13 packages from 8 providers
Managed SASE vendors and providers compared
By Harry Yelland, 13/10
Evidence checked 11 October 2026. Reviewer: Robert Sturt, review pending.
Find a package for your requirements
Here is a side-by-side view of the packages that fit your requirements. Each row comes with the evidence behind it.
When choosing a managed SASE service, it can be difficult to tell whether you’re comparing a technology vendor, a managed provider or an actual contracted package, as the same names turn up at all three levels. At Netify, we’ve compared eight providers (BT, NTT DATA, GTT, Verizon, Lumen, Comcast Business with Masergy, Globalgig and Aryaka) across thirteen defined packages, and we’ve kept the platform separate from the provider throughout. In our view the best fit depends on four things, those being the underlying platform, who administers policy day to day, where traffic and logs are handled, and which contract scope you’re actually buying. Only BT publishes UK-specific service wording, so every other package needs written UK confirmation, and anything we couldn’t verify is marked Unknown.
Author: Harry Yelland, Cybersecurity Writer. Reviewer: Robert Sturt.
Corrections: support@netify.com.
Netify may earn a commission on marketplace introductions and we’re also a BT Authorised Partner – however we do not allow partnerships or sponsored promotion or inflation of provider overviews.
Buyer option buttons
- Run it for us
- Keep control of our policy
- Keep our current platform
- Connect our UK sites
- Connect sites worldwide
- Keep our data in the UK
- Protect staff use of AI tools
- Compare packages side by side
- Review our current provider
Why compare managed SASE packages rather than providers?
One of the most common queries we get is, if a provider sells SASE, why can’t we just compare the providers? The difficulty is that one company can sell several packages on different platforms with very different responsibilities (BT being a good example of this with four platforms), each offering different package coverage. Vendors versus providers also increases the difficulty in comparison, with the platform vendor (Palo Alto Networks, Fortinet, Zscaler, Netskope, Versa and the likes) owning the product itself and deciding what it supports, whereas the provider contracts, operates and supports a defined package built on that platform, and the package is what carries the inclusions, the paid extras and the service levels – and then to further complicate matters, sometimes one company fills both roles, such as the likes of Aryaka, meaning that these are not directly comparable.
Evidence labels
- Schedule-stated – taken from a contract document such as a service schedule, SLA or PSA
- Provider-reported – taken from the provider’s own page, datasheet or press release
- Vendor-reported – taken from the platform vendor’s own page, including analyst placements
- Unknown – not found in the sources we read, which isn’t the same as absent from the service
What do we recommend you confirm before you shortlist?
When shortlisting Managed SASE providers, we’d always recommend checking the following details:
- Whether the exact package is orderable in the UK, and which UK entity contracts for it
- Where traffic is inspected, and where logs and configuration backups are stored
- A responsibility matrix for each management tier, including change approvals and rollback
- The SLA document, with response, restoration and resolution times, credits and the claim deadline
- Whether a SOC or only a NOC supports the package, and whether MDR is included or a separate contract
- Who holds the platform licences, and which features are paid extras
- The pricing basis, term length and early termination terms
How do the managed SASE packages compare?
We’ve compared the managed SASE packages on offer from within the UK market (and beyond), noting the underlying vendor platforms and management models for each platform.
Package | Underlying platform | Management model | UK availability | Last verified |
|---|---|---|---|---|
BT Prisma Access (schedule) | Palo Alto Prisma Access | Co-managed. Customer administers under Foundation, BT implements capped change requests under Plus and Premium | Not confirmed for this package. BT’s UK overview (page) is the only UK-specific source | 2026-10-09 |
BT Netskope (schedule) | Netskope | Co-managed, same tier model | Not confirmed for this package | 2026-10-09 |
BT Zscaler (schedule) | Zscaler (ZIA, ZPA, ZDX, ZCC) | Co-managed, same tier model | Not confirmed for this package | 2026-10-09 |
BT FortiSASE (schedule) | Fortinet FortiSASE | Fully managed as standard. Optional co-management | UK targeted per the November 2024 announcement (announcement) | 2026-10-09 |
NTT DATA Prisma SASE (case study) | Palo Alto Prisma SASE | Fully managed. No co-managed model found (data sheet) | Unknown. NTT DATA’s UK site hosts a case study for a Belgian customer | 2026-10-09 |
GTT Prisma SASE (page) | Palo Alto Prisma SASE (added July 2025) | Fully managed tiers plus a platform-as-a-service tier. Co-management options exist | Unknown | 2026-10-09 |
GTT Fortinet (release) | Fortinet (announced January 2024) | Fully managed tiers as above | Unknown | 2026-10-09 |
Verizon SASE Management (page) | Versa, Cisco cEdge and vEdge, Zscaler, Palo Alto Prisma Access | Verizon holds sole administrative control and the customer has read-only access (service guide) | Unknown. About 30 sales-contact countries are listed including the UK, which isn’t proof of orderability | 2026-10-11 |
Lumen Fortinet, pro-managed (schedule) | Fortinet | Pro-managed or self-managed. No co-managed model | Unknown. EMEA premise-based deployment is for US-sold customers (FAQ) | 2026-10-09 |
Lumen Versa, pro-managed (page) | Versa | Pro-managed or self-managed | Unknown, as above | 2026-10-09 |
Comcast Business with Masergy SASE (terms) | Not named in the contract | Managed, with the customer holding the security policy. Comcast doesn’t monitor security events under this PSA | Unknown. A UK MSA is listed but UK orderability of SASE isn’t confirmed | 2026-10-09 |
Globalgig Managed SSE (press release) | Palo Alto Prisma Access | Tiered. Fundamental, Plus and Premier | Unknown. The company states a UK office | 2026-10-09 |
Aryaka Unified SASE as a Service (release) | Aryaka’s own platform | Fully managed through SmartManage. Other models not confirmed | Unknown. 37 PoPs including London are listed (global page) | 2026-10-11 |
Package | Service scope | Strongest evidenced use case | Material limitation |
|---|---|---|---|
BT Prisma Access | SSE modules only. SD-WAN isn’t in the schedule | UK buyer that wants SSE without SD-WAN and keeps ownership of policy | P1 restoration is a 4 hour target and BT accepts no liability for missing it. No availability percentage in Part B |
BT Netskope | SSE only. Edge and Edge Private Access packages, with DLP sold as a separate module | Netskope-standardised buyer that wants a UK carrier wrapped around it | No service levels or credits in Part A. Portal data is kept for 7 days by default |
BT Zscaler | SSE only. Foundation, Plus and Premium | Existing Zscaler estate that needs the BT service desk and escalation | No BT service levels. ZIA is applied at cloud data centres worldwide with no country commitment |
BT FortiSASE | SSE (secure internet and private access, CASB, endpoint). SD-WAN, DLP and FWaaS aren’t in the schedule | UK buyer with Fortinet SD-WAN that wants BT to run the SSE side | Only on-time delivery has a service level. Availability is a target and Part B says best effort |
NTT DATA Prisma SASE | Managed SD-WAN and cloud security with ITIL change control and SOC-backed threat detection | Multi-site estate that wants one operator for network and security | No SASE SLA found. The SOC serving this package isn’t named |
GTT Prisma SASE | CASB, SWG, ZTNA, FWaaS and managed SD-WAN. MDR and DDoS are paid add-ons | Global buyer that wants network and security from one carrier | No SLA figures published and SOC or NOC locations aren’t given |
GTT Fortinet | As above, with an optional Fortinet-only dedicated private cloud | Fortinet-aligned buyer on GTT’s backbone | The current page doesn’t separate this variant from the Prisma one, and the evidence is dated |
Verizon SASE Management | Change and incident management for third-party SSE. Verizon-managed SD-WAN where connected | Buyer with an existing Versa, Cisco, Zscaler or Palo Alto platform that wants Verizon to run it | SLA covers change requests only, with no availability commitment. Licences are separate |
Lumen Fortinet, pro-managed | Overlay only. Connectivity isn’t included. SWG and ZTNA are paid add-ons | US-led estate that wants an overlay on its own circuits | Hosted gateways are in six US regions only. UK eligibility isn’t stated |
Lumen Versa, pro-managed | Overlay with SD-WAN and NGFW licences and one X-Small CPE. ZTNA is an add-on | US-led buyer that wants a published per-location price | USD 299 per location per month applies to one eligible continental US location |
Comcast Business with Masergy SASE | Built-in L4 firewall, NGFW and SWG. CASB and ZTNA are paid add-ons. SOC services are separate | Buyer that wants contractual availability figures for the overlay | Availability figures differ between three PSA copies and the current one is US-only. Security monitoring needs a separate contract |
Globalgig Managed SSE | SWG, CASB and ZTNA on Prisma Access. 24/7/365 SOC is stated for Premier | Mid-size buyer that wants a tiered SSE service | No SD-WAN or SLA evidence. Contracting entity isn’t stated |
Aryaka Unified SASE as a Service | SD-WAN, NGFW-SWG and private backbone. CASB and ZTNA are separate services | Multi-site buyer that wants one vendor and one operator | 99.999% figures are targets. AI>Secure needs Aryaka SD-WAN and its general availability is unconfirmed |
BT also publishes a UK Managed SASE overview page (page) that names no platform, tier or SLA figure, so we haven’t treated it as a package. It’s the source for BT’s UK-resident logging claim, which none of the three BT schedules we read repeats.
Which platform vendor sits behind each package?
These are the platform vendors behind the packages above, plus vendors we reviewed that don’t have a named UK managed package in this comparison. The capabilities come from each vendor’s own page, so they are vendor-reported, and a vendor’s name appearing against a provider doesn’t mean every feature is included in that provider’s package.
Vendor and platform | Where it appears | What the vendor page shows | Evidence note |
|---|---|---|---|
Palo Alto Networks Prisma SASE (page) | BT, NTT DATA, GTT, Globalgig, Verizon (supported list) | Prisma Access, Prisma SD-WAN, Prisma Browser and ADEM | Edition isn’t stated. Placement claimed in the 2026 Gartner report (vendor) |
Fortinet Unified SASE (page) | BT FortiSASE, GTT, Lumen | FortiSASE with FortiGate Secure SD-WAN | Edition and licence aren’t stated. Trade press reports a Challengers placement in 2026 (SDxCentral) |
Zscaler Zero Trust SASE (page) | BT, Verizon | ZIA, ZPA, ZDX and Zero Trust Branch | 160+ PoPs claimed. Packaging isn’t stated (vendor) |
Netskope One SASE (page) | BT | SD-WAN gateway and SSE | NewEdge 75+ regions claimed. No SKUs on the page |
Versa Networks | Lumen, Verizon | Product page not read | Not assessed beyond provider pages |
Cisco Secure Access (page) | Verizon (cEdge and vEdge) | SSE with Meraki SD-WAN integration | Catalyst SD-WAN isn’t named on the page we read |
Cato SASE Cloud (page) | None as a named UK package | Single-pass cloud platform. Managed delivery is through MSASE partners (page) | Wavenet sells it as a managed UK service (page) with no service description or SLA found |
HPE Aruba Networking (page) | None | EdgeConnect SD-WAN and SSE | Licensing isn’t stated |
VeloCloud by Arista (FAQ) | None | SD-WAN and SASE | Product names are unchanged, with Arista SKUs from 1 January 2026. Our sources conflict on details |
Cloudflare One (page) | None | Platform page summary only | 300+ and 335+ cities appear on the same page, so the figure is unreliable |
Check Point Harmony SASE (page) | None | Platform page summary only | 80+ data centres claimed. Edition isn’t stated |
Where would we start for your buyer requirement?
There is no single package that suits every buyer on this page, so the table below shows where we’d begin shortlisting for each requirement. It isn’t a ranking and it rests only on the evidence recorded on 9 and 11 October 2026.
Buyer requirement | Where we’d start | Why | What to confirm in writing |
|---|---|---|---|
UK-led estate | BT, then NTT DATA and GTT for a UK quote | BT is the only provider with a UK-specific page and a UK-targeted package (announcement) | Which BT schedule is sold as Managed SASE, the Part A service levels and the contracting entity |
Global multi-site | Aryaka, GTT and NTT DATA | Aryaka lists 37 PoPs (page) and GTT states a backbone across 260+ cities (release). Both are provider-reported | PoP and country list, regional service levels and where traffic is inspected |
Existing platform investment | BT, Verizon, GTT and Lumen | Between them they run Palo Alto, Zscaler, Netskope, Fortinet, Versa and Cisco, and Verizon lists the widest set (page) | Who owns the licences. BT FortiSASE licences must be bought through BT (schedule) |
Co-management | BT (Plus or Premium) and BT FortiSASE | BT allows RBAC co-management for up to 5 users, limited to implementing change requests (schedule). GTT says co-management options exist (page) | A responsibility matrix per tier. Lumen has no co-managed model and we found none for NTT DATA |
Limited internal skills | NTT DATA, GTT’s fully managed tiers, BT FortiSASE and Aryaka | These are described as fully managed. Under BT’s Foundation tier the customer administers the service | Who owns policy changes and approvals. Under Comcast’s SASE contract the customer keeps the security policy |
Demanding WAN performance | Aryaka and GTT first, then Comcast Business with Masergy | Aryaka and GTT own a private backbone, and Masergy publishes site availability figures by region | Measured latency and loss for your own sites, as we found no verified latency figure and ran no performance tests |
Regulated data | No package stands out yet | BT’s overview page claims UK-resident logging (page) but none of the BT schedules repeats it. BT Zscaler lets the customer pick the log location on the order | Written statements on where traffic is inspected, where logs are stored and for how long |
What requirements should you give every provider?
Send the same written requirements to each shortlisted provider so the quotes can be compared. Each item below connects to a decision, and each is something we found missing, conflicting or package-specific in the evidence on this page.
