Everyone's Shopping for NAC Wrong

Network access control was supposed to be dead. Around 2015 the whole industry moved on. Agents were a nightmare, 802.1X broke printers, and everyone decided the perimeter was disappearing anyway, so why bother policing the wire.

Then the perimeter actually did disappear. And it turned out the thing standing between an attacker and your soft, flat internal network was the exact control everyone had written off. NAC came back from the dead. The market sits around 5.4 billion dollars this year and is projected to hit 48.8 billion by 2035, a 24 percent compound growth rate. That is not a graph you draw for a dead product.

So now every mid-market team and every MSP I talk to is running a NAC evaluation. And most of them are getting it wrong before the first demo is even booked. The wrong question is "which NAC has the most features?"

The feature matrix is a trap

I just spent a week scoring eleven NAC platforms across twelve criteria. Cisco ISE, Aruba ClearPass, Forescout, FortiNAC, Portnox, Juniper Mist Access Assurance, Arista AGNI, Extreme, Ivanti Policy Secure, macmon, Genians. If you line them up on a spec sheet, they blur together. Every one of them does 802.1X. Every one does profiling, guest, posture, some flavor of segmentation. Every vendor's matrix is a wall of green checkmarks, because every vendor writes their own matrix.

The checkmarks lie. Not because the features aren't real, but because a feature that ships is not the same as a feature your team will ever turn on. The dividing line between NAC that works and NAC that becomes expensive shelfware has nothing to do with capability. It's whether the people who own it can actually operate it after the reseller's professional services hours run out. That is the whole game, and almost nobody scores for it.

The Cisco tax nobody warns you about

Cisco ISE is the default answer, and for a certain kind of shop it's the right one. Deep TrustSec integration, TACACS+ for device admin, the muscle to handle a campus with a hundred thousand endpoints. If you already live inside Cisco DNA and Catalyst and you have a dedicated network team, ISE is hard to beat.

For everyone else it's a trap dressed as a safe choice. ISE is the platform I see bought and never finished. It gets deployed to monitor mode, the team hits the wall on policy complexity, and it sits there in "we'll enforce next quarter" limbo for two years. You bought the Ferrari and you drive it to the mailbox. The license meter runs the whole time.

ClearPass is the same story with better hardware independence. Powerful, vendor-agnostic on the switch side, and heavy. Both reward organizations with staff who do nothing but NAC. If that is not you, name the org that will run this thing on a Tuesday when it breaks, and be honest about the answer.

The real fault line is operating model, not brand

Forget the logos for a second. The line that actually predicts whether you'll succeed runs through two questions: agent or agentless, and box or cloud.

Agentless matters more every year because you cannot put an agent on the thing that's most likely to get you owned. Palo Alto Networks looked at 27 million devices across 1,800 enterprise networks and found that 32.5 percent of everything on corporate networks operates outside IT control. Cameras, badge readers, HVAC controllers, infusion pumps, the label printer in shipping. None of those take an agent. Your NAC's real job is the third of the network you can't install anything on.

This is where Forescout still earns its price. It was built agentless from day one, its device intelligence is the best in the field, and it does not care whose switches you run. If deep visibility across a messy multi-vendor environment is the problem, it's the serious answer, and it's priced like it knows that.

Box or cloud is the other split, and it's where the interesting money is going. Portnox went cloud-native and gutted the thing everyone hates about NAC: standing up and babysitting appliances. For a lean team with no NAC specialist, that trade is worth more than any feature on Cisco's sheet. Juniper Mist Access Assurance and Arista AGNI are the same wave from the infrastructure side, cloud-delivered access baked into networks you might already be buying. FortiNAC only makes sense as a sentence that ends with "because we're already a Fortinet shop." Outside that fabric the shine comes off fast.

IoT and OT rewrote the math

NAC didn't come back for the office laptop. It came back for everything else that got plugged in. That same Palo Alto data set found 77.74 percent of networks have poor segmentation, meaning the medical device and the accountant's workstation are sitting in the same broadcast domain with nothing between them. That's not a config oversight. That's the default state of most networks, and it's exactly what ransomware uses to go from one box to all of them.

This is why the specialists deserve a look the big four never send your way. Genians is quietly excellent at device visibility and priced for the mid-market. macmon is the one European buyers and OT-heavy shops should have on the list and usually don't. Neither will show up in a Gartner-anchored shortlist your VAR hands you, which is precisely why they're worth the call. If your risk lives in the OT and IoT layer, a focused tool that nails that layer beats a platform that treats it as an afterthought.

Here's the honest caveat, because I'm not going to pretend the giants are obsolete. Scale still favors the incumbents. Push past tens of thousands of endpoints, or need TACACS+ device administration and tight fabric-wide enforcement, and ISE and ClearPass pull ahead for real reasons. The specialists win the mid-market. They don't win the enterprise core. Match the tool to the size of the actual problem.

So what should you actually buy

Score it the way it'll actually play out. Start with the third of your network you can't put an agent on, because that's where the incident starts, and weight agentless visibility accordingly. Then be brutally honest about who operates this after go-live. One overworked generalist points you at cloud-native and Portnox. A real network team unlocks ISE and ClearPass and the payoff they bring.

Then map your existing fabric, because Fortinet, Juniper, and Arista shops all have a native answer that cuts integration pain to near zero. Weight segmentation and OT handling by how much of your risk actually lives in those devices, which for healthcare and manufacturing is most of it. Only then, dead last, do you open the feature matrix. It's a tiebreaker, not a decision.

The best NAC is not the one with the most checkmarks. It's the one your team fully deploys and still runs eighteen months from now. Everything else is a license you're renting to feel safe.

Run it on your own shortlist

I turned this into a free scorecard. It ranks all eleven platforms across the twelve criteria above, with weights you set for your own environment. Change a number and the ranking moves.

Sources

SNS Insider, network access control market projections, 2026 · Palo Alto Networks, device telemetry across 27 million devices and 1,800 enterprise networks.

Buy for the deployment you'll finish, not the demo you'll enjoy.