyed customers list WAF integration with ADC and other F5 functions as the most prominent criterion for selecting F5 ASM. Many Gartner clients have reported that F5 ASM has been a differentiator in their ADC decisions.
• F5's corporate teams and channels provide logistic capabilities and support that are greater and have more geographic coverage than the majority of WAF vendors.
• ASM utilizes the same management software that is familiar to F5 administrators. iRules scripting enables the creation of custom policies that complement the predefined rule sets.
• F5 has been active in adding new WAF features, including alert scoring for easier triage and geo-IP-based challenges. F5 also messages well on overall security.
• As a leading ADC vendor with a large installed base of clients, F5 leverages the scalability of its ADC Big-IP platforms and the strength of its ADC sales as the entry point for add-on WAF licenses. This gives existing F5 clients an easy path to add WAF to their security portfolio.

Cautions

• Users report difficulty in initial configuration and policy tuning, and report some difficulty maintaining things like reporting history and automated policy after reboot. Some Gartner clients have commented that ASM support can be challenging until escalated.
• Like other ADC-based WAFs, F5's WAF buyers are most likely to consider its WAF as a feature add-on to the accompanying ADC in reverse-proxy mode. This places F5 at a potential disadvantage versus pure-play WAFs when prospects have an incumbent ADC from another vendor.
• Many surveyed VARs reselling F5 also have a pure-play WAF in their portfolio. Clients interested in F5's WAF for high-security deployments should get a confirmation that the selected partner is sufficiently skilled on the ASM module to support this use case.

Fortinet

Strengths

• Clients cite vendor reputation, competitive prices and satisfaction with other products from Fortinet as reasons to purchase FortiWeb.
• FortiWeb relies on a solid hardware product line with accelerated SSL decryption. Straightforward documentation on product performance and limitations per deployment mode help to ensure reliable product sizing practices across Fortinet's channel.
• Clients purchasing FortiWeb frequently use its antivirus engine for malware inspection on file sharing Web services. Gartner expects the integration with sandboxing to further improve the relevance of FortiWeb for this use case.
• FortiWeb includes an integrated vulnerability scanner, OOB deployments and a good number of predefined reports.
• FortiWeb has a good set of features, including automatic policy learning, IP reputation (maintained by the FortiGuard team), cookie signing, SSL acceleration, Web application caching and bot detection.

Cautions

• FortiWeb is a secondary product for Fortinet compared to FortiGate, with only a narrow portion of the Fortinet channel actively selling its WAF. Gartner believes that local technical skills availability is much scarcer than those relating to network firewalls.
• Clients report that deploying FortiWeb in nontrivial application environments might require a fair amount of fine-tuning for a prolonged period of time to avoid false positives.
• Fortinet does not offer WAF functionalities on top of its ADC, and does not provide a WAF as a cloud service. The vendor also does not offer some features that security-conscious organizations request, such as hardware security module (HSM) support or integration with DDoS cloud-based protection services. It integrates only with Acunetix DAST solutions.
• FortiWeb has limited integration with other Fortinet solutions, thereby limiting the benefits for current Fortinet customers mostly to a common log reporting solution (FortiAnalyzer).
• Fortinet's WAF rarely appears on WAF selection shortlists and is mostly seen in compliance-driven WAF selections.

Imperva

Strengths

• Gartner sees Imperva consistently scoring very high and/or winning competitive assessments done by Gartner clients, with a high success rate when security, reporting and protection, rather than detection, are the most weighted criteria. Postsales, Gartner client commentaries also usually are very positive.
• Imperva has continually led the WAF market in new features that forced competitors to react; it also includes several advanced techniques for better efficiency of protection that its competitors lack. Thus, it is a good shortlist contender when protection is foremost and having a different vendor for WAFs and ADCs is an acceptable scenario. Clients using Imperva's "manager of manager" option is another sign of the vendor's presence in large deployments.
• The vendor has consistently and effectively messaged on and delivered WAF features in response to changes in the data center and the application threat landscape, such as the first integration between Incapsula WAF and Skyfence CASB. Imperva has done well in thought leadership and threat reporting for new Web-based attacks.
• Having the WAF-as-a-service Incapsula and on-premises SecureSphere options gives Imperva access to a larger addressable market in the enterprise and SMBs. This provides a transition path for clients whose application security needs change, and Incapsula is a good source to feed SecureSphere's threat intelligence (ThreatRadar Reputation Services).
• Like the on-premises SecureSphere, Incapsula continually scores high in Gartner client feedback versus other in-the-cloud WAFs.

Cautions

• As a premium enterprise product, Imperva SecureSphere is usually too advanced for SMBs, or for projects where the WAF is being deployed only as a "check the box" measure to meet compliance requirements. Enterprise clients cite SecureSphere's premium price as the main reason to select an alternate WAF solution. This is especially true when competing with ADC vendors.
• Although Imperva consistently scores highest in security capability, SecureSphere faces the most competition from WAFs provided by ADC vendors, which often already have products on-site with customers and can offer a WAF via a license key. These customers do not want to pay the premium for a point security product.
• Imperva's clients and prospects frequently feel pressure from Imperva's channel and sales team to integrate with its database solutions, which increases the total costs of Web application security projects and lengthens the purchase cycle with additional discussions between the data and network security buying centers for a yet unproven combined benefit.
• Clients report occasional frustration with Imperva's management console, which they find a bit dated, especially when deploying clusters of applications.
• Although Gartner has not observed it as a barrier to any deals, Imperva only supports AWS at present, whereas competitors have versions for other cloud platforms.

NSFOCUS

Strengths

• Clients selecting NSFOCUS's WAF often report competitive price and performance, especially low latency, as being decisive factors. NSFOCUS has recently added a localized GUI for its Japanese clients.
• The WAF can redirect incoming Web traffic to NSFOCUS's anti-DDoS ADS devices located on a cloud infrastructure when congestion is detected, and then switch back to normal.
• The WAF has a good mix of local and global product certification, including ICSA Labs WAF certification.
• NSFOCUS's WAF integrates with its DAST product, NSFOCUS Web Vulnerability Scanning System (NSFOCUS WVSS).

Cautions

• NSFOCUS is not visible in WAF offering evaluations outside of China. Its international channel's technical investment in WAF still lags behind the other products, which can limit the availability of local skilled resources for support.
• NSFOCUS's WAF lags behind the Leaders in some enterprise-class features, such as limited role-based management, active-active clusters restricted to two appliances, and no SSL acceleration or HSM.
• NSFOCUS's WAF does not provide authentication features.
• Surveyed clients report that automatic policy learning could be easier to fine-tune.
• NSFOCUS's WAF integrates with the vendor's vulnerability scanner (RSAS); however, to date, there are no integrations with third-party SIEM or vulnerability scanners.

Penta Security

Strengths

• Surveyed clients praise Penta Security's WAF ease of deployment and low operational workload. They give good scores for the quality of the protection and for the low false-positive rate.
• Wapples is the only WAF evaluated in this research with Common Criteria EAL4 certification.
• Wapples includes parameter and cookie security features, and it can create whitelists from IP reputation feeds. Its audit logs provide good traceability of configuration changes. Cloudbric, its cloud WAF, is free for up to 4GB of data per month.
• Penta Security's local partnership agreement with telecom providers offers an easy option to combine cloud-based DDoS protection with the WAF.

Cautions

• Wapples includes limited automation features to create its security policy from Web application behavior. Even if multiple default security policies are available, it lacks predefined templates for well-known Web applications.
• Wapples security heavily depends on the robustness of its generic engine, with few complementary techniques available in case it fails to detect targeted attacks.
• Penta Security does not offer authentication features, which can limit its ability to integrate with internal Web applications.
• To date, integrations with third-party SIEM or Web vulnerability scanners rely on generic SNMP and syslog support.
• The vendor does not yet appear on Gartner clients' shortlists outside the Asia/Pacific region.

Positive Technologies

Strengths

• Positive Technologies' customers list good security, ease of configuration through self-learning, and heuristics as reasons for selection.
• Partners and customers speak highly of the vendor's responsiveness to feature requests and the quality of technical support.
• PT Application Firewall enables reflected XSS detection by analyzing HTTP responses, and uses machine learning for anomaly detection.
• Positive Technologies has a strong capability, using templates to protect certain business applications, most notably SAP.
• The vendor enables correlation between its WAF and DAST/static application security testing (SAST) to increase the accuracy of detection and protection.

Cautions

• Positive Technologies' WAF is a young product; therefore, it has been focused on a limited set of geographies. In 2015, the vendor plans to expand its reach into South American and North American nations, and certain Asia/Pacific region and Middle Eastern nations.
• The vendor lacks integration with Active Directory, and does not support hardware SSL offload.
• Positive Technologies' revenue is low compared with the Leaders, Challengers and most of the Niche Players in this Magic Quadrant. It does not show up as a top competitor among surveyed vendors, and Gartner seldom sees PT Application Firewall on client shortlists.
• Customers cite management console and inflexible reporting as areas for improvement.

Radware

Strengths

• Among other deployment scenarios, AppWall can be deployed in transparent bridge mode while providing reverse-proxy capabilities to specific traffic. Combined with automatic policy learning, this enables AppWall to be deployed easily, with no configuration changes to the network.
• Surveyed Radware customers cite security and price as two primary reasons for selecting the vendor.
• Radware's WAF console includes strong service-provider-focused multitenancy capabilities, and integrates authentication and SSO modules.
• Radware has executed well on its roadmap for the past three years, showing a stronger commitment to the WAF market than many of the other Niche Players in this Magic Quadrant.

Cautions

• AppWall lacks integration with third-party dynamic vulnerability scanners and database monitoring solutions.
• Radware was slow to integrate AppWall as a module with the Radware Alteon ADC (it was added in June 2014), thereby putting the vendor at a competitive disadvantage with fully integrated ADC/WAF competitors. Since then, Gartner has not seen many deals with AppWall sold alongside Alteon.
• Radware has low visibility on Gartner client WAF shortlists. It gets fewer mentions in Gartner client inquiries than several of its direct competitors.

Trustwave

Strengths

• Trustwave's support of ModSecurity gives its large threat research team (SpiderLabs) access to feedback from its community, which is useful for improving the quality of its WAF — notably the recently introduced IP reputation subscription.
• Trustwave's WAF provides a PCI-ready default configuration. Its well-crafted OOB deployment mode, with multiple types of blocking capabilities and the ability to decrypt SSL connections using a copy of the network traffic, appeals to its WAF clients.
• With its latest release (v.7.0), Trustwave WAF can inspect JSON content and deploy signatures automatically.
• Clients report that they have confidence in the SpiderLabs team's expertise.

Cautions

• The impact of the Singtel acquisition could influence Trustwave's roadmap and switch the focus to other products and services. It also could alienate some channel partners in regions where Singtel operates.
• Gartner sees Trustwave's partnership with Akamai as a double-edged sword for Trustwave customers, offering them a cloud option with a known brand, but vastly different technology, pricing and management approaches when migrating their Web application to the cloud.
• Except for compliance projects in North America, Gartner rarely sees Trustwave on WAF shortlists.
• Clients cite centralized management and the false-positive rate (in default configuration and subsequent application changes) as needed improvements.
• Trustwave lags its competitors in several areas, including authentication, in-house protection against application DDoS, integration with third-party SIEM and Web application delivery optimization.

United Security Providers

Strengths

• The integration with the WAM solution offers a lot of flexibility for authentication and SSO, which can be factored into WAF security decisions.
• United Security Providers has recently started operations in the U.K., with dedicated objectives for WAF expansion, and has further developed its WAF appliance product lines. Gartner sees these moves as good first signals for a future increased focus on WAF client needs.
• United Security Providers' WAF includes advanced security features, such as URL encryption, protection against CSRF, cookie security and Web client fingerprinting. It also supports JSON and WebSockets.
• The vendor has a faithful base of clients and channel partners. When surveyed, clients mentioned positive feedback from peer references as a reason to select United Security Providers. They give good scores to its support and professional service, and to the vendor's WAF managed services offering.

Cautions

• United Security Providers increased its efforts in WAF product development, but its marketing remains primarily centered on WAM buyers.
• Surveyed clients indicate that the management and reporting console could be improved.
• The vendor's WAF can't redirect traffic to a DDoS protection cloud or integrate with third-party DDoS protection. It does not integrate with any of the leading application security testing vendors, and has integration with SIEM using syslog only.
• Outside of Switzerland, United Security Providers does not appear on Gartner competitive shortlists for WAF, and it is not mentioned as a competitor by other vendors for WAF selections.

Vendors Added and Dropped

Added

• Positive Technologies

Dropped

• BeeWare was acquired by DenyAll

• Their offerings can protect applications running on different types of Web servers.
• Their WAF technology is known to be approved by qualified security assessors as a solution for PCI Data Security Standard (DSS) Requirement 6.6 (which covers Open Web Application Security Project [OWASP] Top 10 threats, in addition to others).
• They provide physical, virtual or software appliances, or cloud instances.
• Their WAFs were generally available as of 1 January 2014.
• Their WAFs demonstrate features/scale relevant to enterprise-class organizations.
• They have achieved $4 million in revenue from the sales of WAF technology.
• Gartner has determined that they are significant players in the market due to market presence or technology innovation.
• Gartner analysts estimate that the vendor's WAF technology provides more than repackaged ModSecurity engine and signatures.