Requirement | The decision it drives |
|---|---|
Platform you already own (Palo Alto, Fortinet, Zscaler, Netskope, Versa, Cisco) and who holds the licences | Which providers can run it, and whether you need to buy licences through the provider |
Number of sites, remote users and countries, with UK sites listed separately | Which packages can be sold to you and whether a per-location or per-user price applies |
Whether SD-WAN is in scope or SSE only | Whether BT’s Prisma, Netskope or Zscaler schedules are enough, given that they exclude SD-WAN |
Who owns policy design, changes, approvals and rollback, and how many change requests are included | Fully managed, co-managed or customer-administered, and the cost of changes above the allowance |
Co-management permissions, including how many named users and what they can change | Whether BT’s Plus or Premium tier, or another provider, gives you the control you want |
Where traffic is inspected, where logs are stored and for how long | Whether any package meets your data-location rules, supported by a written statement for the exact package |
Whether 24/7 monitoring is a SOC or only a NOC, and whether MDR is included | Whether you need a separate MDR contract alongside the SASE package |
Whether the SLA is a target or a guarantee, with response, restoration and resolution times, credits and the claim deadline | Whether a service level actually gives you a remedy |
Whether connectivity is included | Whether you need a separate circuit, since Lumen’s service is an overlay only |
AI requirements, split between provider AI used for detection and operations and controls for staff use of GenAI tools | Whether Aryaka’s AI>Secure add-on, or another provider’s roadmap, is relevant to you |
Contracting UK entity, term, early termination terms and price basis | Whether the contract can be signed in the UK and what leaving early costs |
A named reference of similar size and sector, with the platform and the provider’s role stated | Whether the provider has run a comparable estate, as we found no UK SASE case |
Provider profiles
Each package gets the same six headings. Where the evidence is thin the profile is shorter and says so, and the labels we use are provider-reported, schedule-stated (from a contract document) and Unknown.
BT Managed Cloud Security with Palo Alto Prisma Access
Who supplies and operates the service.
BT sells Palo Alto’s Prisma Access platform, with Palo Alto running the platform whilst BT looks after the service desk, security operations escalation and commissioning.
Capabilities and inclusions.
This is SSE only, so there’s no SD-WAN, though you can order it on its own. Internet Security comes in Basic, Premium Advanced and Enterprise Advanced modules, with ZTNA for mobile users only and DLP as an optional extra. SWG and full CASB aren’t listed, so we’d confirm both before shortlisting.
Configuration and daily use. Foundation leaves you administering the service, whilst Plus and Premium add BT-implemented requests (8 or 10 per module per month). Up to 5 of your people can co-manage, but only to implement those requests. In our view Foundation suits teams with Prisma Access skills, and Plus or Premium suits everyone else.
AI capabilities that matter to the buyer. The AI status is Unknown, as BT lists no AI features for this package, so we wouldn’t plan around any.
Coverage, support and contract commitments. A P1 incident has a 4 hour restoration target, but it’s a target only and BT accepts no liability for missing it. Credits come from Palo Alto instead, whose 99.999% SLA has to be claimed within five business days. We believe that’s the key point, as the promise is Palo Alto’s and not BT’s.
Customer evidence, fit and limitations. There’s no published BT case study to point to. We’d recommend this for a UK buyer with Prisma Access skills who wants BT for escalation and capped changes, but we’d look elsewhere if you need BT’s own availability guarantee. Either way, we’d ask BT where traffic is inspected before you shortlist it.
BT Managed Cloud Security with Netskope
Who supplies and operates the service. BT sells Netskope as a managed service, with BT’s Global Security Operations Centre handling incidents. BT doesn’t state which BT company you’d contract with, so we’d put that to them first.
Capabilities and inclusions. This is SSE only, with the Edge and Edge Private Access packages both including a next-generation SWG and cloud firewall. DLP is a separate module and CASB isn’t mentioned, so we wouldn’t assume it’s included.
Configuration and daily use. Foundation leaves you administering the service, whilst Plus and Premium add BT reviewing performance and policy. Up to 5 of your people can co-manage service requests and nothing more, so for instance you couldn’t change a web policy yourself. We think that suits a buyer who’s happy to hand policy over.
AI capabilities that matter to the buyer. The AI status is Unknown, as BT lists no AI features for this package.
Coverage, support and contract commitments. BT’s P1 restoration target is 4 hours, but the managed service carries no service levels and no credits, and portal data is kept for 7 days by default. In our view that’s the biggest weakness of this package. On the plus side, your tenancy can link to a management plane in London.
Customer evidence, fit and limitations. There’s no published BT case study for Netskope. We’d recommend it for a buyer who’s already standardised on Netskope and wants a UK carrier around it, provided the lack of an availability guarantee is acceptable. If it isn’t, our suggestion would be BT Zscaler, which is stronger on data location.
BT Managed Cloud Security with Zscaler
Who supplies and operates the service. BT sells Zscaler as a managed service, with Zscaler running the cloud platform and BT providing the service desk and escalation. BT doesn’t state which BT company contracts with you, so we’d ask for that up front.
Capabilities and inclusions. The package covers ZIA internet protection, ZPA private access, ZDX and the Client Connector, with no SD-WAN. Inspection happens at Zscaler data centres worldwide with no country commitment, so if you need UK-only inspection we think this one rules itself out.
Configuration and daily use. Reporting is self-service on Foundation, quarterly on Plus and monthly on Premium, with up to 5 of your people able to co-manage. As a rule of thumb, we’d recommend Premium if you want regular reporting without chasing for it.
AI capabilities that matter to the buyer. The AI status is Unknown, as BT lists no AI features for this package.
Coverage, support and contract commitments. BT’s P1 restoration target is 4 hours, as a target only, and the managed service carries no service levels and no credits. You claim from Zscaler instead, whose SLA commits to 99.999% with credits of up to 30 days, provided you report within 24 hours. You can also choose where logs are stored on the order, which is the strongest data location commitment on any BT package and one we’d lean on in a UK procurement.
Customer evidence, fit and limitations. There’s no published BT case study for Zscaler. Our recommendation is to shortlist this if Zscaler is already your platform or log location is a priority, as no other BT package lets you choose it.
BT FortiSASE managed service
Who supplies and operates the service. BT sells FortiSASE as a managed service, the newest of its four security packages, and has described it as a managed SD-WAN plus Fortinet SSE service for UK business and public sector. We’d get the SD-WAN position confirmed directly, as that description is a news report and not a contract.
Capabilities and inclusions. The SSE side covers secure internet access, private access built on ZTNA principles, CASB and endpoint protection. SWG, FWaaS, DLP and SD-WAN aren’t listed, so we’d ask BT about all four, and you have to buy your licences through BT.
Configuration and daily use. Five service requests a year are included, which in our view is light if you change policy regularly. Optional co-management through the FortiSASE Portal lets you run certain commands, though you’re responsible for your own changes.
AI capabilities that matter to the buyer. The AI status is Unknown, as BT lists no AI features for this package.
Coverage, support and contract commitments. This is the odd one out, as only on-time delivery has a service level (a 4% monthly credit per business day late) whilst availability and incident resolution are targets and BT calls the service best effort. PoPs are agreed per customer and no log location is stated.
Customer evidence, fit and limitations. There’s no published BT case study for FortiSASE. We’d suggest it for a UK buyer who wants BT to run the SSE side fully and is happy with best-effort service levels, which is the trade-off against the other three BT packages.
NTT DATA Managed Networks with Prisma SASE
Who supplies and operates the service. NTT DATA sells managed networks with Palo Alto Prisma SASE, with Palo Alto supplying both the SD-WAN and the SSE. NTT doesn’t name a UK contracting company or the edition, which we’d want answered before going further.
Capabilities and inclusions. Palo Alto’s platform includes remote browser isolation, next-generation CASB and ML-enhanced DLP, but NTT DATA doesn’t say which of these its licence includes. In our view that matters, as it’s the difference between a full SASE stack and a basic one.
Configuration and daily use. NTT manages your policy and runs change management to ITIL practice and sells fully managed delivery only. We’d steer anyone who wants to make their own changes towards BT instead.
AI capabilities that matter to the buyer. The AI status is Unknown, as NTT DATA documents no AI feature for this package.
Coverage, support and contract commitments. NTT DATA runs 49 SOC facilities worldwide, but that’s a company-wide figure and doesn’t tell you which one serves you. There’s no SLA for the SASE service, so you’re left with Palo Alto’s own commitments, and logs sit in the Cortex Data Lake with no location named.
Customer evidence, fit and limitations. Liantis in Belgium is the one named case, with more than 50 locations that NTT designed, deployed and now operates. We’d recommend NTT DATA for a multi-site buyer who wants one operator and is happy to rely on Palo Alto, and we’d ask for a SASE-specific SLA before signing.
GTT Secure Connect with Palo Alto Prisma SASE
Who supplies and operates the service. GTT sells Secure Connect as a fully managed SASE service and added Prisma SASE in July 2025. Its current page doesn’t name Prisma or Fortinet, so we’d confirm which variant you’d be sold, and GTT doesn’t name a UK contracting company.
Capabilities and inclusions. GTT consolidates management of SD-WAN, SWG, CASB, ZTNA, FWaaS and DLP, which isn’t the same as each one being in the base price. MDR and DDoS prevention are separate services, so for instance, if MDR is on your list you’d be buying it as a second contract.
Configuration and daily use. GTT offers three tiers, those being Enterprise (Fully Managed Plus), Premium (Fully Managed) and Standard (Platform as a Service). You can keep co-management rights over specific functions, though GTT doesn’t say which ones, and we’d always get that in writing as it decides who’s accountable when a change goes wrong.
AI capabilities that matter to the buyer. AI-enabled network security is a stated GTT priority for 2026, but that’s roadmap and not something you can buy today.
Coverage, support and contract commitments. GTT states 24/7/365 NOC and SOC support with CREST-certified analysts but gives no locations and no SLA figures, so there’s no availability or response commitment to compare.
Customer evidence, fit and limitations. GTT names HR Path, Radisson Hotel Group, JYSK and Loxam as customers without saying they use SASE, so none counts as a case. We’d suggest GTT for a global buyer who wants carrier and security under one contract, and we’d ask for the SLA and SOC locations first.
GTT Secure Connect with Fortinet
Who supplies and operates the service. GTT announced a Fortinet-based SASE portfolio in January 2024 and has a Fortinet variant of Secure Connect, but its current page no longer names Fortinet. We’d check the variant is still sold before shortlisting it.
Capabilities and inclusions. GTT doesn’t split out what the Fortinet variant includes, with no edition or licence stated, which makes it hard to price like for like.
Configuration and daily use. The management tiers and add-ons match the Prisma variant above.
AI capabilities that matter to the buyer. The AI position matches the Prisma variant, which means roadmap items only.
Coverage, support and contract commitments. The same 24/7/365 NOC and SOC statement applies, with no locations and no SLA figures.
Customer evidence, fit and limitations. There’s no published Fortinet-specific GTT case. We’d suggest this for a buyer who’s already committed to Fortinet and wants GTT’s backbone underneath. If you’re open on platform, we think the Prisma variant is the safer start, as it’s the one GTT currently announces.
Verizon SASE Management
Who supplies and operates the service. Verizon sells SASE Management + as a service that manages a platform you license yourself, supporting Versa, Cisco, Zscaler and Palo Alto Prisma Access. Verizon’s UK terms don’t cover SASE Management, so we’d ask which company contracts for it.
Capabilities and inclusions. Verizon manages whichever platform you choose and the licences stay with you. The base tier covers change and incident management for SWG and ZTNA, Plus adds CASB and DLP, and Preferred adds Verizon’s separate MDR product. In our view that makes it a managed service on your platform and not a SASE package in its own right.
Configuration and daily use. Verizon keeps exclusive administrative control and you get read-only access, so this isn’t co-management. You raise up to 31 Change Requests a month, and initial policy design and migration sit outside the service, so we’d budget separately for the build.
AI capabilities that matter to the buyer. The AI status is Unknown, as Verizon describes no AI feature for this package.
Coverage, support and contract commitments. The only SLA covers change requests, with Urgent ones implemented within 4 hours, and there’s no availability, restoration or resolution commitment at all. A credit is one day of charge, capped at 50% of the month’s recurring charge.
Customer evidence, fit and limitations. There’s no published Verizon SASE case. We’d recommend Verizon for a buyer who already owns Versa, Cisco, Zscaler or Palo Alto and wants one carrier running the changes, but it isn’t a fit if you want co-management or an availability guarantee.
Lumen SASE with Fortinet, pro-managed
Who supplies and operates the service. Lumen sells SASE with Fortinet as an overlay, so you don’t need Lumen connectivity and it isn’t in the price. The contracting party is Lumen Technologies Group or its affiliates, and customers outside the US sign a local country addendum.
Capabilities and inclusions. Fortinet SD-WAN, NGFW/UTM and ZTNA are the available components. NGFW/UTM includes DLP, although network DLP is excluded, so we’d ask what you actually get. ZTNA is a per-user add-on from USD 5 per month.
Configuration and daily use. There’s no co-managed model, just self-managed or pro-managed. Pro-managed gives you read-only portal access whilst Lumen keeps administrative control, with up to 5 customer-level changes a month included.
AI capabilities that matter to the buyer. The AI status is Unknown, as Lumen describes no AI feature for this package.
Coverage, support and contract commitments. Pro-managed doesn’t include SOC services, so you’re the one watching security events, which in our view is a big gap for a service sold as managed. Hosted gateways sit in six US regions only, and availability follows the underlying tier under Lumen’s SLA (99.9% at Silver) with a 12 month term.
Customer evidence, fit and limitations. We’d say this package suits US-led estates, and a UK-headquartered company should ask Lumen whether it can buy it at all before spending time on it.
