Versa Unified SASE provides carrier-grade performance and a host of deployment options expected by experienced network engineers and security professionals. Versa SASE stands out in the Secure Access Service Edge market for its self-hosted option for organizations seeking full control of their SASE environment, but the company also retains a private backbone for clients seeking a high-speed and traditionally-managed SASE solution.
For more details explore the following sections of this review:
- Who is Versa Networks
- Versa Unified SASE
- Pricing & Delivery
- Features
- Pros
- Cons
- Alternatives to Versa Unified SASE
- How We Evaluated Versa Unified SASE
- Bottom Line: Best For Fully-Controlled SASE
To compare Versa Unified SASE against competitors, see our complete list of top secure access service edge (SASE) solutions.
Who is Versa Networks?
Founded in 2012, Versa Networks seeks to deploy a single software operating system, called VOS, to converge and integrate cloud and on-premises security, networking, and analytics. Using VOS, Versa enables customers and service providers to deploy SASE and software-defined wide area network (SD-WAN) solutions. Versa Networks remains a privately-held company backed by venture funds such as Sequoia Capital, Verizon Ventures, and Comcast Ventures.
Versa Unified SASE
Versa’s Unified SASE Platform provides a single software solution to control, secure, and analyze network flow, user access, and resources. The platform, previously called Versa Secure Access or Versa Secure Access Fabric, connects to both cloud and local resources with ease.
Versa was recognized as a Challenger in the 2023 Gartner Magic Quadrant, and the Versa Unified SASE platform delivers the required six key SASE capabilities:
- Centralized control through Versa Concerto, a consolidated management console that provides a single interface to manage other components and policies
- Monitored network status pulled from Versa’s software-defined wide area network (SD-WAN) capabilities that provide reports, analytics and control over network operations performance and security
- Monitored user activity and data loss prevention (DLP) analysis through the Versa Secure Internet Access (VSIA) tool
- Inspected and decrypted traffic that blocks malware and malicious URLs through a centralized control and filtering through VSIA’s secure web gateway (SWG) and Firewall-as-a-Service (FWaaS) capabilities
- Controlled access to data and resources based upon user, device, and permissions through Versa Secure Private Access (VSPA) zero trust network access (ZTNA) and SD-WAN capabilities as well as VSIA’s cloud access security broker (CASB), and domain name service (DNS) security capabilities
- Secured cloud-based assets such as applications, websites, and Software-as-a-Service (SaaS) resources through VSIA’s SWG and FWaaS capabilities
Versa Unified SASE harnesses artificial intelligence (AI) and machine learning (ML) algorithms to quickly detect anomalies and provide powerful analytics, control and response capabilities. The SASE solution also provides additional security to users through remote browser isolation that keeps the endpoint segregated from the corporate information.
The primary service components of the Versa SASE solution include:
- Versa Analytics powers the exploration of SASE, SD-WAN, and other SASE operations and security data; built for the Secure Cloud IP Platform; multi-tenant
- Versa Secure Access Client (VSAC) App extends the SASE solution to endpoints and provides an isolated browser on Windows, macOS, iOS, and Android devices
- Versa Concerto provides the single orchestration platform for an organization to use to deploy, monitor, operate, and analyze a SASE deployment
- Versa Secure Internet Access (VISA) provides cloud-hosted secure web gateway capabilities such as multi-factor authentication (MFA), stateful firewall, web filtering, URL traffic management, cloud-based CASB, DLP, and deep packet scanning
- Versa Secure Private Access (VSPA) enables cloud-hosted ZTNA capabilities for Versa SASE with visibility, awareness, and control over users, applications, and fully encrypted network connections
- Versa Operating System (VOS) provides the base OS to integrate and power all of the Versa components
- Versa CSG Appliances provide local appliances to connect to cloud-based Versa SASE components or to connect locally hosted SASE and SD-WAN implementations
Versa Titan SASE
For Lean IT environments, Versa offers the stripped down Versa Titan deployment that allows for full SASE capability through a single hardware unit deployed in each branch office and the Versa Titan Mobile App. IT teams can still apply policies, receive reports, and view analytics using the Versa Titan Portal.