• The vendor primarily has a network firewall or IPS with a non-enterprise-class WAF.
• The vendor has minimal or negligible apparent market share among Gartner clients, or is not actively shipping products.
• The vendor is not the original manufacturer of the firewall product. This includes hardware OEMs, resellers that repackage products that would qualify from their original manufacturers, and carriers and Internet service providers that provide managed services. We assess the breadth of OEM partners as part of the WAF evaluation, and do not rate platform providers separately.
• The vendor has a host-based WAF or API security gateway (these are considered distinct markets).

Ability to Execute

• Product or Service: This includes the core WAF technology offered by the technology provider that competes in/serves the defined market. This also includes current product or service capabilities, quality, feature sets, and skills, whether offered natively or through OEM agreements/partnerships, as defined in the Market Definition/Description section. Strong execution means that a vendor has demonstrated to Gartner that its products or services are successfully and continually deployed in enterprises. Execution is not primarily about company size or market share, although these factors can considerably affect a company's ability to execute. Some key features, such as the ability to support complex deployments, including on-premises and cloud-based options, with real-time transaction demands, are weighted heavily.
• Overall Viability: This includes an assessment of the overall organization's financial health, the financial and practical success of the business unit, and the likelihood that the individual business unit will continue to invest in WAF, offer WAF products, and advance the state of the art within the organization's portfolio of products.
• Sales Execution/Pricing: This is the technology provider's capabilities in all presales activities and the structure that supports them. It includes deal management, pricing and negotiation, presales support, and the overall effectiveness of the sales channel. It also includes deal size, as well as the use of the product or service in large enterprises with critical public Web applications, such as banking applications or e-commerce. Low pricing will not guarantee high execution or client interest. Buyers want good results more than they want bargains.
• Market Responsiveness/Record: This is the ability to respond, change direction, be flexible and achieve competitive success as opportunities develop, competitors act, and security trends and customer needs evolve. A vendor's responsiveness to new or updated Web application frameworks and standards, as well as its ability to adapt to market dynamics, changes (such as the relative importance of PCI compliance). This criterion also considers the provider's history of releases, but weights its responsiveness during the most recent product life cycle higher.
• Marketing Execution: This is the clarity, quality, creativity and efficacy of programs that are designed to deliver the organization's message in order to influence the market, promote the brand and business, increase awareness of the products, and establish a positive identification with the product/brand and organization in buyers' minds. This mind share can be driven by a combination of publicity, promotional activities, thought leadership, word of mouth and sales activities.
• Customer Experience: This assesses the relationships, products and services/programs that enable clients to be successful with the products that are evaluated. Specifically, this includes the ways customers receive technical support or account support. This can also include ancillary tools, customer support programs (and the quality thereof), availability of user groups, service-level agreements and so on.
• Operations: This is the organization's ability to meet its goals and commitments. Factors include the quality of the organizational structure, including skills, experiences, programs, systems and other vehicles that enable the organization to operate effectively and efficiently on an ongoing basis.

Completeness of Vision

• Market Understanding: This is the technology provider's ability to understand buyers' wants and needs, and to translate them into products and services. Vendors that show the highest degree of vision listen to and understand buyers' wants and needs, and can shape or enhance them with their added vision. They also determine when emerging use cases will greatly influence how the technology has to work.
• Marketing Strategy: This is a clear, differentiated set of messages that is consistently communicated throughout the organization and externalized through the website, advertising, customer programs and positioning statements.
• Sales Strategy: This is the strategy for selling products that uses the appropriate network of direct and indirect sales, marketing, service, and communication affiliates to extend the scope and depth of market reach, skills, expertise, technologies, services and the customer base. The ability to attract new customers in need of Web application security only has a strong influence on this criterion.
• Offering (Product) Strategy: This is the technology provider's approach to product development and delivery that emphasizes differentiation, functionality, methodology and feature sets as they map to current and future requirements. As attacks change and become more targeted and complex, we highly weight vendors that move their WAFs beyond rule-based Web protections that are limited to known attacks. For example:
  • Enabling a positive security model with automatic and efficient policy learning
  • Using a weighted scoring mechanism based on a combination of techniques
  • Providing updated security engines to handle new protocols and standards (such as JSON, HTML5, SPDY, IPv6 and WebSockets), as well as remaining efficient against the changes in how older Web technologies (such as Java, JavaScript and Adobe Flash) are used
  • Actively countering evasion techniques
  This criterion includes the evaluation of the depth of features, especially features that ease the management of the solution, and the integration with other solutions, including DDoS protection services and emerging technologies like CASB.
• Business Model: This is the soundness and logic of a technology provider's underlying business proposition.
• Vertical/Industry Strategy: This is the technology provider's strategy to direct resources, skills and offerings to meet the specific needs of individual market segments, including vertical markets. This criterion is not rated this year.
• Innovation: This is the direct, related, complementary and synergistic layouts of resources, expertise or capital for investment, consolidation, defensive or pre-emptive purposes. It includes product innovation and quality differentiators, such as:
  • New methods for detecting Web attacks and avoiding false positives
  • A management interface, monitoring and reporting that contribute to easy Web application setup and maintenance, better visibility, and faster incident response
  • Integration with companion security technologies, which improves overall security
• Geographic Strategy: This is the technology provider's strategy to direct resources, skills and offerings to meet the specific needs of geographies outside the "home" or native geography — either directly or through partners, channels and subsidiaries — as appropriate for those geographies and markets.

Quadrant Descriptions

Leaders

Challengers

Visionaries

Niche Players

• Their tolerance for a full in-line reverse proxy with blocking capabilities in front of the Web applications
• The benefits and constraints of the different WAF delivery options: dedicated appliances, CDNs, ADCs and cloud services
• SSL decryption/re-encryption and other scalability requirements

Organizations Better Understand the Value of WAF Technology, but Expect More Benefits

• Data acquisition for business intelligence (BI), analytics and data warehousing —Extracting data from operational systems, transforming and merging that data, and delivering it to integrated data structures for analytics purposes. The variety of data and context for analytics is expanding as emergent environments — such as NoSQL and Hadoop distributions for supporting big data, in-memory DBMSs, logical data warehouse architectures and end-user capability to integrate data (as part of data preparation) — increasingly become parts of the information infrastructure.
• Sourcing and delivery of master data in support of master data management (MDM) —Enabling the connectivity and integration of the data representing critical business entities such as customers, products and employees. Data integration tools can be used to build the data access and synchronization processes to support MDM initiatives.
• Data migrations/conversions — Although traditionally addressed most often via the custom coding of conversion programs, data integration tools are increasingly addressing the data movement and transformation challenges inherent in the replacement of legacy applications and consolidation efforts during mergers and acquisitions.
• Data consistency between operational applications — Data integration tools provide the ability to ensure database-level consistency across applications, both on an internal and an interenterprise basis (for example, involving data structures for SaaS applications or cloud-resident data sources), and in a bidirectional or unidirectional manner.
• Interenterprise data sharing — Organizations are increasingly required to provide data to, and receive data from, external trading partners (customers, suppliers, business partners and others). Data integration tools are relevant for addressing these challenges, which often consist of the same types of data access, transformation and movement component found in other common use cases.

• Interoperating with application integration technology in a single solution architecture to, for instance, expose extraction, transformation and loading (ETL) processes that extract data from sources as a service to be provisioned via an enterprise service bus.
• Enabling data services as an architectural technique in a service-oriented architecture (SOA) context. Rather than a use of data integration per se, this represents an emerging trend for data integration capabilities to play a role, and to be implemented within, software-defined architecture for application services.
• Integrating a combination of data residing on-premises and in SaaS applications or other cloud-based data stores and services, to fulfill requirements such as cloud service integration.
• Supporting the delivery of data to, and the access of data from, platforms typically associated with big data initiatives, such as Hadoop, NoSQL and cloud-based data stores. These platforms provide opportunities for distributing data integration workloads to external parallelized processes. The emerging concept of a "data lake," where data is continuously collected and stored in a lightly structured NoSQL repository, poses data integration challenges but also opportunities to assist in the application of schemas at data read-time, if needed, and to deliver data to business users, processes or applications, or to use data iteratively.

• Connectivity/adapter capabilities (data source and target support). The ability to interact with a range of different types of data structure, including:
  • Relational databases
  • Legacy and nonrelational databases
  • Various file formats
  • XML
  • Packaged applications, such as those for CRM and supply chain management
  • SaaS and cloud-based applications and sources
  • Industry-standard message formats, such as electronic data interchange (EDI), Health Level Seven International (HL7) and Society for Worldwide Interbank Financial Telecommunication (SWIFT)
  • Parallel distributed processing environments such as Hadoop Distributed File System (HDFS) and other NoSQL-type repositories, such as graph, table-style, document store and key-value DBMSs
  • Message queues, including those provided by application integration middleware products and standards-based products (such as Java Message Service)
  • Data types of a less structured nature, such as that associated with social media, Web clickstreams, email, websites, office productivity tools and content
  • Emergent sources, such as data on in-memory repositories, mobile platforms and spatial applications
  • Screen-scraping and/or user interaction simulations (for example, scripts to interact with Web, 3270, VT100 and others)

• Data integration tools must support different modes of interaction with this range of data structure types, including:
  • Bulk/batch acquisition and delivery
  • Granular trickle-feed acquisition and delivery
  • Change data capture (CDC) — the ability to identify and extract modified data
  • Event-based acquisition (time-based, data-value-based, or links to application integration tools to interact with message request/reply, publish/subscribe, and routing)

• Data delivery capabilities. The ability to provide data to consuming applications, processes and databases in a variety of modes, including:
  • Physical bulk/batch data movement between data repositories, such as processes for ETL or extraction, loading and transformation (ELT)
  • Data federation/virtualization
  • Message-oriented encapsulation and movement of data (via linkage with application integration tool capability)
  • Replication of data between homogeneous or heterogeneous DBMSs and schemas

• In addition, support for the delivery of data across the range of latency requirements is important, including:
  • Scheduled batch delivery
  • Streaming/near-real-time delivery
  • Event-driven delivery of data based on identification of a relevant event

• Data transformation capabilities. Built-in capabilities for achieving data transformation operations of varying complexity, including:
  • Basic transformations, such as data-type conversions, string manipulations and simple calculations
  • Transformations of intermediate complexity, such as look-up and replace operations, aggregations, summarizations, integrated time series, deterministic matching and the management of slowly changing dimensions
  • Complex transformations, such as sophisticated parsing operations on free-form text, rich media and patterns/events in big data

• Metadata and data modeling support. As the increasingly important heart of data integration capabilities, metadata management and data modeling requirements include:
  • Automated discovery and acquisition of metadata from data sources, applications and other tools
  • Discernment of relationships between data models and business process models
  • Data model creation and maintenance
  • Physical-to-logical model mapping and rationalization
  • Ability to define model-to-model relationships via graphical attribute-level mapping
  • Lineage and impact analysis reporting, in graphical and tabular formats
  • An open metadata repository, with the ability to share metadata bidirectionally with other tools
  • Automated synchronization of metadata across multiple instances of the tools
  • Ability to extend the metadata repository with customer-defined metadata attributes and relationships
  • Documentation of project/program delivery definitions and design principles in support of requirements definition activities
  • A business analyst/end-user interface to view and work with metadata
• Design and development environment capabilities. Facilities for enabling the specification and construction of data integration processes, including:
  • Graphical representation of repository objects, data models and data flows
  • Management of the development process workflow, addressing requirements such as approvals and promotions
  • Granular, role-based and developer-based security
  • Team-based development capabilities, such as version control and collaboration
  • Functionality to support reuse across developers and projects, and to facilitate the identification of redundancies
  • A common or shared user interface for design and development (of diverse data delivery styles, of data integration and data quality operations, of cloud and on-premises environments, and so on)
  • A business analyst/end-user interface to specify and manage mapping and transformation logic through the use of end-user functionality for data integration/preparation
  • Support for testing and debugging
• Information governance support capabilities (via interoperation with data quality, profiling and mining capabilities with the vendor's or a third party's tools). Mechanisms to work with related capabilities to help with the understanding and assurance of data quality over time, including interoperability with:
  • Data profiling tools (profiling and monitoring the conditions of data quality)
  • Data mining tools (relationship discovery)
  • Data quality tools (supporting data quality improvements)
• Deployment options and runtime platform capabilities. Breadth of support for the hardware and operating systems on which data integration processes may be deployed, and the choices of delivery model — specifically:
  • Mainframe environments, such as IBM z/OS and z/Linux
  • Midrange environments, such as IBM System i or HP Tandem
  • Unix-based environments
  • Windows environments
  • Linux environments
  • On-premises (at the customer site) installation and deployment of software
  • Hosted off-premises software deployment (dedicated, single-tenant implementation)
  • Integration platform as a service (iPaaS), consumed by the customer completely "as a service"— the vendor provides cloud infrastructure; the customer does not install and administer the software
  • Cloud deployment support (requires organizations to deploy software in cloud infrastructure)
  • In-memory computing environment
  • Server virtualization (support for shared, virtualized implementations)
  • Parallel distributed processing (such as Hadoop and MapReduce)
• Operations and administration capabilities. Facilities for enabling adequate ongoing support, management, monitoring and control of the data integration processes implemented by the tools, such as:
  • Error-handling functionality, both predefined and customizable
  • Monitoring and control of runtime processes, both via functionality in the tools and through interoperability with other IT operations technologies
  • Collection of runtime statistics to determine use and efficiency, as well as an application-style interface for visualization and evaluation
  • Security controls, for both data in-flight and administrator processes
  • A runtime architecture that ensures performance and scalability
• Architecture and integration capabilities. The degree of commonality, consistency and interoperability between the various components of the data integration toolset, including:
  • A minimal number of products (ideally one) supporting all data delivery modes
  • Common metadata (a single repository) and/or the ability to share metadata across all components and data delivery modes
  • A common design environment to support all data delivery modes
  • The ability to switch seamlessly and transparently between delivery modes (bulk/batch versus granular real-time versus federation) with minimal rework
  • Interoperability with other integration tools and applications, via certified interfaces, robust APIs and links to messaging support
  • Efficient support for all data delivery modes, regardless of runtime architecture type (centralized server engine versus distributed runtime)
  • The ability to execute data integration in cloud and on-premises environments, as appropriate, where developed artifacts can be interchanged, reused and deployed across both environments with minimal rework
• Service enablement capabilities. As acceptance of data service concepts continues to grow, so data integration tools must exhibit service-oriented characteristics and provide support for SOA, such as:
  • The ability to deploy all aspects of runtime functionality as data services (for example, deployed functionality can be called via a Web services interface)
  • Management of publication and testing of data services
  • Interaction with service repositories and registries
  • Service enablement of development and administration environments, so that external tools and applications can dynamically modify and control the runtime behavior of the tools

Vendor Strengths and Cautions

Actian

Strengths

• Core capability and performance. Actian's continued focus on diverse connectivity and emphasis on industry-standard message formats enable companies to support diverse data integration requirements, from real-time to batch mode. Customers report Actian's bulk/batch data delivery to be a key strength, one favored in implementations for having strong scalability and performance.
• User productivity. The extension of functionality so that business roles can control user-defined integration mapping and data loading enables productivity gains. Actian has extended the capabilities of DataCloud and DataConnect, which will evolve to be delivered as managed services to further simplify customer onboarding and ease use for interenterprise data sharing.
• Customer relationship. Actian's partnering posture toward companies results in a strong customer experience, encompassing the presale process, the selling process, and the postsale relationship.

