Timus SASE: adaptive zero trust access and cloud firewall

What Timus SASE is

Timus Networks builds Timus SASE for organisations that want remote access, network security and web protection from one cloud service, rather than a VPN appliance, a separate web filter and a firewall at every site. Timus describes it as 100% cloud-delivered: there is no hardware to buy, and the Timus Connect agent on each device does the connecting.

Timus SASE brings together:

• Zero trust network access (ZTNA): user and identity-based access, with adaptive MFA and policies by role, risk and location
• Dynamic Cloud Firewall: firewall as a service with identity-based rules enforced from Layer 3 to Layer 7, covering cloud and on-premises networks
• Secure web gateway (SWG) on the Advanced Plan: URL and category filtering and malware protection, with SSL/TLS inspection
• An always-on agent: Timus Connect runs on desktop and mobile devices, with Windows, macOS and iOS among the supported platforms, and stays connected without the user having to start it
• Gateways with static IPs: each Timus cloud gateway has a static IP address you can allowlist on SaaS applications
• Device posture checks: device health and endpoint protection signals decide whether a device gets full, limited or no access

Timus and CyberFOX. CyberFOX announced on 29 June 2026 that it had acquired Timus Networks; Timus continues under its own brand, and Timus SASE is presented as a CyberFOX platform. For the wider SASE picture, see SASE on our cloud security site.

How Timus ZTNA works: adaptive zero trust

Timus calls its approach Adaptive Zero Trust: trust is checked before sign-in and then re-checked continuously during the session, rather than once at login. In the terms used by the NCSC's ZTNA guidance, Timus is a network-level policy engine: decisions are made in the Timus cloud and enforced at its gateways and cloud firewall. A typical connection looks like this:

1. The user signs in to Timus Connect through your identity provider: Microsoft Entra ID, Okta, any standards-based SAML provider, or users synchronised from on-premises Active Directory.
2. Sign-in policies weigh signals such as a new device, a new location or impossible travel, asking for adaptive MFA when something looks risky, while device posture checks use Timus's own telemetry and, where you run them, Microsoft Defender, Bitdefender, SentinelOne, Heimdal or Huntress to give full, limited or no access.
3. The agent connects to a Timus gateway over an encrypted tunnel, using WireGuard or OpenVPN with automatic protocol fallback.
4. Zero trust policies and cloud firewall rules decide which private networks, servers and applications that user can reach, so access is segmented rather than open to the whole network.
5. While the user is connected, Timus keeps watching behaviour and device posture. If antivirus is switched off or the session starts to look risky, access can be challenged, limited or ended.

Policies run in a priority order you set, with separate sign-in policies for users and administrators. Trusted Networks can relax checks on known networks, but the NCSC lists trusting network location as an anti-pattern, so we usually recommend keeping MFA and posture checks on everywhere; see how ZTNA works for more.

Timus SASE plans: Essentials and Advanced

Timus positions Essentials for small teams that need secure remote access, and the Advanced Plan for larger teams that want more security controls and customisation. Timus lists URL filtering, malware protection and category filtering on the Advanced Plan only, so that is the plan to choose if you want the secure web gateway as part of your SASE. Plan contents change from time to time, so we confirm the current position when we quote.

Static IPs, SaaS lock-down and secure remote desktop

Timus highlights three common uses.

Locking SaaS apps to your IP. Every Timus gateway has a static IP address. On SaaS apps that support IP restrictions, such as Microsoft 365 (through Conditional Access) or Salesforce, allowlist it so sign-ins are accepted only when they arrive through Timus. A stolen password alone is then much less useful: without Timus Connect on the device, the sign-in comes from the wrong address. Rules can be set per organisation, per site or per user group. The NCSC treats a source IP as a network-location signal, and its anti-patterns warn against relying on location alone, so keep MFA and conditional access on the SaaS apps as well. Timus itself describes the static IP as an added layer on top of ZTNA.

Remote desktop without exposed RDP. Timus places RDP hosts behind its cloud firewall and ZTNA policies, so they no longer need a port open to the internet, and Timus says that without Timus Connect there is no RDP access, even with valid credentials. Access can be limited per user and per device and conditioned on posture, location and role, with sessions logged. If remote desktop is the main requirement, compare the options on secure remote desktop access, including TruGrid SecureRDP.

Offices and cloud networks. Offices join the same virtual network over IPsec site-to-site tunnels, which Timus lists as unlimited on both plans. Timus documents set-ups with Cisco Meraki, WatchGuard and Sophos firewalls among others, and with Microsoft Azure and AWS, so an existing office firewall can usually stay in place while remote users move to zero trust access. How sites fit into SASE is covered on SASE vs firewall.

Where Timus SASE fits

Timus SASE tends to suit:

• Hybrid and remote teams that want an always-on agent instead of a VPN people forget to start
• Organisations that want to lock SaaS to a fixed IP, Microsoft 365 in particular, without routing everything back through head office
• Small multi-site businesses joining offices over IPsec and putting remote users and sites under one cloud firewall policy
• Firms already running Microsoft Defender, SentinelOne, Bitdefender, Heimdal or Huntress that want those endpoint signals to decide network access
• Organisations without in-house security staff that want a provider to set it up: Timus sells only through IT service providers, and we can supply, deploy and support it for you

If you are comparing, see Todyl SASE, NordLayer and Exium SASE, or the full lists on ZTNA providers and SASE providers.

Licensing and how we help

Timus SASE is licensed per user, with each user covering two devices on Essentials and four on the Advanced Plan. It can be billed monthly, with terms confirmed at quote. Prices depend on the plan and the number of users, so ask us for a quote; the other options we supply are on business VPN, SASE and ZTNA licensing.

Here is how we can help:

1. Map access: list who works remotely, what they reach (file shares, line-of-business apps, RDP hosts, cloud networks) and which SaaS apps you want to lock to a static IP.
2. Connect identity: link Microsoft Entra ID, Okta, another SAML provider or Active Directory, and set sign-in and MFA policies for users and administrators.
3. Set posture rules: connect your endpoint protection so device health feeds into access decisions.
4. Pilot: Timus offers a 30-day trial, which we can use to test with a small group on real devices and applications.
5. Roll out: deploy Timus Connect silently through your device management or RMM tooling, using Timus's installer packages and deployment tokens, then add site tunnels and static IP allowlisting.
6. Close the old route: retire the VPN and any open RDP ports so nothing bypasses the new policy, as the NCSC recommends.

Scope and timescales are confirmed at quote. Contact us to talk about Timus.