Lumen SASE with Versa, pro-managed
Who supplies and operates the service. Lumen sells SASE with Versa as an overlay on the same terms as the Fortinet package, with Versa supplying the platform.
Capabilities and inclusions. The USD 299 per location per month pro-managed price includes one X-Small CPE plus SD-WAN and NGFW licences, but not connectivity, installation or taxes. Versa ZTNA is an add-on from USD 9 per user per month, and the USD 168 self-managed price isn’t a managed price, so we’d make sure nobody budgets from it.
Configuration and daily use. The operating model matches the Fortinet package, with read-only portal access and 5 changes a month. Secure Router is pro-managed only.
AI capabilities that matter to the buyer. The AI status is Unknown, as Lumen describes no AI feature for this package.
Coverage, support and contract commitments. Coverage matches the Fortinet package, so no SOC services and US-only hosted gateways. The price applies to one eligible continental US location.
Customer evidence, fit and limitations. This is the only managed package here with a published per-location price, which makes it handy for budgeting a US site and of little use for a UK one until Lumen confirms eligibility. The Versa page says bandwidth isn’t charged separately whilst the FAQ says underlay isn’t included, so we’d get any overage terms in writing.
Comcast Business with Masergy, SASE
Who supplies and operates the service. The contract is with Masergy Communications, Inc. under Comcast Business SASE terms, and no platform vendor is named for the service. Masergy’s SD-WAN terms name Fortinet, so we’d ask Comcast which platform sits behind the SASE service before comparing it with anything else.
Capabilities and inclusions. The service covers SD-WAN connectivity with a built-in layer 4 firewall, next-generation firewall, IPS, IDS and secure web gateway. CASB is a paid add-on under separate terms, and ZTNA is another that needs an SD-WAN Secure or SASE base and one FortiClient licence per endpoint.
Configuration and daily use. You control your ZTNA policy through the customer portal and the responsibility for it is yours. If hands-off policy management is what you’re after, we’d steer you to a different package.
AI capabilities that matter to the buyer. The AI status is Unknown, as Comcast describes no AI features for the SASE or ZTNA services.
Coverage, support and contract commitments. Comcast monitors the SASE service 24x7x365 but doesn’t monitor security events, as SOC-style services are sold separately and limited to the United States. Comcast publishes three undated copies of the SASE terms, with the November 2025 copy giving 100% for HA sites and 99.99% for non-HA sites in the contiguous United States only (the Ent copy matches). We’d ask which copy applies to a UK buyer before quoting any figure.
Customer evidence, fit and limitations. There’s no published Masergy SASE case. We’d suggest this for a buyer who wants contractual availability figures and doesn’t mind buying security monitoring separately, whereas our recommendation for anyone wanting security events watched as part of the service would be a package with a SOC included.
Globalgig Managed SSE with Palo Alto Prisma Access
Who supplies and operates the service. Globalgig launched Managed SSE on Palo Alto Prisma Access in November 2024 on a fully managed or co-managed basis, with Fundamental, Plus and Premier tiers added in May 2025. Globalgig also sells Managed Network Services tiers with the same names, so we’d be careful not to mix the two up, and it doesn’t state which company contracts with you.
Capabilities and inclusions. Managed SSE includes SWG, CASB and ZTNA, though Globalgig doesn’t say what each tier includes, and Managed SD-WAN is sold separately. Premier adds SOC support with incident investigation and remediation, which Globalgig doesn’t call MDR, so neither do we.
Configuration and daily use. Fundamental covers core administration, Plus adds monitoring and remediation guidance, and Premier adds full policy remediation and enforcement. In our view the tier you pick is really the decision of how much security operations work you want Globalgig to take on.
AI capabilities that matter to the buyer. Globalgig’s AI-driven Orchestra Insight is included in the Plus and Premier Managed Network Services tiers and gives visibility into SSE and SASE environments, but Globalgig doesn’t say which Managed SSE tier carries it, so we’d ask before counting it.
Coverage, support and contract commitments. Premier states a 24/7/365 SOC and there are no SOC hours for the other tiers, with no published SLA or pricing. Globalgig doesn’t sell security management separately from managed network services, so we’d ask whether network services are a condition of the order.
Customer evidence, fit and limitations. There’s no published Globalgig case. We’d recommend it for a mid-size buyer who wants Prisma Access with the operating tier chosen up front, and we’d ask for UK orderability and the SLA before signing.
Aryaka Unified SASE as a Service
Who supplies and operates the service. Aryaka is both the platform vendor and the provider, contracting as Aryaka Networks, Inc. and launching Unified SASE as a Service 2.0 in November 2025. It doesn’t name a UK contracting company. In our view the single-vendor set up is the main draw, as there’s only one party to hold responsible.
Capabilities and inclusions. Unified SASE combines the global Private Core, SD-WAN, WAN optimisation, NGFW-SWG, IDPS and anti-malware, sold in four site tiers. CASB is a separate Advanced Security Service, as the AI>Secure datasheet shows, and Remote User ZTNA is a separate per-user service.
Configuration and daily use. Aryaka handles activation, orchestration and always-on monitoring, and fully manages your ZTNA policy against the requirements you give it. You roll out the client and provide level 1 user support. There’s no co-management, so this suits a buyer who wants to hand the whole thing over.
AI capabilities that matter to the buyer. AI>Secure finds and classifies sanctioned and unsanctioned AI applications and inspects AI traffic with next-generation DLP. It’s a paid add-on that needs Aryaka SD-WAN and has no published availability date, so we’d ask Aryaka to confirm it’s generally available. It’s the only package on this page with documented GenAI controls, which makes it the one we’d look at first if staff AI use is your concern.
Coverage, support and contract commitments. Aryaka’s SLA sets 99.999% uptime targets for the Private Core and NGFW-SWG, with 99.99% end to end only for sites with high availability and dual ISPs, so 99.999% isn’t a figure every customer gets. P1 incidents are acknowledged within 10 minutes, which is a response time and not a restoration time, and credits are capped at 25% of monthly fees.
Customer evidence, fit and limitations. The one named case is Lauridsen Group, a US manufacturer in 20 countries that cut set-up of a new location from several weeks to 2 to 3 days, though it’s Aryaka’s own account with no UK element. We’d recommend Aryaka for a multi-site buyer who wants one vendor and one operator, and we’d ask for a UK contracting company before signing.
Which providers did we hold back or move?
Two names from the previous page have no profile above, and a handful of other candidates haven’t earned one yet. None of this is a judgement on quality, as it comes down to whether a provider publishes a managed offer with a UK route that we can compare.
Candidate | Decision | Reason | What would change it |
|---|---|---|---|
IBM | On hold | IBM has no current service page, SLA, SOC list or delivery entity, and the only coverage is 2021 launch news of the Zscaler-based service (SDxCentral). QRadar SaaS assets were reported sold to Palo Alto Networks (Dark Reading), which affects the old QRadar integration claim | Current IBM service description and written package confirmation |
Cato Networks | Moved to the vendor table | Cato is a platform and managed delivery is through MSASE partners. Wavenet sells Cato Cloud as a managed UK service (page) but publishes no SLA, tiers or service description | A named UK partner with a written service description and SLA |
Colt Technology Services | Candidate for addition | UK and European operator with a Versa-based SASE announced in 2022 (release), and named among UK leaders by ISG in 2024 (ISG). No current offer page or SLA is published | Current service page and schedule |
Computacenter | Not added | Its G-Cloud 14 listing is SASE consultancy with optional managed support on weekday office hours and no availability figure (listing), so it isn’t a defined managed package | A managed SASE service description with an SLA |
Orange Business, Telefónica Tech, Kyndryl, Accenture | Excluded for now | Only dated announcements are published, for example Kyndryl’s February 2025 Prisma SASE announcement (Computer Weekly). Managed scope, regions and UK delivery aren’t stated | A current service description with an operating model |
SCC | Excluded for now | Managed SD-WAN on Fortinet and Cisco with 24/7 monitoring (page). SCC doesn’t state that it operates SSE | Evidence that SCC operates SSE |
World Wide Technology | Excluded | Advisory, integration and lab services. No managed operations or UK presence evidenced | Not applicable |
Forcepoint | On hold | Product naming after the government unit sale needs settling before a package can be defined | A defined managed package with a service description |
Managed SASE evaluation answers
Below are the answers to the questions businesses ask when evaluating managed SASE, each tied to the evidence on this page so you can see how well each claim is supported.
Managed SASE evaluation
Managed SASE is a provider running the whole SASE stack for you on a platform such as Palo Alto Prisma, Fortinet, Zscaler, Netskope, Versa or Aryaka’s own. We compare thirteen packages from eight providers, and given that only BT publishes UK-specific wording, we’d always get the contracting company and UK availability in writing before shortlisting anyone.
Managed SD-WAN and SASE evaluation
SASE is SD-WAN plus security delivered from the cloud, but not every package includes both halves. For example, BT’s Prisma Access, Netskope and Zscaler offerings are SSE only, whilst Aryaka and GTT sell the SD-WAN alongside the security layer. Our suggestion would be to settle whether you need SD-WAN before comparing any quotes, as it changes what you’re being priced for.
Secure service edge evaluation
SSE is the security half of SASE, so web filtering, cloud app control and private application access without the SD-WAN. BT’s four schedules and Globalgig are SSE-led, and Verizon manages SSE on platforms you license yourself. Because SWG, CASB and DLP are included in some packages and sold as extras in others, we’d ask every provider which are in the base price.
Zero trust network access evaluation
ZTNA lets users reach private apps without a full network connection, and in most of these packages it’s an extra. Lumen charges from USD 5 per user per month on Fortinet and USD 9 on Versa, Comcast Business with Masergy and Aryaka both sell it separately, and BT’s Prisma Access only offers it for mobile users. We’d work out the per-user cost before comparing totals.
Managed SOC and MDR evaluation
A NOC keeps the service running whilst a SOC watches for attacks, and plenty of these packages only give you the first. Lumen’s pro-managed service has no SOC and Comcast doesn’t monitor security events under its SASE contract, whereas Globalgig states a 24/7/365 SOC on its Premier tier. We’d ask each provider which of the two you’re actually buying.
Data location and UK data residency evaluation
Few packages say in writing where your traffic is inspected and your logs are stored. BT Zscaler is the exception as you choose the log location on the order, and we think that’s the one to beat in a UK procurement. For everything else we’d ask for the same written data-location statement for the exact package.
Managed SASE SLA evaluation
A target isn’t a guarantee, and most figures in this market are targets. BT’s P1 restoration time carries no liability, Verizon’s credited SLA only covers change requests and Aryaka’s 99.999% is a monthly target. We’d compare response, restoration and resolution separately, and get the credit and claim deadline in writing.
Co-managed SASE evaluation
Co-management means you and the provider both change policy, and BT is the clearest on it, allowing up to 5 of your people to implement service requests on its Plus and Premium tiers. BT FortiSASE offers optional co-management through its portal as well, whereas Verizon keeps exclusive administrative control and Lumen has no co-managed model. We’d ask each provider for a written responsibility matrix, as that’s what tells you who’s actually doing what.
AI security controls evaluation
Only Aryaka documents a specific AI security feature set, and that’s AI>Secure, a paid add-on that needs Aryaka SD-WAN and has no general availability date on its datasheet. Roadmap items don’t count, so for every other package we wouldn’t assume any GenAI controls.
Managed SASE pricing evaluation
Pricing is quote only for almost every package. Lumen publishes per-location prices in US dollars, which don’t help a UK buyer, so we’d always ask for dated written quotes that state the unit, term and exclusions.
How does shortlisting managed SASE through Netify work?
Shortlisting with Netify is a fairly simple process. You tell us your requirements, we match them to the packages above and show the evidence behind each match, and you decide who to approach. As nothing is committed by asking, you’re more than welcome to send the same requirements to providers we haven’t listed.
- Describe your requirements, including your platform, sites, countries, users and data-location rules.
- We map them to the packages on this page, as what a provider can deliver varies by package and region.
- You review the shortlist and the evidence behind each recommendation, including what we’d still confirm in writing.
- We draft the written questions for each provider, so that every answer can be compared like for like.
- Once you’re happy, you take the answers back to the providers and decide who to approach for a quote.
Frequently asked questions
We’ve compiled the questions that we at Netify see most from buyers of managed SASE.
What is the difference between a SASE vendor, a provider and a package?
The vendor owns the platform (Palo Alto Networks, Fortinet, Zscaler, Netskope, Versa and the likes), the provider contracts, operates and supports a defined service on it, and the package is what you actually buy, with its own inclusions, paid extras and service levels. We compare packages for that reason, as one provider can sell several, and BT publishes four on four different vendors.
Which providers operate my preferred platform?
Palo Alto Prisma is run by BT, NTT DATA, GTT and Globalgig, and Verizon will manage it if you license it yourself. Fortinet is run by BT, GTT and Lumen, Zscaler by BT, Netskope by BT only and Versa by Lumen, whilst Aryaka runs its own platform. Whichever you choose, we’d confirm the edition and who holds the licences before assuming a match.
Which providers allow policy co-management?
Co-management means you and the provider both change policy, and BT is the clearest on it. It allows up to 5 of your people to implement service requests on the Plus and Premium tiers of its Prisma Access, Netskope and Zscaler packages. Verizon, Aryaka, Lumen and NTT DATA keep control themselves, so if you want to make changes yourself, BT is where we’d start.
Is any package confirmed as orderable in the UK?
Not yet. BT is the only provider with UK-specific wording, and that sits on a marketing page that names no platform or SLA. Our suggestion would be to ask every provider to confirm the package, the UK contracting company and where your data sits before you shortlist.
Where is traffic inspected and where are logs stored?
This is package-dependent, with BT Zscaler letting you choose the log location on the order, whilst Lumen’s hosted gateways are US only. We’d therefore always get a written statement for the exact package before signing.