Cautions

• Challenges with major upgrades. Customers report challenges with upgrades between major releases. A migration utility offered by Actian, along with increased frequency of releases, is intended to reduce the complexity of each upgrade and ease migration efforts.
• Linkage of product support with professional services. Customers would like to see better alignment between Actian's data integration tools, along with access to implementation skills and professional services.
• Market positioning of use cases. The perceived closeness of alignment between Actian's portfolio and analytics support requirements represents a competitive disadvantage for prospective buyers. However, customers report diverse data integration use cases in production.

Adeptia

Strengths

• Integrated product and time-to-value: Adeptia's data integration technology is offered alongside other integration tools that provide an enterprise service bus, B2B integration and trading partner management — all in a single product. Customers appreciate the tight integration of the underlying components and the ability to support rapid implementation.
• Expanded applicability using cloud services. Adeptia Connect offers iPaaS functionality that enables interenterprise data sharing, where businesses are able to publish and use data connectors for B2B integration. Planned enhancements to support EDI schemas, data dictionaries, mapping and prebuilt EDI connections to common applications are expected at the end of 2015, followed by a single interface for using both iPaaS and on-premises tools.
• Pricing and value. Customers view Adeptia's tools as attractively priced and as delivering good value, relative to the cost of tools from major competitors. Adeptia's recent standardization of subscription-based pricing aims to simplify procurement, based on tiered editions and feature sets.

Cautions

• Skills and market coverage. While Adeptia claims its products' ease of use and reduced dependence on skilled resources are differentiators, finding those skilled resources might prove challenging for organizations trying to implement and maintain deployments as their requirements grow.
• Learning experience. Some Adeptia customers indicate usage challenges when business-oriented users, rather than integration developers, are first learning to perform complex data integration activities. Generally, however, Adeptia's enabling of business-user-driven integration tasks and overall ease of use attract buyers to 'its Web-based product — and these are differentiating factors that the company continues to focus on.
• Big data support. Overall, Adeptia's implementations and competitive activities indicate limited traction in support of big data initiatives, which are increasingly emphasized in this market.

Cisco

Strengths

• Agility and rapid time-to-value. Cisco has a strong focus on data federation/virtualization, and a well-established track record for capitalizing on the growing demand in this area. Reference customers praise Cisco's data virtualization technology for enabling agile development, and using optimization techniques such as pushing processing down to data sources, which minimizes data movement and reduces time-to-value.
• Expanding product portfolio. Cisco continues to evolve its product portfolio by supporting the logical data warehouse (LDW), integrating streaming data and Internet of Things (IoT) environments, linking with Cisco Tidal Enterprise Scheduler for data integration workflows, and envisaging capability for data preparation. Cisco's expanding product portfolio supports the objective of enabling bimodal IT and digitalization, and of providing an enhanced analytics experience.
• Customer relationship and market access. Reference customers state that Cisco is extremely responsive to customer needs and that the quality of its customer support is good. Cisco's global reach continues to widen the availability of the data integration tools it acquired from Composite Software.

Cautions

• Breadth of coverage and market resonance. Organizations seeking providers with a comprehensive range of data delivery capabilities (beyond federated/virtualized styles) often find Cisco's product set to be narrow. Cisco's relatively small customer base in this market limits the availability of relevant skills, which at times poses a barrier to adoption. Cisco needs to increase its market resonance on the basis of its acquired offerings from Composite Software, as Cisco is not an incumbent vendor in the information management technology sector.
• Synergy with data management capabilities. Although Cisco is working to improve its metadata support, customers are still looking for a seamless way to integrate metadata across diverse data integration use cases. Customers are increasing their expectations for governance support and requiring integrated use of Cisco's data integration capability with comprehensive data quality tools.
• Deployment and diagnostic guidance. Reference customers identify diagnosis of error messages as challenging, and require better diagnostic support and integrated documentation. Customers also expressed a desire for a more mature user community, for improved access to implementation guidance and practices.

Denodo

Strengths

• Capitalization on demand. The Denodo Platform provides data virtualization, with an established basis in the enabling of data abstraction capabilities for joining multistructured data sources from DBMSs, websites, documents and a variety of repositories. Physical data movements are supported via the Denodo Scheduler component, which delivers data from repository to cache, or directly to another repository. Denodo capitalizes on the increasing traction and importance of data virtualization in the overall market for data integration tools.
• Track record and partner channels. With a recognized track record in data virtualization, Denodo has built a partner network of implementers and joint-marketing vendors, including IBM, Cloudera, Hortonworks, MicroStrategy, Tableau, SAP, MongoDB and Pivotal. A diverse range of software vendors license or bundle Denodo's functionality as part of their products in support of logical abstraction and agility for analytics, big data and operational use cases.
• Connectivity support and links to related integration capability. The Denodo Platform provides broad connectivity to relational databases, prerelational legacy data, flat files, XML, packaged applications and emergent data types including Hadoop and cloud-based data sources. The Denodo Platform can receive and publish data in a variety of formats and interfaces, including Java Database Connectivity (JDBC), Open Database Connectivity (ODBC), Java Message Service (JMS)-compliant message queues, REST and SOAP Web services, JavaScript Object Notation (JSON), XML, portlets and SharePoint Web parts. It can also support discovery and the use of data services.

Cautions

• Breadth of coverage. Organizations seeking providers with a breadth of data delivery styles may find Denodo's integrated platform to have limited versatility, relative to competitors with toolsets for diverse data delivery. Customers express a desire for easier administrative manageability and links to related tools for data governance support.
• Degree of metadata support. Reference customers identify Denodo's metadata management as an area of relative weakness when enabling reusability across a growing range of software tools and use cases. Customers increasingly look for comprehensive functionality and a vision for these requirements, to address the escalating number and variety of datasets and distributed data architectures.
• Availability of skills and best-practice documentation. Since Denodo has a relatively small customer base, customers express concerns about a lack of adequately skilled implementers in the market. Denodo has addressed this shortcoming with additional system integration partners and training. Reference customers express a desire for improvements in guidance on design architecture and documentation of best practices.

IBM

Strengths

• Depth and breadth of usage. IBM's data integration tools continue to be deployed for extensive use cases — often those of complex scale, spanning a wide range of projects and involving teams of various sizes.
• Mind share and capitalization on market demand. IBM continues to gain traction as an enterprise standard for data integration infrastructure, with a strong presence in competitive bids. The linkage of data integration capability with diverse analytics support, and the embedding of IBM DataWorks (for self-service data preparation) in Watson Analytics and in cloud-based data stores such as IBM dashBD, are increasing the synergy of IBM's data integration tools with its broader portfolio.
• Versatility in enabling information infrastructure and analytics. IBM continues to focus on enabling information infrastructure modernization in its efforts to align data integration with diverse demands for information capabilities (including data quality and governance, support for line-of-business users, big data, integration support in cloud adoptions and MDM). IBM's data integration focus is expanding applicable usage scenarios to business-facing roles by increasing self-service capabilities and deepening the synergies between information infrastructure and analytics use cases, to form integrated toolsets available on a common platform.

Cautions

• Product support and version upgrades. Customers reported difficulty with version upgrades and migrations. IBM has begun mitigating this through in-place upgrades, where downtime can be avoided, and will continue to mitigate it by converging the timing of various InfoSphere product releases, for better anticipation and alignment of upgrades.
• Pricing model. Reference customers identify software costs and perceived total cost of ownership (TCO) as barriers to broader adoption. IBM's provision of varied licensing approaches, such as core-, workgroup-, bundle-, subscription- and perpetual-based models, while intended to provide more procurement and pricing choices, has reportedly also confused customers assessing and selecting pricing models.
• Complexity of integrated use of portfolio. In general, customers expressed difficulty with integrated deployments of IBM's data integration tools alongside other IBM products, such as challenges associated with the integration of IBM InfoSphere DataStage with IBM BigInsights.

Informatica

Strengths

• Strength of data integration functionality and synergy with portfolio. Informatica's tools continue to reflect a diverse range of data integration styles, usage scenarios and multiproject deployments. Strong synergies between Informatica's data integration tools and other Informatica technologies encourage usage as an enterprise standard for a data integration infrastructure that links with data quality, MDM, big data, data security and cloud integration technologies. Informatica's emphasis on supporting digital services, the IoT, and related analytics and data security opportunities capitalizes on trends in demand.
• Broad presence and dedicated focus on, and innovation in, data management and integration. Informatica's mind share in this market is extensive, with the highest frequency of appearances in competitive situations. Informatica's concentration on enabling information capabilities aligns its application- and technology-agnostic offerings with a broad range of established and emerging information infrastructures. Informatica's v10 release, planned for late 2015, advances Informatica's metadata-rich capabilities with Live Data Map, to enable data-driven applications (such as Secure@Souce for tracking and protecting sensitive, private information and Project Sonoma for operationalizing self-service capability).
• Alignment with evolving trends and business-facing demand. The linking of Informatica's data integration offerings to its self-service data preparation tool facilitates a Microsoft Excel-like interface through which end users can build ETL-type tasks that can be deployed on Informatica Platform. Strong adoption of Informatica's iPaaS aligns well with the growing movement of data integration architectures toward cloud-based and hybrid delivery models. Informatica's v10 release is expected to feature new capabilities that support any type of user, data and mode of deployment.

Cautions

• Business evolution. The announced acquisition of Informatica generated some uncertainty among prospective and existing customers about the possibility of an impending strategy that could affect Informatica's roadmap and status as a thought-leader. Informatica has told its customers and partners that its commitment to delivering on its roadmap remains unchanged.
• Cost model. Prospective customers point to difficulty understanding Informatica's licensing and pricing methods. Existing customers often express concerns about high costs relative to alternatives in this market. Informatica has begun to address some of these concerns by introducing simpler product packaging and pricing, by consolidating multiple add-on products.
• Clarity of product messaging and portfolio architecture. Informatica's portfolio has grown large, and customers often express confusion about overlapping products and functionality. They want more intuitive ways to understand and navigate the offerings that Informatica's data integration tools work with. They also want guidance on how to add new products to existing Informatica deployments, and easier integrated usage of components.

Information Builders

Strengths

• Robust functionality and broad usage. Information Builders' data integration tools support a diverse and balanced set of use cases, for which the core functionality remains robust and reliable. The vendor's capabilities in adapters and connectivity, comprehensive data transformation and encapsulating data into real-time message flows are regarded as key strengths in deployments.
• Synergy of data integration tools with enterprise information capabilities: Information Builders continues to focus on evolving an integrated environment for data integration capability that can operate with enterprise service bus and master data management functions. This aligns well with demand for support of data integration activities, so that competency teams can seamlessly implement integration, process management, data governance and analytics in a synergistic way.
• Customer relationship. Reference customers report a positive overall experience with Information Builders, both before buying and after implementation. Selection of this vendor's data integration tools is often influenced by an existing relationship and use of other Information Builders products.

Cautions

• Mind share with business leaders and influencers. Information Builders appeals mainly to technical communities and IT buyers, but it has relatively low mind share with business management and process leaders, who increasingly influence the adoption of information capabilities. This creates a market visibility challenge at a time when major competitors are engaging more with those roles.
• Adoption scale and learning experience: Implementations of Information Builders' products by enterprises show an increase in departmental-level and narrower deployments. Many customers identify challenges with product complexity, a long learning curve and limited availability of skilled practitioners.
• Product documentation and time-to-value. Reference customers have stated they want to see more improvements to Information Builders' documentation of products and best practices. Customers seek more extensive documentation of technical components to enable consistency of developer practices and faster time-to-value in implementations.

