SD-WAN and SASE shortlist builder

Compare SD-WAN and SASE providers, vendors and managed services

Compare 30 researched SD-WAN and SASE providers across operating model, network and security capability. Explore the public provider evidence, then review and publish an anonymous project when you are ready. Personalised matching is available through authorised access after publication. Publication does not guarantee invitations or supplier responses. A full RFP is optional.

Compare SD-WAN and SASE providers

Compare two or three named vendors and service providers across 40 capabilities. Public evidence is free to explore; personalised matching unlocks when you publish a project.

Provider 1Provider 2Provider 3 (optional)

Compare every feature across your selected providers

Which providers fit your project?

Ask Netify to source proposals against your requirements. Start with a short brief, review the public notice and verify your work email and company before publishing. Supplier participation is developing; responses and prices are not guaranteed. A full RFP is optional.

Your requirement (optional)

Your selected providers, comparison question and stated requirements travel with your draft as research context. They do not invite suppliers or publish anything.

Your selections travel with you. Nothing is published without your approval.

Public capability comparison

Capability	Zscaler	Netskope
Service delivery and operating model
Fully managed service	Not confirmed	Not confirmed
DIY / self-managed model	Yes, public evidence	Yes, public evidence
Co-managed service	Not confirmed	Not confirmed
Multi-tenant MSP / white-label support	Not confirmed	Not confirmed
Professional services and migration support	Yes, public evidence	Yes, public evidence
Last-mile circuit management	Yes, public evidence	Not confirmed
Lifecycle management	Not confirmed	Not confirmed
Flexible commercial model	Not confirmed	Not confirmed
Network architecture and transport
Encrypted overlay fabric	Yes, public evidence	Yes, public evidence
Dynamic path selection	Not confirmed	Yes, public evidence
Active-active link utilisation	Not confirmed	Not confirmed
Application-aware routing	Not confirmed	Yes, public evidence
QoS and traffic shaping	Not confirmed	Yes, public evidence
Packet loss remediation	Not confirmed	Yes, public evidence
Local internet breakout	Not confirmed	Yes, public evidence
MPLS coexistence and migration	Yes, public evidence	Yes, public evidence
Cellular and 5G support	Not confirmed	Not confirmed
Cloud on-ramp	Yes, public evidence	Yes, public evidence
Gateway, PoP and backbone design
Public cloud gateways	Not confirmed	Yes, public evidence
Private PoPs / dedicated PoPs	Not confirmed	Not confirmed
Private global backbone	Not confirmed	Not confirmed
Regional breakout and data residency	Not confirmed	Not confirmed
Multi-cloud transit fabric	Yes, public evidence	Yes, public evidence
Flexible edge form factors	Not confirmed	Not confirmed
High availability design	Not confirmed	Yes, public evidence
SLA-backed service fabric	Not confirmed	Not confirmed
Security and SASE capability
Integrated next-generation firewall	Yes, public evidence	Yes, public evidence
Full SASE platform	Yes, public evidence	Yes, public evidence
SSE ecosystem integration	Yes, public evidence	Yes, public evidence
Zero Trust Network Access	Yes, public evidence	Yes, public evidence
Secure web gateway	Yes, public evidence	Yes, public evidence
CASB capability	Not confirmed	Yes, public evidence
Data loss prevention	Yes, public evidence	Yes, public evidence
Remote user access	Yes, public evidence	Yes, public evidence
SOC/SIEM/SOAR integration	Yes, public evidence	Yes, public evidence
Operations, assurance and automation
Centralised orchestration	Not confirmed	Not confirmed
Customer portal and RBAC	Not confirmed	Not confirmed
Observability and digital experience monitoring	Yes, public evidence	Not confirmed
APIs and automation	Not confirmed	Not confirmed
Managed service assurance	Yes, public evidence	Yes, public evidence
Regional coverage
UK and Ireland	Not confirmed	Not confirmed
Europe	Not confirmed	Not confirmed
North America	Not confirmed	Not confirmed
Asia Pacific	Yes, public evidence	Yes, public evidence
Middle East and Africa	Yes, public evidence	Yes, public evidence
Latin America	Yes, public evidence	Yes, public evidence
China (mainland)	Yes, public evidence	Yes, public evidence
Cloud platforms
AWS	Yes, public evidence	Yes, public evidence
Microsoft Azure	Yes, public evidence	Yes, public evidence
Google Cloud	Yes, public evidence	Yes, public evidence
Oracle Cloud	Not confirmed	Not confirmed
Alibaba Cloud	Not confirmed	Not confirmed
AI capability and resilience
AI-driven operations (AIOps)	Not confirmed	Yes, public evidence
AI security analytics	Yes, public evidence	Yes, public evidence
AI assistant / copilot	Not confirmed	Not confirmed
Disaster recovery	Not confirmed	Yes, public evidence
Typical deployment speed	Not confirmed	Not confirmed

Grades: Yes (public evidence), Partial, Via partner, Via managed service, Not primary, Not confirmed. Extended dimensions are indicative desk research; confirm via RFP.