Which packages include MDR and incident response?
MDR is a SOC that investigates and responds to threats for you, and most of these packages don’t include it. GTT and Verizon sell it as a separate product and Lumen’s pro-managed service has no SOC, whilst Globalgig’s Premier tier includes a 24/7/365 SOC with incident investigation. If MDR matters to you, we’d ask each provider to name the service rather than assume it’s covered.
Which providers offer evidenced GenAI controls?
Only Aryaka documents a specific feature set, in its AI>Secure datasheet – their paid add-on that builds on Aryaka SD-WAN, to provide prompt-injection blocking.
What is excluded from their SLAs?
BT’s response and restoration figures are targets with no liability, Verizon’s SLA only covers change requests and BT FortiSASE only guarantees on-time delivery. GTT, NTT DATA and Globalgig publish no SLA figures at all, so we’d ask them for theirs before comparing anything.
Can I buy SASE without SD-WAN?
Given that SD-WAN offers the access capabilities of SASE, rather than looking for SASE offerings, SSE is the version without SD-WAN. For example, BT’s Prisma Access, Netskope and Zscaler offerings are SSE only.
Can I get pricing from this page?
As all providers only publish quote pricing, rather than make false claims around pricing, we’ve tried to give slight indications on who may be better value for money but strongly recommend that you ask for dated written quotes that state the unit, term and exclusions to get a confirmed price.
Why aren’t Cato, IBM and Colt on the list?
We’ve built this around managed providers that are sold via UK-based partners, with the likes of Cato, IBM and Colt missing out on these.
Why does this page give no scores or rankings?
Given every business has their own needs and requirements, at Netify we decided to build this page without numeric scores or best-provider claims.
How do I report a mistake?
Found a mistake or piece of outdated information in our research, please feel free to reach out to us via email at support@netify.com.
How this page is researched
Every fact on this page comes from a public provider, vendor or contract source. It’s written by Harry Yelland, Robert Sturt is the reviewer and his review is pending, and the page was last verified on 11 October 2026. You can read the full methodology here: https://netify.co.uk/methodology/
How candidates were chosen. We reviewed 29 organisations, those being the 10 providers on the previous page and 19 additional vendors and providers. A package gets a profile when the provider publishes a managed SASE offer and sells it to UK buyers, which gives thirteen packages from eight providers, and the rest sit in the vendor table or the held back list.
How we label evidence. Contract schedules, product-specific attachments and data sheets carry the most weight, followed by vendor and provider product pages, then press releases and trade press. Every claim is labelled schedule-stated, provider-reported or vendor-reported, and anything a provider’s own documents don’t state is marked Unknown, which isn’t the same as absent from the service.
Three separate judgements. Technical support, package inclusion and contractual guarantee are three different questions, so we keep them apart. A platform can support a feature that a package leaves out or sells as an extra, and a service level can be a target with no remedy, which is why this page separates included features from paid extras throughout.
No scores or rankings. Netify’s editorial policy and corrections page (version 1.0, 5 February 2026) doesn’t describe an approved scoring method, so there are no numeric scores or best-provider claims on this page. Analyst placements are labelled vendor-reported or trade-press-reported, and we haven’t run performance tests on any package.
Commercial relationships. Netify may earn a commission for marketplace introductions, which doesn’t affect how a package is described, and we’re also a BT partner, which is relevant to the BT packages on this page.
Corrections. To report an error, email support@netify.com. Substantive changes are listed in the dated change note below.
Build a shortlist against your requirements
At Netify, we’d suggest starting from your requirements and not from a provider name, because the same carrier can sell packages with very different responsibilities and service levels. Send us your platform, site and country counts, management model, data-location needs and SLA expectations, and we’ll help you shortlist packages that fit and draft the written questions for each. As set out in our methodology, Netify may earn a commission on marketplace introductions.
Sources
All opened between 9 and 11 October 2026. The workbook carries the full list of 132 sources with locators.
BT. UK Managed SASE overview, Prisma Access Part B, July 2024 V1, Netskope Part B, July 2024, Zscaler Part B, August 2025 V2, FortiSASE Part B, July 2026 V2, TelecomTV on the November 2024 FortiSASE launch
Comcast Business with Masergy. SASE PSA v1.0, ZTNA PSA v1.0, SASE PSAv10 Ent, Masergy SASE PSA, November 2025, CASB PSA, SD-WAN PSA, SASE product brief
NTT DATA. Liantis case study, 28 August 2025, MSS SASE data sheet, Palo Alto blog, January 2024, ISG briefing note, July 2025, Global cybersecurity whitepaper
GTT. Secure Connect SASE, Palo Alto release, July 2025, Fortinet release, January 2024, 2026 strategy release, 21 April 2026, Secure Connect data sheet
Verizon. SASE Management, SASE Management service guide, SASE Management SLA, UK terms
Lumen. SASE overview, Versa package, SASE service schedule, SASE service guide, FAQ, Service level agreement
Globalgig. Managed SSE release, November 2024, Service tiers, May 2025, Premier SSE Management, March 2025, Managed network services, SSE and SASE datasheet 2025
Aryaka. Unified SASE 2.0 release, 12 November 2025, AI>Secure datasheet, Global connectivity datasheet, SmartManage datasheet, Service level agreement, Services Description and Terms
Vendors. Palo Alto, Fortinet, Zscaler, Netskope, Cisco, Cato, HPE Aruba, VeloCloud FAQ, Cloudflare, Check Point
Analyst placements. Palo Alto, Zscaler, Cato, SDxCentral, August 2026
Supporting page copy supplied by Harry
Part 4: Supporting copy
Buyer options (outcomes tab)
Key | Button label | Plan introduction | Call to action |
|---|---|---|---|
run_it_for_us | Run it for us | Here are the managed SASE packages where the provider runs the service day to day, based on your sites and platform. Every choice comes with the evidence behind it. | Plan my service |
keep_policy_control | Keep control of our policy | Here is where co-management is evidenced, including how many users and what they can change. Each choice comes with what we’d get in writing. | Plan my control |
keep_current_platform | Keep our current platform | Here are the providers that run the platform you already own, and who holds the licences. Each choice comes with the evidence behind it. | Match my platform |
connect_uk_sites | Connect our UK sites | Here is what we could and couldn’t confirm for your UK sites. We’ll flag every package whose UK orderability still needs confirming in writing. | Plan my UK sites |
connect_global_sites | Connect sites worldwide | Here are the packages with a stated global footprint, along with what we’d confirm on PoPs, countries and regional service levels. | Plan my network |
keep_data_in_uk | Keep our data in the UK | Here is what each package states about where traffic is inspected and logs are stored. Where nothing is stated, we’ll say so and show the question to ask. | Check my data location |
protect_ai_use | Protect staff use of AI tools | Here is the evidence for controls on staff use of GenAI tools, and what is announced but not yet confirmed as available. | Check AI controls |
compare_packages | Compare packages side by side | Here is a side-by-side view of the packages that fit your requirements. Each row comes with the evidence behind it. | Build my shortlist |
review_current_provider | Review our current provider | Here is how your current managed SASE service compares with the packages on offer now. Each point comes with the evidence behind it. | Review my service |
Reasons for each recommendation (match_rules tab)
Rule | Reason shown to the buyer |
|---|---|
R01 | A package is a provider’s defined service on a platform, so we compare packages and not companies. |
R02 | BT publishes four managed security packages on four different platforms, so check which schedule you’re being sold. |
R03 | Where SD-WAN isn’t in the schedule, you’ll need a separate SD-WAN, so we’d confirm what’s in scope. |
R04 | Co-management is limited to implementing service requests for up to 5 users on BT’s Plus and Premium tiers. |
R05 | Verizon keeps exclusive administrative control of the third-party portal, so the customer has read-only access. |
R06 | Lumen’s pro-managed service is an overlay, so connectivity and SOC services aren’t included. |
R07 | Comcast Business doesn’t monitor security events under its SASE contract, so MDR or threat monitoring is a separate purchase. |
R08 | Aryaka and GTT own a private backbone, which matters for demanding WAN performance, though we found no verified latency figures. |
R09 | Most availability figures are targets with no remedy, so we’d compare response, restoration and resolution separately. |
R10 | No package states traffic inspection and log location with a verified commitment, so we’d get a written statement for the exact package. |
R11 | Only Aryaka documents a specific AI security feature set, and it’s a paid add-on with general availability unconfirmed. |
R12 | UK orderability isn’t confirmed in writing for any package, so we’d confirm the package and the UK contracting entity. |
R13 | Lumen is the only provider with published per-location prices, and they apply to one eligible continental US location. |
R14 | Every other price is quote only, so we’d ask for dated written quotes that state the unit, term and exclusions. |
Package descriptions (packages tab)
Key | Package | What it is | Who it suits | Who it does not suit |
|---|---|---|---|---|
bt_prisma | BT Prisma Access | BT’s co-managed SSE package on Palo Alto Prisma Access, with SD-WAN excluded and P1 restoration as a 4 hour target. | UK buyers with Prisma Access skills that want BT escalation and capped changes. | Buyers that need BT’s own availability guarantee or hands-off policy management. |
bt_netskope | BT Netskope | BT’s co-managed SSE package on Netskope, with Edge and Edge Private Access packages and DLP as a separate module. | Netskope-standardised buyers that want a UK carrier around it. | Buyers that need an availability guarantee or more than 7 days of default portal data. |
bt_zscaler | BT Zscaler | BT’s co-managed SSE package on Zscaler ZIA, ZPA, ZDX and Client Connector, with credits claimed from Zscaler. | Buyers with an existing Zscaler estate that need the BT service desk. | Buyers that need a country commitment on inspection, or BT’s own service levels. |
bt_fortisase | BT FortiSASE | BT’s fully managed SSE package on Fortinet FortiSASE, with optional co-management and only on-time delivery guaranteed. | UK buyers with Fortinet SD-WAN that want BT to run the SSE side. | Buyers that need a guaranteed availability figure. |
ntt_prisma | NTT DATA Prisma SASE | NTT DATA’s fully managed network and security service on Palo Alto Prisma SASE. | Multi-site buyers that want one operator for network and security. | Buyers that need a SASE-specific SLA or co-management. |
gtt_prisma | GTT Prisma SASE | GTT’s managed Secure Connect service with Palo Alto Prisma SASE, in three management tiers. | Global buyers that want carrier and security from one contract. | Buyers that need published SLA figures or SOC locations. |
gtt_fortinet | GTT Fortinet | GTT’s Fortinet-based Secure Connect variant, announced in January 2024. | Buyers already committed to Fortinet who want GTT’s backbone. | Buyers that need confirmation the variant is still sold. |
verizon_sase | Verizon SASE Management | Verizon’s change and incident management for customer-licensed third-party SSE platforms. | Buyers that already own Versa, Cisco, Zscaler or Palo Alto and want one carrier to run changes. | Buyers that need co-management or an availability guarantee. |
lumen_fortinet | Lumen Fortinet, pro-managed | Lumen’s overlay SASE with Fortinet, where Lumen manages the service and the customer monitors security events. | US-led estates that want an overlay on their own circuits. | UK-led estates until UK eligibility is confirmed, and buyers that need a SOC. |
lumen_versa | Lumen Versa, pro-managed | Lumen’s overlay SASE with Versa and a published per-location list price. | US-led buyers that want a published price. | UK sites, until eligibility is confirmed. |
masergy_sase | Comcast Business with Masergy SASE | Comcast Business’s managed SD-WAN with built-in firewall, NGFW and SWG, with CASB and ZTNA as paid add-ons. | Buyers that want contractual availability figures and will buy security monitoring separately. | Buyers that need security event monitoring included, or a confirmed UK SLA. |
globalgig_sse | Globalgig Managed SSE | Globalgig’s tiered SSE service on Palo Alto Prisma Access. | Mid-size buyers that want to choose the operating tier explicitly. | Buyers that need SD-WAN, an SLA or confirmed UK delivery. |
aryaka_sase | Aryaka Unified SASE as a Service | Aryaka’s SD-WAN, security and private backbone, fully managed by Aryaka. | Multi-site buyers that want one vendor and one operator. | Buyers that need co-management or a confirmed UK entity. |
Questions asked of the buyer (requirements tab)
Key | Question |
|---|---|
countries_sites | Which countries and site locations need to be covered, and which of them must inspect traffic locally? |
users_sites | How many users and sites do you have? |
remote_access | How many people connect remotely, on their own devices or as third parties? |
critical_apps | Which applications are critical, whether that’s cloud, SaaS, private or voice and video? |
existing_tools | What SD-WAN, identity and security tools do you already run? |
inspected_bandwidth | How much bandwidth needs inspecting at your largest sites? |
security_controls | Which security controls do you need, whether that’s web filtering, ZTNA, CASB, DLP or a firewall? |
data_location | Where must your data and logs be held, and for how long? |
management_preference | Do you want the provider to run it, to co-manage it, or to administer it yourselves? |
support_hours | Which support languages and hours do you need? |
migration_deadline | When do you need this live, whether that’s now, within 3 months or at a contract end date? |
budget_contract | What is your budget range, and do you have any contract constraints? |
Form consent wording and buttons (handoffs tab)
Key | Consent wording | Button label |
|---|---|---|
shortlist_request | I agree Netify may use these details to prepare my managed SASE shortlist, and may contact me about it. | Build my shortlist |
call_me | I agree Netify may call me about my shortlist and use these details to prepare for the call. | Call me back |
phone | Call a Netify adviser | |
teams_chat | Chat with a Netify adviser |
Link text on other Netify pages (internal_links tab)
Link from | Placement | Anchor text |
|---|---|---|
/bt-sase-sd-wan/ | Below the assessment | Compare BT’s SASE packages with seven other providers |
/bt-fortinet-meraki/ | Below the comparison | Compare managed SASE packages side by side |
/buy-bt/ | In the SD-WAN and SASE section | See how BT’s SASE packages compare with other providers |
Package evidence and sources
The recorded claims below keep their original wording, package scope, source locator and research status. Unknown means the evidence did not establish the fact. Review remains pending.
