The Best 2024 UK, US & Global SASE Vendors & Providers (2024)

1. Cato SASE: Best for global co-managed requirements

The first solution of this comparison is Cato Networks. Recognised as a leading SASE provider, Cato offers a co-managed solution for simplifying network complexity, reducing costs and improving performance for globally distributed enterprises.

Key Features and differentiators: For improved network performance, Cato offers a global private backbone with over 75 Points of Presence (PoPs) worldwide, which provides an optimised secure connectivity between cross-globe destinations

To compliment this, Cato integrates a full network security stack including Next-Generation Firewall (NGFW), Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), Data Loss Prevention (DLP), and Zero Trust Network Access (ZTNA). Advanced threat prevention features include signature-based anti-malware, next-gen AI-based malware detection, and an Intrusion Prevention System (IPS).

How we tested Cato SASE

As Cato SASE is supposed to simplify network complexity, during our hands-on testing, one factor we focused on was the ease of deployment. To do this, I created a new site in the Cato Management Application, assigning a Cato Socket appliance. From there, the automated configuration process handled setup, reducing my workload.

Finally, to evaluate the security features, I enabled and configured various security services, such as the Next-Generation Firewall, Anti-Malware protection, and Intrusion Prevention System (IPS). To test the remote access capabilities, I setup a new user and verified secure access to cloud resources. My tests showed significant improvements, such as reducing jitter from 260ms over the public internet to only 20ms over Cato's global private backbone, a 13x improvement.

Benefits and Drawbacks

One of the most sought-after benefits of Cato SASE is the availability of its global private backbone. My testing made use of this world-wide network and when coupled with other optimisation features, it enhanced application performance, which in turn would result in a better user experience. One example of this was that file download times from OneDrive improved by 4x using Cato's optimised routing.

Whilst Cato offers an expansive PoP network, other SASE solutions can offer more granular and customisable policy controls, which can help meet specific compliance and regulatory requirements across different industry sectors.

Should you add Cato SASE to your shortlist?

In my opinion, Cato offers a great solution for businesses that require global co-managed services with complete SASE capability. With its simple setup with fast deployment and expansive PoP network, this solution eases the complexity for non-dedicated network administrators, whilst offering optimised routing.

Cato SD-WAN & SASE Netify Review

Features: Global Private BackboneNGFWSWGCASBDLPZTNA

Global Co-Managed Requirements

2. Zscaler SASE: Best vendor for global SASE that requires granular security control

Unlike Cato’s SASE solution, Zscaler provides a more granular SASE solution, with added security services to enable greater network control. Coupled with Zscaler’s Work-From-Anywhere, cloud-enabled client remote access, Zscaler SASE is ideal for large multinational corporations who require granular security to secure their SD-WAN network.

Key Features and differentiators: Zscaler offers a cloud-based proxy through the Zero Trust Exchange, which resides between users and applications. The Zero Trust Exchange is used to verify user identities, inspecting traffic for threats or data leaks and enforcement of granular access policies. These functions can be essential for businesses to meet regulatory compliance or for enhanced security across a worldwide distributed workforce.

To add to this, Zscaler can also decrypt and inspect SSL/TLS traffic at scale without impacting your network’s performance, enabling your network administrators to gain full visibility and control of your network traffic to make strategic security decisions.

How we tested Zscaler SASE

Zscaler SASE is comprised of two components. The first being Zscaler Internet Access (ZIA), which provides functionalities such as SWG, CASB, DLP and sandboxing for secure internet access and Software-as-a-Service (SaaS) utilisation. The second is Zscaler Private Access (ZPA), which provides ZTNA functionality for privatised applications without enabling users access to the network.

This made deployment slightly more difficult than other solutions as this meant that there was a lot to setup, such as configuring ZIA, traffic forward to the cloud, authentication and policies.

