Security Vendors L1-L7
Security Vendors — 6 vendors and operators, each broken down by layer L1 to L7: what they sell at that layer, and which layer is their home turf.
Palo Alto
Home turf: L4 / L7
L1 Physical
State the character of this layer honestly first: Palo Alto is a pure security vendor and builds no switches, wireless APs, optical transport, PoE or timing products, so there is no physical-layer product matrix here of the kind a network vendor has.
L2 Data Link
The core of this layer is not switching capability (Palo Alto builds no switches) but how a firewall is inserted into an existing network — one of the most consequential decisions at deployment.
L3 Network
This is Palo Alto's core layer and the basis of its leadership in the next-generation firewall market. The most important knowledge here is not model numbers but the capacity sizing method: the vendor publishes several throughput figures (firewall throughput, App-ID throughput, threat prevention throughput), selection must use the figure with threat preventi…
L4 Transport
Stateful inspection is Palo Alto's foundational capability, and the knowledge centre of this layer is session lifecycle and capacity bottlenecks. Three things matter most: session table capacity and connections per second (CPS) are the real bottleneck rather than bandwidth; stateful inspection requires both directions through the same device, so asymmetric r…
L5 Session
This layer is one of Palo Alto's strong areas and where it differs most from pure network vendors. The core is User-ID: mapping IP addresses to specific users and groups so policy can be written by person rather than by IP — the technical precondition for zero trust segmentation and its second differentiator alongside App-ID.
L6 Presentation
This layer holds Palo Alto's most central and most contested capability: TLS decryption. The overwhelming majority of traffic is now encrypted, and without decryption you cannot see threats inside it — threat prevention, URL filtering, DLP and sandboxing nearly all depend on decrypted content.
L7 Application
This is Palo Alto's richest layer and the core of its value as a next-generation firewall leader, covering threat prevention (IPS, anti-malware, anti-spyware), the WildFire cloud sandbox, URL filtering, DNS security, IoT security and enterprise DLP. But two pieces of less comfortable knowledge matter most here.
Cross-layer: Management & Operations
This layer has two focal points. First, Panorama: essentially mandatory in a multi-device estate for central policy, templates and logs, but its own capacity planning (especially log storage) is routinely underestimated, and misconfigured device group and template stack inheritance produces 'the policy looks right but nothing happens'.
Gigamon
Home turf: L4 / L7
L1 Physical
This layer answers one very specific question: where the copy of the traffic comes from. There are only two answers, and which one you choose determines how much you can trust every layer above.
L2 Data Link
This layer collects scattered capture points into one fabric while keeping the tools able to tell where traffic came from. Three blocks. Aggregation and source identification: once several taps and mirror ports are collected, a concrete problem appears — the packets are mixed together and a tool cannot tell which link a given packet came from — and the answe…
L3 Network
This layer holds the domain's signature capability, and what it solves is a blind spot that appeared only once networks became overlays. Modern data centres commonly use encapsulation such as VXLAN to build an overlay (see EVPN-VXLAN in the equipment domains' L2), and the result is that packets captured on the backbone carry an outer wrapper while most analy…
L4 Transport
This is where a capture network brings the volume down and keeps together what has to stay together, and it is the layer most easily got wrong. Four blocks. Layer 4 and adaptive filtering: distributing by port and five-tuple is the basis, and when the standard fields are not enough (filtering on a field inside an encapsulation, or on a pattern anywhere in th…
L5 Session
This layer solves a problem the five-tuple cannot: a business session is often not one connection. Everything in the layers below distributes on the five-tuple (see L4), and a five-tuple identifies one connection — so when a business session consists of several connections, hashing on the five-tuple scatters them across different tools and each tool sees onl…
L6 Presentation
This is the domain's thickest and most delicate layer, because what it does is turn encrypted traffic into plaintext. There are three technical routes with entirely different capabilities and prerequisites.
