In short
Timus SASE, from Timus Networks (now a CyberFOX company), is a cloud-native SASE platform with no hardware: an always-on agent connects users to Timus gateways with static IPs for adaptive ZTNA, a Layer 3 to 7 cloud firewall and, on the Advanced Plan, a secure web gateway. Forever Systems can supply and deploy it, licensed per user.
Get a quote for Timus SASE
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What Timus SASE is
Timus SASE is the secure access service edge platform from Timus Networks, which describes it as a channel-first SASE platform built for IT service providers. Its home page (opens in a new tab) says there is no hardware: the platform is fully cloud native, and an always-on, OS-agnostic agent on each desktop and mobile device connects users to Timus cloud gateways.
Timus groups its components like this:
- Zero trust network access (ZTNA): always-on, zero-click access, defined by role, risk or location, with conditional access and adaptive MFA
- Dynamic Cloud Firewall: a cloud firewall (opens in a new tab) with identity-based rules that follow users across locations and devices, enforced from Layer 3 to Layer 7
- Secure web gateway (SWG): URL filtering (opens in a new tab), malware protection and category filtering, with granular web policies by user, device, time and content type
- Advanced device posture checks, using endpoint protection signals from tools such as SentinelOne, Bitdefender, Microsoft Defender and Heimdal
- IP-based access to SaaS apps: a dedicated static IP for SaaS access control, so cloud apps can be locked to known IPs
- Secure RDP: zero trust remote desktop without a VPN
- Reporting, including activity and productivity tracking and compliance reporting
Timus and CyberFOX. CyberFOX announced (opens in a new tab) that it has acquired Timus Networks. CyberFOX says Timus continues under the Timus brand in the near term, with no disruption to service, support or contracts for existing partners and customers, and Timus now describes the product as "Timus SASE, A CyberFox Platform".
How Timus SASE works
Timus is a cloud-delivered Security Service Edge (SSE) with a cloud firewall at its centre. A typical connection runs like this:
- Sign-in: the user signs in through your identity provider (Timus lists Microsoft Entra ID, Okta and SAML), with conditional access and adaptive MFA.
- Posture: device posture checks and endpoint protection signals decide whether the device gets in, and how far.
- Tunnel: the agent keeps an always-on encrypted tunnel to a Timus gateway, using WireGuard or OpenVPN with automatic protocol fallback, and domain-based split tunnelling decides which traffic goes through it.
- Policy: zero trust policies and the Layer 3 to 7 cloud firewall decide which private networks and applications the user reaches; on the Advanced Plan the secure web gateway filters web traffic.
- Static IP out: traffic to SaaS apps leaves from the gateway's dedicated static IP, so apps that support IP restrictions can accept sign-ins only from Timus.
- Continuous checks: Timus calls this Adaptive Zero Trust, monitoring behaviour, risk and device posture continuously during the session.
Offices and cloud networks connect over site-to-site IPsec tunnels, with site-to-site interconnectivity, so the same policy covers sites and remote users. Timus has no SD-WAN appliance; sites keep their existing firewall or router as the tunnel end. The ZTNA detail, including Trusted Networks and sign-in policies, is on ztna.org.uk's Timus ZTNA (opens in a new tab) page.
Timus SASE plans: Essentials and Advanced
| What Timus lists | Essentials (shared gateways) | Advanced Plan (dedicated gateway) |
|---|---|---|
| Who Timus says it is for | Small teams that need secure remote access | Larger teams that need more security controls and customisation |
| Timus users per client | Up to five | No limit listed |
| Devices per user | Two | Four |
| Cloud firewall policies | Up to 10 | Unlimited |
| Secure web gateway (URL filtering, malware protection, category filtering) | Not included | Included |
| Log retention | 7 days | 30 days |
| Agent profiles | Two | Twelve |
Both plans are built on the same platform: conditional access with adaptive MFA, a dedicated static IP for SaaS access control, the Layer 3 to 7 cloud firewall, site-to-site IPsec tunnels, private DNS, device posture integrations and the always-on agent. Gateway bandwidth is also higher on the Advanced Plan. If you want web filtering as part of SASE, the Advanced Plan is the one to look at. Source: Timus SASE plans (opens in a new tab), read 9 November 2026.
