Cisco Live 2026 dominated enterprise networking this week, and any honest read of the news cycle has to start there. The event — running Monday through Wednesday at Mandalay Bay in Las Vegas — was the largest stage Cisco has used in years to consolidate its AI-era narrative, and the company did not waste it. The anchor message was the arrival of what Cisco is calling the "agentic network": infrastructure that doesn't just surface telemetry or flag anomalies, but takes autonomous corrective action. Network World reported that Cisco launched an "agentic ops platform" alongside a security overhaul explicitly framed around the concept of AI agents running enterprise infrastructure alongside human operators. Computer Weekly captured Cisco's framing succinctly: a new platform that "allows customers to build their own apps and agents in natural language." Whether the actual product capabilities match the rhetorical ambition is a fair question — and TechTarget explicitly raised it this week, noting that Cisco's agentic AI security push "faces enterprise trust gap" because businesses' mistrust of AI "cuts both ways." That tension between Cisco's keynote ambitions and customer skepticism about autonomous AI in production networks is the most important counter-narrative available to Mist sellers right now.
This is the sixth consecutive week of tracking a compounding Cisco AI narrative. What began as thought leadership in early May has now been amplified through a CEO conference keynote, an earnings cycle, and now a full-scale customer event. The Cisco Live format matters: it is not a press release or an analyst briefing. It puts thousands of customers and partners in a room, surrounds them with demo stations and breakout sessions, and sends them home with Cisco's framing embedded in their evaluation criteria. Every enterprise buyer who attended Cisco Live this week will return to their office having absorbed Cisco's version of what an AI-native network looks like. Mist sellers will encounter that framing in customer conversations for the next six to eight weeks.
Alongside the keynote narrative, Cisco published a blog on Multicloud Fabric in Cloud Control, positioning it as a unified platform for connecting sites and clouds in the AI era. This is Cisco's broader strategic bet — that the network itself becomes the substrate for agentic AI workflows — and it is not a campus-specific claim. It spans data center, WAN, and cloud connectivity in a single commercial narrative. The risk for Mist sellers is that customers hear "Cisco can do all of this together" and treat fragmentation of vendors as a risk rather than a feature.
Everywhere else on the competitive map, it was a quiet week. Arista returned zero campus-relevant results for the fifth consecutive week. Extreme and Fortinet were similarly absent. The Tier 2 vendors produced no material enterprise networking news. The Pulumi provider for Juniper Mist continued its unbroken daily development cadence — now in its sixth consecutive week — with three confirmed builds this week (June 1, 3, 5, and 6). This remains the most consistently verifiable engineering investment signal across any vendor in this report's tracking period, but it is a developer-facing signal, not a customer-event-scale one.
Next week, Mist sellers should be preparing for customer conversations shaped entirely by Cisco Live content. The most important preparation is not a feature comparison — Cisco will win any feature-list argument framed on their own terms. The winning move is to redirect the conversation to implementation reality: what does "agentic networking" actually require to deploy, and where does Cisco's architectural complexity undercut its own AI story?
Cisco Live 2026 delivered the "agentic network" as Cisco's centerpiece enterprise narrative, with new agentic ops platform and security overhaul announced. This is now six consecutive weeks of compounding Cisco AI narrative, culminating in a customer-event-scale deployment of the message. So what: Every customer conversation next week will be colored by Cisco Live. Prepare a crisp, implementation-grounded response to "agentic networking" — not a feature list, but an honest architecture comparison. 🟡
TechTarget surfaced an "enterprise trust gap" in Cisco's agentic AI security push. Customers are skeptical that AI-autonomous network operations are production-ready. So what: This skepticism is your opening. Marvis's track record of years-in-production AI-driven operations (SLEs, Conversational Assistant, self-driving network features) is a concrete counter to aspirational Cisco keynote claims. Use it. 🟡
Cisco launched Multicloud Fabric in Cloud Control, framing its network as the unified substrate for AI-era multi-cloud connectivity. This is a cross-domain play spanning campus, WAN, and cloud. So what: Cisco will use this to argue that buying point solutions — including Mist — creates fragmentation risk. Prepare the counter: what does "unified" actually cost to deploy and operate, versus best-of-breed on a modern AI fabric? 🟢
Palo Alto Networks lifted its FY26 earnings forecast, citing accelerating AI security demand. Not a direct campus competitor, but it signals that security-integrated networking is where enterprise buyers are spending. So what: The Mist + Marvis + Mist Access Assurance narrative (identity + AI + campus) is increasingly relevant to buyers whose budgets are shifting toward security-integrated infrastructure. 🟡
Fortinet stock is up 87.5% YTD on AI security positioning, but has produced zero campus/branch product news for five consecutive weeks. The stock story and the campus product story are completely disconnected. So what: Fortinet-incumbent campus accounts are understaffed on product innovation attention. This window remains open. 🟡
Pulumi provider for Juniper Mist continued daily 0.11.0 alpha development cadence — six consecutive weeks, builds confirmed June 1, 3, 5, and 6. So what: For deals where platform engineering or NetOps automation teams have vendor selection influence, six weeks of daily public IaC commits is a credible proof of programmatic investment that competitors cannot match with equivalent evidence. 🟢
HPE's broader stock narrative is apparently moving on AI backlog signals (r/wallstreetbets thread on HPE earnings beat, r/stocks thread on "$5B AI backlog"). So what: HPE's financial momentum is a legitimate enterprise-sale confidence signal — use it to counter the "acquisition instability" narrative that Cisco is actively seeding in Aruba accounts. 🔴 [practitioner forum signal, unverified]
Product / Feature Announcements:
Cisco Live 2026 was the week's dominant event. Three substantive announcements are traceable from this week's research: 🟡
Agentic Ops Platform: Cisco announced what Network World described as an "agentic ops platform" — a system where AI agents can take autonomous corrective action on network infrastructure, not merely surface alerts. The Computer Weekly framing: "allowing customers to build their own apps and agents in natural language." Confidence on the specific capability: 🟡 (trade press coverage, not yet verified against Cisco product documentation in this research set).
Security Overhaul: Cisco announced what Network World called a "security overhaul" at Cisco Live, framed around agentic AI defenses. TechTarget reported that Cisco officials urged customers to "meet the Mythos moment" with new agentic defenses. Critically, TechTarget also reported an "enterprise trust gap" — customers are skeptical of AI autonomous action in security contexts. The trust gap is confirmed by a named publication with attribution. 🟡
Cisco Multicloud Fabric in Cloud Control: A Cisco blog post (official source) announced Cisco Multicloud Fabric as a "unified, secure, and on-demand global fabric that connects sites and clouds through a single, intelligent platform." 🟢 This is Cisco's attempt to position the network layer as the connective tissue across AI workloads, not just a transport layer.
