GigaOm Radar for Cloud Networking v5

Cloud networking software enables data transmission within and between clouds by deploying and orchestrating virtual networking functions. Cloud networking is entirely software driven, with each virtual function playing a role in defining the ways various cloud entities communicate at a logical level, and it enables connectivity among different data centers and cloud providers.

Cloud networking solutions use native networking capabilities from each cloud provider, orchestrating them from a central management solution. Additionally, cloud networking vendors can provide specialized functions such as gateways, exchange points, or routers that offer more features than those available from cloud providers. 

With these capabilities, cloud networking vendors address everyday networking-specific challenges (such as network design, deployment, management, and security) but with a cloud-specific twist. Network segmentation must now span multiple distributed environments, monitoring and observability tools must account for larger and more complex networks, optimization must include cloud-to-cloud intelligence, and routing must support new networking functions such as transit gateways.

The best way to address these challenges is to abstract all networking constructs and present them in a single orchestration solution that can handle multiple types of infrastructure and provisioning of networking instances with minimal configuration. This consolidated view changes the cloud networking experience from an overwhelming problem to a much more casual activity. Connecting another public cloud environment should feel like just another instance to connect rather than a whole architecture overhaul.

At this higher level of abstraction, service-to-service connectivity and content-aware traffic processing are two of the most important use cases that cloud networking solutions must address. Rather than having the networks team handle constructs at OSI Layers 3 and 4, a cloud networking solution can automatically provision those layers, allowing the DevOps teams to work exclusively at Layer 7 and focus on content-aware, service-to-service connectivity. 

With this type of capability at the development teams’ fingertips, applications are no longer bound to a single region or provider, and use cases can expand to multicloud, hybrid cloud, and edge locations. Cloud networking also reduces the amount of vendor-specific knowledge required to interconnect environments by offering a unified and consistent management interface. Rather than adopting an unsophisticated “connecting multiple environments” approach, users can reframe cloud networking as one of the core enablers of developing and maintaining cutting-edge applications using all the available infrastructure types.

To help prospective customers find the best fit for their use case and business requirements, we assess how cloud networking solutions are designed to serve specific deployment models (Table 1). 

For this report, we focus on four software-based deployment models, for networking appliances and management platforms. 

For networking appliances, these are: 

• Virtual appliance: Images that run within VMs or containerized environments.

• Public cloud image: These are used to provision networking appliances directly from a public cloud provider marketplace, with the appliances running within the cloud environment.

• Software: Installed and run from any compatible operating system.

• SaaS: Deployed and managed by the cloud networking vendor, where the appliance is delivered as a service.

For management platforms, these are:

• Virtual appliance: Images that run within VMs or containerized environments.

• Public cloud image: These are used to enable platform access directly from a public cloud provider marketplace

• Software: Installed and run from any compatible operating system.

• SaaS: Deployed and managed by the cloud networking vendor, delivered via a web portal. 

Table 1. Vendor Positioning: Appliance Deployment Model and Management Platform Deployment Model

Table 1 components are evaluated in a binary yes/no manner and do not factor into a vendor’s designation as a Leader, Challenger, or Entrant on the Radar chart (Figure 1). 

“Target market” reflects which use cases each solution is recommended for, not simply whether that group can use it. For example, if an SMB could use a solution but doing so would be cost-prohibitive, that solution would be rated “no” for SMBs.

All solutions included in this Radar report meet the following table stakes—capabilities widely adopted and well implemented in the sector:

• Vendor agnostic orientation

• Virtual network functions

• Centralized management

• Network monitoring 

• Cloud awareness

Tables 2, 3, and 4 summarize how each vendor in this research performs in the areas we consider differentiating and critical in this sector. The objective is to give the reader a snapshot of the technical capabilities of available solutions, define the perimeter of the relevant market space, and gauge the potential impact on the business.

• Key features differentiate solutions, highlighting the primary criteria to be considered when evaluating a cloud networking solution

• Emerging features show how well each vendor implements capabilities that are not yet mainstream but are expected to become more widespread and compelling within the next 12 to 18 months 

• Business criteria provide insight into the nonfunctional requirements that factor into a purchase decision and determine a solution’s impact on an organization

These decision criteria are summarized below.

Key Features

• Networking policy definition: This metric assesses the manner in which the cloud networking service is consumed and how administrators can define and deploy cloud networks. For example, solutions can be consumed in multiple ways, such as through a GUI, API, or CLI.

• Secure traffic and segmentation: This criterion looks at secure data transmission in cloud environments, which is typically achieved using various security functions such as firewalls, gateways, and VPNs. In addition, cloud networking security should incorporate network segmentation, in which entities such as VMs are grouped within a network that is closed off from outside environments, such as the public internet, through the use of firewalls. 

• Observability and optimization: Observability in the context of cloud networking should provide end-to-end visibility of the whole cloud estate for a variety of metrics and advanced functions. This enables a solution to optimize traffic flows within a cloud environment and help administrators troubleshoot and resolve network issues.

• Content-aware traffic processing: This criterion evaluates a solution’s ability to operate at Layer 7 and understand the type of content being transmitted, such as emails, file transfers, or HTTP-based API calls. 

• Data center networking: This key feature looks at how well the solution supports networking in customers’ private data centers. For example, solutions can include virtual networking appliances that can be deployed either inside the data center or as edge or gateway appliances. Some solutions can offer a network operating system.

• Application-to-application connectivity: Traditionally, the network team has been responsible for providing the underlying infrastructure upon which application teams can build. Today, solutions should support an application-first mentality in which the underlying infrastructure is provisioned to support services and applications, including scaling up as required.

• Container and microservices networking: This feature assesses a solution’s support for container networking, which, due to its ephemeral nature, presents a different challenge compared to other types of compute infrastructure. Containers are typically managed using orchestrators such as Kubernetes, which use a set of plugins to manage connectivity within the same pod, between pods, and among clusters and services. 

Table 2. Key Features Comparison

Emerging Features

• Cost optimization: Solutions should help organizations manage and optimize networking costs by monitoring networking spend, generating cost forecasting based on traffic levels, routing traffic through the most cost-efficient paths by taking egress costs into consideration or suggesting cost versus performance traffic routes or optimization techniques.

• eBPF: eBPF technology was originally designed for the Linux kernel and allows sandboxed programs to run in a privileged context, such as the OS kernel. Some solutions use eBPF to safely and efficiently extend kernel capabilities without requiring changes to kernel source code or the loading of kernel modules. 

• Workload authentication and authorization: This emerging technology evaluates how well tools can authenticate and authorize workload (nonhuman) identities. Methods include using tokens and certificates such as X.509, Secure Production Identity Framework for Everyone (SPIFFE), SPIFFE Runtime Environment (SPIRE), mutual TLS (mTLS), cloud-native authentication services, asymmetric key pair authentication, or JSON Web Token (JWT).

• Large dataset egress: In instances when organizations need to transfer large volumes of data across clouds or to and from on-prem environments, cloud networking solutions can support high-speed data transfers from multiple sources and enforce security at the origin, in transit, and in the landing environment. 

Table 3. Emerging Features Comparison

Business Criteria

• Ecosystem: This criterion looks at the services and capabilities the cloud networking solution leverages from third-party vendors. This includes the breadth of integrations with cloud service providers (CSPs) and capabilities meant to orchestrate their native networking capabilities. It also considers service insertion capabilities. 