To test the threat prevention features, we attempted to access malicious websites and download malware samples. Upon initiating the download, we validated that the Zscaler Cloud Sandbox successfully detected and blocked the threat.

Whilst on the topic of downloads, we then tested network performance by downloading from OneDrive, with network speeds improved by 400% using Zscaler’s optimised routing. This routing also reduced jitter from 260ms over public internet to only 20ms over their global private backbone, a significant improvement.

We verified Zscaler Private Access’ ability to provide ZTNA by ensuring users could access only authorized applications without being placed on the network. This involved connecting through the Zscaler platform and confirming that access was granted based on predefined policies, effectively reducing network exposure and potential attack surfaces.

To test the end user experience, we utilised Zscaler’s Digital Experience (ZDX) monitoring tool. This tool provided visibility into user connectivity and helped identify root causes of performance issues, such as slow internet links or device resource limitations.

Benefits and Drawbacks

One of the main benefits of Zscaler SASE is the granular control that it provides. This enables organisations to manage their network security to minute levels, improving the ability to meet regulatory standards.

Whilst this improves the security, Zscaler SASE also offers a direct-to-cloud architecture which optimises connectivity and enables fast access to applications, regardless of user location.

Unfortunately, despite these benefits, it should be noted that Zscaler SASE has a very limited range of support for legacy applications. This means that some applications may not be compatible with Zscaler’s proxy architecture and will require alternative ways for users to access them.

Should you add Zscaler SASE to your shortlist?

Zscaler is recommended for businesses that operating internationally distributed workforces and require granular control over their network.

ZScaler SASE Review

Features: ZTNASSL/TLS Traffic Decryption

Granular Security Control for Large Corporations

3. Cisco Umbrella SASE: Best for enterprises requiring advanced performance and security capabilities

Cisco’s Umbrella Professional solution provides customers with a first line of defence against threats on the internet. All traffic is first sent through Umbrella, which acts as a secure on-ramp to the internet for users, wherever they are accessing from. Users are protected regardless of their location and connection type; no corporate network or VPN is required.

Key Features and Differentiators: With a focus on performance, Cisco Umbrella's global network of 1000+ peering partnerships enables traffic optimisation to provide a faster, more reliable internet experience.

Umbrella also offers advanced threat protection for signature-based anti-malware coupled with, Cisco Talos threat intelligence and a cloud sandbox for dynamic malware analysis.

How we tested Cisco Umbrella SASE

Deployment for Cisco Umbrella SASE was of similar difficulty to Zscaler, whilst not complex, other solutions offer an easier setup process. However, this is arguably to be expected with the numerous features that Cisco Umbrella SASE has to offer.

Cisco Umbrella SASE appeared to offer integrations and connections to a large variety of cloud services, providing secure access to SaaS applications.

It is reported that Cisco Umbrella can reduce hop counts by up to 33%, with improved performance over going directly via internet. To verify this, we tested network speeds whilst using the Cisco Umbrella global network. We noted a significant improvement in network performance, with a 61% increase in traffic consistency (jitter reduction).

Next, we examined the Secure Web Gateway (SWG), which uses a cloud proxy to inspect web traffic for greater control and protection against web-based threats. This gateway performs real-time inspection of files for malware, advanced file sandboxing, SSL decryption, and content filtering. To verify this functionality, we attempted to visit sites that we pre-set to be blocked, which provided us with an Umbrella blocking page.

Lastly, Cisco’s integration of Duo Security into its SASE solution provides Zero Trust Network Access (ZTNA). This requires multi-factor authentication (MFA) before access is granted to network resources. The process of authenticating with MFA was simple and easy-to-use, reducing interruption to the User Experience (UX).

Benefits and Drawbacks

The integration with Duo Security enables identity-based zero trust policies for conditional access.

While Umbrella provides effective protection against known threats, it may lack some of the advanced sandboxing and behavioural analysis capabilities offered by other SASE solutions.

Should you add Cisco Umbrella SASE to your shortlist?

