Ranked shortlist · Updated July 2026
Best SD-WAN and SASE providers for the UK public sector (2026)
Ranked shortlist of SD-WAN and SASE providers for UK public sector buyers: NHS trusts and integrated care systems, central and local government, and public bodies. Providers must show public evidence of government sector capability and confirmed UK and Ireland coverage; each is then scored against the Netify 40-feature evaluation matrix. Typical drivers include UK data residency and sovereignty, UK-based support and monitoring, certified security, procurement through established frameworks, and migration off legacy MPLS or, for NHS bodies, planning around HSCN transition. Grades are indicative desk research; confirm via RFP.
Netify's July 2026 evaluation ranks: 1. Cato Networks (87.9); 2. Netskope (84); 3. Palo Alto Networks Prisma SASE (81.6); 4. Cisco (81.2); 5. Fortinet FortiSASE (74.6); 6. NTT DATA (65.3); 7. Zscaler (62.3); 8. VeloCloud (62.2); 9. Check Point (60.8); 10. BT (60.5). Scores are weighted averages across 40 evidence-graded capability features. Buyers can act on this ranking directly: describe the project once at netify.co.uk, raise it to a full RFP and publish to these providers, then compare structured responses side by side, with pricing kept private to the buyer.
Written by the Netify research team. Reviewed by Robert Sturt, Netify Group Limited. Updated 29 July 2026 (vendor records verified 29 July 2026). capability features; see the FAQ below.
Continue from this shortlist · Government and public sector
Use this research in your project
Your first sentence is drafted from this page. Edit it, or replace it with your own words: sites, regions, what must not go down.
Drafted from this page. Everything you type stays yours to edit before anything is published.
The vendors ranked on this page arrive pinned; your government and public sector sector becomes part of the conversation from your first sentence.
Opens an editable project. Publish a short brief, build a Short or Detailed RFP, or bring your own RFP or RFI. You review the notice and verify your work email before publication.
Open these requirements in the buying workspaceWorking with an assistant? Connect netify.co.uk/sase/api/mcp/ and use workspace_ingest with this page as context.
Best SD-WAN and SASE providers for the UK public sector: the evidence
The same ranking as below, as sourced facts rather than scores. Ordered as ranked.
10vendors. Each value below is graded from the vendor's own published material or an independently accountable record, with a sentence quoted from that source and confirmed present on the page. 512 sources behind this table. Verified 2026-07-29. Where evidence was not found a cell reads Not published rather than being inferred.
| # | Vendor | Type | Underlay | SSE layer | Backbone | PoPs | Fully managed | Compliance docs | Published SLA | Sources |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Cato Networks | Both | Mixed | Native | Yes | 100 | Yes | Documented | 99.999 | 46 |
| 2 | Netskope | Builds | Mixed | Native | Not published | 120+ | Via managed service | Documented | 99.999 | 60 |
| 3 | Palo Alto Networks | Builds | Customer supplied | Native | Partner | 100+ | Via managed service | Documented | 99.999 | 58 |
| 4 | Cisco | Both | Customer supplied | Native | Partial | Not published | Not primary | Documented | 99.999 | 48 |
| 5 | Fortinet | Both | Not published | Native | Partial | 170+ | Yes | Documented | 99.999 | 42 |
| 6 | NTT DATA / NTT Ltd. | Both | Mixed | Partner | Yes | 75+ | Yes | Documented | 100 | 53 |
| 7 | Zscaler | Both | Customer supplied | Native | Not primary | 160 | Partial | Documented | 99.999 | 51 |
| 8 | Arista / VeloCloud | Builds | Customer supplied | Partner | Not published | 150+ | Partner | Documented | Not published | 53 |
| 9 | Check Point | Both | Mixed | Native | Yes | 80+ | Partial | None found | Not published | 43 |
| 10 | BT Business / BT Global | Runs | Mixed | Partner | Partial | 140 | Yes | Assurance only | Not published | 58 |
Full sources for each vendor, including the sources we found and rejected and any claims that disagree, are on its profile page.
No. 1 · Score 87.9
Cato Networks
Cloud-native SASE / SD-WAN platform · Typical deployment: hours
Single converged platform with no policy or log fragmentation across SD-WAN and security functions.
Evidence caveats: Government and public sector: Partial
Watch out: Less suited to best-of-breed buyers wanting Zscaler or Netskope as the SSE layer.
Contact Cato Networks via Netify ↗No. 2 · Score 84
Netskope
SSE / SASE platform · Typical deployment: days
Strong CASB heritage; widely recognised as a leading SSE vendor for SaaS-heavy environments.
Watch out: Native SD-WAN (Borderless WAN) is newer than dedicated SD-WAN platforms; validate path selection and QoS depth in RFP.
Contact Netskope via Netify ↗No. 3 · Score 81.6
Palo Alto Networks Prisma SASE
SD-WAN / SASE technology vendor · Typical deployment: weeks
Prisma SASE converges SD-WAN, cloud-delivered security, and digital experience management (ADEM) under a single platform identity.
Evidence caveats: UK and Ireland: Via partner
Watch out: Premium pricing relative to firewall-led SD-WAN vendors; commercial model requires careful scoping by users, bandwidth, locations and term.