BT Prisma Access
SASE completeness
SSE modules only. Prisma Access SD-WAN devices are not part of the service, and ADEM needs an add-on supplier licence.
Partial; GA; Included. Needs review.
SD-WAN is a separate product.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B 2.2.7(a)(i) and 2.2.7(b)
SSE only option
SSE can be ordered without SD-WAN under this schedule.
Supported; GA; Included. Needs review.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 1.1
Product lifecycle
Schedule dated July 2024 V1. Netskope and Zscaler siblings are 2024; FortiSASE schedule is July 2026 V2.
Supported; GA; Included. Needs review.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Footer
Secure web gateway
Internet Security modules (Basic, Premium Advanced, Enterprise Advanced) are listed. The term SWG is not used.
Unknown; Unknown; Included. Needs review.
Confirm SWG function in writing.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 1.1
CASB inline controls
Inline SaaS supplier option is the closest match to CASB. The term CASB is not used.
Partial; GA; Optional paid. Needs review.
Optional supplier service; price not stated.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 2.2.3
ZTNA private application access
ZTNA module offered for mobile users only; private application access via Enterprise Advanced Internet Security with Service Connections.
Partial; GA; Included. Needs review.
Mobile users only for the ZTNA module.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 1.1
Inline DLP
DLP is an optional Supplier Service.
Supported; GA; Optional paid. Needs review.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 2.2.1
Data residency of inspection
Traffic is inspected in Palo Alto Networks supplier infrastructure. BT responsibility ends where traffic enters or leaves infrastructure owned or controlled by the supplier. Country is not stated.
Partial; GA; Included. Needs review.
Retention of 30 days portal data, 6 months threat logs and 15 months reporting data. Log capacity can be extended as an optional service.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B Section A 1.3 and 3.1
Log and metadata residency
Where logs and data are stored is not specified.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 1.3
Retention controls
Retention 30 days portal data, 6 months threat logs, 15 months reporting data.
Supported; GA; Included. Needs review.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 1.3
AI feature licensing
Schedule does not mention AI features.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Searched, not stated
Co management permissions
Co-management via RBAC profile for up to 5 nominated users on the Supplier Portal, restricted to implementing SSRs. Requires Foundation Plus or Premium.
Supported; GA; Optional paid. Needs review.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 2.1, 8.6
Change approval workflow
SSRs require customer approval and agreed timing.
Supported; GA; Included. Needs review.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 8.5.1(b)
Policy configuration ownership
Under Foundation the customer administers the service in life. Under Plus/Premium BT implements approved SSRs. Policy ownership sits outside BT responsibility.
Partial; GA; Included. Needs review.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 8.4.1(b), 3.3
24x7 NOC
1st line Service Desk is described. 24x7 NOC hours are not stated in Part B.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Searched, not stated
24x7 SOC
Security incidents go to the BT Global Security Operations Centre (second line). Support is reactive, BT has no real time access to the supplier platform, and SIEM analysis is excluded.
Partial; GA; Included. Needs review.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 1.5, 8.2, 3.3
MDR scope
MDR is not described in this schedule.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Searched, not stated
Standard change service
SSR allowance 8 (Foundation Plus) or 10 (Premium) per Prisma Access module per month.
Supported; GA; Optional paid. Needs review.
Foundation tier gives no SSR allowance.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 2.1
Unlimited change claims
Changes are capped. Up to 15 extra SSRs per month can be ordered at extra charge.
Not supported; GA; Not offered. Needs review.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 8.5.1(c)
Security testing before go live
BT configures and tests the service before handover. Customer acceptance tests within five Business Days.
Supported; GA; Included. Needs review.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 5.1, 6.1
Subcontracted delivery
Platform is operated by the supplier. BT provides service desk, GSOC escalation and commissioning.
Supported; GA; Included. Needs review.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 1.5
UK service availability
BT publishes a dedicated Prisma Access annex in its UK terms. The UK order route and orderability statement were not found.
Partial; GA; Unknown. Needs review.
Needs written confirmation.
SRC070: Prisma Access annex to the BT Managed Security Service Schedule of the UK terms Document title
Service availability SLA
No availability percentage in Part B. Part A not read.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 8.7.1
P1 incident response
P1: customer informed within 15 min, first update 30 min, updates hourly, target restoration 4 hours. Targets only.
Supported; GA; Included. Needs review.
BT has no liability for missing targets. Customer must provide a dedicated employee by phone.
SRC022: BT Managed Cloud Security (Prisma Access) Service Schedule Part B Part B para 8.7.1, 8.3.2
Service credit entitlement
Part A lets the customer claim service credits directly from the supplier for the supplier service levels. Claim steps are a portal case within 24 hours and a claim within five business days. Credits are deducted from the invoice within two billing cycles.
Partial; GA; Included. Needs review.
Service level figures sit in an external Palo Alto document that Part A links to and does not reproduce.
SRC105: BT Managed Cloud Security (Prisma Access) Part A, July 2024 V1.1 Part A Section E 19.1 to 19.3
Contracting entity
The UK Prisma Access annex (28 February 2024) carries a British Telecommunications plc copyright line. The contracting entity for an order is not stated.
Partial; Unknown; Unknown. Needs review.
A copyright line is not proof of the contracting party.
SRC070: Prisma Access annex to the BT Managed Security Service Schedule of the UK terms Document header
BT Netskope
SASE completeness
SSE only (Edge packages). No SD-WAN in this schedule.
Partial; GA; Included. Needs review.
SRC003: Managed Cloud Security Netskope service schedule Part B para 1.1
Product lifecycle
Part B version July 2024; Netskope SKUs may change with supplier offering on notice.
Supported; GA; Included. Needs review.
SRC003: Managed Cloud Security Netskope service schedule Footer, para 2.2
Secure web gateway
Next Generation SWG included in Edge and Edge Private Access packages.
Supported; GA; Included. Needs review.
SRC003: Managed Cloud Security Netskope service schedule Part B para 1.1
Firewall as a service
Cloud firewall included in both Edge packages.
Supported; GA; Included. Needs review.
SRC003: Managed Cloud Security Netskope service schedule Part B para 1.1
ZTNA private application access
Netskope Private Access included in the Edge Private Access Package. It is also listed as a separate module.
Supported; GA; Included. Needs review.
SRC003: Managed Cloud Security Netskope service schedule Part B para 1.1
Inline DLP
Data Loss Prevention is a separate module.
Supported; GA; Separate product. Needs review.
SRC003: Managed Cloud Security Netskope service schedule Part B para 1.1
Data residency of inspection
The customer chooses a tenancy and links it to a management plane in San Jose, Dallas, Amsterdam, Frankfurt, Melbourne, Zurich, Riyadh, London or Singapore.
Partial; GA; Included. Needs review.
Covers the management plane. Traffic inspection location is not stated.
SRC106: BT Managed Cloud Security (Netskope) Part A, July 2024 Part A 20.2
Log and metadata residency
Data location not specified.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC003: Managed Cloud Security Netskope service schedule Searched, not stated
Retention controls
Portal data 7 days by default, extendable to 3 months with additional licences; Advanced Analytics BASE 7-day log retention; data kept up to six months after termination.
Partial; GA; Included. Needs review.
SRC003: Managed Cloud Security Netskope service schedule Part B para 1.1, 1.3
Co management permissions
RBAC co-management for up to 5 users, SSRs only. Foundation Plus or Premium.
Supported; GA; Optional paid. Needs review.
SRC003: Managed Cloud Security Netskope service schedule Part B para 2.1
Policy configuration ownership
Foundation: customer administers the service in life and self-serves reporting. Plus/Premium: BT reviews technical performance and policy.
Partial; GA; Included. Needs review.
SRC003: Managed Cloud Security Netskope service schedule Part B para 8.4.1-8.4.3
24x7 SOC
Security incidents assigned to BT GSOC. Support reactive.
Partial; GA; Included. Needs review.
SRC003: Managed Cloud Security Netskope service schedule Part B para 1.5, 8.2
Standard change service
SSR allowance 8 (Foundation Plus) or 10 (Premium) per module per month. Extra up to 15 chargeable.
Supported; GA; Optional paid. Needs review.
SRC003: Managed Cloud Security Netskope service schedule Part B para 2.1, 8.5.1(c)
Unlimited change claims
Changes are capped.
Not supported; GA; Not offered. Needs review.
SRC003: Managed Cloud Security Netskope service schedule Part B para 8.5.1(c)
Service availability SLA
No availability percentage stated in Part B.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC003: Managed Cloud Security Netskope service schedule Searched, not stated
P1 incident response
Same priority table as Prisma Access schedule. P1 restoration target 4 hours. Targets only.
Supported; GA; Included. Needs review.
No liability for missing targets.
SRC003: Managed Cloud Security Netskope service schedule Part B para 8.7.1, 8.3.2
Service credit entitlement
Part A states there are no service levels and service credits available for the BT managed service.
Not supported; GA; Not offered. Needs review.
An incident ticket must be raised before any credit claim, so a supplier credit route may exist. Not evidenced.
SRC106: BT Managed Cloud Security (Netskope) Part A, July 2024 Part A 18.1 to 18.5
Contracting entity
BT contracting entity not named in summary read.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC003: Managed Cloud Security Netskope service schedule Searched, not stated
BT Zscaler
Product lifecycle
Part B is dated March 2024 and a Part A dated August 2025 V2 is also published. The Part A describes three tiers (Foundation, Foundation Plus, Premium).
Supported; GA; Included. Conflicting.
Part B figures may predate Part A. Reconcile before relying on the 2024 detail.
SRC071: BT Managed Cloud Security (Zscaler) Service Schedule Part A, August 2025 V2 Service description
Secure web gateway
ZIA internet protection in scope.
Supported; GA; Included. Needs review.
SRC023: BT Managed Cloud Security (Zscaler) Service Schedule Part B Part B para 1.1
ZTNA private application access
ZPA private application access in scope.
Supported; GA; Included. Needs review.
SRC023: BT Managed Cloud Security (Zscaler) Service Schedule Part B Part B para 1.1
Data residency of inspection
The customer may select where transaction logs are stored, as set out in the order.
Partial; GA; Included. Needs review.
Locations on offer are not listed in Part A.
SRC107: BT Managed Cloud Security (Zscaler) Part A, August 2025 V2 (global) Part A 20.1.6
Retention controls
Customer data kept on Supplier Portal for six months.
Supported; GA; Included. Needs review.
SRC023: BT Managed Cloud Security (Zscaler) Service Schedule Part B Part B para 1.3
Co management permissions
RBAC co-management for up to 5 users; separate user guide; incident help from audit logs.
Supported; GA; Optional paid. Needs review.
SRC023: BT Managed Cloud Security (Zscaler) Service Schedule Part B Part B para 2.1, 8.6.1
User experience monitoring
ZDX and ZCC are described in the schedule. Licence basis not read.
Supported; GA; Included. Needs review.
SRC023: BT Managed Cloud Security (Zscaler) Service Schedule Part B Part B para 1.1
Standard change service
SSR allowance 8 (Plus) or 10 (Premium) per month.
Supported; GA; Optional paid. Needs review.
SRC023: BT Managed Cloud Security (Zscaler) Service Schedule Part B Part B para 2.1
Service reporting
Reporting self-service (Foundation), quarterly (Plus), monthly (Premium).
Supported; GA; Included. Needs review.
SRC023: BT Managed Cloud Security (Zscaler) Service Schedule Part B Part B para 8.4.1-8.4.3
Service availability SLA
No availability percentage stated in Part B.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC023: BT Managed Cloud Security (Zscaler) Service Schedule Part B Searched, not stated
P1 incident response
P1 restoration target 4 hours; targets only.
Supported; GA; Included. Needs review.
No liability for missing targets.
SRC023: BT Managed Cloud Security (Zscaler) Service Schedule Part B Part B para 8.7.1, 8.3.2
Service credit entitlement
Part A says there are no service levels and service credits for the BT managed service. The customer submits a credit claim directly to the supplier, after raising an incident ticket and within the supplier period.
Partial; GA; Included. Needs review.
Supplier service level figures are not in Part A.
SRC107: BT Managed Cloud Security (Zscaler) Part A, August 2025 V2 (global) Part A 18.1 to 18.5
BT FortiSASE
SSE only option
BT FortiSASE is delivered as a standalone service without the need for a Fortinet SD-WAN.
Supported; GA; Included. Needs review.
SD-WAN is not part of the schedule.
SRC072: BT FortiSASE Service Schedule Part A, April 2026 V1 Service description
Product lifecycle
Schedule July 2026 V2 (newest BT SSE schedule). Nov 2024 announcement described managed SD-WAN plus Fortinet SSE for UK.
Supported; GA; Included. Needs review.
SD-WAN not in this schedule.
Secure web gateway
Secure Internet Access covers web filtering, DNS security, SSL inspection and advanced threat protection. The term SWG is not used.
Unknown; GA; Included. Needs review.
Confirm SWG function in writing.
SRC021: BT FortiSASE Service Schedule Part B Part B cl. 1.1.6
Firewall as a service
FWaaS is not mentioned in the schedule.
Unknown; Unknown; Unknown. Needs review.
SRC021: BT FortiSASE Service Schedule Part B Part B cl. 1.1
CASB inline controls
CASB listed as a component.
Supported; GA; Included. Needs review.
SRC021: BT FortiSASE Service Schedule Part B Part B cl. 1.1.5
ZTNA private application access
Secure Private Access applies ZTNA principles.
Supported; GA; Included. Needs review.
