SD-WAN and SASE Trends: Durable Shifts and Emerging Claims
Separate durable changes in distributed networking and security from vendor forecasts about convergence, AI, edge, and autonomous operations, using dated evidence rather than trend-list hype.
By Mark Poulton
SD-WAN and SASE Trends: Durable Shifts and Emerging Claims
The durable change behind SD-WAN and SASE is that users, sites, and applications are distributed across networks and cloud services, so connectivity and security policies must work across more than one office perimeter. SD-WAN and SASE are related, but they are not becoming interchangeable: SD-WAN focuses on WAN connectivity and traffic policy; SASE coordinates networking with cloud-delivered security around access paths.
This is an evidence-led view of developments and claims, not a forecast list. As of 4 October 2026, selected providers publicly describe portfolios that combine or integrate networking and security. Those pages establish product positioning, not industry-wide adoption or independent proof that a combined service improves outcomes.
Which shifts are durable?
Distributed access remains an architectural requirement
Users may work from offices, homes, or other locations, while applications run in data centres, SaaS, and public cloud. Networks therefore need to handle paths that cross different providers and enforcement points. This is the context for both SD-WAN and SASE, not a claim that a particular service model is mandatory.
Networking and security products are being packaged together in some portfolios
Current provider materials illustrate different approaches. Cisco describes Secure Access as SSE and separately discusses integration with Meraki SD-WAN. Fortinet describes FortiSASE and a Unified SASE combination with Secure SD-WAN. Palo Alto Networks presents Prisma SASE as a broad portfolio across users, applications, data, and devices. These are examples of vendor positioning, not proof that all suppliers have converged on one architecture or that the functions share one control plane.
For buyers, the durable question is whether the required routing, access, inspection, identity, and monitoring functions work together in their environment. The SASE vendor evaluation provides criteria for checking that claim.
Identity and application context matter to access policy
Identity-aware access and application-specific policy are central to contemporary SASE descriptions. The implementation details vary: check which identity and device signals are used, what resources are protected, where decisions are enforced, and how exceptions and events are handled. These controls do not make every design “zero trust” or replace identity governance and endpoint security.
Which claims remain emerging or vendor-specific?
| Claim area | What can be observed | What still needs validation |
|---|---|---|
| AI-assisted or agentic security | Providers are adding AI-labelled features to product portfolios and marketing materials. | The exact task, training or input data, false positives, action boundaries, auditability, and human approval. AI branding is not proof of effective threat detection or safe automation. |
| Self-healing or autonomous networking | Products may recommend or automate selected configuration and traffic actions. | Which actions are actually automated, how they are constrained, how operators can intervene, and performance in failure scenarios. |
| One unified policy or console | Some vendors describe integrated management across networking and security. | Whether the required products share policy and telemetry in practice, or still need separate licenses, interfaces, teams, and escalation paths. |
| Edge, IoT, and 5G convergence | Edge and cellular connectivity appear in product roadmaps and service options. | Availability in required locations, supported workloads, resilience without cloud reachability, device controls, and measured application paths. |
| Lower cost or simpler operations | Vendors often position consolidation as a route to savings or reduced complexity. | Total lifecycle cost, transition overlap, operating effort, retained tools, provider management, integration, and whether the claimed benefit is realised. |
AI-specific SD-WAN capabilities are covered separately in AI in SD-WAN; this article distinguishes broad market narratives from evidence instead of repeating the feature list. For a concrete SD-WAN-to-SASE transition, see when to move from SD-WAN to SASE.
How should teams assess a trend before acting on it?
Use a short evidence check:
- Classify the statement. Is it a standard architectural requirement, an available product feature, a vendor roadmap, an analyst forecast, or a marketing outcome claim?
- Check the date and source. Prefer current product documentation for availability, independent research for market statements, and contracts or tests for service commitments.
- Separate availability from effectiveness. A feature being offered does not show it works for your traffic, identity systems, geography, or incident process.
- Test against a requirement. Use a representative user or site path and define what evidence would justify adoption.
- Revisit forecasts. Treat dates and adoption percentages as time-bound expectations, not facts about the organisation's need.
The original 2025 article asserted exact cost reductions, operational time savings, AI accuracy, self-healing behaviours, and broad 5G/edge adoption without enough source detail to validate those claims. They are not repeated here. A 2025 forecast should not be relabelled as a 2026 result without current evidence.
Conclusion
The durable trend is a need to coordinate connectivity, identity, and security across distributed access—not the disappearance of distinctions between SD-WAN, SSE, and SASE. Vendor portfolios are evolving, but convergence, AI automation, edge integrations, cost savings, and operational simplification must be evaluated product by product and against a real requirement. Keep the architecture terms precise and let evidence, not trend language, drive investment.