SASE Providers and Managed SD-WAN
SASE Vendors, SASE vs SD-WAN, SD-WAN vs MPLS, and What Each Costs
Enterprises in TeleGeography's WAN survey now run 22 percent of their sites on MPLS, down from 82 percent in 2018. Get SASE or managed SD-WAN through us: the providers that fit price your sites at once, and we negotiate the contract.
Compare SASE ProvidersThis page is for network and IT leaders replacing MPLS, adding security to an SD-WAN they already run, or comparing SASE providers for the first time. We source SASE and managed SD-WAN for you from the providers that fit; the right one depends on your sites, users and applications. SASE is one part of a wider program; managed security services covers the rest.
Sources: Dell'Oro Group, September 2026 (market); Gartner prediction from 2024, as reported by SDxCentral (single-vendor share); TeleGeography, April 2026, 2025 data for small and medium enterprises (per-user price); 2026 Data Breach Investigations Report (DBIR) (exploited vulnerabilities).
What SD-WAN, SSE and SASE Each Cover
Most confusion in this market comes from three overlapping labels. SD-WAN is the network layer. Security service edge (SSE) is the security layer delivered from the cloud. SASE is both, sold and managed as one. The chart stacks the five building blocks from the network up.
The "Partial" cells, and the "Runs from" and "Priced" rows, are Metro Colo Advisory's interpretation, not Gartner categories: many SD-WAN devices include a branch firewall and some SSE services add a cloud firewall, but neither category requires one. Sources: Gartner's feature lists for single-vendor SASE and security service edge (both updated August 2026); Network World on Gartner's 2021 definition of SSE as secure web gateway, CASB and ZTNA; billing units from TeleGeography's survey of SASE pricing strategies (2023) and SD-WAN prices (2021 data). Individual products vary. Figures as of October 2026. Free to cite with a link to this page.
One requirement goes to the SASE vendors, carriers and managed SD-WAN providers that fit, on the same day. Once you ask a provider for pricing directly, it usually will not register an advisor on the deal, and you negotiate alone.
Site licenses, user licenses, edge hardware, circuits and installation, side by side over the full term, so you compare what you will pay rather than a headline rate.
Circuit diversity, SLAs per site, who owns the edge hardware and the price at renewal, in writing before you sign.
The provider you choose pays us, so it costs you nothing. You'll hear back within 24 hours. If staying on your current network is right for you, we will say so.
What Is SD-WAN?
SD-WAN is software that connects a company's locations over any mix of broadband, dedicated internet, wireless and private circuits, and picks the best path for each application in real time. An edge device at each site follows policies set in a central controller and written by application: video calls take the cleanest link, backups take the cheapest, and if one circuit fails, traffic moves to another.
It replaced MPLS as the default wide area network because most traffic now goes to SaaS and the public cloud, not the head office, and routing it through a central site first adds cost and delay. TeleGeography's survey data puts SD-WAN adoption at about 75 percent of enterprises.
What Is Managed SD-WAN?
Managed SD-WAN is SD-WAN designed, deployed and run by a provider: it ships and configures the edge devices, monitors every site, changes policies on request and often supplies the circuits underneath. Managed SD-WAN providers include carriers, managed service providers and some vendors that run their own service. Sites in a data center connect the same way; the data center connectivity guide covers cross-connects and cloud on-ramps, and dark fiber covers high-capacity links between your own facilities.
SD-WAN vs MPLS
MPLS is a private network a carrier runs for you, with performance guarantees end to end. SD-WAN runs over ordinary internet circuits and gets its reliability from using several of them at once. The trade is guaranteed performance on one expensive link versus managed performance across cheaper ones.
