In short
SASE providers we supply include Check Point SASE, Cisco Secure Access and Cisco SASE, Trend Micro ZTSA, Todyl SASE, Exium SASE, WatchGuard FireCloud and NordLayer, with DNSFilter as a DNS layer. They differ in components, whether SD-WAN is included, how traffic is inspected and whether licences are per user or per device. We compare them on fit, not rank.
Get a quote for a SASE platform
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
How to read this comparison
These are the SASE and security service edge (SSE) platforms we supply. Each row is drawn from the vendor's own published material and our fact-checked licensing data. We do not rank them, give scores or repeat analyst placements: the right platform depends on what you already run, how many users and sites you have, and which applications need protecting.
If you are still deciding between ZTNA, SSE and SASE, read SASE vs SSE first. If your priority is private application access only, the ZTNA providers page covers ZTNA-focused products as well, including those with no SASE features.
SASE and SSE platforms compared by component
| Platform | ZTNA | Web gateway (SWG) | CASB / SaaS | FWaaS | SD-WAN |
|---|---|---|---|---|---|
| Check Point SASE (formerly Harmony SASE) | Yes: Private Access, agentless ZTNA, Enterprise Browser | Yes: on-device or hybrid | Yes: SaaS Security, inline and API | Yes | Yes |
| Cisco Secure Access / Cisco SASE | Yes: client-based and clientless, plus VPN as a service | Yes | Yes | Yes; Layer 7 with IPS in Advantage | With Cisco Catalyst SD-WAN or Meraki SD-WAN (Cisco SASE) |
| Trend Micro ZTSA | Yes: Private Access via connectors | Yes: Internet Access | CASB controls; AI Secure Access | - | - |
| Todyl SASE | Yes: identity-based conditional access | Yes, with secure DNS | - | Yes: cloud NGFW; SSL inspection by option or package | IPsec SASE Tunnel, not SD-WAN |
| Exium SASE (now part of NETGEAR) | Yes; agentless on Pro | Yes: DNS and web security | SaaS security; conditional access on Pro | Software NGFW at sites (Cyber Gateway) | Cyber Gateway per site |
| WatchGuard FireCloud | Total Access only | Yes | Application Control | Yes | Via Firebox at sites |
| NordLayer | Yes: private gateways, device posture | Web Protection; DNS filtering on Core and Premium | - | Cloud Firewall on Premium | Site-to-Site connector on Premium |
| DNSFilter | - | DNS layer only | AppAware app blocking | - | - |
"-" means the component is not part of that product as we supply it. Vendors add features often, so we confirm the current position on your quote.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Delivery, licensing unit and fit
| Platform | How traffic is handled | Licensed | Often suits |
|---|---|---|---|
| Check Point SASE | Agent with on-device inspection, or hybrid with Check Point's cloud; private backbone for Private Access | Per user: Internet Access (Essentials, Premium or Complete, on-device or hybrid) and Private Access | One vendor for users, SaaS and branches |
| Cisco Secure Access | Cisco Secure Client or browser to Cisco's cloud; resource connectors beside private apps | Per user, Essentials or Advantage, 12, 36 or 60-month terms | Cisco, Duo, Meraki and Secure Firewall estates |
| Trend Micro ZTSA | Secure access module or browser portal; connectors near apps | Per user, under TrendAI Flex | TrendAI Vision One customers wanting risk-based access |
| Todyl SASE | Always-on agent to Todyl's Secure Global Network points of presence | Per device; static IPs per tenant and SASE Tunnel per tunnel as options | SASE plus endpoint security on one platform |
| Exium SASE | Client on each device; agentless access on Pro; software gateway at sites | Per user (up to five devices); Cyber Gateway per site | Small and mid-sized multi-site organisations |
| WatchGuard FireCloud | Connection Manager builds WireGuard tunnels to WatchGuard points of presence | Per user | WatchGuard Firebox customers with remote staff |
| NordLayer | App connects to shared gateways or a Virtual Private Gateway on a dedicated server | Per user from five users, up to six devices each; servers extra | Smaller teams needing quick, hardware-free access |
| DNSFilter | Roaming client on devices, or network and relay deployment | Per licence (device or network query volume) | A DNS protection layer alongside any of the above |
Licensing detail and editions are on our licensing site: Harmony SASE licensing, Cisco Secure Access licensing, Trend Micro Zero Trust Secure Access licensing, Todyl SASE licensing, Exium SASE licensing, WatchGuard FireCloud licensing and NordLayer licensing. For cost drivers without prices, see ZTNA cost.
The platforms in brief
Check Point SASE. Check Point's website now calls it the Check Point SASE Platform (formerly Harmony SASE); it is built on Perimeter 81, which Check Point acquired in 2023. Private Access, Internet Access, SaaS Security, GenAI Security and Secure SD-WAN make it a single-vendor SASE option. More on Check Point ZTNA, and in depth on our specialist site under Check Point Harmony SASE.
Cisco Secure Access and Cisco SASE. Secure Access is Cisco's SSE, combining Secure Internet Access and Secure Private Access. Cisco SASE pairs it with Cisco Catalyst SD-WAN or Meraki SD-WAN, and universal ZTNA extends the same policy to on-site users through Secure Firewall. See Cisco universal ZTNA, Cisco Secure Access and Cisco SASE.
Trend Micro ZTSA. TrendAI Vision One Zero Trust Secure Access is Trend's SSE, with Private Access, Internet Access and AI Secure Access. Its distinctive feature is that Vision One risk data can remove a risky user's or device's access. See Trend Micro ZTSA.