Microsoft

Strengths

• Relevant capabilities and TCO. Reference customers cite overall low TCO, speed of implementation, ease of use, and the ability to integrate with other Microsoft SQL Server capabilities as the main reasons for choosing SSIS over alternatives.
• Alignment with data management and process- and user-oriented integration: SSIS supports connectivity to diverse data types and broad deployment in Microsoft-centric environments. SSIS is often used to put data into SQL Server to enable analytics, data management and end-user data manipulation using Microsoft Office tools, particularly Excel. Using SSIS in conjunction with Microsoft's BizTalk and Azure Data Factory platforms enables delivery of data from business workflows in enterprise applications for user-configured integration flows.
• Widespread tool presence and usage experience. Broad familiarity with the implementation of Microsoft technologies spurs usage of SSIS. Wide choices in terms of community collaboration, training, and third-party documentation and guidance for deployment practices are reported as key points of value.

Cautions

• Integration of portfolio. Reference customers cite difficulties with integrated implementation of Microsoft's offerings across its portfolio as they address the growing scale and complexity of deployment scenarios for data integration activities.
• Platform support. The inability to deploy data integration workloads on non-Windows environments is a limitation for customers wishing to draw on the processing power of diverse hardware and operating system platforms.
• Linkage to deployments of information infrastructure. Reference customers cited a desire for more extensive big data support when manipulating and delivering data of interest, and for more guidance to enable data quality and governance in relation to data integration activities. These challenges relate to the growing complexity of, and demand for, information capabilities. Microsoft is progressively enhancing its big data support with links to machine learning and streaming analytics, and envisaging capabilities for data hub enablement.

Oracle

Strengths

• Broad usage and applicability. Oracle's data integration tool deployments reflect a mix of use cases and balanced market traction for ELT capabilities and real-time-oriented CDC and replication support. Oracle has extended its big data support to enable ingestion of streaming data by ODI workflows that can be deployed in Apache Spark and Pig environments. To capitalize further on big data and streaming integration scenarios, Oracle is expanding its product development competencies to focus on machine learning in modeling and design processes.
• Synergies with portfolio's broad range of technologies. Recognition of Oracle's diverse portfolio for addressing data integration and other data and application-oriented requirements (spanning data quality tools, MDM solutions, ESB, analytic appliances and enterprise applications) continues to fuel its appeal in deployment scenarios.
• Brand awareness and market presence. Oracle's size and global coverage of applications and analytics solutions enables it to draw on a huge customer base and a wide product distribution model for positioning data integration tools. Broad usage of Oracle's technologies within its customer base has driven wide availability of community support, training and third-party documentation on implementation practices and approaches to problem resolution.

Cautions

• Functional fulfillment. Although perceptions of Oracle's evolution of its data integration tools are generally positive, product-related customer satisfaction has declined in relation to developers' productivity with newer versions, overall ease of use and time-to-value. Customers want easier deployment of source and target changes, simpler monitoring across platforms, and more control over concurrency and queues.
• Customer experience. Customers point to challenges in terms of version upgrades, bugs in new releases, responsiveness and the quality of product support. Customers of Oracle's data integration tools identify challenges with the processes for obtaining product support, especially in urgent cases.
• Pricing. Concerns about prices, target and source-based licensing requirements, and perceived hardware-oriented cost challenges as deployments broaden have generated dissatisfaction among customers.

SAP

Strengths

• Broad usage and functionality. The breadth of functionality available across SAP's portfolio supports a diverse mix of data integration styles and use cases of increasing complexity. Usage supports synergistic deployments with SAP's broad application and information infrastructure offerings. Newly released SAP Hana EIM capabilities in SAP Hana Smart Data Integration and SAP Hana Smart Data Quality include built-in data integration adapters, as well a software development kit, which enhances the construction of data access and integration flows of variable latency involving on-premises and cloud-based data, in-memory data stores, Apache Spark and NoSQL environments.
• Alignment with business-facing demand. Drawing on the linkage of data integration with information stewardship, alongside delivery of self-service data preparation functionality, SAP is making collaboration easier between business users and data integration practitioners. The launch of SAP Agile Data Preparation, with its user-facing functionality, enables business roles to access data sources, perform data transformations, and model datasets of interest in support of business scenarios.
• Market presence and links to related disciplines. Capitalizing on its brand recognition, global reach and vast customer base in related disciplines, SAP maintains a high share of the market's data integration tool adoption. Enterprises with an incumbent portfolio of SAP products naturally look to the same vendor to provide their data integration technology.

Cautions

• Roadmap alignment and market messaging. There are concerns among customers about roadmaps, where the capabilities of SAP's agnostic data integration tools and native Hana products appear to overlap. Concerns about SAP's offerings becoming tightly linked to Hana have given rise to a perception that SAP is placing less emphasis on addressing the needs of non-SAP environments (for timely releases of heterogeneous data connectivity, for example). However, recent product releases and published roadmaps from SAP show continued development of heterogeneous features in its agnostic data integration tools.
• Support for metadata. Although SAP offers extensive metadata and modeling functionality for data integration activities through SAP PowerDesigner, some reference customers are unaware of these capabilities and require help to address the growing scale and diversity of data integration scenarios that are making metadata management and modeling more complex in information infrastructure environments.
• Customer support, service experience and skills. Reference customers' feedback indicates concerns about the overall customer experience. They want better guidance and support for best practices to ease the learning curve, wider availability of high-quality professional services, and shorter time-to-value for deployments.

SAS

Strengths

• Broad and integrated portfolio. The breadth and completeness of core functions and the integration of components position SAS to compete with larger and more established vendors in the data integration market. SAS's newly introduced Data Loader for Hadoop provides a guided user interface to facilitate data loading and data preparation (profiling, cleansing and transforming data), one that capitalizes on demand in the market.
• Customer relationship. Reference customers report that their relationship with SAS, both before purchasing and after implementation, is exceptional. This contributes to longer-term, recurring engagements.
• Product reliability and stability. Reference customers praised SAS's products for stability, reliability, robustness and effectiveness. These qualities, along with synergistic capabilities across portfolio, establish SAS's data integration technology as dependable and mature.

Cautions

• Cost and usage. Reference customers expressed concerns about high prices and a licensing model that they perceive as limiting their ability to expand deployments. SAS's data integration tool exhibits a dominant emphasis on analytics scenarios, which reflects narrower versatility compared with leading competitors in this market.
• Availability of deployment skills. Reference customers expressed a desire for greater availability of resources who possess a deep knowledge of SAS tools outside its own professional services business, to give them wider procurement and cost options.
• Metadata support and ease of deployment. Some reference customers indicate requirements for more extensive metadata support when using SAS tools for data integration. However, recent enhancements provide capabilities that some customers may not have taken advantage of; these include discovering, integrating and facilitating the reuse of metadata both within and external to SAS technologies. Customers identify difficulties, and display reduced satisfaction, with tool setup and product version upgrades and migrations.

Syncsort

Strengths

• Performance of core functionality and time-to-value. Syncsort continues to provide high-performance bulk/batch data movement capabilities with faster time-to-value than many competitors. These strengths continue to fulfill requirements for targeted functionality and superior performance and throughput.
• Capitalization on big data initiatives. Syncsort is widening its data integration focus to work with diverse parts of the Hadoop ecosystem, interact with streaming data, and support external parallelized processing in offloading heavy legacy-infrastructure-related ETL or ELT workloads from data warehouses and mainframes to Hadoop. Using its "Intelligent Execution" framework, Syncsort sets out to insulate users from the underlying complexities of Hadoop, enable flexible deployment to diverse platforms, and support on-premises or cloud-based deployments.
• Customer relationship and track record. Syncsort offers a high quality of service and support, and many customers identify its technical support and their overall relationship with Syncsort as positives. With an established track record of optimizing ETL processing, a loyal customer base and strategic partners (including Amazon, Cloudera, Cognizant, Dell, Fujitsu, Hortonworks, MapR, Qlik, Splunk, Tableau and Waterline Data), Syncsort has a solid foundation on which to grow its market presence.

Cautions

• Functional coverage and usage. Implementations of Syncsort's capabilities predominantly center on bulk/batch data movement, which poses challenges in competitive situations that require a broad range of data integration styles. However, links between Syncsort's tools and Apache Kafka and Storm are starting to support message-oriented data delivery.
• Support for metadata and data quality. While Syncsort is making efforts to extend its metadata capabilities, such as by using Apache HCatalog, reference customers cite metadata management as an area requiring improvements in terms of the discovery of metadata in broad context, ease of access, and reuse in data integration processes. Customers express a desire for linkages to data quality capabilities in synergy with data integration tool usage.
• Availability of skills and evolving cost model. There is a growing desire for greater availability of resources with a deep knowledge of Syncsort's tools to facilitate wider access to skills and more cost options. Cost-sensitivity is beginning to surface in broadening deployments.

Talend

Strengths

• Portfolio relevance and cost model. Reference customers appreciate the solid performance of Talend's functionality, its support of diverse use cases, and the lower TCO of Talend's technology, relative to competitors. Talend's free open-source offering and affordable developer-based pricing for fully featured software appeal to customers and frequently attract usage for augmenting data integration capabilities.
• Commitment to big data and evolving trends. Talend continues to benefit from an early commitment to big data and Hadoop, with new customer adoption and technology advancements such as in-memory processing (with Apache Spark) and the enabling of real-time scenarios. Momentum to support big data, combined with a new iPaaS offering and plans for self-service data preparation capability (using data virtualization and iPaaS) in 1Q16, position Talend to expand its market reach.
• Adaptable capabilities in a unified product set. Talend's portfolio, including data quality, MDM, business process management, an ESB, and a recently added metadata management tool, sets out to deepen synergies across information- and application infrastructure-related use cases. Customers value the configurability of Talend's tools, which makes them flexible enough to adapt to the business requirements of data integration processes and the availability of artifacts built by Talend's practitioner community.

Cautions

• Breadth of experience with all data delivery styles and resourcing. While Talend's capabilities resonate well in bulk/batch-oriented data delivery needs, the company needs to increase awareness of its support for other data integration styles. Perceived limitations in terms of access to skilled resources, integration with incumbent technical environments and standards, and enterprisewide deployments were expressed by prospective customers.
• Implementation guidance and time-to-value. Increased adoption of Talend's offerings is generating dissatisfaction with regard to the availability of usage references and best-practice implementation guidance. Deployments exhibit a long time-to-value, compared with major alternatives in this market. Customers desire improvements in technical support and documentation to ease version upgrades and migrations, tool usage, monitoring and administration. Talend is making significant investments in this area.
• Product and market messaging. Some existing and prospective customers, particularly organizations considering putting Talend's portfolio to enterprisewide use, indicate that Talend does not adequately articulate the more evolved capabilities of its products or their synergistic uses.

Vendors Added and Dropped

Added

• Denodo.

Dropped

• None, but Cisco (Composite Software) now appears as Cisco.

• Range of connectivity/adapter support (sources and targets) — Native access to relational DBMS products, plus access to nonrelational legacy data structures, flat files, XML and message queues
• Mode of connectivity/adapter support (against a range of sources and targets) — Bulk/batch and CDC
• Data delivery modes support — At least two modes among bulk/batch data movement, federated/virtualized views, message-oriented delivery, and data replication and synchronization
• Data transformation support — At a minimum, packaged capabilities for basic transformations (such as data type conversions, string manipulations and calculations)
• Metadata and data modeling support — Automated metadata discovery, lineage and impact analysis reporting, ability to synchronize metadata across multiple instances of the tool, and an open metadata repository, including mechanisms for bidirectional sharing of metadata with other tools
• Design and development support — Graphical design/development environment and team development capabilities (such as version control and collaboration)
• Data governance support — Ability to interoperate at a metadata level with data profiling and/or data quality tools
• Runtime platform support — Windows, Unix or Linux operating systems
• Service enablement — Ability to deploy functionality as services conforming to SOA principles

• They must generate at least $20 million of their annual software revenue from data integration tools, or maintain at least 300 maintenance-paying customers for their data integration tools.
• They must support data integration tool customers in at least two of the major geographic regions (North America, Latin America, Europe, the Middle East and Africa, and Asia/Pacific).

Ability to Execute

• Product/Service. How well the vendor supports the range of distinguishing data integration functionalities required by the market, the manner (architecture) in which this functionality is delivered, support for established and emerging deployment models, and the overall usability and consumption of the tools. Product capabilities are critical to the success of data integration tool deployments and, therefore, receive a high weighting.
• Overall Viability. The magnitude of the vendor's financial resources and the continuity of its people and technology, which affect the practical success of the business unit or organization in generating business results.
• Sales Execution/Pricing. The effectiveness of the vendor's pricing model in light of current customer demand trends and spending patterns, and the effectiveness of its direct and indirect sales channels. This criterion is weighted high to reflect the major emphasis of buyers on cost models and ROI, and the criticality of consistent sales execution in order to drive a vendor's growth and customer retention.
• Market Responsiveness/Record. The degree to which the vendor has demonstrated the ability to respond successfully to market demand for data integration capabilities over an extended period, and how well the vendor has acted on the vision of prior years.
• Marketing Execution. The overall effectiveness of the vendor's marketing efforts, which impacts its mind share, market share and account penetration. The ability of the vendor to adapt to changing demands in the market by aligning its product message with new trends and end-user interests.
• Customer Experience. The level of satisfaction expressed by customers with the vendor's product support and professional services; their overall relationship with the vendor; and their perceptions of the value of the vendor's data integration tools relative to costs and expectations. This criterion retains a weighting of "high" to reflect buyers' scrutiny of these considerations as they seek to derive optimal value from their investments. Analysis and rating of vendors against this criterion are driven directly by the results of a customer survey executed as part of the Magic Quadrant process.