Zscaler: evidence and sources Netskope: evidence and sources

Short answer: compare 30 SD-WAN providers, SD-WAN vendors, SASE providers, carriers and managed services using one governed research dataset. Compare named providers feature by feature or open their evidence profiles. Review your anonymous notice before publication. Personalised matching requires authorised access after publication. Only selected eligible providers receive invitations. Supplier participation and response times are not guaranteed.

If the evaluation confirms no eligible matches, no suppliers are invited. Review the reasons and evidence gaps, check your requirements and decide whether to revise and republish your project. Missing evidence does not necessarily mean a provider lacks the capability.

Free for buyers
No sales calls until you reply
Pricing private to you
No obligation to award

Written and reviewed by the Netify research team. The governed provider records were last updated on 2026-09-01. Comparison contract governed-shortlist/1.0.0. To act on a shortlist, describe the project once at the Netify RFP Builder, review your anonymous notice before publication. Invitations depend on confirmed eligibility. Review any responses privately; participation and response times are not guaranteed. Read and cite the research method.

All providers SD-WAN vendors SASE vendors Managed SD-WAN providers

2026 market answer

All SD-WAN and SASE providers

Evidence order: most proven capability items first, then most recent verification date, then provider name (slug breaks identical names). Only published capability grades of yes count; partial, partner-delivered and unconfirmed items do not. Missing dates come last. Positions are evidence order, not recommendations. Computed fit and scoring-model rankings require authorised access after verified project publication.

30 providers in this evidence view. Reviewed 2026-09-01. View contract shortlist-market-view/2.0.0.

