# BT Business / BT Global - Managed SASE - Netify Knowledge Profile

## Netify Overview: BT Business / BT Global Managed SASE

BT is not a single-platform SASE company, but the UK’s largest telecommunications operator and managed service provider, delivering SASE as one service line within a vastly larger, publicly-listed (LSE: BT.A) group. For FY2026 (year ended 31 March 2026), BT Group reported revenue of £19.7 billion, adjusted EBITDA of £8.2 billion, and profit before tax of £1.4 billion - a large corporate scale, reflecting BT’s identity as a diversified national telecommunications operator rather than a standalone SASE vendor. BT’s SASE proposition is delivered under its own named managed-connectivity brand, Agile Connect, and is explicitly multi-platform rather than built on a single, proprietary technology stack: BT’s own materials and Netify’s own published research confirm managed SD-WAN delivered on Cisco Meraki and Versa, with managed SASE delivered on Fortinet and Meraki, reinforced by BT’s own Managed Detection and Response service. The current, Fortinet-based managed SASE offering - adding firewall-as-a-service, secure web gateway, cloud access security broker and zero-trust network access on top of BT’s existing managed SD-WAN - launched in its most recent expanded form in late 2025, following an earlier, distinct managed SASE service built on VMware technology that BT brought to market in January 2022. Buyers researching BT’s SASE history should understand these as two different underlying technology generations rather than a single, continuous product. BT’s core differentiator is not a proprietary SASE architecture but infrastructural depth: Openreach, BT’s wholly-owned but operationally separate access-network subsidiary (established 2006 under Ofcom/Enterprise Act 2002 undertakings), gives BT direct control over one of the deepest last-mile access estates in the UK market, combined with BT’s own international core network and long-established BT Security division. Evidence quality here differs in character from many pure-play SASE vendors: no fully-named, quantified customer success story with an identified company was found, though a real, detailed, primary-sourced case study describes an anonymised global financial-services customer’s deployment of Agile Connect with BT Managed Fortinet Firewall. Commercially, BT’s SASE offering is confirmed as quote-based with no published enterprise pricing, and buyers should confirm directly which specific underlying vendor platform (Fortinet, Meraki, or otherwise) is being proposed for their specific deployment, since BT’s own positioning is explicit that platform choice and packaging vary by customer.

## Core Architecture & Key Differentiators

BT's SASE architecture reflects its identity as a large, diversified telecommunications operator and systems integrator rather than a single-platform technology company: the differentiators are infrastructural and operational, not proprietary software.

### Genuine, owned last-mile and core network depth via Openreach.

 Netify's own published capability research on BT specifically confirms 'Openreach-adjacent last mile, owned core, and global reach through BT's international network' with 'dual-hub and diverse last-mile designs' as standard practise for resilience - a specific, structural advantage rooted in BT's ownership of Openreach rather than a SASE-platform feature.

### A confirmed, deliberately multi-platform technology strategy.

 Rather than committing to one SASE vendor, BT offers managed SD-WAN on Cisco Meraki and Versa, and managed SASE on Fortinet and Meraki, giving buyers genuine platform choice within a single managed-service contract - though this also means buyers must confirm exactly which platform is being proposed for their specific requirement, since capability and packaging vary between them.

### Sector-specific SASE positioning with named, concrete use cases.

 BT's own current SASE materials describe specific, named sector applications rather than generic capability claims - for retail, 'elastic SD-WAN and CASB to dynamically steer traffic and safeguard payment and customer data' during seasonal surges and pop-up environments; for financial services, ZTNA-based identity-first access with data residency support 'by keeping sensitive traffic within localised data paths'.

## Where BT Managed SASE Stands Out vs Where It Falls Short

| Evaluation Area | Strengths & Differentiators | Weaknesses & Watch-Outs |
| --- | --- | --- |
| Deployment & Ops | Genuine, confirmed field-engineering depth and UK-wide access-network ownership via Openreach, reinforced by a real, detailed (if anonymised) case study describing a full global, multi-country managed SD-WAN and firewall deployment. | BT's own positioning, per Netify's independent research, is explicit that a DIY/self-managed model is 'not BT's primary positioning' - buyers wanting a lighter-touch, self-administered platform should confirm the co-managed model and customer control boundaries directly via RACI documentation and a portal demonstration before committing. |
| Security & Analytics | BT Security provides a confirmed, named Managed Detection and Response service layered on top of the SASE offering, reinforced by BT's own confirmed 'unified monitoring services' and round-the-clock access to BT security experts. | The specific security-stack capabilities (RBI, DLP, granular CASB detail) depend on which underlying vendor platform (Fortinet vs. Meraki) is proposed for a given deployment - buyers should request platform-specific technical detail rather than assume uniform capability across BT's whole SASE portfolio. |
| Commercials | A single managed contract can combine access, CPE, the underlying vendor stack, and service-tier options together, reducing multi-vendor procurement complexity for buyers who value contractual simplicity. | No complete, public enterprise price was found in any source reviewed - pricing is confirmed quote-based, consistent with the pattern for the large majority of managed-service and carrier-delivered SASE offerings. |
| Compliance & Footprint | Confirmed HSCN (Health and Social Care Network) accreditation specifically supports NHS and healthcare-sector public bodies, reinforced by BT's own confirmed compliance-support materials describing managed logs, policies and controls to simplify staying compliant. | This research pass found no confirmation of platform-specific certifications (FedRAMP, ISO 27001 specifically for the SASE service, SOC 2) distinct from BT Group's broader, much larger corporate compliance posture - a genuine, specific gap worth closing directly for buyers with formal, platform-level certification requirements. |
| Scope & Boundaries | Genuine platform flexibility (Fortinet, Meraki, Versa) inside one managed relationship gives buyers real optionality without needing to manage multiple separate vendor contracts directly. | BT has offered managed SASE under at least two distinct underlying technology generations in recent years (VMware from January 2022, Fortinet from late 2024/2025) - buyers should confirm which specific, current generation and platform any proposal describes, rather than assume continuity with older, publicly-referenced BT SASE announcements. |

## Suitability Matrix: Who Should (and Shouldn't) Buy BT Managed SASE

### Recommended for:

 UK-headquartered or UK-anchored organisations wanting genuine underlay accountability and field-engineering depth alongside SD-WAN and SASE delivery, given BT's confirmed ownership of Openreach; public-sector and NHS-adjacent buyers specifically, given confirmed HSCN accreditation; and buyers wanting a single managed contract combining connectivity, hardware, and a choice of underlying SASE platform rather than separately procuring each element.

### Look elsewhere if:

 you want a fully self-managed, do-it-yourself platform, given BT's own confirmed positioning that this is not its primary delivery model; you need platform-specific compliance certifications (FedRAMP, an independently-confirmed ISO 27001 or SOC 2 for the SASE service itself) that this research pass could not confirm; or you want a single, proprietary, vendor-owned SASE architecture rather than a multi-platform managed-service model where the specific underlying technology varies by proposal.

## Netify Buyer Checklist: Questions for BT

Before placing BT Managed SASE on a shortlist, it's worth getting clear answers to the following, ideally in writing rather than taken on trust from a slide.

### On platform choice specifically:

 exactly which underlying SASE platform (Fortinet or Meraki) is being proposed for this deployment, and why was it selected over the alternative? ### On the co-managed model:

 what does the RACI split actually look like in practise, and can BT provide a live portal demonstration showing exactly what visibility and control the customer retains directly? ### On compliance:

 beyond the confirmed HSCN accreditation, does the specific SASE service itself carry any independently-verified certifications (ISO 27001, SOC 2, or equivalent), distinct from BT Group's broader corporate compliance posture? ### And on migration history:

 given BT has offered managed SASE under at least two different underlying technology generations (VMware from 2022, Fortinet from 2024-2025), what is the current status of any legacy VMware-based deployments, and what would a migration path to the current platform look like for an existing customer?




## Table 1 - Entity Identity and Market Position

| Field | Required data |
| --- | --- |
| Entity name | BT Group plc, operating this service via BT Business and BT Global under the named managed-connectivity brand Agile Connect, with managed SASE delivered on Fortinet and Cisco Meraki platforms specifically [[5]](#src5) [[6]](#src6) |
| Entity type | Telecommunications operator and managed service provider (publicly-listed parent company; SASE is one service line within a much larger, diversified group) |
| Headquarters | London, United Kingdom [[10]](#src10) |
| Ownership | Public company, listed on the London Stock Exchange (BT.A). For the financial year ended 31 March 2026, BT Group reported revenue of £19.7 billion (down 3% year-on-year), adjusted EBITDA of £8.2 billion (flat), profit before tax of £1.4 billion (up 8%), and capital expenditure of £5.1 billion. Allison Kirkby serves as CEO. BT's operations are organised into segments described variously across sources as Consumer, Business (or Enterprise/Global) and Openreach; Openreach - the UK access-network subsidiary responsible for the physical local-loop infrastructure connecting most UK homes and businesses - was established in 2006 following undertakings agreed with UK regulator Ofcom under the Enterprise Act 2002 to ensure equal access for rival telecom operators, and remains 100% owned by BT Group despite operating with additional regulatory governance independence. Openreach reported 2023/24 revenue of approximately £6.0 billion and operating income of approximately £3.8 billion. [[12]](#src12) [[10]](#src10) [[13]](#src13) [[15]](#src15) [[14]](#src14) [[11]](#src11) [[16]](#src16) |
| Primary proposition | A managed, multi-platform SD-WAN and SASE service (Agile Connect, with managed SASE on Fortinet and Meraki) combining BT's owned UK access-network depth (via Openreach), international core network, and BT Security's monitoring and Managed Detection and Response capability into a single managed contract. [[2]](#src2) [[5]](#src5) [[6]](#src6) |
| Core buyer segments | UK and multinational enterprises and public-sector organisations wanting a single managed contract for connectivity, hardware, and SASE security, particularly in retail, financial services, public sector, and healthcare (NHS-adjacent) sectors specifically. [[7]](#src7) [[6]](#src6) |
| Primary geographies | UK-anchored with genuine global reach for multinational customers, via BT's own international network - the specific case study evidence found in this research pass confirms multi-country deployment capability directly. [[17]](#src17) |
| Delivery model | Fully managed by default (BT's own confirmed core positioning), with a co-managed option available; customer control boundaries and the specific RACI split should be confirmed directly via documentation and a portal demonstration. [[8]](#src8) |
| Netify View | BT's identity in this category is defined by scale and infrastructural ownership rather than a single, proprietary SASE architecture - a genuinely different evaluation basis from a platform-focused, single-vendor SASE company. The confirmed ownership of Openreach is a real, structural differentiator no pure-play SASE vendor can replicate, but buyers must do more work to pin down exactly which underlying technology platform, service tier, and commercial terms apply to their specific deployment, given BT's own confirmed multi-platform, packaging-varies-by-customer positioning. |




## Table 2 - Product and Service Portfolio

| Product/service | Category | Current name/version | Native or partner | Target buyer | Delivery model | Source | Last verified |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Agile Connect | Managed SD-WAN [[8]](#src8) | Agile Connect [[8]](#src8) | Native BT-managed service, delivered on partner platforms (Cisco Meraki, Versa) [[8]](#src8) | All buyers [[8]](#src8) | Fully managed, with mixed connectivity options per site [[8]](#src8) | [[8]](#src8) | 22 Jul 2026 [[8]](#src8) |
| BT Managed SASE (Fortinet-based) | Converged SASE (SD-WAN + SSE) [[2]](#src2) | BT Managed SASE, powered by Fortinet [[2]](#src2) | Native BT-managed service on Fortinet's platform [[2]](#src2) | Buyers wanting a full, current-generation SASE service [[2]](#src2) | Cloud-delivered SSE layered on managed SD-WAN [[2]](#src2) | [[2]](#src2) | 22 Jul 2026 [[2]](#src2) |
| BT Managed SASE (Meraki-based) | Converged SASE (SD-WAN + SSE) [[7]](#src7) | BT Managed SASE on Cisco Meraki [[7]](#src7) | Native BT-managed service on Meraki's platform [[7]](#src7) | Buyers preferring Cisco/Meraki-based technology specifically [[7]](#src7) | Cloud-delivered SSE layered on managed SD-WAN [[7]](#src7) | [[7]](#src7) | 22 Jul 2026 [[7]](#src7) |
| BT Managed Fortinet Firewall | Firewall as a Service [[17]](#src17) | BT Managed Fortinet Firewall [[17]](#src17) | Native BT-managed service on Fortinet's platform [[17]](#src17) | Buyers wanting managed firewall alongside SD-WAN specifically [[17]](#src17) | Managed, edge-deployed with SSL decryption [[17]](#src17) | [[17]](#src17) | 22 Jul 2026 [[17]](#src17) |
| BT Security Managed Detection and Response | Managed security service [[7]](#src7) | BT Security MDR [[7]](#src7) | Native [[7]](#src7) | Buyers wanting integrated threat detection/response alongside SASE [[7]](#src7) | Managed, 24x7 [[7]](#src7) | [[7]](#src7) | 22 Jul 2026 [[7]](#src7) |
| BT-managed VMware SASE (legacy/historical) | Converged SASE (SD-WAN + SSE) - historical [[9]](#src9) | VMware SASE, managed by BT [[9]](#src9) | Native BT-managed service on VMware's platform (historical) [[9]](#src9) | Buyers on this earlier technology generation specifically [[9]](#src9) | Cloud-delivered, via a global network of over 150 VMware/partner PoPs at launch [[9]](#src9) | [[9]](#src9) | 22 Jul 2026 [[9]](#src9) |




## Table 3 - Core SASE, SSE and SD-WAN Feature Matrix

BT's SASE capability is delivered via named third-party platforms (principally Fortinet, with a Meraki-based alternative) rather than proprietary BT technology - several rows below reflect capabilities of the underlying platform as implemented and managed by BT, not a BT-built security stack.