Completeness of Vision

• Market Understanding. The degree to which the vendor leads the market in recognizing opportunities represented by trends and new directions (technology, product, services or otherwise), and its ability to adapt to significant market inertia and disruption, including the degree to which the vendor is aligned with the significant trend for synergy with data management and application integration technologies. Given the dynamic nature of this market, this item receives a weighting of "high."
• Marketing Strategy. The degree to which the vendor's marketing approach aligns with and/or exploits emerging trends and the overall direction of the market.
• Sales Strategy. The alignment of the vendor's sales model with the ways in which customers' preferred buying approaches will evolve over time.
• Offering (Product) Strategy. The degree to which the vendor's product roadmap reflects demand trends in the market, fills current gaps or weaknesses, and includes developments that create competitive differentiation and increased value for customers. In addition, given the requirement for data integration tools to support diverse environments for data, delivery models, and platform mix, we assess vendors on the degree of openness of their technology and product strategy. Given the intense evolution of both technology and deployment models in this market, this criterion receives a weighting of "high."
• Business Model. The overall approach the vendor takes to execute its strategy for the data integration tool market, including diversity of delivery models, packaging and pricing options, and partnership.
• Vertical/Industry Strategy. The degree of emphasis the vendor places on vertical solutions, and the vendor's depth of vertical-market expertise.
• Innovation. The degree to which the vendor demonstrates creative energy by enhancing its practices and product capabilities, as well as introducing thought-leading and differentiating ideas and product plans that have the potential to significantly extend or reshape the market in a way that adds real value for customers. Given the pace of expansion of data integration requirements and the highly competitive nature of the market, this criterion receives a weighting of "high."
• Geographic Strategy. The vendor's strategy for expanding its reach into markets beyond its home region/country, and its approach to achieving a global presence (for example, its direct local presence and use of resellers and distributors).

Quadrant Descriptions

Leaders

Challengers

Visionaries

Niche Players

• Growing interest in business moments and recognition of the required speed of digital business. In the context of digital business, "business moments"— opportunities of short duration or a point in time that sets in motion a series of events involving people, business and things — are increasingly attracting the attention of enterprises. They want to harness data to seize these moments, which will require data integration support. Data integration functionality provided in a "sandbox" to support analytics is of growing interest; this approach enables data to be delivered and manipulated in a physical or virtual manner, for ingestion regardless of where it resides; it also encourages experimentation with, and the building of, new models with which to use data of interest. As pressures for real-time data integration grow, organizations will need to manage a range of data latencies to make data available for use within acceptable service levels and to match the required speed of business.
• Intensifying pressure for enterprises to modernize and enlarge their data integration strategy. Data integration architecture that predominantly uses a single style and form — for example, batch-oriented, bulk data extract and delivery (accomplished via ETL techniques) — falls short in enterprises that face overwhelming pressure to support real-time operations and those that require flexible latencies. Data integration tool deployments are emphasizing the need to support multiple modes of data delivery, including traditional batch/bulk-oriented data movement, creation of in-memory federated views of data, and low-latency capture and propagation of events and changed data. Organizations are increasingly driven to position data integration as a strategic discipline at the heart of their information infrastructure — to ensure it is equipped for comprehensive data capture and delivery, linked to metadata management and data governance support, and applicable to diverse use cases. In addition, implementations need to support multiple types of user experience via tool interfaces that appeal not only to technical practitioners but also to people in business-facing roles, such as business analysts and end users. Offerings that promote collaboration between business and IT participants are becoming important as organizations seek adaptive approaches to achieving data integration capabilities.
• Requirements to balance cost-effectiveness, incremental functionality, time-to-value and growing interest in self-service. Organizations' continued scrutiny of their investments and optimization of costs is resulting in aggressive behavior on the part of buyers when negotiating prices with vendors. More organizations are looking for solid basic capabilities that are "good enough," that can be deployed rapidly and that are offered at attractive prices. Some buyers, furthermore, are taking a targeted approach by acquiring only what they need now, while planning for future data integration needs — they don't procure all the capabilities they want at once. Nor are buyers necessarily looking for a single product or a single vendor-specific platform to accomplish everything. Vendors have responded to this development in various ways, such as by varying their pricing structures and deployment options (open-source, cloud and hybrid models), and extending support for end-user functions so that they work with targeted data of interest, especially when requirements aren't well-defined. Demand from business-facing buyers is also prompting vendors to add functionality that supports self-service data integration.
• Expectations for high-quality customer support and services. Faced with a need to optimize staffing and budgets, as well as mounting pressure for faster and higher-quality delivery of solutions, buyers are demanding superior customer service and support from technology providers. In addition to highly responsive and high-quality technical support for products, they want direct and frequent interactions with sales teams and executives. Buyers also want wide availability of relevant skills — both within a provider's installed base and among system integrator partners — and forums where they can share experiences, lessons and solutions with their peers.
• Increasing traction of extensive use cases. Usage of data integration tools continues to expand beyond analytics-related scenarios, as many others are now also driving demand. The need to support operational data consistency, data migration and cloud-related integration is prompting more data integration initiatives than before. The architectural approach of the LDW optimizes the repository styles that employ data federation/virtualization capabilities to enable data services and assimilate data involving a variety of integrated datasets. Big-data-related initiatives require the use of opportunistic analytics and the exploration of answers to less-well-formed or unexpected business questions. The distribution of required computing workloads to parallelized processes in Hadoop and alternative NoSQL repositories will continue to advance the ability of data integration tools to interact with big data sources and to deliver data to, and execute integration tasks in, platforms associated with big data environments.
• Extension of integration architectures through a combination of cloud and on-premises deployments. A hybrid approach to data integration is growing in popularity because it provides the ability to execute data integration in both cloud and on-premises environments, as appropriate. It enables enterprises to interchange, reuse and deploy artifacts as needed across both environments. Adoption of this approach is increasing in the wake of the "cloud first" focus of some digital business strategies, which emphasizes the use of "lightweight" technologies that are user-oriented and adaptable to change. Customers are looking to gain business agility by, for example, using iPaaS as an extension of their data integration infrastructure to manage cloud-related data delivery and address the growing need for data sharing in cloud scenarios.
• Need for alignment with application and information infrastructure. More organizations are selecting data integration tools that provide tight links to data quality tools, to support critical information management and governance initiatives. As MDM programs increase in number and scope, so organizations seek to apply their investments in data integration technology to those initiatives, to enable the movement, transformation and federation of master data. In addition, many organizations are beginning to pursue data integration and application integration in a synergistic way, to exploit the intersection of the two disciplines. Aligned application integration and data integration infrastructure, deployed for the full spectrum of customer-facing interactions and a broad range of operational flows, gradually optimizes costs and shared competencies, as compared with the pursuit of disparate approaches to similar or common use cases (see "Five Reasons to Begin Converging Application and Data Integration"). The expansion of vendors' capabilities into application integration provides opportunities to use tools that exploit common areas of both technologies to deliver shared benefits, such as use of CDC tooling that publishes captured changes into message queues.

• Improve the response times as experienced by users of business-critical applications over WAN links or mobile connections, often addressing application performance problems caused by bandwidth constraints, latency or protocol limitations.
• Assist in maximizing the ROI for WAN bandwidth, and delay costly bandwidth upgrades.
• Optimize data-center-to-data-center (DC-to-DC) traffic for faster replication and synchronization.

• Generic protocol- and application-protocol specific optimization to minimize the effects of network latency
• Compression, deduplication or content caching to reduce the bandwidth required to transfer WAN traffic, as well as to improve user access times
• Traffic identification, prioritization, policing and shaping to ensure acceptable access for mission-critical applications during periods of high traffic load
• Traffic monitoring and reporting to aid in troubleshooting and network planning
• WAN path control, WAN virtualization or link load balancing to control traffic forwarding across multiple networks, such as Internet and Multiprotocol Label Switching Transport Profile (MPLS-TP) for resilience and to optimize utilization
• Direct Internet access via the ability to forward traffic to public cloud services, while still controlling traffic forwarding to privately deployed applications

Vendor Strengths and Cautions

Array Networks

Strengths

• Array Networks offers a full range of physical and virtual appliances with good performance and features at prices that are typically lower than those of the leading WAN optimization vendors.
• The aCelera Virtual Appliance is available on VMware ESX/ESXi, Microsoft Hyper-V, Citrix XenServer and Windows Server 2008 R2, and as a small-footprint mobile client for Windows XP and Windows 7.
• Array offers up to 100GB local cache storage in its branch office device as well as a centrally located networkwide image of all caching, thus improving the scalability of its solution.
• Array Networks provides a storage backup/replication solution that supports a broad range of storage vendors, including Dell EqualLogic and Compellent, EMC, and NetApp, and bundles with Hitachi Data Systems for a strong solution targeted at the Indian market.

Cautions

• Array Networks' distribution is limited outside India, China, Japan and North America, although it is expanding. In addition, Gartner inquiries show enterprise awareness of Array Networks remains limited.
• Array lacks specific application protocol optimization, User Datagram Protocol (UDP), video content and asymmetric Web browser optimization.
• Visibility and reporting, although improved, are not yet on par with leading vendors.
• Array does not offer WAN path control, local link load balancing capabilities or direct Internet access.

Aryaka

Strengths

• Aryaka offers a simplified deployment model that eliminates the need for on-premises WAN optimization appliances and replaces its customers' capital expense with an ongoing monthly fee.
• For locations in which local loop performance is unacceptable, Aryaka provides an on-premises appliance.
• The network-based solution offers broad and well-rounded service capabilities, such as WAN optimization, visibility and custom reporting, CDN, remote access with IPsec termination, and Internet access.
• The Aryaka model delivers good network-level performance and visibility, but is not on par with leading vendors.

Cautions

• Compared with managed WAN services that include WAN optimization, Aryaka can be often as much as 30% more expensive when all additional costs are included, such as access services and WAN routers. Aryaka does not provide specific application optimization features or dedicated data-center-to-data-center storage replication that compares to that of leading vendors in this report, although it supports standard network-based optimization.
• Enterprises must ensure that their branch offices have low-latency (25 milliseconds [ms] or less) connectivity to an Aryaka POP in order to get the best application performance, although Aryaka continues to roll out more POPs.
• The Aryaka on-site appliance has limited functional capabilities and does not support WAN path control functions, although it supports basic optimization, link bonding, failover and limited visibility.

Blue Coat Systems

Strengths

• Blue Coat provides a strong feature set for cloud-based applications via its local link load balancing and direct-to-Internet capabilities combined with its cloud-based SWG service and asymmetric caching.
• The company's portfolio provides one of the industry's broadest ranges of WAN optimization techniques, especially for video (where it supports stream splitting and caching of many streaming protocols, although these features are spread across multiple platforms).
• Blue Coat PacketShaper offers some of the most detailed application traffic visibility and traffic control solutions of any optimization vendor, and via integration with WebPulse (Blue Coat's Web intelligence cloud service), PacketShaper also provides granular visibility and control of Web content and URL categorization.
• Blue Coat has a good vision around integration of WAN optimization, security and cloud-based applications.

Cautions

• Blue Coat's marketing is dominated by security, which, together with its multiple WAN optimization product lines, leads to market confusion around the company's commitment and focus on WAN optimization. This has also led to a decline in 2013 to 2014 WOC revenue.
• Feature support of the mobile client — Blue Coat ProxyClient — is still limited.
• Blue Coat's MACH5 has limited support for application-protocol-specific optimization and no specific storage protocol optimization, making it less suitable for DC-to-DC storage replication than competitors.
• Blue Coat does not support any WAN path control features or IPsec VPN capability, although it does support link load balancing for Internet traffic.

Circadence

Strengths

• Circadence has one of the strongest SoftWOCs on the market, with support for a wide variety of optimizations across a wide range of OSs.
• Circadence continues to innovate on the mobility front, particularly with enhanced congestion control, dynamic network recognition (circuit versus packet) and Wi-Fi/cellular handoff.
• Circadence Link Resilience maintains application session persistence for unreliable wireless connectivity — that is, when connectivity is re-established, the session picks up where it left off.
• Circadence has shown scalability in very large deployments.

Cautions

• Circadence lacks data-center-to-data-center-specific capabilities, although it now supports higher-bandwidth connections on its physical and virtual appliances.
• Circadence has limited dedicated video optimization and application-specific acceleration capabilities.
• Circadence has limited support of visibility and reporting and does not support as extensive traffic discovery and traffic control capabilities as leading vendors.
• The company has limited brand awareness in the general market, especially outside of the U.S., although efforts are underway to improve this situation. Enterprises should verify local support capabilities outside of the U.S.

Cisco

Strengths

• Cisco's broad WAN product portfolio, addition of embedded Akamai Web caching, aggressive pricing and global distribution make WAAS a compelling option for Cisco-oriented network teams.
• Cisco provides a strong advanced service arm to design and implement WOC optimization services.
• Enterprises with a preference for Cisco solutions will appreciate the ability to deploy the full solution set on one physical platform via the ISR-AX bundle, especially since it is often licensed at extremely competitive prices.
• Cisco's broader IWAN offering provides support for cloud-based applications via Performance Routing version 3 (PfRv3), local forwarding selection and direct-to-Internet capabilities, combined with Cisco Cloud Web Security (CWS).

Cautions

• Cisco WAAS does not support application-protocol-specific optimization beyond common capabilities such as Server Message Block (SMB), Exchange, Citrix ICA or SharePoint.
• The Cisco WAAS appliance does not natively support any application discovery or visibility and reporting capabilities. These capabilities remain supported only via AX bundling on the ISR router. For AVC reporting, Flexible NetFlow data needs to be exported to Cisco Prime or to third-party systems such as LiveAction, CA, InfoVista or Plixer International.
• Cisco's WAAS Mobile product is an independent product, although integration into its AnyConnect VPN client is under development.
• Data-center-to-data-center optimization does not support storage-protocol-specific optimization; however, WAAS storage has been increased, and WAAS can scale to 10 Gbps of optimized throughput by pooling WAAS resources using AppNav.