Provider evidence

Provider, product and differentiator

1. Cato Networks (Cato Browser Extension, Cato Client, Cato DEM, Cato EPP/EDR): Single converged platform with no policy or log fragmentation across SD-WAN and security functions.
25 proven capability items · Verified 2026-09-01
2. Cisco (Cisco AI Defence, Cisco Catalyst SD-WAN, Cisco Duo, Cisco ISE): Broadest platform portfolio in the category, covering Catalyst SD-WAN for enterprise WAN, Meraki MX for cloud-managed branch, and Cisco Secure Access for converged SASE delivery.
23 proven capability items · Verified 2026-09-01
3. Netskope (Borderless SD-WAN, Cloud Confidence Index (CCI), Netskope Cloud Exchange (CE), Netskope One): Strong CASB heritage; widely recognised as a leading SSE vendor for SaaS-heavy environments.
23 proven capability items · Verified 2026-09-01
4. Palo Alto Networks Prisma SASE (ADEM, AI Access Security, Enterprise DLP, Precision AI / Strata Copilot): Prisma SASE converges SD-WAN, cloud-delivered security, and digital experience management (ADEM) under a single platform identity.
22 proven capability items · Verified 2026-09-01
5. Versa Networks (Inbound SSE, Secure Enterprise Browser, VOS, Versa Analytics): Multi-tenancy from the ground up, making Versa a common choice for service providers and carriers building managed SD-WAN and SASE platforms.
17 proven capability items · Verified 2026-09-01
6. Zscaler (AI Security / GenAI Security, Data Fabric for Security, Risk360, Zero Trust Branch): Category leader in SSE with ZIA, ZPA and ZDX; widely adopted as the security layer in best-of-breed SASE architectures.
17 proven capability items · Verified 2026-09-01
7. Fortinet FortiSASE (Fabric Connectors, FortiClient, FortiGuard AI-Powered Security Services, FortiManager / FortiAnalyzer): Native convergence of networking and security on a single operating system (FortiOS) across FortiGate edge, FortiManager and FortiSASE.
16 proven capability items · Verified 2026-09-01
8. HPE Aruba EdgeConnect (Cloud Intelligence, EdgeConnect Orchestrator, First-Packet iQ, HPE Aruba Networking Central): EdgeConnect SD-WAN (acquired with Silver Peak) is positioned as the foundation for single-vendor SASE alongside Aruba SSE.
15 proven capability items · Verified 2026-09-01
9. Check Point (AI Network Firewall / AI Defence Plane, CASB, Check Point Infinity Architecture, Check Point SASE Platform): Harmony SASE combines Check Point security heritage with cloud-delivered SASE and optimised SD-WAN performance.
13 proven capability items · Verified 2026-09-01
10. Forcepoint (AI Mesh / Getvisibility, ARIA, Field Programmable SASE Logic (FPSL), FlexEdge Secure SD-WAN): FlexEdge Secure SD-WAN combines secure SD-WAN with strong DLP and data security heritage from the wider Forcepoint portfolio.
13 proven capability items · Verified 2026-09-01
11. Aryaka (AI>Observe, AI>Secure, Aryaka Cyber Threat Research Lab (CTRL), Aryaka Network Access Point (ANAP)): Unified SASE delivered as a managed service from end to end, including the private global core network and WAN optimisation.
10 proven capability items · Verified 2026-09-01
12. Juniper Networks (Juniper AI-Native SD-WAN, Juniper Mist AI / Marvis AI, Juniper Secure Edge, Managed SD-WAN): Mist AI delivers WAN Assurance, providing AI-driven monitoring and troubleshooting at the WAN edge that few competitors match.
9 proven capability items · Verified 2026-09-01
13. Lumen (Black Lotus Labs, Lumen Managed SASE Solutions, Lumen SASE with Versa, Lumen SD-WAN with Versa Networks): Fully managed or co-managed SD-WAN with strong NaaS positioning and integrated network services.
9 proven capability items · Verified 2026-09-01
14. Cloudflare One (AI Gateway / Agents SDK / MCP security, CASB, Cloudflare Access, Cloudflare One): Cloudflare global edge network provides one of the largest PoP footprints in the category for SASE traffic.
7 proven capability items · Verified 2026-09-01
15. Expereo (Expereo Enhanced Internet, Expereo Managed SD-WAN, Expereo SD-WAN/SASE with Cato Networks, Starlink (via Expereo, authorised reseller)): Managed SD-WAN and internet connectivity, with Cato Networks as a named partner for managed SASE.
7 proven capability items · Verified 2026-09-01