| Capability | Availability | Product/module | Included or add-on | Deployment options | Key limitations | Evidence | Confidence | Netify View |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| SD-WAN | Native, and genuinely the platform's founding, long-established capability - BT's managed SD-WAN service (Agile Connect) predates the current managed SASE offering [[8]](#src8) | Agile Connect, delivered on Cisco Meraki and/or Versa [[8]](#src8) | Included [[8]](#src8) | Fully managed, with confirmed flexibility to mix different connectivity options per site [[8]](#src8) | None identified [[8]](#src8) | [[8]](#src8) | High | Confirmed with genuine specificity and reinforced by a real, detailed case study describing exactly this capability in a global, multi-country deployment. |
| Secure web gateway | Native, confirmed as part of the current, Fortinet-based managed SASE expansion [[2]](#src2) | BT Managed SASE (Fortinet SSE stack) [[2]](#src2) | Included [[2]](#src2) | Cloud-delivered [[2]](#src2) | Capability specifics depend on which underlying platform (Fortinet vs. Meraki) is proposed [[2]](#src2) | [[2]](#src2) | High | Confirmed directly in BT's own current launch materials as one of four named, core SSE capabilities added to the managed SD-WAN base. |
| CASB - inline | Native, confirmed with genuine sector-specific detail - explicitly named for retail, combined with elastic SD-WAN 'to dynamically steer traffic and safeguard payment and customer data' [[5]](#src5) [[6]](#src6) | BT Managed SASE (CASB) [[5]](#src5) [[6]](#src6) | Included [[5]](#src5) [[6]](#src6) | Cloud-delivered [[5]](#src5) [[6]](#src6) | Specific inline-versus-API-mode technical detail not itemised [[5]](#src5) [[6]](#src6) | [[5]](#src5) [[6]](#src6) | High | Genuinely well-evidenced with a specific, named, sector-relevant use case (retail payment/customer data protection) rather than a generic capability mention. |
| CASB - API | Not independently confirmed as a distinct out-of-band/API-mode capability in sources reviewed, separate from inline CASB | Unknown | Unknown | Unknown | Not confirmed as distinct from inline CASB | Not found in a Tier 1-2 source in this pass | Low | Flagged as an open question for direct vendor confirmation rather than assumed present or absent. |
| ZTNA | Native, confirmed with genuine sector-specific detail - explicitly named for financial services as 'secure, identity-based access through ZTNA' supporting data residency [[5]](#src5) [[6]](#src6) | BT Managed SASE (ZTNA) [[5]](#src5) [[6]](#src6) | Included [[5]](#src5) [[6]](#src6) | Cloud-delivered [[5]](#src5) [[6]](#src6) | None identified [[5]](#src5) [[6]](#src6) | [[5]](#src5) [[6]](#src6) | High | Genuinely well-evidenced with specific, named, sector-relevant detail (financial-services identity-based access, data residency support) rather than a generic ZTNA mention. |
| Firewall as a Service | Native, and confirmed with genuine technical specificity via a real, detailed case study - 'BT Managed Fortinet Firewall... detecting malicious activity at the edge of the network... built-in Secure Sockets Layer (SSL) decryption' [[17]](#src17) | BT Managed Fortinet Firewall [[17]](#src17) | Included, or available as a distinct add-on per the confirmed named product [[17]](#src17) | Managed, edge-deployed [[17]](#src17) | None identified [[17]](#src17) | [[17]](#src17) | High | Genuinely one of the strongest, most technically specific rows in this table - real, primary-sourced, case-study-evidenced detail (SSL decryption, edge-based malicious-activity detection) rather than a generic FWaaS claim. |
| Data loss prevention | Not independently confirmed as a distinct, named DLP product in sources reviewed | Unknown | Unknown | Unknown | Not confirmed | Not found in a Tier 1-2 source in this pass | Low | Evidence gap - worth a direct follow-up. |
| Remote browser isolation | Not independently confirmed as a distinct named capability in sources reviewed | Unknown | Unknown | Unknown | Not confirmed | Not found in a Tier 1-2 source in this pass | Low | Flag as an open question for direct vendor confirmation rather than assumed present or absent. |
| Digital experience monitoring | Native, implied via the confirmed 'unified monitoring services' and 'connecting insights across your network, users and devices' capability described directly by BT [[5]](#src5) [[6]](#src6) | BT unified monitoring [[5]](#src5) [[6]](#src6) | Included [[5]](#src5) [[6]](#src6) | Managed, 24x7 [[5]](#src5) [[6]](#src6) | A distinctly-branded DEM product name wasn't itemised [[5]](#src5) [[6]](#src6) | [[5]](#src5) [[6]](#src6) | Medium-High | Real, confirmed operational-visibility capability via a specific, primary-sourced description; a distinctly-branded DEM product name wasn't separately confirmed. |
| DNS security | Not independently confirmed as a distinct named feature in sources reviewed | Unknown | Unknown | Unknown | Not confirmed | Not found in a Tier 1-2 source in this pass | Low | Evidence gap. |
| Cloud firewall / cloud network security | Native, via the confirmed FWaaS capability described above [[17]](#src17) | BT Managed Fortinet Firewall [[17]](#src17) | Included [[17]](#src17) | Managed, edge-deployed [[17]](#src17) | None identified [[17]](#src17) | [[17]](#src17) | High | Same strong evidence as the FWaaS row above. |
| SaaS security posture | Not independently confirmed as a distinct, named DSPM/SSPM capability in sources reviewed | Unknown | Unknown | Unknown | Not confirmed | Not found in a Tier 1-2 source in this pass | Low | Evidence gap. |
| Threat intelligence | Native, implied via the confirmed BT Security Managed Detection and Response service and BT's own confirmed 'AI-powered proactive threat detection' [[2]](#src2) [[7]](#src7) | BT Security MDR [[2]](#src2) [[7]](#src7) | Included, or available as an enhanced managed-service tier [[2]](#src2) [[7]](#src7) | Managed, 24x7 [[2]](#src2) [[7]](#src7) | A dedicated, separately-named threat-research organisation (comparable to some competitors' named equivalents) wasn't itemised specifically for the SASE service [[2]](#src2) [[7]](#src7) | [[2]](#src2) [[7]](#src7) | High | Confirmed via both BT's own launch materials (AI-powered threat detection) and Netify's independent research (BT Security MDR) - genuinely concrete, corroborated evidence. |
| WAN optimisation | Native, implied via the confirmed 'traffic is prioritised from your devices to the SASE cloud node, avoiding public internet congestion' [[5]](#src5) [[6]](#src6) | Agile Connect / BT Managed SASE [[5]](#src5) [[6]](#src6) | Included [[5]](#src5) [[6]](#src6) | Managed [[5]](#src5) [[6]](#src6) | Named technical mechanisms (e.g. FEC, compression) not itemised [[5]](#src5) [[6]](#src6) | [[5]](#src5) [[6]](#src6) | Medium-High | A specific, direct, primary-sourced confirmation of traffic prioritisation to avoid congestion; granular optimisation mechanics weren't independently itemised. |
| Application-aware routing | Native, implied via the confirmed 'elastic SD-WAN' capability described directly for dynamic traffic steering in the retail sector specifically [[5]](#src5) [[6]](#src6) | Agile Connect (elastic SD-WAN) [[5]](#src5) [[6]](#src6) | Included [[5]](#src5) [[6]](#src6) | Managed [[5]](#src5) [[6]](#src6) | None identified [[5]](#src5) [[6]](#src6) | [[5]](#src5) [[6]](#src6) | Medium-High | A specific, named, sector-relevant capability ('elastic SD-WAN... to dynamically steer traffic') - genuinely concrete evidence. |
| Multi-cloud networking | Native, implied via the confirmed international network reach and multi-country customer deployment evidenced directly in the confirmed case study [[17]](#src17) | Agile Connect (global reach) [[17]](#src17) | Included [[17]](#src17) | Managed [[17]](#src17) | Specific, named hyperscaler cloud on-ramp partnerships weren't itemised by name [[17]](#src17) | [[17]](#src17) | Medium-High | Reasonable, well-supported inference from the confirmed multi-country deployment case study; named hyperscaler-specific integrations weren't independently itemised in this pass. |




## Table 4 - SD-WAN and Branch Capability

| Data point | Finding | Evidence | Confidence | Netify View |
| --- | --- | --- | --- | --- |
| Supported WAN underlays | Native, confirmed directly - Agile Connect provides 'the flexibility to mix different connectivity options for each of their sites', reinforced by the confirmed 'over-the-internet connection' capability described in the case study specifically [[8]](#src8) [[17]](#src17) | [[8]](#src8) [[17]](#src17) | High | Confirmed with genuine specificity via both primary BT positioning and real, case-study-evidenced deployment detail. |
| Edge form factors | Not independently confirmed with specific named hardware model detail in sources reviewed - the platform's confirmed architecture centres on managed service delivery with CPE included in the commercial model, rather than a distinctly-named, purpose-built hardware line [[8]](#src8) | [[8]](#src8) | Medium | A specific, worth-noting characteristic - CPE is confirmed as part of the managed commercial model (Table 16), though specific hardware model names weren't independently itemised. |
| Virtual/cloud edge support | Native, implied via the confirmed cloud-delivered SASE architecture and the 'SASE cloud node' terminology used directly by BT [[5]](#src5) [[6]](#src6) | [[5]](#src5) [[6]](#src6) | Medium-High | Reasonable, well-supported inference from the confirmed cloud-node architecture description. |
| 5G/LTE support | Not independently confirmed as a distinct, named capability for the SASE/SD-WAN service specifically in sources reviewed, though BT Group's own, much larger EE mobile network (5G+ coverage confirmed at 73% of the UK population as of FY2026) makes underlying 5G capability highly plausible at the parent-company level [[12]](#src12) | [[12]](#src12) | Low-Medium | A reasonable, though unconfirmed for the SASE service specifically, inference from BT Group's own substantial, confirmed 5G network investment via EE. |
| LEO satellite support | Unknown - not found in sources reviewed | Not found in a Tier 1-2 source in this pass | Low | Evidence gap. |
| Application identification | Native, implied via the confirmed elastic SD-WAN, dynamic-traffic-steering capability [[5]](#src5) [[6]](#src6) | [[5]](#src5) [[6]](#src6) | Medium-High | Reasonable inference from the confirmed dynamic traffic-steering architecture. |
| Dynamic path selection | Native, confirmed directly - 'elastic SD-WAN' dynamically steers traffic, and 'traffic is prioritised from your devices to the SASE cloud node, avoiding public internet congestion' [[5]](#src5) [[6]](#src6) | [[5]](#src5) [[6]](#src6) | High | A specific, direct, primary-sourced confirmation - genuinely concrete evidence. |
| Forward error correction / packet duplication | Not confirmed as a distinct named capability in sources reviewed | Not found in a Tier 1-2 source in this pass | Low | Evidence gap - flag rather than assume. |
| QoS and traffic engineering | Native, implied via the confirmed elastic, dynamically-steered traffic architecture [[5]](#src5) [[6]](#src6) | [[5]](#src5) [[6]](#src6) | Medium-High | Reasonable inference from the confirmed elastic SD-WAN architecture; granular QoS configuration mechanics not independently detailed. |
| Local internet breakout | Native, implied via the confirmed 'over-the-internet connection' capability described directly in the case study, and the confirmed SASE-cloud-node architecture avoiding public internet congestion for prioritised traffic specifically [[17]](#src17) | [[17]](#src17) | Medium-High | Reasonable, well-supported inference from the confirmed internet-based connectivity option evidenced in a real customer deployment. |
| Segmentation / VRF capability | Native, confirmed directly and with genuine technical specificity - 'the network is segmented too. So if a breach happens in one area, data in other areas stays protected' [[17]](#src17) | [[17]](#src17) | High | A specific, direct, case-study-evidenced confirmation of network segmentation for breach containment - genuinely concrete evidence. |
| High availability | Native, confirmed directly and with genuine specificity via Netify's own independent research - 'Dual-hub and diverse last-mile designs are standard practise for resilience' [[8]](#src8) | [[8]](#src8) | High | A specific, named architectural confirmation (dual-hub, diverse last-mile) - genuinely concrete evidence, reinforced by BT's confirmed ownership of the underlying UK access network via Openreach. |
| Zero-touch provisioning | Not independently confirmed with a specific, named zero-touch mechanism in sources reviewed, though the confirmed fully-managed delivery model implies BT-led deployment rather than customer-driven manual configuration by default [[8]](#src8) | [[8]](#src8) | Medium | Reasonable inference from the confirmed fully-managed delivery model; a specific, named zero-touch mechanism wasn't independently itemised. |
| Branch LAN/WLAN integration | Not independently confirmed as a distinct, named capability specifically for the SASE/SD-WAN service in sources reviewed, though BT's much broader telecommunications infrastructure business may address adjacent capability not confirmed as unified with this specific service in this pass | Not found in a Tier 1-2 source in this pass at this specificity | Low | Evidence gap - worth a direct follow-up, given BT's broader infrastructure portfolio may have relevant, adjacent capability not confirmed as unified with the SASE service specifically in this pass. |
| Brownfield migration support | Native, well-evidenced via a real, detailed case study directly describing exactly this scenario - a customer migrating from a legacy approach to 'an over-the-internet connection' to 'solve many of these problems', citing the inability 'to handle a network transformation like this in-house' [[17]](#src17) | [[17]](#src17) | High | Genuinely one of the platform's most concretely evidenced capabilities - a real, detailed customer example directly describing legacy-infrastructure migration challenges and the managed-service resolution. |




## Table 5 - Remote User, Mobile and BYOD Support

| Use case | Supported | Method/client | Operating systems | Identity/device requirements | User experience controls | Limitations | Netify View |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Managed laptops | Yes | Not itemised by specific client technology - dependent on the underlying platform (Fortinet or Meraki) proposed | Not itemised by specific OS in sources reviewed | Identity-based access confirmed generally via ZTNA (Table 3) | Not fully detailed | Platform-dependent; specific client detail not itemised | Confirmed at the architectural level via ZTNA; specific client/agent technology detail depends on the underlying platform proposed and wasn't independently itemised in this pass. |
| Unmanaged/BYOD devices | Not independently confirmed as a distinct, named BYOD-specific capability in sources reviewed | Unknown | Unknown | Unknown | Unknown | Not confirmed | Evidence gap - worth a direct follow-up, and likely dependent on which underlying platform (Fortinet or Meraki) is proposed for a specific deployment. |
| Mobile devices | Not independently confirmed with specific detail in sources reviewed | Unknown | Unknown | Unknown | Unknown | Not confirmed | Evidence gap. |
| Contractors/third parties | Not independently confirmed as a distinct capability in sources reviewed | Unknown | Unknown | Unknown | Unknown | Not confirmed by a named case study specifically about contractor access | Evidence gap. |
| Clientless access | Not independently confirmed as a distinct clientless mode in sources reviewed | Unknown | Unknown | Unknown | Unknown | Not confirmed | Evidence gap. |
| VDI environments | Unknown - not found in sources reviewed | Not found in public sources reviewed | - | - | - | Not confirmed | Evidence gap. |
| Privileged access | Unknown - not found in sources reviewed | Not found in public sources reviewed | - | - | - | Not confirmed | Evidence gap. |
| Remote browser isolation | Not independently confirmed (see Table 3) | Unknown | Unknown | Unknown | Unknown | Unknown | See Table 3 - an evidence gap, not a confirmed absence. |




## Table 6 - Architecture and Deployment Models

| Deployment model | Supported | Components required | Traffic path | Policy location | Typical use case | Complexity | Migration notes | Netify View |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Cloud-delivered | Yes, and genuinely the default model for the SSE/SASE half of the service | BT Managed SASE (Fortinet or Meraki cloud SSE) | Via the confirmed SASE cloud node architecture | Managed by BT, per the confirmed fully-managed default | All customers - core delivery model for the SASE/security layer | Low for the customer, given the confirmed fully-managed model | N/A - default | Confirmed via BT's own direct 'SASE cloud node' terminology and architecture description. |
| On-premises edge | Yes, via customer-premises equipment included in the confirmed managed commercial model | CPE (specific hardware model not itemised) | CPE → Agile Connect → cloud SASE layer | Managed by BT | Fixed branch sites | Low, given the confirmed fully-managed model | Not itemised in detail | Real, confirmed capability via the confirmed CPE-inclusive commercial model (Table 16); specific hardware model names weren't independently itemised. |
| Virtual edge | Not independently confirmed with specific detail in sources reviewed | Unknown | Unknown | Unknown | Unknown | Not confirmed | Not found in a Tier 1-2 source in this pass | Evidence gap. |
| Public cloud edge | Native, implied via the confirmed cloud-delivered SASE architecture | BT Managed SASE (cloud SSE) | Via the confirmed SASE cloud node | Managed by BT | Cloud-first organisations | Low | Not itemised for specific named hyperscalers | Confirmed at the architectural level; named hyperscaler-specific integration detail wasn't independently itemised. |
| Branch appliance | Yes, and genuinely well-evidenced via a real, detailed customer example | CPE plus Agile Connect managed service | Branch → Agile Connect → cloud SASE layer | Managed by BT | Distributed, multi-country branch estates | Low, given the confirmed fully-managed model | Confirmed directly via a real, detailed, multi-country case study (Table 4, 17) | Well-evidenced via specific, real, primary-sourced customer-deployment detail rather than only a generic capability claim. |
| Client-based remote access | Not independently confirmed with specific client-technology detail in sources reviewed | Unknown | Unknown | Unknown | Unknown | Not confirmed | N/A | See Table 5 - a genuine, specific evidence gap, likely dependent on which underlying platform (Fortinet or Meraki) is proposed. |
| Clientless remote access | Not independently confirmed as a distinct capability in sources reviewed | Unknown | Unknown | Unknown | Unknown | Not confirmed | N/A | See Table 5 - a genuine, specific evidence gap. |
| Hybrid deployment | Yes, implied via the confirmed combination of on-premises CPE, managed SD-WAN, and cloud-delivered SASE together under one contract, reinforced by the confirmed case study describing protection across on-premises and internet-based connectivity together | CPE plus Agile Connect plus BT Managed SASE (cloud) | Mixed | Managed by BT, unified under one contract | Most real-world enterprise estates with mixed on-premises and cloud requirements | Low for the customer, given the confirmed fully-managed model | Confirmed directly via the case study's described transition from a legacy approach to a hybrid, internet-augmented model | A genuine, confirmed architectural strength - the combination of owned last-mile infrastructure, managed CPE, and cloud-delivered SASE under one managed contract is a real, specific characteristic of BT's offering. |
| Co-managed deployment | Yes, confirmed as an available option, though Netify's own independent research specifically notes 'DIY/self-managed model is not BT's primary positioning' and recommends confirming 'customer control boundaries... via RACI and portal demo' | Not itemised with specific technical components | N/A | Shared between BT and customer IT staff, per a confirmed but not fully specified RACI split | Buyers wanting some direct operational involvement alongside BT-managed delivery | Not fully detailed - buyers should confirm the specific RACI split directly | N/A | A specific, important, independently-sourced caution - a co-managed option is confirmed to exist, but the exact division of responsibility should be confirmed directly rather than assumed, since BT's core, confirmed positioning centres on fully-managed delivery. |
| Fully managed deployment | Yes, and genuinely the platform's default, most consistently evidenced delivery model | Full BT-managed service (Agile Connect plus BT Managed SASE) | N/A | Managed by BT | Buyers wanting to minimise IT operational burden entirely - BT's own core, confirmed positioning | Very low for the customer | N/A | Genuinely the platform's clearest, most consistently-evidenced delivery model - fully-managed delivery is confirmed directly as BT's primary positioning, not merely one option among several. |




