In short
Todyl SASE is the cloud-delivered SASE module of the Todyl platform: an agent tunnels each device to the Todyl Secure Global Network (SGN), which applies ZTNA, a secure web gateway, secure DNS and a next-generation firewall. Todyl sells through providers; Forever Systems can supply and deploy it, and subscriptions can be billed monthly, terms confirmed at quote.
Get a quote for Todyl SASE
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What Todyl SASE includes
Todyl builds one security platform for smaller organisations and the IT providers who look after them, and Todyl SASE is its network security module. Rather than an office firewall, a VPN concentrator and a separate web filter, each laptop, desktop or server runs the Todyl SASE agent, and the agent connects it to Todyl's cloud, where the policy is applied.
On its SASE platform page (opens in a new tab) Todyl lists:
- Zero trust network access: identity-based access to internal resources, with custom conditional access rules and location-aware enforcement
- Secure web gateway with comprehensive web filtering, to control access to non-work and malicious websites
- Secure DNS, blocking malicious and unwanted domains
- Advanced next-generation firewall (NGFW) with SSL inspection, so threats inside encrypted traffic can be found
- LAN Zero Trust microsegmentation, which blocks internal traffic between devices by default to stop lateral movement
- Highly available architecture with automatic failover, smart traffic routing and optional static IPs for dedicated, allowlistable connections
- Compliance mapping and dashboards, linking individual SASE capabilities to frameworks such as HIPAA, PCI DSS and GDPR
Todyl states that the core of SASE is entirely cloud-based, so there is no appliance to buy. Mapped onto the usual SASE building blocks, that covers the Security Service Edge (SSE) side (ZTNA, secure web gateway, DNS security and firewall as a service) and joins offices through IPsec tunnels rather than a Todyl SD-WAN appliance. If you are new to the terms, what is SASE and SASE vs Security Service Edge (SSE) explain them.
What is the Todyl Secure Global Network (SGN)?
The Todyl Secure Global Network, usually shortened to Todyl SGN, is Todyl's own network of cloud points of presence. Todyl says the SASE module "creates a Secure Global Network (SGN) to protect remote connections": devices running the agent talk to the SGN over a secure tunnel, and traffic is inspected there before it is routed on to the internet, a SaaS application or one of your private resources.
That is the defining design choice of Todyl SASE:
- The agent connects the device. Wherever the user is, the agent tunnels to a regional point of presence on the SGN.
- The SGN applies policy. Conditional access rules decide which private resources the user may reach; the web gateway, secure DNS and NGFW inspect internet traffic.
- Traffic carries on to its destination. Internet and SaaS traffic leaves from the SGN, with an optional static IP if a supplier or cloud application needs to allowlist you; private traffic reaches your offices or cloud networks through tunnels.
- Failover is automatic. Todyl describes a highly available architecture that moves connections if a point of presence has a problem.
Because enforcement happens in the SGN rather than at the office, a laptop in a hotel gets the same web filtering and firewall rules as one at a desk. For the general picture of where the policy engine sits, see SASE architecture; for the ZTNA side of the SGN, ztna.org.uk covers Todyl ZTNA (opens in a new tab).
Is Todyl a VPN? Todyl SASE vs a traditional VPN
| Question | Traditional remote access VPN | Todyl SASE |
|---|---|---|
| What the user connects to | A VPN gateway on the office firewall | A point of presence on the Todyl Secure Global Network |
| What the user can reach | Usually the whole office network once connected | Only the resources conditional access rules allow |
| Internet traffic | Often sent back to the office to be filtered, or not filtered at all | Filtered by the secure web gateway, secure DNS and NGFW in the SGN |
| Devices on the same LAN | Can usually talk to each other | Blocked by default with LAN Zero Trust |
| Hardware | Firewall or VPN appliance at the office | None for the core service; Todyl says it is entirely cloud-based |
| Fixed public IP | The office line's IP | Optional static IPs from the SGN |
People search for Todyl VPN because the agent does build an encrypted tunnel, and Todyl itself positions SASE as the end of "traditional VPN operating issues". The difference is what happens after the tunnel: access is decided per resource by policy, and internet traffic is inspected on the way out. SASE vs VPN sets out the wider comparison.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Todyl SASE packages and licensing
Todyl publishes three packages on its pricing request page (opens in a new tab) that combine SASE with its other modules (endpoint security, SIEM, MXDR and compliance). The SASE-related differences are:
| Package | SASE-related contents Todyl lists | Todyl describes it as suiting |
|---|---|---|
| Essentials | SASE mobile devices at a 1:1 ratio | Single location operations; basic compliance and cyber insurance needs |
| Advanced | Adds SSL inspection, two static IPs and LAN Zero Trust segmentation; SASE mobile devices at 1:2 | Businesses with one or two locations; enhanced compliance |
| Complete | Adds unlimited IPsec tunnel connections and multi-engine download scanning; SASE mobile devices at 1:4 | Multi-location businesses and highly regulated industries |
Todyl says SASE is "offered as-a-service with no annual contracts", so it can be turned up or down as your device count changes, with no upfront capital cost. We can quote a package or the SASE module on its own; pricing depends on device numbers and options, so ask us for a quote. Todyl SASE can be billed monthly, terms confirmed at quote, and the licensing detail is on Todyl SASE licensing (opens in a new tab).