16. Ericsson Cradlepoint (NetCloud Federal, NetCloud Manager, NetCloud Perimeter, NetCloud Private Networks): Wireless-first branch architecture from Ericsson with deep 5G expertise; NetCloud provides cellular-centric SD-WAN management.
6 proven capability items · Verified 2026-09-01
17. Open Systems (MDR+ (Managed Detection and Response), Managed SD-WAN / Secure SD-WAN, Managed, Universal SSE, Mission Control): Managed SD-WAN and SASE supported by Open Systems' Mission Control service team.
6 proven capability items · Verified 2026-09-01
18. Orange Business (Orange Business Evolution Platform, Orange Business SASE with Palo Alto Networks Prisma SASE, Orange Business and Fortinet SASE, Orange Cyberdefense Managed SASE): Global managed network leadership with strong service assurance, NOC depth and field operations.
6 proven capability items · Verified 2026-09-01
19. Barracuda SecureEdge (Barracuda SecureEdge, Barracuda SecureEdge Access, BarracudaONE, Secure Edge Manager): SecureEdge combines SD-WAN and cloud security, with an MSP option for multi-tenant management.
5 proven capability items · Verified 2026-09-01
20. BT (Agile Connect, BT Managed Fortinet Firewall, BT Managed SASE (Fortinet-based), BT Managed SASE (Meraki-based)): UK market leader for managed SD-WAN with deep access circuit ownership and field engineering capability.
5 proven capability items · Verified 2026-09-01
21. GTT (GTT Envision, GTT Managed SD-WAN, GTT Secure Connect, Secure Connect with HPE (Aruba/EdgeConnect/SSE)): Tier 1 global backbone provides strong international transit capability alongside managed SD-WAN.
5 proven capability items · Verified 2026-09-01
22. VeloCloud (Arista AVA, Edge Threat Management (ETM), SSE partner integrations, VeloCloud Orchestrator): VeloCloud was an early SD-WAN platform with strong cloud-delivered gateway architecture; now under Arista following the 2025 acquisition.
5 proven capability items · Verified 2026-09-01
23. Vodafone Business (Fortinet-based Secure Networking, Vodafone Business Managed Network Services, Vodafone Business Network as a Service (NaaS), Vodafone Business SASE): Strong UK and European market presence with NaaS positioning and integrated mobile/fixed access.
5 proven capability items · Verified 2026-09-01
24. Verizon Business (RingCentral (voice/UC integration), Verizon Managed SD Branch, Verizon Managed SD WAN, Verizon SASE Management): Global carrier-led managed SASE and SD-WAN with strong North American presence and international delivery.
4 proven capability items · Verified 2026-09-01
25. Colt Technology Services (Colt SASE Gateway solution, Colt SD WAN, Colt SD WAN Remote Access, Partner IP Access (Blue Wireless)): SD-WAN and SASE with strong European data sovereignty positioning.
3 proven capability items · Verified 2026-09-01
26. Comcast Business (Comcast Business CASB, Comcast Business FWaaS, Comcast Business Managed SD-WAN, Comcast Business SASE): SASE combining SD-WAN and security available fully managed or co-managed, drawing on Masergy AIOps heritage.
3 proven capability items · Verified 2026-09-01
27. NTT DATA (Managed Campus Networks with Prisma SASE, Managed Internet Connectivity, Managed IoT and Network as a Service (NaaS), Managed Network Security): 24x7 managed SD-WAN delivery via global operations centres with strong portal visibility.
3 proven capability items · Verified 2026-09-01
28. Virgin Media O2 Business (8x8 Voice for Teams, Cloud Infrastructure as a Service / Platform as a Service, Managed Detection and Response, Success Agreement): Managed connectivity and SD-WAN with Zscaler-based SASE; confirm the current contracting entity and scope.
3 proven capability items · Verified 2026-09-01
29. AT&T Business (AT&T Dynamic Defence with Palo Alto Networks, AT&T Managed SASE with Cisco, AT&T Managed SD-WAN, AT&T Network as a Service (NaaS)): Major US carrier-led managed SD-WAN portfolio with multi-vendor platform options (including Fortinet for AT&T SASE).
2 proven capability items · Verified 2026-09-01
30. SonicWall Cloud Secure Edge (Global Response Intelligent Defence (GRID) Threat Network, Managed Protection Security Suite (MPSS), SAMI, Secure Internet Access): SD-WAN delivered via existing TZ, NSa and SM firewall appliances; familiar deployment for organisations standardised on SonicWall.
2 proven capability items · Verified 2026-09-01

