In short
Exium SASE is a SASE platform for small and mid-sized organisations; Exium is now part of NETGEAR. SASE Essentials covers web, DNS and SaaS security plus ZTNA; SASE Pro adds conditional access, agentless access and firewall replacement; the Cyber Gateway is a per-site software firewall with SD-WAN. Forever Systems can supply it, billed monthly, terms confirmed at quote.
Get a quote for Exium SASE
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What is NETGEAR Exium? The NETGEAR acquisition of Exium
NETGEAR has completed its acquisition of Exium (opens in a new tab), a cybersecurity company with a cloud-native Secure Access Service Edge (SASE) solution; NETGEAR's announcement page was last updated on 19 June 2025. Exium's website (opens in a new tab) now says: "Exium is now proudly part of NETGEAR". That is what people mean by NETGEAR Exium: Exium's SASE platform, under NETGEAR ownership.
What NETGEAR has said about the Exium NETGEAR acquisition is specific:
- Exium's SASE is "specifically built for the needs of small and medium enterprises" and "tailored to be managed by their MSP or MSSPs"
- NETGEAR plans to combine Exium's SASE platform with its own networking to deliver integrated networking and cybersecurity for small and medium-sized businesses
- NETGEAR intends to bring "a new class of secure networking products" to market for MSPs and SMEs
- Exium's former CEO and his team have joined NETGEAR
NETGEAR has since set out a phased roadmap for Exium (opens in a new tab):
- Available now: the Exium platform as a standalone service, with SASE and XDR.
- Exium in NETGEAR hardware (scheduled by NETGEAR for the first quarter of 2026): the Exium Cyber Gateway software is built into NETGEAR business hardware, and all security services are managed centrally through the NETGEAR Insight cloud platform.
- Longer term (2027 onwards): NETGEAR's aim is security built into every NETGEAR business product.
The second phase has started: NETGEAR now sells a business security gateway, managed in Insight, that comes with cloud-enforced Exium security (web filtering, intrusion detection and cloud access controls), and its NETGEAR Exium security dashboard opens directly from Insight. Exium's own products keep their names (SASE Essentials, SASE Pro, Cyber Gateway, XDR360, GRC360 and IAM360) and are still bought through partners, so you can take Exium as a standalone service or alongside NETGEAR hardware. We confirm current editions when we quote.
What Exium SASE includes
Exium describes a unified platform with one console and one endpoint agent "for SASE, EDR, XDR, device posture, threat remediation, and data governance". On the solutions and products pages (opens in a new tab), Exium's SASE has three parts:
- Secure Internet Access (SIA): web security, DNS security including encrypted DNS, and SaaS security, protecting users and data when they use the internet and SaaS applications
- Secure Private Access (opens in a new tab) (SPA): zero trust network access to internal networks and private applications, which Exium positions as a replacement for VPNs
- Modern Workplace Security: replacing office firewalls with software, through the Cyber Gateway
In SASE terms, SIA and SPA together are a Security Service Edge (SSE), and the Cyber Gateway adds the branch networking (SD-WAN and firewall) that turns it into full SASE. Exium calls its global cloud platform CyberMesh. If the terms are new, what is SASE and SASE vs SD-WAN explain them.
Exium SASE Essentials, SASE Pro and the Cyber Gateway
| Capability Exium lists | SASE Essentials | SASE Pro | Cyber Gateway |
|---|---|---|---|
| DNS, web and SaaS security | Yes | Yes | DNS and web security at the site |
| Zero trust Secure Private Access | Yes | Yes | Supports ZTNA for VPN replacement |
| Private DNS and private domains | Yes | Yes | Not listed |
| Mobile device security | Yes | Yes | Not listed |
| Digital Experience Monitoring | Yes | Yes | Not listed |
| Conditional access for SaaS apps | No | Yes | Not listed |
| Geo-fencing controls | No | Yes | Geo-fencing listed |
| Agentless zero trust access | No | Yes | Not listed |
| Connect existing firewalls | No | Yes | Not listed |
| SSO/MFA, SCIM and SIEM integrations | No | Yes | Not listed |
| Next-generation firewall, SD-WAN, IDS/IPS, segmentation, IoT/OT security | Not listed | Not listed | Yes |
| How it is licensed | Per user, up to five devices | Per user, up to five devices | Per site, with high availability included |
SASE Essentials is Exium's entry point for organisations new to zero trust: VPN replacement plus web, DNS and SaaS protection. SASE Pro builds on it with conditional access for SaaS apps, agentless access for contractors and unmanaged devices, geo-fencing and integrations, and Exium positions it as a replacement for traditional firewalls. The Cyber Gateway is the site component. Source: Exium's published plans on exium.net, read 9 November 2026; we confirm current contents when we quote.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Exium for offices: Cyber Gateway and existing firewalls
Most small multi-site organisations start with an office firewall that also runs the remote access VPN. Exium gives two routes through that:
- Keep the firewall for now. SASE Pro can connect existing firewalls to the Exium cloud, so remote users move to zero trust private access first and the VPN service on the firewall can be switched off, without changing every site at once.