## Table 7 - Global Platform and Service Coverage

| Data point | Verified finding | Direct or partner | Regions/countries | Limitations | Evidence date | Confidence | Netify View |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Security PoPs / service edges | Not confirmed with a specific, quantified PoP-count figure for the current, Fortinet-based managed SASE service specifically in sources reviewed; the earlier, historical VMware-based service was confirmed at launch to use 'a global network of over 150 points of presence (PoPs) deployed by VMware and its SASE service pro[viders]' - a figure describing the prior, distinct technology generation rather than the current offering | Partner (Fortinet's or VMware's PoP network, per the relevant technology generation) [[9]](#src9) | Global, per the confirmed (historical) VMware-era figure; current, Fortinet-era figure not itemised [[9]](#src9) | The confirmed 150+-PoP figure describes the historical VMware-based service specifically, not confirmed as applicable to the current Fortinet-based offering [[9]](#src9) | [[9]](#src9) | Low-Medium (historical figure only; current-generation figure not found) | A specific, worth-noting evidentiary gap - the only quantified PoP figure found in this research pass describes BT's earlier, historical VMware-based SASE service rather than the current, Fortinet-based offering; buyers should request the current, platform-specific PoP count directly. |
| SD-WAN gateways / cloud gateways | Delivered via BT's own international core network and the relevant underlying platform's (Fortinet's or Meraki's) cloud infrastructure [[8]](#src8) | Direct (BT core network) and partner (platform-specific cloud infrastructure) [[8]](#src8) | UK-anchored with global reach, per BT's own confirmed international network [[8]](#src8) | Specific, quantified gateway-count figures not itemised [[8]](#src8) | [[8]](#src8) | Medium | Reasonable, well-supported inference from BT's own confirmed international network and the relevant platform's cloud infrastructure. |
| Private backbone | Native, and genuinely one of BT's clearest, most distinctive structural strengths - Netify's own independent research confirms BT operates with an 'owned core, and global reach through BT's international network' [[8]](#src8) | Direct (owned) [[8]](#src8) | Global, via BT's own international network [[8]](#src8) | None identified [[8]](#src8) | [[8]](#src8) | High | A specific, direct, independently-sourced confirmation of an owned core network - genuinely one of BT's most concrete, structural differentiators relative to platform-only SASE vendors without equivalent owned infrastructure. |
| Carrier interconnects | Native, implied via BT's own status as a major, established global telecommunications carrier with extensive, long-established interconnection relationships, though specific, itemised carrier/exchange detail wasn't independently confirmed in this pass | Direct | Global, per BT's own established carrier status | Specific, itemised carrier/exchange detail not itemised | Not found at this specificity in a Tier 1-2 source in this pass | Medium | A reasonable, well-supported inference from BT's own established, long-standing position as a major global telecommunications carrier; granular, itemised interconnect detail wasn't independently confirmed. |
| Public cloud on-ramps | Not independently confirmed with specific named hyperscaler detail in sources reviewed | Unknown | Unknown | Not detailed by named hyperscaler | Not found at this specificity in a Tier 1-2 source in this pass | Low-Medium | See Table 3, 6 for the related finding. |
| China coverage | Unknown - no China-specific data-centre or licensed-PoP detail found for the SASE/SD-WAN service specifically in sources reviewed, though BT Group's own, much larger, established global telecommunications business is highly likely to have some form of China-relevant presence at the parent-company level, not confirmed as unified with the SASE service specifically in this pass | Unknown at the SASE-service-specific level | Not specified for the SASE service specifically | No named China presence confirmed for the SASE service specifically | Not found in a Tier 1-2 source in this pass at this specificity | Low | Evidence gap for the SASE service specifically, though BT Group's own broader global telecommunications footprint makes some form of parent-company-level China presence plausible. |
| Middle East coverage | Unknown - not itemised for the SASE service specifically in sources reviewed | Unknown | Not specified | No named data centres found for the SASE service specifically | Not found in a Tier 1-2 source in this pass | Low | Evidence gap. |
| Africa coverage | Unknown - not itemised for the SASE service specifically in sources reviewed | Unknown | Not specified | No named data centres found for the SASE service specifically | Not found in a Tier 1-2 source in this pass | Low | Evidence gap. |
| Latin America coverage | Unknown - no specific evidence found for the SASE service specifically in this pass | Unknown | Not specified | No named data centres or customer evidence found for this region specifically | Not found in a Tier 1-2 source in this pass | Low | Evidence gap. |
| United Kingdom coverage | Strong fit, genuinely the best-evidenced region in this entire table [[8]](#src8) [[12]](#src12) | Direct (owned, via Openreach) [[8]](#src8) [[12]](#src12) | United Kingdom, comprehensively [[8]](#src8) [[12]](#src12) | None identified [[8]](#src8) [[12]](#src12) | [[8]](#src8) [[12]](#src12) | High | Genuinely the strongest-evidenced coverage finding in this entire profile - BT's confirmed ownership of Openreach, the UK's dominant last-mile access network, gives it a structural UK-coverage advantage no platform-only SASE vendor can replicate. |
| Data residency choices | Native, confirmed with genuine sector-specific detail for financial services specifically - ZTNA 'supports data residency by keeping sensitive traffic within localised data paths' [[5]](#src5) [[6]](#src6) | Direct (via BT's own network) [[5]](#src5) [[6]](#src6) | UK/localised, per the confirmed financial-services-specific claim [[5]](#src5) [[6]](#src6) | Broader, general data-residency architecture beyond this specific sector claim wasn't itemised [[5]](#src5) [[6]](#src6) | [[5]](#src5) [[6]](#src6) | Medium-High | A specific, named, sector-relevant confirmation of data-residency support - genuinely concrete evidence for this exact, named use case, even without a broader, general data-residency architecture page. |
| Sovereign/regional service options | Not confirmed as a distinct, named FedRAMP or equivalent sovereign-cloud authorization in sources reviewed; BT's own confirmed HSCN accreditation is the closest, specific, sector-relevant regional/sovereign-adjacent credential found in this pass | Direct (HSCN accreditation) [[7]](#src7) | United Kingdom, NHS/healthcare-adjacent public bodies specifically [[7]](#src7) | No FedRAMP or equivalent US federal authorization found for the SASE service specifically [[7]](#src7) | [[7]](#src7) | Medium-High | A real, specific, UK-relevant accreditation (HSCN) is confirmed; broader, international sovereign/regional credentials (e.g. FedRAMP) were not found for this service in this pass. |




## Table 8 - NOC, SOC, Support and Managed Operations

| Operational capability | Availability | Hours | Locations/coverage | Included or premium | Customer responsibility | Escalation/SLA | Evidence | Netify View |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Network operations centre | Native, and genuinely well-evidenced via Netify's own independent research confirming '24×7 NOC tooling' as a core evaluated capability for BT specifically [[7]](#src7) | 24x7, confirmed directly [[7]](#src7) | UK-wide, per confirmed UK-wide engineering reach [[7]](#src7) | Included, per the confirmed fully-managed default model [[7]](#src7) | Customer configures high-level policy; day-to-day NOC operations are BT-managed by default [[7]](#src7) | Not itemised with a specific numeric figure | [[7]](#src7) | A specific, direct, independently-sourced confirmation of 24x7 NOC capability - genuinely concrete evidence, reinforced by BT's confirmed UK-wide field-engineering reach. |
| Security operations centre | Native, and genuinely well-evidenced via the confirmed BT Security division and its named Managed Detection and Response service, reinforced by Netify's own independent research confirming 'MDR and SOC capability' as a core evaluated capability for BT specifically [[7]](#src7) | 24x7, per the confirmed MDR/SOC framing [[7]](#src7) | UK-wide, with international reach via BT's global network [[7]](#src7) | Included, or available as an enhanced managed-service tier [[7]](#src7) | Customer configures high-level policy; SOC operations are BT Security-managed [[7]](#src7) | Not itemised with a specific numeric figure | [[7]](#src7) | Real, confirmed capability via both BT's own named security division and Netify's independent research - genuinely credible, corroborated evidence. |
| 24x7 monitoring | Native, confirmed directly and repeatedly - 'Round-the-clock monitoring and access to BT security experts when you need them' [[5]](#src5) [[6]](#src6) | 24x7x365, confirmed directly [[5]](#src5) [[6]](#src6) | UK-wide, with international reach [[5]](#src5) [[6]](#src6) | Included [[5]](#src5) [[6]](#src6) | N/A | Not itemised with a specific numeric figure | [[5]](#src5) [[6]](#src6) | A specific, direct, primary-sourced confirmation - genuinely concrete evidence. |
| Incident response | Native, implied via the confirmed BT Security MDR service and BT's own confirmed 'AI-powered proactive threat detection', though a distinctly-named IR service with a specific, published SLA figure wasn't itemised [[7]](#src7) | Not confirmed with a specific figure | N/A | Included, or available as an enhanced managed-service tier [[7]](#src7) | N/A | Not itemised with a specific numeric figure | [[7]](#src7) | Real, confirmed capability via the confirmed MDR service; a distinctly-named IR product with a specific, published SLA figure wasn't independently itemised. |
| Configuration management | Native, via the confirmed fully-managed default delivery model [[8]](#src8) | N/A | N/A | Included [[8]](#src8) | Customer-managed via the co-managed option, or BT-managed by default [[8]](#src8) | N/A | [[8]](#src8) | Confirmed via the platform's core, fully-managed default architecture. |
| Policy management | Native, via the same confirmed fully-managed default architecture [[8]](#src8) | N/A | N/A | Included [[8]](#src8) | Customer or BT-managed, per the confirmed co-managed option [[8]](#src8) | N/A | [[8]](#src8) | Same evidence and finding as Configuration management above. |
| Change management | Native, implied via Netify's own independent research confirming 'change windows' as a core evaluated capability for BT specifically [[7]](#src7) | Not confirmed with a specific figure | N/A | Included [[7]](#src7) | Customer requests changes within confirmed change-window processes [[7]](#src7) | N/A | [[7]](#src7) | A specific, direct, independently-sourced confirmation of a formal change-management process ('change windows') - genuinely concrete evidence. |
| Carrier/last-mile management | Native, and genuinely one of BT's most structurally distinctive capabilities - direct ownership of Openreach gives BT genuine, first-party accountability for UK last-mile infrastructure that no platform-only SASE vendor can replicate [[8]](#src8) | 24x7, per the confirmed NOC/monitoring architecture [[8]](#src8) | UK-wide [[8]](#src8) | Included [[8]](#src8) | N/A - BT owns the underlying access network directly via Openreach | N/A | [[8]](#src8) | Genuinely the strongest, most structurally distinctive finding in this entire profile for this exact row - BT's direct ownership of Openreach means last-mile accountability sits with the same corporate group delivering the SASE service, a genuine structural advantage most competitors cannot offer. |
| Hardware replacement | Not independently confirmed with specific RMA/replacement terms in sources reviewed, though CPE is confirmed as included within the managed commercial model (Table 16), implying lifecycle management is BT's responsibility by default [[8]](#src8) | Not found | Not found | Included, per the confirmed CPE-inclusive commercial model [[8]](#src8) | N/A | Not confirmed | [[8]](#src8) | Reasonable inference from the confirmed CPE-inclusive commercial model; specific RMA/replacement terms weren't independently itemised. |
| Technical account management | Not confirmed as a distinct named support tier with specific TAM detail in sources reviewed | Not confirmed with specific figures | Not specified | Not confirmed | N/A | Not confirmed | Not found at this level of detail in a Tier 1-2 source in this pass | Evidence gap - worth a direct follow-up, particularly given BT's much broader enterprise account-management infrastructure across its wider portfolio. |
| Service reviews | Unknown - not found in sources reviewed | Not found | Not specified | Not confirmed | N/A | Not confirmed | Not found in a Tier 1-2 source in this pass | Evidence gap. |
| Professional services | Native, implied via Netify's own independent research confirming 'field engineering reach' as a core evaluated capability for BT specifically [[7]](#src7) | N/A | UK-wide field engineering reach confirmed directly [[7]](#src7) | Included, or available as an enhanced service tier [[7]](#src7) | N/A | N/A | [[7]](#src7) | A specific, direct, independently-sourced confirmation of field-engineering capability - genuinely concrete evidence, though specific standalone Professional Services pricing wasn't itemised. |
| Managed detection and response | Native, and genuinely well-evidenced via a specifically-named BT service [[7]](#src7) | BT Security MDR [[7]](#src7) | 24x7 [[7]](#src7) | Included, or available as an enhanced managed-service tier [[7]](#src7) | N/A | Not itemised with a specific numeric figure | [[7]](#src7) | A specific, named, credible, independently-corroborated managed-service product - genuinely concrete evidence, backed by BT's own long-established security division. |




## Table 9 - Configuration, Administration and Operating Effort

| Area | How it works | Primary interface | Skills required | Automation available | Operational effort | Known friction | Evidence | Netify View |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Initial tenant setup | Fully managed by default, evidenced via a real, detailed case study describing BT taking over an entire network transformation on the customer's behalf [[17]](#src17) | BT-managed, per the confirmed fully-managed default model [[17]](#src17) | Very low, given the confirmed fully-managed model [[17]](#src17) | Not itemised further | Genuinely well-evidenced as low-effort for the customer via a real, primary-sourced case study - the customer explicitly 'couldn't afford to handle a network transformation like this in-house' [[17]](#src17) | None significant identified [[17]](#src17) | [[17]](#src17) | A specific, real, case-study-evidenced confirmation of low customer-side effort - genuinely concrete evidence directly addressing why the customer chose a managed approach in the first place. |
| Policy creation | Managed by BT by default, with a confirmed co-managed option for buyers wanting more direct involvement [[8]](#src8) | BT-managed portal, or customer-accessible tools under the confirmed co-managed option [[8]](#src8) | Very low under the default managed model; benefits from technical familiarity under the co-managed option [[8]](#src8) | Not itemised further | Positioned as simplified via the confirmed fully-managed default architecture [[8]](#src8) | Buyers should confirm the exact RACI split directly (Table 6) [[8]](#src8) | [[8]](#src8) | Real, confirmed capability under the fully-managed default; the exact co-managed division of responsibility should be confirmed directly rather than assumed. |
| Branch onboarding | Fully managed, evidenced via a real, detailed, multi-country customer example [[17]](#src17) | BT-managed [[17]](#src17) | Very low, given the confirmed fully-managed model [[17]](#src17) | Not itemised as a distinct zero-touch mechanism, though implied by the managed-service model | Genuinely well-evidenced as low-effort for the customer, given the confirmed managed-service delivery and real case-study evidence [[17]](#src17) | None significant identified [[17]](#src17) | [[17]](#src17) | Well-evidenced via a real, detailed customer example at genuine, multi-country scale. |
| Remote-user onboarding | Not independently confirmed with specific client/agent deployment-effort detail in sources reviewed | Unknown | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not found in a Tier 1-2 source in this pass at this level of detail | See Table 5 - a genuine, specific evidence gap for the remote-user side of the platform specifically, likely dependent on which underlying platform is proposed. |
| Bulk changes | Unknown - not found in sources reviewed | Presumably BT-managed portal or API | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not found in public sources reviewed | Evidence gap. |
| Role-based administration | Unknown - not found in sources reviewed | Presumably BT-managed portal | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not found in public sources reviewed | Evidence gap. |
| Multi-tenancy | Not independently confirmed as a distinct, named MSP/multi-tenant capability in sources reviewed, though BT's own scale as one of the UK's largest managed service providers, per Netify's independent research, implies real, underlying multi-tenant operational capability exists in practise [[7]](#src7) | Not confirmed by name | Not confirmed | Not confirmed | Not confirmed | Not confirmed | [[7]](#src7) | Reasonable inference from BT's confirmed scale as the largest UK managed network and managed security provider; a distinctly-named, customer-facing multi-tenant product feature wasn't independently itemised. |
| Delegated administration | Not independently confirmed with specific detail in sources reviewed, beyond the general confirmed co-managed option | Presumably BT-managed portal | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not found in a Tier 1-2 source in this pass at this level of granular detail | Reasonable inference from the confirmed co-managed option; granular delegated-administration mechanics weren't independently itemised. |
| Troubleshooting | Native, and genuinely well-evidenced via BT's confirmed round-the-clock access to security experts and the confirmed centralised-visibility capability described directly in a real case study - 'better able to see and control their entire infrastructure and security' [[17]](#src17) | BT-managed portal/support [[17]](#src17) | Very low, given the confirmed managed-troubleshooting model [[17]](#src17) | Not itemised as a distinct AI-diagnostics feature | Positioned as low-effort via the confirmed centralised-visibility and expert-access architecture [[17]](#src17) | None significant identified [[17]](#src17) | [[17]](#src17) | A specific, real, case-study-evidenced confirmation of centralised visibility and control - genuinely concrete evidence. |
| Software/firmware lifecycle | Native, implied via the confirmed CPE-inclusive, fully-managed commercial model, which by design shifts lifecycle-management responsibility to BT [[8]](#src8) | BT-managed [[8]](#src8) | Very low, given the confirmed fully-managed model [[8]](#src8) | Automatic, given the managed-service delivery model [[8]](#src8) | Very low [[8]](#src8) | None significant identified [[8]](#src8) | [[8]](#src8) | Reasonable, well-supported inference from the confirmed fully-managed, CPE-inclusive commercial model. |
| Service-provider co-management | Yes, confirmed as an available option, though buyers should confirm the exact RACI split directly rather than assume equivalence with the confirmed, primary, fully-managed model (Table 6) [[8]](#src8) | BT-managed portal, with confirmed customer-accessible elements under the co-managed option [[8]](#src8) | Low for the customer under the confirmed managed default; moderate under the co-managed option depending on the chosen involvement level [[8]](#src8) | Confirmed, real option, though not itemised with full technical detail [[8]](#src8) | Low under the default managed model [[8]](#src8) | Buyers should confirm the RACI split and request a portal demonstration directly, per Netify's own independent research [[8]](#src8) | [[8]](#src8) | A genuine, confirmed option exists, though this is a specific, worth-flagging area requiring direct buyer confirmation rather than assumption, given BT's core positioning centres on fully-managed delivery by default. |