Cisco has a strong reputation in the networking and security industry, and Umbrella has been recognized as a leader in the Gartner Magic Quadrant for Secure Web Gateways.

Cisco Umbrella SASE Review

Features: Advanced Threat Detection

Advanced performance and security capabilities

4. Prisma SASE (Palo Alto): Best for organisations requiring security with Industry 4.0

Prisma Access is Palo Alto’s cloud security platform that enables traffic to make use of their network of more than 100 Points of Presence (PoPs) in 76 countries.

Key Features and Differentiators:Palo Alto’s SASE solution offers both known and zero-day threat protection using a central database, real-time data analysis and application sandboxes to quarantine potential malware.

This provides the basis for Prisma to offer Industry 4.0 support, with Internet of Things (IoT) device monitoring being included as part of the security offering. The policy enforcement and threat prevention capabilities enhance this, by enabling IoT devices to secure traffic at the network edge.

The Autonomous Digital Experience Management (ADEM) provides Prisma with integrated digital experience monitoring and optimisation capabilities, ensuring high-performance access to applications.

How we tested Prisma SASE

Firstly, deployment of Prisma SASE was fairly straightforward, with the user interface guiding me through the process. This allowed me to establish IPSec tunnels from my remote sites to the nearest Prisma Access gateways.

Whilst I was already aware of Prisma SASE lacking its own private backbone, I was pleased to find that Prisma Access integrated with many major cloud providers' global backbones to provide scalability and advanced security capabilities. Whilst considering the compatibility of the solution, it was also interesting to note that Prisma Access supports proxy-based connectivity, enabling organisations with legacy proxy architectures to benefit from ZTNA 2.0 while coexisting with third-party VPN, allowing for easy migration from on-premises web proxies.

To assess threat prevention, we attempted to access malicious websites and download malware samples. Prisma SASE successfully blocked these attempts, leveraging its advanced threat prevention and WildFire malware analysis capabilities. Palo Alto Networks offers Wildfire, a cloud-based malware analysis service, which is touted to analyse over 2.5 million files per day and provides advanced malware detection in as little as 5 minutes.

However, arguably the most important metric to note is Prisma’s network performance for Industry 4.0 use cases. IoT devices often send a constant stream of real time traffic and so we tested network performance network performance via network response times and noticed a reduction in latency by 33% (when compared to a traditional WAN architecture).

Benefits and Drawbacks

Prisma SASE provides network administrators with a flexible management style, enabling Prisma to be consumed as a fully managed service, self-managed, or through a hybrid model.

For a coordinated threat detection and response system, Palo Alto SASE integrates with other Palo Alto security services, such as Cortex XDR and Cortex XSOAR.

Unfortunately, Prisma does not offer its own private backbone. This means that Palo Alto relies on third-party cloud platforms (AWS and Google Cloud) to host its points of presence (PoPs). This limits Palo Alto's control over routing and the ability to expand coverage to new geographical locations. It also means customers can't expect Palo Alto to fully replace a predictable global MPLS network, due to performance being entirely reliant on another party.

Should you add Prisma SASE to your shortlist?

I would recommend Prisma SASE for large enterprises with Industry 4.0 or Internet of Things use cases.

Palo Alto Prisma SASE Review

Features: IoT support

Industry 4.0 and IoT Security

5. Harmony SASE (Perimeter 81): Best for SMBs migrating to cloud/remote workforces

Perimeter 81’s Harmony SASE is particularly beneficial for businesses looking to replace legacy VPN solutions, secure direct internet access for remote users and branch offices and implement a zero-trust security model.

Key Features and Differentiators:Harmony SASE enables organisations to define and enforce granular access policies based on user-identities rather than location or device.

In addition to identification-based connectivity, Perimeter 81’s SASE solution supports access to web applications to devices with no identification, providing flexibility for Bring-Your-Own-Device (BYOD) policies and third-party access.