| Question | SD-WAN | MPLS |
|---|---|---|
| What it is | Software overlay that steers traffic across several circuits | A carrier's private network with traffic engineered end to end |
| Circuits underneath | Broadband, dedicated internet, wireless, and MPLS where it remains | Private circuits from one carrier, usually one per site |
| Price at the same speed | Lower: gigabit dedicated internet was cheaper than MPLS in all 10 key global markets TeleGeography compared (Q1 2026 prices) | Higher: best-effort MPLS cost 50 to 500 percent more than gigabit dedicated internet |
| Performance guarantee | Per-site SLAs from the provider, with resilience from multiple links | Carrier SLA on latency, jitter and packet loss across the private network |
| Cloud and SaaS traffic | Goes straight out from the site or through a nearby security point of presence | Usually routed back through a central site first |
| Adding a site | Ship a device, plug in whatever circuits are available | Order a private circuit from the carrier and wait for it |
| Security | Encrypted tunnels; inspection comes from a branch firewall or a cloud security service | Private by design, but not inspected; firewalls sit at the central site |
| Best fit | Most multi-site companies, especially with heavy SaaS and cloud use | A few sites with strict latency needs, or where a contract still has years to run |
Source: TeleGeography, The Rise of DIA Over MPLS (August 2026). Respondents can use several types at once: 74 percent use MPLS at some site and 96 percent use dedicated internet. Figures as of October 2026. Free to cite with a link to this page.
Send us your sites, circuits and contract end dates. We price SD-WAN and SASE options side by side with the providers that fit, before your MPLS term renews. You'll hear back within 24 hours.
What Is SASE?
SASE (secure access service edge) is a cloud-delivered service that combines SD-WAN with network security, so every site and every remote user connects through the same provider network under the same security policy. Gartner coined the term in 2019, in a report titled The Future of Network Security Is in the Cloud. The idea: once applications moved to SaaS and the cloud and people moved home, a firewall stack in the head office was guarding a perimeter few people used.
Gartner's current feature list for single-vendor SASE, updated August 2026, sets the bar: visibility and control of sensitive data; management through no more than two consoles covering secure web access, SaaS controls, identity-based access to private applications, a branch device that steers traffic across several WAN links by application, and Layer 7 firewalling; and a resilient global network of points of presence. A product without all of those covers part of SASE, not the whole of it.
SASE Architecture: How the Pieces Fit
The edge
An SD-WAN device at each site and a software agent on each laptop. Both send traffic to the nearest point of presence instead of back to the head office.
The points of presence
The provider's data centers, where the security stack inspects traffic close to the user: web filtering, SaaS control, private app access and the cloud firewall.
One policy
Rules written once, by user, device and application, and enforced the same way in the office, at home and on the road. This is what SASE solutions sell, more than any single feature.
SASE vs SD-WAN, and Where SSE Fits
Security service edge (SSE) is the security half of SASE without the network half. Gartner introduced SSE in 2021 as the secure web gateway, CASB and ZTNA delivered from the cloud. It suits a company that already has an SD-WAN it is happy with, or one whose people mostly work remotely. Dell'Oro reported SSE revenue up 22 percent year over year in 1Q 2026 (June 2026 report).
| Question | SD-WAN | SSE | SASE |
|---|---|---|---|
| What it does | Connects sites and steers traffic across circuits | Secures web, SaaS and private app access from the cloud | Both, under one policy |
| Protects | Site to site traffic, in encrypted tunnels | Users, wherever they are | Sites and users |
| Replaces | MPLS and branch routers | Web proxies and remote access VPNs | All of those, plus many branch firewalls |
| Usually priced | Per site, by bandwidth tier | Per user per month | Per site plus per user |
| Fits | Companies whose security is handled elsewhere for now | Mostly remote workforces, or an SD-WAN already in place | Multi-site companies starting fresh or at renewal |
SASE vs Zero Trust
Zero trust is a strategy, ZTNA is one control that applies it, and SASE is one way to deliver that control alongside the rest. NIST SP 800-207 (August 2020) describes zero trust as an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to users, assets and resources, and it grants no implicit trust to an account or device based only on where it sits on the network. No product is zero trust on its own; a SASE platform supplies several of the controls a zero trust program needs.
Zero trust: the strategy
Grant access per session after checking the user and device, give the least access needed, and assume an attacker may already be inside. It reaches well beyond the network.
ZTNA: one control
Zero trust network access connects a checked user on a checked device to the specific applications they are allowed to use, not to the whole network. It is the part of SASE that usually replaces the remote access VPN.
SASE: the delivery
ZTNA plus the web gateway, CASB, cloud firewall and SD-WAN from one provider network. It covers network access, not the identity or endpoint parts of zero trust.
