SASE vendors for MSPs: 24 products compared

SASE vendors pitch their products as the replacement for a small client's VPN concentrator and office firewall: one cloud service that connects users to what they need and inspects the traffic on the way. The catalog's SASE / SSE category lists 24 products from 22 vendors as of October 2026. Some are built for MSPs, others are broader platforms that also sell through MSPs. This guide covers the terms, how the groups differ, and what to check before you put a client on one.

Key facts, October 2026

• 24 products from 22 vendors are listed under SASE / SSE.
• All 24 are client-facing: 16 run by the MSP and paid for by the client, 8 resold. None is internal MSP tooling.
• 4 expose a public API and 1 has a verified MCP server, Cloudflare Gateway.
• 3 list a verified ConnectWise PSA integration, 1 Halo PSA and 1 Autotask.
• 21 of the 24 come from US vendors. The others are from Israel, the Netherlands and the UK.

SASE, SSE and ZTNA

Cato Networks, one of the vendors in the category, defines SASE as a category introduced by Gartner that "converges SD-WAN, a Cloud Network, and Security Service Edge (SSE) functions, including FWaaS, CASB, DLP, SWG, and ZTNA, into a unified, cloud-native service." In plainer terms:

• SASE is networking plus security, delivered from the vendor's cloud. It connects branch offices (SD-WAN) and secures the users and traffic (SSE).
• SSE is the security half on its own: a secure web gateway (SWG) for internet traffic, a cloud access security broker (CASB) for SaaS apps, firewall as a service (FWaaS) and zero-trust access.
• ZTNA, zero-trust network access, is the piece that replaces the VPN. A user gets access to a named application after their identity and device are checked, instead of a tunnel into the whole network.

SD-WAN matters when a client has several sites with their own internet lines. A client with one office or none mostly needs the SSE and ZTNA parts.

Why MSPs sell it

Three pitches recur on the vendor pages in this category: replacing a VPN that users disconnect from, securing staff who work from home, and cutting the number of boxes and subscriptions at the edge. Cytracom ControlOne is pitched at MSPs as the replacement for firewalls, SD-WAN and remote-access tools from several vendors. Kaseya's Secure Edge lists ZTNA, a next-gen firewall, DNS filtering and an always-on connection, which Kaseya says matters because latency leads users to switch VPNs off. Todyl says its SASE can reduce spend on VPN and RDP servers and is sold with no annual contracts.

Three groups of vendors

Built for MSPs. Timus SASE ("Built for MSPs." on its own site), Todyl SASE, Cytracom ControlOne, Exium SASE, Kaseya Secure Edge and Cloudbrink Personal SASE describe themselves as built for MSPs on their own sites or listings. Timus SASE is the only product in the category with both ConnectWise and Autotask integrations verified, used for billing sync.

Broader platforms. Cato Networks combines SD-WAN, FWaaS, CASB, DLP, SWG and ZTNA. Netskope One SASE pairs SSE with SD-WAN, and its listing says MSPs manage customer tenants and licences through Netskope. HPE Aruba Networking SASE adds network access control. Check Point Harmony SASE, Versa, iboss, Cloudflare Gateway and Cisco Umbrella, which Cisco sells in DNS security and secure internet gateway packages, are in this group too.

Part of a wider security portfolio. Barracuda SecureEdge, SonicWall Cloud Secure Edge, Sophos ZTNA, ThreatLocker Zero Trust Network Access, NordLayer and Xcitium come from vendors that also sell firewalls, endpoint protection or VPNs. Sophos builds a ZTNA gateway into every Sophos Firewall. ThreatLocker's ZTNA uses outbound connections, so no inbound firewall ports or VPN are needed. If a client already runs one of these vendors' firewalls or endpoint agents, start there.