• DevOps suitability: This feature assesses a solution’s ability to define and provision networking constructs in a declarative manner, typically by integrating with infrastructure-as-code (IaC) tools, supporting automation and scripting, and integrating with CI/CD and version control systems.

• Cost transparency: This criterion looks at finance-related considerations, such as pricing calculators and transparency, licensing models, and the requirement for professional or managed services.

• Support services: This metric assesses whether vendors offer comprehensive technical documentation and support services to help customers adopt and run the solution at the scale they require. This can include training and certification programs; technical documentation; onboarding programs; help desks in different tiers and working hours, such as 9 to 5, 8 to 8, follow the sun, or 24/7; service-level agreements, such as resolving P1 incidents in under two hours; and varied support channels, such as live chat, Slack, and phone.

• Manageability: This criterion evaluates how easy or difficult it is for administrators and end users to interact with the solution, with specific focus on the work required for initial setup and ongoing configuration. Ease of use is achieved, for example, through the availability of low-code and no-code builders, integrating with workflow automation tools, the availability of topological maps, and the offering of data-driven suggestions for improved network security posture.

Table 4. Business Criteria Comparison

The GigaOm Radar plots vendor solutions across a series of concentric rings, with those positioned closer to the center being judged as having the most complete solution. The chart characterizes each vendor on two axes—balancing Maturity versus Innovation and Feature Play versus Platform Play—while providing an arrowhead that projects each solution’s expected evolution over the coming 12 to 18 months.

Figure 1. GigaOm Radar for Cloud Networking

As you can see in Figure 1, most vendors are positioned in the Platform Play half of the chart. While this is consistent with previous iterations of this report, some vendors have been repositioned to the Feature Play half. The vendors featured in the Feature Play half have solutions that mainly address specific cloud networking use cases, such as container networking or application connectivity.

We see most household networking providers concentrated in the Maturity/Platform Play quadrant.

Compared to the last iteration, in which there was a high number of Forward Movers and a complete lack of Outperformers, this year’s has a good balance of Outperformers, Forward Movers, and Fast Movers, which suggests a second wind of cloud networking solutions driven by security use cases and managing both training and inference data flows for generative AI.

In reviewing solutions, it’s important to keep in mind that there are no universal “best” or “worst” offerings; every solution has aspects that might make it a better or worse fit for specific customer requirements. Prospective customers should consider their current and future needs when comparing solutions and vendor roadmaps.

INSIDE THE GIGAOM RADAR

To create the GigaOm Radar graphic, key features, emerging features, and business criteria are scored and weighted. Key features and business criteria receive the highest weighting and have the most impact on vendor positioning on the Radar graphic. Emerging features receive a lower weighting and have a lower impact on vendor positioning on the Radar graphic. The resulting chart is a forward-looking perspective on all the vendors in this report, based on their products’ technical capabilities and roadmaps.

Note that the Radar is technology-focused, and business considerations such as vendor market share, customer share, spend, recency or longevity in the market, and so on are not considered in our evaluations. As such, these factors do not impact scoring and positioning on the Radar graphic.

For more information, please visit our Methodology.

Alkira: Alkira Cloud Services Exchange (CSX)

Solution Overview
Alkira delivers a cloud-delivered Network Infrastructure-as-a-Service (NIaaS) platform for consistent connectivity and segmentation across public clouds, data centers, branches, and partners, with centralized operations, visibility, and integrated security services. At the core of the Alkira solution is Alkira Cloud Services Exchange (CSX), which consists of a cloud backbone of globally interconnected Alkira Cloud Exchange Points (CXPs), virtual points of presence (PoPs) powered by a full routing stack, and network services. CXPs deliver symmetric traffic steering for stateful network services and optimal routing to the cloud with no data center backhaul. Alkira CSX delivers a cloud-delivered global backbone that connects users, data centers, branches, partners, and cloud workloads across single-cloud or multicloud environments.

Alkira CSX discovers cloud networking constructs using administrator-provided cloud credentials. After discovery, teams select the cloud environments to onboard, and CSX provisions the required connectivity and routing so approved cloud workloads can communicate based on defined policy. The same onboarding pattern extends connectivity to non-cloud domains, including home offices, branches, campuses, SD-WAN sites, data centers, and colocation facilities. CSX supports DevOps-friendly automation through APIs and infrastructure-as-code integrations, including Terraform, to standardize provisioning and change management. For AI-enabled operations and integration into agentic workflows, Alkira provides an MCP server and a built-in network infrastructure assistant (NIA) for AI-driven operations.

One of Alkira’s distinguishing features is its Extranet-as-a-Service, which allows organizations to connect customers, partners, and third parties to critical business data at enterprise scale while maintaining high levels of control, visibility, and security. Alkira’s fully as-a-service deployment model for both the networking appliances and management platform differentiates it from other vendors in this report.

Alkira is positioned as a Challenger and Fast Mover in the Maturity/Platform Play quadrant of the cloud networking Radar chart.

Strengths
Alkira scored well on a number of decision criteria, including:

• Observability and optimization: Alkira CSX offers a comprehensive graphical interface for design, provisioning, and Day 2 activities. It enables organizations to insert network services and stateful firewalls and leverage Alkira intent-based policies to steer the desired traffic from single or multicloud environments to the autoscalable network services nodes. 

• Secure traffic and segmentation: Alkira CSX provides network segmentation capabilities that group remote users, on-prem sites, public cloud instances, network services, and internet exit points into specific network connectivity segments. These capabilities apply equally to single cloud and multicloud environments. Alkira also offers selective cross-segment communication with firewall service insertion to support various shared application service use cases related to mergers, acquisitions, divestitures, and partner network connectivity. Furthermore, Alkira’s microsegmentation capabilities allow subdividing segments even further for even more granular security policy controls.

• Networking policy definition: Alkira offers a UI-based topology that enables customers to design and manage their network architecture. The interface allows users to add or remove network components using tools similar to drag-and-drop editors. The solution provides granular role-based access control (RBAC) with support for MFA and single sign-on. All configurations are done through the GUI, API, or Terraform, as there is no CLI. Most customers use a combination of API and UI or Terraform and UI for day-to-day operations. In addition, Alkira’s interfaces can be used by varied user personas, including NetOps, SecOps, and application developers, to manage their enterprise connectivity needs.

Opportunities
Alkira has room for improvement in a few decision criteria, including:

• Data center networking: Alkira is not able to manage networks inside on-prem data centers, though it does support connectivity between the edge of the data center network and external cloud environments.

• Container and microservices networking: Alkira does not implement container network interfaces (CNIs), service meshes, or ingress controllers for container and Kubernetes networking.

• Content-aware traffic processing: While Alkira has visibility over traffic at Layer 7, it does not currently include features such as HTTP routing, gRPC, Kafka, or other protocols for routing traffic based on content. 

Purchase Considerations
Alkira’s cloud networking product is consumed in an as-a-service manner and is available to be purchased from cloud marketplaces. Alkira operates its own network backbone, which means better control, observability, and security for traffic routed among environments. It is one of the few vendors whose solution can deliver both NaaS and cloud networking requirements.

Use Cases
The solution is suitable for a variety of use cases that include multicloud networking, hybrid cloud networking, and NaaS connectivity. The drag-and-drop interface makes user onboarding easy and reduces time-to-value.

