Compare providers.
Build your shortlist.

Self-Managed, Pro-Managed

Dated contractual description. Confirm applicable order and current platform. Pro-Managed excludes SOC services; customer monitors security events.

Fortinet, VMware, Versa

Named in the dated guide; not confirmation that every variant remains orderable in every location.

UK listed in Zone 1 for specified services

Affiliate or third-party delivery permitted. Does not identify the UK contracting entity or prove availability at a buyer address.

SD-WAN, SSE, NGFW, ZTNA, SD-LAN

Platform components listed by Versa; licence and deployed configuration still required.

Platform enables MSP-delivered managed services

Multi-tenant platform capability does not make Versa the contracted operator of every deployment.

cloud, on-premises, hybrid, air-gapped

Confirm which security components are available in the selected deployment.

Netskope One SSE, Netskope One SD-WAN

An SSE subscription alone is not evidence of an installed SD-WAN service.

dynamic path selection, link remediation, TCP/UDP optimisation, VRF segmentation

Converged Gateway scope. Exact packet-loss mechanism, software version and entitlement need technical documentation before a blanket grade change.

Gateway DEM includes hop-by-hop and application performance monitoring

Confirm package and licence; not proof of a managed NOC or security response service.

Prisma SD-WAN is the branch networking component of Prisma SASE

Keep Prisma ION and PAN-OS SD-WAN product records separate.

Native onboarding supports Cloud Managed and Panorama Managed Prisma Access

A branch site, assigned ION and WAN circuit are required. Existing CloudBlade deployments need deactivation and support involvement before this workflow.

Panorama Cloud Services plugin minimum 5.2.0-h24

Applies to the documented Panorama workflow, not every Prisma deployment.

Cato or a qualified partner performs networking and security policy changes.

Cato monitors last-mile ISPs 24/7 and works with the ISP on outages or degradation.

Analysts investigate threats and guide remediation.

Remote or on-site support for site activation and configuration.

Customer-requested configuration changes; third-party devices excluded.

Select the management service and scope in the order.

Catalyst SD-WAN, Meraki, Firepower Threat Defense

Product families have different networking and security architectures; do not pool their features into a single unqualified Cisco row.

Cisco Cloud Control integrates Catalyst SD-WAN and Secure Access management

The documented management integration does not prove identical feature parity or licence coverage across Meraki and Catalyst.

Current SASE page describes networking, ZTNA and threat prevention

Do not use older Perimeter 81 remote-access material alone as evidence of current SD-WAN scope.

Check Point SD-WAN software blade integrates with Check Point SASE

SD-WAN is a subscription licensed per firewall. The retrieved document has changed from the older Harmony/Quantum wording in the search index. Validate the selected firewall model and subscription.

Zscaler, Microsoft Entra SSE

Certified external SSE integrations are distinct from the single-vendor Check Point SASE configuration.

Cisco, Palo Alto Networks

These are explicit current page options, not a complete historical AT&T partner list.

fully managed

Feature entitlement and underlay responsibility depend on the selected bundle and order.

FortiSASE SSE, FortiGate Secure SD-WAN

FortiSASE, FortiSASE Sovereign and FortiGate are distinct deployable components, not interchangeable subscriptions.

Secure SD-WAN is integrated in FortiGate NGFWs

Do not infer a carrier-managed circuit or operational service from Fortinet platform support.

Juniper Secure Edge, Palo Alto Prisma Access, Zscaler, Custom

Provisioning mode differs. Do not present every connector as an equivalent native security platform.

BGP over IPsec is supported for Prisma Access automatic provisioning and Custom, not JSE or Zscaler

Limitation applies to the documented Secure Edge Connector workflow.

SSR and SRX are distinct supported WAN platforms

Do not copy SSR-specific forwarding or SRX-specific firewall capabilities between products.

self-managed to fully managed

The catalogue permits selection of provider, service and operating model; confirm the specific SASE service and change rights.

Composable services using selected technology providers

A platform catalogue does not establish native ownership or equal feature support across all partner services.

Forcepoint ONE SSE, FlexEdge Secure SD-WAN

Specific product and security licence must be identified; Data Security Cloud alone does not prove branch SD-WAN.

Managed services can be delivered by MSSP partners

Historical programme evidence. Does not establish a named current UK MSSP or a direct Forcepoint operational service.

Managed edge device combines SD-WAN, SASE and local compute

Choose the actual configuration; the device does not prove every security function is enabled.

Zero Trust Branch includes Zero Trust SD-WAN, OT/IoT segmentation and privileged remote access offerings

Separate capabilities and packages; do not reduce Zscaler to an SSE-only record or assume all branch functions come with ZIA.

Branch connectivity uses Zero Trust Exchange application access rather than a traditional unrestricted routed overlay

Avoid assigning classic encrypted overlay semantics purely from the SD-WAN product name.

fully managed, co-managed, self-managed

Vendor page explicitly lists the choices; obtain the responsibility split and commercial package.

ISP procurement, contract management, link monitoring

Listed service capabilities, not proof they are included at every site or in every contract.