## Table 10 - Reporting, Statistics and Visibility

| Capability | Available | Audience | Real time or historical | Retention | Export/API | Customisation | Limitations | Netify View |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Executive dashboard | Not independently confirmed as a distinct executive-level view in sources reviewed | Presumably IT leadership | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Evidence gap. |
| Network health | Native, confirmed directly and with genuine specificity via a real case study - 'better able to see and control their entire infrastructure and security' [[17]](#src17) | IT operations [[17]](#src17) | Not confirmed in granular technical detail | Not confirmed | Not confirmed | Not confirmed | Not confirmed | A specific, direct, case-study-evidenced confirmation of centralised network visibility - genuinely concrete evidence. |
| Application performance | Not independently confirmed as a distinct, named application-performance dashboard in sources reviewed, beyond the general confirmed network-visibility capability | IT operations | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Reasonable inference from the confirmed general network-visibility capability; application-specific granularity wasn't independently itemised. |
| User experience | Not independently confirmed as a distinct, named DEM/UX-monitoring product in sources reviewed | IT operations, helpdesk | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Evidence gap for a dedicated, named user-experience-monitoring product specifically. |
| Security events | Native, implied via the confirmed BT Security MDR service and the confirmed 'connecting insights across your network, users and devices' capability | SOC/security teams | Real time, per the confirmed monitoring architecture | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Reasonable, well-supported inference from the confirmed MDR and unified-monitoring architecture; a distinct, named security-event reporting product wasn't independently itemised. |
| DLP events | Not confirmed given DLP itself is not confirmed as a distinct, named capability (Table 3) | Security/compliance teams | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not confirmed | See Table 3 - this row's evidence gap follows directly from the underlying DLP capability gap. |
| Threat reporting | Native, implied via the confirmed BT Security MDR service and BT's own confirmed AI-powered proactive threat-detection capability | SOC teams | Not confirmed in granular reporting-dashboard detail | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Reasonable inference from the confirmed MDR and AI-powered threat-detection architecture; a distinct, named threat-reporting dashboard product wasn't independently itemised. |
| Compliance reporting | Native, implied via BT's own confirmed 'logs, policies and controls are managed and kept up to date, so staying compliant is simpler' [[6]](#src6) | Compliance/audit teams [[6]](#src6) | Not confirmed in granular detail | Not confirmed | Not confirmed | Not confirmed | Not confirmed | A specific, direct, primary-sourced confirmation of managed logs, policies and controls specifically framed around compliance simplification - genuinely concrete evidence. |
| SLA reporting | Unknown - no specific SLA figures were found for this platform in this pass (see Table 8), so a self-service SLA reporting dashboard is unconfirmed by extension | IT operations [[7]](#src7) | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not confirmed | A compounded evidence gap given the underlying SLA figures themselves weren't found; Netify's own independent research confirms 'severity SLAs' exist as an evaluated capability generally, without itemising specific figures. |
| Site and circuit performance | Not independently confirmed as a distinct, named reporting product in sources reviewed, beyond the general confirmed network-visibility capability | IT operations | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Reasonable inference from the confirmed general network-visibility capability; a distinct, named site/circuit-performance reporting product wasn't independently itemised. |
| Remote-user experience | Not independently confirmed with specific detail in sources reviewed | IT operations, helpdesk | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Evidence gap. |
| Scheduled reports | Unknown - not found in sources reviewed | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Evidence gap. |
| Custom reports | Unknown - not found in sources reviewed | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Evidence gap. |
| Raw log access | Native, implied via BT's own confirmed 'logs, policies and controls are managed and kept up to date' capability, though granular, self-service raw-log-export detail wasn't itemised [[6]](#src6) | Security/SOC teams, integrations [[6]](#src6) | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Not confirmed | Reasonable inference from the confirmed managed-logs capability; self-service export/API detail wasn't independently itemised. |




## Table 11 - AI, Machine Learning and Automation

BT's confirmed AI investment is framed around threat detection specifically, layered on top of whichever underlying vendor platform (Fortinet or Meraki) is proposed - evidence in this table reflects BT's own positioning rather than a single, BT-built AI product.

| Feature | Specific function | Input data | Output/action | Human approval required | GA or preview | Evidence | Practical value | Limitations | Netify View |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| AI assistant/copilot | Not confirmed as a single, distinctly-named AI copilot product in sources reviewed | - | - | Not confirmed | Not confirmed | Not found as a distinctly-named product in this pass | Cannot fully assess without more specific evidence | BT's confirmed AI investment centres on threat detection specifically (see Anomaly detection row) rather than a general administrative AI copilot product | A specific, worth-noting distinction: no single, named AI copilot product was confirmed for this service specifically in the sources reviewed. |
| Natural-language querying | Unknown - not found in sources reviewed | - | - | Not confirmed | Not confirmed | Not found | Not confirmed | Not confirmed | Evidence gap. |
| Automated policy recommendation | Unknown - not found in sources reviewed | - | - | Not confirmed | Not confirmed | Not found | Not confirmed | Not confirmed | Evidence gap. |
| Anomaly detection | Native, confirmed directly and with genuine specificity - 'new AI-powered SSE capabilities... will enhance customers' oversight of their networks backed with AI-powered proactive threat detection' [[2]](#src2) [[3]](#src3) | Network/security telemetry [[2]](#src2) [[3]](#src3) | Automatic detection and alerting, feeding into BT's unified monitoring services [[2]](#src2) [[3]](#src3) | No - automatic, per the confirmed proactive-detection framing [[2]](#src2) [[3]](#src3) | GA, per BT's own current launch materials [[2]](#src2) [[3]](#src3) | [[2]](#src2) [[3]](#src3) | Well-evidenced via a specific, direct, primary-sourced claim naming both the AI-powered mechanism and its proactive framing explicitly [[2]](#src2) [[3]](#src3) | Underlying detection methodology and the specific technical contribution of BT versus the underlying platform (Fortinet) not itemised separately [[2]](#src2) [[3]](#src3) | A specific, direct, primary-sourced confirmation - genuinely concrete evidence, reinforced by independent trade-press corroboration of the same launch, though the precise split between BT's own value-add and the underlying Fortinet platform's native AI capability wasn't itemised separately. |
| Threat detection/classification | Native, via the confirmed AI-powered proactive threat-detection capability and the confirmed BT Security MDR service [[2]](#src2) [[4]](#src4) [[7]](#src7) | Network/security telemetry [[2]](#src2) [[4]](#src4) [[7]](#src7) | Threat detection and classification, escalated via BT Security [[2]](#src2) [[4]](#src4) [[7]](#src7) | No - automatic detection; human review for escalated incidents via BT Security [[2]](#src2) [[4]](#src4) [[7]](#src7) | GA [[2]](#src2) [[4]](#src4) [[7]](#src7) | [[2]](#src2) [[4]](#src4) [[7]](#src7) | Well evidenced, reinforced by a named, established internal security division (BT Security) [[2]](#src2) [[4]](#src4) [[7]](#src7) | Same underlying-platform-versus-BT-value-add distinction noted above [[2]](#src2) [[4]](#src4) [[7]](#src7) | Real, confirmed capability, reinforced by BT Security's long-established, named MDR service. |
| User/entity behaviour analytics | Not clearly confirmed as a distinct standalone UEBA product in sources reviewed | - | - | Not confirmed | Not confirmed | Not found as distinct in a Tier 1-2 source in this pass | Not confirmed | Not confirmed | Evidence gap - do not assume UEBA parity without direct confirmation. |
| Root-cause analysis | Native, implied via the confirmed centralised-visibility capability described directly in the case study - 'better able to see and control their entire infrastructure and security' [[17]](#src17) | Network/security telemetry [[17]](#src17) | Diagnostic insight surfaced via the confirmed centralised-visibility architecture [[17]](#src17) | Analyst/admin reviews and acts, per the confirmed managed-service model [[17]](#src17) | GA [[17]](#src17) | [[17]](#src17) | Real, credible evidence via a specific, primary-sourced, real-customer account [[17]](#src17) | Not itemised as a single, distinctly-named root-cause-analysis product | Reasonable, well-supported inference from the confirmed centralised-visibility capability, evidenced via a real customer account. |
| Digital experience diagnostics | Not independently confirmed as a distinct, named DEM-equivalent AI diagnostic product in sources reviewed | - | - | Not confirmed | Not confirmed | Not found in a Tier 1-2 source in this pass | Not confirmed | Not confirmed | Evidence gap, consistent with the Table 3, 10 DEM-related gaps. |
| Automated remediation | Not independently confirmed as a distinct, named automated-remediation capability (as opposed to detection/alerting) in sources reviewed | - | - | Not confirmed | Not confirmed | Not found in a Tier 1-2 source in this pass at sufficient specificity | Not confirmed | Not confirmed | Evidence gap - BT's confirmed AI framing centres on proactive detection rather than confirmed autonomous remediation actions specifically. |
| Capacity/path optimisation | Native, via the confirmed elastic SD-WAN, dynamic-traffic-steering architecture (Table 3, 4) [[5]](#src5) [[6]](#src6) | WAN/application telemetry [[5]](#src5) [[6]](#src6) | Automatic optimal-path selection and traffic prioritisation [[5]](#src5) [[6]](#src6) | No - automatic per platform architecture [[5]](#src5) [[6]](#src6) | GA [[5]](#src5) [[6]](#src6) | [[5]](#src5) [[6]](#src6) | Core, continuously-operating function, confirmed directly by name (elastic SD-WAN, SASE cloud node prioritisation) [[5]](#src5) [[6]](#src6) | Granular technical mechanics beyond the confirmed architecture description not itemised [[5]](#src5) [[6]](#src6) | Real, credible, named capability, consistent with the platform's confirmed dynamic-traffic-steering architecture. |
| Configuration generation | Unknown - not found in sources reviewed | - | - | Not confirmed | Not confirmed | Not found | Not confirmed | Not confirmed | Evidence gap. |
| Report summarisation | Unknown - not found in sources reviewed | - | - | Not confirmed | Not confirmed | Not found | Not confirmed | Not confirmed | Evidence gap. |
| Generative AI application controls | Not independently confirmed as a distinct, named GenAI-application-governance capability specifically for this platform in sources reviewed | - | - | Not confirmed | Not confirmed | Not found in a Tier 1-2 source in this pass at sufficient specificity | Not confirmed | Not confirmed | A genuine, specific gap - worth a direct follow-up on BT's specific roadmap here, particularly given the confirmed reference to 'AI-driven fraud and phishing' as a named threat category BT positions itself against for financial-services customers specifically. |
| AI data protection controls | Not independently confirmed as a distinct, named capability specific to AI data interactions in sources reviewed | - | - | Not confirmed | Not confirmed | Not found in a Tier 1-2 source in this pass | Not confirmed | Not confirmed | Evidence gap - worth a direct follow-up given how central this capability area has become across the wider SASE/SSE category. |




## Table 12 - Integrations and Ecosystem

| Integration | Category | Native/certified/API/partner | Direction of data flow | Required licence | Implementation notes | Evidence | Confidence | Netify View |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Microsoft Entra ID | Identity | Unknown - not found in sources reviewed | - | - | - | Not found | Low | Evidence gap. |
| Active Directory | Identity | Unknown - not found in sources reviewed | - | - | - | Not found | Low | Evidence gap. |
| Okta | Identity | Unknown - not found in sources reviewed | - | - | - | Not found | Low | Evidence gap. |
| Google Workspace | Identity/productivity | Unknown - not found in sources reviewed | - | - | - | Not found | Low | Evidence gap. |
| Microsoft 365 | Productivity/SaaS | Not separately confirmed as a distinct named integration in sources reviewed | Unknown | Not specified | Not detailed | Not found as a distinct, named integration in this pass | Low | Evidence gap. |
| Fortinet | SASE/SSE platform (core partner) [[2]](#src2) | Native partnership, and genuinely BT's current, primary SASE technology partner [[2]](#src2) | Bidirectional (full platform integration) [[2]](#src2) | Included within BT Managed SASE (Fortinet-based) [[2]](#src2) | Confirmed as the technology foundation for BT's current, expanded managed SASE offering, launched in its most recent form in late 2025 [[2]](#src2) | [[2]](#src2) | High | Genuinely the deepest, most current, most extensively-evidenced integration in this entire profile - not a peripheral feature but the technology foundation of BT's current managed SASE service. |
| Cisco Meraki | SD-WAN/SASE platform (alternative partner) [[7]](#src7) | Native partnership, confirmed as an alternative underlying platform for both managed SD-WAN and managed SASE [[7]](#src7) | Bidirectional (full platform integration) [[7]](#src7) | Included within the Meraki-based service option [[7]](#src7) | Confirmed directly via Netify's independent research as a named, distinct platform option alongside Fortinet [[7]](#src7) | [[7]](#src7) | High | A specific, named, confirmed alternative platform - genuinely concrete evidence of real platform choice within BT's managed service. |
| Versa Networks | SD-WAN platform (SD-WAN-specific partner) [[7]](#src7) | Native partnership, confirmed specifically for managed SD-WAN (Agile Connect) [[7]](#src7) | Bidirectional (SD-WAN platform integration) [[7]](#src7) | Included within the Versa-based SD-WAN service option [[7]](#src7) | Confirmed directly via Netify's independent research as a named SD-WAN platform partner, distinct from the SASE-specific Fortinet/Meraki partnerships [[7]](#src7) | [[7]](#src7) | High | A specific, named, confirmed SD-WAN-specific platform partnership - genuinely concrete evidence of BT's multi-platform strategy extending to the SD-WAN layer specifically. |
| VMware (historical) | SASE platform (legacy/historical partner) [[9]](#src9) | Native partnership, historical - the basis for BT's earlier, 2022-launched managed SASE service, distinct from the current Fortinet-based offering [[9]](#src9) | Bidirectional (historical, full platform integration) [[9]](#src9) | N/A - this was the technology foundation for an earlier, distinct product generation | Confirmed directly via a dated (January 2022), primary, wire-distributed press release - buyers should confirm current status of any legacy VMware-based deployments directly [[9]](#src9) | [[9]](#src9) | High (for the historical fact itself; current relevance/status not confirmed) | A specific, dated, confirmed historical partnership - genuinely important context for buyers researching BT's SASE history, distinct from and predating the current, confirmed Fortinet-based offering. |
| AWS | Cloud | Unknown - not found in sources reviewed | - | - | - | Not found | Low | Evidence gap. |
| Microsoft Azure | Cloud | Unknown - not found in sources reviewed | - | - | - | Not found | Low | Evidence gap. |
| Google Cloud | Cloud | Unknown - not found in sources reviewed | - | - | - | Not found | Low | Evidence gap. |
| Microsoft Sentinel | SIEM | Unknown - not found in sources reviewed | - | - | - | Not found | Low | Evidence gap. |
| Splunk | SIEM | Unknown - not found in sources reviewed | - | - | - | Not found | Low | Evidence gap - a specific, worth-flagging gap given how common this kind of pairing is across the wider SASE/SSE category. |
| ServiceNow | ITSM | Unknown - not found in sources reviewed | - | - | - | Not found | Low | Evidence gap. |
| CrowdStrike | EDR | Unknown - not found in sources reviewed | - | - | - | Not found | Low | Evidence gap. |
| Microsoft Defender | EDR | Unknown - not found in sources reviewed | - | - | - | Not found | Low | Evidence gap. |
| Nokia | 5G/telco infrastructure (parent-company-level partnership) | Confirmed at the BT Group parent-company level - a memorandum of understanding covering 5G monetisation via telco APIs, not confirmed as unified with the SASE/SD-WAN service specifically | N/A - parent-company-level agreement | N/A | Describes BT Group's broader telco-API strategy rather than the SASE service specifically | Not found at sufficient SASE-specific detail in a Tier 1-2 source in this pass | Low (real, dated, parent-company-level agreement; not confirmed as SASE-specific) | Real, dated, parent-company-level context; not confirmed as directly relevant to the SASE/SD-WAN service specifically in this pass. |
| REST API | Platform API | Not independently confirmed as a distinct, named public developer-API portal specifically for the SASE/SD-WAN service in sources reviewed | Unknown | Not specified | Not detailed | Not found as a distinct, named integration in this pass | Low | Evidence gap - worth a direct follow-up. |
| Syslog | Log export | Unknown - not found in sources reviewed | - | - | - | Not found | Low | Evidence gap. |
| SCIM/SAML/OIDC | Identity federation | Unknown - not found in sources reviewed | - | - | - | Not found | Low | Evidence gap - a specific, worth-flagging follow-up given how central this capability is across the wider SASE/SSE category. |




## Table 13 - Security, Compliance and Data Sovereignty

This research pass found strong evidence of BT's own confirmed regulatory accreditations relevant to its network operations (HSCN), but no independently-confirmed, SASE-service-specific certifications (ISO 27001, SOC 2, FedRAMP) distinct from BT Group's much broader, larger corporate compliance posture.

