In short
SASE providers are the companies that supply, set up and support a SASE platform: the vendor itself, an IT partner or a managed service provider. UK organisations should compare providers on platform choice, design and pilot help, licensing and shared responsibility, which the NCSC asks buyers to agree before relying on a cloud access service.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
SASE vendor, SASE provider or managed SASE provider?
Three different roles hide behind the search for a SASE provider, and it helps to know which one you need before you compare anyone.
| Role | What it does | Who it suits |
|---|---|---|
| SASE vendor | Builds the platform: writes the software, runs the points of presence and decides what each edition includes | You buy from the vendor only if it sells direct to organisations of your size |
| SASE provider (supplier or integrator) | Supplies the licences, designs the policy, runs the pilot and roll-out, and supports the platform afterwards | Organisations with an IT team that wants to run the platform day to day, with expert help |
| Managed SASE provider (sase managed service provider) | Also runs some or all of the platform for you: policy changes, onboarding users and sites, licence reviews | Organisations that want the outcome without building SASE skills in-house |
A SASE service provider can play either of the last two roles, and many do both. The vendors themselves are compared on SASE vendors; what a managed service covers is on managed SASE.
Not sure which edition fits? Ask us
Tell us what you need and we will help you choose the right edition.
Who offers vendor-neutral SASE support?
Vendor-neutral support comes from a provider that supplies several platforms, so its advice is not tied to one product. Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, including Barracuda SecureEdge, Check Point SASE (opens in a new tab), Cisco SASE (opens in a new tab), Exium SASE, HPE Aruba Networking SASE, Sophos Workspace Protection, Timus SASE, Todyl SASE and WatchGuard FireCloud (opens in a new tab), so we can advise across them and recommend the one that fits.
In practice that means starting from what you already run. A Meraki or Cisco estate, an HPE Aruba Networking or HPE Juniper Networking estate, a WatchGuard Firebox or a Sophos Firewall often points to two or three candidates straight away. Where none of your current kit decides it, the choice comes down to components, inspection model and licensing unit. The trade-off between one vendor for everything and a mix is on single vendor SASE, and the platforms are compared side by side on SASE vendors.
Questions to ask a SASE provider
The NCSC's guidance on assessing services and providers (opens in a new tab) treats the choice as "a risk management and assurance decision rather than solely a procurement activity". Its points turn into questions for any SASE provider:
- What will we delegate to you and to the vendor? Identity enforcement, policy decisions, traffic handling, logging and availability of access can all move outside your direct control.
- What happens if the service is unavailable? Which users and applications are affected, and what fallback or break glass access exists.
- What control and visibility do we keep? Who can change policy, which logs you can see and export, and how incidents involving the service are detected and handled.
- How does it fit what we own? Your identity provider, device management, firewalls, SD-WAN and monitoring tools.
- Can we trial it first? The NCSC recommends trials or proof-of-concept deployments with realistic users, devices and applications.
- Who is responsible for what after go-live? Configuration, policy changes, licence true-ups, renewals and response to compromise, written down rather than assumed.
Source: NCSC, checked 9 November 2026.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
SASE provider checklist
| Check | What to look for | Why it matters |
|---|---|---|
| Platform choice | More than one SASE platform on offer, or a clear reason for one | Advice follows your estate, not the provider's only product |
| Assessment first | A look at your VPN, firewalls, WAN links, identity set-up and applications before a quote | The design is based on what you have, not a template |
| Pilot and phased roll-out | A pilot group with real applications, then users and sites in stages | Problems show up with a small group, not the whole organisation |
| Policy design | Access scoped per application, tested before it is enforced | Avoids rebuilding broad VPN-style access on a new platform |
| Licensing clarity | The licensing unit (user, device or site), editions and term set out in the quote | Shared devices, contractors and small branches change the numbers |
| Shared responsibility | A written split of tasks between you, the provider and the vendor | The NCSC asks buyers to make this clear before committing |
| Support after go-live | Scope for changes, onboarding and renewals agreed up front | SASE keeps changing as users, sites and applications do |
Use the same checklist for every SASE solution provider you speak to, so the answers can be compared like for like.
SASE and Security Service Edge (SSE) platforms we supply
The platforms above range from single-vendor SASE with SD-WAN, such as Check Point SASE, Cisco SASE, HPE Aruba Networking SASE and Barracuda SecureEdge, to user-led services licensed per user or per device, such as Timus SASE and Todyl SASE, that suit smaller teams. Each is compared on components, SD-WAN, delivery and licensing unit on SASE vendors, using the vendors' own published material.
If you are still deciding between full SASE and the security half on its own, read SASE vs Security Service Edge (SSE) first, and for a structured shortlist see how to choose SASE.
SASE VPN providers and business VPNs
Some people search for "SASE VPN providers" because they want to replace a business VPN. Most SASE platforms do that through ZTNA, and several also offer VPN as a service for applications that cannot use ZTNA yet, such as Cisco Secure Access. If what you need is a straightforward hardware-free business VPN (opens in a new tab), our licensing site covers those options. If the goal is to retire the VPN properly, start with ZTNA vs VPN (opens in a new tab), SASE vs VPN and our SASE implementation plan.
How Forever Systems helps
As a SASE provider, we can:
- Assess your current VPN, firewalls, WAN links, identity set-up and the applications people need
- Shortlist two or three platforms that fit what you already run, and explain the trade-offs
- Quote the licences and any site hardware in one place, with subscriptions that can be billed monthly, terms confirmed at quote
- Pilot and deploy in phases, then support the platform afterwards, or run it for you as managed SASE, with scope confirmed at quote
Pricing depends on users, devices, sites, components and term, so ask us for a quote. Contact us for advice on which platform fits.
Managed SASE and SASE implementation
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What is a SASE provider?
A company that supplies, sets up and supports a SASE platform for you. It may be the vendor that builds the platform, an IT partner that supplies and deploys it, or a managed service provider that also runs it day to day.
What is the difference between a SASE vendor and a SASE provider?
The vendor builds and runs the platform and its points of presence. The provider sells it to you, designs the policy, deploys it and supports it. Forever Systems is a provider that supplies several vendors' platforms.
Who are the top SASE providers?
There is no single list that fits every organisation. The right provider is one that offers a platform matching your existing network and security kit, helps with design and a pilot, and is clear about licensing and shared responsibility. Use the checklist on this page to compare them.
Is a SASE provider the same as a managed service provider?
Not always. Some SASE providers supply and deploy the platform and leave you to run it; a managed SASE provider also handles changes, onboarding and licence reviews for you. Many offer both, with the split agreed in the contract.
Can we trial a SASE platform before buying?
Often, yes, and the NCSC recommends trials or proof-of-concept deployments with realistic users, devices and applications before committing. We can help set up a pilot with a small group of users.
Still have a question about a SASE platform?
Ask us and a member of our team will get back to you.