Pricing & Delivery
Pricing for Versa’s SASE product was originally called Versa Secure Access and announced in 2020 to start at $7.50 per user per month without limitation for the number of devices. However, Versa no longer publishes prices for their SASE solution overall and limited information can be obtained without a formal sales estimate.
A free trial is available for up to 100 users for organizations with 5,000 or more employees. This size limit suggests that Versa SASE is best suited for large enterprises.
Some limited information is available on tiers and appliances for some Versa components:
- Versa Concerto can be deployed in two main configurations on high-end x86 server clusters with 3 nodes (virtual or physical):
- 8 cores with 16 GB of DRAM supports up to 150 tenants and 4,000 branches
- 12 cores with 32 GB of DRAM supports up to 250 tenants and 10,000 branches
- Versa Secure Internet Access (VISA) is offered in three service tiers:
- Essential Tier: cloud-based app and SaaS access, enterprise authentication, bandwidth control and traffic priority management, web filtering, and real-time security updates
- Professional Tier: includes Essential Tier plus SSL/TLS Proxy, network-based antivirus protection, as well as inline CASB and malware protection
- Elite Tier: includes Professional Tier plus clientless SaaS application management, DLP, and advanced threat protection
- Versa Secure Private Access (VSPA) has two tiers of service:
- Essentials Tier: intelligent gateway selection, enterprise authentication, site-to-site data center tunnels, network obfuscation, and whitelisting for up to 10 applications
- Professional Tier: adds whitelisting for unlimited applications, ZTNA policies based on device posture, and app based traffic steering
Versa Cloud Security Gateway (CSG) Appliances
The best available pricing information can be found for Versa CSG appliances, both physical and virtual, which enable connections between a remote network and the rest of the Versa environment. While some devices may connect directly to Versa secure gateway functions, some organizations will prefer to use the traditional hub and spoke network models and use Versa CSG appliances as the gateway between secured networks.
Physical appliances provide functionality for routing wide area networks (WANs), stateful firewalls, SD-WANs, NGFW, antivirus, intrusion prevention services (IPS), and unified threat management (UTM) capabilities for local networks. Hardware configurations and options deliver:
- Copper or fiber ethernet ports with speeds from 10 Mbps to 10 Gbps
- Embedded enterprise class WiFi access points
- Legacy WAN network support using non-Ethernet standards (ADSL2/VDSL2 or T1/E1)
- Single or dual enterprise class Long Term Evolution (LTE) modules
- 5G Native modem options for the CSG700 and CSG1000 families of appliances
- Support for 3rd party virtual machines to deploy software from other suppliers
- Passively or actively cooled designs
Hardware starts at $500 for the low-end Versa appliances which can only be purchased through distributors, value added resellers (VAR), and other IT integration sources. Prices are not generally published for higher end hardware or virtual appliances. Virtual Appliance supports most major virtualization options:
- Amazon AWS (EC2)
- KVM on CentOS 7.7. Ubuntu 18.04, and Ubuntu 20.04
- Microsoft Azure
- Microsoft Hyper-V 2016/2019 R2/2019
- VMware ESXi up to 7.0
Clusters of physical and virtual appliances can be deployed to expand reach or improve resilience through redundancy. The seven families of CSG appliances consist of:
- CSG300 Series: $500 to $800 small branch office appliances with up to 1,000 Mbps WAN performance
- CSG700 Series: $1,000 to $2,000 medium to large branch appliances with WAN performance as high as 3,750 Mbps and with firewall and SD-WAN performance as high as 2,800 Mbps
- CSG1000 Series: enterprise branch appliances that offer WAN performance as high as 30 Gbps for up ro 2,000 users
- CSG2500 and CSG5000 Series: high-performance enterprise branch appliances offering performance as high as 120 Gbps
- CSG3000 Series: high-performance branch-to-branch appliances that offer WAN performance as high as 30 Gbps and support wired and wireless connections
- CSG4000 Series: enterprise edge and access switches
Versa SASE Support
Versa offers two tiers of support services, Standard and Premier:
- Standard offers 24×7 email and phone-based support with 60 minute response times for priority 1 and 2 requests
- Premium builds off of the Standard support tier by improving response time to 30 minutes, rapid side deployment assistance, complex issue resolution, a designated support engineer, training, and certification
Features
- Full SASE Features: centralized control, monitored user activity, inspected and decrypted traffic, controlled access, secured cloud-based assets, and monitored network status and operations control
- Cloud, local, and hosted deployment options as well as blended deployments of multiple SASE services