L7 Application
This layer answers what buying all of this actually saves, which makes it where the domain's commercial logic concentrates. Four blocks. Application metadata extraction: pulling layer 7 detail out of the traffic (hostnames, request paths, status codes, DNS questions and answers, certificates and handshake attributes) and exporting it as structured records —…
Cross-layer / Operations
This is the layer this domain can least afford to skip, and for a reason unlike any other domain's: a capture network is the highest-value attack target on the whole network. By design it sees all traffic, and after L6 it holds plaintext, so compromising one capture device is equivalent to installing a wiretap across the estate — not an exaggeration but the…
Zscaler
Home turf: L5 / L7
L1 Physical
This layer is explicitly empty — no product or service. This domain is a fleet of proxy nodes deployed inside third-party facilities (see company background), but it sells no physical-layer product itself — no colocation, no cross connects, no hardware — the nodes' own physical access is the facility operator's responsibility.
L2 Data Link
This layer is explicitly empty — no product or service. Same as L1: it builds no switches and manages no VLANs — the layer-2 network is the facility operator's responsibility.
L3 Network
This layer is the domain's real entrance, and two things have to be settled first: how traffic gets there, and whose egress address yours becomes once it does. The first has four methods, and that choice affects every layer above: the endpoint agent (follows the person, best for roaming, at the cost of agent coverage becoming a standing operational burden),…
L4 Transport
The mechanical core of this layer is one sentence: it is a proxy, so your one connection becomes two of them there. Client to its node is one, node to destination is another — each with its own addresses, its own timeouts and its own congestion control.
L5 Session
This is the thickest layer in the domain, and its core mechanism deserves one sentence up front: connectors dial outward from the inside, so your internal applications no longer listen on any port to the outside.
L6 Presentation
This is the most important and most contentious layer in the domain, and its proposition is the eighth version of this site's 'X is not encryption' thread, facing the opposite way from the previous seven: inspection means decryption.
L7 Application
The leading content of this layer is not a feature list but a question of direction — because it is the thing most often got wrong about this category, and getting it wrong means buying the wrong product. It faces inside-out: it protects your people and your workloads reaching out to the internet, to SaaS and to your own internal applications.
Cross-layer Ops & Governance
This is the layer most worth reading carefully in the domain, because it concentrates all of this architecture's costs, and the first is the heaviest: when it is down, you are offline.
Fortinet
Home turf: L1 / L5 / L7
L1 Physical
This is one of this domain's star layers: the FortiGate hardware platform and its custom-designed silicon. From entry-level desktop models (40F/60F/70F) to data-centre chassis (7000F), nearly the entire lineup carries in-house NP (network processor) and CP (content processor) ASICs — the same engineering logic as this page's F5 domain's dedicated SSL crypto…
L2 Data Link
FortiSwitch is this domain's layer-2 product — an Ethernet switch that can be managed standalone, but its real differentiator is centralized management from FortiGate once it joins the Security Fabric (this page calls this 'Fabric-managed switching'), letting port-level security policy tie into firewall policy.
L3 Network
FortiGate is essentially a device capable of full layer-3 routing — supporting dynamic routing protocols like OSPF and BGP, and one of the most common landing scenarios for site-to-site IPsec VPN tunnels.
L4 Transport
Stateful firewall inspection is this domain's most basic yet most central capability: FortiGate maintains a state table for every TCP/UDP connection, only permitting traffic that matches a known legitimate connection (or an explicit allow rule) — the key mechanism that distinguishes a firewall from a simple packet-filtering router.
L5 Session
This is another of this domain's star layers: Secure SD-WAN is built into FortiGate, usable without purchasing a separate SD-WAN appliance or license (most competitors' SD-WAN is a standalone product line requiring separate procurement).