Todyl SASE compared with other SASE platforms
| If you need | Todyl SASE | Consider also |
|---|---|---|
| One agent for SASE and endpoint security | Yes, the SASE agent is shared with Todyl's other modules | Exium SASE, which also uses one endpoint agent for SASE and XDR |
| Branch SD-WAN appliances with path selection | Offices join through IPsec tunnels | Cisco SASE, Check Point SASE or Barracuda SecureEdge |
| A static IP for SaaS allowlisting | Optional static IPs (two included on Advanced) | Timus SASE, where every gateway has a static IP |
| Blocking device-to-device traffic on the LAN | LAN Zero Trust | Zero Networks Connect (opens in a new tab), covered on ztna.org.uk |
| Browser-based access for unmanaged devices | Agent-based | Check Point SASE Enterprise Browser or agentless access on Exium SASE Pro |
Todyl suits small and mid-sized organisations that want web security, a cloud firewall and VPN replacement on one agent, and that would like a provider to run it. Organisations with many branch sites that need SD-WAN appliances usually look at a platform with SD-WAN in the same product. The full list is on SASE vendors, and the platform overview is on cloud-security.cloud's Todyl (opens in a new tab) page.
Is Todyl SASE the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How Forever Systems helps with Todyl SASE
Todyl describes itself as channel-only, so it is bought and run through an IT provider. We can help you:
- Assess: list the private applications, file shares and RDP hosts people reach today, how internet traffic is filtered, and any systems that allowlist your office IP.
- Choose the package: decide whether the SASE module alone fits or a package with endpoint security and SIEM makes more sense, and whether you need static IPs, LAN Zero Trust or IPsec tunnels.
- Pilot: deploy the agent to a small group through your device management or RMM tooling, build conditional access and web filtering policy, and decide which categories to exempt from SSL inspection.
- Roll out: extend to all devices, join offices and cloud networks with IPsec tunnels and move allowlists to the static IP.
- Retire the old route: close the VPN and its open ports so nothing bypasses the new policy.
Scope and timescales are confirmed at quote. Contact us to talk about Todyl SASE for your organisation.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What is Todyl SASE?
Todyl SASE is the secure access service edge module of the Todyl security platform. An agent on each device tunnels to Todyl's Secure Global Network, where zero trust network access, a secure web gateway, secure DNS and a next-generation firewall with SSL inspection are applied.
What is the Todyl SGN?
SGN stands for Secure Global Network: Todyl's network of cloud points of presence. Devices running the Todyl SASE agent connect to it over a secure tunnel, and Todyl applies your access, filtering and firewall policy there, with automatic failover between points of presence.
Is Todyl a VPN?
Todyl's agent builds an encrypted tunnel, so it can replace a remote access VPN, but it is not a traditional VPN. Conditional access rules decide which resources each user can reach, and internet traffic is inspected by the web gateway, DNS security and firewall in the Secure Global Network.
Does Todyl SASE need hardware?
No. Todyl states that the core functionality of SASE is entirely cloud-based. Offices and cloud networks can connect to the Secure Global Network with IPsec tunnels, and Todyl lists unlimited IPsec tunnel connections in its Complete package.
Does Todyl SASE need an annual contract?
Todyl says SASE is offered as a service with no annual contracts, so it can be scaled up or down. We confirm the terms for your organisation when we quote.
Can we buy Todyl SASE directly from Todyl?
Todyl describes itself as channel-only, selling through IT providers. Forever Systems can supply and deploy Todyl SASE for you, and subscriptions can be billed monthly, terms confirmed at quote.
Still have a question about Todyl SASE?
Ask us and a member of our team will get back to you.
More SASE guides
Timus SASETimus SASE explained: adaptive ZTNA with posture checks, static IP gateways and a cloud firewall in one agent.
Exium SASEExium SASE, now part of NETGEAR: what SASE Essentials, SASE Pro and the Cyber Gateway include.SASE for small businessWeb security, zero trust access and cloud firewall for small teams, without branch hardware.SASE vs VPNSASE vs VPN for business: how SASE replaces remote access VPN backhaul with per-app access and cloud security.Managed SASEManaged SASE for business: co-managed or fully managed, the management tasks involved and where MDR fits.