SRC021: BT FortiSASE Service Schedule Part B Part B cl. 1.1.7
Inline DLP
DLP is not mentioned in the schedule.
Unknown; Unknown; Unknown. Needs review.
Absence is not proof of absence.
SRC021: BT FortiSASE Service Schedule Part B Part B cl. 1.1
Data residency of inspection
PoPs are in Fortinet cloud data centres and the specific PoPs are agreed per customer. No country, region, log location or retention period is fixed.
Partial; GA; Included. Needs review.
UK/EU residency option not found.
SRC094: BT FortiSASE Service Schedule Part B, July 2026 Part B PoPs and Part A telemetry
Log and metadata residency
No residency commitment. PoPs agreed in data centres designed for local compliance.
Unknown; Unknown; Unknown. Needs review.
SRC021: BT FortiSASE Service Schedule Part B Part B cl. 1.1.1
Co management permissions
Optional co-management gives the customer direct FortiSASE Portal access to execute agreed commands.
Supported; GA; Optional paid. Needs review.
Customer configuration changes can raise P2 or P3 incidents and BT excludes liability for losses caused by them.
SRC021: BT FortiSASE Service Schedule Part B Section A 2.2
User experience monitoring
Digital Experience Monitoring needs a separate order and extra licence.
Supported; GA; Separate product. Needs review.
SRC021: BT FortiSASE Service Schedule Part B Part B cl. 1.1.9
Policy configuration ownership
Standard: BT manages the service through FortiOS.
Supported; GA; Included. Needs review.
SRC021: BT FortiSASE Service Schedule Part B Part B cl. 1.1.4
MDR scope
Endpoint Protection lists antivirus, anti-malware and EDR capabilities. No managed detection and response service is stated.
Unknown; Unknown; Unknown. Needs review.
Do not describe this as MDR without a separate BT MDR description.
SRC021: BT FortiSASE Service Schedule Part B Section A 1.1.8
Standard change service
Up to five SSRs per year at no extra charge from the Operational Service Date.
Supported; GA; Included. Needs review.
SRC021: BT FortiSASE Service Schedule Part B Part B cl. 8.1
UK service availability
Announced for UK business and public sector customers (Nov 2024).
Supported; GA; Included. Needs review.
Announcement, not schedule.
SRC025: BT launches a new managed SASE service powered by Fortinet Announcement text
Service availability SLA
Part A states that only the on-time delivery service level applies. Availability and incident resolution are targets only.
Not supported; GA; Not offered. Needs review.
Replaces the earlier "best effort" wording, which is still the Part B description.
SRC093: BT FortiSASE Service Schedule Part A, July 2026 V2 (Global) Part A service levels
Service credit entitlement
Late delivery attracts a credit of 4% of the monthly recurring charge at the affected site per business day beyond the Customer Committed Date.
Partial; GA; Included. Needs review.
Credit applies to delivery only. No credit for availability or resolution. Claim window not found.
SRC093: BT FortiSASE Service Schedule Part A, July 2026 V2 (Global) Part A service credits
Licence tiers and add ons
Licences must be bought via BT; licence limited to 3 users per device.
Supported; GA; Included. Needs review.
SRC021: BT FortiSASE Service Schedule Part B Part B cl. 1.1.10-1.1.11
Contracting entity
Part B carries a British Telecommunications Ltd copyright line. Licences must be purchased via BT.
Partial; Unknown; Unknown. Needs review.
The contracting entity for an order is not stated.
SRC021: BT FortiSASE Service Schedule Part B Header and Section A 1.1.11
NTT DATA Prisma SASE
SASE completeness
Managed Prisma SASE bundles SD-WAN, cloud-delivered security, automation and reporting.
Supported; GA; Included. Needs review.
2023 announcement.
SRC033: NTT Enhances Its Managed Campus Networks Portfolio With Palo Alto Networks Prisma SASE Release body
Single vendor architecture
Palo Alto Networks supplies SD-WAN and SSE.
Supported; GA; Included. Needs review.
SRC034: Managed Innovation: NTT's Managed Networks with Prisma SASE Service list
Remote browser isolation
Remote Browser Isolation listed.
Supported; Unknown; Unknown. Needs review.
Licence inclusion unknown.
SRC034: Managed Innovation: NTT's Managed Networks with Prisma SASE Service list
CASB inline controls
Next-Generation CASB for SaaS and GenAI app security listed.
Supported; Unknown; Unknown. Needs review.
SRC034: Managed Innovation: NTT's Managed Networks with Prisma SASE Service list
Inline DLP
AI/ML-enhanced DLP listed.
Supported; Unknown; Unknown. Needs review.
SRC034: Managed Innovation: NTT's Managed Networks with Prisma SASE Service list
Data residency of inspection
The NOC core platform and associated data reside in NTT DATA-controlled European cloud data centres.
Partial; GA; Included. Needs review.
Applies to the NOC platform. SASE traffic inspection and log location are not stated.
SRC095: NTT DATA ISG briefing notes (24 July 2025) Managed NOC services
AI threat detection
Cortex XSIAM integration claimed on live page is not found in the sources read.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC031: MSS Secure Access Service Edge data sheet Searched, not stated
AI network optimisation
The brochure describes AIOps, automation and analytics, AI incident management, AI-based correlation and proactive monitoring.
Partial; Unknown; Included. Needs review.
Provider-reported. Licence, GA status and approval controls are not stated.
SRC073: Managed Networks with Palo Alto Networks Prisma SASE brochure Service platform and portfolio
Co management permissions
Live page says co-managed; no co-managed model found in NTT sources read (brief says fully managed).
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC035: Network security for new ways of working Searched, not stated
Policy configuration ownership
The brochure lists full lifecycle services including design, implementation, migration, operation, monitoring, reporting and policy optimisation. NTT also runs change management to ITIL practice per the data sheet.
Supported; GA; Included. Needs review.
The brochure gives no clause-level responsibility matrix or rollback ownership.
SRC073: Managed Networks with Palo Alto Networks Prisma SASE brochure Comprehensive lifecycle services
24x7 NOC
NTT DATA says European managed NOC services are delivered from Bengaluru or Barcelona, and a Birmingham operations centre is staffed by UK National Security-cleared personnel.
Partial; GA; Included. Needs review.
Provider-reported in a briefing note. Not stated to be the NOC for this SASE package. SOC languages not stated.
SRC095: NTT DATA ISG briefing notes (24 July 2025) Managed NOC services and UK operations
24x7 SOC
NTT SOCs provide 24/7 threat validation and hunting; Advanced Threat Detection - Enhanced adds analyst validation and incident reports.
Supported; GA; Included. Needs review.
Old branding; undated.
SRC031: MSS Secure Access Service Edge data sheet Management model section
UK service availability
The UK landing page markets Managed Campus Networks with Prisma SASE and asks customers to make contact. No UK contracting entity is named.
Partial; Unknown; Unknown. Needs review.
2023 brochure is the deepest document opened.
SRC074: Managed Campus Networks with Prisma SASE (UK landing page) Service description
NOC and SOC locations
NTT data sheet states six SOCs without locations. Live page claims 49 SOC facilities and NOCs in Bengaluru, Barcelona and Birmingham; not found in sources read.
Unknown; Unknown; Unknown. Conflicting.
Conflict with live page.
SRC031: MSS Secure Access Service Edge data sheet SOC paragraph
Service availability SLA
The brochure refers to "leading SLAs" and states no metric, window, exclusion, credit or claim deadline.
Unknown; Unknown; Unknown. Needs review.
Replaces the earlier note. Still no SLA found.
SRC073: Managed Networks with Palo Alto Networks Prisma SASE brochure Manage the complexity
Named SASE case studies
Liantis, Belgium, Prisma SASE, 50+ locations, 28 Aug 2025.
Supported; GA; Unknown. Needs review.
SRC032: Liantis secures its network with Prisma SASE Case page
Quantified customer outcomes
Case reports no quantified outcomes.
Not supported; GA; Unknown. Needs review.
SRC032: Liantis secures its network with Prisma SASE Case page
Recent changes
Same Prisma SASE managed offer appears as NTT Ltd (Feb 2023) and NTT DATA (Jan 2024 blog; Aug 2025 case).
Supported; GA; Unknown. Needs review.
SRC033: NTT Enhances Its Managed Campus Networks Portfolio With Palo Alto Networks Prisma SASE Release and later pages
GTT Prisma SASE
SASE completeness
Secure Connect lists CASB, SWG, ZTNA, FWaaS and Managed SD-WAN. Page does not separate Prisma and Fortinet variants.
Supported; GA; Included. Needs review.
Variant-level inclusion not stated.
SRC036: Secure Connect SASE Components section
Private backbone
GTT states a Tier 1 IP backbone reaching 260+ cities across six continents. Ranking claim unverified.
Supported; GA; Included. Needs review.
Provider-reported.
SRC038: GTT expands its SASE portfolio with Fortinet Release body
Secure web gateway
The page says Secure Connect consolidates management of SWG along with the other functions.
Partial; GA; Unknown. Needs review.
Consolidated management does not prove the function is included in the base commercial package.
SRC075: SASE: Secure Connect (current page) With Secure Connect in place
Firewall as a service
The page says Secure Connect consolidates management of FWaaS along with the other functions.
Partial; GA; Unknown. Needs review.
Consolidated management does not prove the function is included in the base commercial package.
SRC075: SASE: Secure Connect (current page) With Secure Connect in place
DDoS protection
DDoS prevention is a separate GTT service that the page says integrates with Secure Connect.
Supported; GA; Separate product. Needs review.
Not proven as included.
SRC075: SASE: Secure Connect (current page) The GTT difference
CASB inline controls
The page says Secure Connect consolidates management of CASB along with the other functions.
Partial; GA; Unknown. Needs review.
Consolidated management does not prove the function is included in the base commercial package.
SRC075: SASE: Secure Connect (current page) With Secure Connect in place
ZTNA private application access
The page says Secure Connect consolidates management of ZTNA along with the other functions.
Partial; GA; Unknown. Needs review.
Consolidated management does not prove the function is included in the base commercial package.
SRC075: SASE: Secure Connect (current page) With Secure Connect in place
Inline DLP
The page says Secure Connect consolidates management of DLP along with the other functions.
Partial; GA; Unknown. Needs review.
Consolidated management does not prove the function is included in the base commercial package.
SRC075: SASE: Secure Connect (current page) With Secure Connect in place
AI anomaly detection
GTT promotes Defense Halo as an AI-native network defence platform. It is not evidenced as part of Secure Connect.
Unknown; Unknown; Unknown. Needs review.
Do not import it into this package.
SRC075: SASE: Secure Connect (current page) News listing
Co management permissions
Customers may retain co-management rights over specific functions.
Supported; GA; Included. Needs review.
The page does not define which functions or who owns rollback.
SRC075: SASE: Secure Connect (current page) The right level of management
Policy configuration ownership
Tiers: Enterprise (Fully Managed Plus), Premium (Fully Managed), Standard (Platform as a Service). Co-management options exist.
Supported; GA; Included. Needs review.
SRC036: Secure Connect SASE Management tiers section
24x7 SOC
Global NOC and SOC teams monitor 24/7 with CREST-certified analysts and ISO accreditation claimed. Locations and languages are not stated.
Supported; GA; Included. Needs review.
Provider-reported.
SRC075: SASE: Secure Connect (current page) Operations, monitoring and optimization
MDR scope
Managed Detection and Response is a separate GTT service.
Supported; GA; Separate product. Needs review.
Not a stated inclusion in Secure Connect.
SRC075: SASE: Secure Connect (current page) Complete your solution
NOC and SOC locations
Live page lists Arlington, London and Frankfurt; page read does not specify locations.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC036: Secure Connect SASE Searched, not stated
Service availability SLA
Page says uptime assurance and selectable Service Level Objective but gives no figures. Live page 100% backbone and 30-minute claims not found.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC036: Secure Connect SASE Searched, not stated
Named SASE case studies
April 2026 release names customers (HR Path, Radisson Hotel Group, JYSK, Loxam). SASE use not established. No SASE case read.
Unknown; Unknown; Unknown. Needs review.
SRC039: GTT 2026 strategy press release Customers paragraph
Recent changes
The current Secure Connect page offers single-vendor or dual-vendor SASE with "best-in-class SSE partners" and names neither Prisma SASE nor Fortinet. Separate orderable variants are not confirmed.
Supported; GA; Unknown. Conflicting.
Prisma (July 2025) and Fortinet (January 2024) variants rest on press releases.
SRC075: SASE: Secure Connect (current page) Choosing your Secure Connect solution
GTT Fortinet
SASE completeness
Secure Connect lists CASB, SWG, ZTNA, FWaaS and Managed SD-WAN. Page does not separate Prisma and Fortinet variants.
Supported; GA; Included. Needs review.
Variant-level inclusion not stated.
SRC036: Secure Connect SASE Components section
Secure web gateway
The page says Secure Connect consolidates management of SWG along with the other functions.
Partial; GA; Unknown. Needs review.
Consolidated management does not prove the function is included in the base commercial package.
SRC075: SASE: Secure Connect (current page) With Secure Connect in place
Firewall as a service
The page says Secure Connect consolidates management of FWaaS along with the other functions.
Partial; GA; Unknown. Needs review.
Consolidated management does not prove the function is included in the base commercial package.
SRC075: SASE: Secure Connect (current page) With Secure Connect in place
DDoS protection
DDoS prevention is a separate GTT service that the page says integrates with Secure Connect.
Supported; GA; Separate product. Needs review.
Not proven as included.
SRC075: SASE: Secure Connect (current page) The GTT difference
CASB inline controls
The page says Secure Connect consolidates management of CASB along with the other functions.
Partial; GA; Unknown. Needs review.
Consolidated management does not prove the function is included in the base commercial package.