Citrix

Strengths

• Citrix supports broad WAN optimization capabilities, as well as good application classification and traffic control capabilities.
• Citrix has a strong cloud-focused offering with support of Layer 2 bridging, especially with cloud bridging work with Amazon.
• Citrix has a strong offering for session-based ICA acceleration, hosted virtual desktop (HVD) application visibility.
• Citrix offers one of the best video optimization solutions of the evaluated vendors, including video stream splitting, video caching of multiple formats, content prepositioning into cache and playback format optimized to the capabilities of the device.

Cautions

• Citrix's direct and indirect sales force is not always focused on the WAN optimization products.
• The offering for data-center-to-data-center storage replications is more limited than leading competitors' offerings, but it does support Layer 2 bridging and specific optimizations for NetApp and Hitachi Data Systems storage.
• Citrix has no carrier partner for managed services; however, Citrix WAN optimization is available as part of NTT's network-based service, and it also partners with Inmarsat.
• Citrix's visibility and reporting is not on par with leading vendors, although enhancements are planned for 2Q15.

Exinda

Strengths

• Exinda offers one of the industry's strongest and most detailed application traffic visibility and traffic control solutions. It is able to link user identity (via Active Directory integration) to application identification and policy, allowing personalized acceleration and content access decisions, as well as user-based application reporting.
• Exinda offers enhanced reporting with customized and purpose-built reporting capabilities, with a traffic pattern and trend analysis function for real-time policy and configuration adjustment recommendations.
• Exinda provides video bandwidth optimization capabilities in the form of video stream splitting and extensive local caching support for both HTTPS and video, with a specific focus on YouTube and Vimeo.
• Exinda has strong relationships with both network service providers and a growing number of cloud providers, providing additional sourcing options for its products.

Cautions

• Although Exinda supports a 10 Gbps interface, it does not support solid-state drive (SSD)-based storage, and it does not support storage protocol optimization, making it less suitable than segment-leading vendors for DC-to-DC storage replication with fast connectivity. Exinda's WAN Memory provides reasonable reduction for replication solutions such as NetApp's SnapMirror in moderate bandwidth scenarios.
• Exinda does not offer WAN path control functionality, local link load balancing or IP VPN for direct Internet access.
• Exinda's cloud solution is not as evolved as leading providers' solutions, and it needs enhancements, such as tunnel support for cloud-based deployments.
• Exinda is a relatively small company by both revenue and market share, and enterprises should ensure they have adequate local support from Exinda and an experienced local channel that can also provide service.

FatPipe Networks

Strengths

• FatPipe is one of the leading vendors for WAN link load balancing and has very good WAN path control capabilities.
• FatPipe supports comprehensive application identification, classification and control capabilities.
• FatPipe offers detailed network visibility and reporting capabilities.
• The FatPipe solution is relatively simple to operate because all functions are integrated onto one platform and managed with a single high-level user interface.

Cautions

• Although they do support all of the most common features, FatPipe's WAN optimization features are more limited than those of the leading providers — for example, no MAPI, no storage-protocol-specific optimization, limited video streaming optimization and no application-protocol-specific optimization.
• FatPipe neither supports video delivery optimization nor provides a soft client.
• FatPipe's support for cloud services is more basic than that of leading providers, lacking in features such as asymmetric optimization.
• FatPipe has relatively small numbers of sales and support worldwide, but is currently expanding and is planning to have close to 200 sales and support staff by mid-2015. However, it partners with around 200 resellers internationally and 700 in U.S.

Ipanema Technologies

Strengths

• Ipanema supports a unique policy-driven solution based on application performance, SLA configuration and enforcement, integrating application visibility and reporting, dynamic per-flow or per-packet control, WAN path selection, direct access to Internet and WAN optimization in a single, centrally managed system.
• Ipanema products are available as managed services from many leading network service providers, such as BT and Orange Business Services, and for direct enterprise purchase via system integrators.
• Ipanema has introduced application traffic classification and control for all types of unified communications and collaboration (UCC) flows (signaling, chat and presence, screen and document sharing, voice, and video) for several vendors, including Microsoft Lync and Polycom.
• The Salsa management platform has proven scalability and robustness in very large single-tenant and multitenant managed service deployments.

Cautions

• The product does not yet support stream splitting for live video or caching/streaming for video on demand.
• Ipanema does not support application-protocol-specific optimization, except for UCC and CIFS traffic.
• Ipanema's two entry-level branch office devices, nano|2 and nano|5, are targeted at visibility, traffic control and WAN path selection, and they do not support WAN optimization functionality.
• Ipanema currently has no support for IPsec tunneling to secure paths and direct to Internet for cloud services connectivity, although this is planned for 3Q15.
• Ipanema's sales and support coverage of the U.S. market is weaker than that of leading vendors in this report; however, it will double its head count in the U.S. during 2015.

NTT Communications

Strengths

• NTT offers a fully managed end-to-end WAN service with in-the-cloud services, as well as an on-premises managed service. The on-premises service includes dedicated appliances and virtual appliances that run on standard servers or virtual machines or are integrated into routers.
• Enterprises have a choice of several WAN optimization vendors integrated on the NTT platform for both cloud-based optimization and managed services.
• The NTT's Cloud Software Defined Networking (SDN) orchestration platform has been integrated with the Universal One portal. This enables enterprises to create and instantly activate new functions — such as firewall, intrusion prevention, URL filtering, IPsec gateway and WAN optimization — for a specific branch office.
• The cloud-based service is fully on-demand with no long-term contracts and a flexible pricing with hourly, weekly or monthly price options available.

Cautions

• In order to get best application performance optimization, enterprises must ensure that their branch offices have low latency (25 ms or less) connectivity to the nearest NTT POP or consider using NTT's customer premises equipment (CPE)-based service offering.
• NTT partners with WOC vendors for significant parts of its road map and product development.
• The NTT Universal One portal reporting function is not as granular or application-specific as those of leading vendors.
• In order to use NTT's in-the-cloud services, such as WAN optimization as a service, enterprises must also subscribe to NTT's managed WAN services.

Riverbed

Strengths

• Riverbed offers the broadest set of capabilities in the industry, including features for large branch office networks, data center replication and storage networking protocols, and single remote users.
• Riverbed's SteelFusion appliance offers unique capabilities, allowing applications to remain distributed while storage is centralized.
• The combination of SteelHead and SteelCentral AppResponse provides very good visibility and reporting capabilities for drill-down reporting across networks, servers, applications, Web apps, pages, objects, sites and users (including end-user experience).
• The new Secure Transport feature supports an IPsec-encrypted overlay mesh network, and a partnership with Zscaler provides the ability to scan optimized traffic for security purposes before going to the cloud.

Cautions

• Riverbed's price can be significantly higher than its leading competitors, and although it does respond when competitively challenged, its discount policies can be inflexible and inconsistent.
• Riverbed's portfolio has become extensive, with six product ranges and multiple products within each range, which can make it difficult to understand how to meet functional needs in a cost-efficient manner.
• Riverbed has been slow to embrace hybrid WANs, and its WAN path selection capabilities are rudimentary; they lack link quality assessment and performance-based forwarding capabilities, although these capabilities are planned for 4Q15.
• Gartner clients have reported that the solution can be difficult to manage in complex application environments, which can lead to misconfiguration and degraded application performance. However, Riverbed is adding autoconfiguration capabilities, and support is generally very responsive and highly rated by Gartner clients.

Sangfor

Strengths

• Sangfor WANO supports a broad range of commonly used WAN optimization features.
• The Sangfor WANO supports local Web and file caching, firewall functionality, good application and URL classification and control, IP VPN termination, and link load balancing, making it an ideal "all in one box" solution for branch offices that use direct Internet access, particularly connecting to cloud services.
• Sangfor is a strong and well-established vendor in the Chinese market.

Cautions

• There is limited application-protocol-specific optimization, and there is no support for dedicated video caching or video stream splitting.
• Only a small percentage of Sangfor's revenue currently comes from sales outside of China, and enterprises should be cautious about experience and capabilities outside of China. However, Sangfor is expanding presence in the U.S. with its own support staff and partners.
• Sangfor does not support a mobile client and does not support WAN path control.
• Sangfor currently only partners with a few Chinese service providers.

Silver Peak

Strengths

• Silver Peak offers a very strong solution for optimizing data center storage replication, with segment-leading products and good strategic alliances with data center infrastructure companies, such as VMware, EMC, Hitachi and Dell.
• Silver Peak has combined products, price, packaging and tailored deployment models to allow storage administrators to deploy WAN optimization specifically for remote replication workloads without a requirement to reconfigure the routed network.
• The company has a large portfolio of appliances, with flexibility in deployment options (hardware and virtual appliances) and pricing (subscription, perpetual and pay as you grow) with options to convert licenses for free.
• Silver Peak's dual-ended path selection features link quality assessment and remediation as well as topology awareness. It supports single-ended link load balancing for direct Internet access from branch offices, including IPsec tunneling.

Cautions

• Silver Peak support of traffic identification, classification and visibility is less granular than segment-leading vendors.
• Silver Peak still lacks SoftWOC capabilities for mobile users, but its strategy is to use WAN optimization distributed in the WAN via its Unity fabric to address this requirement.
• The company's video-on-demand support does not provide specific video format caching or support of remote streaming to offload the origin server, although it does incorporate stream splitting and remote office format-independent file caching to offload the network.
• As it continues to focus on its network-based application optimization approach, Silver Peak offers fewer application-protocol-specific optimizations than other leading vendors.
• Silver Peak does not have any service provider partners, but a new organization has been created with the aim of establishing service provider partnerships.

Vendors Added and Dropped

Added

Dropped

• Have WAN optimization products or services in general availability and actively sold.
• Deliver WAN optimization solutions to the enterprise market in at least three regions out of North America, South America, Europe, Asia/Pacific and Africa.
• Achieve a minimum of $10 million in WAN optimization product revenue or $3 million revenue in ongoing WAN optimization service fees during the past four quarters.
• Must offer more than just managed on-premises WAN optimization based on another vendor's technology. However, the service may include network-based WAN optimization capabilities that use technology supplied by third parties.

Ability to Execute

• Bandwidth reduction capabilities, including compression, caching and/or data deduplication
• Generic protocol acceleration (for TCP or HTTP, for example)
• Application-protocol-specific optimization features, such as acceleration of the CIFS file-sharing protocol
• Network traffic management capabilities, such as prioritization, classification, policy enforcement, traffic shaping, monitoring and reporting, hybrid WAN, WAN virtualization, link load balancing, and direct Internet access

• Market Responsiveness and Track Record are evaluated under Marketing Execution.
• Operations are evaluated under Overall Viability.

Completeness of Vision

• Offering (Product) Strategy is covered under Market Understanding and Innovation.
• Vertical/Industry Strategy

Quadrant Descriptions

Leaders

Challengers

Visionaries

Niche Players

• Traffic that isn't response-time sensitive (such as email, data backup and personal Web access) can swamp WAN links, leading to slow response times for business-critical applications.
• Applications that make extensive use of dynamic content, such as Microsoft SharePoint, can swamp WAN links, while delivering poor application response times.
• Global centralization of branch office servers and data centers can expose latency-sensitive protocols, again leading to slow response times.
• Public cloud services often introduce additional latency, which degrades application response times.
• File transfers, OS patch distribution and similar applications, such as the delivery of training videos, can quickly saturate WANs.
• Repeated transmissions of the same, or similar, files, objects or data patterns can create opportunities for data compression and caching.
• Growing use of live or on-demand video streaming has become a concern for most enterprises, where significant volumes of video traffic saturate local access links.
• Dynamic multipoint unified communications and collaboration video sessions can saturate edge network nodes without passing through the data center, making visibility and control very difficult to achieve.

• In branch offices, the capabilities of WOCs now support serverless branch operations, also described as branch office boxes (BOBs). Customers often need to maintain one or two key applications in the branch. BOBs are now leveraging hypervisor or OS capabilities to host one or more applications on the BOB hardware.
• An alternative offered by most vendors is to install a virtualized WOC in a server at the branch. That server can then run the virtualized WOC along with other virtualized appliances. An advantage is the availability of a standard virtualization environment at the branch and easier replacement of the hardware if there's a failure. However, integration of the branch server can be complex, and hardware bypass network interface cards (NICs) for a fail-to-wire operation may not be available for a particular hypervisor.
• Virtual WOCs are also being loaded into clouds and used to accelerate cloud-based applications. These deployment models will evolve significantly under the influence of software-defined networking (SDN) and NFV.
• There is increasing interest in SoftWOC clients for mobile devices, such as smartphones and tablets, but adoption is still limited.
• Optimization of SaaS applications, such as Office 365, is a key trend that is moving WAN optimization into external data centers or into services from providers such as Aryaka, NTT or Akamai.
• Access to cloud-based applications increasingly makes use of direct access to the Internet from the branch office to reduce latency. This approach often integrates a cloud-based SWG service.
• We have seen leading network service providers incorporating WOC appliances — especially from Cisco, Ipanema and Riverbed — in their managed network service portfolio. We are also seeing network service providers expand these solutions to include router-based WAN optimization and WAN-embedded WAN optimization. Alternative delivery models, such as cloud-based solutions or cloud/premises-based hybrid solutions, are generating interest in managed service providers such as Aryaka and NTT and in the Riverbed/Akamai or Cisco/Akamai joint offering.
• There remains a focus on security — including the acceleration of encrypted protocols such as HTTPS and the security of data stored on WOC systems — as well as secure access to off-premises applications. Ensure that your vendor provides timely support for new versions of applications and protocols and that data in flight and at rest in the appliance is protected by strong encryption. Some vendors can decrypt HVD traffic to provide QoS for interactive versus print and file transfer traffic. In some cases, cross-session compression/deduplication and caching are performed. Other vendors provide QoS only for the encrypted streams, in some cases with guaranteed in-order delivery of packets.
• As basic acceleration capabilities mature, we see a resurgence of enterprise client interest in visibility and control, both as a means to assure WOC effectiveness and as a bandwidth/response-time planning tool. Providing advanced traffic management capabilities for application and user performance measurement and SLA reporting are key emerging requirements for WOC equipment.
• As WAN optimization appliances increasingly include WAN path control and local link load balancing capabilities, these products are morphing into SD-WAN solutions.