Arista: Arista Extensible Operating System (EOS), CloudVision

Solution Overview
Arista offers a comprehensive cloud networking solution via its Cloud Extensible Operating System (CloudEOS) and CloudVision. CloudEOS, Arista’s multicloud and cloud-native networking operating system, delivers a secure and reliable networking experience. To ensure scalability and automation, CloudEOS integrates with CloudVision, a multidomain network management solution built around telemetry, analytics, and automation principles. 

CloudEOS integrates with tools such as Terraform, Ansible, Puppet, and Chef and supports streaming receiver solutions like the ELK stack and Prometheus. These enable CloudEOS users to declaratively provision and configure public cloud environments.

Arista also developed AVA, an AI-enabled decision support system that is integrated in the Arista EOS stack. AVA uses a chat-like interface and natural language processing to assist even a junior analyst to accomplish tasks such as configuring, troubleshooting, and analyzing policy configurations. 

Arista is positioned as Challenger and Forward Mover in the Maturity/Platform Play quadrant of the cloud networking Radar chart.

Strengths
Arista scored well on a number of decision criteria, including:

• Observability and optimization: Arista’s CloudVision provides a consistent operational model across domains that helps simplify network operations with a single orchestration tool. It has integrated machine learning (ML) technologies that can help with alert definitions based on dynamically learned deviations from a reachability or latency baseline. It also monitors resource utilization trends and associated telemetry to make predictive assessments.

• Data center networking: Arista can enable multicloud path optimization using dynamic path selection based on changing network conditions, prioritizing production traffic over noncritical traffic, and providing control over networking policies. To achieve this optimization, CloudEOS instances autodiscover the available paths to others and automatically establish IPsec-based data plane encryption. For optimized forwarding and dynamic path selection, CloudEOS measures delay, latency, loss, and bandwidth for each potential path, then applies this data in real time to determine which path to use.

• Secure traffic and segmentation: Arista supports both macrosegmentation and microsegmentation. Microsegmentation involves inserting services in the path of inter-VM traffic by defining policies in an overlay or virtualization controller for each individual workload. In contrast, macrosegmentation provides segmentation by inserting services between workgroups in the physical network.

Opportunities
Arista has room for improvement in a few decision criteria, including:

• Content-aware traffic processing: Arista does not offer Layer 7 functions, such as content-aware load balancers, as part of its cloud networking solutions and does not facilitate service-to-service communication.

• Networking policy definition: Arista does not offer drag-and-drop canvases or policy definition using configuration files such as YAML, HELM, or JSON. It does not support out-of-the-box policies, policy visualizers, or tiered policies.

• Application-to-application connectivity: Arista does not provision the networking constructs behind the scenes, and the operators provide only a source and a destination address, such as an IP address, application, service, or label or tag.

Arista is classified as a Forward Mover due to few year-on-year developments and a slow feature release cadence. 

Purchase Considerations
CloudVision is licensed as a subscription that includes software and support for managing a particular device or instance under management. Arista’s cloud networking products are also available for data center networks, enabling customers to use a single solution to manage on-prem data center and cloud networks. 

Use Cases
Arista’s solutions can deliver on multiple use cases, including multicloud, hybrid cloud, and container networking. Customers with an on-prem Arista footprint can expand their management plane to include cloud networks across different architectures.

Arrcus

Solution Overview
The Arrcus flexible multicloud networking solution, FlexMCN, delivers a scalable edge, hybrid, and multicloud network overlay that helps enterprises and telcos extend their on-prem data center network fabric to the edge and to multicloud scenarios. FlexMCN supports multitenancy with RBAC, allowing CSPs, colocation providers, and telcos to offer multicloud connectivity as a managed service. 

The Arrcus FlexMCN platform consists of ArcOS, ArcEdge, ArcOrchestrator, and ArcIQ. ArcOS is a microservices-based network operating system that can be deployed as a VM on a hypervisor, as a container, on whitebox hardware, or on accelerators like SmartNICs to provide routing and switching fabric capabilities in the data center and at the edge. ArcEdge is the control and data plane element that provides hybrid and multicloud connectivity and can be deployed on-prem, at the edge, or in the cloud. It can be deployed as a VM or container, or on accelerators like SmartNICs.

ArcOrchestrator is the management plane used to manage and orchestrate the deployment of ArcEdges across cloud or on-prem environments. ArcOrchestrator is a modern orchestrator that dramatically simplifies and secures cloud connectivity with hyperscale performance. Lastly, ArcIQ is a network visibility and analytics platform that provides real-time views of the networks and devices with actionable insights for incident management and troubleshooting.

A differentiating feature for Arrcus’s FlexMCN is its patented cost management technology, Egress Cost Control (ECC), which provides visibility and allocation of egress costs for enterprise business units, as well as dynamically and intelligently allocating traffic to be routed to regions with the lowest egress costs. Given a source and a destination in any geolocation and across cloud providers, FlexMCN’s proprietary solution finds the single-hop and multiple-hop links that minimize egress charges. Administrators should deploy ArcEdge in these intermediate hop locations to route the traffic. 

Arrcus offers a comprehensive networking solution with a set of differentiating features. These innovations span both business use cases such as cost management and engineering use cases, such as implementing SRv6 Flex Algo.

Arrcus is positioned as a Leader and Fast Mover in the Maturity/Platform Play quadrant of the cloud networking Radar chart.

Strengths
Arrcus scored well on a number of decision criteria, including:

• Secure traffic and segmentation: Arrcus supports a wide range of segmentation methodologies, including access control lists (ACLs), virtual routing and forwarding (VRF), virtual local area network (VLAN), subnet, Layers 4 to 7 service insertion, security groups, and next-generation firewall (NGFW). Separation at the VRF/VLAN level allows a single ArcEdge to provide microsegmentation. Cross-cloud segmentation can be delivered by redirecting east-west and north-south traffic to a firewall where Layer 3, Layer 4, and Layer 7 inspection, decryption and encryption, and content filtering are performed, with traffic routed back to ArcEdge before being sent on to its destination.

• Content-aware traffic processing: Arrcus’ FlexMCN supports Layer 7 routing and load balancing with SRv6 FlexAlgo. It can differentiate between application traffic, such as HTTP or secure sockets layer (SSL), based on port and protocol at Layers 3 and 4 and using SRv6 segment identifiers at Layer 7. ArcEdge can encapsulate and decapsulate encrypted packets and uses equal-cost multipath routing (ECMP) to load balance traffic among multiple links.  

• Observability and optimization: Arrcus’ ArcIQ is a deep visibility analytics platform that offers predictive analytics and actionable insights. It provides network-wide visibility over network traffic, including the cryptographic resource public key infrastructure-based route origin validation that prevents malicious routes from being injected in a network. Users can configure network traffic thresholds and alerts so network operations teams receive notifications in near real time. Further, ArcIQ can be easily integrated with third-party tools such as PagerDuty and ServiceNow. 

Opportunities
Arrcus has room for improvement in a few decision criteria, including:

• Application-to-application connectivity: While Arrcus customers can define application characteristics such as high bandwidth or low latency requirements, the solution does not support application-aware features such as application discovery, app-to-app connectivity, or content-aware load balancing.