ZTNA vs VPN
A VPN puts a remote user on the corporate network, and from there the user, or an attacker holding the user's credentials, can reach whatever the network allows. ZTNA checks identity and device health first and then connects the user only to the applications that user is allowed to reach. The VPN appliance itself has become a target. The 2025 DBIR found edge devices and VPNs made up 22 percent of the vulnerabilities exploited in breaches, up from 3 percent the year before. The 2026 DBIR found exploitation is now the most common way in, at 31 percent of breaches, and that only 26 percent of vulnerabilities on CISA's Known Exploited Vulnerabilities catalog were fully remediated by organizations in 2025, down from 38 percent, with a median of 43 days to full resolution. Fewer internet-facing boxes to patch is one reason replacing the VPN with ZTNA is a common first step in a SASE rollout. The firewalls that remain still need watching; see managed firewall services, and for the endpoints behind them, managed detection and response.
Single Vendor SASE vs Dual Vendor SASE
Single vendor SASE means one company supplies both the SD-WAN and the security service edge, on one platform with one policy. Dual vendor SASE pairs an SD-WAN from one vendor with SSE from another, joined by tunnels and integration work. The market is moving toward the first: in 2024, Gartner predicted that 65 percent of new SD-WAN purchases will be part of a single-vendor SASE offering by 2027, up from 20 percent in 2024, and Dell'Oro expects vendors offering both halves to hold 90 percent of a $17 billion SASE market in 2029.
| Question | Single vendor SASE | Dual vendor SASE |
|---|---|---|
| Consoles and policy | One platform, one policy, one support line | Two platforms, policies kept in step by your team or your provider |
| Strength | Simpler to run and to troubleshoot; one contract | Each half can be chosen on its own merits |
| Risk | One supplier for the whole network and security edge | Integration gaps, and two parties to call when something breaks |
| Commercial terms | One renewal date carries the whole spend | Two renewals, which can be staggered |
| Fits | Most mid-market companies, and anyone replacing both halves at once | A recent investment in one half worth keeping, or a large team with strong preferences |
Tell us what you run today and what you want to keep. We put both approaches in front of the providers that fit and show you the totals side by side. You'll hear back within 24 hours.
SASE Vendors vs Managed SD-WAN Providers: Who Runs It
SASE vendors build and license the platforms. Managed SD-WAN providers, including carriers and managed service providers, design, deploy and run them for you, and some vendors run their own managed service too. Who runs it decides the bill, and how quickly a change gets made at two in the morning, as much as the platform does.
Fully managed
The provider designs, deploys, monitors and changes everything, and usually sources the circuits. Fits companies with a small network team or none. You trade some control and cost for one number to call.
Co-managed
The provider runs the platform, monitoring and hardware; your team keeps policy changes and day-to-day decisions. A good fit for mid-market companies with a capable network team that cannot cover every hour.
Do it yourself
You license the platform from a vendor and your team runs it. The lowest license cost, the most control, and every outage and change is yours. Fits large teams with round-the-clock coverage.
Whichever model you choose, network security events still need someone watching them. A managed SASE service is not a security operations center; see SOC as a service for the monitoring layer that sits above it. If the bigger question is where workloads should live before the network is redesigned around them, that is an IT infrastructure consulting engagement.
SASE Pricing and SD-WAN Cost
Two SASE or managed SD-WAN quotes that look alike can price these lines very differently. Compare them line by line.
| Cost line | How it is usually priced | What moves it |
|---|---|---|
| SD-WAN serviceThe network side | Per site per month, by bandwidth tier | Bandwidth at each site, license tier, and whether the provider manages it |
| Security serviceThe SSE side | Per user per month; sometimes per site or per bandwidth for branch traffic | User count, which features are bundled, and volume discounts |
| Edge hardware | Bought outright, leased, or bundled into the monthly fee | Device size, high availability pairs at key sites, and refresh terms |
| CircuitsThe last mile | Per circuit per month, often separate and often from other carriers | Location, speed, and whether each site has two diverse circuits |
| Installation | One-time fee per site, plus circuit installation charges | Site count, staging, and whether an engineer visits each site |
| Management | Built into a managed service, or your team's time | Managed, co-managed or DIY, and the change and support terms |
Source: TeleGeography, Network Security in the SD-WAN Market (April 2026, 2025 data). Vendors discounted larger customers by 17 to 40 percent. Figures as of October 2026. Free to cite with a link to this page.
Send your site list with bandwidth, your user count and what you run today. The providers that fit quote the same requirement, including hardware, circuits and installation, and we negotiate before you sign. The provider you choose pays us, so it costs you nothing.