Todyl SASE. An always-on agent tunnels each device to Todyl's Secure Global Network for ZTNA, web gateway, DNS security and a cloud firewall, using the same agent as Todyl's endpoint security. See Todyl SASE and, for the vendor overview, Todyl.
Exium SASE. Exium, now part of NETGEAR, sells SASE Essentials and SASE Pro per user, with the Cyber Gateway as a software firewall and SD-WAN for sites. See Exium.
WatchGuard FireCloud. Internet Access provides firewall as a service and a secure web gateway; Total Access adds zero trust access to private resources through a Firebox or virtual gateway. See WatchGuard FireCloud.
NordLayer. Nord Security's business network access service combines ZTNA building blocks, web protection and, on Premium, a cloud firewall and site-to-site connector. See NordLayer ZTNA and NordLayer.
DNSFilter. Not a SASE platform, but a DNS protection layer that many organisations run alongside one. See DNSFilter.
Also worth knowing. Sophos ZTNA is part of Sophos Workspace Protection, and Island, best known for its enterprise browser, describes Island Enterprise Network as its SASE offering alongside Island Private Access; ask us about either. For access to private applications only, without the web and SaaS layers, Zero Networks Connect and TruGrid are covered on our ZTNA providers pages.
Is a SASE platform the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Single-vendor vs multi-vendor SASE
Some providers above sell the whole stack; others sell the security half and expect you to bring the network.
- Single-vendor SASE (for example Check Point SASE, or Cisco Secure Access with Cisco or Meraki SD-WAN) gives one policy model, automated site tunnels and one support route.
- Multi-vendor SASE pairs an SSE with an SD-WAN or firewall estate you already own, joined by IPsec. It protects existing investment and avoids replacing branch kit mid-contract.
- SSE-only or user-only services (such as Trend Micro ZTSA, Todyl SASE or NordLayer) suit organisations whose offices are simple and whose users are the priority.
The trade-offs are covered on SASE vs SD-WAN and SASE vs firewall.
How to shortlist SASE providers
The NCSC's guidance on assessing ZTNA services and providers gives a sound framework for any SASE purchase, not just ZTNA. Turned into a shortlist method:
- Write down what you need now and later: users, devices (managed and unmanaged), sites, private applications, SaaS and AI use, and WAN contract dates.
- Understand the trust relationship. List what you would delegate to the provider (identity enforcement, policy decisions, traffic handling, logging), how critical the service becomes and what happens if it is unavailable.
- Check visibility and control. Confirm what you keep control of: policy configuration, logs you can export, and how incidents involving the service are detected and handled.
- Check fit with what you own. Identity provider, device management, existing firewalls and SD-WAN, and any integrations you rely on.
- Trial before committing. The NCSC recommends trials or proof-of-concept deployments with realistic users, devices and applications. Piloting two shortlisted platforms side by side often settles the question.
- Agree shared responsibility. Be clear which security tasks sit with the vendor and which stay with you or with us, such as configuration, policy changes and response to compromise.
The same method, applied to ZTNA products, is on ZTNA providers.
SASE VPN providers and business VPNs
Some people search for "SASE VPN providers" because they want to replace a business VPN. Most platforms above can do that through ZTNA, and several also offer VPN as a service for applications that cannot use ZTNA yet, such as Cisco Secure Access. If what you need is a straightforward hardware-free business VPN, our licensing site covers those options. If the goal is to retire the VPN properly, start with ZTNA vs VPN and our VPN replacement project guide.
How Forever Systems helps
Because we supply several SASE and SSE platforms, we can compare them against your requirements rather than defend a single product. We can build the requirements list with you, shortlist two or three platforms, run a pilot and then deploy and migrate in stages. Scope and timescales are confirmed at quote, and pricing depends on users, devices, sites and components, so ask us for a quote. Contact us for a recommendation based on fit.
How Forever Systems helps with ZTNA and SASE
We are an independent IT and cyber security provider. We supply and support several zero trust access and SASE platforms, so we can recommend what fits how your people work rather than one vendor's answer to everything.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across ZTNA, SSE and SASE options, including Cisco Secure Access and Check Point Harmony SASE
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What is a SASE provider?
A company that delivers secure access service edge: cloud security for users and sites (secure web gateway, CASB, ZTNA and usually firewall as a service) combined with SD-WAN networking, either from its own platform or through integrations.
Which SASE providers does Forever Systems supply?
Check Point SASE, Cisco Secure Access and Cisco SASE, Trend Micro ZTSA, Todyl SASE, Exium SASE, WatchGuard FireCloud and NordLayer, with DNSFilter as a DNS layer. We also supply Sophos ZTNA and Island Private Access.
Which SASE provider is best?
There is no single answer. It depends on your identity provider, device management, existing firewalls and SD-WAN, numbers of users and sites, and whether you need per-user or per-device licensing. We compare on fit and can run a trial.
What is single-vendor SASE?
SASE where one vendor supplies both the security service edge and the SD-WAN, giving one policy model and automated site tunnels. Check Point SASE and Cisco Secure Access with Cisco or Meraki SD-WAN are examples.
Are there SASE options for small businesses?
Yes. Several platforms are licensed per user or per device with no hardware, such as NordLayer, Exium SASE and Todyl SASE. See our ZTNA for small business guide for more detail.
Can we trial a SASE platform before buying?
Often, yes, and the NCSC recommends trials or proof-of-concept deployments before committing. We can set up a pilot with a small group of users and real applications.
Still have a question about a SASE platform?
Ask us and a member of our team will reply by email.