Vietnam Software-Defined Perimeter Market Size, Share, Growth and Forecast, 2025-2035

Access control moves from VPNs to named applications

The Vietnam software-defined perimeter market was valued at USD 7.30 million in 2025 and is projected to increase from USD 9.27 million in 2026 to USD 137.5 million by 2035, registering a CAGR of 34.93% during 2026–2035. Demand comes from banks, digital platforms, factories and public bodies that must prove who reached which application, a question that became sharper after 52.30% of organizations in a National Cybersecurity Association survey reported cyberattack damage in 2025. Ho Chi Minh City held the largest regional share, 43.0% in 2025, because its merged economy, about 24% of GDP, concentrates bank, digital and industrial buyers. Provincial markets are the fastest-growing zone at 36.43% a year as factories and branch networks in fast-growing provinces connect to central systems. The main regulatory change is Law No. 91/2025/QH15 on personal data protection, effective Jan. 1, 2026, followed by the new Cybersecurity Law with a July 1, 2026 effective date. Together these rules push buyers away from broad network tunnels and toward logged, per-application access.

What does software-defined perimeter spending cover in Vietnam?

The market counts spending by Vietnamese organizations on software-defined perimeter products that hide applications from the open internet and open a connection only after the user, device and request are verified. This includes cloud-delivered access, on-premises access software, managed access services and professional services for design and rollout. Buyers usually purchase annual subscriptions or licenses through integrators, with larger banks and telecom groups also negotiating directly.

The estimate excludes firewalls, endpoint tools and security monitoring sold on their own, even when they come from the same vendor. The value chain runs from global platform vendors through distributors and Vietnamese integrators to end users, while local managed providers often operate the service after deployment.

Banks and cloud delivery anchor early access spending

Why does cloud delivery lead while managed access grows fastest?

Based on solution type, the market is categorized into cloud-delivered access, on-premises access software, managed access services and professional access services. Cloud-delivered access led with 41.0% of 2025 value because enterprise workloads are moving to cloud, and VnEconomy reported in October 2025 that the Vietnam Internet Association's data put cloud spending at $734 million in 2024. On-premises software keeps a real base among operators such as Viettel, which runs FortiGate appliances for segmentation and remote access. Managed access services grow fastest at 37.86% a year as 47.72% of organizations reported cybersecurity staff shortages in the National Cybersecurity Association's 2025 report, so outsourced operation suits many buyers.

Why do banks spend first and public bodies accelerate?

Based on end-use industry, the market is categorized into financial services, digital services, manufacturing and public and social services. Financial services led with 38.0% of 2025 value because State Bank of Vietnam Circular 09/2020/TT-NHNN requires multi-factor authentication for internal network access, and a commercial bank lost VND 100 billion in a breach disclosed in May 2025. Digital services follow, given 80,052 active digital technology firms counted by the Ministry of Science and Technology for 2025. Public and social services grow fastest at 37.38% a year as Decision 1751 targets verified digital identities for 90% of citizens and businesses by 2030, according to Viet Nam News.

Why does employee access lead while partner access accelerates?

Based on application, the market is categorized into employee private application access, third-party application access and privileged application access. Employee private application access led with 56.0% of 2025 value because about 70% of Vietnamese respondents in a June 2023 Fortinet survey worked in hybrid or fully remote models, and nine in ten organizations in Cisco's 2025 readiness index flagged risk from unmanaged devices. Privileged access has a clear rule base, since Circular 09 requires administrator rights to be revoked once authorized tasks end. Third-party application access grows fastest at 37.28% a year as banks must fully comply with open API Circular 64/2024/TT-NHNN by March 1, 2027, according to Brankas.

Why do integrators lead while managed providers gain ground?

Based on sales channel, the market is categorized into direct enterprise sales, integrator-led sales and managed provider sales. Integrator-led sales led with 47.0% of 2025 value because global platforms depend on local deployment skills, shown by FPT's role as a strategic partner at Check Point Advantage 2025, reported by FPT IS in November 2025. Direct deals remain concentrated among very large groups with their own security teams. Managed provider sales grow fastest at 37.87% a year as CMC Cyber Security signed a March 2026 agreement with South Korea's IGLOO that pairs its managed service capabilities with banking and insurance clients, according to The Investor.