Marketing Narrative:
The dominant Cisco Live narrative is "Cisco as the infrastructure layer for the agentic enterprise." This is broader than networking — it encompasses security, cloud connectivity, and AI agent orchestration. RCR Wireless, covering the channel angle, noted that for managed service providers the "real test remains simpler licensing, channel economics, and monetizable SMB value" — signaling that Cisco's grand narrative still has a channel operationalization problem. 🟡
The SiliconANGLE "Five takeaways" piece is in the research set but the body content is behind a summary snippet — full takeaways not available in this research.
Customer Wins / Channel / Pricing / Personnel:
None surfaced in this week's research beyond the Cisco Live event coverage.
Analyst Commentary:
TechTarget's "enterprise trust gap" framing is the most analytically useful piece this week. The argument that customer mistrust of AI "cuts both ways" — i.e., customers skeptical of adversarial AI are equally skeptical of autonomous defensive AI — is a genuine market signal, not just a Mist talking point. 🟡
Quiet week — fifth consecutive week with zero campus-relevant product, customer, or partner activity in the research set. The only Arista item surfaced was a Barchart financial story noting that Arista stock has outperformed the Nasdaq over the past year with analysts "highly optimistic" about its prospects. 🟡 This is a financial story, not a product or campus story. The disconnect between Arista's stock narrative and its campus product activity remains complete.
Quiet week — fifth consecutive week with zero campus-relevant results. No product, channel, customer, or event coverage surfaced. The post-Extreme Connect momentum referenced in prior weeks has not generated publicly trackable follow-through activity in this research set.
Quiet week — fifth consecutive week with zero campus/branch product news. The notable non-campus signal: Fortinet stock is up 87.5% year-to-date, attributed to AI security positioning (Yahoo Finance / Zacks). 🟡 This confirms the financial story continues to run independently of campus product investment. No campus Wi-Fi, switching, or SD-Branch announcements.
Nile (NaaS): No current-week news surfaced. However, the Market Education research set surfaced a FirstPassLab blog post (dated March 19, 2026) documenting Nile's announcement of native NAC and identity-based microsegmentation built directly into its Secure NaaS fabric — eliminating the need for standalone NAC appliances. This is not new this week but is directly relevant to the Section 12 deep dive and the competitive landscape context. 🟡 (trade press / blog, not verified against Nile official source)
Meter (NaaS): No relevant enterprise networking news surfaced. Search returns were entirely off-topic.
CommScope RUCKUS: Quiet week. No relevant results.
Huawei: No relevant results. International context: no enterprise networking announcements surfaced.
Tier 3 (ALE, H3C, Allied Telesis, TP-Link, Join Digital): No material news. No flags required.
Moves this week: No new Aruba product announcements, customer wins, or channel news surfaced in this week's research set. The only HPE-adjacent signal is Reddit activity around HPE's financial results — a r/wallstreetbets thread titled "HPE skyrockets 30% on biggest earnings beat since 2018" (posted within the past 6 days, 135 votes, 51 comments) and a r/networking thread titled "HPE Discover." 🔴 [forum signals, unverified claims]
Current narrative and customer reception: The Aruba Central / CX / ClearPass / EdgeConnect narrative has no new content to assess this week. The absence of Aruba-specific news is itself informative — Cisco Live has consumed the enterprise networking news cycle, and Aruba produced no counter-programming.
Aruba customer dissatisfaction and migration anxiety signals: No fresh practitioner threads emerged this week. The Reddit searches for "Aruba Central migration experience" and "Aruba ClearPass issues" returned only old, non-current threads (2022–2023 vintage ClearPass 802.1X questions, nothing fresh). The absence of fresh complaint threads is mildly positive — it suggests no new acute pain event this week — but the structural concerns documented in prior weeks (integration uncertainty, ClearPass complexity) remain.
Competitive threats targeting Aruba accounts: Cisco Live is the active threat vector this week. Cisco's agentic network narrative — unified fabric, AI-driven ops, security integration — will be directly pitched into Aruba accounts by Cisco reps returning from Las Vegas this week and next. The channel angle noted by RCR Wireless (licensing complexity, channel economics) cuts against Cisco but does not protect Aruba accounts automatically.
Gaps in the Aruba story: The r/networking thread "HPE Discover" is not accessible in full in this research set, but its existence suggests practitioners are actively discussing HPE's conference event. Whether that discussion is positive or negative cannot be determined from available data. 🔴
Moves this week: The confirmed development activity is the Pulumi provider for Juniper Mist, with four builds published this week: 0.11.0a1780294086 (June 1), 0.11.0a1780471274 (June 3), 0.11.0a1780643941 (June 5), and 0.11.0a1780729198 (June 6). 🟢 This is the sixth consecutive week of unbroken daily development cadence in the 0.11.0 alpha series. No product announcements, customer wins, or marketing publications from Mist surfaced in the research set this week.
Customer wins / pipeline signals: None surfaced this week.
Marvis AI narrative vs. Cisco AI: This is the central competitive question of the week. Cisco has now established — at customer-event scale — an "agentic network" narrative. Mist's counter is not messaging; it is operational history. Marvis has been running AI-driven network operations in production for multiple years: Service Level Expectations (SLEs) translate network telemetry into business-impact metrics, the Conversational Assistant has handled real operator queries, and Marvis Actions have been making autonomous configuration corrections in production accounts. The differentiation from Cisco's announced "agentic ops" is that Mist has a track record and Cisco has a keynote. That difference matters in deals — but only if sellers make it explicit.
Battlecard-relevant developments this week: The TechTarget "enterprise trust gap" story is directly usable. Cisco's own press coverage includes the acknowledgment that customers don't fully trust AI-driven network decisions. Mist sellers can use third-party validation of that skepticism to pivot to: "Here's what Marvis has actually done in production networks, with customer references, versus what Cisco announced this week."
No new HPE executive statements or roadmap disclosures surfaced this week that create customer-facing questions. The r/networking "HPE Discover" thread exists but is not accessible in full in this research set — it may contain practitioner questions about the portfolio direction. 🔴 [unverified]
The HPE stock narrative (earnings beat, "$5B AI backlog") is running positively in financial communities this week. This is useful context for Aruba account managers facing the "HPE integration = instability" narrative from Cisco reps — HPE's financial position is stronger than the acquisition-uncertainty story suggests. However, financial strength does not automatically translate to product roadmap clarity, and Aruba account managers should not rely on stock price as a substitute for product roadmap conversations with customers.
The Aruba/Mist platform separation remains unchanged. No convergence announcements. No messaging contradictions surfaced. The "which platform when" question is still the primary customer confusion risk, and no new guidance materialized this week.
Cisco — Non-Campus Activity:
- Cisco Multicloud Fabric (announced at Cisco Live) positions Cisco as the unified connectivity layer for multi-cloud AI workloads — a data center and cloud play that extends beyond campus. 🟢
- Cisco's agentic security overhaul at Cisco Live includes security elements that span endpoint, cloud, and network — not campus-specific. 🟡
- No financial results this week; no M&A news surfaced.
Arista Networks — Non-Campus Activity:
- Arista stock continues to outperform the Nasdaq per Barchart coverage. 🟡 No product or data center announcements surfaced in this research set. Financial narrative is strong; operational news is absent.
