In short
SASE vendors are the companies that build SASE platforms. Those we supply include Cisco, Check Point, HPE, Barracuda, Sophos, WatchGuard, Todyl, Timus Networks and Exium; Palo Alto Networks, Zscaler, Netskope, Cloudflare and Cato Networks are also widely shortlisted. UK organisations usually compare two or three on components, SD-WAN, delivery and licensing unit.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
SASE vendor or SASE provider: what is the difference?
A SASE vendor is the company that makes the platform: it writes the software, runs the points of presence and decides what the product includes. A SASE provider is whoever supplies, sets up and supports it for you, which may be the vendor itself, an IT partner or a managed service provider.
This page compares the vendors and their platforms. Who supplies and manages them, and what to expect from that relationship, is on SASE providers and managed SASE. If you are still deciding whether you need full SASE or only the security half, start with SASE vs Security Service Edge (SSE).
SASE vendors we supply: components and design
| Vendor and platform | Security Service Edge (SSE) components | SD-WAN | Single or dual vendor |
|---|---|---|---|
| Barracuda: SecureEdge | Zero Trust Access, firewall as a service (opens in a new tab), web security; SecureEdge Access for users | Barracuda Secure SD-WAN | Single vendor |
| Check Point: Check Point SASE (formerly Harmony SASE (opens in a new tab)) | Private Access, Internet Access, SaaS Security, GenAI Security, Enterprise Browser | Secure SD-WAN | Single vendor (Check Point's own wording) |
| Cisco: Cisco SASE | Cisco Secure Access: ZTNA (opens in a new tab), VPN as a service, internet and SaaS protection, DNS Defense | Cisco SD-WAN or Cisco Meraki (opens in a new tab) SD-WAN | Cisco throughout, or Secure Access with another SD-WAN |
| Exium: Exium SASE (now part of NETGEAR) | Secure Internet Access and Secure Private Access | Cyber Gateway software at each site | Single vendor |
| HPE: HPE Aruba Networking SASE | HPE Networking Security Service Edge (SSE): ZTNA, SWG, CASB, DLP | HPE Networking EdgeConnect | Single vendor, or EdgeConnect with another Security Service Edge (SSE) |
| Sophos: Sophos Workspace Protection | Protected Browser, Sophos ZTNA, DNS Protection for endpoints, Email Monitoring System | Not part of the bundle; Sophos Firewall at sites | Endpoint and browser-based rather than gateway-based |
| Timus Networks: Timus SASE | Adaptive ZTNA, cloud firewall, secure web gateway on the Advanced Plan | IPsec site-to-site tunnels | User-led; pair with your WAN |
| Todyl: Todyl SASE | ZTNA, secure web gateway, secure DNS, cloud next-generation firewall | SASE Tunnel (IPsec) from an existing site edge | User-led; pair with your WAN |
| Trend Micro: ZTSA | Private Access, Internet Access with CASB controls, AI Secure Access | Not included | Security Service Edge (SSE) only |
| WatchGuard: FireCloud and Firebox | FireCloud: firewall as a service, secure web gateway, ZTNA on Total Access | Firebox appliances at sites | Single vendor across FireCloud and Firebox |
Rows are listed alphabetically, not ranked. Each is drawn from the vendor's own website, checked 9 November 2026; vendors add features often, so we confirm the current position on your quote.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
Delivery, licensing unit and fit
| Platform | How traffic is handled | Licensed | Often suits |
|---|---|---|---|
| Barracuda SecureEdge | Inspection in the cloud, at the branch or on the device; SaaS or on-premises deployment | SecureEdge Access per user; site devices per site | Multi-site organisations wanting SD-WAN and firewall as a service from one vendor |
| Check Point SASE | Hybrid: on-device and cloud inspection; private backbone for Private Access | Per user, Internet Access and Private Access | One vendor for users, SaaS, AI tools and branches |
| Cisco SASE | Cisco Secure Client or browser to Cisco's cloud; SD-WAN tunnels from sites | Per user (Secure Access); SD-WAN per site | Cisco, Meraki and Duo estates |
| Exium SASE | Client on each device; software gateway at sites | Per user; Cyber Gateway per site | Small and mid-sized multi-site organisations |
| HPE Aruba Networking SASE | EdgeConnect at sites; agent-based or agentless access for users | Subscriptions for sites and users, confirmed at quote | HPE Aruba Networking and Juniper estates |
| Sophos Workspace Protection | On the device and in the browser, without routing through cloud gateways | Per user | Sophos Firewall and Sophos endpoint customers |
| Timus SASE | Always-on agent to cloud gateways, each with a static IP | Per user | Smaller organisations wanting access, firewall and web security in one agent |
| Todyl SASE | Always-on agent to Todyl's Secure Global Network | Per device | SASE and endpoint security on one platform |
| WatchGuard FireCloud | One agent to WatchGuard's cloud, managed in WatchGuard Cloud | Per user | WatchGuard Firebox customers with remote staff |
Licensing detail without prices is on our licensing pages, for example Cisco Secure Access licensing (opens in a new tab), Check Point SASE licensing (opens in a new tab), Sophos Workspace Protection licensing (opens in a new tab) and WatchGuard FireCloud licensing (opens in a new tab). Subscriptions can be billed monthly, terms confirmed at quote.