• Container and microservices networking: The solution can provide routing for Kubernetes clusters, but it does not implement service meshes or ingress controllers to handle networking for containers and Kubernetes.

• Workload authentication and authorization: Arrcus currently supports certificate- and JWT-based authentication, but it does not support mTLS or the SPIFFE and SPIRE frameworks, which are used for bidirectional authentication between entities that need to communicate.

Purchase Considerations
The Arrcus portfolio is available in the form of an annual subscription license. Enterprises and service providers can purchase bundles or buy any component a la carte. While the scope of this cloud networking report mainly relates to connecting services within and across environments, Arrcus’s networking solution is a core component of cloud and data center infrastructure that supports use cases such as data center networking for AI workloads.

Use Cases
Arrcus FlexMCN is suitable for large enterprises, CSPs, colocation providers, and telcos that need to extend their on-prem networks to multicloud environments and deliver multicloud connectivity as a managed service to enterprises. 

Aviatrix: Aviatrix Cloud Networking Platform

Solution Overview
Aviatrix is a household name in the multicloud networking space, with a comprehensive solution that ranks high on various criteria described in this report, including secure traffic and segmentation, observability, optimization and autoscaling, and solution management. With this platform, organizations can leverage a consistent deployment and operating model across enterprise multicloud networks, eliminating the need to use tools and services specific to individual CSPs.

Aviatrix offers strong multicloud networking and security capabilities that enable enterprises to design, configure, and operate cloud networks across multiple environments with ease.

Aviatrix Gateways can be deployed to deliver transit network and security services such as intelligent dynamic routing, active-active network configurations, end-to-end and high-performance encryption, and the collection of operational visibility data. They can also be deployed to provide distributed filtering services or replace native cloud provider network address translation (NAT) gateways.

Aviatrix offers a comprehensive networking solution and delivers on all emerging technologies described in the report, namely cost optimization, eBPF, and workload authentication and authorization.

Aviatrix is positioned as a Leader and Fast Mover in the Maturity/Platform Play quadrant of the cloud networking Radar chart.

Strengths
Aviatrix scored well on a number of decision criteria, including:

• Secure traffic and segmentation: Aviatrix offers strong security features, including multicloud segmentation, which extends secure network segmentation beyond cloud boundaries, enabling multicloud security domains with consistent, centrally managed global network segmentation and connection policies. In May 2023, Aviatrix released Distributed Cloud Firewall, a feature that embeds network security features into the cloud network data plane. It distributes both inspection and policy enforcement into the natural path of application traffic, eliminating the need to redirect traffic to centralized firewalls or other network security services.  

• Observability and optimization: Aviatrix provides a global operational view of multicloud networks. Its copilot management interface has comprehensive capabilities that support Day 2 activities for NetOps and DevOps teams, with features such as dynamic topology mapping, analysis of global network traffic flows using FlowIQ, and global heat maps and time-series trend charts that can help pinpoint and troubleshoot traffic anomalies. Aviatrix CoPilot also provides visibility into security services, offering end-to-end features such as resource tagging, resource clustering, infrastructure monitoring, and alerting, all purpose-built for multicloud operations. 

• Networking policy definition: Aviatrix’s centralized controller is the main interface for the solution, providing a browser-based GUI that offers a visual method for configuring and deploying cloud-native networking constructs and advanced services across multiple clouds. The solution integrates with Terraform, enabling network and security IaC automation in multicloud environments. A key feature of Aviatrix’s Terraform integration is the ability to export existing configurations as populated Terraform files, giving DevOps and NetOps teams the best of both worlds: a visual builder and code-based scalability. Aviatrix also supports DevOps processes through change and revision control by providing fully documented REST APIs.

Opportunities
Aviatrix has room for improvement in a few decision criteria, including:

• Data center networking: Aviatrix is not able to manage networks inside on-prem data centers. However, the solution can support connectivity between the edge of the data center network and external cloud environments.

• Content-aware traffic processing: Aviatrix offers some content-aware capabilities, such as deep packet inspection (DPI), but does not offer features such as Layer 7 load balancing, application delivery controllers (ADCs), or observability into the content and context of application transactions like HTTP requests and responses, database queries, and RPC calls.

• Container and microservices networking: Aviatrix does not implement CNIs, service meshes, or ingress controllers to handle networking for containers and Kubernetes. However, it can read the Kubernetes API and dynamically reconcile SmartGroups with live pod and namespace information to dynamically react to Kubernetes changes for security policy.

Purchase Considerations
Aviatrix’s solution is agentless and delivered in an as-a-service model. The solution can be used for improving network spend compared to public cloud native appliances by using the Aviatrix distributed cloud firewall and NAT features.

Use cases
Aviatrix can support a wide range of cloud networking use cases, which include multicloud and hybrid cloud. It integrates with Equinix Network Edge and Megaport, which can give customers private connectivity between clouds and on-prem environments.

Cisco*

Solution Overview
Cisco’s networking solutions are present in almost all networks, so it is unsurprising that the vendor would expand its capabilities to cloud networking. Cisco can deliver multicloud and hybrid cloud connectivity as follows. For multicloud networking, Cisco offers a tightly integrated solution made up of Cisco Cloud Network Controller or CCNC (previously Cisco Cloud APIC), Cisco Nexus Dashboard Orchestrator, and Cisco Catalyst 8000v. 

For hybrid cloud connectivity, Cisco provides on-prem switching, network policy, and configuration using Cisco Nexus 9000 Series Leaf and Spine switches, Application Policy Infrastructure Controller (APIC), and Nexus Dashboard Fabric Controller (NDFC).

The Cisco Cloud Network controller, along with the Cisco Nexus Dashboard Orchestrator, provides, among other functionalities, automated connectivity for multicloud network environments, operational visibility, Layer 4 to Layer 7 service integration and traffic redirection, consistent security and segmentation on on-prem-to-cloud or cloud-to-cloud networks, and business continuity and disaster recovery.

Cisco is positioned as a Challenger and Fast Mover in the Maturity/Platform Play quadrant of the cloud networking Radar chart.

Strengths
Cisco scored well on a number of decision criteria, including:

• Application-to-application connectivity: Cisco’s application-to-application connectivity allows the solution to define the application tiers and provide rules to classify application workloads into various policy groups. Based on the configured policy, the solution automates the connectivity by configuring the necessary route tables and security group rules to enable application workloads to communicate with each other. 

• Data center networking: Cisco’s CCNC enables organizations to build hybrid cloud networks by extending their network across on-prem and public clouds. The solution supports hybrid cloud connectivity, abstracts and orchestrates different cloud constructs and languages, and enables connectivity between clouds with consistent security and segmentation.

• Content-aware traffic processing: The solution operates at Layer 7 to discover and map application topology, observe application performance, and provide content-aware load balancers and firewalls.

Opportunities
Cisco has room for improvement in a few decision criteria, including:

• Observability and optimization: Cisco’s troubleshooting and diagnostics capabilities are available only for on-prem and colocation deployments and don’t extend to hybrid or multicloud environments. 

• Container and microservices networking: Cisco currently offers a limited set of native container networking capabilities. However, following the acquisition of Isovalent, Cisco will inherit the extensive feature set of Cilium and Isovalent Enterprise for Cilium. This iteration of the report evaluates the Cisco and Isovalent products separately.