SASE and SD-WAN Contract Terms That Matter
These terms decide what the network costs over its life and how hard it is to leave. Get each in writing before you sign.
| Term | What to get in writing | Why it matters |
|---|---|---|
| Term length | The term for the service, and whether circuits and hardware run on the same dates | Longer terms buy a lower rate, but mismatched end dates leave you paying for links you no longer use. |
| Circuit diversity | Two circuits at key sites on separate physical paths and, where possible, separate carriers | Two circuits in the same conduit fail together, and SD-WAN's resilience goes with them. |
| SLAs per site | Availability, time to repair and hardware replacement for each site type, with credits that apply automatically | A network-wide SLA can be met while one store or clinic is down for a day. |
| Who owns the edge hardware | Ownership, refresh timing, and what happens to the devices at the end of the term | Leased or bundled devices go back at exit, and replacing them lands in the next decision. |
| Price at renewal | A cap on the renewal increase, or the renewal price itself | The best rate is the first one. Without a cap, the renewal is negotiated with your sites already built on the platform. |
| Adding and removing sites and users | Pricing for new sites and users at the contract rate, and the right to reduce counts | Acquisitions and closures happen mid-term; a contract priced only for growth punishes closures. |
| Points of presence and data handling | Where traffic is inspected and logs are stored, and how that meets your compliance needs | Regulated data may need to stay in the country or region. See compliance colocation for the hosting side. |
| Exit and transition | Assistance and configuration export when you leave, and the notice period | Policies built over years are your work. Getting them out is easier to agree at signing than at exit. |
Migrating Off MPLS, Step by Step
Every site, its circuits and bandwidth, and when each MPLS contract ends. The end dates set the schedule.
How much goes to SaaS and the cloud, how much to your own data centers, and which applications are sensitive to delay.
Single vendor SASE, dual vendor, or SD-WAN now and SSE later. Once sites send traffic straight to the internet, that security has to be in place on day one.
Two diverse circuits where the site matters, ordered well ahead: new circuits are often the slowest part.
Run a few representative sites on SD-WAN alongside MPLS until the numbers hold, then move sites in groups.
Give notice in time to avoid an automatic renewal, and keep MPLS only at the sites that still need it.
Data center sites follow the same plan with different circuits. If the migration is part of a wider move, the cloud migration services guide covers the workloads, hybrid cloud colocation covers the private connection between your racks and the cloud, and managed private cloud covers dedicated environments the new network has to reach. In New York, our NYC metro data centers guide shows where the carrier-dense buildings are.
Questions to Ask SASE and SD-WAN Providers
The contract terms above cover SLAs, renewal and exit. These three questions separate quotes that look alike.
The whole price
What is per site, what is per user, and what hardware, circuits, installation and support add on top, over the full term?
Points of presence
Where are they relative to your sites and people, and which security functions run in every one of them?
One console or two
Are the SD-WAN and the security managed in one place under one policy, and who makes changes, how fast?
How We Place SASE and SD-WAN
You send the requirement
Your sites with bandwidth and current circuits, your user count, what you run today and when its contracts end, and any compliance needs. Rough numbers are fine.
We run the providers that fit, at once
SASE vendors, carriers and managed SD-WAN providers that fit the requirement see the same request on the same day, so the quotes compare line by line.
We negotiate and you sign
Price, circuit diversity, SLAs per site, hardware ownership and the renewal cap, settled while they are still negotiable. You sign with the provider you choose.
The provider pays us
The provider you choose pays us, so it costs you nothing. Larger strategy work, such as a network and infrastructure review, is a paid engagement, and we tell you the fee before it starts.
SASE and SD-WAN: Frequently Asked Questions
What is SD-WAN?
SD-WAN, or software-defined wide area network, is software that connects a company's locations over any mix of broadband, dedicated internet, wireless and private circuits and picks the best path for each application in real time. If one link fails, traffic moves to another. TeleGeography's survey data puts adoption at about 75 percent of enterprises.
What is the difference between SD-WAN and MPLS?
MPLS is a private network a carrier runs with performance guarantees end to end, while SD-WAN runs over ordinary internet circuits and gets its reliability from using several at once. MPLS also costs more: in TeleGeography's Q1 2026 prices, best-effort MPLS cost 50 to 500 percent more than gigabit dedicated internet in all 10 key global markets it compared. Most companies now keep MPLS only at the sites that need it.