| Standard/requirement | Status | Scope | Certification or supporting capability | Region restrictions | Evidence | Last verified | Netify View |
| --- | --- | --- | --- | --- | --- | --- | --- |
| ISO 27001 | Not independently confirmed as a distinct, SASE-service-specific certification in sources reviewed; BT Group's own, much larger, established corporate scale makes broader ISO 27001 certification plausible at the parent-company level, though this wasn't confirmed as specifically applicable to the SASE service in this pass | Not confirmed at the SASE-service-specific level | Not confirmed | None identified | Not found at this specificity in a Tier 1-2 source in this pass | Not found | A genuine, specific evidence gap for the SASE service itself - worth a direct follow-up, given BT Group's own scale and established market position make some form of corporate-level ISO 27001 certification plausible even without SASE-service-specific confirmation. |
| SOC 2 | Not confirmed in sources reviewed | N/A | Not confirmed | N/A | Not found in a Tier 1-2 source in this pass | Not found | A genuine evidence gap worth a direct follow-up - this may reflect the UK/European market orientation, where SOC 2 (a US-originated attestation standard) is less commonly the lead certification, rather than confident evidence of absence. |
| PCI DSS | Not independently confirmed as a distinct, named certification for the SASE service specifically in sources reviewed, despite the confirmed retail-sector positioning explicitly addressing 'payment and customer data' protection | Not confirmed at the SASE-service-specific level | Not confirmed | N/A | Not found in a Tier 1-2 source in this pass at sufficient specificity | Not found | A specific, worth-flagging gap given the confirmed, direct retail/payment-data positioning (Table 3) - worth a direct follow-up for any retail-sector buyer specifically. |
| GDPR | Not separately itemised as a distinct compliance certification in sources reviewed, though BT's own confirmed UK/European market orientation and the confirmed data-residency claim (Table 7) make GDPR-aligned data handling highly plausible in practise [[5]](#src5) [[6]](#src6) | UK/EU-relevant, per BT's own market orientation [[5]](#src5) [[6]](#src6) | Not confirmed as a distinct, named certification | EU/UK relevant [[5]](#src5) [[6]](#src6) | [[5]](#src5) [[6]](#src6) | 22 Jul 2026 [[5]](#src5) [[6]](#src6) | A reasonable, well-supported inference from BT's own confirmed UK/EU market orientation and the confirmed data-residency claim; a distinct, named GDPR-compliance certification wasn't independently itemised. |
| HIPAA | Not applicable in the traditional sense - HIPAA is a US-specific healthcare regulation; BT's confirmed healthcare-adjacent accreditation (HSCN) is a UK-specific equivalent instead | N/A | Not applicable (UK market orientation) | US healthcare-relevant only | N/A | N/A | Not applicable given BT's confirmed UK market orientation - see the HSCN row below for the relevant UK-specific healthcare accreditation instead. |
| HSCN (Health and Social Care Network) accreditation | Confirmed directly via Netify's own independent research [[7]](#src7) | UK NHS and social-care-sector organisations specifically [[7]](#src7) | HSCN accreditation [[7]](#src7) | United Kingdom [[7]](#src7) | [[7]](#src7) | 25 Jun 2026 [[7]](#src7) | A specific, real, UK-relevant, sector-specific accreditation - genuinely concrete evidence for NHS and social-care-sector buyers specifically, and a real differentiator most non-UK-focused SASE vendors would not hold. |
| NIS2 relevance | Unknown - not found in sources reviewed | N/A | Not confirmed | EU | Not found in a Tier 1-2 source in this pass | Not found | Evidence gap - worth a direct follow-up given BT's genuine European market presence. |
| DORA relevance | Unknown - not found in sources reviewed, despite confirmed direct financial-services-sector positioning (Table 3, 14) | N/A | Not confirmed | EU financial services | Not found in a Tier 1-2 source in this pass | Not found | A specific, worth-flagging gap given the confirmed direct financial-services-sector positioning - worth a direct follow-up for any EU financial-services buyer specifically. |
| FedRAMP | Not applicable in the traditional sense - FedRAMP is a US-specific federal-government cloud-authorization programme; BT's confirmed market orientation and accreditations (HSCN) are UK-specific instead | N/A | Not applicable (UK market orientation) | US federal only | N/A | N/A | Not applicable given BT's confirmed UK market orientation - no evidence was sought or expected for this US-specific framework. |
| UK public sector frameworks | Native, implied via the confirmed HSCN accreditation and BT's own established, long-standing position as a major UK public-sector technology supplier, though a comprehensive, itemised list of specific UK public-sector frameworks (e.g. G-Cloud) wasn't independently confirmed for the SASE service specifically in this pass [[7]](#src7) | UK public sector [[7]](#src7) | HSCN confirmed specifically; broader frameworks not itemised [[7]](#src7) | United Kingdom [[7]](#src7) | [[7]](#src7) | 25 Jun 2026 [[7]](#src7) | A real, specific, confirmed UK public-sector accreditation (HSCN) exists; a broader, comprehensive framework list wasn't independently itemised in this pass. |
| Data residency | Native, confirmed with genuine sector-specific detail for financial services specifically (Table 7) - 'supports data residency by keeping sensitive traffic within localised data paths' [[5]](#src5) [[6]](#src6) | UK/localised, per the confirmed financial-services-specific claim [[5]](#src5) [[6]](#src6) | Confirmed at the mechanism level for this specific sector claim [[5]](#src5) [[6]](#src6) | UK-relevant [[5]](#src5) [[6]](#src6) | [[5]](#src5) [[6]](#src6) | 22 Jul 2026 [[5]](#src5) [[6]](#src6) | A specific, named, sector-relevant confirmation; a broader, general data-residency architecture beyond this specific claim wasn't itemised. |
| Encryption/key management | Native, confirmed with specific technical detail via a real case study - 'built-in Secure Sockets Layer (SSL) decryption keeps every user safe' [[17]](#src17) | BT Managed Fortinet Firewall specifically [[17]](#src17) | SSL decryption confirmed directly [[17]](#src17) | None identified [[17]](#src17) | [[17]](#src17) | 22 Jul 2026 [[17]](#src17) | A specific, named, case-study-evidenced encryption capability - genuinely concrete evidence, though scoped specifically to the confirmed Fortinet-based firewall product rather than the platform generally. |
| Logging/auditability | Native, confirmed directly - 'Logs, policies and controls are managed and kept up to date, so staying compliant is simpler' [[5]](#src5) [[6]](#src6) | Platform-wide, per BT's own direct claim [[5]](#src5) [[6]](#src6) | Not confirmed at granular technical detail | None identified [[5]](#src5) [[6]](#src6) | [[5]](#src5) [[6]](#src6) | 22 Jul 2026 [[5]](#src5) [[6]](#src6) | A specific, direct, primary-sourced confirmation explicitly framed around compliance simplification - genuinely concrete evidence, even without granular, technical export/retention detail. |




## Table 14 - Sector Suitability

BT's own current SASE materials name specific sectors directly with concrete, sector-relevant capability claims - genuinely stronger evidence than a generic sector list, even without individually-named customer case studies for most sectors.

| Sector | Suitability | Relevant capabilities | Relevant compliance | Supporting case studies | Service/coverage considerations | Limitations | Netify View |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Financial services | Strong fit, extensively evidenced [[6]](#src6) [[17]](#src17) | ZTNA-based identity-first access, data-residency support via localised traffic paths, and a real, detailed (anonymised) case study directly in this sector [[6]](#src6) [[17]](#src17) | PCI DSS and DORA not independently confirmed (Table 13), though data residency is confirmed directly for this sector specifically [[6]](#src6) [[17]](#src17) | A real, detailed, primary-sourced (anonymised) global financial-services customer case study, describing Agile Connect plus BT Managed Fortinet Firewall deployment [[6]](#src6) [[17]](#src17) | Multi-country deployment confirmed directly in the case study [[6]](#src6) [[17]](#src17) | The named certification gaps (PCI DSS, DORA) are worth flagging directly for this specific sector [[6]](#src6) [[17]](#src17) | Genuinely the best-evidenced sector in this entire profile - both specific, named sector-relevant product positioning (ZTNA, data residency) and a real, detailed case study exist together, even without the customer's name disclosed. |
| Retail | Good fit, evidenced via specific, named product positioning [[6]](#src6) | Elastic SD-WAN and CASB, explicitly named for dynamically steering traffic and safeguarding payment/customer data during seasonal surges and pop-up environments [[6]](#src6) | PCI DSS not independently confirmed (Table 13), despite the direct payment-data positioning [[6]](#src6) | None found as a named individual case study in this pass [[6]](#src6) | N/A | Specific, named product positioning exists without a named individual retail case study [[6]](#src6) | A genuinely specific, concrete sector-fit claim (seasonal surges, pop-up environments, payment/customer data) - worth highlighting directly, even without a named case study to reinforce it. |
| Public sector (general) | Good fit, evidenced generally via BT's own confirmed public-sector positioning and established market position [[7]](#src7) | Not assessed in specific technical detail for this sector generally, beyond the confirmed HSCN accreditation for healthcare-adjacent public bodies specifically (see Healthcare row) | HSCN confirmed for healthcare-adjacent bodies specifically; broader public-sector framework detail not itemised [[7]](#src7) | None found as a named individual case study in this pass [[7]](#src7) | United Kingdom [[7]](#src7) | General sector confirmation exists without a named individual case study [[7]](#src7) | Real, credible fit given BT's established, long-standing position as a major UK public-sector technology supplier, even without a named public-sector case study specifically for the SASE service. |
| Healthcare / NHS | Strong fit, evidenced via a specific, named UK accreditation [[7]](#src7) | HSCN accreditation directly supports NHS and social-care-sector connectivity requirements [[7]](#src7) | HSCN confirmed directly (Table 13) [[7]](#src7) | None found as a named individual case study in this pass [[7]](#src7) | United Kingdom [[7]](#src7) | A specific, named accreditation exists without a named individual healthcare case study [[7]](#src7) | A genuine, specific, UK-relevant differentiator - HSCN accreditation is a real, checkable credential most non-UK-focused SASE vendors would not hold, even without a named case study to reinforce it. |
| Manufacturing | Unknown - not assessed, no case study or sector-specific product positioning found in this pass | Not assessed in detail | Not assessed | None found | N/A | No case study or sector-specific positioning found | Evidence gap. |
| Multi-national / global enterprise | Good fit, evidenced via a real, detailed case study describing exactly this scenario [[17]](#src17) | Genuine multi-country deployment capability, confirmed directly via BT's own international network and a real, detailed case study [[17]](#src17) | Not assessed for sector-specific frameworks | The same financial-services case study confirms multi-country deployment directly [[17]](#src17) | Global, via BT's own confirmed international network [[17]](#src17) | The available case-study evidence, while real and detailed, is specific to the financial-services sector rather than confirmed across other multinational-enterprise contexts [[17]](#src17) | Real, credible, genuinely well-evidenced fit via a specific, detailed case study, even though the only such example found in this pass happens to be financial-services-specific. |




## Table 15 - Organisation and Estate Suitability

| Buyer profile | Suitability | Why | Operational prerequisites | Commercial considerations | Evidence | Netify View |
| --- | --- | --- | --- | --- | --- | --- |
| SME | Conditional fit [[8]](#src8) | BT's core positioning, per Netify's own independent research, centres on fully-managed delivery for larger, more complex estates rather than confirmed SME-specific packaging; no SME-specific pricing tier or positioning was found in this pass [[8]](#src8) | Minimal internal skills needed given the confirmed fully-managed default model [[8]](#src8) | No confirmed entry-level pricing tier found in this pass [[8]](#src8) | [[8]](#src8) | A genuine, specific evidence gap for SME-specific fit - worth confirming directly rather than assuming this platform is optimised for the smallest buyer segment. |
| Mid-market | Good fit, evidenced at a general level | BT's confirmed multi-platform flexibility and managed-service model support genuine mid-market applicability, though no named mid-market case study was found specifically | Benefits from, but doesn't strictly require, extensive internal networking expertise given the confirmed managed model | Not itemised | Not found in a Tier 1-2 source in this pass at this specificity | A reasonable, though not extensively evidenced, fit for this buyer profile. |
| Large enterprise | Strong fit, extensively evidenced [[17]](#src17) | A real, detailed case study describes exactly this profile - a global, multi-country financial-services enterprise unable to manage a network transformation in-house, reinforced by BT's own established position as a major, large-scale UK and international managed service provider [[17]](#src17) | Requires coordination between internal IT and BT-managed delivery, though substantially reduced by the confirmed fully-managed default [[17]](#src17) | Custom enterprise pricing, quote-based [[17]](#src17) | [[17]](#src17) | Genuinely the best-evidenced buyer profile in this entire table - a real, detailed, primary-sourced case study directly confirms fit for exactly this buyer type. |
| Global multinational | Good fit, evidenced [[17]](#src17) | The confirmed case study directly describes a multi-country deployment, reinforced by BT's own confirmed international network reach [[17]](#src17) | Needs Netify/buyer to verify specific-country coverage directly, given the Table 7 general-versus-specific coverage-detail gap outside the UK [[17]](#src17) | Custom enterprise pricing [[17]](#src17) | [[17]](#src17) | Real, credible fit for this buyer profile, backed by a specific, real, detailed multi-country case study, though country-by-country coverage detail beyond the UK wasn't independently itemised. |
| Highly distributed branch estate | Strong fit, evidenced | The confirmed elastic SD-WAN and flexible connectivity-mixing capability directly supports this buyer profile, reinforced by the confirmed managed CPE model reducing per-site deployment burden | Low, given the confirmed fully-managed model | Not itemised | Table 3, 4, 6 findings | Real, confirmed capability, reinforced by BT's own long-established managed-connectivity heritage. |
| Remote-user-heavy organisation | Unknown - thin evidence specifically for the remote-user/client side of the platform (see Table 5) | Not assessed with confidence | Not assessed | Not assessed | Table 5 findings | A genuine, specific evidence gap - this profile's research skewed toward the site-to-site SD-WAN, managed-operations, and sector-specific-positioning sides of the service, leaving remote-user/client-side evidence comparatively thin. |
| Cloud-first organisation | Good fit, evidenced at a general level | Confirmed cloud-delivered SASE architecture ('SASE cloud node') supports this buyer profile | None significant identified | Not assessed | Table 3, 6 findings | Real, credible fit; specific, named hyperscaler-level integration detail is a genuine, specific gap worth closing directly. |
| Regulated organisation (UK-specific) | Strong fit specifically for UK healthcare/social-care requirements, given the confirmed HSCN accreditation; conditional for other regulated frameworks | HSCN is confirmed directly and is a genuine, specific, UK-relevant differentiator; PCI DSS, DORA, ISO 27001, and SOC 2 were not independently confirmed for the SASE service specifically | Buyer must independently verify sector-specific compliance status directly with BT for anything outside the confirmed HSCN scope | Not assessed | Table 13 findings | A genuinely strong, specific compliance foundation for UK healthcare/social-care buyers specifically, tempered by the specific, worth-flagging absence of confirmed platform-level certifications for other regulated frameworks. |
| Lean IT team | Strong fit, extensively evidenced [[8]](#src8) [[17]](#src17) | BT's core, confirmed positioning centres on fully-managed delivery precisely to reduce internal operational burden, reinforced by a real, detailed case study describing a customer explicitly unable to manage a network transformation in-house [[8]](#src8) [[17]](#src17) | Minimal training investment implied by the confirmed fully-managed default model [[8]](#src8) [[17]](#src17) | Not assessed | [[8]](#src8) [[17]](#src17) | A genuinely credible, well-evidenced fit - the confirmed, real customer account of exactly this scenario (insufficient in-house resources) gives this buyer profile real, concrete evidence. |
| Mature NetOps/SecOps team | Conditional fit [[8]](#src8) | Mature teams get real, confirmed flexibility via the confirmed co-managed option, though this platform's core, most extensively evidenced strength centres on fully-managed delivery rather than deep, self-directed technical control for sophisticated in-house teams specifically [[8]](#src8) | Mature teams should confirm the exact RACI split directly, per Netify's own independent research recommendation [[8]](#src8) | Not assessed | [[8]](#src8) | A reasonable fit for teams specifically wanting the co-managed flexibility option; teams wanting maximum self-directed, self-managed control should confirm this platform's fully-managed default model and RACI boundaries fit their preference directly. |




## Table 16 - Commercial and Licensing Data

No pricing has been published for BT's managed SASE service in any source found in this research pass - Netify's own independent research explicitly confirms this is 'Quote-based. No complete public enterprise price was found in reviewed sources.'