• Network policy definition: While Cisco’s Cloud Network Controller solution can capture intents and translate them into native policy constructs for applications deployed across various cloud environments. It translates policies into cloud-native constructs using public APIs to create a single, consistent policy abstraction across multiple on-prem and public cloud instances. 

Purchase Considerations
Cisco’s acquisition of Isovalent and Valtix will provide access to more extensive security and container networking capabilities. Buyers should evaluate how these vendors’ features have been integrated into the Cisco portfolio and whether these features are available in CCNC and APIC.

Use cases
Cisco can deliver a wide range of use cases, but its strengths lie particularly in its extensive data center and enterprise networking portfolio, which, when combined with public cloud networking features, can deliver very comprehensive hybrid cloud networking.

Cohesive Networks: VNS3 Network Platform

Solution Overview
Cohesive Networks’ VNS3 Network Platform is used to build a network overlay to, through, and across an organization’s cloud infrastructure, integrating with their data centers, carriers, and customers. 

VNS3 is an API-driven cloud controller that allows users to define network topology and secure data across public and private clouds. It is a virtual router, switch, firewall, protocol redistributor, and SSL/IPSec VPN concentrator. The network virtualization software creates a customer-controlled overlay network on top of the underlying network backbone.

Each customer gets a fully isolated and encrypted compute subnet. The VNS3 controllers are connected to VNS3:ms, a management console used for alerting, backups, admin access management, and visibility into the network. VNS3:ms enables administrators to manage their network’s connectivity, security, and admin controls. It provides full visibility into the network topology and the ability to manage and automate backups and to architect for high availability.

VNS3:ms stitches together all the component identification information surfaced by the cloud provider into a single page, providing details such as addresses, routes, and ACL and security group rules for the VLAN and the instance running in the VLAN. Once a controller has been added to a VNS3 topology that is part of a virtual network, clients will have visibility over infrastructure health, network topology, controller configurations, peering information, client status, local IPsec tunnels, route tables, and high-availability configurations. 

VNS3 offers Terraform and CloudFormation templates, as well as an API to configure the network using your language of choice. Moreover, VNS3 operates as a network edge plug-in that can run any containerized function in the path, allowing full customization of network edges. This functionality can support use cases such as edge-hosted intrusion detection, load balancing, and monitoring.

Cohesive Networks is positioned as a Leader and Outperformer in the Maturity/Platform Play quadrant of the cloud networking Radar chart.

Strengths
Cohesive Networks scored well on a number of decision criteria, including:

• Secure traffic and segmentation: The solution can define network segments across intra-cloud, multicloud, and hybrid cloud environments, along with microsegments. The VNS3 network platform can create an over-the-top network composed of licensed, configured devices that form the backbone and can run in any virtual environment. 

• Content-aware traffic processing: It supports Layer 7 load balancing through integrations with ingress load balancers such as NGINX and HAProxy, providing SSL/TLS termination and content-aware traffic distribution for optimized application delivery. It also supports deep packet inspection, can act as an application load balancer, and can enforce policies based on DNS and fully qualified domain name (FQDN).

• Network policy definition: Cohesive Networks supports policy definition via GUI, API, and IaC and can integrate with tools such as CloudFormation, Chef, Puppet, Ansible, and Terraform. The solution’s built-in endpoint firewall supports import and export with JSON, as well as a number of plugins that independently consume JSON.

Cohesive Networks is classified as an Outperformer due to its recent releases around security features and integrations, along with an extensive development pipeline of LLM-related features.

Opportunities
Cohesive has room for improvement in a few decision criteria, including:

• Container and microservices networking: Cohesive Networks supports container and microservices networking using third-party and open source products, such as NGINX, but does not offer these capabilities natively.

• Observability and optimization: While the solution offers administrators full visibility into network topology and the ability to manage and automate backups and architect for high availability, it does not currently offer features such as self-healing or automatically populating tickets with incident data.

• Data center networking: VNS can be deployed as virtual networking appliances in a data center, but it does not currently have features such as private network backbones for DC-to-cloud connectivity or integrations with data center networking products like Cisco ACI.

Purchase Considerations
Cohesive Networks uses its existing VNS3 architecture to deliver SASE services, including partner, workforce, and customer connectivity, on-prem-to-cloud connectivity, and multicloud API connectivity.

Use Cases
VNS3 can deliver on a wide range of use cases that include multicloud connectivity, data center connectivity, network segmentation, and end-to-end encryption. The solution is particularly suitable for environments with strict uptime SLAs and high availability requirements.

emma

Solution Overview
The name emma stands for “enterprise multicloud management application” and describes a solution that delivers cloud networking capabilities as part of a wider cloud management platform. This “cloud networking baked into cloud management” is a distinctive approach, and the vendor also operates its own multicloud network backbone, a feature that’s available only from a select group of vendors in this report.

emma offers a managed solution, which means some of the features evaluated are not exposed to end customers but rather enforced by emma on behalf of those customers. 

Customers can deploy virtual appliances from third-party vendors such as Juniper Networks, Check Point Software, Palo Alto Networks, and Cisco, with the solution enabling service chaining, allowing traffic to be strategically directed through these appliances. These third-party services, alongside other security and observability tools, are available in the emma marketplace.

The solution incorporates preconfigured network architectures, encompassing VPCs, peerings, and direct connects. This architecture is abstracted away from the customer, providing a streamlined, user-friendly experience without compromising the efficiency or capabilities of the underlying network infrastructure.

Administrators can define routing and security policies (such as specifying data flow within the network, access controls, and encryption) and manage security groups to regulate internet access and intra-compute communication. The solution supports the definition of policies for multicloud and hybrid cloud traffic flows, ensuring consistent and secure network configurations across diverse cloud environments. Administrators define and manage routing tables based on traffic patterns, configure high availability setups, and set up automated failover mechanisms to redirect traffic and maintain service continuity in case of failures.

emma is positioned as a Challenger and Fast Mover alone in the Innovation/Platform Play quadrant of the cloud networking Radar chart.

Strengths
emma scored well on a number of decision criteria, including:

• Application-to-application connectivity: emma supports automated provisioning of networking resources, such as VMs, storage, and network configurations, to establish connectivity between specified source and destination addresses. The solution can discover compute or storage infrastructure and discover and map applications and services. 

• Observability and optimization: It can monitor networks in real time and uses an AI engine to analyze the behavior of workloads and predict further changes in network consumption and utilization. Some observability and optimization features include global load balancing and DPI.

• Cost optimization: emma offers extensive cost optimization features that can be used to monitor networking spend, cost forecasts based on traffic levels, and cost versus performance traffic routes. The solution provides visibility into the costs associated with network resources, allowing users to track expenses, identify cost drivers, and optimize resource allocation. By analyzing historical data and current usage patterns, the platform provides predictions and estimates of future costs. It also provides features to optimize cost versus performance considerations in traffic routing. This involves intelligent routing decisions based on cost metrics and performance requirements. For example, it dynamically routes traffic through more cost-effective pathways while ensuring performance meets specified criteria. 

Opportunities
emma has room for improvement in a few decision criteria, including:

• Content-aware traffic processing: emma does not natively offer features such as Layer 7 load balancing, deep packet inspection (DPI), ADCs, or observability into the content and context of application transactions such as HTTP requests and responses, database queries, and RPC calls, but these capabilities can be implemented from third parties via the emma eStore. 