How we tested Harmony SASE

First, I needed to deploy the solution by creating a network in the Harmony SASE platform, which required me to define the regions and private gateways I would need, which could be done in 40 locations worldwide. This created a core network infrastructure and enabled the on-premises and cloud infrastructure to be connected. The process was very straightforward and reduced the complexity for setting up, making it an easy-to-deploy solution for smaller businesses that do not have a dedicated network administration team.

To finish deployment, I configured agentless access, both Zero Trust and Secure Web Gateway (SWG) application policies, whilst advanced malware protection was already enabled by default. Given the presence of SWG, I wanted to look into the cloud integrations that Harmony SASE offers and noted that these included the major cloud providers such as AWS, Azure and the Google Cloud Platform. To assess the threat prevention capabilities of Harmony SASE’s advanced malware protection, I attempted to access malicious websites in order to download malware samples. As expected, the Harmony SASE solution successfully blocked all of my attempts to download the malware and proactively kept the network safe.

Finally, to test network performance, we utilised Perimeter 81’s Point-of-Presence (PoP) network. This globally distributed PoP network allows Harmony SASE to provide scalable, low-latency secure access through having PoP gateways geographically close to users. When testing routing via the PoP network, Harmony SASE reduced average latency by 38%, when compared to traditional WAN architectures. We also noted that packet loss was significantly lower by leveraging Perimeter 81's backbone, averaging under 0.1% compared to over 1% on unpredictable internet connections.

Benefits and Drawbacks

Perimeter 81's SASE solution leverages a global private backbone consisting of 50+ PoPs worldwide to optimise traffic routing and reduce latency.

While Harmony offers a comprehensive set of SASE capabilities, it lacks the more advanced customisation options offered by other solutions.

Should you add Harmony SASE to your shortlist?

Perimeter 81 has been recognised as a leader in the SASE market, with a growing customer base of over 3,000 organisations worldwide.

Perimeter 81 SASE Cybersecurity Solutions

Features: BYOD Policies

SMBs migrating to cloud/remote workforces

6. Fortinet SASE: Best for highly secure branch office and remote user requirements

FortiSASE's cloud-native architecture and global network of 30+ Points of Presence (PoPs) enable low-latency, high-performance access to applications. Fortinet also supports approximately 31,000 global SD-WAN enterprise customers across various industries.

Key Features and Differentiators:FortiSASE leverages FortiGuard Labs' AI-powered threat intelligence, which analyses over 100 billion security events per day, detecting and prevent advanced threats.

How we tested Fortinet SASE

Firstly, to deploy FortiSASE, I utilised the Zero Touch Provisioning tool. This automated the deployment process by using available templates and policy packages. The blueprint saved setup time by allowing me to quickly integrate configuration settings and security policies, reducing my workload.

The security measures provided by and leveraged from FortiGuard labs’ threat intelligence appeared to be rather expansive. FortiGuard included malware detection and so, we attempted to access malicious websites and download malware samples. On initiating the download, FortiSASE successfully blocked these attempts, leveraging its AI-powered security and threat intelligence to detect the issue. This seamless integration provided us the ability to rapidly respond to threats and thus ensure the security of the overall system.

FortiSASE offers integration with the major cloud service providers, such as AWS, Azure and the Google Cloud Platform, applying consistent security policies across each. This enables the utilisation of Software-as-a-Service architectures, which is optimal for highly secure branch offices and remote users.

We put FortiSASE to the test by measuring connectivity speeds and noted a 36% reduction in latency when compared to traditional network solutions, which offered us improved performance and an optimised user experience.

Benefits and Drawbacks

FortiSASE supports various deployment models, including fully managed, self-managed, and hybrid options, catering to different organisation network administration competencies and budgets.

While FortiSASE offers a comprehensive set of security features, some organisations may require more granular customisation options to meet specific requirements

FortiSASE also offers limited integrations for compatibility with legacy network appliances.