Data laws, cloud apps and partners pull demand forward

Data laws make every access decision a compliance record

Vietnam's data rules now make organizations answer for who reached personal records, which turns access logs into compliance evidence. Law No. 91/2025/QH15, passed June 26, 2025 and effective Jan. 1, 2026, sets fines of up to 5% of prior-year revenue for cross-border transfer breaches and requires violations to be reported within 72 hours, according to Tilleke & Gibbins. Decree 356/2025/ND-CP makes technical safeguards such as multi-factor authentication mandatory for sensitive data processing, according to Rouse. Law No. 116/2025/QH15 also imposes mandatory assessments on critical information systems, according to Duane Morris. As a result, buyers want tools that record each user, device and application session rather than a single network login, and this favors Cloud-delivered access at 41.0% of 2025 value.

Application modernization exposes the limits of network tunnels

Applications are leaving the corporate data room, and software-defined perimeter designs protect them better than a network tunnel once they sit across several clouds. The Vietnam Internet Association's VNCDC report, cited by VnEconomy in October 2025, projected cloud spending of USD 1.24 billion in 2025 and data center capacity of 525 MW in 2025, against 45 MW in 2024. The Ministry of Science and Technology put the digital economy at about USD 72.1 billion, an estimated 14.02% of GDP, in its June 2026 briefing. World Bank data show internet use at 84.15% of the population in 2024, up from 78.08% in 2023. In turn, staff and customers reach more services from outside the office, so publishing each application behind its own verified connection becomes the practical design.

Download Free Sample

Partner-led adoption fills the gap in enterprise security teams

Most Vietnamese enterprises cannot design and run access policy alone, so integrators and managed providers now shape adoption. A 2025 Fortinet-commissioned study reported by Vietnam Investment Review found fewer than one in six organizations had a standalone security chief, and only 6% had dedicated security operations and threat hunting teams. Cisco's 2025 readiness index found 95% of Vietnamese firms named talent shortages as a major hurdle. FPT IS said in November 2025 that its FPT.EagleEye mSOC platform serves finance, telecommunications, energy and public sector organizations while integrating Check Point, Palo Alto Networks and Fortinet products. Because partners bring both the skills and the customer relationship, Integrator-led sales accounted for a 47.0% share of 2025 value.

Credential theft pushes buyers toward identity-first access

Attackers increasingly log in rather than break in, which weakens any model that trusts a user after one network check. A December 2025 National Cybersecurity Association survey of over 5,300 organizations found 52.30% reported damage, up from 46.15% in 2024. Vnetwork counted 685,912 credential attacks, or 25.1% of the incidents in its report, according to Vietnamnet in April 2026. Viettel Cyber Security recorded 6.5 million stolen personal accounts in the third quarter of 2025, up 64% from the previous quarter. Vietnamnet reported in March 2026 that eight of ten companies assessed had identity and access weaknesses, while more than 9.3% of organizations had no internet access control at all. Security teams are therefore pairing strong authentication with application-level authorization.

AI agents and open banking widen the access policy scope

Shift from VPN concentrators to per-application access

Vietnamese buyers are starting to retire remote access appliances that grant broad network reach. One Mount Group, the parent of VinID and VinShop, replaced a legacy on-premises VPN with Cloudflare Zero Trust to protect hundreds of internal and SaaS applications, according to a Cloudflare case study. The same Fortinet-commissioned 2025 study ranked SASE and zero trust among the top five investment areas for the next 12 to 18 months in Vietnam. It also found 96% of organizations were converging security and networking or evaluating that step. This shift borrows from wider zero trust architecture programs, although most local rollouts begin with one user group and a few high-risk applications before reaching the whole company. Vendor consolidation, considered by 80% of respondents, should favor platforms that bundle these controls.

Rise of AI agents as identities inside access policy

AI agents are becoming a new class of user that access policy must identify and limit. At Cisco Connect Vietnam in Hanoi on May 5, 2026, Cisco presented Zero Trust Access for AI agents and said 62% of Vietnamese organizations risk losing value from AI investments through infrastructure debt, according to Viet Nam News. Palo Alto Networks used Ignite on Tour Hanoi on June 11, 2026 to pitch protection for every machine identity, AI agent and workload, according to Vietnam Investment Review. Cisco's 2025 index also found 25% of employees had unrestricted access to public generative tools. As artificial intelligence projects reach production, buyers are beginning to ask for agent-level logs and time-limited permissions in access products, not only human login controls.