| Commercial field | Finding | Publicly disclosed | Variables/drivers | Buyer questions | Evidence | Confidence | Netify View |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Licensing unit | Confirmed to be structured as a quote-based, managed-service model combining access, CPE, vendor stack, and service-tier options together, per Netify's own independent research [[8]](#src8) | Partially - the general commercial-model structure is confirmed; specific per-unit pricing is not [[8]](#src8) | Access type, CPE model, vendor platform selected (Fortinet/Meraki/Versa), service tier [[8]](#src8) | What is the actual cost structure at our expected site count and required service tier? [[8]](#src8) | [[8]](#src8) | Medium-High | Confirmed at the structural level via a credible, independent, dated (May 2026) source - genuinely more concrete than an entirely undocumented commercial model. |
| Subscription terms | Not itemised with specific term-length figures in sources reviewed | Not found | Not confirmed | What subscription term lengths does BT offer, and what discount applies to longer commitments? | Not found in a Tier 1-2 source in this pass | Low | Evidence gap. |
| Bundles/editions | Confirmed to exist as multiple, distinct offerings - Agile Connect (SD-WAN), BT Managed SASE (Fortinet-based), BT Managed SASE (Meraki-based), and BT Managed Fortinet Firewall as a potentially separate product - each separately named | Partially - product-line existence and names are confirmed; specific commercial tier boundaries and bundling rules were not itemised | Feature requirements, platform selected, deployment scale | Exactly which Table 3 capabilities are included in the base SD-WAN service versus available only within the full managed SASE upgrade? | Table 2 findings | Medium-High | A specific, confirmed multi-product structure - genuinely more concrete than a single, undifferentiated product name, even without published pricing per line. |
| Required add-ons | Not itemised with specific figures in sources reviewed, beyond the confirmed distinction between base SD-WAN and the full managed SASE upgrade | Not found beyond the confirmed tier structure | Buyer's required feature set | Are all Table 3 capabilities included within the base managed SASE tier, or are some priced as separate add-ons (e.g. the specifically-named BT Managed Fortinet Firewall)? | Not found in a Tier 1-2 source in this pass at this level of detail | Low-Medium | Evidence gap beyond the confirmed general product-tier structure. |
| Hardware charges | Confirmed to exist as a real, included commercial component - the quote-based commercial model is confirmed directly to include CPE alongside access and vendor stack [[8]](#src8) | Partially - the existence of a CPE component is confirmed directly; specific pricing is not [[8]](#src8) | CPE model selected, deployment scale [[8]](#src8) | What is the current cost of the required CPE hardware at our expected deployment scale, and is it included in the base quote or a separate line item? [[8]](#src8) | [[8]](#src8) | Medium-High | A specific, confirmed commercial-model description - genuinely more concrete than the pattern found across most vendors in this category, even without published hardware pricing. |
| Bandwidth charging | Not itemised as a distinct bandwidth-tier charging dimension in sources reviewed | Not found | N/A | Is there any bandwidth-related charge, separate from the base access/service subscription? | Not found in a Tier 1-2 source in this pass | Low | Evidence gap. |
| User charging | Not itemised with a specific figure in any source reviewed | Not found | User count, tier selected | What is the actual per-user rate at our expected volume, if user-based charging applies at all to this predominantly site/access-based commercial model? | Not found in a Tier 1-2 source in this pass | Low | Evidence gap. |
| Site charging | Confirmed to exist as the primary commercial dimension, per the confirmed quote-based, access-plus-CPE-plus-stack commercial model [[8]](#src8) | Partially - the site-based commercial logic is confirmed; specific per-site figures are not [[8]](#src8) | Site count, access type, CPE model, vendor platform selected [[8]](#src8) | What is the actual per-site cost at our target branch count, factoring in access, CPE, and the selected vendor platform? [[8]](#src8) | [[8]](#src8) | Medium-High | A specific, confirmed commercial-model logic - genuinely more concrete than an entirely undocumented pricing structure. |
| Support tiers | Not itemised with named tiers and specific SLA figures in sources reviewed, though Netify's own independent research confirms 'severity SLAs' exist as a general, evaluated capability | Partially - the existence of severity-based SLAs is confirmed generally; specific figures are not [[7]](#src7) | Support tier selected [[7]](#src7) | What named support tiers and severity-SLA response times exist specifically? [[7]](#src7) | [[7]](#src7) | Medium | A specific, confirmed general existence of severity-based SLA structure - genuinely more concrete than the pattern found across most vendors in this category, even without specific published figures. |
| Professional services | Not confirmed as a distinct, separately-priced Professional Services product in sources reviewed, consistent with BT's confirmed core positioning that implementation is included within the fully-managed default model | N/A | N/A | Is any element of deployment or migration support priced separately from the base managed-service quote? | Consistent with the confirmed fully-managed delivery model found throughout this profile | Medium | A genuine, structural finding rather than a gap - this platform's entire value proposition centres on included, managed implementation rather than a separately-priced Professional Services line item. |
| Managed service charges | Confirmed to exist as the platform's entire, default commercial and delivery model, though specific, itemised managed-service pricing wasn't found in this pass | Partially - the managed-service model itself is confirmed and central; specific pricing is not | Service scope, level of co-management chosen | What does the confirmed fully-managed model cost at our expected scale, and does choosing the co-managed option instead affect pricing? | Table 6, 8, 9 findings | Medium | A specific, worth-asking question given the confirmed choice between fully-managed and co-managed models - Netify should confirm directly whether this choice affects pricing. |
| Minimum commitments | Unknown - not found in sources reviewed | Not found | Not confirmed | Is there a minimum site count, user count, or contract value? | Not found in a Tier 1-2 source in this pass | Low | Evidence gap. |
| Renewal/true-up considerations | Not itemised with a specific figure in sources reviewed | Not found | Not confirmed | How are mid-term site additions priced - pro-rated, or at renewal only? | Not found in a Tier 1-2 source in this pass | Low | Evidence gap. |




## Table 17 - Deployment and Migration Evidence

| Scenario | Typical sequence | Dependencies | Customer resources | Provider resources | Time evidence if public | Risks | Mitigations | Netify View |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| MPLS to SD-WAN migration | Genuinely well-evidenced via a real, detailed case study directly describing a legacy-to-modern connectivity transition, with a customer moving toward an over-the-internet connection approach specifically | Existing legacy connectivity potentially coexisting during transition, per the confirmed flexible-underlay architecture | IT team, though substantially reduced given the confirmed fully-managed model | BT-managed, per the confirmed fully-managed default | Not quantified with a specific timeline in the source reviewed | The confirmed case study directly names the risk this scenario addresses: the customer 'couldn't afford to handle a network transformation like this in-house' | The confirmed fully-managed delivery model directly addresses the named in-house-resource-constraint risk | Genuinely well-evidenced via a real, detailed customer example directly describing this exact migration scenario and the specific business constraint (lack of in-house resources) that drove the decision. |
| Firewall consolidation | Evidenced via the confirmed BT Managed Fortinet Firewall product, combined with SD-WAN in the confirmed case study specifically to provide centralised, edge-based security | Existing firewall infrastructure potentially retired | IT/security team | BT-managed | Not quantified with a specific timeline | Not itemised | Not detailed | The underlying capability is genuinely well-evidenced via a real, detailed case study combining SD-WAN and managed firewall together as a single, coordinated migration. |
| VPN to ZTNA migration | Not evidenced via a named case study specifically describing VPN retirement in sources reviewed, though ZTNA itself is confirmed as a core capability (Table 3) | Existing VPN infrastructure potentially retired | IT team | BT-managed | Not quantified | Not itemised | Not detailed | The underlying ZTNA capability is confirmed and specific (identity-based access, data residency support); a named customer case study specifically for VPN retirement wasn't found in this pass. |
| SSE deployment to remote users | Not evidenced with specific detail in sources reviewed, consistent with the broader Table 5 finding that remote-user/client-side evidence is thinner than the site-to-site/sector-positioning side of the platform | Not itemised | Not itemised | Not itemised | Not quantified | Not itemised | Not detailed | A genuine, specific evidence gap for this exact scenario, consistent with the pattern found throughout Table 5. |
| Global branch rollout | Genuinely well-evidenced via a real, detailed case study describing a multi-country deployment specifically | Existing branch network/WAN infrastructure to integrate or replace across multiple countries | BT-managed, per the confirmed fully-managed default | BT-managed, with confirmed international network reach | Not quantified with a specific timeline | The confirmed case study directly names the challenge: 'they couldn't afford to handle a network transformation like this in-house' 'in all countries' | The confirmed fully-managed, internationally-capable delivery model directly addresses this scenario | Well-evidenced via a real, detailed, multi-country customer example - genuinely concrete evidence for this exact scenario. |
| Merger/acquisition integration | Not documented via a named customer M&A-specific scenario in sources reviewed | Not itemised | Not itemised | Not itemised | Not quantified | Not itemised | Not detailed | Evidence gap for this specific scenario. |
| Co-managed transition | Confirmed as an available option (Table 6, 9), though buyers should confirm the exact RACI split and request a portal demonstration directly, per Netify's own independent research recommendation | Existing tools/processes reviewed against BT's specific co-managed delivery model | Customer chooses desired level of involvement | BT-managed, with confirmed customer-accessible elements under the co-managed option | Not quantified | N/A | N/A | Real, confirmed option exists, though this is a specific area worth confirming directly rather than assuming, given BT's core positioning centres on fully-managed delivery by default. |
| Multi-vendor SASE integration | Not the platform's primary emphasis in the sources reviewed - BT's core positioning centres on a single managed contract spanning access, CPE, and a chosen underlying vendor platform (Fortinet, Meraki, or Versa) rather than explicitly marketed best-of-breed pairings with vendors outside its own confirmed platform partnerships | Existing security/identity tools already in place | Not itemised | Not itemised | Not quantified | N/A | N/A | A specific, worth-stating architectural-philosophy distinction - BT's own confirmed strategy favours managed delivery of one of a small number of named, established vendor platforms (Fortinet, Meraki, Versa) rather than orchestrated integration with a broader ecosystem of third-party SASE/SSE vendors. |




## Table 18 - Structured Customer Case Studies

One real, detailed, primary-sourced case study was found in this research pass. The customer's own identity is anonymised - a common, standard practise for this class of content - but the technical and business narrative is genuinely specific and credible. No fully-named, individually-identified customer case study was found for BT's managed SD-WAN or SASE services in this research pass, a real, worth-flagging gap Netify should prioritise closing directly with BT.

| Case study | Customer/anonymous | Sector | Country/region | Users | Sites | Problem | Products/services | Deployment model | Integrations | Measured outcomes | Evidence quality | Netify interpretation |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Global financial-services customer - Agile Connect and Managed Fortinet Firewall | Anonymous - described only as 'our global customer' and 'our customer'; company name not disclosed | Financial services | Multi-country (specific countries not named) | Not quantified | Not quantified - described generally as requiring consistent service 'in all countries' | The customer needed to move away from an existing approach that could not provide consistent service across all its countries of operation, and could not afford to handle a network transformation of this scale in-house | Agile Connect (managed SD-WAN) combined with BT Managed Fortinet Firewall | Fully managed, over-the-internet connectivity combined with edge-based managed firewall | Fortinet (via BT Managed Fortinet Firewall) | Simpler deployment and greater control over the network; centralised management providing better visibility and control over the entire infrastructure and security; network segmentation confirmed directly ('if a breach happens in one area, data in other areas stays protected'); higher bandwidth, greater connectivity and flexibility at lower cost; no specific quantified percentage or numeric outcome given | Medium-High - a real, detailed, primary-sourced (BT's own published case study) account with specific technical detail (SSL decryption, network segmentation, centralised management) and a clear problem/solution narrative, though the customer's identity is anonymised and no specific quantified outcome figure (e.g. a percentage) is given | The strongest available customer evidence found in this research pass - genuinely detailed and technically specific rather than generic marketing language, even without the customer's name disclosed or a specific, quantified numeric outcome. Netify should treat obtaining additional, ideally fully-named, case studies as a priority follow-up item with BT directly. |




## Table 19 - Strengths, Limitations and Procurement Watch-outs

| Type | Finding | Buyer impact | Best/worst affected buyers | Evidence | Confidence | Netify View |
| --- | --- | --- | --- | --- | --- | --- |
| Strength | Genuine, confirmed ownership of Openreach gives BT direct control over one of the deepest UK last-mile access networks in the market - a structural advantage no platform-only SASE vendor can replicate [[8]](#src8) | Buyers get genuine underlay accountability within a single corporate group, rather than a SASE platform layered on top of a third-party-owned, separately-accountable access network [[8]](#src8) | Best: UK-anchored organisations prioritising underlay accountability and field-engineering depth. Less relevant: buyers with no particular UK-connectivity dependency [[8]](#src8) | [[8]](#src8) | High | Genuinely BT's clearest, most structurally distinctive differentiator - a real, checkable, corporate-ownership fact rather than a marketing claim. |
| Strength | Confirmed, genuine multi-platform flexibility - managed SD-WAN on Cisco Meraki and Versa, managed SASE on Fortinet and Meraki - gives buyers real platform choice within a single managed contract [[7]](#src7) | Buyers can select the underlying vendor platform that best fits their specific technical requirements without needing to manage multiple separate vendor relationships directly [[7]](#src7) | Best: buyers wanting platform flexibility without separate procurement relationships. Less relevant: buyers who have already firmly decided on a specific, named SASE platform vendor directly [[7]](#src7) | [[7]](#src7) | High | A specific, confirmed, genuine differentiator, though it also means buyers must do more work to confirm exactly which platform and packaging applies to their specific proposal. |
| Strength | A real, detailed, primary-sourced case study demonstrates concrete, specific technical and business outcomes for a genuinely challenging scenario (global, multi-country network transformation with insufficient in-house resources) [[17]](#src17) | Buyers get real, checkable evidence of BT's capability for complex, large-scale, multi-country deployments, even without the customer's name disclosed [[17]](#src17) | Best: large, multi-country enterprises, particularly in financial services. Less relevant: buyers wanting a fully-named, quotable customer reference specifically [[17]](#src17) | [[17]](#src17) | Medium-High | Genuinely credible, specific evidence - real technical and business detail rather than generic marketing language, tempered only by the customer's anonymisation. |
| Limitation | This research pass found no independently-confirmed, SASE-service-specific certifications (ISO 27001, SOC 2, PCI DSS, DORA) distinct from BT Group's much larger, broader corporate compliance posture | Buyers with formal, platform-level compliance-attestation requirements cannot currently verify these specific certifications for the SASE service itself from public sources | Affects regulated-industry buyers most specifically, particularly financial services given the confirmed direct sector positioning without matching confirmed certifications | Table 13 findings | Medium-High (confident about the absence found in this specific research pass, though this may reflect a research-pass limitation given BT Group's own substantial scale) | A genuine, specific gap worth flagging directly and early with any buyer requiring formal, platform-level compliance certification, particularly in financial services given the confirmed sector-specific positioning without matching confirmed certifications. |
| Limitation | No fully-named, individually-identified customer case study was found for BT's managed SD-WAN or SASE services in this research pass - the strongest available evidence is a real, detailed, but anonymised case study | Buyers wanting a fully-named, quotable customer reference to validate against have less to draw on than the pattern found among several other vendors in this category | Affects all buyer sizes wanting fully-attributable case-study evidence before committing | Table 18 findings | Medium-High (confident about the absence found in this specific research pass, though case studies may exist that weren't surfaced) | A genuine, specific gap worth flagging as a direct follow-up request to BT, even though the anonymised evidence located is itself real and credible. |
| Limitation | BT's own confirmed positioning, per Netify's independent research, is that a DIY/self-managed model is 'not BT's primary positioning', and the confirmed co-managed model's specific customer-control boundaries should be verified directly rather than assumed [[8]](#src8) | Buyers wanting a genuinely lightweight, self-administered platform experience should confirm this expectation matches BT's actual delivery model before committing [[8]](#src8) | Affects buyers with a strong internal preference for self-directed, minimal-vendor-involvement operation most specifically [[8]](#src8) | [[8]](#src8) | High (this is Netify's own, directly-stated, independently-researched finding) | A specific, important, independently-sourced caution - not necessarily a weakness for buyers wanting fully-managed delivery, but a real, worth-confirming mismatch risk for buyers with the opposite preference. |
| Procurement watch-out | BT has offered managed SASE under at least two distinct underlying technology generations in recent years - a VMware-based service launched January 2022, and the current, confirmed Fortinet-based service expanded in late 2025 - buyers researching this vendor's SASE history should confirm which generation any given proposal, reference, or public materials actually describe | Buyers doing extended, multi-source due diligence should verify they are evaluating current, correctly-dated materials, and confirm the status of any legacy VMware-based deployments directly if relevant to their own situation | Most relevant to buyers doing extended research who may encounter older, VMware-era BT SASE references alongside current, Fortinet-era materials | Table 1, 12 findings | High (both technology generations are directly, primary-sourced confirmed with specific dates) | Worth flagging directly and early - Netify should note explicitly to any buyer that BT's current managed SASE offering is Fortinet-based (from late 2025), distinct from an earlier, VMware-based service BT offered from January 2022. |




## Table 20 - Netify Human Evaluation

First six rows are the mandatory Netify Assessment questions and are answered explicitly here.