- Replace the firewall. The Cyber Gateway (opens in a new tab) is software that Exium says runs on general-purpose hardware, virtual machines or public cloud platforms such as Azure and AWS. It brings a next-generation firewall, SD-WAN, intelligent network segmentation, intrusion detection and prevention, and IoT/OT security, and is licensed per site with high availability included.
Whether replacing a firewall is the right step depends on what the box does today, such as guest Wi-Fi, inbound services or site-to-site links, so we review that first. SASE vs firewall explains the trade-offs, and network-infrastructure.co.uk covers hardware firewalls if you decide to keep one.
Where Exium SASE fits
Exium suits:
- Small and mid-sized organisations that want VPN replacement, web protection and a firewall replacement from one platform
- Multi-site businesses with ageing office firewalls, where the Cyber Gateway can replace the appliance as sites come up for renewal
- Organisations that want XDR and identity on the same platform: XDR360, IAM360 (single sign-on, MFA and a password manager) and GRC360 share the console
- Hybrid staff with several devices, since each SASE user licence covers up to five devices
The platforms closest in shape are Todyl SASE and Timus SASE; for a platform with branch SD-WAN from a large network vendor, compare Cisco SASE, Check Point SASE and HPE Aruba Networking SASE. The ZTNA side of Exium is on ztna.org.uk's Exium ZTNA (opens in a new tab) page.
Is Exium SASE the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Licensing and how we help
Exium SASE is licensed per user, each user licence covering up to five devices; the Cyber Gateway is licensed per site. Exium says it bills monthly with no upfront fees and no contracts. Pricing depends on edition, users and sites, so ask us for a quote; the licensing detail is on Exium SASE licensing (opens in a new tab) and Exium Cyber Gateway licensing (opens in a new tab). Subscriptions can be billed monthly, terms confirmed at quote.
How we can help:
- Assess: how staff reach applications today, which firewalls you run and what they do, and any logging or compliance needs.
- Design: choose Essentials or Pro, decide where a Cyber Gateway makes sense and plan policies.
- Pilot: deploy the agent to a small group, connect identity and publish the first private applications.
- Migrate: move users and sites across, then close the old VPN so nothing bypasses the new policy.
Scope and timescales are confirmed at quote. Contact us to talk about Exium SASE.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What is NETGEAR Exium?
NETGEAR Exium is Exium's SASE platform under NETGEAR ownership. NETGEAR has completed its acquisition of Exium, and Exium's products, including SASE Essentials, SASE Pro and the Cyber Gateway, still carry the Exium name at the time of writing.
When did NETGEAR acquire Exium?
NETGEAR announced the completion of its acquisition of Exium on a page last updated on 19 June 2025. Exium's website now says Exium is part of NETGEAR.
What does the NETGEAR acquisition mean for Exium customers?
NETGEAR says it will combine Exium's SASE platform with its networking to deliver integrated networking and cybersecurity for small and medium-sized businesses, and has published a phased plan: Exium is available as a standalone SASE and XDR service, the Exium Cyber Gateway software is being built into NETGEAR business hardware, and security services are managed in the NETGEAR Insight cloud platform. NETGEAR already sells a business security gateway with Exium cloud security managed from Insight. We confirm current editions and terms when we quote.
What is the difference between Exium SASE Essentials and SASE Pro?
SASE Essentials covers DNS, web and SaaS security, zero trust private access, private DNS, mobile device security and digital experience monitoring. SASE Pro adds conditional access for SaaS apps, geo-fencing, agentless zero trust access, connection of existing firewalls and SSO/MFA, SCIM and SIEM integrations.
Can Exium replace our office firewall?
Often, yes. Exium positions SASE Pro and its Cyber Gateway, a software firewall with SD-WAN, IDS/IPS and segmentation licensed per site, as replacements for traditional firewalls. We check what your current firewall does before recommending it.
How many devices does an Exium SASE licence cover?
Exium states that each SASE user licence covers up to five devices.
Still have a question about Exium SASE?
Ask us and a member of our team will get back to you.
More SASE guides
Todyl SASETodyl SASE: one agent connects devices to Todyl's Secure Global Network for ZTNA, web filtering, secure DNS and a cloud firewall.
Timus SASETimus SASE explained: adaptive ZTNA with posture checks, static IP gateways and a cloud firewall in one agent.SASE vs firewallOn-premises NGFW vs SASE and firewall as a service: where inspection happens and whether you still need a firewall.SASE for small businessWeb security, zero trust access and cloud firewall for small teams, without branch hardware.Single vendor SASESingle vendor SASE vs dual-vendor SASE: one platform for SD-WAN and security, or best-fit parts joined by tunnels.