- Single converged platform with a unified console, policy and data lake
- AI/ML powered real-time and historical analytics to provide visibility into operations and security events
- Extensive global point-of-presence (PoP) access points in Europe, North America and Asia, at least one PoP in Africa, Australia, and South America
- Traffic engineered network connections use application aware software to optimize reachability and dynamic path selection for traffic between PoPs and network assets
- Rapid anomaly detection using AI and ML reduces mean time to detect (MTTD) and mean time to respond (MTTR) for both operations and security events
- Remote browser isolation (RBI) to sandbox malware and malicious links in a virtual environment segregated from the network and the end user’s device
- Endpoint agent available for Windows, macOS, iOS, and Android devices
- Federal information processing standards (FIPS) 140-2 cryptographic module certification was granted in 2023 for the Versa Operating System that powers the SASE platform
- 24/7 support via email and phone with standard support plan
Pros
- Security-sensitive deployments run purely on-premises SASE, deployed exclusively through the enterprise network, and even support air-gapped management systems
- Multi-tenant options for hosted Versa SASE enable managed service providers (MSPs) to run multiple client SASE instances; Versa claims to be the only true multi-tenant SASE architecture available
- Partially and fully-managed SASE deployment options using the Versa network operations center (NOC) to provide cloud-hosted partial management or the fully managed Versa Titan SASE
- Full control option for clients to install all SASE components in their own onsite data center or cloud environment
- High-speed private backbone integrated controls through technology partners such as Google Cloud and Azure
- Versa SASE Fabric NaaS provides network-as-a-service (NaaS) and SD-WAN connectivity
- FIPS 140-2 compliant hardware with a two-year warranty
Cons
- Limited IoT connections for the internet of things (IoT), operations technology (OT), and other devices; requires connection to existing networks or direct plug-in to proprietary CSG hardware
- Service chaining of network components may limit network performance
- Limited multicast support an issue for some clients
- Limited formal training may be an issue for some service tiers
- Lagging threat detection noted by Gartner
- Poor price transparency and licensing information increases the difficulty to budget or determine which components and tiers will be needed to obtain specific SASE capabilities
- More complex options from well-established technology can create longer and a more complex setup and possible unintended gaps or conflicts in security policies
- Diminished AI capabilities may be encountered for local installations that do not contribute or interact with Versa’s data lake that informs their machine learning (ML) and AI capabilities.
Alternatives to Versa Unified SASE
Buyers attracted to Vera Unified SASE likely need a high-performance SASE solution with extensive options for customization. These organizations will not shy away from extensive deployment requirements and will also want to consider:
- Palo Alto Prisma SASE: offers top-notch security performance, multi-tenancy options, and similar customization options
- FortiSASE: deploys application-specific integrated circuit (ASIC) designs for SD-WAN hardware that improve performance and a similar range of SD-WAN customization
- VMware SASE: Offers similar customization and multi-tenancy options with a wider range of support for third-party tool support from network virtualization capabilities
How We Evaluated Versa Unified SASE
Versa Unified SASE is rated and ranked against seven other SASE competitors in our top SASE providers article. That article explains the overall ranking and here we provide details specific to Versa Unified SASE:
- Overall Rating: 3.77 / 5 (#5)
- Licensing Information: 1.3 out of 5 possible criteria
- Monitoring and Management: 6.51 out of 7 possible criteria
- Asset Control: 3.4 out of 4 possible criteria
- Implementation and Administration: 3.9 out of 5 possible criteria
- Customer Support: 3.12 out of 4 possible criteria
Versa stands out from other SASE competitors with the widest range of deployment options that include locally-hosted SASE control software. For customers that prefer speed over control, Versa Unified SASE also offers a private backbone and a very large number of options for network and security control.
Bottom Line: Best For Fully-Controlled SASE
Versa brings the numerous customization options of legacy network and security products to provide large enterprises with fully customizable SASE instances. Since Versa Unified SASE is the only top SASE vendor that offers an option for locally installed SASE control software, buyers with strong security needs (military, biotech, etc.) must strongly consider this product.