• Secure traffic and segmentation: While emma supports features such as multicloud segmentation, it does not support microsegmentation or dynamic segmentation.

• Data center networking: emma is not able to manage networks within on-prem data centers. However, the solution can support connectivity between the edge of the data center network and cloud environments.

Purchase Considerations
Considering emma offers a full-stack infrastructure management platform, the solution can deliver on the end-to-end management requirements of an entire organization. While an all-in-one approach is not entirely suitable for multinational enterprises, small-to-medium organizations can take full advantage of the platform’s benefits. 

Use Cases
emma’s solution is suitable for multicloud and hybrid cloud approaches but most notably, emma is one of the few vendors that focuses on integrating with edge service providers and content delivery networks (CDNs). 

F5

Solution Overview
Following F5’s 2021 acquisition of Volterra, Volterra’s cloud networking solution became part of F5 Distributed Cloud Services, which delivers a comprehensive cloud networking solution via Distributed Cloud Network Connect and Distributed Cloud App Connect. What differentiates F5 from other product-based entrants in the cloud networking space is its global private fiber network backbone and comprehensive set of networking functions, which allow the vendor full control over the performance and delivery of services without dependencies on third parties. F5’s cloud networking solutions provide integrated services from Layer 3 to Layer 7. 

F5 offers a comprehensive networking solution with differentiating features enabled by its acquisition of best-of-breed providers. The solution also focuses on emerging technologies such as workload authentication.

F5 is positioned as a Leader and Outperformer in the Maturity/Platform Play quadrant of the cloud networking Radar chart.

Strengths
F5 scored well on a number of decision criteria, including:

• Secure traffic and segmentation: F5 secures inbound traffic with native DDoS protection, Layers 4 and 7 firewalls, and API protection before the load balancer for each service at Layers 3, 4, or 7 forwards the request. In the workload, microsegmentation policies are either applied automatically via native Kubernetes service discovery or manually configured for each load balancer service at the origin. The solution supports end-to-end network segmentation across hybrid and multicloud environments, helping customers separate their environments from one another.

• Observability and optimization: F5’s Distributed Cloud Mesh performs Layer 7 load balancing for HTTPS as an ingress/egress controller and for REST APIs as an API gateway. Distributed Cloud Mesh nodes are provisioned automatically and installed on a public cloud, deployed as VMs on a private cloud and data center, or installed as industrial-grade off-the-shelf hardware for edge. 

• Application-to-application connectivity: F5 offers observability at multiple levels of information density, from global site interconnections down to individual flows per microservice and per application. Application endpoints and structure are detected automatically and displayed on a topological map showing endpoints, interconnections, microservice response times, and API request call stacks through microservices. Application topology is provided by API discovery to map connections among nodes inside the service mesh, including health stats per microservice.

F5 is classified as an Outperformer due to recent developments like including CEs on the Equinix marketplace and introducing the F5 AI Assistant, which provides a natural language interface for querying issues on the platform.

Opportunities
F5 has room for improvement in a few decision criteria, including:

• eBPF: With the recent acquisition of eBPF-based observability provider MantisNet, F5 is expected to integrate these capabilities natively in the Distributed Cloud portfolio.

• Data center networking: Though F5 can connect cloud to on-prem environments and orchestrate policies, it does not offer appliances or network operating systems that can be deployed in on-prem data centers.

• Networking policy definition: While F5 offers strong policy definition features, including GUI, CLI, and API, it could improve by implementing tiered policies and natural language-based policy definition. 

Purchase Considerations
F5’s Distributed Cloud platform delivers capabilities beyond cloud networking, including web application and API security, application delivery controllers, and edge compute.

Use Cases
The F5 solution caters to a variety of use cases, including multicloud and hybrid cloud networking, container networking, and intercloud connectivity using a private backbone. Between the distributed cloud portfolio, BIG IP, and NGINX, F5 can deliver to most enterprise IT networking use cases.

HPE Juniper Networking: Cloud-Native Contrail Networking (CN2)

Solution Overview
HPE Juniper Networking delivers cloud networking capabilities through the newly released Cloud-Native Contrail Networking (CN2), which ranks high on the secure traffic and segmentation and observability and optimization key features. CN2 is a cloud-native SDN solution that automates the creation and management of virtualized networks to connect, isolate, and secure cloud workloads and services seamlessly across private and public clouds.

CN2 features a cloud-native analytics stack that automates network design, deployment, monitoring, management, and security from a single point of operations. The portal supports RBAC, giving network administrators full access to the tools and resources needed to design, deploy, manage, and monitor network services, while providing limited access to other users.

HPE Juniper Networking is positioned as a Challenger and Forward Mover in the Maturity/Platform Play quadrant of the cloud networking Radar chart.

Strengths
HPE Juniper Networking scored well on a number of decision criteria, including:

• Secure traffic and segmentation: HPE Juniper Networking Cloud-Native Contrail Networking™ (CN2) uses the vRouter forwarding plane for high performance routing and microsegmentation. There are several different isolation models, including network policies, custom pod networks, and isolated namespaces. The vRouter has built-in distributed Layer 3 and Layer 4 firewall capabilities that allow users to define simple and abstract security policies for virtual networks, as well as NGFWs for Layer 7 traffic filtering. 

• Observability and optimization: The solution offers an optional and configurable analytic module for monitoring and troubleshooting. CN2 provides enhanced observability with plug-and-play usability for some of the most popular open source projects like Prometheus, InfluxDB, Grafana, FluentD, and ElasticStack for ease of use, platform flexibility, and low cost. CN2 also offers ECMP load balancing built into the vRouter’s forwarding plane, distributing traffic across endpoints such as virtualized firewalls. In addition, the solution provides an application-layer load-balancing function for content-aware traffic optimization.

• Data center networking: The solution is a virtual appliance that can be deployed in data center networks and enforce the same cloud network policies to on-prem data centers.

Opportunities
HPE Juniper Networking has room for improvement in a few decision criteria, including:

• Application-to-application connectivity: The solution can handle routing tables and forwarding information bases that map application traffic flows to underlying network paths, but it does not support application-aware features such as application discovery, app-to-app connectivity, or content-aware load balancing.

• Networking policy definition: It can automate network design, deployment, monitoring, management, and security, but it does not offer a drag-and-drop builder, policy simulations, or tiered policies.

• eBPF: HPE Juniper Networking offers only basic eBPF-based networking implementations in CN2 to support Kubernetes networking. 

HPE Juniper Networking is classified as a Forward Mover due to limited year-over-year developments and a slow feature release cadence. 

Purchase Considerations
The Juniper Networks acquisition by HPE has recently closed, so we expect its cloud networking products will become integrated in the wider HPE portfolio alongside HPE Aruba Networking products. While there isn’t any overlap between the HPE Juniper Networking and HPE Aruba Networking products for cloud networking, buyers should consider any changes or updates to licensing and consumption models.

Use Cases
HPE Juniper Networking can cater to a wide range of use cases, including multicloud, hybrid cloud, and container networking. With extensive data center, wired and wireless local area network (LAN), and service provider-oriented products, Juniper has one of the widest range of use cases in the networking space.

IBM: Hybrid Cloud Mesh*

Solution Overview
IBM Hybrid Cloud Mesh is a cloud networking solution released in 2023. Delivered as SaaS, it offers multicloud, multicluster, application-centric connectivity.