L6 Presentation
This layer needs to plainly record an issue that can't be glossed over: this domain's SSL-VPN product has, historically, had high-severity vulnerabilities disclosed multiple times (some of which were used in large-scale attack campaigns), and the vendor now explicitly recommends customers migrate to IPsec or ZTNA (Zero Trust Network Access) modes as a replac…
L7 Application
This is this domain's third star layer: the Security Fabric ecosystem's subscription-based security product bundle, covering UTM/ATP threat-protection subscriptions (IPS/AV/sandboxing and similar), FortiWeb (web application firewall), FortiClient (endpoint protection and ZTNA client), and FortiSASE (cloud-delivered secure access service edge).
360 Security
Home turf: L7
L1 Physical
This layer is explicitly empty — no product or service. 360's confirmed current business is consumer endpoint security software; it does not sell networking hardware (switches, routers, etc.).
L2 Data Link
This layer is explicitly empty — no product or service. Same as L1: 360 sells no networking hardware, and provides no product or service at the layer-2 protocol level.
L3 Network
This layer is explicitly empty — no product or service. Same as L1 and L2: this domain's product line doesn't cover routing, IP-layer network equipment or services.
L4 Transport
This layer is explicitly empty — no product or service. Same as above: 360 provides no firewall, load-balancer or other transport-layer network equipment or services — that category belongs to this page's Qi An Xin, Sangfor and NSFOCUS-style domestic security-vendor domains, not to 360.
L5 Session
This layer is explicitly empty — no product or service. 360 has no VPN, SD-WAN or other session-layer networking product — its security software operates locally on the endpoint device and at the application layer, and does not participate in establishing or maintaining network sessions.
L6 Presentation
This layer is explicitly empty — no product or service. 360's secure browser does handle download scanning and malicious-URL blocking for HTTPS pages, but that capability lives at the application layer (a feature of the browser itself), not as a standalone encryption or presentation-layer protocol product — so this layer is accurately marked empty rather tha…
L7 Application
This is the only layer where this domain has an actual product, and it's where its entire weight sits: a free endpoint-security software ecosystem aimed at consumers in mainland China — 360 Total Security / Safe Guard (system security and optimization), 360 Antivirus (a standalone AV engine), 360 Secure Browser / 360 Speed Browser (browsers with built-in mal…
FireEye
Home turf: L4 / L7
L1 Physical
This layer's content is thin, covering the rack-mounted appliance form factors that existed while the FireEye brand was an independent company (2004-2021): the NX series (network), EX series (email) and HX series (endpoint) were all dedicated hardware appliances deployed in data-centre racks.
L2 Data Link
This layer covers how the NX series historically inserted into an existing network — similar in spirit to this page's Palo Alto domain's deployment-mode decision: NX supported a monitor-only mode (receiving a mirrored/TAP traffic copy, detection only, no blocking, zero risk) and an inline bridging mode (transparently spliced into the traffic path, able to bl…
L3 Network
This layer is explicitly empty — no product or service. The NX appliance itself provides no traffic-aggregation or distribution product — it depends on mirror ports, TAPs, or traffic-visibility infrastructure of the kind this page's Gigamon domain covers, already present in the network, to bring a traffic copy to it.
L4 Transport
This is one of this domain's historical star layers: the NX series tracked TCP/UDP sessions to identify the connection-behaviour signature of malware calling back to a command-and-control server (C2 callback), and in inline mode could cut such connections directly.
L5 Session
This layer is explicitly empty — no product or service. This domain has no VPN, SD-WAN or other session establishment/maintenance product — its role has always been detecting the traffic that passes through, not participating in establishing, maintaining or routing the session itself.
L6 Presentation
This layer is explicitly empty — no product or service. This domain's detection engine analyzes the plaintext content of traffic, but encryption/decryption itself was generally not its own product capability — facing encrypted traffic, it depended on dedicated external appliances to perform the decryption (such as the inline decryption modules this page's Gi…
L7 Application
This is this domain's heaviest historical layer, and its original core innovation: the MVX (Multi-Vector Virtual Execution) detection engine — actually running a suspicious file, URL or email attachment inside an isolated virtual environment and observing its real behaviour (whether it drops a malicious payload, attempts a callback, or takes lateral-movement…