In short
Managed SASE is a SASE platform run for you by a provider, either fully managed or co-managed with your IT team. The NCSC advises UK organisations to agree which security tasks sit with the provider and which stay with them, such as configuration, policy changes and response to compromise. We can help scope it, confirmed at quote.
Get a quote for managed SASE
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What managed SASE can mean: co-managed or fully managed
"Managed" covers a wide range. The useful question is who does each task once the platform is live.
| Model | Who does what | Often suits |
|---|---|---|
| Supplied and supported | The provider supplies licences, designs and deploys the platform; your IT team runs it and asks for help when needed | Organisations with in-house network and security skills |
| Co-managed SASE | The provider handles roll-out, change requests and licence reviews; your team keeps policy approval and day-to-day user administration | Organisations that want control of policy with expert help on the platform |
| Fully managed SASE | The provider handles change requests, onboarding of users and sites, policy upkeep and renewals within an agreed scope | Organisations that want the outcome without building SASE skills in-house |
Whichever model you choose, the scope is a contract matter: what is included, how changes are requested and approved, and what sits outside the service. We set this out at quote, so there are no assumptions on either side.
Not sure which licence fits? Ask us
Tell us what you need and we will recommend the right licence for your organisation, with a quote.
SASE management: the tasks involved
SASE management is the ongoing work of keeping the platform matched to your organisation as people, devices, sites and applications change.
| Task | What it involves |
|---|---|
| Access policy | Adding and changing rules for private applications, web categories, SaaS and AI tools; testing a change before enforcing it, as the NCSC recommends |
| Onboarding users and devices | Rolling out the agent or browser access, mapping identity provider groups to policy, setting device posture checks |
| Onboarding sites | Bringing offices onto the platform with SD-WAN or IPsec tunnels, and placing connectors beside private applications |
| Licence true-ups | Matching licence counts to the users, devices and sites actually in use, so you are neither short nor paying for spare seats |
| Renewals | Reviewing editions, add-ons and term before the subscription renews |
| Logs and change records | Making sure access logs reach your SIEM or log store, and keeping a record of who changed what |
| Recovery and break glass | Keeping emergency access and recovery steps current, so a policy mistake or service problem does not lock people out |
The NCSC's guidance on implementing ZTNA (opens in a new tab) covers several of these, including testing policies before enforcing them, phased roll-out, recovery paths and tightly restricted break glass access. Source: NCSC, checked 9 November 2026.
Managed SASE services and solutions: what to put in scope
Before you sign for managed SASE services, agree these in writing:
- Which platform and components are included: Security Service Edge (SSE) only, or SD-WAN for sites as well
- How changes are requested and approved, and who signs off a policy that widens access
- Which tasks stay with you, such as joiners and leavers in your identity provider
- What happens if the service is unavailable, and how access is restored
- How licences are counted and reviewed, and when renewals are discussed
- Where threat detection and incident response sit, which is usually a separate service (see below)
The NCSC asks buyers to be clear "which security responsibilities sit with the vendor, and which remain with the customer, such as configuration, policy management, and response to compromise" (source (opens in a new tab)). A managed SASE solution adds a third party to that split, so write all three down.
Is managed SASE the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Managed Security Service Edge (SSE)
Not every organisation needs SD-WAN on day one. Managed Security Service Edge (SSE) covers the security half of SASE only: ZTNA for private applications, a secure web gateway (opens in a new tab), CASB controls for SaaS and, on some platforms, firewall as a service. It suits organisations whose offices are simple or already have a firewall they are happy with, and whose priority is remote and hybrid users.
The management tasks are the same as above, minus site tunnels and SD-WAN. On single-vendor platforms that offer both, such as those compared on SASE vendors, adding SD-WAN later can turn it into full SASE, often without starting again; the route is confirmed with the vendor at quote. See Security Service Edge (SSE) for what it includes and SASE vs Security Service Edge (SSE) for when each makes sense.
Where an MDR or SOC fits
Managed SASE runs the platform and its policy. Watching the security events that the platform, your endpoints and your identity provider generate, and responding to threats, is a different job, usually done by a managed detection and response (MDR) service or a security operations centre (SOC).
The two work together: the SASE platform produces access and threat logs, and the NCSC recommends centralising them in a SIEM or similar monitoring capability. If you want that layer as well, our sister site explains MDR (opens in a new tab) and managed SOC (opens in a new tab) services, and how they differ.
SASE managed service providers and MSP-ready platforms
Several of the platforms we supply are designed to be delivered by managed service providers, which makes co-managed and fully managed SASE easier to run:
- Timus SASE: Timus presents Timus SASE as a channel-first platform for MSPs, now part of CyberFox (Timus (opens in a new tab))
- Todyl SASE: Todyl lists MSPs and VARs as its partner types and describes Todyl SASE as a managed solution (Todyl (opens in a new tab))
- Barracuda SecureEdge: Barracuda offers its network protection products for MSPs (Barracuda (opens in a new tab))
Larger platforms such as Cisco SASE, Check Point SASE and HPE Aruba Networking SASE can be co-managed too. Vendor facts checked 9 November 2026.
How we help with managed SASE
We can design, deploy and support your SASE platform, and run as much of it as you want us to:
- Assess what you have and recommend a platform and a management model
- Deploy in phases, following our SASE implementation plan
- Manage the tasks you hand over, with the scope and change process confirmed at quote
- Licence the platform in one place, with subscriptions that can be billed monthly, terms confirmed at quote
Contact us to talk through co-managed or fully managed SASE.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What is managed SASE?
Managed SASE is a SASE platform that a provider runs for you, in whole or in part. It typically covers roll-out, policy changes, onboarding of users and sites, licence true-ups and renewals, with the exact scope agreed in the contract.
What is the difference between managed and co-managed SASE?
In fully managed SASE the provider handles changes, onboarding and policy upkeep within an agreed scope. In co-managed SASE the work is shared: the provider runs the platform and your team keeps control of policy approval and day-to-day user administration.
What does SASE management involve?
Keeping access policy current, onboarding users, devices and sites, checking that logs reach your log store, reviewing licence counts and renewals, and keeping recovery and break glass access up to date.
Is managed Security Service Edge (SSE) the same as managed SASE?
Not quite. Managed Security Service Edge (SSE) covers the cloud security services only, such as ZTNA, secure web gateway and CASB. Managed SASE adds the network side, SD-WAN or site tunnels, so offices are covered as well as users.
Does managed SASE include threat monitoring?
Usually not on its own. Managed SASE runs the platform and its policy; detecting and responding to threats across your logs is normally a separate MDR or managed SOC service. Check what each scope includes before you buy.
Still have a question about managed SASE?
Ask us and a member of our team will get back to you.