Not sure which plan fits? Ask us
Tell us what you need and we will recommend the right plan for your organisation, with a quote.
Timus SASE use cases
Timus highlights a few jobs that come up again and again with smaller organisations:
- Replacing a remote access VPN with an always-on agent that users do not have to start
- Locking SaaS to a fixed IP: allowlisting the gateway's static IP in apps that support IP restrictions, so a stolen password on its own is far less useful
- Remote desktop without exposed RDP: putting RDP hosts behind ZTNA and the cloud firewall instead of an open port
- One firewall policy for users and sites: identity-based rules in the cloud firewall, with offices joined by IPsec tunnels
- Web protection for remote users on the Advanced Plan, without sending traffic back to the office
For multi-site organisations that also need SD-WAN at every branch, compare Cisco SASE, Check Point SASE or Barracuda SecureEdge. The closest platforms in shape to Timus are Todyl SASE and Exium SASE; SASE for small business puts them side by side.
Licensing and deployment
Timus SASE is licensed per user, with two devices per user on Essentials and four on the Advanced Plan. Timus offers a 30-day trial, which we can use for a pilot on your own devices and applications. Subscriptions can be billed monthly, terms confirmed at quote, and pricing depends on the plan and user numbers, so ask us for a quote. Licensing detail is on Timus SASE and CyberFOX licensing (opens in a new tab), and other SASE and ZTNA licences we supply are on SASE and ZTNA licensing (opens in a new tab).
A typical deployment:
- Assess: who works remotely, what they reach, which SaaS apps support IP restrictions and how web traffic is filtered today.
- Connect identity and posture: link your identity provider and endpoint protection, and set sign-in and MFA policies for users and administrators.
- Build policy: zero trust policies and cloud firewall rules per group, and web filtering on the Advanced Plan.
- Pilot, then roll out: deploy the agent silently through device management or RMM tooling, add IPsec tunnels for sites and move SaaS allowlists to the static IP.
- Close the old route: retire the VPN and any exposed RDP ports.
Scope and timescales are confirmed at quote. Contact us to talk about Timus SASE.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What is Timus SASE?
Timus SASE is the cloud-native secure access service edge platform from Timus Networks, now a CyberFOX company. An always-on agent connects users to Timus gateways, where adaptive zero trust network access, device posture checks, a Layer 3 to 7 cloud firewall and, on the Advanced Plan, a secure web gateway are applied.
Who owns Timus Networks?
CyberFOX has acquired Timus Networks. CyberFOX says Timus continues under its own brand in the near term with no disruption to service, support or contracts, and Timus now presents the product as Timus SASE, a CyberFOX platform.
Does Timus SASE need hardware?
No. Timus describes Timus SASE as cloud native with no hardware. Offices and cloud networks connect over site-to-site IPsec tunnels from the firewall or router you already have.
What is the difference between Timus Essentials and Advanced?
Timus positions Essentials, on shared gateways, for small teams of up to five users with two devices each and up to 10 firewall policies. The Advanced Plan, on a dedicated gateway, adds the secure web gateway, four devices per user, unlimited firewall policies and longer log retention.
Does Timus give us a static IP?
Yes. Timus lists a dedicated static IP for SaaS access control, so you can allowlist it in SaaS apps that support IP restrictions and accept sign-ins only from users connected through Timus.
Can we buy Timus SASE directly?
Timus describes itself as a channel-first platform for IT service providers. Forever Systems can supply and deploy Timus SASE for you, licensed per user; subscriptions can be billed monthly, terms confirmed at quote.
Still have a question about Timus SASE?
Ask us and a member of our team will get back to you.
More SASE guides
Todyl SASETodyl SASE: one agent connects devices to Todyl's Secure Global Network for ZTNA, web filtering, secure DNS and a cloud firewall.
Exium SASEExium SASE, now part of NETGEAR: what SASE Essentials, SASE Pro and the Cyber Gateway include.SASE for small businessWeb security, zero trust access and cloud firewall for small teams, without branch hardware.SASE vs firewallOn-premises NGFW vs SASE and firewall as a service: where inspection happens and whether you still need a firewall.SASE for hybrid workingSASE for hybrid working: the advantages of SASE for hybrid workforce security, with the same policy at home.