In short
SASE for small business replaces the office VPN, web filter and much of the firewall with one cloud service and an agent on each device. Several platforms are sized for smaller teams and sold as per-user or as-a-service subscriptions, including Timus, Todyl, Exium and Barracuda SecureEdge. Subscriptions can be billed monthly, terms confirmed at quote.
Get a quote for SASE for small business
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What SASE gives a small business
A small business usually has a broadband line, a router or firewall, a VPN that a few people use from home, and little or no web filtering once a laptop leaves the office. SASE (secure access service edge) moves that security into the cloud, so the same policy follows each person wherever they work:
- Zero trust network access (ZTNA) gives each user access to the specific applications, file shares or remote desktops they need, rather than the whole office network
- Secure web gateway (opens in a new tab) and DNS filtering block malicious and unwanted sites at home, in the office and on public Wi-Fi
- Firewall as a service applies firewall rules in the provider's cloud rather than on a box in a cupboard
- One console for policy and reporting, instead of separate tools for VPN, filtering and firewall
The security half of SASE is called Security Service Edge (SSE); SASE adds the networking side for offices. For a small team with one office, or none, the Security Service Edge (SSE) half often does most of the work. What is SASE and SASE vs Security Service Edge (SSE) explain the terms.
SASE platforms that suit smaller teams
| Platform | How it is delivered | Licensed | Source |
|---|---|---|---|
| Timus SASE | Always-on agent to Timus cloud gateways; Timus says "No Hardware" and "100% Cloud Native". Essentials uses shared gateways and is aimed at small teams; the Advanced Plan has a dedicated gateway | Per user, with two or four devices per user depending on plan | timusnetworks.com (opens in a new tab) |
| Todyl SASE | Agent tunnels each device to Todyl's regional points of presence; Todyl says the core of SASE is "entirely cloud-based" | Licensed as a service; Todyl says there are no annual contracts | todyl.com (opens in a new tab) |
| Exium SASE | Client on each device, with the Cyber Gateway software for sites that need a firewall and SD-WAN | Per user, up to five devices per licence; Cyber Gateway per site | Exium's plans page on exium.net |
| Barracuda SecureEdge | ZTNA, firewall as a service, web security and Secure SD-WAN, with inspection "in the cloud, at the branch, or on the device" | SecureEdge Access per user per month, based on the plan chosen | barracuda.com (opens in a new tab) |
| Check Point SASE | Formerly Harmony SASE (opens in a new tab): Internet Access with on-device, in-browser and cloud protections, plus zero trust Private Access | Per user, Internet Access and Private Access | checkpoint.com (opens in a new tab) |
| Sophos Workspace Protection | Protected Browser, Sophos ZTNA and DNS Protection for endpoints, protecting at the endpoint and browser rather than through cloud gateways | Per user subscription | sophos.com (opens in a new tab) |
Each row comes from the vendor's own website, checked 9 November 2026. Vendors change plans and features often, so we confirm the current position on your quote. All six can be run without new branch hardware for remote users; Exium and Barracuda also cover offices with their own site software or SD-WAN.
Not sure which plan fits? Ask us
Tell us what you need and we will recommend the right plan for your organisation, with a quote.
How to choose: three questions
- Do you have an office to connect, or just people? With no office, or one simple office, a user-based Security Service Edge (SSE) service such as Timus, Todyl or Sophos Workspace Protection is often enough. With several sites, look at Exium's Cyber Gateway, Barracuda SecureEdge or Check Point SASE, which add SD-WAN.
- What do people need to reach? List the file shares, line-of-business applications, remote desktops and SaaS services. If a supplier or cloud application only accepts connections from your office IP, a static IP from the SASE platform (Timus gives every gateway one; Todyl offers them as an option) can replace it.
- Who will look after it? Timus and Todyl are built to be run by an IT provider. If you have no in-house IT, a managed SASE arrangement keeps policy changes and new starters handled for you.
The zero trust side of this decision, including ZTNA products that do not include web security, is covered on ztna.org.uk's ZTNA for small business (opens in a new tab) guide. For the full list of platforms we supply, see SASE vendors.
SASE and Cyber Essentials
Many small businesses meet SASE while working towards Cyber Essentials, the UK government-backed certification. SASE does not replace the Cyber Essentials controls, but it supports several of them: firewall rules that follow home workers, web and DNS filtering as part of malware protection, and per-application access as part of user access control. Our sister site explains what Cyber Essentials is (opens in a new tab) and how its BYOD and home working (opens in a new tab) and cloud services rules apply.
Is SASE for small business the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How Forever Systems helps small businesses with SASE
We can look at how your team works today, recommend a platform that fits your size and budget, and handle the set-up:
- Assess: users, devices, the applications people reach and how internet traffic is filtered now
- Quote: one or two platforms side by side, sized to your users and devices; subscriptions can be billed monthly, terms confirmed at quote
- Deploy: roll the agent out to a pilot group, build access and filtering policy, then extend to everyone and close the old VPN
- Support: policy changes, new starters and licence reviews, with scope confirmed at quote
Contact us to talk about SASE for your business.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
Is SASE suitable for a small business?
Yes. Several SASE platforms are sold per user or as a service with no hardware for remote users, such as Timus SASE, Todyl SASE, Exium SASE and Sophos Workspace Protection. A small business can start with web filtering and secure access for staff and add office connectivity later.
Does a small business need SD-WAN as well?
Usually not at first. With one office and mainly remote or SaaS work, the Security Service Edge (SSE) half of SASE does most of the work. SD-WAN helps when you have several sites or two internet lines to balance; Exium, Barracuda SecureEdge and Check Point SASE include it.
Can SASE replace our VPN?
In most cases, yes. ZTNA gives each person access to the applications they need without putting them on the whole office network. Some older applications may need a narrow legacy route for a while; we plan that during the pilot. See SASE vs VPN for the detail.
How is SASE for small business licensed?
It depends on the platform: Timus and Barracuda SecureEdge Access are licensed per user, Todyl is offered as a service with no annual contracts, and Exium licenses users with up to five devices each. Subscriptions can be billed monthly, terms confirmed at quote.
Does SASE help with Cyber Essentials?
It supports several controls, such as firewalls that follow home workers, web and DNS filtering, and per-application access, but it does not replace them. Our sister site cyber-essentials-uk.net explains the requirements in full.
Still have a question about SASE for small business?
Ask us and a member of our team will get back to you.
More SASE guides
Timus SASETimus SASE explained: adaptive ZTNA with posture checks, static IP gateways and a cloud firewall in one agent.
Todyl SASETodyl SASE: one agent connects devices to Todyl's Secure Global Network for ZTNA, web filtering, secure DNS and a cloud firewall.
Exium SASEExium SASE, now part of NETGEAR: what SASE Essentials, SASE Pro and the Cyber Gateway include.Barracuda SecureEdgeBarracuda SecureEdge: Secure SD-WAN, zero trust access, firewall as a service and web security in one SASE platform.SASE vs VPNSASE vs VPN for business: how SASE replaces remote access VPN backhaul with per-app access and cloud security.Managed SASEManaged SASE for business: co-managed or fully managed, the management tasks involved and where MDR fits.