SRC075: SASE: Secure Connect (current page) With Secure Connect in place
ZTNA private application access
The page says Secure Connect consolidates management of ZTNA along with the other functions.
Partial; GA; Unknown. Needs review.
Consolidated management does not prove the function is included in the base commercial package.
SRC075: SASE: Secure Connect (current page) With Secure Connect in place
Inline DLP
The page says Secure Connect consolidates management of DLP along with the other functions.
Partial; GA; Unknown. Needs review.
Consolidated management does not prove the function is included in the base commercial package.
SRC075: SASE: Secure Connect (current page) With Secure Connect in place
AI anomaly detection
GTT promotes Defense Halo as an AI-native network defence platform. It is not evidenced as part of Secure Connect.
Unknown; Unknown; Unknown. Needs review.
Do not import it into this package.
SRC075: SASE: Secure Connect (current page) News listing
Co management permissions
Customers may retain co-management rights over specific functions.
Supported; GA; Included. Needs review.
The page does not define which functions or who owns rollback.
SRC075: SASE: Secure Connect (current page) The right level of management
Policy configuration ownership
Tiers: Enterprise (Fully Managed Plus), Premium (Fully Managed), Standard (Platform as a Service). Co-management options exist.
Supported; GA; Included. Needs review.
SRC036: Secure Connect SASE Management tiers section
24x7 SOC
Global NOC and SOC teams monitor 24/7 with CREST-certified analysts and ISO accreditation claimed. Locations and languages are not stated.
Supported; GA; Included. Needs review.
Provider-reported.
SRC075: SASE: Secure Connect (current page) Operations, monitoring and optimization
MDR scope
Managed Detection and Response is a separate GTT service.
Supported; GA; Separate product. Needs review.
Not a stated inclusion in Secure Connect.
SRC075: SASE: Secure Connect (current page) Complete your solution
NOC and SOC locations
Live page lists Arlington, London and Frankfurt; page read does not specify locations.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC036: Secure Connect SASE Searched, not stated
Service availability SLA
Page says uptime assurance and selectable Service Level Objective but gives no figures. Live page 100% backbone and 30-minute claims not found.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC036: Secure Connect SASE Searched, not stated
Recent changes
The current Secure Connect page offers single-vendor or dual-vendor SASE with "best-in-class SSE partners" and names neither Prisma SASE nor Fortinet. Separate orderable variants are not confirmed.
Supported; GA; Unknown. Conflicting.
Prisma (July 2025) and Fortinet (January 2024) variants rest on press releases.
SRC075: SASE: Secure Connect (current page) Choosing your Secure Connect solution
Verizon SASE Management
SASE completeness
Verizon SASE Management + is a management overlay for customer-licensed third-party security cloud instances, integrated with Verizon-managed SD-WAN.
Partial; GA; Included. Needs review.
It is a management service and not a platform licence.
SRC077: Verizon SASE Management + Service Guide Section 1.1
Secure web gateway
Management covers change and incident handling for basic cloud security functions including SWG.
Partial; GA; Included. Needs review.
Underlying licences are customer-licensed third-party services.
SRC077: Verizon SASE Management + Service Guide Section 1.3
CASB inline controls
The Plus tier adds change and incident management for CASB.
Partial; GA; Optional paid. Needs review.
Underlying CASB is customer-licensed.
SRC077: Verizon SASE Management + Service Guide Section 1.3
ZTNA private application access
Management covers change and incident handling for ZTNA.
Partial; GA; Included. Needs review.
Underlying licences are customer-licensed third-party services.
SRC077: Verizon SASE Management + Service Guide Section 1.3
Inline DLP
The Plus tier adds change and incident management for DLP.
Partial; GA; Optional paid. Needs review.
Underlying DLP is customer-licensed.
SRC077: Verizon SASE Management + Service Guide Section 1.3
Log and metadata residency
Verizon requires access to customer logs and events in the third-party portal. Storage location and retention are not stated.
Unknown; Unknown; Unknown. Needs review.
SRC077: Verizon SASE Management + Service Guide Section 1.4.6
Co management permissions
The customer has read-only portal access for advisories and reporting.
Not supported; GA; Not offered. Needs review.
SRC077: Verizon SASE Management + Service Guide Section 2.2.2.2
Change approval workflow
Regular changes are accepted within 24 hours and implemented in the next maintenance window. Fast Track is accepted within 4 hours and implemented within 36 hours. Urgent is accepted within 2 hours and implemented within 4 hours.
Supported; GA; Included. Needs review.
Major changes need a separate paid agreement.
SRC077: Verizon SASE Management + Service Guide Sections 1.4.1.1 to 1.4.1.5
Policy configuration ownership
Verizon has exclusive administrative control of the third-party portal. Changes are customer-initiated Change Requests. Initial policy design, configuration and migration are outside scope.
Supported; GA; Included. Needs review.
SRC077: Verizon SASE Management + Service Guide Sections 1.2, 1.4.1, 2.2.1, 2.2.2.2
24x7 SOC
Page says NOC and SOC are integrated. Hours, staffing and locations not stated. 2023 coverage says top package adds MDR.
Partial; GA; Included. Needs review.
Verizon NOC/SOC statement is provider-reported.
SRC008: SASE Management Overview
MDR scope
The Preferred tier adds integration with Verizon MDR. MDR itself is a separate Verizon product.
Supported; GA; Separate product. Needs review.
SRC077: Verizon SASE Management + Service Guide Section 1.3
Standard change service
Up to 31 Change Requests per month in total, with Fast Track and Urgent limited to 10 each within that quota.
Supported; GA; Included. Needs review.
Rollback is not stated.
SRC077: Verizon SASE Management + Service Guide Section 1.4.1
Unlimited change claims
Change Requests are capped at 31 per month.
Not supported; GA; Not offered. Needs review.
SRC077: Verizon SASE Management + Service Guide Section 1.4.1
International service availability
Page lists ~30 countries incl. UK under a sales contact list.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC008: SASE Management Searched, not stated
Service availability SLA
The credited SLA covers change request acceptance and implementation. No availability commitment is stated.
Not supported; GA; Not offered. Needs review.
SRC078: Verizon SASE Management + SLA Sections 1.1 to 1.3
P1 incident response
No incident restoration or resolution metric appears in the SLA.
Not supported; GA; Not offered. Needs review.
SRC078: Verizon SASE Management + SLA Sections 1.1 to 1.3
Service credit entitlement
Credit is one day of charge per qualifying miss, claimed within 30 days of the calendar month, offsets future charges and is capped at 50% of that month recurring charge.
Supported; GA; Included. Needs review.
Exclusions include customer failure, third-party non-performance, maintenance, customer tests and force majeure. Major changes have no SLA.
SRC078: Verizon SASE Management + SLA Sections 2 to 4
Minimum commitments
Terms run from one to five years. Charges depend on user count, service package and instance type.
Supported; GA; Included. Needs review.
Quote only.
SRC077: Verizon SASE Management + Service Guide Section 4.3
Contracting entity
The service guide names no UK contracting entity or UK order route.
Unknown; Unknown; Unknown. Needs review.
SRC077: Verizon SASE Management + Service Guide Sections 3 and 4
Recent changes
Current page lists Versa, Cisco, Zscaler and Palo Alto. Netskope (claimed on live page) is not listed.
Supported; GA; Unknown. Needs review.
SRC008: SASE Management Platform sentence
Lumen Fortinet, pro-managed
Product lifecycle
Fortinet and Versa are current in the guide dated 22 September 2026. Lumen SASE with VMware has not been available for new orders since 15 March 2024.
Supported; GA; Included. Needs review.
SRC080: SASE Solutions Service Guide Sections 3.1 to 3.3
Next generation firewall
Fortinet NGFW/UTM includes antivirus, anti-malware, web filtering, firewall and IDS/IPS. Customers may use it to build a web gateway.
Supported; GA; Included. Needs review.
Available service component. Order-level entitlement to confirm.
SRC080: SASE Solutions Service Guide Section 3.1.2
Remote browser isolation
Remote browser isolation is expressly excluded. Sandboxing, network DLP, SIEM and managed SIEM are also not included.
Not supported; GA; Not offered. Needs review.
SRC080: SASE Solutions Service Guide Section 4.4
ZTNA private application access
ZTNA is a per-user add-on.
Supported; GA; Optional paid. Needs review.
SRC005: Managed SASE overview ZTNA pricing
Inline DLP
The Fortinet NGFW/UTM component lists DLP among its features, and the guide separately excludes network DLP.
Partial; GA; Included. Conflicting.
Scope conflict inside the guide. Confirm what DLP is delivered.
SRC080: SASE Solutions Service Guide Sections 3.1.2 and 4.4
Retention controls
Security logs are retained only for a limited period that is not specified. Lumen has no obligation to store or provide log data.
Unknown; Unknown; Unknown. Needs review.
SRC080: SASE Solutions Service Guide Sections 1.3 and 1.4
Co management permissions
Pro-Managed customers get read-only partner portal access by default and can request read-write access. Self-Managed customers get read-write by default. Lumen keeps global administrative access.
Partial; GA; Included. Needs review.
No formal co-managed model.
SRC080: SASE Solutions Service Guide Table 1.0
24x7 SOC
Pro-Managed does not include SOC services. The customer monitors security events and alerts and responds. Lumen support resources are available 24x7.
Not supported; GA; Not offered. Needs review.
SRC080: SASE Solutions Service Guide Section 4.1.1
Standard change service
Pro-Managed includes up to 5 customer-level changes per month.
Supported; GA; Included. Needs review.
Lumen backs up the latest running configuration for rollback and recovery.
SRC080: SASE Solutions Service Guide Table 1.0 and Section 2.5
Unlimited change claims
Changes are limited to 5 per month under Pro-Managed.
Not supported; GA; Not offered. Needs review.
SRC080: SASE Solutions Service Guide Table 1.0
Underlay carrier management
Overlay service. Lumen connectivity not required and underlay not included in price.
Not supported; GA; Not offered. Needs review.
Contradicts live page.
SRC030: Lumen SASE Solutions FAQ Underlay answer
UK service availability
The service guide does not mention EMEA or the UK. Hosted Gateway is currently only available in the US.
Unknown; Unknown; Unknown. Needs review.
The FAQ allows premise-based EMEA deployment for US-sold customers only.
SRC080: SASE Solutions Service Guide Section 1.7
Mainland China delivery
Mainland China not addressed.
Unknown; Unknown; Unknown. Needs review.
Service availability SLA
The SLA is a separate document that has not been read. Unsupported configurations and missed updates make a customer ineligible for SLA credits.
Unknown; Unknown; Unknown. Needs review.
SRC080: SASE Solutions Service Guide Sections 2.4 and 2.8.3
Minimum commitments
12 month term. Early termination: 100% of remaining MRC in months 1-12, 50% from month 13.
Supported; GA; Included. Needs review.
SRC029: SASE Solutions Service Schedule Schedule 3.1
Bandwidth and usage charges
Versa page: bandwidth not charged separately. Underlay not included. Written confirmation of overage terms needed.
Unknown; Unknown; Unknown. Conflicting.
Conflicting wording.
SRC006: Versa package Pricing block
Lumen Versa, pro-managed
Product lifecycle
Fortinet and Versa are current in the guide dated 22 September 2026. Lumen SASE with VMware has not been available for new orders since 15 March 2024.
Supported; GA; Included. Needs review.
SRC080: SASE Solutions Service Guide Sections 3.1 to 3.3
Remote browser isolation
Remote browser isolation is expressly excluded. Sandboxing, network DLP, SIEM and managed SIEM are also not included.
Not supported; GA; Not offered. Needs review.
SRC080: SASE Solutions Service Guide Section 4.4
ZTNA private application access
ZTNA is a per-user add-on.
Supported; GA; Optional paid. Needs review.
SRC005: Managed SASE overview ZTNA pricing
Retention controls
Security logs are retained only for a limited period that is not specified. Lumen has no obligation to store or provide log data.
Unknown; Unknown; Unknown. Needs review.
SRC080: SASE Solutions Service Guide Sections 1.3 and 1.4
Co management permissions
Pro-Managed customers get read-only partner portal access by default and can request read-write access. Self-Managed customers get read-write by default. Lumen keeps global administrative access.
Partial; GA; Included. Needs review.
No formal co-managed model.
SRC080: SASE Solutions Service Guide Table 1.0
24x7 SOC
Pro-Managed does not include SOC services. The customer monitors security events and alerts and responds. Lumen support resources are available 24x7.
Not supported; GA; Not offered. Needs review.
SRC080: SASE Solutions Service Guide Section 4.1.1
Standard change service
Pro-Managed includes up to 5 customer-level changes per month.
Supported; GA; Included. Needs review.
Lumen backs up the latest running configuration for rollback and recovery.
SRC080: SASE Solutions Service Guide Table 1.0 and Section 2.5
Unlimited change claims
Changes are limited to 5 per month under Pro-Managed.
Not supported; GA; Not offered. Needs review.
SRC080: SASE Solutions Service Guide Table 1.0
Underlay carrier management
Overlay service. Lumen connectivity not required and underlay not included in price.
Not supported; GA; Not offered. Needs review.
Contradicts live page.
SRC030: Lumen SASE Solutions FAQ Underlay answer
UK service availability
The service guide does not mention EMEA or the UK. Hosted Gateway is currently only available in the US.
Unknown; Unknown; Unknown. Needs review.
The FAQ allows premise-based EMEA deployment for US-sold customers only.
SRC080: SASE Solutions Service Guide Section 1.7
Mainland China delivery
Mainland China not addressed.
Unknown; Unknown; Unknown. Needs review.
Service availability SLA
The SLA is a separate document that has not been read. Unsupported configurations and missed updates make a customer ineligible for SLA credits.
Unknown; Unknown; Unknown. Needs review.
