In short: SASE (secure access service edge) combines network access and security, such as ZTNA, secure web gateway, CASB and firewall as a service, in one cloud service. ZTNA gives users access to specific applications rather than the whole network. Business VPNs provide encrypted connections and fixed IPs. All three are usually licensed per user, sometimes with site or bandwidth add-ons.
SASE, ZTNA and VPN explained
The traditional model put a firewall around the office and a VPN in front of it for remote staff. With applications in the cloud and people working anywhere, that model creates bottlenecks and gives every connected user broad access to the network.
- Business VPN creates an encrypted tunnel from a device to your network or a cloud gateway. Modern business VPN services, such as NordLayer, add dedicated IP addresses, site-to-site links and central user management without on-site hardware.
- ZTNA (zero trust network access) grants access to individual applications, only after checking who the user is and whether their device meets policy. Users never land on the network itself, which limits what an attacker can reach with a stolen login.
- SASE (secure access service edge) brings ZTNA together with secure web gateway, cloud access security broker (CASB), firewall as a service and often SD-WAN, delivered from the vendor's cloud. Some vendors call the security half SSE (security service edge).
Examples include Check Point Harmony SASE, Cisco Secure Access, Sophos ZTNA, Todyl, Exium and Zero Networks, alongside business VPN services such as NordLayer.
SASE, ZTNA and business VPN: vendors and products we supply
- Check Point: Endpoint, email, SASE, mobile, browser, WAF and MDR licences in one Check Point Portal tenant.
- Check Point Harmony SASE: Secure internet access and zero trust private access, licensed per user.
- DefensX: Browser security with DNS protection, phishing and credential defence, AI data controls and ZTNA.
- DefensX Browser security: Core, Core Plus, Premium and Premium+ editions compared, licensed per user.
- Exium: SASE, software firewall, XDR and identity on one platform, licensed per user.
- Exium Cyber Gateway: Software firewall, SD-WAN and IDS/IPS for each site.
- Exium SASE: Zero trust access and web, DNS and SaaS security, per user.
- Island: Enterprise browser and extension with built-in security, per user.
- Island Enterprise Browser: Managed Chromium browser with DLP, safe browsing and zero trust add-ons.
- Keeper Security Connection Manager: Self-hosted, browser-based RDP, SSH and VNC access with session recording.
- Nord Security: NordLayer network access, NordPass password management and NordStellar threat exposure monitoring.
- Nord Security NordLayer: Business VPN, ZTNA, cloud firewall and DNS filtering, licensed per user with no hardware.
- Sophos: Endpoint, EDR, XDR, MDR, firewall, email and mobile security licences, managed in Sophos Central.
- Sophos Workspace Protection: Protected Browser, ZTNA, DNS Protection and Email Monitoring System in one per-user licence.
- Timus Networks: Timus SASE: zero trust access, cloud firewall and web filtering in one per-user subscription.
- Timus Networks Timus SASE: Zero trust access, always-on agent, cloud firewall and web filtering, licensed per user.
- Todyl: Modular SASE, EDR, SIEM, 24/7 MXDR and GRC on one agent, billed monthly per device.
- Todyl SASE: Zero trust access, web gateway and cloud firewall through one always-on agent.
- Trend Micro: TrendAI Vision One endpoint, email, XDR and ZTSA, plus Worry-Free for smaller businesses.
- Trend Micro Zero Trust Secure Access: ZTNA private access, secure web gateway and AI service access with risk-based policy.
- TruGrid: Zero trust remote desktop access and BitLocker management for Windows.
- TruGrid SecureRDP: Zero trust RDP to PCs, RDS and virtual desktops with MFA and no open ports.
- WatchGuard: Firebox firewalls, endpoint security, MDR, AuthPoint MFA and FireCloud SASE.
- WatchGuard FireCloud: Cloud firewall and secure web gateway for remote users, with ZTNA in Total Access.
- Zero Networks: Agentless microsegmentation, identity segmentation and secure remote access.
- Zero Networks Connect remote access: MFA-gated remote access with no open ports, for staff and suppliers.
What to look for
- Application access model: agent-based, agentless (browser) or both, and support for legacy protocols such as RDP and SSH
- Device posture checks before access is granted
- Points of presence in or near the UK for good performance
- Web security: URL filtering, TLS inspection, data loss prevention and CASB for cloud apps
- Identity integration with Microsoft Entra ID, Google Workspace or Okta, plus MFA
- Migration path: can you run it alongside your current VPN while you move users across?
It is also worth checking how the service behaves when it cannot reach the cloud, how it handles split tunnelling for video calls, and whether local internet breakout is allowed for trusted SaaS applications. Those details make a big difference to how staff experience the service every day.
How SASE and ZTNA are licensed
Most SASE and ZTNA services are licensed per user, in tiers that add capabilities such as secure web gateway, CASB, DLP or firewall as a service. Site connections, extra bandwidth, dedicated IPs or dedicated gateways may be add-ons. Business VPNs are usually per user with dedicated servers or IPs priced separately. Annual terms are common, though several vendors offer monthly billing.
How to choose
- List the applications users need: SaaS, internal web apps, file shares, remote desktop and anything legacy.
- Decide whether you need full SASE or a narrower step first, such as ZTNA to replace a VPN or DNS and web filtering for internet protection.
- Check how the service handles contractors and unmanaged devices; a secure enterprise browser can help here.
- Plan the cut-over from your existing VPN, keeping a fallback during the pilot.
Our specialist Cloud Security site explains SASE and ZTNA in more depth, and Cisco Umbrella covers Cisco's DNS and secure internet gateway service.
How we help
We help you work out which approach fits your users and applications, supply the subscriptions on your Forever Systems account and plan a phased roll-out. Contact us for a quote.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is ZTNA a replacement for a VPN?
For most application access, yes. ZTNA grants access to specific apps after checking the user and device, rather than putting users on the network. Some organisations keep a VPN for a few legacy needs during migration.
What is the difference between SASE and SSE?
SSE (security service edge) is the security part of SASE: secure web gateway, CASB and ZTNA. SASE adds networking, typically SD-WAN, so branch connectivity and security come from one service.
Do I need SASE as a small business?
Not always. A small business with cloud apps may get most of the benefit from MFA, DNS filtering and endpoint protection. SASE becomes worthwhile as you add sites, remote staff and internal applications.