Other SASE companies you will see on shortlists
| Vendor | Platform | What the vendor says it includes | Compare |
|---|---|---|---|
| Cato Networks | Cato SASE Cloud | SD-WAN, a global private backbone and a network security stack, managed through a single self-service console | Ask us for a side-by-side |
| Cloudflare | Cloudflare One | ZTNA, secure web gateway, CASB, network as a service and firewall as a service, plus RBI, DLP and email security; Magic WAN for sites | Ask us for a side-by-side |
| Netskope | Netskope One SASE | Netskope's Security Service Edge (SSE) with Netskope One SD-WAN, described by Netskope as single-vendor | Ask us for a side-by-side |
| Palo Alto Networks | Prisma SASE | Prisma Access, Prisma SD-WAN, Prisma Browser, Enterprise DLP, RBI and SaaS Security | Palo Alto SASE compared |
| Zscaler | Zscaler Zero Trust SASE | Its Security Service Edge (SSE) platform with Zero Trust SD-WAN, launched in January 2024 as a single-vendor SASE | Zscaler SASE compared |
Sources: Cato Networks (opens in a new tab), Cloudflare (opens in a new tab), Netskope (opens in a new tab), Palo Alto Networks (opens in a new tab) and Zscaler (opens in a new tab), checked 9 November 2026. The comparison pages set them against the platforms in the first table so you can see where each fits.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Best SASE vendors: how to shortlist instead of ranking
Searches for the best or top SASE vendors, or a top 10 list for 2026, usually come from someone building a shortlist. A ranking cannot tell you which platform fits your estate, so a method helps more:
- Start from what you own. Your firewalls, SD-WAN or routers, identity provider and device management often point to two or three SASE companies straight away: a Meraki estate to Cisco, an Aruba or Juniper estate to HPE, a Firebox estate to WatchGuard.
- Decide single or dual vendor. One vendor for the network and the security, or a Security Service Edge (SSE) from one and SD-WAN from another. The trade-offs are on single vendor SASE.
- Match the inspection model. Cloud gateways, on-device inspection or a mix. This affects latency, privacy and how much traffic leaves your sites.
- Check the licensing unit. Per user, per device or per site changes the cost picture for shared devices, contractors and small branches.
- Pilot two. A trial with real users and applications settles more than any feature list.
The full method, including the NCSC's questions on trust and visibility, is on how to choose SASE.
What we do
Forever Systems supplies several SASE platforms, so we can compare them on fit rather than push one. We can:
- Assess your current VPN, firewalls, WAN links, identity set-up and the applications people need
- Shortlist two or three SASE vendors that match what you already run
- Quote the licences and any site hardware in one place, with subscriptions that can be billed monthly, terms confirmed at quote
- Deploy in phases, starting with one group of users or one site, and support the platform afterwards with scope confirmed at quote
Pricing depends on users, sites, components and term, so ask us for a quote. Contact us for a recommendation based on your estate.
SASE vendor guides
Cisco SASECisco Secure Access with Cisco SD-WAN or Meraki SD-WAN, explained.
Check Point SASECheck Point SASE, formerly Harmony SASE: private access, internet access, SaaS security and Secure SD-WAN in one platform.HPE Aruba Networking SASEHPE Aruba Networking Security Service Edge (SSE) with EdgeConnect SD-WAN, plus Juniper Secure Edge.Barracuda SecureEdgeBarracuda SecureEdge: Secure SD-WAN, zero trust access, firewall as a service and web security in one SASE platform.
Sophos SASESophos Workspace Protection: browser, ZTNA and DNS protection for endpoints.
WatchGuard SASEWatchGuard SASE explained: FireCloud Internet Access and Total Access for cloud security and ZTNA.
Todyl SASETodyl SASE: one agent connects devices to Todyl's Secure Global Network for ZTNA, web filtering, secure DNS and a cloud firewall.
Timus SASETimus SASE explained: adaptive ZTNA with posture checks, static IP gateways and a cloud firewall in one agent.
Exium SASEExium SASE, now part of NETGEAR: what SASE Essentials, SASE Pro and the Cyber Gateway include.Palo Alto SASE comparedPalo Alto Networks Prisma SASE compared factually with the Cisco, Check Point, HPE and Barracuda SASE platforms we supply.Zscaler SASE comparedZscaler Zero Trust SASE compared factually with Cisco, Check Point and HPE SASE: components, branch design and delivery.How to choose SASEHow to choose the right SASE for your business: requirements, shortlist questions, proof of concept and licensing.How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
Who are the main SASE vendors?
Among those we supply: Barracuda, Check Point, Cisco, Exium, HPE, Sophos, Timus Networks, Todyl, Trend Micro and WatchGuard. Cato Networks, Cloudflare, Netskope, Palo Alto Networks and Zscaler are also widely shortlisted. Each is compared factually on this page.
What is the best SASE vendor?
There is no single answer. The right SASE vendor depends on the network and security kit you already run, your identity provider, how many sites and users you have, and whether you want one vendor for SD-WAN and security. We compare on fit and can run a pilot.
What is the difference between a SASE vendor and a SASE company that supplies it?
The vendor builds and runs the platform. The supplier, often called a SASE provider, sells, sets up and supports it for you. Forever Systems supplies several vendors' platforms, so we can recommend between them.
Which SASE vendors offer single-vendor SASE?
Check Point, Netskope and Zscaler use the term for their own platforms, and HPE uses it for HPE Networking SASE. Barracuda, Exium and WatchGuard also provide both the SD-WAN or site gateway and the cloud security. Cisco offers Secure Access with Cisco SD-WAN or Meraki SD-WAN.
Are there SASE vendors for small businesses?
Yes. Timus SASE, Todyl SASE and Exium SASE are licensed per user or per device with no hardware for remote users, and WatchGuard FireCloud and Sophos Workspace Protection suit organisations already using those vendors. See SASE for small business for more.
Still have a question about SASE vendors?
Ask us and a member of our team will get back to you.