In short
Palo Alto SASE, sold as Prisma SASE, combines Prisma Access (cloud security), Prisma SD-WAN and a secure enterprise browser. Cisco SASE, Check Point SASE, HPE Aruba Networking SASE and Barracuda SecureEdge cover the same layers in different ways. UK organisations comparing them can ask Forever Systems to quote the platforms we supply against the same requirements.
Want to compare it with the platforms we supply?
Tell us about your users, sites and current kit and we can show how Cisco, Check Point, HPE, Barracuda and the other platforms we supply would fit, with a quote.
What Palo Alto SASE (Prisma SASE) is
Prisma SASE is Palo Alto Networks' secure access service edge platform. On its SASE page (opens in a new tab), Palo Alto Networks describes it as protecting users, apps, data and devices, from the hybrid workforce to the branch, on a multicloud architecture, for both managed and unmanaged devices. It is made of three products:
- Prisma Access (opens in a new tab): the cloud-delivered security, covering zero trust access to applications without a traditional VPN, web protection, SaaS security with SaaS Security Posture Management (opens in a new tab) and inline and API-based controls, remote browser isolation and cloud-native network security (firewall as a service). Users connect through the Prisma Agent, which Palo Alto Networks describes as a unified agent across SASE and next-generation firewall deployments.
- Prisma SD-WAN (opens in a new tab): branch networking with application-defined SLAs, integrated IoT security and one-click onboarding of branches to Prisma Access, using Palo Alto Networks' Instant-On Network (ION) devices.
- Prisma Browser (opens in a new tab) (called Prisma Access Browser on the SASE page): a secure enterprise browser, available as a browser, an extension and a mobile app, for managed and unmanaged devices, with data controls inside the browser.
Management sits in Strata Cloud Manager, and Autonomous Digital Experience Management (ADEM) monitors user experience across the platform. Palo Alto Networks also markets Prisma SASE to managed service providers.
Palo Alto SASE architecture
The Palo Alto SASE architecture follows the pattern most single-vendor SASE platforms use, with Palo Alto Networks' own names for each part:
- Users connect with the Prisma Agent from managed devices, or work inside Prisma Browser on managed and unmanaged devices.
- Branches connect through Prisma SD-WAN devices, which choose paths across their links and onboard the branch to Prisma Access. Palo Alto Networks says Prisma Access protects remote networks by automatically deploying firewalls in the cloud.
- Prisma Access applies the Security Service Edge (SSE) controls: zero trust access to private applications, web and DNS protection, SaaS controls and data protection, and firewall as a service.
- Applications are reached from the Prisma Access cloud, whether they are on the internet, in SaaS or in your data centres and clouds.
- Strata Cloud Manager and ADEM give one place to manage policy and see performance.
If you want the vendor-neutral version of this picture, SASE architecture walks through the same layers, and single vendor SASE covers the trade-off between one platform and best-fit parts.
Prisma SASE compared with the SASE platforms we supply
| Platform | Security Service Edge (SSE) | SD-WAN and branch | User access | Delivery |
|---|---|---|---|---|
| Palo Alto Networks Prisma SASE | Prisma Access: ZTNA, web security, SaaS security, RBI, firewall as a service | Prisma SD-WAN with ION devices | Prisma Agent, or Prisma Browser on managed and unmanaged devices | Cloud, managed in Strata Cloud Manager |
| Cisco SASE | Cisco Secure Access: ZTNA, secure web gateway, CASB, firewall as a service, DLP, RBI, DNS-layer security | Cisco SD-WAN or Cisco Meraki (opens in a new tab) SD-WAN | Client-based or clientless ZTNA | Cloud, with Cisco Cloud Control |
| Check Point SASE (formerly Harmony SASE) | Internet Access, Private Access, SaaS Security, GenAI usage monitoring | SD-WAN in the same platform | On-device protection, agentless access and Enterprise Browser | Hybrid: on-device, in-browser and cloud inspection |
| HPE Aruba Networking SASE | HPE Aruba Networking Security Service Edge (SSE): ZTNA, SWG, CASB, firewall as a service, DEM | HPE Aruba Networking EdgeConnect SD-WAN | Agent-based or agentless ZTNA | Cloud security with EdgeConnect at the branch |
| Barracuda SecureEdge | ZTNA, firewall as a service, web security | Barracuda Secure SD-WAN in the same platform | SecureEdge Access (opens in a new tab): agent-based, for any user on any device | Inspection in the cloud, at the branch or on the device; on-premises to SaaS options |
Facts are taken from each vendor's own pages, linked on this page and on each platform's page, read on 9 November 2026. Vendors change packaging often, so we confirm what is included when we quote.
Still not sure which way to go? Ask us
Tell us what matters most to you and we can go through the options we supply with you.
How the platforms differ
All five platforms cover the same SASE layers, so the differences that matter in practice are about where inspection happens, what you already own and how the branch connects:
- Where traffic is inspected. Prisma SASE and Cisco Secure Access inspect in the vendor's cloud. Check Point SASE describes a hybrid model, with protection on the device, in the browser and in the cloud. Barracuda SecureEdge lets you enforce policy in the cloud, at the branch or on the device.