Extreme Networks — Non-Campus Activity:
- No non-campus activity surfaced this week.
Fortinet — Non-Campus Activity:
- Fortinet stock up 87.5% YTD, attributed to AI security positioning (Yahoo Finance / Zacks). 🟡 The financial performance is real; no specific non-campus product news surfaced.
Palo Alto Networks — Non-Campus Activity:
- Palo Alto Networks beat Q3 FY2026 earnings expectations and lifted its full-year earnings forecast, citing accelerating AI security demand. 🟡 This is a SASE/SSE security signal — enterprise security budgets are moving toward AI-integrated platforms. Relevant context for the Mist Access Assurance and Mist + third-party ZTNA narrative.
Zscaler — Non-Campus Activity:
- No current-week product or earnings news surfaced. Stock price prediction articles only — not operationally relevant.
Research note: Reddit searches this week returned almost entirely off-topic results (sports scores, consumer finance, unrelated communities). The one exception of marginal relevance is the r/wallstreetbets and r/stocks threads on HPE's earnings. No fresh practitioner threads on Mist, Meraki, Aruba Central, or any Tier 1 campus vendor surfaced within the past 7 days in the research set. Sentiment analysis this week must rely on the structural absence of new complaints rather than positive signal.
HPE Aruba (practitioner sentiment):
- 🔴 [practitioner forum, unverified] The r/wallstreetbets "HPE skyrockets 30% on biggest earnings beat since 2018" thread (135 votes, 51 comments, posted within past 6 days) suggests HPE's financial narrative is landing positively with a retail investment audience. This is not a networking practitioner signal, but it indicates HPE's public narrative is not in distress.
- 🔴 [practitioner forum, unverified] r/networking "HPE Discover" thread exists this week — full content not accessible. This is a practitioner thread about an HPE event, suggesting community awareness of HPE's conference activity. Valence unknown.
- No fresh ClearPass complaint threads, migration anxiety threads, or Aruba Central dissatisfaction threads surfaced this week. This is neutral — absence of complaints is not the same as satisfaction.
Cisco / Meraki (practitioner sentiment):
- No fresh practitioner threads this week. The prior-week signals of Meraki licensing friction and Catalyst DNA subscription complaints have not generated new threads in this research cycle.
HPE Juniper Mist (practitioner sentiment):
- No fresh practitioner threads surfaced. The Pulumi GitHub/PyPI activity is developer-facing signal, not practitioner forum sentiment.
Trend note: The second consecutive week with minimal fresh Reddit practitioner signal. Either the research pipeline's Reddit coverage is degrading, or the community is between major discussion cycles. The Cisco Live event may generate fresh practitioner discussion next week as attendees return and post their impressions.
No capability matrix cells changed this week based on verified information in the research set. Cisco announced an "agentic ops platform" at Cisco Live, but the specific capabilities, shipping status, and feature scope are not confirmed against primary documentation in this research set. Marking it as a 🟡 announced/roadmap item would require verifying what specifically is shipping versus demonstrated at the event. Until confirmed, no cell change is warranted.
The full current-state matrix is carried forward in Appendix A without modification.
Apparent Parity:
Both vendors now claim AI-driven network operations. Both offer cloud-managed campus Wi-Fi and switching. Both have AIOps platforms that surface telemetry, correlate events, and (now, in Cisco's framing) take autonomous corrective action. Both offer NAC integration, SD-WAN, and some form of SASE/SSE adjacency. At the feature-list level, after Cisco Live week, Cisco's marketing now explicitly claims parity — or superiority — on every dimension Mist has historically led on.
Implementation Reality:
Cisco's "agentic ops" announcement is a keynote claim this week, not a production-validated capability. Cisco's AIOps stack spans multiple products (DNA Center/Catalyst Center, Meraki Dashboard, ThousandEyes, Cisco AI) that were built separately and integrated over years of acquisition activity — the "single pane" story requires real integration work in deployment. Meraki and Catalyst remain architecturally separate platforms with different management paradigms; a customer running both faces dual dashboards and split telemetry streams. Cisco ISE for NAC is notoriously complex to deploy and maintain — PeerSpot's 2026 NAC rankings confirm ISE mindshare has dropped from 25.8% to 19.4% year-over-year (see Section 12 research), a real signal of deployment friction. Mist's microservices cloud architecture was built cloud-native from inception; Cisco's cloud management is an overlay on on-premises origins. The Marvis SLE framework has been in production for multiple years with measurable customer outcomes; Cisco's "agentic" framing is, as of this week, a conference announcement.
Where Mist Has Stacked Advantage:
- Production AI track record: Marvis SLEs have been operating in production customer environments for years, correlating Wi-Fi, switching, and WAN telemetry into business-impact scores. This is not an announced roadmap item. Cisco's agentic narrative is this week's news. When a customer asks "can you show me what AI-driven operations looks like in a real account?", Mist can answer with references; Cisco can answer with demos.
- Architectural simplicity at the management layer: Mist runs from a single cloud-native microservices platform. A customer managing Wi-Fi, EX switching, SRX security, and Session Smart WAN sees a single API surface and a single telemetry pipeline. Cisco's equivalent coverage requires Meraki + Catalyst Center + ISE + ThousandEyes + Cisco AI — separate licensing, separate consoles, separate support contracts.
- IaC/programmability investment velocity: Six consecutive weeks of daily Pulumi provider builds, a Python SDK, and an open API surface that developer and NetOps teams can engage with immediately. Cisco's programmability story (DNA Center APIs, Meraki APIs) is real but built on older architectures with more abstraction layers.
- Marvis Conversational Assistant: Natural language querying of network state ("Why is the Wi-Fi slow in Conference Room B?") has been shipping and in use in Mist for multiple years. Cisco announced natural language network configuration at Cisco Live this week. The gap is years of production learning versus a conference demo.
Where Mist Is Structurally Weaker:
- Installed base scale: Cisco's installed base in enterprise campus — across both Meraki and Catalyst — is an order of magnitude larger than Mist's. Migration from an existing Cisco environment to Mist requires ripping out infrastructure customers have already paid to maintain. This is not a feature gap; it is a switching-cost reality.
- SD-WAN / WAN security breadth: Cisco's SD-WAN portfolio (Catalyst SD-WAN, formerly Viptela) has broader carrier and enterprise validation than Juniper's Session Smart Router in many markets. For large enterprises with complex WAN requirements and existing Cisco routing contracts, the WAN conversation is harder for Mist.
- Security portfolio depth: Post-Cisco Live, Cisco can credibly claim a unified security + network + cloud story that spans endpoint, cloud workload, campus, and WAN. Mist's security story (Mist Access Assurance, ZTNA partnerships) is strong at the campus edge but does not match Cisco's cross-domain security portfolio depth.
- Partner ecosystem depth: Cisco's channel program, VAR relationships, and co-sell motions with hyperscalers are substantially larger than Mist's. In competitive bids where the channel partner has a strong Cisco relationship, Mist needs a champion inside the customer to win.