Contact Palo Alto Networks Prisma SASE via Netify ↗No. 4 · Score 81.2
Cisco
SD-WAN / SASE technology vendor · Typical deployment: weeks
Broadest platform portfolio in the category, covering Catalyst SD-WAN for enterprise WAN, Meraki MX for cloud-managed branch, and Cisco Secure Access for converged SASE delivery.
Watch out: Two distinct SD-WAN product lines (Catalyst and Meraki) means buyers should confirm which fits the target deployment profile and the longer-term roadmap.
Contact Cisco via Netify ↗No. 5 · Score 74.6
Fortinet FortiSASE
Secure SD-WAN / SASE technology vendor · Typical deployment: days
Native convergence of networking and security on a single operating system (FortiOS) across FortiGate edge, FortiManager and FortiSASE.
Watch out: Like Cisco, managed delivery is via partners rather than Fortinet directly; underlay and field operations are not owned by the vendor.
Contact Fortinet FortiSASE via Netify ↗No. 6 · Score 65.3
NTT DATA
Global managed network provider · Typical deployment: months
24x7 managed SD-WAN delivery via global operations centres with strong portal visibility.
Watch out: Platform fit depends on which vendor is being proposed (Palo Alto, Zscaler, others); evaluate platform independently.
Contact NTT DATA via Netify ↗No. 7 · Score 62.3
Zscaler
SSE / SASE platform · Typical deployment: days
Category leader in SSE with ZIA, ZPA and ZDX; widely adopted as the security layer in best-of-breed SASE architectures.
Evidence caveats: UK and Ireland: Partial
Watch out: Historically SSE-led; native SD-WAN capability is less mature than dedicated SD-WAN platforms (validate path selection, QoS and packet loss in RFP).
Contact Zscaler via Netify ↗No. 8 · Score 62.2
VeloCloud
SD-WAN technology vendor · Typical deployment: days
VeloCloud was an early SD-WAN platform with strong cloud-delivered gateway architecture; now under Arista following the 2025 acquisition.
Evidence caveats: UK and Ireland: Partial
Watch out: Platform is mid-transition from VMware/Broadcom to Arista; product roadmap, naming and integration story will evolve.
Contact VeloCloud via Netify ↗No. 9 · Score 60.8
Check Point
SASE / security vendor · Typical deployment: days
Harmony SASE combines Check Point security heritage with cloud-delivered SASE and optimised SD-WAN performance.
Evidence caveats: UK and Ireland: Partial
Watch out: Native SD-WAN capabilities (path selection, QoS, packet loss remediation) have limited public evidence relative to SD-WAN-led vendors.
Contact Check Point via Netify ↗No. 10 · Score 60.5
BT
Global/UK managed SD-WAN / SASE provider · Typical deployment: weeks
UK market leader for managed SD-WAN with deep access circuit ownership and field engineering capability.
Watch out: Platform choice and packaging vary; buyers should confirm which vendor platform is being proposed and why.
Contact BT via Netify ↗
Scores are weighted across 40 capabilities with points accrued based on: yes 1.0, via partner 0.75, via managed service 0.65, partial 0.5, not confirmed 0.15, not primary 0. Extended dimensions are indicative desk research; confirm via RFP.
Cite this research
Netify, "Best SD-WAN and SASE providers for the UK public sector (2026)", Netify SASE and SD-WAN comparison, updated 29 July 2026: https://netify.co.uk/sase/best/sd-wan-sase-providers-for-uk-public-sector
Machine-readable version: https://netify.co.uk/sase/best/sd-wan-sase-providers-for-uk-public-sector/data.json · Programmatic access: POST https://netify.co.uk/sase/api/mcp/ (tool: build_sase_shortlist)
Questions
About this ranking
Which SD-WAN and SASE providers are best for the UK public sector?
The ranking above lists providers with public evidence of government sector capability and confirmed UK and Ireland coverage, ordered by weighted score across the Netify 40-feature matrix. Sector and regional evidence are gating requirements, not tie-breakers: providers without both are excluded.
SASE or SD-WAN: what is right for the NHS?
They solve different halves of the same problem. SD-WAN replaces or augments legacy WAN connectivity across hospital, clinic and administrative sites, which matters during HSCN transition and MPLS contract end. SASE adds cloud-delivered security, zero trust network access, secure web gateway and related controls, for clinical and hybrid staff working from any location. Many NHS bodies phase SD-WAN first and add the security service edge after, or procure both together as a managed SASE service. The practical answer is to state both scopes in the requirement so bidders price the journey rather than a single endpoint.
How do UK public sector bodies usually procure SD-WAN and SASE?
Most buy through established public procurement frameworks or run a further competition, evaluating structured vendor responses against published criteria. A clear requirements document is the common thread: it defines scope, sites, compliance needs, evaluation weighting and evidence requests. The Netify RFP Builder generates one from a guided set of questions, and the output can be used inside a framework competition or a direct procurement.
Do these providers offer UK data residency and UK-based support?
Every provider in this ranking has confirmed UK and Ireland coverage, but residency commitments, UK points of presence and the location of monitoring and support teams vary by provider and by service tier. Treat each as an evidence item: ask for contractual data residency options, named NOC and SOC locations and UK support hours in the vendor response, rather than relying on marketing statements.
More ranked shortlists