- What is at the branch. Prisma SD-WAN, Cisco SD-WAN or Meraki SD-WAN, Check Point's SD-WAN, HPE Aruba Networking EdgeConnect and Barracuda Secure SD-WAN each bring their own branch appliances. If you already run one vendor's routers, firewalls or Wi-Fi, staying with that vendor's SASE usually means fewer changes.
- Unmanaged devices. Palo Alto Networks and Check Point both offer an enterprise browser; Cisco and HPE offer clientless or agentless ZTNA for apps that do not need an agent.
- Management. Each platform has one console for its own parts (Strata Cloud Manager, Cisco Cloud Control and so on). Mixing vendors means more than one.
There is no single right answer. How to choose SASE sets out the questions to answer first.
Who each platform suits
| Platform | Often shortlisted by |
|---|---|
| Palo Alto Networks Prisma SASE | Organisations that already run Palo Alto Networks next-generation firewalls and want SASE in the same family |
| Cisco SASE | Organisations with Cisco or Meraki networks, or Cisco security such as Duo and Umbrella, that want SASE from the same vendor |
| Check Point SASE | Organisations that want on-device and in-browser inspection, or already use Check Point firewalls or Harmony products |
| HPE Aruba Networking SASE | Organisations with HPE Aruba Networking or HPE Juniper Networking estates, or EdgeConnect SD-WAN already at branches |
| Barracuda SecureEdge | Organisations that want the choice of cloud, branch or on-device enforcement, or already run Barracuda firewalls |
| Todyl, Timus or Exium SASE | Smaller organisations that want a cloud-only platform run by an IT provider; see Todyl SASE, Timus SASE and Exium SASE |
These are typical starting points, not verdicts: the right platform depends on your users, sites, applications and the kit you already own.
Weighing up SASE platforms?
We can map the platforms we supply against your own requirements and talk you through the trade-offs.
Licensing models, without the prices
SASE platforms are licensed by a mix of users and sites:
- Prisma SASE: Prisma Access is bought with a mobile user licence for remote users, and Palo Alto Networks says customers can exceed their purchased mobile user licence temporarily in an emergency. Prisma SD-WAN has a consumption model based on the bandwidth used, alongside its devices.
- Cisco Secure Access: Cisco says user-based pricing is typical, with site-based licensing based on bandwidth available, in Essentials and Advantage packages.
- Check Point SASE, HPE Aruba Networking SASE and Barracuda SecureEdge: security per user, with SD-WAN appliances and their subscriptions per site.
Term, support level and add-ons change the total, so compare like for like. We can quote the platforms we supply on the same user and site counts; ask us for a quote.
How Forever Systems helps
We supply Cisco, Check Point, HPE Aruba Networking, Barracuda and several MSP-ready SASE platforms, so we can:
- Assess your users, sites, applications, current VPN and firewalls, and what is due for renewal.
- Shortlist the platforms we supply that fit, and map them against Prisma SASE on the components you care about.
- Quote like for like, on the same users, sites and term.
- Pilot and deploy, starting with one group or one site and extending in phases.
Scope and timescales are confirmed at quote. Contact us to compare SASE platforms for your organisation.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What is Palo Alto SASE?
Palo Alto SASE is Palo Alto Networks' Prisma SASE platform. It combines Prisma Access for cloud-delivered security (ZTNA, web and SaaS security, remote browser isolation and firewall as a service), Prisma SD-WAN for branches and Prisma Browser for secure browsing on managed and unmanaged devices.
What is the difference between Prisma Access and Prisma SASE?
Prisma Access is the cloud security part, the Security Service Edge (SSE). Prisma SASE is the whole platform: Prisma Access plus Prisma SD-WAN and Prisma Browser, managed through Strata Cloud Manager.
What does the Palo Alto SASE architecture look like?
Users connect with the Prisma Agent or Prisma Browser, branches connect through Prisma SD-WAN devices, and Prisma Access applies security in the cloud before traffic reaches internet, SaaS or private applications. Strata Cloud Manager and ADEM provide management and experience monitoring.
What are the alternatives to Palo Alto Networks Prisma SASE?
Single-vendor SASE platforms covering the same layers include Cisco SASE (Cisco Secure Access with Cisco SD-WAN or Meraki SD-WAN), Check Point SASE, HPE Aruba Networking SASE with EdgeConnect SD-WAN and Barracuda SecureEdge. Forever Systems can quote these against the same requirements.
Is Prisma SASE single-vendor SASE?
Yes. Palo Alto Networks supplies both the security (Prisma Access) and the SD-WAN (Prisma SD-WAN), managed together. Cisco, Check Point, HPE and Barracuda also offer both halves from one vendor.
Still deciding?
Ask us and a member of our team will get back to you.
More SASE guides
Cisco SASECisco Secure Access with Cisco SD-WAN or Meraki SD-WAN, explained.