Vendor Strengths and Cautions

AppNeta

Strengths

• Its full-featured offering, including APM and NPMD within lightweight SaaS delivery, appeals to those wishing to experiment with technologies without large capital investment.
• PathView's capabilities, including multiple appliance form factors and hardware/software deployment options, appeal to those wishing to measure distributed networks and branch offices.
• AppNeta has benefited from the growth in SaaS use among enterprises; this differentiates it from offerings that focus on packet or network buyers only.

Cautions

• Management changes across several executive areas have resulted in a decreasing focus on NPMD.
• AppNeta is shifting its product and marketing focus away from network monitoring buyers who represent a significant (if slower growing) portion of its current customer base.
• The modules within AppNeta's offering are linked together, but they do not share a common user interface or back-end data store, creating some fragmentation and inconsistency within the offering.

Automic (Orsyp)

Strengths

• Complementary technologies have been consolidated to provide a well-rounded overall solution, including the ability not only to monitor, but also to depict the QoS and application delivery.
• The visually compelling user interface captures typical operator workflows well, including troubleshooting and optimization use cases, and demonstrates an innovative approach to present multiple dimensions of status easily.
• As part of Automic, the NPMD solution is now part of a larger company (combined revenue is roughly triple that of Orsyp alone) with greater resources, and which boasts a solid network of partners (35 channel partners outside of the Americas).

Cautions

• The former Orsyp solutions are now part of a larger organization that has its primary focus on other technologies, making NPMD an even smaller focus within Automic than it was under Orsyp.
• While Automic (Orsyp) conducts business globally, it has not yet broadly expanded its NPMD installed base outside of EMEA.
• Resources devoted to NPMD are limited for this midsize organization.

CA Technologies

Strengths

• CA's broad portfolio includes many functional areas, with a strong partner and internal service capability to implement and maintain the solutions.
• CA changed its development organization during the past two years in order to become more agile to increase release velocity, providing point releases with fixes and new functionality every three to four months.
• CA's financial viability, and the fact that the company is public, shows there is limited risk to business stability involved in doing business with the company. New leadership with a proven track record of innovation is a departure from previous leadership.

Cautions

• Complexity and size of the CA product portfolio continues to be an issue.
• Scalability of packet analysis and management of the ADA probes are common user complaints; the product doesn't have the same scale issues when dealing with SNMP or flow data.
• The product is currently designed and used by customers primarily for reporting and dashboard purposes versus guided diagnostic troubleshooting.

Cisco

Strengths

• Cisco is in a unique position to support its pervasive networking installed base. Its NPMD solution goes very deep within Cisco technologies and has industry-leading support for Day 1 releases of Cisco hardware and software within the management technologies.
• Flow generation by Cisco devices (such as Next Generation Network-Based Application Recognition [NBAR2] included in Application and Visibility Control [AVC] 2.0) are among the best and most useful implementations in the industry, supporting recognition and basic performance monitoring of thousands of application types. This is supported in both the devices and the NPMD tools, which leverage NBAR2.
• The uniform UI across the Prime products makes navigation consistent across modules and implementations.

Cautions

• Central packet analysis is limited in Cisco solutions, since data is summarized off the NAM devices. This prevents the capability for historical, distributed or deep packet analysis after packets have been processed. The limited capability in this space is done via a dated user interface off a specific NAM instance.
• Cisco Prime product sets are often included in deals, and used for point solution management; unfortunately, the support for non-Cisco devices is minimal today, requiring buyers to purchase other management tools for availability and performance monitoring, including NPMD.
• Analytics capabilities are limited; most of the product is based on reporting and presenting large reports of metric data.

Corvil

Strengths

• The offering can monitor large amounts of data at rapid speeds. This will appeal to companies beyond Corvil's high-speed trading installed base, as concepts such as the Internet of Things (IoT) are adopted into the mainstream.
• Corvil's NPMD solution excels in terms of multisegment analysis and accuracy of packet analysis.
• Increased capabilities on analytics and integration with BI systems are a differentiator and unique selling point.

Cautions

• The user interface is geared to the highly technical network engineer supporting high-speed data environments, limiting the speed of adoption and appeal to those less technically proficient.
• There are few "greenfield" opportunities in the company's financial vertical core. This will invariably inhibit growth.
• The company is still relatively small, but has fairly large typical deal sizes, making it somewhat dependent on large deals as it moves to expand to a broader audience.

Fluke Networks

Strengths

• Strong contextual drill-down capabilities help simplify diagnostic and troubleshooting workflows.
• Fluke has a well-defined global sales organization demonstrating success via direct sales (in the U.S.) and channel partners (in EMEA and Asia/Pacific).
• TruView is a single modular appliance-based product offering that allows the customer to repurpose and use each appliance for multiple types of data acquisition.

Cautions

• Fluke Networks' NPMD strategic road map remains unclear in light of the impending merger of Danaher's communications business with NetScout.
• Questions surround the extent to which Danaher has achieved technology sharing among the acquired companies that form its communications business (VSS Monitoring, Arbor Networks, Tektronix and Fluke Networks), translating to risks of resource inefficiencies and capability overlap.
• While the vendor continues to innovate, its ability to demonstrate product enhancements and overall capabilities has regressed.

Genie Networks

Strengths

• Prebuilt reporting templates support key CSP customer support and operations use cases out of the box.
• Attractive pricing and carrier-grade scalability should continue to stimulate enterprise customer interest.
• An appliance-based product form factor simplifies implementation, particularly in highly distributed environments.

Cautions

• Committed CSP and Asia/Pacific prioritization compromises adoption beyond these vertical and geographical focal points, although the EMEA client base has almost doubled in the past 12 months.
• The product's user interface, while demonstrating some new features, remains perfunctory compared to the most sophisticated examples in the market space.
• Analytics capabilities are basic, centered on automated baselining to support anomaly detection and on security-focused use cases.

HP

Strengths

• HP's vision for the increasing role of IT operations analytics (ITOA) technologies in NPMD is strong.
• Data interchange, modeling and process-level integration with other HP solutions is robust.
• The vendor offers a broad portfolio of complementary availability and performance monitoring products.

Cautions

• Usability is hindered by multiple, varied and dated user interfaces across the NPMD solution.
• Customers report difficulty in implementation and management of the complex solution.
• Implementation and integration of ITOA capabilities is not pervasive, both within NPMD solution components and across the HP BSM portfolio.

InfoVista

Strengths

• InfoVista remains focused on solution scalability, meeting the needs of some of the largest carrier and large-enterprise networks.
• InfoVista does carrier focus well, expanding offerings specific to those buyers, and increasing support and capability of the products.
• Flexibility of the InfoVista solution allows it to meet sophisticated use cases, which many other vendors cannot meet.

Cautions

• Complexity within the InfoVista product line may result in long lead times in implementation, difficulty with product usability, and typically high levels of required consulting — often driven by the need to meet customer-specific use cases.
• Growth has been slow, since most customers are carriers and large enterprises, although InfoVista has been introducing new offerings to complement existing product lines.
• InfoVista has a heavy reliance on customers in EMEA, which make up 60% of its installed base.

JDSU (Network Instruments)

Strengths

• Data- and process-level integration workflows are well-thought-out across the solution's component products.
• Network Instruments' recent addition of a network packet broker product (Observer Matrix) to its offerings may appeal to small-scale enterprises looking for NPMD and NPB capabilities from the same vendor.
• Packet capture and inspection capability (via GigaStor) is well-regarded by clients.

Cautions

• While significant business integration activities have not, to date, had a perceptible impact on support or development productivity, this process is ongoing and now part of a larger business separation action that could result in challenges in the near future.
• The NPMD solution requires multiple components with differing user interfaces that are not consistent across products.
• The solution is focused on physical appliances, with limited options beyond proprietary hardware.

NetScout Systems

Strengths

• NetScout has a large and loyal customer base.
• Once third-party market innovators have proven market demand, NetScout has successfully acquired and integrated such complementary technologies.
• NetScout's patented Adaptive Session Intelligence technology provides technical differentiation in support of growing scalability requirements.

Cautions

• NetScout's planned, large acquisition of significantly overlapping technologies may result in road map delays, changes in market and product strategy, and leadership churn that impacts customer value in the near and long term, as evidenced by other acquisitions.
• NetScout's ability to derive and use application context from network data should not be confused with full APM capabilities.
• The hardware-dependent solution is priced at a premium, with limited upgrade paths.

Niksun

Strengths

• Packet capture in excess of 100G and broad analysis support in recent releases allow Niksun to maintain a leading position at high speeds.
• Niksun provides interfaces to a broad array of large IT vendors including Microsoft, Cisco, IBM Tivoli, HP ArcSight, Juniper Networks, Gigamon, VMware and Intel (McAfee), providing customers with flexibility when using complementary solutions.
• The vendor has a long history and remains an innovator at the high end of the market by introducing new features before competitors.

Cautions

• Niksun is not positioned as a pure-play NPMD vendor despite innovation in the space. Its marketing collateral leads first with security solutions, then with its NPMD solutions.
• Market presence and messaging are limited, inhibiting growth potential.
• Niksun's focus on the premium high end inhibits its ability to aggressively expand its installed base.

Riverbed

Strengths

• Riverbed's technical breadth and depth is often cited as a key positive differentiator in competitive evaluations.
• A focus on application delivery quality across all solution components is evident and useful, particularly for those invested in other Riverbed offerings.
• Multiple ITOA capabilities are utilized across solution components.

Cautions

• Riverbed's NPMD solution is a visibly complicated combination of several unique and complex hardware and software technologies.
• Continued activist investor involvement negatively impacts corporate stability and ability to execute.
• Product line and naming changes continue to create confusion.

SevOne

Strengths

• Integration of PLA has been rapidly executed upon, successfully adding value to the portfolio.
• The patented distributed peer-to-peer architecture is highly scalable and facilitates a buy-as-you-grow deployment approach.
• A rapid flow analysis engine enables the highest reported flows and polling instances on a single appliance.

Cautions

• Rapidly expanding reseller agreements will dilute focus of resources dedicated to supporting each channel partner, which, in turn, may affect the end users they serve. SevOne has demonstrated an evolved channel strategy in anticipation of this impact.
• While support for software-defined networking (SDN) is a strategic goal, no current capabilities exist to support the SDN controller or SDN environments.
• Depth into packet data is comparatively limited due to this component being an OEM offering of third-party technology and based on flow analysis.

Vendors Added and Dropped

Added

Dropped

Product-Related Criteria

• Offer the ability to monitor, diagnose and generate alerts for:
  • Network endpoints — Servers, virtual machines, storage systems or anything with an IP address, by measuring these components directly in combination with a network perspective.
  • Network components — Routers, switches and other network devices. This includes SDN and network function virtualization (NFV) components.
  • Network links — Connectivity between network-attached infrastructure.
• Offer the ability to monitor, diagnose and generate alerts for dynamic end-to-end network service delivery as it relates to:
  • End-user experience — The capture of data about how end-to-end application availability, latency and quality appear to the end user from a network perspective. This is limited to network traffic visibility and not within components, such as what APM is able to accomplish.
  • Business service delivery — The speed and overall quality of network service and/or application delivery to the user in support of key business activities, as defined by the operator of the NPMD product. These definitions may overlap as services and applications are recombined into new applications.
  • Infrastructure component interactions — The focus on infrastructure components as they interact via the network, as well as the network delivery of services or applications.
• Provide support for analysis of:
  • Real-time performance and behaviors — Essential for troubleshooting in the current state of the environment. Analysis of data must be done within three minutes under normal network loads and conditions.
  • Historical performance and behaviors — To help understand what occurred or what is trending over time.
  • Predictive behaviors by leveraging IT operations analytics technologies — The ability to distill and create actionable advice from the large dataset collected (see the data sources listed below).
• Leverage the following data sources:
  • Network-device-generated data, including flow-based data sources inclusive of NetFlow and IPFIX.
  • Network device information collected via SNMP.
  • Network packet analysis to identify application types and performance characteristics.
• Demonstrate the ability to support the following scalability and performance requirements:
  • Real-time monitoring of 10GbE networks at full line rate via a single instance of the product.
  • Ingest sampled flow records at a rate of 75,000 flows per second via a single instance of the product.

