In short: Todyl SASE is the network security module of the Todyl platform. An always-on agent sends device traffic through Todyl's cloud points of presence, applying zero trust access rules, a secure web gateway, DNS filtering and a next-generation firewall with SSL inspection. It is licensed per device, with LAN Zero Trust, static IPs and site tunnels as options.
What Todyl SASE is
Secure access service edge (SASE) moves the security you used to run on an office firewall into the cloud, so it follows each device. Todyl SASE does this with an always-on agent that creates an encrypted tunnel from the device to the nearest point of presence on Todyl's Secure Global Network (SGN), which Todyl says has more than 40 points of presence worldwide. Traffic is inspected and filtered there before it goes on to the internet or to your internal applications.
Because the agent is always connected, users do not have to remember to start a VPN, and the same policies apply at home, in the office, in a hotel or on a customer site. Todyl states that the core service needs no hardware: there is no appliance to buy, patch or replace.
The module brings together:
- Zero trust network access (ZTNA): identity-based conditional access rules that decide who can reach which internal resources
- Secure web gateway and web filtering: category and threat filtering for web traffic
- Secure DNS: protection against malicious and unwanted domains
- Cloud next-generation firewall (NGFW), with SSL inspection so threats hidden in encrypted traffic can be found
- Highly available architecture with automatic failover across the points of presence
Todyl SASE options and add-ons
SASE is the base licence. These options are added where you need them:
| Option | What it adds | Licensed by |
|---|---|---|
| Todyl SASE and ZTNA | The core agent: ZTNA, web gateway, DNS filtering and cloud NGFW for laptops, desktops and servers | Device |
| SASE and ZTNA Mobile | SASE protection for phones and tablets | Device |
| LAN ZeroTrust and Internal Segmentation | Blocks device-to-device traffic on the local network by default to stop lateral movement | Device |
| SASE Tunnel | IPsec site-to-site connections from an office or cloud network into the SGN | Per tunnel |
| Static IP | Dedicated public IP addresses so third-party systems can allow-list your traffic | Tenant |
| Multi-Engine Cloud Scanning | Scans downloads with several malware engines in the cloud | Device |
If you buy a Todyl package instead of individual modules, SSL inspection, two static IPs and LAN Zero Trust come with Advanced, and unlimited IPsec tunnels and multi-engine download scanning come with Complete.
How Todyl SASE is licensed
Todyl SASE is a subscription counted by the devices running the agent, billed monthly in arrears on what was protected. Mobile devices are licensed through the mobile option, or come as an allowance with a package. Static IPs are a per-tenant charge for your organisation rather than per device.
Todyl describes SASE as offered with no annual contracts, so you can add devices for a project or switch features off when they are no longer needed. Ask us for a quote and we will price the core licence and any options against your device count.
Requirements and deployment
Deployment is software-only. We push the agent to Windows desktops and servers through your device management or RMM tooling, and the mobile agent to phones and tablets through your mobile device management. We confirm support for any other operating systems in your estate before we start.
A typical rollout:
- Map the internal applications, file shares and RDP hosts users need to reach.
- Build ZTNA rules by group, plus web filtering categories and firewall policy.
- Pilot with a small group, then roll out to all devices.
- Add LAN Zero Trust, static IPs or site tunnels where required, and retire the old VPN.
The SASE agent is the same agent used by Todyl Endpoint Security, so adding endpoint protection later does not mean another install.
Who Todyl SASE suits
Todyl SASE suits organisations with hybrid or remote staff that want to replace an ageing VPN or remote desktop gateway, multi-site businesses that want the same web filtering and firewall rules everywhere, and anyone who needs a fixed IP for access to a supplier portal or cloud application without routing everything through the office. It also helps with evidence for insurers and frameworks such as Cyber Essentials, where firewalls and access control are core controls.
Compare other options in SASE, ZTNA and business VPN and DNS and web filtering. See all vendors on our vendors A to Z, or go back to the Todyl overview.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Todyl SASE need any hardware?
No. Todyl states that the core SASE service is entirely cloud based. Devices with the agent connect over a secure tunnel to a regional point of presence. Offices can optionally connect with IPsec site tunnels.
Can Todyl SASE replace our VPN?
Yes. The agent is always on and applies zero trust access rules, so users reach internal applications without logging in to a VPN, and the same policies apply wherever they work.
Does Todyl SASE work on mobile phones?
Yes. Phones and tablets are covered by the SASE and ZTNA Mobile licence, and each Todyl package includes a mobile device allowance (a 1:1, 1:2 or 1:4 ratio depending on the package).
What is Todyl LAN Zero Trust?
LAN ZeroTrust and Internal Segmentation is an add-on that blocks internal traffic between devices by default, so an infected laptop cannot spread to others on the same office or home network.