In short
NETGEAR completed its acquisition of Exium, a cloud-native SASE company, in June 2025, and Exium's site now says it is part of NETGEAR. Exium's products keep their names: SASE Essentials and SASE Pro for zero trust access and web, DNS and SaaS security, the Cyber Gateway software firewall with SD-WAN, XDR360 and IAM360.
Get a quote for Exium SASE
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
The NETGEAR acquisition of Exium
NETGEAR announced in June 2025 that it had completed its acquisition of Exium, a cybersecurity company with a cloud-native secure access service edge (SASE) platform. Exium's website now states that "Exium is now proudly part of NETGEAR".
What NETGEAR has said about the deal is limited and specific:
- the acquisition is meant to accelerate NETGEAR's work on integrated networking and cybersecurity for small and medium-sized businesses
- Exium's SASE is built for the needs of smaller organisations and designed to be managed by MSPs and MSSPs
- NETGEAR intends to use Exium's technology to bring a new class of secure networking products to market for MSPs and SMEs
At the time of writing, Exium's product names and packaging are unchanged and Exium still sells through partners. We do not speculate on NETGEAR's roadmap beyond what NETGEAR and Exium have published, and we confirm current names, editions and licensing when we quote. For buyers, the practical point is that Exium now sits inside a much larger networking company, which is worth weighing alongside the product itself.
What Exium SASE does
Exium splits its SASE into two halves, both managed from one console:
- Secure Internet Access: DNS security, including encrypted DNS, web security and SaaS security, with AI-driven threat prevention, so malicious sites and downloads are blocked before they reach the device
- Secure Private Access: zero trust network access to applications in your office, data centre or cloud, granted per application after the user and device are verified, instead of a VPN that puts users on the whole network
Both editions also include digital experience monitoring (DEX), which helps show whether a slow application is a network problem or an application problem, plus private DNS, private domains and mobile device security.
Around SASE, Exium sells further modules on the same platform:
| Module | What it does | Licensed per |
|---|---|---|
| Cyber Gateway | Software next-generation firewall with SD-WAN, segmentation and threat protection, for offices, data centres and cloud networks, running on general-purpose hardware, virtual machines or public cloud | Site |
| XDR360 | Detection and response with SIEM, Microsoft 365 security, endpoint security and compliance reporting | User or asset |
| IAM360 | Single sign-on, MFA, passwordless sign-in and a password manager | User |
| GRC360 | Compliance, risk, policy, audit and vendor risk management | User |
For the firewall angle, read SASE vs firewall; for how SD-WAN fits, see SASE vs SD-WAN.
Not sure which edition fits? Ask us
Tell us what you need and we will recommend the right edition for your organisation, with a quote.
Exium SASE Essentials vs SASE Pro
| Capability | SASE Essentials | SASE Pro |
|---|---|---|
| DNS (including encrypted DNS), web and SaaS security | Yes | Yes |
| Secure Private Access (ZTNA) | Yes | Yes |
| Private DNS and private domains | Yes | Yes |
| Mobile device security | Yes | Yes |
| AI-driven threat prevention | Yes | Yes |
| Digital experience monitoring (DEX) | Yes | Yes |
| Conditional access for SaaS applications | No | Yes |
| Geo-fencing controls | No | Yes |
| Agentless zero trust access | No | Yes |
| Connect existing firewalls to the SASE cloud | No | Yes |
| SSO/MFA, SCIM and SIEM integrations | No | Yes |
Essentials is the usual starting point for replacing a VPN and protecting web traffic. Pro suits organisations that want to lock SaaS apps to trusted access, restrict access by country, give contractors browser-based access without installing an agent (see agentless ZTNA), connect existing firewalls during a migration or feed events into a SIEM. Exium also positions Pro as a replacement for traditional firewalls. We confirm support for your identity provider during design.
Where Exium fits
Exium's design choices make it a natural fit for a particular kind of organisation:
- Small and mid-sized businesses that want VPN replacement, web protection and a firewall replacement from one platform rather than several suppliers
- Multi-site organisations with ageing office firewalls, where the Cyber Gateway can replace the box while remote users move to zero trust access
- Organisations without an in-house security team, because Exium is built to be operated by a service provider
- Hybrid workers with several devices, since a SASE user licence covers up to five devices
Measured against the NCSC's ZTNA guidance, Exium's Secure Private Access grants access per application after the user and device are verified, in line with the NCSC's call to enforce policy before granting access. As with any provider, the NCSC suggests gaining confidence through a trial or proof of concept and being clear about the shared responsibility before you commit; we can run a pilot with a small group to do exactly that.