| Evaluation area | Netify conclusion | Evidence basis | Confidence | Buyer implication |
| --- | --- | --- | --- | --- |
| Who is this genuinely best suited for? (mandatory) | UK-anchored organisations wanting genuine underlay accountability via BT's confirmed ownership of Openreach; large, multi-country enterprises wanting a single managed contract combining connectivity, hardware, and a choice of SASE platform; and NHS/social-care-adjacent public bodies specifically, given confirmed HSCN accreditation. | Tables 1, 7, 13, 15 | High | Buyers matching this profile can proceed with genuine confidence, backed by real, specific, checkable evidence rather than only generic managed-service marketing claims. |
| Where does it stand out? (mandatory) | Genuine, structural ownership of the UK's dominant last-mile access network via Openreach; confirmed, genuine multi-platform flexibility (Fortinet, Meraki, Versa) within one managed contract; and a real, detailed (if anonymised) case study demonstrating concrete capability for complex, multi-country deployments. | Tables 7, 12, 18, 19 | High | These are the claims Netify can make most confidently and specifically to buyers, each backed by real, checkable, primary-sourced or independently-researched evidence. |
| Where does it fall behind competitors? (mandatory) | No independently-confirmed, SASE-service-specific compliance certifications (ISO 27001, SOC 2, PCI DSS, DORA) were found distinct from BT Group's broader corporate posture; no fully-named customer case study was found; and BT's own confirmed positioning is that fully self-managed delivery is not its primary model. | Tables 13, 15, 18, 19 | Medium-High | Named specifically and evidenced, not a generic hedge - the compliance-certification gap and the fully-managed-by-default positioning specifically should be raised proactively with any relevant buyer. |
| What implementation challenges should buyers expect? (mandatory) | Expect a genuinely low customer-effort deployment for the core, fully-managed path, reinforced by a real, detailed case study describing exactly this experience. Expect to confirm directly which specific underlying vendor platform (Fortinet, Meraki, or Versa) is being proposed, since capability and packaging vary by platform. Expect the commercial conversation to require a direct BT quote from the start, given the confirmed absence of published, first-party pricing. | Tables 6, 9, 16, 17 | Medium-High | Each expectation is traceable to a specific, evidenced finding elsewhere in this profile. |
| When would Netify recommend it? (mandatory) | When a buyer specifically wants genuine underlay/last-mile accountability via BT's confirmed Openreach ownership; when a buyer wants a single managed contract spanning connectivity, hardware, and a choice of SASE platform; or when a buyer is an NHS/social-care-adjacent UK public body specifically, given confirmed HSCN accreditation. | Synthesis of Tables 7, 12, 13, 15 | High | A clear, actionable recommendation trigger set for Netify's comparison tool to apply directly. |
| When would Netify recommend looking elsewhere? (mandatory) | When a buyer needs confirmed, independently-verified, platform-specific compliance certifications (ISO 27001, SOC 2, PCI DSS, DORA); when a buyer specifically wants a fully self-managed, do-it-yourself platform rather than BT's confirmed fully-managed-by-default model; or when a buyer needs a fully-named, quotable customer reference as part of their procurement evidence requirements. | Synthesis of Tables 13, 15, 18 | Medium-High | Each trigger is tied to a specific, evidenced gap rather than a generic 'consider alternatives' hedge. |
| Questions to ask before recommending it | 1) Exactly which underlying SASE platform (Fortinet or Meraki) is being proposed for this specific deployment, and why? 2) What does the co-managed RACI split actually look like in practise, with a live portal demonstration? 3) Beyond HSCN, does the specific SASE service itself carry any independently-verified certifications distinct from BT Group's broader corporate posture? 4) Can BT provide a fully-named customer reference, and what is the current status of any legacy VMware-based SASE deployments? | Synthesis of Tables 6, 12, 13, 18 | High | A direct, reusable question set for Netify's advisory conversations with buyers considering BT Managed SASE. |
| Most credible differentiator | Genuine, structural ownership of the UK's dominant last-mile access network via Openreach, combined with confirmed multi-platform flexibility (Fortinet, Meraki, Versa) within a single managed contract - a real, checkable infrastructural advantage no platform-only SASE vendor can replicate. | Tables 7, 12, 19 | High | This is the single sentence Netify's comparison engine could most confidently quote for this vendor specifically, particularly for UK-anchored buyers. |
| Biggest operational advantage | A real, detailed case study directly demonstrates BT's fully-managed delivery model successfully resolving a genuinely challenging scenario - a global, multi-country network transformation the customer could not handle in-house - with confirmed, specific outcomes including network segmentation and centralised visibility. | Table 9, 18 | High | Directly quotable with the specific, real case-study detail for credibility, even without the customer's name disclosed. |
| Biggest operational concern | The combination of no independently-confirmed, SASE-service-specific compliance certifications and the absence of a fully-named customer case study together represent the two most concrete, actionable evidence gaps a buyer should resolve directly before committing, particularly for regulated-industry procurement decisions. | Tables 13, 18, 19 | Medium-High | Netify should proactively flag both specific, evidenced gaps to buyers during the shortlist conversation rather than let either surface as a surprise later. |
| Deployment reality | Genuinely well-evidenced as low-effort for the customer under BT's confirmed fully-managed default model, backed by a real, detailed case study; the confirmed co-managed alternative requires buyers to verify the exact RACI split directly rather than assume equivalent customer control. | Tables 6, 9, 17, 18 | High for the fully-managed path specifically; Medium for the co-managed alternative pending direct RACI confirmation | Present the fully-managed deployment evidence with genuine confidence, backed by real, specific case-study detail, while flagging the co-managed RACI-confirmation need directly for buyers considering that path. |
| Support/service reality | Genuinely well-evidenced via multiple, independently-corroborated confirmations - 24x7 NOC and SOC/MDR capability, severity SLAs, and change-window processes are all confirmed both by BT's own materials and Netify's independent research - though specific, numeric SLA figures were not found published. | Table 8 | Medium-High (structural capability well-confirmed; specific numeric SLA figures are not) | Present the confirmed, corroborated NOC/SOC/MDR capability with genuine confidence, while requesting specific, numeric SLA figures directly before finalising any support-SLA-sensitive procurement decision. |
| Reporting reality | Strong specifically for centralised network/security visibility and compliance-relevant logging, reinforced by both BT's own direct materials and a real case study; weaker or unconfirmed on application-performance, DLP-event, and executive-dashboard reporting, none of which were confirmed as distinct, named products in this research pass. | Table 10 | Medium-High for centralised visibility and compliance logging; Low for other reporting categories | Present the centralised-visibility and compliance-logging strengths specifically rather than imply comprehensive reporting maturity across every category. |
| AI reality | A real, direct, primary-sourced confirmation of AI-powered proactive threat detection exists, layered on top of the underlying vendor platform (principally Fortinet); the precise split between BT's own value-add and the underlying platform's native AI capability was not itemised separately, and no single, distinctly-named AI copilot product was confirmed. | Table 11 | Medium-High | Represent the confirmed AI-powered threat-detection capability with genuine confidence, while being clear that the specific technical contribution of BT versus the underlying Fortinet platform wasn't independently itemised in this pass. |
| Sector fit | Financial services is genuinely the best-evidenced sector in this entire profile, combining specific, named product positioning (ZTNA, data residency) with a real, detailed (if anonymised) case study; retail and healthcare/NHS are well-evidenced via specific, named product positioning and accreditation respectively, without individually-named case studies; manufacturing was not assessed due to an absence of evidence. | Table 14 | High for financial services; Medium for retail and healthcare; Low for sectors with no evidence | The confirmed financial-services case study and the confirmed HSCN accreditation are both worth highlighting directly for any buyer in those specific sectors. |
| Global fit | Genuinely the strongest coverage finding in this entire profile is specifically for the United Kingdom, via BT's confirmed ownership of Openreach; international, multi-country capability is confirmed directly via a real case study, though detailed, country-by-country coverage outside the UK was not independently itemised. | Table 7, 15 | High for the UK specifically; Medium for confirmed multi-country capability generally; Low for country-level specificity outside the UK | Present the UK-coverage strength with genuine confidence, while always verifying buyer-specific country/region delivery capability directly with BT for deployments outside the UK. |
| Commercial reality | No pricing exists for this service in any source found in this research pass, explicitly confirmed as quote-based by Netify's own independent research; the confirmed structural commercial model (access, CPE, vendor stack, and service tier combined into one contract) gives buyers real, useful commercial framing even without published figures. | Table 16 | Medium (confident about the absence of published pricing, and about the confirmed commercial-model structure) | Route any budget conversation to a direct BT quote from the very first interaction, using the confirmed commercial-model structure (access plus CPE plus vendor stack plus service tier) to scope the conversation precisely. |
| Questions Netify still cannot verify | Independently-confirmed, SASE-service-specific ISO 27001, SOC 2, PCI DSS, DORA, and NIS2 status; specific, published pricing figures at any tier; named, formal support-tier SLA figures beyond the general confirmed existence of severity SLAs; a fully-named customer case study; and the current status of any legacy VMware-based SASE deployments. | Synthesis of Tables 8, 13, 16, 18 | N/A - explicitly unresolved | This list should drive the next follow-up (a direct BT briefing) before this profile is considered fully closed out, particularly the compliance-certification and named-case-study questions given their direct relevance to regulated-sector and general procurement confidence. |
| Overall Netify Assessment | BT's most credible, best-evidenced strength is genuinely structural rather than a proprietary technology claim: confirmed ownership of Openreach gives it a real, checkable infrastructural advantage over platform-only SASE vendors, reinforced by confirmed, genuine multi-platform flexibility (Fortinet, Meraki, Versa) within a single managed contract. That combination, backed by a real, detailed (if anonymised) case study demonstrating concrete capability for complex, multi-country deployments, makes this a credible shortlist candidate - particularly for UK-anchored organisations, large multi-country enterprises, and NHS/social-care-adjacent public bodies specifically. The profile is honest about real, specific gaps: no independently-confirmed, SASE-service-specific compliance certifications distinct from BT Group's broader corporate posture, no fully-named customer case study, and a confirmed core positioning that fully self-managed delivery is not BT's primary model. This profile is solid enough to support initial shortlist guidance for UK-anchored, large-enterprise, and public-sector buyers specifically, but the flagged compliance-certification gap and the absence of a fully-named case study should both be closed out directly with BT before use in a high-stakes, compliance-sensitive procurement decision. | Whole profile | Medium-High overall | Recommend direct BT engagement to confirm platform-specific compliance certifications and obtain a fully-named customer reference before this profile supports a high-stakes procurement decision. |




## Evidence Register

Every source used in this profile, numbered, with a reliability tier (see "Source reliability tiers" below). Each [n] superscript throughout the tables above is a clickable link that jumps to the matching numbered row here - right-click the number and choose "Update Field" if Word doesn't show it as a live link immediately after opening. Sources kept at Tier 4 are NOT relied on for any factual claim in this profile; they're retained here only for audit-trail transparency.

| # | Tier | Source title/document | URL | Pub. date | Verified | Confidence / reliability note |
| --- | --- | --- | --- | --- | --- | --- |
| <a id="src1"></a>1 | Tier 4 | Wikipedia - BT Group / Openreach | en.wikipedia.org/wiki/BT_Group | Ongoing (community-maintained) | 22 Jul 2026 | Not used as evidence - community-editable; replaced by primary BT/Openreach sources and independent corroboration for the facts it originally supported |
| <a id="src2"></a>2 | Tier 1 | BT Newsroom - press release: BT launches a new managed SASE service powered by Fortinet | newsroom.bt.com/bt-launches-a-new-managed-sase-service-powered-by-fortinet/ | 27 Nov 2024 | 22 Jul 2026 | High |
| <a id="src3"></a>3 | Tier 2 | Comms Business - BT launches new managed SASE service (independent trade-press reporting) | commsbusiness.co.uk/content/news/bt-launches-new-managed-sase-service | 21 Oct 2025 | 22 Jul 2026 | High (named independent trade-press outlet, original reporting) |
| <a id="src4"></a>4 | Tier 2 | Computer Weekly - BT unveils managed SASE service (independent trade-press reporting) | computerweekly.com/news/366616338/BT-unveils-managed-SASE-service | Undated (2024-2025) | 22 Jul 2026 | High (named independent trade-press outlet, original reporting) |
| <a id="src5"></a>5 | Tier 1 | BT Business - SD-WAN & SASE Solutions overview page | business.bt.com/networks-digital-services/sd-wan-sase/ | Undated | 22 Jul 2026 | High |
| <a id="src6"></a>6 | Tier 1 | BT Business - Managed SASE Solutions page (sector-specific positioning: retail, financial services, public sector; SASE cloud node architecture) | business.bt.com/networks-digital-services/sd-wan-sase/sase/ | Undated | 22 Jul 2026 | High |
| <a id="src7"></a>7 | Tier 3 | Netify - Managed Service Providers Comparison 2026 (independent Netify research; BT positioned as largest UK managed network/security provider; multi-platform confirmation: Cisco Meraki, Versa, Fortinet, Meraki SASE; BT Security MDR; HSCN accreditation) | netify.co.uk/managed-service-providers-comparison-2026/ | 25 Jun 2026 | 22 Jul 2026 | Medium-High (Netify's own published, dated, structured comparative research - treated as a credible secondary source consistent with the same evidentiary standard applied to other independent comparison platforms in this profile series) |
| <a id="src8"></a>8 | Tier 3 | Netify SASE Marketplace - BT Business / BT Global capability profile (independent Netify research; 40-feature evidence-graded capability card, reviewed 2026-05-22; dual-hub/diverse last-mile design, Openreach-adjacent last mile, owned core, quote-based commercial model) | sase.netify.co.uk/vendors/bt-business | 22 May 2026 | 22 Jul 2026 | Medium-High (Netify's own published, dated, evidence-graded capability profile - treated as a credible secondary source consistent with the same evidentiary standard applied to other independent comparison platforms in this profile series) |
| <a id="src9"></a>9 | Tier 1 | Business Wire (via wire-distribution mirror) - VMware SASE Launched by BT As A Managed Service (historical, 2022 VMware-based managed SASE launch; 150+ PoP global network reference) | markets.financialcontent.com/observerreporter/article/bizwire-2022-1-20-vmware-sase-launched-by-bt-as-a-managed-service | 20 Jan 2022 | 22 Jul 2026 | High (vendor-issued release, wire-distributed; historical - describes an earlier VMware-based offering distinct from the current, confirmed Fortinet-based managed SASE service) |
| <a id="src10"></a>10 | Tier 3 | Umbrex - BT Group Strategy and Business Model (independent company-profile research; FY2024 segment/revenue detail, strategic priorities) | umbrex.com/resources/company-profiles/bt-group-plc/ | 11 Jun 2026 | 22 Jul 2026 | Medium (independent research-aggregator content - corroboration only) |
| <a id="src11"></a>11 | Tier 3 | PitchBook - BT Group 2026 Company Profile (market cap, trailing 12-month revenue, Openreach fibre-coverage detail) | pitchbook.com/profiles/company/41913-82 | 21 Jul 2026 | 22 Jul 2026 | Medium (company-data aggregator - corroboration only) |
| <a id="src12"></a>12 | Tier 1 | Investegate (RNS regulatory announcement) - BT Group plc: Results for the full year to 31 March 2026 (FY2026 revenue £19.7bn, adjusted EBITDA £8.2bn, profit before tax £1.4bn, capex £5.1bn, fibre-build and NPS detail) | investegate.co.uk/announcement/rns/bt-group--bt.a/results-for-the-full-year-to-31-march-2026/9578811 | 27 May 2026 | 22 Jul 2026 | High (primary, regulatory-filed (RNS) company financial announcement) |
| <a id="src13"></a>13 | Tier 3 | ZoomInfo - BT Group Overview & News (segment structure: Global Services, Retail, Wholesale, Openreach; named executives) | zoominfo.com/c/bt-group-plc/18241240 | 1 month old at verification | 22 Jul 2026 | Medium (aggregator - corroboration only) |
| <a id="src14"></a>14 | Tier 3 | Wikipedia - Openreach (used only for facts independently corroborated elsewhere in this pass: 2006 founding, Ofcom/Enterprise Act 2002 regulatory origin, 2023/24 revenue and operating income) | en.wikipedia.org/wiki/Openreach | Ongoing (community-maintained) | 22 Jul 2026 | Medium (used narrowly, only for specific facts cross-checked against other sources in this pass - not relied upon as sole evidence for any claim) |
| <a id="src15"></a>15 | Tier 3 | Forbes - BT Group \| Company Overview & News (segment structure: Consumer, Enterprise, Global, Openreach, Other) | forbes.com/companies/bt-group/ | 24 Jun 2026 | 22 Jul 2026 | Medium (named, authoritative financial-data provider - corroboration only for the specific segment-structure detail cited) |
| <a id="src16"></a>16 | Tier 3 | GlobalData - BT Group Plc Company Profile (managed telecommunications, security, network and secure digital products/services portfolio description) | globaldata.com/company-profile/bt-group-plc/ | Undated | 22 Jul 2026 | Medium (company-data aggregator - corroboration only) |
| <a id="src17"></a>17 | Tier 1 | BT Business - Financial services SD-WAN case study (Agile Connect + BT Managed Fortinet Firewall; anonymised global financial-services customer) | business.bt.com/insights/case-studies/financial-services-sd-wan/ | Undated | 22 Jul 2026 | High (primary BT case study; customer identity anonymised at the customer's own request, per standard practise for this class of content) |

## Source reliability tiers

**Tier 1 - Primary (BT / regulatory registry)** - BT's own site (BT Newsroom, BT Business, BT case studies), plus a primary, regulatory-filed (RNS) BT Group financial announcement. Used freely as evidence.

**Tier 2 - Authoritative third-party** - Named, editorially-independent trade-press outlets with original reporting (Comms Business, Computer Weekly). Used freely as evidence.

**Tier 3 - Secondary (corroboration only)** - Netify's own dated, structured, independent comparative research (netify.co.uk and sase.netify.co.uk - treated with the same evidentiary standard applied to any other independent comparison platform in this profile series), company-data aggregators (Umbrex, PitchBook, ZoomInfo, Forbes, GlobalData), and Wikipedia's Openreach entry (used narrowly, only for specific facts cross-checked against other sources). Used only to corroborate, never as sole evidence for a claim that materially affects a buyer recommendation.

**Tier 4 - Not used as evidence** - Wikipedia's BT Group entry specifically. Not cited as support for any factual claim in this profile; retained in the register only for audit-trail transparency about what was found and consciously not relied on, replaced instead by primary BT sources and independent corroboration.




## Reference Architecture / Deployment Diagram Description

Typical BT Managed SASE deployment flow, suitable for later visual production: 

(1) At each site, customer-premises equipment (included within BT's confirmed managed commercial model) connects via a customer-selected mix of underlays - BT's own confirmed 'flexibility to mix different connectivity options for each of their sites' - with dual-hub and diverse last-mile designs applied as standard practise for resilience. 

(2) Wherever the UK last mile is involved, that connectivity runs over BT's own directly-owned Openreach access network, giving BT genuine, first-party accountability across the entire path rather than depending on a separate, third-party-owned local loop. 