Deal Impact:
This week's Cisco Live substantially raises the AI credibility bar Mist sellers will face. Customers who attended Cisco Live will return with Cisco's framing of "agentic networking" as the reference point. The winning Mist counter is not to argue features but to pivot to production evidence: "Cisco announced this at their conference this week. Marvis has been doing it in production for years. Here are three customers who can describe what that looked like in their environment." Do not get drawn into a feature checklist argument on Cisco's terms.
Apparent Parity:
Both vendors claim cloud-managed campus networking with AIOps. Both carry Gartner Magic Quadrant Leader placement in campus networking. Both have strong data-plane engineering heritage and a developer-friendly API story. At the analyst-report level, Arista and Mist look equivalent.
Implementation Reality:
Arista's campus motion is real but relatively young. CloudVision and the Cognitive Campus architecture are extensions of data center tooling applied to campus — the engineering is sound but the campus-specific operational refinements (dense Wi-Fi RF management, branch provisioning at scale, NAC integration) are less mature than Mist's purpose-built campus platform. Arista has no Wi-Fi access point product line — campus Wi-Fi requires a third-party integration or a separate vendor selection. In a campus RFP that includes Wi-Fi, switching, and wired access under a unified management platform, Arista cannot bid a single-vendor answer.
Where Mist Has Stacked Advantage:
- Integrated Wi-Fi + switching + WAN under a single AI engine: Arista cannot bid a complete campus solution including Wi-Fi from a single vendor. Mist can. In deals where the customer wants a single throat to choke for campus networking, this is a structural differentiator.
- Marvis versus AVA (Arista Virtual Assist): Arista's AVA is real, but it is newer, has fewer production customer years behind it, and is primarily focused on data center operations. Mist's Marvis was built for campus operations — roaming failures, RF interference, authentication delays — from day one.
- Campus-specific feature depth: 802.11ax/Wi-Fi 6E/Wi-Fi 7 AP portfolio, location services, dynamic VLAN assignment via Mist Access Assurance — these are campus-native capabilities with years of iteration. Arista's campus feature set is growing but is not at the same maturity level.
Where Mist Is Structurally Weaker:
- Data center adjacency in large enterprise deals: In accounts where Arista already runs the data center fabric, IT leadership often prefers a common management and operational model. Arista's ability to offer CloudVision across DC and campus in a single NOC workflow is a genuine consolidation argument that Mist cannot match.
- Financial and analyst momentum: Arista's stock performance and Gartner Leader status give it executive-level credibility in large enterprise procurement committees. A CIO who doesn't know the networking market deeply will see Arista's financial profile and Gartner placement as validation.
Deal Impact:
Arista has been silent on campus for five consecutive weeks. This is not necessarily weakness — Arista may be preparing a significant campus announcement. Mist sellers should use this window to close deals in campus-primary accounts before Arista re-enters the conversation. In any account where data center and campus are being evaluated together, expect Arista to make a consolidation argument. Counter with production campus depth and the cost of Arista's Wi-Fi integration complexity.
Apparent Parity:
Both offer cloud-managed campus networking with AI-driven AIOps. Both have been investing in agentic/AI narratives following major conference presentations. Both target enterprise and government verticals. Both have switching + Wi-Fi + cloud management portfolios.
Implementation Reality:
Extreme's Platform ONE is a real consolidation effort across RUCKUS (Wi-Fi), Summit (switching), and ExtremeCloud IQ (management), but the underlying architectures of these products originated from different companies (RUCKUS acquired from CommScope, Summit from Extreme's own development, ExtremeCloud developed over time) and true unified management is still maturing. Extreme's AI features (ExtremeAI, agentic narrative from Extreme Connect) are newer than Marvis by multiple years and have a smaller production telemetry corpus. Government and education verticals — Extreme's strongest segments — have unique procurement requirements (FedRAMP, E-Rate) that Mist must navigate carefully but that Extreme has more established positioning in.
Where Mist Has Stacked Advantage:
- AI maturity and production corpus: Marvis processes telemetry from a larger global customer base than Extreme's platform, meaning the ML models have more signal. Extreme's AI narrative is largely aspirational in terms of what has been demonstrated at Extreme Connect versus what is shipping in day-two operations for large enterprise customers.
- Microservices cloud architecture: Mist's cloud backend was built cloud-native; ExtremeCloud IQ is a maturing platform with architecture that reflects its multi-acquisition history. The day-two operational experience for network administrators — speed of policy changes, telemetry latency, API reliability — reflects this architectural difference.
- Commercial enterprise breadth: Mist has stronger case study depth in financial services, healthcare, and technology verticals. Extreme's showcase accounts skew heavily toward education and government.
Where Mist Is Structurally Weaker:
- Government and education installed base: Extreme has deeper penetration and E-Rate certifications in K-12 and higher education. In competitive bids against Extreme in those verticals, Mist faces a procurement process familiarity disadvantage and must work harder on E-Rate positioning.
- Stadium and high-density venue experience: RUCKUS (now part of Extreme) has extensive deployments in sports venues and high-density public spaces. This is a specific segment where RUCKUS heritage gives Extreme a credibility advantage.
Deal Impact:
Extreme has been quiet for five consecutive weeks post-Extreme Connect. The field motion following the conference is underway but not generating public evidence. In commercial enterprise deals, Mist can lead with AI maturity, architectural modernity, and production case study depth. In government and education, Mist needs updated competitive positioning on E-Rate and FedRAMP that goes beyond feature comparisons.
Apparent Parity:
Both offer campus Wi-Fi + switching + SD-WAN + cloud management. Both can claim "security-integrated networking" in some form. Fortinet's Universal SASE narrative positions the network and security as a unified product — similar framing to what Mist attempts with Marvis + access assurance + third-party ZTNA integration.
Implementation Reality:
Fortinet's approach to campus networking is security-first, network second. FortiAP and FortiSwitch are real products with real deployments, but they are managed primarily as security surfaces (FortiGate policy enforcement) rather than as network-performance-optimized infrastructure. FortiAP lacks the RF AI engine sophistication of Mist; FortiSwitch management through FortiGate is powerful for security policy but weak on network operations visibility (performance trending, proactive anomaly detection, capacity planning). Fortinet's "security fabric" integration is genuinely strong — a Fortinet shop can enforce unified policy from endpoint to WAN — but the trade-off is operational complexity in the network layer that security-first customers often don't notice until they hit a performance problem.
Fortinet's stock performance (87.5% YTD) and AI security narrative are resonating with security buyers, not network operations buyers. In accounts where the primary buyer is a CISO or security team, Fortinet has wind at its back. In accounts where the primary buyer is a network operations team, Mist has a significantly stronger story.
Where Mist Has Stacked Advantage:
- Network operations maturity: Marvis's SLE framework measures network performance from the user's perspective (roaming time, authentication time, throughput, DNS resolution time) and correlates root cause across the full stack. Fortinet has no equivalent. A network operations team evaluating both platforms on operational visibility will find Mist materially superior.