Comparison summary

Evidence for all providers at a glance

Comparative overview of 30 all providers, updated 2026-09-01
Provider	Type	Products	Best suited to	Main strength	Confirm through RFP	Reviewed
1. Cato Networks	technology vendor	Cato Browser Extension, Cato Client, Cato DEM, Cato EPP/EDR	Mid-market and enterprise buyers consolidating SD-WAN and SASE on one platform from a single vendor.	Single converged platform with no policy or log fragmentation across SD-WAN and security functions.	Fully managed service	2026-09-01
2. Cisco	technology vendor	Cisco AI Defence, Cisco Catalyst SD-WAN, Cisco Duo, Cisco ISE	Enterprises already standardised on Cisco networking who want platform consistency from LAN through WAN to security.	Broadest platform portfolio in the category, covering Catalyst SD-WAN for enterprise WAN, Meraki MX for cloud-managed branch, and Cisco Secure Access for converged SASE delivery.	Fully managed service	2026-09-01
3. Netskope	technology vendor	Borderless SD-WAN, Cloud Confidence Index (CCI), Netskope Cloud Exchange (CE), Netskope One	Enterprises with deep SaaS adoption where CASB and DLP are top procurement priorities.	Strong CASB heritage; widely recognised as a leading SSE vendor for SaaS-heavy environments.	Fully managed service	2026-09-01
4. Palo Alto Networks Prisma SASE	technology vendor	ADEM, AI Access Security, Enterprise DLP, Precision AI / Strata Copilot	Enterprises with mature security operations that want SASE built around a leading security platform rather than a security layer on top of an SD-WAN platform.	Prisma SASE converges SD-WAN, cloud-delivered security, and digital experience management (ADEM) under a single platform identity.	Fully managed service	2026-09-01
5. Versa Networks	technology vendor	Inbound SSE, Secure Enterprise Browser, VOS, Versa Analytics	Service providers, carriers and MSPs building white-label managed SD-WAN or SASE services.	Multi-tenancy from the ground up, making Versa a common choice for service providers and carriers building managed SD-WAN and SASE platforms.	Fully managed service	2026-09-01
6. Zscaler	technology vendor	AI Security / GenAI Security, Data Fabric for Security, Risk360, Zero Trust Branch	Enterprises selecting best-of-breed SSE alongside a separate SD-WAN platform.	Category leader in SSE with ZIA, ZPA and ZDX; widely adopted as the security layer in best-of-breed SASE architectures.	Fully managed service	2026-09-01
7. Fortinet FortiSASE	technology vendor	Fabric Connectors, FortiClient, FortiGuard AI-Powered Security Services, FortiManager / FortiAnalyzer	Security-first buyers who want SD-WAN and SASE under a single policy and log domain.	Native convergence of networking and security on a single operating system (FortiOS) across FortiGate edge, FortiManager and FortiSASE.	Fully managed service	2026-09-01
8. HPE Aruba EdgeConnect	technology vendor	Cloud Intelligence, EdgeConnect Orchestrator, First-Packet iQ, HPE Aruba Networking Central	Enterprises already running Aruba LAN/Wi-Fi who want WAN and SASE under the same operational tooling.	EdgeConnect SD-WAN (acquired with Silver Peak) is positioned as the foundation for single-vendor SASE alongside Aruba SSE.	Fully managed service	2026-09-01
9. Check Point	technology vendor	AI Network Firewall / AI Defence Plane, CASB, Check Point Infinity Architecture, Check Point SASE Platform	Existing Check Point customers extending firewall investment into SD-WAN and SASE.	Harmony SASE combines Check Point security heritage with cloud-delivered SASE and optimised SD-WAN performance.	Fully managed service	2026-09-01
10. Forcepoint	technology vendor	AI Mesh / Getvisibility, ARIA, Field Programmable SASE Logic (FPSL), FlexEdge Secure SD-WAN	Enterprises with strong data protection and DLP requirements (regulated industries, government).	FlexEdge Secure SD-WAN combines secure SD-WAN with strong DLP and data security heritage from the wider Forcepoint portfolio.	Fully managed service	2026-09-01
11. Aryaka	technology vendor	AI>Observe, AI>Secure, Aryaka Cyber Threat Research Lab (CTRL), Aryaka Network Access Point (ANAP)	Global enterprises wanting SASE delivered as a fully managed service rather than as DIY platform plus tools.	Unified SASE delivered as a managed service from end to end, including the private global core network and WAN optimisation.	Fully managed service	2026-09-01
12. Juniper Networks	technology vendor	Juniper AI-Native SD-WAN, Juniper Mist AI / Marvis AI, Juniper Secure Edge, Managed SD-WAN	Enterprises already running Mist for Wi-Fi or access who want unified AI-driven operations across WAN and LAN.	Mist AI delivers WAN Assurance, providing AI-driven monitoring and troubleshooting at the WAN edge that few competitors match.	Fully managed service	2026-09-01
13. Lumen	technology vendor / managed service provider / carrier network provider	Black Lotus Labs, Lumen Managed SASE Solutions, Lumen SASE with Versa, Lumen SD-WAN with Versa Networks	North American enterprises wanting integrated managed SD-WAN, access and broader network services from one provider.	Fully managed or co-managed SD-WAN with strong NaaS positioning and integrated network services.	Multi-tenant MSP / white-label support	2026-09-01
14. Cloudflare One	technology vendor	AI Gateway / Agents SDK / MCP security, CASB, Cloudflare Access, Cloudflare One	Buyers already using Cloudflare for DDoS protection, CDN or Zero Trust who want to extend into WAN.	Cloudflare global edge network provides one of the largest PoP footprints in the category for SASE traffic.	Fully managed service	2026-09-01
15. Expereo	managed service provider / carrier network provider	Expereo Enhanced Internet, Expereo Managed SD-WAN, Expereo SD-WAN/SASE with Cato Networks, Starlink (via Expereo, authorised reseller)	Buyers comparing managed internet connectivity alongside SD-WAN and partner-delivered SASE.	Managed SD-WAN and internet connectivity, with Cato Networks as a named partner for managed SASE.	DIY / self-managed model	2026-09-01