(3) Traffic is elastically, dynamically steered by the managed SD-WAN layer (Agile Connect, delivered on Cisco Meraki or Versa) and prioritised to a SASE cloud node, avoiding public internet congestion for prioritised traffic. 

(4) At the SASE cloud node, the customer's chosen underlying platform - currently and predominantly Fortinet, with Meraki as a confirmed alternative - delivers firewall-as-a-service, secure web gateway, cloud access security broker, and zero-trust network access, with identity-based ZTNA access confirmed to support data-residency requirements by keeping sensitive traffic within localised data paths for regulated-sector customers specifically. 

(5) Network segmentation is applied throughout, confirmed directly via a real customer account, so that a breach in one area does not compromise data in other areas. 

(6) BT Security provides round-the-clock monitoring, AI-powered proactive threat detection, and Managed Detection and Response, feeding into BT's own confirmed unified monitoring services and giving customers centralised visibility and control across their entire infrastructure and security posture. 

(7) The whole estate is managed by BT by default under a single commercial contract combining access, CPE, and the chosen vendor stack together, with a confirmed co-managed option available for buyers wanting more direct operational involvement, subject to a RACI split that should be confirmed directly rather than assumed.

## Research updates checked 23 October 2026

These dated updates are separate from Harry Yelland's original profile, which is preserved in full below.

### Fortinet launch date

BT announced the UK Fortinet managed SASE expansion on 25 November 2024.

Scope: BT announcement. Announcement date.

[BT Fortinet managed SASE launch, 25 November 2024](https://newsroom.bt.com/bt-launches-a-new-managed-sase-service-powered-by-fortinet/)

### International SSE choices

The 14 October 2026 announcement names Cisco, Fortinet, Netskope and Zscaler SSE connectivity through Global Fabric. This is an International offer, not a universal UK package.

Scope: BT International. Announcement and notes to editors.

[BT Global Fabric SSE announcement, 14 October 2026](https://newsroom.bt.com/bt-international-expands-global-fabric-with-a-choice-of-integrated-security-service-edge-solutions/)

### Data loss prevention

BT now names DLP for cloud applications, including M365.

Scope: BT published service description. Converged threat detection and prevention.

[BT Managed SASE page](https://business.bt.com/networks-digital-services/sd-wan-sase/sase/)

### Operations and reporting

BT names unified incident response, quarterly business reviews, a unified dashboard, custom reporting, anomaly detection and auto-remediation. These marketing claims do not establish each ordered package or its response targets.

Scope: BT published service description. End-to-end SASE managed by BT.

[BT Managed SASE page](https://business.bt.com/networks-digital-services/sd-wan-sase/sase/)

### UK logging

BT describes UK-resident logging and management. Retention, export permissions and the contracted processing scope need agreement.

Scope: BT published service description. Converged threat detection and prevention.

[BT Managed SASE page](https://business.bt.com/networks-digital-services/sd-wan-sase/sase/)

### Remote access and DNS

The BT FortiSASE schedule names FortiClient, DNS security, CASB and private-application ZTNA.

Scope: BT FortiSASE. Part B 1.1.2, 1.1.5-1.1.7; 3.1.1.

[BT FortiSASE July 2026, Part B](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/security/bt-fortisase-service-schedule-part-b-july-2026.pdf)

### Digital experience monitoring

DEM is orderable with an additional licence.

Scope: BT FortiSASE option. Part B 1.1.9.

[BT FortiSASE July 2026, Part B](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/security/bt-fortisase-service-schedule-part-b-july-2026.pdf)

### Customer access and changes

Portal monitoring and reports require co-management. Permitted commands are agreed; BT disclaims losses from customer changes. Five simple service requests per year are included.

Scope: BT FortiSASE. Part B 1.1.3; 2.2; 3.2; 8.1.

[BT FortiSASE July 2026, Part B](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/security/bt-fortisase-service-schedule-part-b-july-2026.pdf)

### Licence duration

Licences may cover the service term or a minimum year with yearly renewals. BT manages the subscriptions.

Scope: BT FortiSASE. Part B 1.1.10.

[BT FortiSASE July 2026, Part B](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/security/bt-fortisase-service-schedule-part-b-july-2026.pdf)

### Service-edge locations

Specific PoPs are agreed for customer requirements; the schedule supplies no fixed worldwide count.

Scope: BT FortiSASE. Part B 1.1.1.

[BT FortiSASE July 2026, Part B](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/security/bt-fortisase-service-schedule-part-b-july-2026.pdf)

### Physical, virtual and LAN options

BT specifies physical and virtual edges, optional cloud deployment, switches, Wi-Fi access points and LAN CPE. Exact models remain order-specific.

Scope: BT Fortinet SD-WAN. Part B 1.1; 2.1; 2.4; 2.8.

[BT Fortinet SD-WAN July 2026, Part B](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/digital-workplace/bt-fortinet-sd-wan-service-schedule-part-b-july-2026.pdf)

### 4G and 5G underlay

UK mobile options include 4G and 5G. Active-active mobile access requires available 5G.

Scope: BT Fortinet SD-WAN option. Part B 2.3.

[BT Fortinet SD-WAN July 2026, Part B](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/digital-workplace/bt-fortinet-sd-wan-service-schedule-part-b-july-2026.pdf)

### Application and site visibility

Co-management provides FortiManager/FortiAnalyzer visibility; write access needs permission. The customer portal monitors network status and generates reports.

Scope: BT Fortinet SD-WAN. Part B 1.6; 2.2.

[BT Fortinet SD-WAN July 2026, Part B](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/digital-workplace/bt-fortinet-sd-wan-service-schedule-part-b-july-2026.pdf)

### Protective monitoring

Optional protective monitoring handles high/critical events continuously and uses agreed response playbooks. It is separate from security licensing.

Scope: BT Fortinet SD-WAN option. Part B 2.5-2.6.

[BT Fortinet SD-WAN July 2026, Part B](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/digital-workplace/bt-fortinet-sd-wan-service-schedule-part-b-july-2026.pdf)

### Hardware maintenance

BT maintains and, where applicable, replaces BT-owned SD-WAN edge devices.

Scope: BT Fortinet SD-WAN. Part B 7.2.2.

[BT Fortinet SD-WAN July 2026, Part B](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/digital-workplace/bt-fortinet-sd-wan-service-schedule-part-b-july-2026.pdf)

### Bandwidth and user licences

FortiSASE add-ons include bandwidth, public IP and remote-user licences. No public unit price is stated.

Scope: BT Fortinet SD-WAN option. Part B 2.7.1.

[BT Fortinet SD-WAN July 2026, Part B](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/digital-workplace/bt-fortinet-sd-wan-service-schedule-part-b-july-2026.pdf)

### Contracted service levels

BT FortiSASE Part A gives on-time delivery a service level; availability and incident resolution have targets. This differs from other BT service schedules.

Scope: BT FortiSASE contract. Part A 13.2-14.

[BT FortiSASE July 2026, Part A](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/security/bt-fortisase-service-schedule-part-a-july-2026-global.pdf)

### Commitments and renewal

Charges and volume commitments are set in the order. Renewal requests are described at least 90 days before expiry; renewal needs an order. Reconfiguration and out-of-hours work can incur extra charges.

Scope: BT FortiSASE contract. Part A 10-11.

[BT FortiSASE July 2026, Part A](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/security/bt-fortisase-service-schedule-part-a-july-2026-global.pdf)

### China availability

The schedule addresses China restrictions; this does not establish universal availability or a named local PoP.

Scope: BT FortiSASE contract. Part A 9.

[BT FortiSASE July 2026, Part A](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/security/bt-fortisase-service-schedule-part-a-july-2026-global.pdf)

### Incident and change management

STANDARD defines incident ownership, escalation, diagnosis, restoration and controlled changes. The applicable management schedule is identified in the order.

Scope: BT management schedule. STANDARD sections 4-12, 18-21; schedule index.

[BT Service Management STANDARD](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/Service-management-schedule-standard-9-jun-2023.pdf); [BT global service schedules](https://business.bt.com/terms-and-conditions/global/service-schedules/)

### Service reviews and reporting

PLUS describes monthly performance reports and service management. Applicable options must be purchased and listed in the order.

Scope: BT management option. PLUS sections 9-11, 14-15; schedule index.

[BT Service Management PLUS](https://business.bt.com/content/dam/bt-business/pdfs/terms-and-conditions/service-schedules/service-management-schedule-plus-15-february-2024.pdf); [BT global service schedules](https://business.bt.com/terms-and-conditions/global/service-schedules/)

### SOC 2 report access

BT offers its SOC 2 report to customers and prospects under NDA. Request the report and check the exact service, legal entity, audit period and exceptions. The public page does not establish SASE-specific scope.

Scope: BT assurance process. SOC2 Assurance.

[BT Security Assurance and Compliance](https://business.bt.com/help/article/email-security-and-hosting/online-safety-and-security/security-assurance-and-compliance/)

### Browser access for contractors

FortiSASE documents browser-only access to private HTTPS applications for contractors and temporary workers. BT orderability and application scope still need confirmation.

Scope: Underlying platform, not BT inclusion. Agentless ZTNA; subscription prerequisites.

[FortiSASE agentless ZTNA](https://docs.fortinet.com/document/fortisase/latest/administration-guide/329570/agentless-ztna); [FortiSASE agentless ZTNA prerequisites](https://docs.fortinet.com/document/fortisase/latest/feature-administration-guide/856362/prerequisites-and-considerations)

### Mobile clients

FortiSASE lists Android and iOS clients alongside Windows and macOS. BT must confirm supported versions and feature parity for the chosen service.

Scope: Underlying platform, not BT inclusion. Product integration and support.

[FortiSASE product integration and support](https://docs.fortinet.com/document/fortisase/26.1.107/feature-release-notes/87005)

### API-based CASB

Fortinet documents out-of-band CASB for AWS S3, Google Cloud Storage and Office 365, with licence prerequisites. This does not prove inclusion in a BT order.

Scope: Underlying platform, not BT inclusion. API-based CASB prerequisites.

[FortiSASE API-based CASB](https://docs.fortinet.com/document/fortisase/7.4.0/administration-guide/690102/api-based-casb)

### Browser isolation

FortiSASE RBI is a select-availability feature, disabled by default where not already enabled. It requires an eligible subscription, proxy and Fortinet PoP. BT availability must be agreed.

Scope: Underlying platform, not BT inclusion. RBI availability and prerequisites.

[FortiSASE RBI availability and prerequisites](https://docs.fortinet.com/document/fortisase/26.1.107/feature-administration-guide/374370/rbi)

### Identity integration

FortiSASE documents Entra ID, Okta, LDAP and RADIUS authentication. BT configuration and support responsibilities remain order-specific.

Scope: Underlying platform, not BT inclusion. Access and authentication.

[FortiSASE access and authentication](https://docs.fortinet.com/document/fortisase/latest/administration-guide/623391/access-authentication)

### Multiple identity providers

FortiAuthenticator can proxy employee and contractor identities from Entra ID, Google Workspace or Okta. Its inclusion in BT service scope needs agreement.

Scope: Underlying platform, not BT inclusion. Identity-provider proxy example.

[FortiSASE identity-provider proxy](https://docs.fortinet.com/document/fortisase/26.1.107/mature-administration-guide/338285/configuring-fortisase-with-fortitrust-id-as-saml-idp-proxy-for-entra-id-sso)

### User provisioning

FortiSASE documents SCIM provisioning with eligibility and instance restrictions. SAML support does not itself prove OIDC support. BT must confirm instance eligibility and enabled protocols.

Scope: Underlying platform, not BT inclusion. SCIM server support prerequisites.

[FortiSASE SCIM server support](https://docs.fortinet.com/document/fortisase/latest/feature-administration-guide/276170)

### External log export

FortiSASE supports external FortiAnalyzer, Syslog and CEF forwarding, including DLP, security and administrative events. This is not evidence of a ready-made Sentinel or Splunk integration or BT-granted export access.

Scope: Underlying platform, not BT inclusion. Forwarding logs to an external server.

[FortiSASE external log forwarding](https://docs.fortinet.com/document/fortisase/25.4.96/feature-administration-guide/774663/forwarding-logs-to-an-external-server)

### Loss protection

FortiGate supports forward error correction and packet duplication. Firmware, design and BT support scope need matching before procurement.

Scope: Underlying platform, not BT inclusion. SD-WAN architecture guides.

[FortiGate forward error correction](https://docs.fortinet.com/document/fortigate/7.6.0/sd-wan-architecture-for-enterprise/228050/forward-error-correction-fec); [FortiGate packet duplication](https://docs.fortinet.com/document/fortigate/7.6.0/sd-wan-architecture-for-enterprise/119261/packet-duplication)

### AI assistant and reports

FortiAnalyzer FortiAI supports natural-language queries, report generation and configuration assistance with its own licence. BT has not been shown to include that licence or customer access.

Scope: Underlying platform, not BT inclusion. FortiAI capabilities and licence.

[FortiAnalyzer FortiAI](https://docs.fortinet.com/document/fortianalyzer/7.6.6/administration-guide/439379/fortiai)

### Zero-touch Wi-Fi deployment

BT names zero-touch deployment for FortiAP. This is specific to Wi-Fi access points and does not prove a universal zero-touch branch workflow.

Scope: BT published component description. Notes to editors, FortiAP.

[BT Fortinet managed SASE launch, 25 November 2024](https://newsroom.bt.com/bt-launches-a-new-managed-sase-service-powered-by-fortinet/)

### Manufacturing experience

BT publishes manufacturing case studies and links to its SD-WAN/SASE portfolio. These references do not establish a named Fortinet SASE manufacturing deployment.

Scope: Sector experience, not product proof. Manufacturing case-study directory.

[BT manufacturing case studies](https://business.bt.com/insights/case-studies/manufacturing/)

### ServiceNow orchestration

BT describes ServiceNow digital service apps for SASE-controller orchestration. A customer-facing ServiceNow connector, entitlement and workflow scope still need agreement.

Scope: BT published transformation description. Automation and orchestration.

[BT SD-network transformation services, 19 September 2025](https://business.bt.com/insights/isg-leader-apac/)

### Separate security products

BT lists Managed CrowdStrike, Managed CySOC for Splunk and multiple cloud-security offers separately. Their presence in the catalogue does not establish integration or inclusion in BT FortiSASE.

Scope: Separate BT offers. Security service schedule list.

[BT global service schedules](https://business.bt.com/terms-and-conditions/global/service-schedules/)

### Satellite scope

BT and Starlink announced consumer broadband and mobile-backhaul uses. This does not establish a managed SASE satellite option. Ask BT for the enterprise offer and support boundary.

Scope: Different BT service. Consumer announcement scope.

[BT and Starlink consumer announcement](https://newsroom.bt.com/bt-group-and-starlink-pave-the-way-for-high-speed-home-broadband-in-the-uks-hardest-to-reach-places/)

### Questions for BT

- SaaS security posture: Please identify the ordered product, licence and supported configuration for SaaS security posture, with a service-document reference.

- VDI environments: Please confirm supported devices, applications, enrolment requirements and licence scope for VDI environments.

- Privileged access: Please confirm supported devices, applications, enrolment requirements and licence scope for Privileged access.

- Middle East coverage: Please provide the country/location list, regulatory restrictions and contracted delivery scope for Middle East coverage.

- Africa coverage: Please provide the country/location list, regulatory restrictions and contracted delivery scope for Africa coverage.

- Latin America coverage: Please provide the country/location list, regulatory restrictions and contracted delivery scope for Latin America coverage.

- Sovereign/regional service options: Please provide the country/location list, regulatory restrictions and contracted delivery scope for Sovereign/regional service options.

- Role-based administration: Please demonstrate Role-based administration and specify customer permissions, change controls and any additional charge.

- Multi-tenancy: Please demonstrate Multi-tenancy and specify customer permissions, change controls and any additional charge.

- User/entity behaviour analytics: Please identify the product/version, licence, customer access and BT support scope for User/entity behaviour analytics.

- Generative AI application controls: Please identify the product/version, licence, customer access and BT support scope for Generative AI application controls.

- AI data protection controls: Please identify the product/version, licence, customer access and BT support scope for AI data protection controls.

- VMware (historical): Please provide the supported connector or protocol, data flow, licence and responsibility split for VMware (historical).

- AWS: Please provide the supported connector or protocol, data flow, licence and responsibility split for AWS.

- Microsoft Azure: Please provide the supported connector or protocol, data flow, licence and responsibility split for Microsoft Azure.

- Google Cloud: Please provide the supported connector or protocol, data flow, licence and responsibility split for Google Cloud.

- Microsoft Defender: Please provide the supported connector or protocol, data flow, licence and responsibility split for Microsoft Defender.

- Nokia: Please provide the supported connector or protocol, data flow, licence and responsibility split for Nokia.

- REST API: Please provide the supported connector or protocol, data flow, licence and responsibility split for REST API.

- PCI DSS: Please provide the service-specific assurance documentation and contractual scope for PCI DSS.

- GDPR: Please provide the service-specific assurance documentation and contractual scope for GDPR.

- NIS2 relevance: Please provide the service-specific assurance documentation and contractual scope for NIS2 relevance.

- DORA relevance: Please provide the service-specific assurance documentation and contractual scope for DORA relevance.

- Financial services: Please provide a named, product-specific deployment reference for Financial services.

- Retail: Please provide a named, product-specific deployment reference for Retail.

- Mid-market: Please provide a comparable deployment and explain service fit, scale and support scope for Mid-market.