The solution provides an overlay network managed by software gateways. These are automatically deployed to manage application and service endpoints. The software gateways are deployed like appliances in their own VM, close to application and service deployments. The software gateways provide an overlay addressing scheme that ensures packets entering the overlay are delivered to the correct service instances. 

The solution supports automated, on-demand, intent-driven, application-centric connectivity by inferring network requirements from business intent. In future releases of the product, the solution’s intent-driven, policy-based traffic engineering and network optimization will assign traffic flows to network paths based on data transmission costs, application service-level agreements (SLAs), network status, and current traffic conditions. 

IBM is positioned as an Entrant and Forward Mover alone in the Maturity/Feature Play quadrant of the cloud networking Radar chart. 

Strengths
IBM scored well on a number of decision criteria, including:

• Application-to-application connectivity: IBM can identify and map associated applications and services. Upon creating an inventory of an enterprise's points of connectivity, the solution enables DevOps-driven policy intents to describe application and service connectivity. Leveraging awareness of applications and services, administrators can write simple policies that express the intent to connect endpoints wherever they are. These policies are enforced by the solution’s software gateway appliances. 

• Observability and optimization: IBM supports infrastructure discovery by creating an inventory of an enterprise's multicloud deployment infrastructure. The discovery process can take place at regular intervals to maintain a current model of an enterprise’s cloud infrastructure. The solution uses infrastructure models to correlate applications and services with their supporting infrastructure. Examples of infrastructure include VPCs, Kubernetes clusters, security groups, and others. Hybrid Cloud Mesh’s security capabilities include end-to-end encryption and policy controls that can define microsegments. 

• Container and microservices networking: IBM’s Mesh automatically configures software-defined networks (SDNs) for microservices-based applications. It creates an overlay network that abstracts and provisions the virtual networks supporting AWS, Microsoft Azure, and Google Cloud. Applications and services are the main points of connectivity in Mesh. For example, an application in the Store Kubernetes namespace that requires connectivity to a service in the Inventory Kubernetes namespace depends on Mesh being aware of the deployment location of both the application and service, even as their deployment locations change over time.

Opportunities

IBM has room for improvement in a few decision criteria, including:

• Content-aware traffic processing: IBM does not offer features such as Layer 7 load balancing, DPI, ADCs, or observability into the content and context of application transactions like HTTP requests and responses, database queries, or RPC calls.

• Data center networking: IBM’s solution cannot manage networks inside on-prem data centers, but it can handle requests made to on-prem workloads.

• Secure traffic and segmentation: While IBM supports end-to-end encryption between workloads, it does not support microsegmentation, dynamic segmentation, or cross-environment segmentation.

IBM is classified as a Forward Mover due to few year-over-year developments and a slow feature release cadence. 

Purchase Considerations
IBM provides a good point solution for connecting applications and services within and between cloud environments. It offers a broad portfolio of networking products, including gateway appliances, IBM Cloud Direct Link, and IBM Cloud Load Balancers.

Use Cases
The solution’s primary use case is application-to-application connectivity in multicloud environments. Its intent-based approach makes it easy for DevOps teams to provision the underlying network infrastructure that connects their applications. 

Isovalent (Cisco): Isovalent Networking for Kubernetes

Solution Overview
Isovalent Networking for Kubernetes is an enterprise distribution of the Cilium open source project, which was initially created by Isovalent and later donated to the Cloud Native Computing Foundation (CNCF). Cilium provides networking, security, and observability for cloud-native environments such as Kubernetes and multicloud networking architectures. It can run natively in any Kubernetes environment, operate as a virtual appliance in the form of a transit gateway, or run in the form of an agent on VMs and servers. Connectivity is provided at both the networking (Layer 3 to Layer 4) and service mesh levels (Layer 7). Isovalent was acquired by Cisco in April 2024.

The solution caters to DevOps audiences through integrations with IaC tools such as GitOps, Terraform, and Ansible. CI/CD integrations are typically used to define load-balancing, network policy, and egress gateway needs. All routing and networking intent can be defined via YAML or JSON and can be automatically generated or maintained via a CI/CD pipeline. All configuration aspects of Cilium, such as load balancing, network policy, mesh connectivity, egress policies, and VRF configuration are declarative and intent based. 

Isovalent stands out from the rest of the vendors featured in this report due to its eBPF-first and Kubernetes-first approach. The vendor is highly innovative and focuses on both the eBPF and workload authentication emerging features.

Isovalent Load Balancer was announced at Cisco Live 2025 and is designed to provide a high-performance, eXpress Data Path (XDP)-based Layer 4/Layer 7 load balancer. This is a software-based load balancer built on the foundations of eBPF and Cilium, with cloud-native programmability.

Isovalent is positioned as a Leader and Outperformer alone in the Innovation/Feature Play quadrant of the cloud networking Radar chart. 

Strengths
Isovalent scored well on a number of decision criteria, including:

• Secure traffic and segmentation: Isovalent provides identity-based segmentation across public cloud, on-prem, and Kubernetes environments regardless of whether networks are logically connected. Cilium’s network policy enforcement engine implements segmentation and microsegmentation by natively understanding public cloud provider concepts such as security groups and Kubernetes metadata. The policy enforcement layer is able to operate at Layers 3 through 7 and enforces a strong security identity-based layer with optional support for mTLS-based mutual authentication.

• Observability and optimization: Isovalent Networking for Kubernetes is able to detect a wide range of network degradation events, including drops, policy violations, retransmissions, network latency measurements, TCP zero-window events, continuous data delivery to application monitoring, detection of TCP timeouts, identification of routing loops, and DNS failures. The solution can detect various known traffic anomalies such as routing loops, maximum transmission unit (MTU) issues, mismatched encryption keys, and repeated DNS resolution failures. Failures are automatically recovered from by recreating data path functionality, automatic leader reelection of control plane components, and high availability of egress and DNS proxies and gateways.

• Container and microservices networking: Isovalent can establish connectivity among applications, containers, Kubernetes pods, VMs, and bare metal servers using an embedded agent or network transit gateway. Isovalent Enterprise for Cilium offers Layer 7 load balancing and extensive service mesh capabilities. The solution has full Layer 7 observability and can provide service and connectivity maps based on information composed at Layers 3 through 7. 

Isovalent is classified as an Outperformer given its extensive recent releases, including the load balancer.

Opportunities
Isovalent has room for improvement in a few decision criteria, including:

• Large dataset egress: While the recently released Isovalent Load Balancer can manage traffic to and from environments, the vendor does not currently offer capabilities for securely transferring large data volumes from multiple environments to a single destination. 

• Data center networking: Isovalent does not offer network operating systems or virtual appliances to support networking inside the data center. However, Cilium can support networking for on-prem Kubernetes environments and can support non-Kubernetes connectivity with additional configuration.

• Workload authentication and authorization: Isovalent provides a comprehensive authentication mechanism using mTLS and the SPIFFE/SPIRE framework but does not support out-of-the-box authentication using JWT.

Purchase Considerations
Cisco recently acquired Isovalent and will focus on Isovalent Networking for Kubernetes’s security capabilities. However, the product will remain distinct from Cisco’s data center and cloud networking capabilities, namely CNC, APIC, and NDFC.