16. Ericsson Cradlepoint	technology vendor / carrier network provider	NetCloud Federal, NetCloud Manager, NetCloud Perimeter, NetCloud Private Networks	Distributed enterprises with strong cellular/5G access strategy (retail, logistics, transport, public sector).	Wireless-first branch architecture from Ericsson with deep 5G expertise; NetCloud provides cellular-centric SD-WAN management.	Co-managed service	2026-09-01
17. Open Systems	technology vendor / managed service provider	MDR+ (Managed Detection and Response), Managed SD-WAN / Secure SD-WAN, Managed, Universal SSE, Mission Control	Buyers comparing a managed operating model for SD-WAN and SASE.	Managed SD-WAN and SASE supported by Open Systems' Mission Control service team.	Multi-tenant MSP / white-label support	2026-09-01
18. Orange Business	carrier network provider / integrator	Orange Business Evolution Platform, Orange Business SASE with Palo Alto Networks Prisma SASE, Orange Business and Fortinet SASE, Orange Cyberdefense Managed SASE	Multinational enterprises wanting a single global managed provider for SD-WAN, SASE and access.	Global managed network leadership with strong service assurance, NOC depth and field operations.	DIY / self-managed model	2026-09-01
19. Barracuda SecureEdge	technology vendor	Barracuda SecureEdge, Barracuda SecureEdge Access, BarracudaONE, Secure Edge Manager	Buyers and service providers comparing SecureEdge deployment and management options.	SecureEdge combines SD-WAN and cloud security, with an MSP option for multi-tenant management.	Fully managed service	2026-09-01
20. BT	managed service provider / carrier network provider	Agile Connect, BT Managed Fortinet Firewall, BT Managed SASE (Fortinet-based), BT Managed SASE (Meraki-based)	UK enterprises wanting a single supplier for SD-WAN platform, access circuits, security and field operations.	UK market leader for managed SD-WAN with deep access circuit ownership and field engineering capability.	DIY / self-managed model	2026-09-01
21. GTT	hybrid provider	GTT Envision, GTT Managed SD-WAN, GTT Secure Connect, Secure Connect with HPE (Aruba/EdgeConnect/SSE)	Multinational enterprises needing strong international backbone alongside managed SD-WAN.	Tier 1 global backbone provides strong international transit capability alongside managed SD-WAN.	Fully managed service	2026-09-01
22. VeloCloud	technology vendor	Arista AVA, Edge Threat Management (ETM), SSE partner integrations, VeloCloud Orchestrator	Enterprises consuming VeloCloud through a managed service provider (Vodafone UK, others).	VeloCloud was an early SD-WAN platform with strong cloud-delivered gateway architecture; now under Arista following the 2025 acquisition.	Fully managed service	2026-09-01
23. Vodafone Business	managed service provider / carrier network provider	Fortinet-based Secure Networking, Vodafone Business Managed Network Services, Vodafone Business Network as a Service (NaaS), Vodafone Business SASE	UK and European enterprises wanting carrier-led SD-WAN with strong mobile and 5G integration.	Strong UK and European market presence with NaaS positioning and integrated mobile/fixed access.	DIY / self-managed model	2026-09-01
24. Verizon Business	managed service provider / carrier network provider	RingCentral (voice/UC integration), Verizon Managed SD Branch, Verizon Managed SD WAN, Verizon SASE Management	North American and multinational enterprises wanting carrier-led managed SD-WAN and SASE.	Global carrier-led managed SASE and SD-WAN with strong North American presence and international delivery.	DIY / self-managed model	2026-09-01
25. Colt Technology Services	carrier network provider	Colt SASE Gateway solution, Colt SD WAN, Colt SD WAN Remote Access, Partner IP Access (Blue Wireless)	European enterprises prioritising data residency, sovereignty and regulatory alignment.	SD-WAN and SASE with strong European data sovereignty positioning.	DIY / self-managed model	2026-09-01
26. Comcast Business	managed service provider / carrier network provider	Comcast Business CASB, Comcast Business FWaaS, Comcast Business Managed SD-WAN, Comcast Business SASE	North American enterprises wanting managed or co-managed SD-WAN and SASE from a single carrier.	SASE combining SD-WAN and security available fully managed or co-managed, drawing on Masergy AIOps heritage.	DIY / self-managed model	2026-09-01
27. NTT DATA	carrier network provider	Managed Campus Networks with Prisma SASE, Managed Internet Connectivity, Managed IoT and Network as a Service (NaaS), Managed Network Security	Multinational enterprises wanting truly global managed delivery with consistent operations across regions.	24x7 managed SD-WAN delivery via global operations centres with strong portal visibility.	DIY / self-managed model	2026-09-01
28. Virgin Media O2 Business	managed service provider / carrier network provider	8x8 Voice for Teams, Cloud Infrastructure as a Service / Platform as a Service, Managed Detection and Response, Success Agreement	Buyers comparing managed connectivity and partner-delivered cloud security.	Managed connectivity and SD-WAN with Zscaler-based SASE; confirm the current contracting entity and scope.	DIY / self-managed model	2026-09-01
29. AT&T Business	managed service provider / carrier network provider	AT&T Dynamic Defence with Palo Alto Networks, AT&T Managed SASE with Cisco, AT&T Managed SD-WAN, AT&T Network as a Service (NaaS)	US-headquartered enterprises wanting integrated carrier-led SD-WAN and SASE.	Major US carrier-led managed SD-WAN portfolio with multi-vendor platform options (including Fortinet for AT&T SASE).	DIY / self-managed model	2026-09-01
30. SonicWall Cloud Secure Edge	technology vendor	Global Response Intelligent Defence (GRID) Threat Network, Managed Protection Security Suite (MPSS), SAMI, Secure Internet Access	SMB and mid-market organisations already running SonicWall firewalls.	SD-WAN delivered via existing TZ, NSa and SM firewall appliances; familiar deployment for organisations standardised on SonicWall.	Fully managed service	2026-09-01

