Network security vendors: who they are and how CISOs compare them

On CISO Tribune's record as of 18 October 2026, 40 vendors file under network security, across nine categories from firewalls to Domain Name System (DNS) security. Their products inspect, filter and control traffic across corporate networks and between users and the internet. Chief information security officers (CISOs) compare them on where inspection happens, how exposed each vendor's own edge components are, proof of zero trust enforcement, data handling and exit terms.

Key facts

• The Cybersecurity and Infrastructure Security Agency (CISA) had counted more than 22 known exploited vulnerabilities tied to virtual private network (VPN) compromise when it and four partners published network access guidance on 18 June 2024.
• CISA's Known Exploited Vulnerabilities (KEV) catalog held 1,748 entries on 18 October 2026.
• Binding Operational Directive BOD 26-02, issued on 5 February 2026, gives federal agencies 18 months to remove every end-of-support edge device.
• Under BOD 26-04 of 10 June 2026, deadlines tagged for forensic triage give agencies three days to remediate and a duty to check whether the asset was compromised.
• MITRE ATT&CK lists nine Lateral Movement techniques, the behaviour that segmentation and network detection are bought to contain.
• The National Institute of Standards and Technology (NIST) documented 19 sample zero trust builds made with 24 vendors in Special Publication (SP) 1800-35, final on 10 June 2025.

What network security products do

CISO Tribune's taxonomy defines the group as products that inspect, filter and control traffic across corporate networks and between users and the internet. We file vendors under nine categories, defined here as on the record:

• Firewalls and NGFW: hardware, virtual and cloud firewalls, including next-generation firewalls (NGFW), that enforce policy by port, application, user and content.
• Secure access service edge (SASE) and security service edge (SSE): cloud-delivered bundles of secure web gateway, cloud access security broker and private access, with or without software-defined wide area networking (SD-WAN).
• Zero trust network access (ZTNA): standalone services that open specific private applications after checking identity and device, in place of a network-level VPN.
• Network detection and response (NDR): tools that analyse traffic and metadata to detect threats and support investigation.
• Microsegmentation: software that limits which workloads, devices and users can talk to each other, to contain lateral movement.
• Network access control (NAC): systems that identify devices as they join wired and wireless networks and decide what each may reach.
• Distributed denial-of-service (DDoS) protection: services and appliances that absorb or filter attack traffic before it overwhelms a target.
• DNS security: protective DNS resolvers and DNS infrastructure products that block malicious domains.
• Network visibility and traffic brokering: taps, packet brokers and observability fabrics that copy traffic to security and monitoring tools.

Two of these terms have analyst definitions. In a cloud security architecture guide dated 25 November 2025, Gartner describes SASE as converged network and security-as-a-service capabilities spanning SD-WAN, secure web gateway, cloud access security broker, NGFW and ZTNA. It calls SSE the SASE subcomponent that secures access to the web, cloud services and private applications. CISA's 2024 guidance lists SSE's parts as ZTNA, a cloud secure web gateway, a cloud access security broker and firewall-as-a-service.

Out of scope here: web application firewalls, which protect an organization's own web applications, endpoint agents under endpoint and extended detection and response (EDR and XDR), and operational technology security. Many network vendors also sell in those categories, and the record files each product line where it belongs.

What the standards and agencies say about network security

Zero trust replaced the trusted perimeter

NIST SP 800-207, published in August 2020, is the reference definition. It says zero trust grants no implicit trust to users or assets based only on their physical or network location, and that authentication and authorization happen before a session with a resource begins.

CISA's Zero Trust Maturity Model version 2.0, released on 11 April 2023, makes networks one of five pillars, with identity, devices, applications and workloads, and data. The network pillar covers segmentation, traffic management, traffic encryption and resilience. At the Optimal stage it describes fully distributed micro-perimeters and extensive microsegmentation built around application profiles.