Download Free Sample

Opening in managed access for smaller enterprises

Smaller enterprises offer the clearest untapped opening, because they face rising exposure without the staff to run an access platform. VnEconomy reported in September 2025 that SMEs make up 97% of more than 940,000 active businesses in Vietnam. The personal data law gives small businesses and startups a five-year grace period on impact assessments and data protection staffing, and Tilleke & Gibbins notes the relief does not apply to those processing sensitive data. That timeline gives providers until about 2031 to build a compliance-ready entry product. Packaged subscriptions that sit alongside managed security services would suit firms that lack a security team, which 56.16% of organizations reported in the Cisco data released by the National Cybersecurity Association in May 2025.

Opportunity in securing third-party access to open banking APIs

Open banking creates a specific sales opening for tools that govern outside parties rather than employees. Circular 64/2024/TT-NHNN took effect on March 1, 2025, required banks to submit API lists and deployment plans by July 1, 2025, and demands full compliance by March 1, 2027, according to Brankas. Savyint's April 2026 analysis says the circular calls for digital signing, encryption and OAuth 2.0-based identity and access management among banks, customers and third-party providers. Circular 09 already sets minimum contract terms for outside providers that handle client data. Therefore, vendors that can show per-partner, per-API policy and audit records can sell into a dated compliance program, and this supports Third-party application access at 37.28% a year through the forecast period.

Staff gaps and thin budgets slow enterprise rollouts

A deep shortage of security staff delays rollouts

Skills are the tightest constraint on software-defined perimeter deployment across Vietnam. The National Cybersecurity Association warned at the Vietnam Security Summit in May 2025 of a shortfall above 700,000 cybersecurity professionals, according to VietnamPlus and 42% of firms in Cisco's 2025 index had more than ten security positions unfilled. Mid-sized enterprises feel this most, because access policy needs constant tuning as applications change. As a result, projects stall after a first user group, which is why providers increasingly bundle policy operation into their contracts.

Small budget increases limit full platform purchases

Budgets are rising, although usually too slowly to fund a full replacement of existing remote access. The Fortinet-commissioned 2025 study found nearly nine in ten Vietnamese organizations raised security spending, yet 60% of those increases were below 5%. Cisco's 2025 index found only 52% allocate more than 10% of IT budgets to cybersecurity. Consequently, smaller buyers phase purchases by application and keep older VPNs running in parallel, which lengthens sales cycles and leaves mixed estates. Subscription pricing softens this constraint only partly for the smallest buyers in the market.

Fragmented security tools complicate integration

Existing security estates make new access controls harder to operate well. Cisco's 2025 index found 84% of Vietnamese organizations said more than ten point solutions slow their response to threats. VSEC deputy chief executive Phan Hoang Giap told Vietnamnet in March 2026 that many deployed tools work separately and depend on manual processes. Buyers therefore risk adding another console rather than reducing risk, and vendors must prove identity, logging and monitoring integrations during pilots before enterprises will commit to wider deployment.

Unsettled data retention rules complicate cloud delivery

Cloud-delivered access depends on where logs and account data sit, and this rule is still being defined. Duane Morris wrote in January 2026 that data localization remains under Law No. 116/2025/QH15, covering items such as account names and access IP addresses, while the retention period awaits a government decree. Foreign platforms and regulated buyers face the greatest uncertainty until that decree settles the detail. Many therefore favor local points of presence or hybrid designs, which add cost but reduce the risk of later redesign.

Two metro hubs lead while industrial provinces catch up

Ho Chi Minh City leads on finance and merged industrial output

Ho Chi Minh City held a 43.0% share of 2025 value and grows at 34.23% a year. General Statistics Office data for 2023 put the merged city, including Binh Duong and Ba Ria-Vung Tau, at about $99 billion of output, or around 24% of GDP, according to Vietnamnet. The city also contributed 23.11% of national growth in 2025 and hosted the Vietnam Security Summit in May 2025. Bank head offices and factories in the former Binh Duong area give vendors both employee and third-party access deals in a single metro market.