Non-Product-Related Criteria

• A minimum of 10 NPMD customer references must be included at the time of survey submission.
• Customer references must exclude security-oriented use cases and scenarios.
• Customer references must be located in at least two of the following geographic regions: North America, South America, EMEA and/or the Asia/Pacific region/Japan.
• Total revenue (including new licenses, updates, maintenance, subscriptions, SaaS, hosting and technical support) must have exceeded $7.5 million in 2013, excluding revenue derived from security-related buying centers.
• The vendor should have at least 75 customers that use its NPMD product actively in a production environment.
• The product and specific version submitted for evaluation must have been shipping to end-user clients for production deployment and designated with general availability by 31 October 2014.

Ability to Execute

• Data source support, including application and network device log data
• Behavioral analysis
• Diagnostic workflows
• Real-time monitoring
• Day-to-day maintenance of the product
• Ease and management of deployment and configuration
• Ease of use and richness of functions within the product
• Product deployment options and usability

Completeness of Vision

• Data source support, including application and network device log data
• Behavioral analysis
• Diagnostic workflows
• Real-time monitoring
• Virtualization (NFV and SDN)

Quadrant Descriptions

Leaders

Challengers

Visionaries

Niche Players

• Products have been mostly stagnant. The use of IT operations analytics has not fully materialized to date.
• The potential for market disruption via alternative delivery models and innovation is high.
• Ease of use remains an area that needs improvement and varies significantly both across vendors and within solutions.
• Virtualization and SDN support is minimal in most NPMD solutions.
• Flow protocol support and actual flow data utilization vary significantly across vendors.
• Pricing and product/capability packaging vary significantly across vendors.
• On-premises appliances are the dominant delivery model, but software and SaaS offerings are available (see Note 1).
• Integrations with other ITOM solutions (even other availability and performance solutions) are an afterthought for most, thus encouraging the use of these tools within the network silo.
• Many NPMD solutions are assembled from multiple products, which can enable modular adoption of NPMD capabilities, but also can add significant complexity to procurement and ongoing maintenance.

NPMD: A Mature Market Evolves Rapidly in Response to New Demands

• Increasing recognition that network traffic is a critical source of information about the behavior of the holistic IT stack
• Rising demand for network services and end-user expectations of their quality
• Growing appreciation of the network as a critical component of IT services and as an agnostic, trusted source of cross-domain availability and performance data
• Exponential growth in application and infrastructure dynamism and complexity

SNMP Polling

Flow-Based Technology

Packet-Based Technology

Adjacent and Overlapping Markets

Application-Aware Network Performance Monitoring

APM

IPM

NPBs

Network Fault Monitoring

Unified Monitoring

Vendor Strengths and Cautions

Absolute Software

Strengths

• Absolute Manage provides consistent management capabilities and tight functional interoperability across Mac and Windows platforms.
• Persistence technology provides strong agent health and hardware inventory management capabilities.

Cautions

• Absolute Software has been slow in providing some client management capabilities that organizations are increasingly requiring, such as the availability of a software title database.
• Relative to other vendors, Absolute Software's customer base is small, and awareness for Absolute Manage is relatively low, particularly for Windows. The vendor also lacks a strong online community and user groups.

Accelerite

Strengths

• Accelerite Client Automation has a highly scalable underlying architecture that is particularly strong at managing remote locations.
• Accelerite is one of the few vendors in this Magic Quadrant that can deliver a consistent set of a client management functionality on-premises, as a SaaS-based cloud offering or through a managed service provider relationship.

Cautions

• Accelerite is a small vendor with limited sales and marketing capacity that must quickly grow share in the midmarket, while preserving its enterprise business.
• The feature set of Accelerite Client Automation is more geared toward larger enterprise requirements, and midsize organizations may not be able to exploit its full capabilities (e.g., scalability and remote-office management).

BMC Software

Strengths

• BCM uses a simple user interface, making it accessible to IT staff that lack substantial desktop administration expertise.
• BCM has tight integration with BMC FootPrints Service Core and BMC Remedyforce Service Desk, at a console, data and process level.

Cautions

• The absence of an established mobile management offering product will hinder the vendor's ability to provide a unified endpoint management solution.
• As a stand-alone offering, compared with other products in its portfolio, client management is not highly strategic to the overall success of BMC Software, and receives minimal sales and marketing focus, resulting in low market penetration and a weak community of users.

CA Technologies

Strengths

• Client Automation allows administrators to manage physical and virtual desktops similarly with features such as the ability to maintain application assignments for dynamically assembled desktops for VMware View and Citrix XenDesktop.
• The product has strong software inventory management, providing multiple ways to identify software, including a unique capability called Intellisigs, which allows administrators to identify software more accurately than heuristics or signature-based methods.

Cautions

• Relative to other vendors, Client Automation has low visibility in the market, and is usually not considered unless part of a larger CA bundle or as an add-on module.
• Client Automation lacks a strong online community and user groups.

Dell Kace

Strengths

• The Dell sales force, which is actively promoting Kace and offering access to the technology integrated with other Dell hardware, gives it a unique sales channel with broad and geographically diverse capabilities.
• Kace appliances are easy to deploy, maintain and upgrade, which are among the major challenges of CMTs in the midmarket.

Cautions

• Kace has lagged behind other market-leading CMTs in enabling new functionality and capabilities, particularly in addressing the requirements of larger organizations.
• Kace is now part of Dell's rapidly expanding software portfolio, and must share focus and investment with other high-profile, high-margin offerings.

Heat Software (formerly FrontRange)

Strengths

• Package building has long been a differentiator for Heat DSM. Many client management offerings require third-party products for advanced application packaging, but DSM includes strong native capabilities to help customers build packages.
• A combined FrontRange and Lumension will allow Heat Software to improve on patch management and overall security capabilities within Heat DSM.

Cautions

• Heat Software's visibility and presence in the CMT space is low. Organizations may have difficulty finding online peer support, as well as administrators and consultants with Heat DSM experience.
• Heat DSM's console must be enhanced to improve overall performance and breadth of native management functionality.

IBM

Strengths

• The product's endpoint-oriented intelligence and control, along with its relay server architecture, results in a relatively small server footprint to support highly distributed environments.
• IBM BigFix provides comprehensive out-of-the-box configuration policies and templates.

Cautions

• Uptake of OS deployment (OSD) remains low, and IBM's track record of supporting it at large scale is unproven.
• IBM's customers frequently express challenges with support. Client feedback suggests that support for non-Windows management functionality is not as strong as support for Windows-management functions.

Landesk

Strengths

• Landesk offers one of the most robust sets of management functionality among all client management vendors, with strong cross-device and cross-platform support for Windows, OS X and mobile.
• The LDMS Targeted Multicast with the peer download option enables administrators to distribute applications using a peer-to-peer model at subnets. Landesk customers have fewer remote package servers than customers using competitive products.

Cautions

• LDMS can be complex to use, and generally requires experience with and a strong understanding of client management to fully exploit all of its capabilities.
• Landesk's EMM capabilities are less mature than its PC management capabilities, and integration with LDMS needs to be tighter.

ManageEngine

Strengths

• Initial setup and configuration of Desktop Central is straightforward. The interface is intuitive and easy to navigate, and it does not require high levels of client management experience.
• Desktop Central is one of the most aggressively priced products in the client management space.

Cautions

• Desktop Central offers basic management functionality, but trails the market in several key areas, including self-service, enterprise scalability and OS deployment.
• ManageEngine is still small and not as well-known as many of the leading CMT vendors; as such, it has a limited following and limited online community resources.

Matrix42

Strengths

• The vendor provides packaging and scripting capabilities as a cloud service that include more than 1,200 prepackaged software packages.
• The product has a comprehensive end-user self-service interface, which is independent of the Matrix42 service desk.

Cautions

• OS deployment capabilities need to be extended. Matrix42 Physical does not currently support multicast OS deployment, and reference feedback indicates challenges with driver management in some environments.
• Mac management capabilities are incomplete, currently lacking OS deployment, software usage and patch management.

Microsoft

Strengths

• Configuration Manager's scalability has been proven through many large customers.
• Microsoft has a large ecosystem of software vendors and service providers that support Configuration Manager, due to its large market share.

Cautions

• Support for non-Windows PCs is weak. Configuration Manager lacks patch content for most non-Microsoft desktop applications. Organizations must patch most non-Microsoft applications through traditional software distribution or third-party patch management tools.
• Remote control is frequently supplemented by third-party products, as it lacks advanced security and auditing capabilities offered by third-party remote control tools.

Novell

Strengths

• ZENworks allows desktop applications to be managed dynamically. Applications can be launched taking into account user identity, location, time and other factors, without the need to develop scripts or a separate profile management tool.
• ZCM has comprehensive software distribution capabilities; complex software distribution jobs can be managed more easily in ZCM than in many competitive products, which may require more scripting or manual effort.

Cautions

• Novell does not have a strong brand in this market, and we continue to see few organizations considering ZENworks beyond legacy Novell customers upgrading from an old version of ZENworks to ZCM.
• ZENworks does not provide vulnerability assessment or out-of-the-box security configuration assessment capabilities.

Symantec

Strengths

• CMS offers great flexibility in managing endpoints; there are many ways to execute the various functions, allowing administrators to tailor the product to processes.
• Symantec has a large installed base of customers, with one of the largest and most active communities of user groups and online forums.

Cautions

• CMS 7.5 can be complex to use and may be challenging for users without strong client management experience to exploit its full capabilities.
• A weak position in mobile management will make it more challenging for Symantec to succeed with a future unified endpoint management product.

Vendors Added and Dropped

Added

Dropped

Other Vendors

• $15 million in annual CMT revenue
• 1,000 active end-user organizations utilizing the CMT
• 1 million desktops and notebooks actively under management by the CMT
• Core CMT functionality for Windows PC systems, including:
  • Hardware and software inventory
  • OS deployment
  • Patch management
  • Software distribution
• 10 new, named customers that have deployed at least 2,500 CMT licenses in the last year
• At least four new, named customers outside the vendor's primary geography with at least 500 CMT licenses deployed in the last year (in the Americas, EMEA and the Asia/Pacific region)
• At least four new, named customers in three different vertical markets with at least 1,000 CMT licenses deployed in the last year

Ability to Execute

• Software distribution
• Hardware and software inventory, including software usage monitoring
• OS deployment
• Patch management

Completeness of Vision

Quadrant Descriptions

Leaders

• They understand future organizational demands for client and user management.
• They have the ability to meet a diverse set of organizational requirements, especially those of large and mature enterprises.
• There is consistent positive feedback from clients regarding the value of their products and the overall service and support experiences.
• They have sustainable market share and financial health.
• They demonstrate ongoing visibility and deal success in the client management market (Gartner tracks how often vendors are being considered by organizations as a measure of visibility).
• They have the ability to service global clients, or have demonstrated the ability to deliver and support solutions to customers in North America, Europe and Asia.

Challengers

Visionaries

Niche Players

• Skills level and number of IT staff
• Scalability and architecture
• Ease of use
• Cost to purchase and operate
• Support for non-Windows PCs (e.g., Mac, virtual machines, servers)
• Integration with EMM products
• Integration and inclusion with other IT management tools (e.g., service desk)
• Remote-office or home-user management requirements
• Endpoint security requirements
• Cloud delivery options

• Self-service — The ability of CMTs to deliver self-service capabilities continues to grow in importance as organizations look to enhance the management experience for the user, improve the efficiency with which software and services are delivered, increase user productivity and satisfaction, and lower total cost of ownership. Most CMTs offer some form of basic self-service capabilities, but only a handful provide workflow and automation capabilities out of the box — most require additional modules or service desk tools. Self-service capabilities are increasingly becoming a leading area of differentiation.
• Patch management — Security and compliance remains a critical focus for most organizations, increasing the need for strong patch management. All CMTs provide patch management capabilities, but there is great variability from one tool to another. Some offer only basic functionality for patching the operating system, while others are more sophisticated in both the breadth of operating systems and applications that they patch, as well as the level of functionality, automation and reporting they provide. Patching is commonly the initial use case for CMTs, and often the primary justification for selecting one tool over another.
• Unified endpoint management — Organizations are struggling to manage a growing number of smartphones, tablets and BYOD devices connecting to their networks. Even though CMTs are beginning to offer basic functionality to manage these devices, most organizations continue to utilize separate EMM products, often from different vendors. We are toward approaching the beginning of Wave 2 of unified endpoint management (see "Managing PCs, Smartphones and Tablets and the Future Ahead"), where a single product initially using separate processes will manage both traditional clients and mobile devices. As such, it is critical that organizations understand their CMT vendor's ability to manage mobile devices today and their plans for convergence.
• Security and compliance — Rapidly changing security and compliance requirements being put in place by organizations are forcing CMTs to continually evolve their capabilities beyond just patch management. IT managers are increasingly looking for CMTs to help in automating the creation and enforcement of security standards on policies. This includes the use of security templates and compliance baselines, proactive notification of noncompliance and threats, and automatic remediation and advanced reporting of systems out of compliance. Security and compliance enhancements will continue to be a major area of focus of innovation for all CMT vendors.

• Client management is sometimes sold as an add-on module to another more strategic product (e.g., service desk). In this case, the CMT may not be as feature-rich as other stand-alone offerings in the market, but it does provide tight integration into other products in the vendor's portfolio. Client management is not usually strategic to the vendor's success.
• Client management functionality may also be delivered as part of a bundled offering where it acts as core function within a larger overall management suite. These offerings are typically targeted at the midmarket and designed for ease of use. Client management functionality is optimized to work specifically with other components of the same suite.
• Most often, CMTs are sold as stand-alone offerings and are a primary focus and investment area of the vendor, and strategic to its overall success. CMTs that are sold stand-alone are generally the most robust in breadth and depth of functionality, and provide strong integration capabilities with other products in the market.