- Wi-Fi RF performance: Mist's Wi-Fi AI (virtual BLE and Wi-Fi optimization, dynamic channel and power adjustment, proactive AP replacement triggers) has years of production refinement. FortiAP's RF management is functional but lacks the AI-driven automation layer.
- AIOps vs. Security Fabric: Mist's value proposition compounds over time — the AI models improve as telemetry accumulates. Fortinet's value proposition in networking is primarily policy enforcement, which doesn't compound in the same way.
Where Mist Is Structurally Weaker:
- Security-primary buying centers: When a deal is driven by a security team that already standardized on Fortinet, the "FortiAP + FortiSwitch is already in the security budget and already has FortiGate integration" argument is hard to defeat on total-cost-of-ownership grounds, even if Mist's network operations are superior.
- SD-WAN for security-centric WAN requirements: FortiGate-based SD-WAN with integrated NGFW is a compelling single-appliance story for branch locations where the primary concern is security policy enforcement at the edge. Mist's Session Smart Router has better WAN performance optimization (application-aware routing, packet duplication) but lacks the integrated NGFW that Fortinet's branch customers often require.
Deal Impact:
Five consecutive weeks of Fortinet campus silence is an open window. In any account where Fortinet's campus proposal is stale or where the network operations team is frustrated with visibility gaps, now is the time to position Marvis's operational depth as the contrast. The CISO-driven deal is harder — understand the buyer before entering.
Structural Gap 1: No self-contained NGFW at the campus edge.
Mist's Session Smart Router and SRX firewall are real products, but Mist cannot offer a single integrated campus branch appliance that combines SD-WAN performance optimization with a shipping next-generation firewall equivalent to Fortinet FortiGate, Palo Alto Prisma SD-WAN, or Cisco Catalyst SD-WAN + Umbrella at the branch. Customers who require deep packet inspection, threat prevention, URL filtering, and application-aware SD-WAN in a single device at every branch location must either add an SRX (separate management, separate licensing, additional complexity) or integrate a third-party NGFW. This is not a software release away — it is an architectural boundary between the network and security product families that reflects how Juniper's products were built and how HPE has structured the portfolio.
Structural Gap 2: No owned Wi-Fi presence in the data center / hyperscaler co-location layer.
Cisco's ability to bridge campus AI-networking narrative into multi-cloud connectivity (Cisco Multicloud Fabric, announced this week) reflects Cisco's ownership of both the campus layer and the cloud/DC connectivity layer in many large enterprise accounts. Mist owns the campus AI layer but has no equivalent cloud connectivity fabric. This means that in accounts where the buyer is consolidating network vendors, Cisco can make a "campus-to-cloud in one vendor" argument that Mist structurally cannot match from the Juniper Mist portfolio alone. (HPE GreenLake and HPE's broader infrastructure portfolio could partially address this narrative, but that requires a coordinated HPE Networking + HPE Infrastructure sale that the current field structure makes difficult.)
Structural Gap 3: Limited enterprise-scale ZTNA for on-premises users without third-party dependency.
Mist Access Assurance (identity-based access control at the network edge) is real and shipping. But for customers who want ZTNA enforcement for on-premises users accessing internal applications — not just network access control at the port — Mist requires integration with a third-party SSE/ZTNA provider (Zscaler, Palo Alto, etc.). Cisco can offer ISE + Cisco Secure Access (ZTNA) + Catalyst campus as a single-vendor story. Mist's campus security story is strong at the identity-aware network access layer but does not extend natively into the application-layer ZTNA enforcement that enterprise security buyers increasingly require as a baseline. This is structural — Juniper/HPE does not own an SSE platform.
Attack 1: "Cisco Live just demonstrated that autonomous agentic networking is where the market is going — and Cisco is the only vendor with the security + networking + cloud portfolio to deliver it at enterprise scale. Mist is a Wi-Fi AI platform from a company that was acquired mid-cycle. HPE is still figuring out what to do with two competing campus platforms (Aruba and Mist), and Juniper's roadmap clarity is uncertain. Buying Mist today is betting on the smaller, acquisitioned platform during an integration period — while Cisco is investing billions in AI infrastructure that spans your campus, your data center, and your cloud."
Honest counter-positioning: The "acquisition uncertainty" argument is real and must be addressed directly — not deflected. The honest answer is: Mist is the strategic HPE campus platform for AI-native enterprise networking; Aruba serves the existing installed base; the roadmaps are separate and funded. On the AI claim: Cisco announced agentic networking this week. Marvis has been running AI-driven campus operations in production for multiple years. Ask Cisco to show you production customer references — not a demo — for their agentic ops capabilities. On portfolio breadth: Mist's singular focus on campus AI operations means the product team is not split across data center, SP, and security priorities the way Cisco's networking organization is.
Attack 2: "Cisco's security integration at Cisco Live is a unified story — ISE, Secure Access, Umbrella, and the campus network all speaking the same policy language. Mist can give you great Wi-Fi telemetry, but when your CISO asks 'how does the campus network enforce zero trust for on-premises applications?', Mist's answer is 'we'll integrate with whoever you've chosen for ZTNA.' Cisco's answer is 'it's built in.' That gap is not a software update — it's a structural difference in what Mist is designed to do."
Honest counter-positioning: This is largely true (see Section 8, Gap 3). The honest response: Mist Access Assurance handles identity-aware network access at the port and SSID level — authentication time, device trust, VLAN assignment. For application-layer ZTNA, yes, Mist integrates with best-of-breed SSE providers. The question to ask Cisco is what ISE + Secure Access actually costs to deploy and operate across an enterprise campus, and what happens to network operations visibility when the security team owns the NAC platform. Cisco's "integrated" story often translates to ISE deployments that network teams find operationally burdensome.
Attack 3: "Meraki's simplicity and Catalyst's enterprise depth give you a choice of operational model within one vendor. Mist forces you into a single cloud-managed model that works beautifully when the AI is right and creates a support escalation nightmare when it isn't. Cisco's support organization — TAC, partners, on-the-ground resources — is an order of magnitude larger than Juniper's campus support infrastructure."
Honest counter-positioning: Marvis's AI-driven troubleshooting is specifically designed to reduce support escalations, not create them — and this is verifiable through customer references. On support scale: HPE now owns Juniper, and HPE's support infrastructure is substantial. The "smaller vendor support" argument is less credible post-acquisition. On the Meraki vs. Catalyst choice: the flip side is that customers running both frequently discover they're managing two separate dashboards with separate telemetry, separate licensing, and separate support queues — the opposite of the "one vendor" simplicity they were sold.
Attack 1: "Arista is a Gartner Magic Quadrant Leader in campus networking with a proven CloudVision platform that your data center team already knows and trusts. Mist is excellent for Wi-Fi-centric deployments, but if you're looking at a unified network operations model from the data center to the campus access layer — single management plane, single API surface, consistent operational model — Arista gives you that without requiring your NOC to learn a new platform. Mist's Marvis is a campus-specific AI that stops at the campus edge."