NGFW, SWG, CASB, ZTNA

Page also lists managed third-party firewall services; keep native and third-party functions separate.

self-service, co-managed, fully managed

Self-service portal access alone is not the full DIY operating model in the comparison definition.

Versa SD-WAN plus Versa SASE, Versa SD-WAN plus Zscaler SSE

Store two service variants. Zscaler functions are partner-delivered, not native Versa functions.

shared, dedicated

Capacity, platform and redundancy differ. Do not apply shared-gateway parameters to all deployments.

SWG and private-application access integration through HPE SSE

SSE not supported in air-gapped environments. EdgeConnect SD-WAN and SD-Branch are distinct product families.

Installing SSE Connector disables WAN Optimization on EdgeConnect appliances with fewer than 16 cores

Connector is not supported on EC-US or older EC-XS models. Check exact appliance and certified software version.

Default 100 tunnels per HPE SSE tenant; increases require support

A documented default, not an immutable maximum across all contracts.

Vodafone Business publishes SD-WAN and SASE services

Page body is only partially exposed to the text fetch. No detailed capability changes based on that fetch.

Fortinet global specialisations in SASE and SD-WAN; EMEA Secure Networking specialisation

Partner certification is not proof of product orderability, a particular customer deployment or service SLA.

Palo Alto Networks Prisma SASE

An evidenced service option; not an exhaustive list of NTT technology partners.

Named NTT DATA customer reference for managed SD-WAN store connectivity

South African retail example, not evidence of UK delivery or of all Prisma security capabilities.

Named reference for software-defined infrastructure

Do not relabel as a completed full SASE deployment without the detailed case evidence.

Verizon and Versa offer a fully managed SD-WAN/security platform

Versa-specific service evidence; do not transfer all capabilities to every Verizon partner variant.

SASE Management connects SD-WAN and cloud-security management

Dated contractual guide; confirm current applicable service terms and selected cloud-security instance.

Clientless ZTNA for third parties and BYOD users was announced 22 April 2025

Browser-based access does not establish native clients for every OS.

Clientless ZTNA integrates with NetCloud Manager alongside WWAN, SD-WAN and other SASE features

Confirm router, service plan and entitled application protocols.

Versa Cloud IP platform for fully managed SD-WAN

Archived launch evidence, not confirmation that every present offer uses that platform.

name: Virgin Media Business Limited; company number: 01785381; registered office: 500 Brook Drive, Reading, RG2 6UU

Corporate identity is confirmed. Match to the specific service order before assigning it as the buyer's contractual counterparty.

Published SDWAN Special Terms Service Schedule v5.0

Read the schedule and applicable order before changing service SLA or technical claims.

Cloudflare WAN, formerly Magic WAN

Keep the former name as an alias; do not change existing Netify URLs.

Cloudflare WAN is Enterprise-only

Cloudflare One Appliance requires purchase of Cloudflare WAN; free Zero Trust access does not include this WAN service.

Cloudflare One Appliance hardware, Cloudflare One Appliance virtual, manual tunnels

Customer/MSSP operation and connectivity procurement remain separate responsibilities.

fully managed, co-managed

Responsibility split and entitlement depend on the order.

Fortinet

Applies to this documented SASE offer, not every historical Masergy/Comcast platform.

Comcast-provided or customer-provided underlay

Network service reach is distinct from Comcast's owned US access footprint and UK orderability.

end of sale: 2025-07-01; end of support: 2026-06-30; current for new sales: False

Dates apply to the named Symantec-secured SKUs, not to all VeloCloud SD-WAN products.

VeloCloud SD-WAN integrates with third-party SSE providers

A partner integration is not an always-included native SSE stack.

Cisco, Cato Networks, Arista Networks, Ericsson Enterprise Wireless Solutions

Different partner roles. Arista campus networking and Ericsson WWAN listings do not establish a specific VeloCloud or SASE service SKU.

Managed SD-WAN with end-to-end services

Confirm selected platform, last-mile scope and customer policy rights. No blanket DIY claim.

encryption and routing, bandwidth control, path selection, application optimisation

Page-level function evidence, not proof of every packet-loss remediation mechanism or licence.

Network/security operation described as automation with Level-3 engineers

Do not infer a customer DIY tier or exact contractual response SLA.

Internet or MPLS across providers

Transport compatibility is not proof Open Systems owns the underlying circuits or a private global backbone.

Last Mile Optimization uses Forward Error Correction

FEC is enabled on Override Categories when Last Mile Optimization is enabled. Do not confuse it with circuit management.

performance-based transport selection, adaptive/static session balancing, failover, multi-provider load balancing

Policy and fallback-link configuration determine actual traffic handling.

SaaS, Azure Virtual WAN, or customer/partner-hosted virtual/hardware deployment

Hosting/management of infrastructure is distinct from a fully managed end-to-end customer network service.

Security Service Edge (SSE)

CSE alone does not establish a branch SD-WAN service or full network-and-security managed service.

ZTNA, VPNaaS, CASB, SWG

Check current SPA/SIA editions and licence before assigning capability grades.

Access Tier or Connector required for private resources

Deployment must be located in an appropriate customer data-centre or cloud environment.