The table uses governed provider records. Unknown evidence is shown as a point to confirm, not a negative score.

Ordered evidence directory for all providers — Provider evidence in the same published evidence order as the numbered list. Positions are not fit scores.

Provider evidence guides

Provider evidence by sector, size and priority

Definitions

The 40 capabilities, defined

Every provider is graded against the same 40 capabilities. One sentence on what each row measures; grades reflect public evidence, so always confirm via RFP.

Service delivery and operating model

8 capabilities

Fully managed service.: The provider designs, deploys, monitors, changes, supports and reports on the service end to end, so the customer sets policy and outcomes rather than running day-to-day operations.
DIY / self-managed model.: The customer's own team operates the platform directly, owning the controller, policies, updates and incident response.
Co-managed service.: Responsibility is shared: the provider runs the platform and support while the customer retains selected policy and change rights.
Multi-tenant MSP / white-label support.: The platform supports tenant isolation, delegated administration, branded portals and templates, so managed service providers can operate it for many customers under their own brand.
Professional services and migration support.: Structured design and migration services are available, covering discovery, pilots, staging, migration runbooks, rollback plans and training.
Last-mile circuit management.: The provider sources, monitors and supports the underlay access circuits at each site, across broadband, dedicated internet access, LTE and 5G, MPLS and cross-connects, giving one accountable party for connectivity and overlay together.
Lifecycle management.: Hardware replacement, firmware upgrades, patching, renewals and end-of-life planning are handled as part of the service.
Flexible commercial model.: Pricing can be structured in more than one way, such as per site, per user, per bandwidth, consumption-based or as NaaS, with terms that adapt to the buyer's estate.

Network architecture and transport

10 capabilities

Encrypted overlay fabric.: Site and user traffic runs through secure tunnels built over any underlying transport, including broadband, dedicated internet, MPLS, LTE and 5G or satellite, keeping data protected across mixed networks.
Dynamic path selection.: The platform routes traffic in real time based on measured latency, jitter, packet loss and policy, steering around brownouts without manual intervention.
Active-active link utilisation.: All available links carry traffic concurrently rather than one sitting idle as passive backup, increasing usable capacity and smoothing failover.
Application-aware routing.: Traffic is identified at application level and routed by per-application policy, so business-critical applications such as UCaaS and ERP take priority.
QoS and traffic shaping.: Bandwidth can be prioritised, reserved and policed per application or traffic class, protecting voice, video and critical traffic under congestion.
Packet loss remediation.: Techniques such as forward error correction, packet duplication, jitter buffering and TCP optimisation repair or mask loss on poor-quality links, keeping real-time applications usable.
Local internet breakout.: Internet-bound traffic exits securely and directly from the branch rather than being backhauled through a central data centre, reducing latency for cloud and SaaS traffic.
MPLS coexistence and migration.: Existing MPLS circuits can run alongside internet and cellular transport during a phased migration, so estates move site by site without a risky single cutover.
Cellular and 5G support.: 4G and 5G connections are supported as primary or failover transport, with integrated or external modems, SIM management and signal monitoring.
Cloud on-ramp.: Connectivity into cloud platforms such as AWS, Microsoft Azure, Google Cloud and Oracle, and interconnect fabrics such as Equinix and Megaport, is automated and simplified rather than hand-built per cloud.

Gateway, PoP and backbone design

8 capabilities

Public cloud gateways.: The vendor operates shared gateways and points of presence that deliver SaaS optimisation, remote access or security enforcement as a cloud service; this measures the vendor's own service infrastructure, distinct from dedicated private PoPs.
Private PoPs / dedicated PoPs.: Points of presence can be supplied as customer-hosted, dedicated or sovereign deployments rather than only the provider's shared multi-tenant locations.
Private global backbone.: Traffic between regions rides a backbone owned or controlled by the vendor rather than the public internet, giving predictable latency and loss between PoPs.
Regional breakout and data residency.: Traffic can be pinned to chosen countries, regions or approved inspection locations, supporting data residency and sovereignty requirements.
Multi-cloud transit fabric.: Branch-to-cloud, cloud-to-cloud and user-to-cloud traffic runs under one common policy through the provider's fabric rather than through customer-built interconnects.
Flexible edge form factors.: The edge is available as hardware appliances, virtual machines, cloud marketplace images, containers or uCPE, so each site can use the form that suits it.
High availability design.: Redundant designs are supported across appliances, circuits, power and gateways, with clustering and automatic failover keeping sites connected through failures.
SLA-backed service fabric.: The service carries contractual commitments covering uptime, response and change handling, and in some cases latency, jitter and loss, rather than best-effort targets.