Honest counter-positioning: Arista does not offer campus Wi-Fi APs. A campus RFP that includes Wi-Fi — which is almost every campus RFP — cannot be answered by Arista alone. CloudVision extended to campus is real, but the campus-specific AI operations maturity (RF management, roaming optimization, authentication failure analysis) is not at the same level as Marvis. The "your data center team already knows it" argument is valid for data-center-primary IT organizations — ask the customer whether their campus network operations team wants to be subordinate to the DC team's tooling choices.
Attack 2: "Arista's financial performance and Gartner recognition confirm that the market is validating our campus direction. Mist was acquired by HPE in 2025 — you're evaluating a platform mid-integration, where product roadmap priorities are being decided in a merged organization. Arista has a single product vision and a clear roadmap with no acquisition integration risk."
Honest counter-positioning: Arista has been silent on campus product activity for five consecutive weeks. "Clear roadmap" requires evidence. Ask Arista for their campus product roadmap — specific features, specific dates, Wi-Fi AP portfolio, and campus AIOps development timeline. Mist's roadmap, while affected by the HPE integration, has continued shipping (Pulumi provider, Marvis features) without interruption.
Attack 3: "Arista's open API and CloudVision programmability mean your DevOps and NetOps teams can automate everything from day-one provisioning through ongoing compliance drift detection, using tooling they already know. Mist's programmability is improving but is focused on a narrower operational scope."
Honest counter-positioning: The Pulumi provider for Juniper Mist has been in daily active development for six consecutive weeks and is now at 0.11.0 alpha — verifiable on PyPI. A Python SDK for Mist was published. Arista's API surface is real and strong for data-center use cases; Mist's is specifically designed for campus network lifecycle automation. Ask for a head-to-head IaC coverage comparison for campus-specific operations.
Attack 1: "Extreme's Platform ONE gives you a unified AI platform across Wi-Fi, switching, and cloud management — and we've been the choice of universities, K-12 districts, and government agencies that have run large-scale wireless networks for decades. RUCKUS Wi-Fi performance in high-density environments is validated by more stadium and venue deployments than any other vendor. Mist is strong in commercial enterprise, but if your environment looks anything like a campus, a hospital, or a government facility, Extreme has production references that Mist can't match in those verticals."
Honest counter-positioning: High-density venue experience is a legitimate Extreme/RUCKUS strength. In K-12 and higher education, Extreme's E-Rate positioning and installed base give it a real procurement advantage. The counter: ask for a demonstration of ExtremeAI's specific operational capabilities — SLE-equivalent metrics, root cause analysis depth, and time-to-resolution data from production deployments — compared to Marvis. Extreme's AI story from Extreme Connect is a keynote; Mist's Marvis has years of production data in similar environments.
Attack 2: "Platform ONE is our commitment to a unified platform — not two separate platforms like HPE is running with Aruba and Mist. When you buy from Extreme, you know what you're buying. When you buy from HPE Networking, you're buying into an integration period where the long-term platform decision hasn't been made."
Honest counter-positioning: The two-platform argument has merit and must be handled directly. The honest answer: Mist is the AI-native platform for net-new enterprise deployments; Aruba Central serves the existing Aruba customer base. These are separate, funded platforms. What the customer should be evaluating is not HPE's internal integration timeline, but which platform delivers better operational outcomes for their network team on day 366.
Attack 3: "Extreme Connect demonstrated agentic AI capabilities that will ship in Platform ONE — and we're executing on government and education compliance requirements (FedRAMP, FIPS) that Mist's cloud architecture makes harder to satisfy."
Honest counter-positioning: Government compliance requirements are real and worth verifying carefully. Mist sellers in government accounts should engage HPE's federal team for current FedRAMP status and FIPS compliance details — this is a deal-specific data point, not a general marketing claim. On agentic AI: Extreme Connect was a conference announcement; ask Extreme for production customer references on their AI-driven operations, equivalent to what Mist can provide through Marvis case studies.
Attack 1: "Fortinet is up 87.5% year-to-date because enterprises recognize that the network and security convergence story isn't theoretical anymore — it's the market moving. FortiGate-based SD-WAN + FortiAP + FortiSwitch + Universal SASE gives your CISO and your network team a single platform with a single policy engine from the branch to the cloud. Mist gives you great Wi-Fi telemetry. Fortinet gives you integrated threat prevention, URL filtering, application control, and network performance in one appliance at every branch. The question is: who's making the purchase decision — network operations or security?"
Honest counter-positioning: The security-primary buyer argument is Fortinet's strongest play, and it is real (see Section 8). The counter is buyer-specific: if this is a network operations-driven decision, Marvis SLEs, RF AI, and Conversational Assistant deliver operational value that Fortinet's campus products do not approach. If it is a security-driven decision, ask about the network operations experience for FortiAP and FortiSwitch — specifically, do the security team's FortiGate policy changes create network operations visibility gaps, and who owns troubleshooting when users report performance problems?
Attack 2: "Fortinet's Universal SASE integrates branch security policy with ZTNA, SWG, CASB, and SD-WAN from a single vendor — no third-party integrations required. Mist's SASE story is 'we'll integrate with whoever you choose.' In 2026, that's not a SASE story. It's a promise that someone else will build the integration for you."
Honest counter-positioning: This is partially true for application-layer ZTNA (see Section 8, Gap 3). The counter: Fortinet's "integrated" Universal SASE often means FortiGate-centric management that forces network operations into a security team's workflow — or vice versa. The integration story is real on paper; the operational model when network and security teams have different priorities and tooling preferences is harder. Also: Fortinet has not shipped a verifiable campus networking innovation in five consecutive weeks of tracking. The Universal SASE narrative is real; the campus network operations platform is not keeping pace.
Attack 3: "Fortinet's security fabric means that a threat detected on one part of your network automatically affects policy across the entire estate — campus, branch, cloud. Mist's response to a detected threat at the network edge requires you to coordinate with your separate ZTNA provider. The speed of response matters, and single-vendor fabric response is faster."
Honest counter-positioning: This is a valid architectural argument for security-response automation. The counter: ask Fortinet to demonstrate what "automatic policy response" looks like in a real enterprise campus environment with mixed device types, MAC randomization, BYOD, and compliance requirements — and what happens to network operations when a false positive triggers an automated policy response. Mist Access Assurance handles identity-aware network access at the edge with Marvis providing the visibility to validate that access decisions are working correctly. The speed-of-response argument applies primarily to threat scenarios, not to the day-to-day network operations experience that drives renewal decisions.
Q1: "We just came back from Cisco Live and their agentic networking demo was impressive. Can Mist do the same thing?"