SRC080: SASE Solutions Service Guide Sections 2.4 and 2.8.3
Minimum commitments
12 month term. Early termination: 100% of remaining MRC in months 1-12, 50% from month 13.
Supported; GA; Included. Needs review.
SRC029: SASE Solutions Service Schedule Schedule 3.1
Bandwidth and usage charges
Versa page: bandwidth not charged separately. Underlay not included. Written confirmation of overage terms needed.
Unknown; Unknown; Unknown. Conflicting.
Conflicting wording.
SRC006: Versa package Pricing block
Comcast Business with Masergy SASE
SASE completeness
The SASE PSA provides end-to-end WAN connectivity using SD-WAN technology with an encrypted IPsec overlay and application-aware steering.
Supported; GA; Included. Needs review.
The SD-WAN vendor is not named.
SRC081: Masergy SASE PSA (SASE PSAv10 Ent) Schedule A-1 1.A
Secure web gateway
SWG is a built-in security function.
Supported; GA; Included. Needs review.
SRC026: Masergy Secure Access Service Edge Services PSA v1.0 Sched. A-1 s1.A(ix)
Next generation firewall
Layer 4 stateful firewall and NGFW are built-in functions.
Supported; GA; Included. Needs review.
SRC026: Masergy Secure Access Service Edge Services PSA v1.0 Sched. A-1 s1.A(ix)
CASB inline controls
CASB is a separate managed service (PSA v1.0, 31 July 2025) that needs an SD-WAN Secure, SD-WAN Secure OTT or SASE base.
Supported; GA; Optional paid. Needs review.
The CASB PSA does not name the CASB vendor.
SRC082: Masergy Cloud Access Security Broker PSA v1.0 Schedule A-1 1
ZTNA private application access
ZTNA available under a separate PSA. Needs SD-WAN Secure, SD-WAN Secure OTT or SASE Managed Services as base. One FortiClient licence per endpoint. Customer controls ZTNA policy via portal and carries testing and troubleshooting duties.
Supported; GA; Optional paid. Needs review.
Price per endpoint, quote only. No SLA in PSA. Effective date not stated.
SRC027: Masergy Zero Trust Network Access Services PSA v1.0 Sched. A-1 s1-3
AI threat detection
No AI features described in the Masergy SASE or ZTNA PSA. The live page AI-driven autonomous networking claim is not supported there.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC026: Masergy Secure Access Service Edge Services PSA v1.0 Searched, not stated
Co management permissions
Customer controls ZTNA policies through the customer portal.
Supported; GA; Included. Needs review.
SRC027: Masergy Zero Trust Network Access Services PSA v1.0 Sched. A-1 s1
24x7 NOC
Comcast monitors the SASE service 24x7x365 from its Network Operations Center.
Supported; GA; Included. Needs review.
Locations and languages are not stated.
SRC081: Masergy SASE PSA (SASE PSAv10 Ent) Schedule A-1 4.D
24x7 SOC
Under the SASE PSA Comcast does not monitor security events. Threat Monitoring and Response, MDR and EDR PSAs are listed separately.
Not supported; GA; Separate product. Needs review.
Scope of TMR/MDR PSAs not read.
SRC026: Masergy Secure Access Service Edge Services PSA v1.0 Sched. A-1 s5; terms index
MDR scope
MDR PSA v1 is listed on the terms index. Scope not read.
Unknown; Unknown; Separate product. Needs review.
SRC004: Masergy service terms Product-Specific Attachments list
UK service availability
UK MSA (version 20200827) is listed. UK orderability of SASE not confirmed.
Unknown; Unknown; Unknown. Needs review.
SRC004: Masergy service terms Current MSA list
Service availability SLA
Three SASE PSA copies. November 2025 (linked today): HA 100%, non-HA 99.99%, SLAs apply only in the Contiguous United States. PSAv10 Ent (undated): same two figures. April 2026 folder: regional table including Europe 99.99% non-HA and HA 99.999%.
Partial; GA; Included. Needs review.
No copy is dated. Do not quote a figure for UK sites until Comcast confirms the governing copy and UK coverage.
SRC108: Masergy SASE PSA v1 (November 2025 folder) Schedule A-2 Section 2
Service credit entitlement
Credit is two days of the affected location monthly charge plus two days per additional cumulative outage hour, capped at 50% of the monthly charge. Eligibility needs Site Diversity, a one-year initial term and 30 days under NOC monitoring.
Supported; GA; Included. Needs review.
Section 2 and Section 5 measure the 30-day claim window from different starting points.
SRC081: Masergy SASE PSA (SASE PSAv10 Ent) Schedule A-2 Sections 2, 5 and 6
Contracting entity
Masergy Communications, Inc. or applicable affiliate.
Supported; GA; Included. Needs review.
SRC026: Masergy Secure Access Service Edge Services PSA v1.0 Art. 2
Recent changes
ZTNA PSA exists in versions under 2025 and 2026 folders, so the live page statement that ZTNA is on the roadmap is out of date.
Supported; GA; Unknown. Needs review.
Effective dates not stated.
SRC004: Masergy service terms Terms index, ZTNA PSA entries
Globalgig Managed SSE
SSE only option
Managed SSE is a security service. Globalgig sells Managed SD-WAN separately.
Supported; GA; Included. Needs review.
Provider-reported press release.
SRC041: Globalgig expands managed security portfolio with scalable service tiers Managed SSE description
ZTNA private application access
Managed SSE includes SWG, CASB and ZTNA on Prisma Access.
Supported; GA; Included. Needs review.
Tier-level inclusion not stated.
SRC041: Globalgig expands managed security portfolio with scalable service tiers Release body
AI threat detection
The 2025 datasheet says Orchestra Insight gives visibility into SSE and SASE environments. The MNS page says it is included with Plus and Premier network tiers.
Partial; Unknown; Unknown. Needs review.
Entitlement for Managed SSE customers is still not shown in a package table.
SRC099: Globalgig SSE and SASE datasheet 2025 Orchestra Insight
Policy configuration ownership
Fundamental: core administration (accounts, group policy, access). Plus: monitoring, investigation, remediation guidance. Premier: full policy remediation and enforcement (ZTaaS).
Supported; GA; Included. Needs review.
SRC041: Globalgig expands managed security portfolio with scalable service tiers Tier descriptions
24x7 SOC
Premier SSE Management states 24/7/365 SOC support. Other tiers not stated.
Supported; GA; Included. Needs review.
SRC042: Globalgig Introduces Premier SSE Management Delivering 24/7 SOC Release body
MDR scope
Premier includes 24/7/365 SOC support, incident identification and investigation, and remediation. The source does not label this MDR.
Unknown; Unknown; Unknown. Needs review.
Do not call it MDR without Globalgig confirmation.
SRC089: Globalgig introduces Premier SSE Management (company copy) Premier benefits
UK service availability
Company states offices in US, UK, France, Switzerland and Netherlands. Service regions not stated.
Unknown; Unknown; Unknown. Needs review.
SRC042: Globalgig Introduces Premier SSE Management Delivering 24/7 SOC Release body
Service availability SLA
The Managed Network Services page refers to an enhanced MTTR SLA for Premier and states no metric. No Managed SSE SLA found.
Unknown; Unknown; Unknown. Needs review.
SRC088: Managed Network Services Premier tier
Recent changes
Tiers are named Fundamental, Plus, Premier (live page says Essential).
Supported; GA; Unknown. Needs review.
SRC041: Globalgig expands managed security portfolio with scalable service tiers Tier descriptions
Aryaka Unified SASE as a Service
CASB inline controls
CASB sits in the Aryaka Advanced Security Service and is not part of base Unified SASE.
Supported; GA; Separate product. Conflicting.
The AI>Secure datasheet lists CASB in the PoP security stack. Terms and datasheet disagree.
SRC084: Aryaka Services Description and Terms Sections D.2 and D.3
ZTNA private application access
Remote User is a separately procured managed ZTNA service licensed per remote user and delivered from Aryaka PoP gateways using Cloudbrink technology.
Supported; GA; Separate product. Conflicting.
The November 2025 release and datasheet describe Universal ZTNA as part of the stack. Terms and release disagree.
SRC084: Aryaka Services Description and Terms Section C.5
Inline DLP
Next-Gen DLP is not listed as a Unified SASE component in the terms.
Unknown; Unknown; Unknown. Conflicting.
It appears in the AI>Secure datasheet PoP security stack.
SRC084: Aryaka Services Description and Terms Section D.2
AI threat detection
AI>Observe is a separately purchasable AI/ML cybersecurity observability service using log analytics and anomaly identification, powered by SequrTek technology.
Partial; Unknown; Optional paid. Needs review.
Detection and operations AI. Not an administrator assistant.
SRC084: Aryaka Services Description and Terms Section D.5
AI feature availability
The November 2025 release said AI>Secure would be available in Q1 2026 and the solution brief still labels the integration "Available Q1 2026". No GA date found.
Unknown; Unknown; Optional paid. Conflicting.
SRC087: Unified SASE as a Service solution brief Integration table
GenAI application discovery
Discovers and classifies sanctioned, unsanctioned and tolerated AI applications.
Supported; Unknown; Optional paid. Needs review.
GA not confirmed.
SRC011: AI Secure datasheet Features list
Prompt and response DLP
AI>Secure inspects AI traffic with Next-Gen DLP entity recognition; add-on with site and remote user licences; needs Aryaka SD-WAN.
Supported; Unknown; Optional paid. Needs review.
GA not confirmed. Release said available Q1 2026.
SRC011: AI Secure datasheet Licensing section
Prompt injection protection
The Aryaka FAQ says AI>Secure detects and blocks prompt injection and jailbreak attempts.
Partial; Unknown; Optional paid. Conflicting.
Vendor-reported FAQ. The datasheet describes malicious URL and file blocking only. GA unconfirmed.
SRC086: Aryaka security FAQs AI Secure FAQ
AI provider operated service
AI Secure Gateway is deployed and managed by Aryaka per customer in public cloud (AWS, GCP).
Supported; GA; Optional paid. Needs review.
SRC011: AI Secure datasheet Deployment section
Co management permissions
The terms grant no direct customer gateway configuration rights, so co-management is not evidenced.
Unknown; Unknown; Unknown. Needs review.
SRC084: Aryaka Services Description and Terms Section C.5
Policy configuration ownership
Aryaka provides activation, orchestration, always-on monitoring and 24x7 NOC support, and fully manages ZTNA gateway configuration and policy against customer access requirements.
Supported; GA; Included. Needs review.
The customer distributes the client and provides Level 1 user support.
SRC084: Aryaka Services Description and Terms Sections D.2 and C.5
24x7 NOC
Aryaka NOC operates 24x7x365.
Supported; GA; Included. Needs review.
SRC052: SmartManage datasheet NOC section
Standard change service
Change types are Emergency (one hour lead time), Expedited, Normal (three business days with CAB review) and Standard.
Supported; GA; Included. Needs review.
Rollback is not stated.
SRC085: Aryaka Service Level Agreement Change management table
Backbone PoPs
40+ PoPs in business metro locations across Americas, EMEA, APAC. No country list.
Partial; GA; Included. Needs review.
SRC051: Global connectivity solution datasheet Specifications table
Coverage latency
Live page "sub-30ms to 95% of business population" not found. Datasheet gives no latency value.
Unknown; Unknown; Unknown. In progress.
Absence from the source is not evidence of absence.
SRC051: Global connectivity solution datasheet Searched, not stated
Service availability SLA
Private Core uptime target is 99.999%, monitored every minute and measured monthly. NGFW-SWG uptime target is also 99.999%. End-to-end 99.99% applies only with ANAP-HA, dual-ISP Last Mile and the specified services at both sites.
Partial; GA; Included. Needs review.
The 99.999% figure is not a universal customer commitment.
SRC085: Aryaka Service Level Agreement Sections 2, 3 and 14
P1 incident response
P1 monitoring acknowledgement within 10 minutes and technical response within 30 minutes. P2 response one hour, P3 one business day, P4 three business days.
Partial; GA; Included. Needs review.
Response commitments only. No restoration or resolution metric.
SRC085: Aryaka Service Level Agreement Priority matrix
Service credit entitlement
Claims are due by the end of the billing month after the incident month. Credits are issued within one billing cycle, capped at 25% of the impacted monthly fees, offset future fees and are the sole remedy.
Supported; GA; Included. Needs review.
Exclusions include maintenance, customer edge-link issues, misconfiguration, third-party technology, trial services and force majeure.
SRC085: Aryaka Service Level Agreement Service credit claims and exclusions
Licence tiers and add ons
Unified SASE site licences come in Small, Medium, Large and X-Large tiers.
Supported; GA; Included. Needs review.
SRC084: Aryaka Services Description and Terms Section D.2
Bandwidth and usage charges
Remote User is billed on the committed user count or actuals, whichever is higher, with excess users invoiced in arrears at the agreed burst multiplier. Enterprise Flex adds an Elastic Subscription billed monthly in arrears.
Supported; GA; Included. Needs review.
SRC084: Aryaka Services Description and Terms Sections B and C
Contracting entity
The terms name Aryaka Networks, Inc. as the provider under a Master Subscription Agreement and Order Form. No UK entity is named.
Partial; GA; Included. Needs review.
The UK is a Class A Last Mile location, which is not a contracting entity.
SRC084: Aryaka Services Description and Terms About Aryaka and definitions
Quantified customer outcomes
CEO states 100+ enterprise customers deployed Unified SASE.
Supported; GA; Unknown. Needs review.
Provider-reported, no named case read.
SRC050: Aryaka announces Unified SASE 2.0 with AI>Secure and Universal ZTNA Quote
Data and assistant access
Read the package data or the complete supplied article. The MCP tools compare_managed_sase_packages, get_managed_sase_research and search_managed_sase_evidence are available at /api/mcp/. Version 2026-10-15.1. Data source: Neon database.