What is SASE?
SASE, or secure access service edge, is a cloud-delivered service that combines SD-WAN with network security, so every site and remote user connects through the same provider network under one policy. The security side includes a secure web gateway, a cloud access security broker, zero trust network access and firewall as a service. Gartner coined the term in 2019.
What is the difference between SASE and SD-WAN?
SD-WAN is the network layer: it connects sites and steers traffic across circuits. SASE adds the security layer, delivered from the provider's cloud points of presence, and manages both under one policy. SD-WAN is usually priced per site, while SASE adds a per-user charge for the security side.
What is the difference between SASE and zero trust?
Zero trust is a strategy, and SASE is one way to deliver part of it. NIST SP 800-207 describes zero trust as moving defenses from static network perimeters to users, assets and resources, with no implicit trust granted to an account or device based only on its network location. SASE supplies zero trust network access and other controls, but identity and endpoint security sit outside it.
What is the difference between SSE and SASE?
SSE, or security service edge, is the security half of SASE without the SD-WAN: a secure web gateway, a cloud access security broker and zero trust network access, delivered from the cloud. Gartner introduced the term in 2021. It fits a company that already runs an SD-WAN it wants to keep, or a mostly remote workforce.
What is single vendor SASE?
Single vendor SASE is SD-WAN and security service edge from one company, on one platform with one policy. In 2024, Gartner predicted that 65 percent of new SD-WAN purchases will be part of a single-vendor SASE offering by 2027, up from 20 percent in 2024. Dual vendor SASE, with SD-WAN from one vendor and SSE from another, still fits companies with a recent investment in one half.
What do managed SD-WAN providers do?
Managed SD-WAN providers design, deploy and run the SD-WAN for you: they configure the edge devices, monitor every site, make policy changes and often supply the circuits. Carriers, managed service providers and some vendors offer it, and co-managed options let your team keep policy changes.
How much does SASE cost?
The security side of SASE is usually priced per user per month. TeleGeography's 2025 data put the median for small and medium enterprises at $7.21 per user per month from vendors and $18.13 through managed providers and carriers. SD-WAN, edge hardware, circuits and installation are usually priced per site on top.
How much does SD-WAN cost?
SD-WAN is usually priced per site per month by bandwidth tier, plus a one-time charge for the edge device. TeleGeography's 2021 survey of vendor prices put the median at $58 a month per site at 10 Mbps, $81 at 100 Mbps and $333 at 1 Gbps, with appliances from $452 to $1,422. Those are 2021 figures, before circuits and managed service.
Is ZTNA better than a VPN?
For most remote access to private applications, yes. A VPN puts the user on the corporate network, while ZTNA checks identity and device health and then connects the user only to the applications they are allowed to reach. VPN appliances have also become a target: the 2025 DBIR found edge devices and VPNs made up 22 percent of exploited vulnerabilities in breaches, up from 3 percent.
Who are the main SASE vendors and providers?
SASE vendors fall into three broad groups: companies that started in networking and added security, companies that started in security and added SD-WAN, and firewall makers that extended into both. Carriers and managed service providers also deliver vendors' platforms as a managed service. The right one depends on your sites, users and applications, and quotes against the same requirement are the clearest way to compare them.
Send the Requirement Before You Request Quotes
Send your site list with bandwidth, your user count, what you run today and when its contracts end. Rough numbers are fine. You'll hear back within 24 hours from the person who will run your search. Once you ask a provider for pricing directly, it usually will not register an advisor on the deal, and you negotiate alone, so the order matters. If staying on your current network for another term is right for you, we will say so. Everything runs by email, so there is no sales call to book.
The provider you choose pays us, so it costs you nothing. If you have already spoken to one provider, tell us which; we can still run the rest of the market.
Security services: managed security services, managed firewall services, SOC as a service, managed detection and response and GCC High and CMMC enclaves.
The network underneath: data center connectivity, dark fiber, hybrid cloud colocation and NYC metro data centers.
Cloud and recovery: cloud migration services, managed private cloud, DRaaS, backup as a service and disaster recovery colocation.
Planning and cost: IT infrastructure consulting, data center consulting, the colocation pricing guide, data center cost and cloud repatriation.