Use Cases
As the creators and maintainers of the widely deployed CNI Cilium, Isovalent is particularly well suited for container networking. These features have been extended for multicloud and multicluster use cases, while Cilium Mesh can now also bring the features to hybrid environments.

VMware (Broadcom)

Solution Overview
VMware boasts an impressive portfolio of networking products that deliver comprehensive cloud networking capabilities, which are now an integrated component within its VMware Cloud Foundation (VCF) private cloud platform. VMware's networking portfolio consists of NSX Network Virtualization, Avi Load Balancer, vDefend Firewall, VCF Operations for Networks, VCF Automation, and integrated Istio Service Mesh. It ranks high on most key features in this report, such as secure traffic and segmentation, observability and optimization (with autoscaling), (including APIs and IaC integration), and app-to-app connectivity.

VMware Cloud Foundation includes a comprehensive networking solution that provides an end-to-end and fully featured stack from Layer 2 to Layer 7, supported by declarative APIs, integrations with IaC tools, and a low-code path for automation.

VCF’s main networking product, NSX, is a multicloud network virtualization and security solution that enables virtual cloud networking with a software-defined approach that extends across data centers, clouds, and application frameworks.

VMware is positioned as a Challenger and Fast Mover in the Maturity/Platform Play quadrant of the cloud networking Radar chart.

Strengths
VMware scored well on a number of decision criteria, including:

• Secure traffic and segmentation: VMware’s vDefend Distributed Firewall and Advanced Threat Protection modules provide a software-only Layer 7 firewall for both network segmentation and microsegmentation of east-west traffic. VMware’s vDefend Distributed Firewall supports both segmentation types in private, public, and multicloud environments. When operating in a public cloud environment, customers can use either the firewall's native controls or the controls provided by the public cloud for segmentation.

• Observability and optimization: VMware’s Tanzu and AON products offer multicloud monitoring suitable for DevOps teams, developers, and Kubernetes operators. The solution supports app discovery and baselining, application topology maps and traffic flows, historical and near-real-time metrics, and app-to-infrastructure correlation heatmaps that help discover root causes of application performance issues. Networking and VCF Operations for networks provide a native analytics engine that uses ML to offer suggestions and recommendations based on correlations between live and historical network traffic flows and compute workload inventory. 

• Content-aware traffic processing: VMware’s NSX includes an advanced load balancer that provides multicloud load balancing, application analytics, and container ingress services. It identifies virtual services that may degrade performance due to traffic conditions, provides autoscale load balancing capacity by spinning up new load balancer instances for the same virtual service, and automatically redistributes traffic. 

Opportunities
VMware has room for improvement in a few decision criteria, including:

• Networking policy definition: VMware Cloud Foundation’s networking offers the core methods of interacting with the product, namely using GUI, CLI, and APIs, but it does not provide drag-and-drop canvases or policy definition using configuration files such as YAML, HELM, or JSON. It does not support out-of-the-box policies, policy visualizers, or tiered policies.

• Data center networking: VMware Cloud Foundation’s networking can be deployed to operate networking in data center environments, but the vendor should consider offering private network backbones to connect on-prem environments with cloud environments.

Purchase Considerations
Broadcom’s acquisition of VMware may have an impact on the licensing and procurement of these solutions. New and existing VMware customers should consider how these solutions will be bought and delivered.

Use Cases
VMware’s solutions cater to a wide range of use cases that include multicloud, hybrid cloud, and container networking. The solution is particularly suitable for scenarios where customers use VMware for datacenter virtualization and need to connect with third-party infrastructure.

While multicloud networking is not a table stake (required feature) for inclusion in this report, it is one of the most sought-after capabilities. All vendors who support hybrid and multicloud networking ensure that both connectivity and services span the supported environments, including visibility, security, and network optimization. 

In the previous iteration of this report, we defined “application-aware infrastructure” as one of the most important criteria on which we observed different maturity levels. In this iteration, we have taken a more granular approach, defining both app-to-app connectivity (which includes other types of services that run in cloud and on-prem environments) and content-aware traffic processing as key features. As in the previous report, small and large vendors demonstrate varying capabilities in this area. Some enable cloud networking using Layer 4 constructs, while others deliver Layer 7 services. We expect increased focus on service performance and health, which will lead vendors to pursue delivery of Layer 7 capabilities such as service discovery, monitoring, content-aware load balancing, and traffic filtering. 

To drive this application-first mentality further, support for DevOps, declarative networking via integrations with IaC tools, and the availability of APIs are at the top of most providers’ lists. All vendors featured in this report offer comprehensive APIs and also include out-of-the-box integrations with Terraform, Ansible, Chef, Salt, and/or similar tools. 

Cloud networking solutions have an innate focus on Day 0 and Day 1 activities, enabling users to design and deploy new networks easily. This facilitation is achieved by using drag-and-drop visual builders, IaC tools, or guided setup wizards in the solution’s GUI. For Day 2 (operational) activities, we assessed vendors on their solution’s troubleshooting and diagnostics performance, which varies widely. Vendors with mature capabilities in this area offer ML algorithms for data analysis and predictive maintenance, which can be used to perform self-healing. Vendors with less mature capabilities offer only basic functions, such as setting up thresholds to trigger alarms when performance degrades.

With more cloud migrations on the horizon and more cloud-first companies and services entering the market, we expect the adoption of cloud networking to increase, largely because it enables organizations to take a more agile approach to infrastructure. Rather than being limited by physical networking, cloud networking enables developers to access the resources and services offered by all types of infrastructure providers for on-prem workloads, multiple public clouds, and an increasing variety of edge locations. As part of the application development process, developers will be able to spin up (and down) networking resources according to their own requirements, without low-level networking knowledge, creating a bespoke infrastructure that best serves the given application.

*Vendors marked with an asterisk did not participate in our research process for the Radar report, and their capsules and scoring were compiled via desk research.

For more information about our research process for Radar reports, please visit our Methodology.

Andrew Green is an enterprise IT writer and practitioner with an engineering and product management background at a tier 1 telco. He is the co-founder of Precism.co, where he produces technical content for enterprise IT and has worked with numerous reputable brands in the technology space. Andrew enjoys analyzing and synthesizing information to make sense of today's technology landscape, and his research covers networking and security.

GigaOm provides technical, operational, and business advice for IT’s strategic digital enterprise and business initiatives. Enterprise business leaders, CIOs, and technology organizations partner with GigaOm for practical, actionable, strategic, and visionary advice for modernizing and transforming their business. GigaOm’s advice empowers enterprises to successfully compete in an increasingly complicated business atmosphere that requires a solid understanding of constantly changing customer demands.

GigaOm works directly with enterprises both inside and outside of the IT organization to apply proven research and methodologies designed to avoid pitfalls and roadblocks while balancing risk and innovation. Research methodologies include but are not limited to adoption and benchmarking surveys, use cases, interviews, ROI/TCO, market landscapes, strategic trends, and technical benchmarks. Our analysts possess 20+ years of experience advising a spectrum of clients from early adopters to mainstream enterprises.

GigaOm’s perspective is that of the unbiased enterprise practitioner. Through this perspective, GigaOm connects with engaged and loyal subscribers on a deep and meaningful level.

© Knowingly, Inc. 2026 "GigaOm Radar for Cloud Networking" is a trademark of Knowingly, Inc. For permission to reproduce this report, please contact sales@gigaom.com.