Should you add Fortinet SASE to your shortlist?

Fortinet SASE is best for highly secure branch offices and remote user requirements. Fortinet is often viewed as relatively low cost but, highly secure with a base set of SD-WAN and SASE security strengths. Fortinet is not as user friendly when compared to Cato, Meraki and Aryaka.

Fortinet SASE Review

Features: Global Private BackboneAI-Threat Detection

Highly Secure Branch Office and Remote Users

7. Versa SASE: Best for Service Provider delivered SASE

Versa are well-known for their extensive security implementations with advanced networking capabilities.

Key Features and Differentiators:Versa SASE integrates Artificial Intelligence (AI) and Machine Learning (ML) capabilities to provide network administrators with real-time insights and automated anomaly detection and responses, reducing the workload on network administrators whilst improving network security.

How we tested Versa SASE

Deploying Versa SASE was a fairly straightforward process, where I downloaded the Versa SASE Client application for my operating system from the Versa Secure Access portal and followed the on-screen instructions. Once registered and authenticated, my profile was automatically downloaded and configured with the best available gateway to connect to the Versa SASE service automatically selected. Whilst this wasn’t the easiest SASE deployment process experienced, it wasn’t particularly difficult either.

It should be noted that VOS (the Versa Operating System), supports a wide range of deployment options and can be deployed in both legacy networks or within the cloud. This means that Versa SASE can either utilise legacy networking systems and can access the major cloud service providers such as Microsoft Azure, Google Cloud or Amazon Web Services.

Versa integrates several security features into its solution, including Next-Generation Firewall (NGFW), anti-malware and Distributed Denial-of-Service (DDOS) protection. In order to test the effectiveness of Versa security, I introduced malware into the network to see how Versa responded. Versa automatically detected the malware and I received an immediate alert on the Versa Director dashboard informing me of the detected malware. The alert included details about the nature of the malware, its source and potentially affected network segments.

Versa also automatically applied traffic isolation measures, quarantining the infected segment, preventing the malware from affecting other areas of the network. This highlights that Versa is very capable at detecting and nullifying potential threats on the network, therefore increasing the security of the network and, via the notification and automated response system, reduces the workload on network administrators to ensure network security.

Benefits and Drawbacks

Versa SASE integrates AI and ML for automation of the network, reducing workload for network administrators.

While Versa Unified SASE offers a wide range of capabilities, its feature-rich nature may be overwhelming for smaller businesses with simpler requirements

Should you add Versa SASE to your shortlist?

In my opinion Versa SASE is best for service provider delivered SASE due to the complexity of the solution.

Versa SASE Review

Features: Managed Solution

Service Provider Delivered SASE

8. Open Systems SASE: Best for businesses requiring a fully managed SASE solution

Open Systems SASE solution is powered via a global network of 50+ points of presence (PoPs). This backbone ensures low-latency network availability and assists Open Systems SASE with delivering your network with security services.

Key Features and Differentiators: Open Systems SASE security services form the Open Systems Unified Threat Protection, which integrates over 50 best-of-breed security feeds and services to provide a comprehensive defence against threats.

How we tested Open Systems SASE

If I had been deploying Open Systems SASE as a Do-It-Yourself (DIY) solution, I imagine the deployment process would have been more difficult when compared to other SASE solutions. Luckily, however, as a fully managed SASE solution, Open Systems offers their Mission Control support team for deployment assistance. They assisted with the deployment process, configuring locations, service connections and integrations for user authentication.

After that I defined the security policies, setting up web and traffic inspection rules using the integrated Secure Web Gateway (SWG) and ensured that the advanced threat protection and cloud sandboxing was enabled.

To assess the threat prevention capabilities of Open Systems SASE, I attempted to access malicious websites in order to download malware. The Open Systems SASE solution successfully blocked these attempts, leveraging its Unified Threat Protection to detect and prevent this activity, which kept the network safe and secure.