Security and SASE capability

9 capabilities

Integrated next-generation firewall.: Stateful firewalling, application control, intrusion prevention, malware inspection and URL filtering are built into the platform rather than supplied as a separate appliance.
Full SASE platform.: Networking and security converge in one platform, combining SD-WAN with cloud-delivered controls including SWG, CASB, ZTNA, firewall as a service, DLP and threat prevention.
SSE ecosystem integration.: The platform interoperates with third-party security service edge providers such as Zscaler, Netskope, Palo Alto Prisma Access and Cisco Secure Access, for buyers running a best-of-breed rather than single-vendor stack.
Zero Trust Network Access.: Users are connected to specific private applications based on identity and device posture rather than being placed on the network, replacing broad VPN access with least-privilege access.
Secure web gateway.: Web traffic is filtered and inspected, with URL filtering, SSL inspection, malware scanning and acceptable-use controls enforced in the cloud.
CASB capability.: Cloud access security broker controls provide SaaS discovery, sanctioned and unsanctioned application control and SaaS policy enforcement, including shadow IT visibility.
Data loss prevention.: Content is classified and inspected for sensitive data, which can be blocked or flagged before it leaves the organisation, with alerting and exception workflows.
Remote user access.: Remote workers, contractors and mobile users connect through the same platform and policies as sites, through a lightweight client or clientless browser access.
SOC/SIEM/SOAR integration.: Logs, events and threat intelligence export cleanly over syslog and APIs into SIEM, SOAR and security operations tooling, so the service fits an existing detection and response workflow.

Operations, assurance and automation

5 capabilities

Centralised orchestration.: Configuration and policy are managed from a single console using templates, intent-based policy and zero-touch provisioning, with changes pushed network-wide rather than device by device.
Customer portal and RBAC.: A customer-facing portal provides real-time status, reporting, tickets and change requests, with role-based access so different teams see and change only what they should.
Observability and digital experience monitoring.: Application experience, user experience, device health and path analytics are measured end to end, so degradation is visible before tickets are raised.
APIs and automation.: Documented interfaces such as REST APIs, Terraform, webhooks and event streaming allow configuration, reporting and ITSM integration to be automated.
Managed service assurance.: The provider's 24/7 NOC and SOC monitor the service proactively, own incidents through to root cause analysis, and run structured service reviews and change governance.

Questions

How the shortlist builder works

Which SD-WAN vendor is best?

There is no single best vendor for every estate. The right shortlist depends on operating model, regions, applications, security requirements and the evidence a supplier can provide for the project.

Who are the leading SD-WAN providers?

The SD-WAN vendor view lists public provider evidence by proven capability count, verification date and name. Computed fit against your operating model, regions and requirements unlocks after verified project publication.

Is SD-WAN obsolete?

No. SD-WAN remains the network layer in many SASE designs. SASE adds cloud-delivered security and access controls rather than removing the need to control WAN traffic.

Should a business choose SD-WAN or MPLS?

Many estates use both during migration. SD-WAN can use internet, cellular and MPLS underlays, while the RFP should define application performance, resilience and any sites that must retain private circuits.

Who are the leading SASE vendors?

The SASE vendor view lists providers with public SASE, ZTNA or secure web gateway evidence in published evidence order. Buyers should compare the networking and security components separately before accepting a single-vendor claim.

How does the shortlist builder rank vendors?

Public comparison pages show source grades and provider lists ordered by published evidence. After verified publication, the private matching engine evaluates your requirements against the current catalogue and freezes its matching rules, evidence, ranks and scores with that publication.

Can I share or save my shortlist?

You can share a public comparison link. Your personalised shortlist is saved in your project and unlocks after verified anonymous publication.

What does Build from requirements do?

Describe your estate, review a short project notice and verify your business identity. Publishing anonymously unlocks a personalised shortlist and supplier responses; a full RFP is optional.

Is this comparison vendor neutral?

Public comparisons use the same capability definitions and published evidence for every provider. Public positions follow evidence counts, verification date and name, not computed fit. Personalised rankings require authorised access after verified publication. Netify is a BT Authorised Partner and earns commission on some routes to market; those relationships do not determine the public evidence order.

How accurate are the extended dimensions?

There are two different levels of evidence here and we would rather be plain about which is which. Eighteen facts per provider were re-sourced on 29 July 2026 from the provider's own published material or an independently accountable record, and each one carries a named source, a reliability tier and a sentence quoted from that source which we then re-checked against the live page: the thirteen capabilities that genuinely separate this market, who owns the underlay, whose security service edge stack it is, whether real compliance documentation exists rather than a general assurance, plus published points of presence and availability SLA. The remaining grades, including regional coverage, cloud support, AI capability and resilience, are still indicative desk research rather than individually sourced, and we say so rather than dress them up. Where we could not evidence something we publish it as unknown with the reason. For anything you are going to sign a contract on, confirm it through a structured RFP, which Netify can create and issue to your shortlisted providers.