The National Security Agency (NSA) issued guidance for the network and environment pillar on 5 March 2024, one of seven pillars in the zero trust framework the agency describes. It names data flow mapping, macro and micro segmentation, and software-defined networking as the key capabilities. On 29 July 2025, CISA's microsegmentation guidance said the practice "reduces the attack surface, limits lateral movement, and enhances visibility."

All of this targets one adversary behaviour, which MITRE ATT&CK files as Lateral Movement, tactic TA0008: the adversary trying to move through your environment. Its nine techniques include logging in to remote services such as Remote Desktop Protocol and Secure Shell (SSH) with valid accounts, and reusing stolen password hashes and Kerberos tickets.

Device hygiene and layered firewalls

NIST SP 800-41 Revision 1, NIST's firewall guideline, dates from September 2009. It defines firewalls as devices or programs that control traffic between networks or hosts with differing security postures, and makes recommendations for firewall policy and for selecting, configuring, testing, deploying and managing firewalls.

The NSA's Network Infrastructure Security Guide, at version 1.2 since October 2023, is more prescriptive. It recommends several layers of next-generation firewalls, each from a different vendor, so that one unpatched flaw cannot open the internal network. It prefers NAC based on 802.1X device certificates over switch port security, limits VPN gateways to the ports they need, and says unsupported devices should be upgraded or replaced immediately.

Remote access is moving off the VPN

Modern Approaches to Network Access Security came out on 18 June 2024 from CISA, the Federal Bureau of Investigation (FBI), two New Zealand agencies and the Canadian Centre for Cyber Security. It urges organizations to shift from broad remote access toward zero trust, SSE and SASE, citing the 22-plus exploited VPN vulnerabilities, and notes that SASE consolidates monitoring onto one platform.

The UK National Cyber Security Centre (NCSC) published eight design requirements for ZTNA on 27 May 2026, from enforcing policy before any connection to designing for failure. Two points matter for buyers. A product that only provides connectivity, without enforcing policy decisions, does not meet the intent of zero trust. And, in the NCSC's words, "ZTNA controls don't remove the need for local network segmentation."

DNS and denial of service

The NSA and CISA sheet Selecting a Protective DNS Service, version 1.3 of March 2025, warns that protective DNS is bypassed by any traffic that uses Internet Protocol (IP) addresses directly. It tells buyers to block outbound ports 53 and 853 and unauthorized DNS-over-HTTPS servers, and to learn how the provider may use the organization's query data. Its provider comparison rests on reported capabilities: no formal testing was performed.

CISA, the FBI and the Multi-State Information Sharing and Analysis Center updated Understanding and Responding to Distributed Denial-of-Service Attacks on 21 March 2024. It sorts attacks into three kinds: volumetric floods that consume bandwidth, protocol attacks on network layers 3 and 4, and application-layer attacks. Its preparation steps include considering a DDoS mitigation provider and planning bandwidth capacity.

Who the network security vendors are

On CISO Tribune's record as of 18 October 2026, 40 vendors file under at least one network security category. The categories overlap: 18 vendors appear in two or more, and six in three. By category, 14 file under SASE and SSE, 13 under firewalls, 10 under ZTNA, seven under DDoS protection, six under NDR, five under NAC, four each under microsegmentation and network visibility, and one under DNS security.

By ownership, 12 are publicly traded, seven are owned by a parent company or investor group, four are independent private companies, and 17 have no ownership recorded yet. By headquarters, 19 are in the United States, three in Israel, two in the United Kingdom, one in Denmark and one in Finland; 14 have no headquarters recorded yet.

What they share is the job: deciding which traffic may pass and recording what did. Eleven of the 40 file their primary business elsewhere, most often under EDR and XDR, so a firewall shortlist can include companies a buyer knows for something else. Two list a product built to govern the use of artificial intelligence (AI), which ties network buying to AI governance.