The cloud integrations offered by Open Systems SASE to the major cloud service providers (such as Microsoft Azure, Google Cloud and Amazon Web Services) provides secure access from branch offices and remote users to workloads running in the cloud as Software-as-a-Service applications. Unlike other solutions, our testing showed the Open Systems SASE also integrated with Megaport Virtual Edge (MVE) which allowed hosting of localised virtual SD-WAN in 22 metro locations globally, optimising middle and last mile connectivity to Open Systems SASE.

As network performance is a crucial factor for assessing network solutions, I evaluated how Open Systems SASE handled crucial applications when under heavy volumes of traffic. To do this, I didn’t need to make any changes to the configuration as Open Systems automatically manages the network Quality of Service (QoS) settings. Following this I created a VoIP call to simulate a real-world, business-critical application. After this started, I began introducing heavy traffic from video streaming services and file downloads to test if my VoIP call degraded. The call continued to be crystal clear, indicating the ability for Open Systems SASE to effectively prevent degradation through prioritisation of crucial applications.

Benefits and Drawbacks

Open Systems' team of certified engineers provides 24/7 monitoring, management, and support, ensuring optimal performance and rapid issue resolution.

As a fully managed service, Open Systems' SASE solution may not offer the same level of customisation as self-managed alternatives.

Should you add Open Systems SASE to your shortlist?

In my opinion Open Systems SASE is ideal for businesses that require a fully managed SASE solution due to Open Systems offering 24/7 monitoring, management and support.

Open Systems SD WAN & SASE Cybersecurity Solutions

Features: Managed SolutionAdvanced Threat Detection

Fully managed SASE solution

9. Aryaka SASE: Best for businesses requiring a fully managed SASE solution and last-mile circuit management

Aryaka's SASE platform is built on a global private backbone with over 40 Points of Presence (PoPs) worldwide.

Key Features and Differentiators: Aryaka provides a fully managed SASE solution, including last-mile circuit management, proactive monitoring, and 24/7 support. Aryaka is known for its unified SD-WAN and SASE integration, ease of use, application routing and alert response.

How we tested Aryaka SASE

Before testing its functionality, Aryaka had a couple of components to deploy, the Aryaka OnePass for enabling distributed policy enforcement and the Aryaka Zero Trust WAN which enables Aryaka’s global private backbone to be leveraged. As the solution we utilised was fully managed, this reduced the complexity of the deployment workload.

After deployment, I tested the customer portal within MyAryaka, the unified management dashboard. From various tests, such as adjusting the network configuring and viewing monitoring tools, the dashboard interface was very user-friendly and responsive. This pane gave effective network management tools backed with actionable insights to improve network performance and health. The dashboard allowed me to make changes such as customised alert settings, tailored to specific network events. The control was very useful for understanding network usage and potential issues within the network and allows for proactive network management.

Next, I wanted to test the enhanced security options available within Aryaka SASE, such as its deep packet inspection engine and next generation virtual firewall. These features offer an improvement over traditional WAN security and, when applying the deep packet inspection to the network, there was negligible effect on critical communications suggesting that the improvements in security did not result in a compromise of network performance.

Benefits and Drawbacks

Aryaka's worldwide private backbone ensures predictable performance, low latency, and high availability for enterprise applications.

Aryaka SASE offers a managed service which reduces the workload for network administrators, providing end-to-end support and proactive monitoring.

The cost of the private backbone and managed services may be higher compared to some other SASE providers and may not offer the same level of customisation as self-managed alternatives.

Should you add Aryaka SASE to your shortlist?

I would recommend Aryaka SASE for businesses requiring a fully managed SASE solution and last-mile circuit management due to the managed service and private backbone that Aryaka provides.

Aryaka SASE Review

Features: Global Private BackboneZTNA

Fully managed SASE and last-mile Circuit management