Honest response: Cisco announced an "agentic ops platform" at Cisco Live this week — it is a real announcement, not vaporware, but it is also this week's announcement. Marvis has been running AI-driven autonomous network operations in production for multiple years. Specifically: Service Level Expectations (SLEs) correlate user-impacting events to root causes across Wi-Fi, switching, and WAN in real time. Marvis Actions takes automated corrective actions — identifying and resolving sticky client issues, port bounces, RF channel conflicts — without human intervention. Marvis Conversational Assistant answers natural language questions about network state. These are not demos; they are features that have been in production customer environments since before Cisco's keynote. Ask us for a customer reference in your industry who can describe what Marvis has done in their network. That conversation is more informative than a demo.
Q2: "HPE acquired Juniper — how do I know the Mist platform is going to be around and funded?"
Honest response: This is a fair question. The direct answer: HPE has publicly stated that Mist AI is the strategic AI-native campus platform for net-new enterprise accounts. The Aruba platform continues to serve the existing Aruba installed base. These are separate, funded product lines. HPE's recent earnings results — the largest beat since 2018 per financial reporting — and a reported $5B AI infrastructure backlog confirm that HPE is not in a position of financial distress that would prompt platform rationalization. That said, integration periods do create uncertainty, and the honest advice is to ask HPE's product management team for a clear roadmap briefing that you can evaluate against your 3-year network plan. Do not accept a vague "we're committed to both platforms" answer. Ask for specifics.
Q3: "Fortinet is already in our security stack — wouldn't FortiAP and FortiSwitch be simpler than adding another vendor?"
Honest response: Simplicity is a real value, and if your security team owns the network budget and is comfortable with FortiGate-centric management, Fortinet's integration story is coherent. The question to ask is: who operates the network day to day, and what tools do they need? Marvis gives network operations teams visibility into user experience — roaming times, authentication failures, throughput issues, DNS problems — that FortiGate/FortiAP does not surface in an equivalent way. If your primary network operations challenge is performance management, user experience assurance, and proactive fault isolation, Mist's operational model delivers measurable outcomes that Fortinet's campus products don't match. If your primary challenge is security policy enforcement at the branch with minimal IT staffing, Fortinet's story has real merit. The honest recommendation is to define which operational problem you're solving first, then evaluate which product is better at solving it.
Q4: "Cisco says they have a unified security + network + cloud story at Cisco Live. How does Mist fit into a zero trust architecture?"
Honest response: Mist's role in zero trust is at the campus network access layer — specifically, Mist Access Assurance provides identity-aware network access control: the network grants access based on user identity, device trust posture, and policy, not just physical port location or SSID. This replaces the function of a traditional NAC without the complexity of deploying a separate NAC appliance (like ISE or ClearPass). For application-layer ZTNA — enforcing zero trust access to internal applications for on-premises users — Mist integrates with leading SSE/ZTNA providers rather than providing it natively. Cisco's ISE + Secure Access story is integrated, but ISE is also one of the most operationally complex NAC platforms in production environments — PeerSpot's 2026 data shows ISE's mindshare has dropped from 25.8% to 19.4% year-over-year, partly reflecting deployment friction. The choice between Cisco's integrated complexity and Mist's best-of-breed simplicity at the campus edge is a real trade-off worth evaluating explicitly.
Q5: "We're also looking at Aruba Central for our existing Aruba switches — should we standardize on Aruba or migrate everything to Mist?"
Honest response: This is the most important question you can ask HPE Networking, and you deserve a straight answer. The current HPE answer is: if you have a significant Aruba installed base (CX switches, Aruba APs, ClearPass), staying on Aruba Central is the supported path forward — there is no forced migration to Mist. If you are doing a greenfield deployment or a major refresh where you have the option to choose, Mist is the AI-native platform with more active product development in the campus AIOps layer. The practical decision should be based on operational outcomes, not vendor strategy: ask both teams for a structured pilot or proof of concept in your environment, with defined success metrics tied to your actual operational pain points. A vendor who won't agree to a structured POC with measurable outcomes is a vendor who doesn't have confidence in their own product.
[Continuing — Week 6] Cisco's AI-era narrative is now a fully deployed, conference-scale market position.
Six consecutive weeks of compounding Cisco AI narrative: thought leadership (week 1) → campus AI content (week 2) → earnings-backed AI infrastructure with HSBC upgrade (week 3) → CEO "networking super cycle" at JPMorgan conference (week 4) → Cisco Live "AI That Fixes Networks Itself" opening (week 5) → Cisco Live agentic ops platform and security overhaul announced to customers (week 6). The conference format elevated this from messaging to customer-event-scale product narrative. Cisco has now planted "agentic networking" in the minds of thousands of enterprise buyers. This narrative will run through the enterprise evaluation cycle for the next 2-3 quarters minimum.
[Continuing — Week 6] Pulumi provider for Juniper Mist in unbroken daily development cadence.
Six consecutive weeks, now completing the 0.11.0 alpha series with four builds this week (June 1, 3, 5, 6). This is the longest continuous public development signal tracked for any vendor in this report. The progression from 0.9.0 stable → 0.10.0 alpha → 0.11.0 alpha over six weeks confirms active, accelerating IaC investment. For DevOps-oriented and NetOps-automation-focused enterprise prospects, this is the most verifiable engineering investment signal available.
[Continuing — Week 5] Arista absent from campus-specific product activity.
Five consecutive weeks with zero campus product, customer, or partner announcements. The Gartner MQ Leader placement (week 4) is now the last substantive campus-relevant event. Arista's campus motion is generating financial market coverage without generating operational evidence. Watch carefully — five weeks of silence often precedes a significant announcement.
[Continuing — Week 5] Fortinet absent from campus/branch product activity.
Five consecutive weeks with zero campus/branch product news. Fortinet's stock has surged 87.5% YTD on AI security positioning, but none of that financial narrative connects to campus networking investment. The window for Mist to advance deals in Fortinet-incumbent campus accounts remains fully open.
[Continuing — Week 3] HPE's financial narrative is running positively.
Third consecutive week of HPE financial performance signals (earnings beat, AI backlog references) appearing in financial and general interest communities. This does not confirm product roadmap clarity, but it provides a useful counter to the "acquisition instability = don't buy" argument that Cisco reps are using in Aruba accounts. Financial strength is not product roadmap confidence — but financial distress would be a legitimate procurement risk, and HPE is not showing that signal.
[NEW] Cisco Live 2026 introduces "enterprise trust gap" as a documented customer concern about AI autonomy.
TechTarget's coverage of Cisco Live explicitly named an "enterprise trust gap" in agentic AI security. This is the first week this specific counter-narrative has appeared in a named, attributed publication in this research set. If this theme develops in trade press and practitioner forums over the next 2-3 weeks, it becomes a durable counter-positioning tool for Mist sellers: Marvis has a production track record; Cisco's agentic ops are conference announcements facing documented customer skepticism.
[CLOSING] Week 2 trend: "HPE autonomous networking announcement bridges Mist and Aruba narratives" — insufficient follow-through in weeks 3-6 to confirm as a sustained trend. Closing this item. No equivalent announcement or narrative bridge has surfaced in subsequent weeks.