The landscape in numbers

• 24 products, 22 vendors. Cloudflare and HPE Aruba list 2 products each, everyone else one.
• Larger vendors than in DNS filtering or email security. 12 of the 24 products come from vendors with more than a thousand staff, 8 from mid-sized vendors and 3 from vendors with 50 people or fewer. 1 has no headcount on file.
• Agent-readiness is low. 4 products expose a public API: Cloudflare Gateway, Cloudflare ZTNA, Netskope One SASE and iboss. Cloudflare Gateway has the only verified MCP server.
• PSA integrations are rare. NordLayer, Timus and threatER's Enforce list ConnectWise, Sophos ZTNA lists Halo, and Timus lists Autotask. Everyone else needs a workaround for tickets and billing.

What separates products

1. The multi-tenant console. One login for all clients, per-client policy templates, and technician roles. Ask to see a second client added live.
2. Points of presence. Traffic goes through the vendor's PoPs, so where they are decides latency. Todyl lists more than 40 global PoPs. Cloudflare Gateway runs on the network behind its 1.1.1.1 resolver. Check the PoPs nearest your clients.
3. SD-WAN included or not. Cato, Netskope, HPE Aruba and Xcitium include SD-WAN, and Exium's Cyber Gateway integrates it. A single-site client gets little from SD-WAN.
4. Licensing terms. Minimum seats, annual versus monthly, and whether you can move licences between clients. Todyl advertises no annual contracts. Ask every vendor the same question.
5. The agent. Where a product uses a client on each device, check the supported operating systems, how it deploys through your RMM, and whether it conflicts with your endpoint agent.
6. Reporting. Timus lists reports delivered daily, weekly or monthly. The report is what you show the client, so look at a real one.

Questions to ask in the demo

• Show me the multi-tenant console with two clients and different policies.
• Where are your PoPs, and which one would my clients in each region use?
• What does a VPN replacement look like for a ten-person client with one file server?
• What are the minimums: seats, contract length, and commitment per client?
• How does your agent deploy through my RMM, and does it run alongside my EDR?
• Which events and seat counts can I get into my PSA, through an integration or an API?

How to use the catalog for this

The category page lists all 24 products with their flags. Each product page links the evidence behind its API and MCP flags, and the vendor page shows what else the vendor sells, which matters when you want one vendor for firewall, endpoint and access. Related shelves are Zero Trust Security, Firewall & Network Security and DNS Security. If a SASE product you use is missing, paste its URL and the system will classify and add it.

Frequently asked questions

What is the difference between SASE and SSE?

SASE combines networking (SD-WAN) with cloud-delivered security. SSE is the security part on its own: secure web gateway, CASB, firewall as a service and zero-trust access. A client with one office or none may only need SSE.

Which SASE vendors are built for MSPs?

In the catalog, Timus, Todyl, Cytracom ControlOne, Exium, Kaseya Secure Edge and Cloudbrink sell SASE through MSPs. Barracuda, SonicWall, Sophos and ThreatLocker sell secure access as part of wider security portfolios.

Can SASE replace a client's VPN?

Yes, through its ZTNA part, which gives users access to specific applications after an identity and device check instead of a tunnel into the whole network. Timus, Todyl, Cytracom ControlOne, SonicWall, Sophos and Cloudflare all position their ZTNA as a VPN replacement.

How many SASE products integrate with a PSA?

Few. In October 2026, 3 of 24 products list a verified ConnectWise PSA integration, 1 Halo PSA and 1 Autotask.

Is SASE resold or used internally by MSPs?

Resold or run for clients. All 24 products in the catalog are client-facing: 16 run by the MSP and billed to the client, 8 resold.

---

Numbers are from the MSP Navigator catalog on 19 October 2026: 24 published products in SASE / SSE. Product details come from each vendor's own website, checked on 19 October 2026. Capability flags are verified against vendor documentation and linked on each product page. The use-or-resell verdict is produced by a classifier reading each product's description and reviewed by hand in samples. Related guides: DNS filtering for MSPs, Email security for MSPs, RMM platforms for MSPs.