Hanoi leads on government and vendor engagement

Hanoi held a 32.0% share of 2025 value and grows at 34.63% a year. VnEconomy reported about 410,000 active enterprises in the capital in September 2025, and its 2025 output rose 8.16% according to the General Statistics Office. Vendors treat the capital as their policy and customer hub, since Cisco Connect Vietnam, Palo Alto Networks Ignite on Tour and the CMC and IGLOO signing all took place there in 2026. Ministries and national data programs add steady public sector demand for verified access.

Download Free Sample

Provincial markets grow fastest on factories and branch networks

Provincial markets held a 25.0% share of 2025 value and are the fastest-growing zone at 36.43% a year. Quang Ninh and Hai Phong posted 2025 output growth of 11.89% and 11.81%, the highest in the country, according to the General Statistics Office, on the back of LG investment and the VinFast complex in Hai Phong. Plants and branches in these provinces connect to head offices elsewhere, and local IT teams are thin. Consequently, centrally managed cloud access suits them better than appliances installed and maintained at each site.

Download Free Sample

Vendors and integrators raised their Hanoi presence

Identity, device and API controls define current designs

• Identity-aware gateways verify the user before an application becomes reachable, which answers the credential attacks that dominated recent incident counts in Vietnam.
• Device posture checks test the laptop or phone before granting a session, which addresses the unmanaged device risk that Vietnamese organizations reported to Cisco.
• Just-in-time administrator access grants rights only for an authorized task and then removes them, following the State Bank of Vietnam rule on administrator accounts and intermediate servers.
• OAuth 2.0 API authorization gives each outside partner a scoped token rather than shared credentials, in line with the open API requirements for Vietnamese banks.

Global platforms sell through Vietnamese integrators

Competition is split between global platforms and the Vietnamese firms that sell, deploy and often operate them. Palo Alto Networks, Cisco and Check Point ran events for Vietnamese customers during 2025 or 2026, and Fortinet keeps a country team led by Nguyen Gia Duc. Fortinet has a visible installed base in Viettel and Asia Commercial Bank, which gives it a natural upgrade path from firewalls to access services. Zscaler reaches Southeast Asia through distribution, with Westcon-Comstor authorized since May 2024 to deliver professional services for Zscaler Private Access across the region. Vietnamese firms such as FPT, CMC Cyber Security and Viettel Cyber Security compete for the service layer, where local language support and proximity to regulators matter. With 80% of surveyed organizations considering vendor consolidation, software-defined perimeter demand should favor broader platforms. Vendors differentiate on integration with existing tools, local data handling and how much policy work a partner can absorb for the customer.

Companies profiled and their roles in this market

Credence Research view on Vietnam access spending

Credence Research's view is that regulation will open the software-defined perimeter market, but operations will decide who wins it. Dated rules on personal data, cybersecurity and open banking give buyers a reason to act between 2026 and 2027, yet most lack the staff to run fine-grained access policy. Vendors should therefore judge success by the partners they enable as well as the licenses they sell. Buyers should start with privileged accounts and outside partners, where the rules are clearest, and expand to employees afterward. The two metro hubs held a 75% share of 2025 demand, so the fast forecast depends on managed offers reaching mid-sized firms beyond them.

How the Vietnam access spending estimate was built

The report uses 2025 as the base year on a calendar basis, and market values come from the Credence Research model. That model was checked against national GDP share and the size of related security spending. Segment and regional splits are Credence Research estimates informed by public data on output, enterprises, regulation and vendor activity. Sources include World Bank data, General Statistics Office and Ministry of Science and Technology releases as reported by Vietnamese media, law firm summaries, National Cybersecurity Association reports and company publications. No interviews or surveys were conducted for this edition of the report.

Managed access and provinces shape the road to 2035

Software-defined perimeter demand should move from bank-led compliance purchases toward broader subscription use, reaching USD 137.5 million by 2035 at a 34.93% CAGR. The next checkpoints are the decree on data retention and the March 1, 2027 open banking compliance deadline, and both will influence how cloud-delivered products are designed. After that, growth depends on whether small and mid-sized firms adopt managed offers before their personal data grace period ends around 2031. Provincial factories and public service systems should provide the next demand wave, while AI agent governance is likely to become a standard feature of access platforms.

Note: The depth of individual sections depends on data availability for this market. Volume, capacity, trade and other unit-based metrics are included where applicable.