In short
The best SASE solution for a business is the one that fits its users, sites, applications, identity provider and existing SD-WAN and firewalls. Shortlist two or three platforms, ask each the same questions and run a proof of concept, which the NCSC recommends UK organisations do before committing to a provider.
Want help with How to choose SASE?
We can plan it with you or do it for you. Tell us where you are up to.
Best SASE solutions: start from your requirements
Lists of the best SASE solutions rank platforms against each other, but none of them know your estate. A platform that suits a large Cisco estate may be the wrong fit for a small firm with one office and a WatchGuard Firebox. Write down what you have and what you need first:
| Requirement | What to record | Why it matters |
|---|---|---|
| Users and devices | Numbers of staff, contractors and shared devices; managed and unmanaged devices | Decides the licensing unit and whether you need agentless or browser-based access |
| Sites | Offices, branches and their WAN links and contract dates | Decides whether you need SD-WAN now, later or not at all |
| Applications | Private applications (on-premises and cloud), SaaS, and AI tools people use | Shapes ZTNA connectors, CASB (opens in a new tab) controls and data protection needs |
| Existing SD-WAN and firewalls | Vendor, model age and support dates | Often points to a single-vendor platform, or to a dual-vendor design that keeps them |
| Identity provider | Which IdP, whether single sign-on covers every application, how strong authentication is | The NCSC treats identity as the primary control for access decisions |
| Device management | Your MDM or endpoint management, and the device signals it can share | Device posture is one of the core signals for access policy |
| Internet traffic policy | Whether you need content filtering, TLS inspection or central logging of web traffic | The NCSC says tunnelling all traffic and TLS inspection should be deliberate choices, not defaults |
The NCSC's pre-build guidance (opens in a new tab) sets out the identity, device and internet access prerequisites in full. Source: NCSC, checked 9 November 2026.
Not sure which option applies to you? Ask us
Tell us about your organisation and we will point you to the right option.
Single vendor or dual vendor SASE
The second decision is whether one vendor supplies both the network and the security, or you pair a Security Service Edge (SSE) from one vendor with SD-WAN or firewalls from another.
- Single vendor gives one policy model, one console and automated site tunnels. It suits organisations replacing branch kit or starting fresh.
- Dual vendor keeps SD-WAN or firewalls you already own and connects them to a Security Service Edge (SSE) with IPsec. It suits organisations mid-way through a WAN or firewall contract.
- Security Service Edge (SSE) first protects users now and leaves SD-WAN for later, which suits simple offices and hybrid teams.
The full trade-offs are on single vendor SASE.
Shortlist questions to ask every SASE vendor
Ask the same questions of each platform on your shortlist, so the answers can be compared directly:
| Question | Why ask it |
|---|---|
| Which components are included in each edition, and which are add-ons? | ZTNA, secure web gateway, CASB, firewall as a service, data protection and SD-WAN are packaged differently by every vendor |
| Where is traffic inspected: in the cloud, on the device or both? | Affects performance, privacy and how much traffic leaves your sites |
| How is TLS inspection handled, and who can see decrypted data? | The NCSC notes that inspecting components concentrate trust and should be treated as critical |
| How does it work with our identity provider and device management? | The NCSC lists integration with identity, device management and monitoring as a confidence measure |
| Which logs are available, and can we export them to our SIEM? | You need visibility of access decisions for investigation and audit |
| What happens if the service is unavailable? | Shows which users and applications are affected and what fallback exists |
| How do private applications connect: connectors, gateways or appliances? | Decides what you deploy beside on-premises and cloud applications |
| How is it licensed, and on what terms? | Per user, per device or per site, and the term length, change the cost picture |
These questions follow the NCSC's measures for gaining confidence in a product (opens in a new tab): evaluation before commitment, alignment with your intended design rather than what the product advertises, and integration and dependencies.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
Proof of concept: how to trial a SASE platform
The NCSC advises seeking "trials or proof-of-concept deployments, using realistic scenarios that reflect their own users, devices and applications". A practical proof of concept looks like this:
- Agree success criteria before you start: the applications that must work, the policies to test and what users should notice.
- Pick a small pilot group with a mix of roles, devices and locations, including at least one site if SD-WAN is in scope.
- Connect real applications, one private application and the main SaaS tools, rather than a test page.
- Test policies before enforcing them, then switch enforcement on for the pilot group, as the NCSC recommends for any new policy.
- Test failure and recovery: a non-compliant device, a lost connection, and the break glass route.
- Review the logs to confirm you can see why each access decision was made.
- Compare two platforms side by side if the shortlist is close, then decide on evidence rather than feature lists.
Source: NCSC ZTNA guidance (opens in a new tab), checked 9 November 2026. When you are ready to roll out, our SASE implementation plan picks up from the pilot.
Licensing unit and term: buying facts to compare
SASE platforms are licensed in different units, and the unit can matter as much as the edition:
| Licensing unit | How it counts | Watch for |
|---|---|---|
| Per user | One licence per named person, often covering several devices | How many devices each user licence covers, and how contractors and shared devices are counted |
| Per device | One licence per protected device | Staff with a laptop, tablet and phone need more than one |
| Per site or appliance | Subscriptions for each office gateway or SD-WAN device | Small branches and temporary sites |
| Term | Monthly, annual or multi-year subscriptions | Renewal dates, true-up rules and how editions can be changed mid-term |
Two examples from vendors' own sites: Barracuda prices SecureEdge Access (opens in a new tab) per user per month based on the selected plan, and Timus's plans page (opens in a new tab) gives two devices per user on Essentials and four on the Advanced Plan (checked 9 November 2026). Subscriptions we supply can be billed monthly, terms confirmed at quote. For cost drivers without prices, see ZTNA cost (opens in a new tab).
Where to compare the platforms
Once your requirements and questions are written down, compare the platforms themselves:
- SASE vendors: every platform we supply, side by side on components, SD-WAN, delivery and licensing unit
- SASE platform: what to look for in the platform itself, from points of presence to one console
- SASE vs Security Service Edge (SSE): whether you need full SASE or the security half first
- SASE providers: what to expect from whoever supplies and supports it
How Forever Systems helps you choose
Because we supply several SASE platforms, we can help you build the requirements list, shortlist two or three platforms that fit what you run, put the same questions to each vendor and set up a proof of concept. Scope and timescales are confirmed at quote, and pricing depends on users, devices, sites and components, so ask us for a quote. Contact us for a recommendation based on fit.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What are the best SASE solutions?
The best SASE solution is the one that fits your users, sites, applications, identity provider and existing network and security kit. Rankings cannot account for those, so shortlist two or three platforms that match your estate and trial them.
How do I choose a SASE solution?
Record your requirements, decide whether you want one vendor for network and security or two, ask each shortlisted vendor the same questions, run a proof of concept with real users and applications, and compare licensing units and terms.
What should a SASE proof of concept include?
Agreed success criteria, a pilot group with a mix of roles and devices, at least one real private application and your main SaaS tools, policies tested before they are enforced, a failure and recovery test, and a review of the logs.
Should we choose single-vendor or dual-vendor SASE?
Single-vendor suits organisations replacing branch kit or starting fresh, because it gives one policy model and console. Dual-vendor suits those keeping SD-WAN or firewalls they already own. Starting with Security Service Edge (SSE) and adding SD-WAN later is also common.
How are SASE solutions licensed?
Usually per user or per device for the security services, and per site or appliance for SD-WAN, on monthly, annual or multi-year terms. How many devices each user licence covers varies by vendor and edition.
Still have a question about How to choose SASE?
Ask us and a member of our team will get back to you.