Network security beyond the perimeter is the set of technologies that enforce access control and limit threat propagation inside enterprise networks — after the user or device has already passed through the outer firewall. It includes three primary disciplines: Network Access Control (NAC), which decides what devices and users are allowed onto the network and with what level of access; microsegmentation, which divides the internal network into isolated zones so that a compromised device cannot move laterally to attack other systems; and Zero Trust Network Access (ZTNA), which applies the principle of "never trust, always verify" to every access request, whether the user is on-premises or remote. These capabilities are related but solve different problems — NAC controls who enters, microsegmentation limits where they can go, and ZTNA governs what applications they can reach once inside.
The premise of traditional perimeter security — a hard outer shell protecting a trusted interior — collapsed when cloud applications, remote work, BYOD devices, and IoT endpoints made the "inside" of the network effectively boundless. Every major breach category of the past five years (ransomware lateral movement, supply chain compromise, insider threat) has exploited the assumption that anything already on the network is trustworthy. A TechCrunch review of the worst breaches of 2026 so far listed attacks on critical energy and water systems, an FBI surveillance hack, and a DOGE data breach — all of which involved lateral movement or privilege escalation after an initial foothold, not just perimeter penetration. The market for zero trust infrastructure is growing because enterprises have accepted, empirically, that the perimeter is not where attacks stop.
ZTNA is growing specifically because VPNs — the traditional tool for remote access — are fundamentally antithetical to least-privilege: a VPN gives a user full network access once authenticated, regardless of what application they need. ZTNA enforces access at the application level, not the network level, and continuously re-validates trust. The 2026 zero trust literature (Exabeam, Palo Alto's Cyberpedia, multiple LinkedIn publications) consistently frames ZTNA as the VPN replacement architecture for the current threat environment.
Cisco Identity Services Engine (ISE): The market share leader in enterprise NAC, particularly in Cisco-heavy estates. PeerSpot's May 2026 NAC Buyer's Guide puts ISE mindshare at 19.4%, down from 25.8% year-over-year. That 6-point decline in mindshare is a meaningful signal — ISE is complex, expensive to deploy and maintain, and the complexity has been compounding as Cisco has added features. ISE is strongest when the entire network estate is Cisco (TrustSec SGT policy is native to Cisco switching infrastructure); in mixed-vendor or modern cloud-managed environments, the operational overhead is substantial. ISE + TrustSec zero trust segmentation is Cisco's campus zero trust story — it is technically capable but operationally demanding.
HPE Aruba ClearPass: The second major enterprise NAC platform, identified by PeerSpot's 2026 rankings alongside ISE and Forescout as the top three. ClearPass is strongest in Aruba-led estates and is frequently deployed alongside Aruba switching and wireless. ClearPass handles 802.1X authentication, MAC-based authentication, BYOD onboarding, and guest access. Its primary competitive position against ISE is multi-vendor support and somewhat lower operational complexity — though ClearPass is still a purpose-built NAC appliance that requires significant configuration work. The HPE/Juniper integration creates a question about ClearPass's long-term roadmap relevance versus Mist Access Assurance (which handles identity-aware access natively in the Mist cloud without a separate NAC appliance).
Forescout: The agentless NAC and device visibility leader. Forescout's differentiation is that it does not require 802.1X or agents on every device — it passively discovers and classifies everything on the network, making it particularly strong in environments with unmanaged devices (IoT, OT, medical equipment, facilities systems). In healthcare, manufacturing, and government environments where you cannot install agents on every device, Forescout fills a role that ISE and ClearPass handle less gracefully. Its weakness is that it is primarily a visibility and enforcement platform — it is not an AIOps platform or a network performance platform.
Illumio: The leader in workload microsegmentation, specifically in data center and cloud environments. Illumio Core provides application-workload-level microsegmentation using a software-defined policy model — it is the dominant answer when the question is "how do we prevent ransomware from moving between servers?" rather than "how do we control which users get onto which VLAN?" Illumio's 2026 review from Contentwave confirms its primary focus on hybrid on-premises/cloud environments for PCI and HIPAA compliance scope reduction. Illumio is not a campus security tool; it is a workload-layer tool. The distinction matters.
Zscaler: The ZTNA and SSE market leader for remote and cloud-access use cases. Zscaler Private Access (ZPA) is the dominant ZTNA product for connecting remote users to internal applications via a cloud broker, eliminating VPN. Zscaler Internet Access (ZIA) provides SWG and CASB. Zscaler's model is proxy-based and cloud-delivered; its weakness is that it does not natively govern on-premises users accessing on-premises resources through the local campus network — that gap is where campus NAC and microsegmentation tools remain necessary.
Nile (NaaS, emerging): As of March 2026, Nile announced that its Secure NaaS platform now includes native NAC and identity-based microsegmentation built directly into the network fabric — eliminating standalone NAC appliances. This is an architecturally significant move: rather than deploying a separate ISE or ClearPass instance, Nile's model bakes access control into the NaaS subscription at the fabric level. This is directionally where the market is heading (network-native access control rather than overlay appliances), and it is the same direction Mist Access Assurance has been moving — though Mist Access Assurance is more mature in enterprise deployments and does not require the NaaS consumption model that Nile mandates.
The dominant debate in this segment in 2026 is NAC appliances vs. network-native access control. Traditional NAC (ISE, ClearPass, Forescout) requires a separate appliance layer that sits alongside the network, receives authentication events, and enforces policy by issuing RADIUS responses to switches. This model works but requires dedicated infrastructure, dedicated expertise, and integration maintenance as the network evolves. The emerging model — represented by Mist Access Assurance and Nile's Secure NaaS — bakes access control into the network management platform itself, so policy is defined and enforced in the same system that manages switching and Wi-Fi. The argument for the appliance model is flexibility and multi-vendor support. The argument for the network-native model is operational simplicity and tighter integration with network telemetry.
The second debate is zero trust for on-premises users. ZTNA tools like Zscaler ZPA were built for remote access; applying them to on-premises users who are physically in the building and using the campus network is architecturally awkward. The campus network becomes a "trusted" transport for ZTNA traffic, which partially undermines the zero trust premise. Vendors are navigating this differently: Cisco claims ISE + Secure Access bridges the gap; Mist claims Access Assurance handles it at the network layer; Zscaler argues the future model routes all traffic through the cloud broker regardless of physical location. All three are partially right and partially incomplete.
The third debate is microsegmentation scope: should it happen at the network layer (VLAN-based, ACL-based, SGT-based) or at the workload layer (host-based agents, service mesh policies)? Illumio argues workload-layer segmentation is the only way to achieve granular east-west control in modern hybrid environments. Cisco TrustSec argues network-layer SGTs give policy without host agents. The practical reality is most enterprises need both: network-layer segmentation for lateral movement containment across broad traffic flows, and workload-layer segmentation for critical application isolation.
For a campus network seller, this segment matters in three specific ways.
First, **NAC is directly in your competitive landscape