Where they differ is delivery, and delivery drives most of the evaluation below:

• Hardware: Fortinet runs FortiGate firewalls on its own FortiOS operating system and FortiASIC processors.
• Cloud service: Netskope sells private application access in place of a legacy VPN; Cato Networks combines SD-WAN, security and a global backbone in one service.
• Carrier-managed: AT&T sells managed SASE, and Telia sells DDoS filtering as a service.
• Overlay on existing gear: Elisity enforces segmentation policy on a customer's existing switches and firewalls without added hardware.
• Sensors and network data: Corelight sells network sensors in tiers from about 4 to over 125 gigabits per second; NETSCOUT builds threat detection on network-derived data.
• Industrial remote access: Dispel connects vendors and operators to operational technology assets in place of legacy VPNs.
• Global network: Cloudflare runs DNS and DDoS mitigation across its own global network.

The full list is below this guide, alphabetical within each category.

How CISOs compare network security vendors

One platform or several layers. The agencies point both ways. The NSA guide recommends firewall layers from different vendors so a single flaw cannot open the network; the June 2024 joint guidance credits SASE with consolidating monitoring onto one platform. Our read: decide which failure the organization can absorb, a shared flaw across one vendor's stack or the cost of running several, and write that choice down.

Who carries the edge. BOD 26-02 says edge devices attract attackers because of their reach into the network and their integration with identity systems. Moving inspection to a cloud service moves that exposed component to the provider; it does not remove it. Ask the KEV, lifecycle and forensics questions about the provider's connectors and clients too.

Decryption and data. Secure web gateways and SSE services decrypt traffic, and a protective DNS provider sees every query. The NSA and CISA tell buyers to establish how a provider may use that data, especially for non-security purposes. Put retention, location and secondary use in the contract, not the sales deck.

Logs and exit. The NCSC asks ZTNA designs to log successful and denied access with the reason, centralized in a SIEM. Our read: test that export during the trial, because the same export is the exit path when the contract ends.

What a proof of concept should test

• Replay ATT&CK Lateral Movement techniques, such as remote desktop logins and pass the hash, between two segments, and record what is blocked and what is logged.
• Revoke a test device's compliance mid-session and time how long access survives.
• Disable a connector or point of presence and confirm the fail-open or fail-closed behaviour matches the contract.
• Run peak traffic with decryption on and measure throughput and latency.
• For DNS products, try DNS over HTTPS and direct-IP connections to see what bypasses the control.
• Ask the vendor to patch a lab unit and help collect a forensic image, and time both.

What changed for network security vendors in 2025 and 2026

• 4 February 2025. Cyber agencies in Canada, the UK and Australia led edge-device guidance published with CISA for firewalls, routers, VPN gateways and other internet-facing devices. The NCSC part asks for security logging that works by default.
• 1 and 2 July 2025. Arista Networks acquired the VeloCloud SD-WAN portfolio, and Hewlett Packard Enterprise (HPE) completed its acquisition of Juniper Networks. Our record files Juniper as an HPE subsidiary.
• 25 September 2025. CISA's Emergency Directive 25-03 ordered agencies to hunt for compromise of Cisco Adaptive Security Appliance firewalls, after attackers altered read-only memory to persist through reboots and upgrades. Its 23 April 2026 update said vendor patches do not necessarily remove an attacker already on a device, and required a hard power reset of affected devices by 30 April 2026.
• 5 February 2026. BOD 26-02 set federal deadlines for end-of-support edge devices: inventory listed models within three months, decommission them within 12, remove all such devices within 18 and run continuous discovery within 24.
• 10 June 2026. BOD 26-04 revoked BOD 22-01 and set patch deadlines by exposure, exploitation, automation and impact, attaching a forensic triage to its three-day deadlines.

Related reading

The CISO security glossary defines the terms used here, and what a CISO does covers who owns these purchases. An exploited edge device can become a disclosure question: see the Item 1.05 materiality guide, the Securities and Exchange Commission disclosure rules, the 10-K governance disclosures on our record and reporting lines.