If you are comparing, Todyl SASE is the closest alternative in shape, NordLayer is lighter-weight, and the full list is on SASE providers.
Is Exium SASE the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Exium for offices: the Cyber Gateway and existing firewalls
Many smaller organisations do not start from a clean sheet. They have an office firewall that also terminates the remote access VPN, a few sites joined by IPsec, and remote staff who connect back to the office to reach a file server or a line-of-business app. Exium offers two ways through that:
- Keep the firewall for now: with SASE Pro, existing firewalls can be connected to the Exium SASE cloud, so offices stay as they are while remote users move to zero trust private access. That lets you retire the VPN service on the firewall first, which removes an internet-facing login page, without a weekend cut-over at every site.
- Replace the firewall: the Cyber Gateway is Exium's software next-generation firewall with SD-WAN, threat protection and segmentation. It runs on general-purpose hardware, a virtual machine or public cloud and is licensed per site, so a site refresh does not have to mean another appliance purchase.
Either way, the aim is one set of policies for users wherever they are, rather than separate rules on the firewall, the VPN and a web filter. That is the practical meaning of SASE for a small multi-site business. Whether replacing the firewall is right depends on what else the box does for you today, such as guest Wi-Fi, site-to-site links or inbound services, so we review that before recommending it.
Licensing and how we help
Exium SASE is licensed per user, and Exium states that each user licence covers up to five devices. The Cyber Gateway is licensed per site and XDR360 per user or asset, and Exium bills monthly. Prices depend on edition, users and modules, so ask us for a quote; see Exium SASE licensing for the detail, and ZTNA for small business for how it compares on cost drivers with other per-user options.
How we can help:
- Assess: review how staff reach applications today (VPN, remote desktop, direct to SaaS), what firewalls you run and any logging or compliance needs.
- Design: choose between Essentials and Pro, decide where a Cyber Gateway makes sense and plan policies.
- Pilot: deploy the client to a small group, connect your identity provider and publish the first private applications.
- Migrate: move users and sites across, then close the old VPN so it cannot bypass the new policy.
- Run it: we can manage policies and user changes day to day, on the same account as your other subscriptions.
Scope and timescales are confirmed at quote. Contact us to talk about Exium.
How Forever Systems helps with ZTNA and SASE
We are an independent IT and cyber security provider. We supply and support several zero trust access and SASE platforms, so we can recommend what fits how your people work rather than one vendor's answer to everything.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across ZTNA, SSE and SASE options, including Cisco Secure Access and Check Point Harmony SASE
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
Did NETGEAR acquire Exium?
Yes. NETGEAR announced in June 2025 that it had completed its acquisition of Exium, and Exium's website states that Exium is now part of NETGEAR.
What is NETGEAR Exium?
It is Exium's SASE platform under NETGEAR ownership: zero trust private access, DNS, web and SaaS security, the Cyber Gateway software firewall with SD-WAN, XDR360 and IAM360. The products still carry the Exium name at the time of writing.
Has Exium changed since the NETGEAR acquisition?
At the time of writing the Exium product names and editions are unchanged. NETGEAR has said it intends to combine Exium's SASE platform with its own networking to bring new secure networking products to market for MSPs and small and medium-sized businesses. We confirm the current packaging when we quote.
What is the difference between Exium SASE Essentials and SASE Pro?
Essentials covers DNS, web and SaaS security, zero trust private access, private DNS, mobile device security and digital experience monitoring. Pro adds conditional access for SaaS apps, geo-fencing, agentless access, connection of existing firewalls and SSO/MFA, SCIM and SIEM integrations.
Can Exium replace our office firewall?
It can in many small offices. The Exium Cyber Gateway is a software next-generation firewall with SD-WAN, licensed per site, and Exium positions SASE Pro as a firewall replacement. We check your sites and traffic before recommending it.
How many devices does an Exium SASE licence cover?
Exium states that each SASE user licence covers up to five devices.
Still have a question about Exium SASE?
Ask us and a member of our team will reply by email.
More zero trust access guides
Todyl SASETodyl's SASE module: ZTNA, secure web gateway, secure DNS and cloud NGFW through one agent and the Todyl SGN.
NordLayer ZTNAHow NordLayer delivers zero trust access: identity sign-in, private gateways, device posture and cloud firewall.SASE vs firewallOn-premises NGFW vs SASE and firewall as a service: where inspection happens and whether you still need a firewall.Agentless ZTNAClientless ZTNA through the browser for contractors, partners and personal devices, and its trade-offs.SASE providersThe SASE and SSE platforms we supply, compared on components, delivery, licensing unit and fit.