Todyl SASE: ZTNA, web gateway and cloud firewall

What Todyl SASE is

Todyl builds a modular security platform for organisations that would rather not run a VPN from one vendor, a web filter from another and a firewall from a third. Todyl SASE is the networking half of that platform. An agent on each laptop, desktop or server creates a secure tunnel to the nearest regional point of presence on Todyl's Secure Global Network (SGN), and the security is applied there.

Todyl lists these components of its SASE service:

• Zero trust network access: identity-based access to internal resources, governed by custom conditional access rules
• Secure web gateway with comprehensive web filtering
• Secure DNS to block malicious and unwanted domains
• Advanced next-generation firewall (NGFW) with SSL inspection, so threats inside encrypted traffic can be found
• Highly available architecture with automatic failover between points of presence
• Optional static IPs for dedicated, allowlistable connections, with smart traffic routing

Because the agent stays connected, users do not have to remember to start a VPN, and the same policy follows the device at home, in the office or on a customer site. Todyl states the core service is cloud-delivered with no hardware to buy. For the platform as a whole, including endpoint security, SIEM and managed detection and response, see Todyl on our cloud security site.

What is the Todyl SGN?

The Secure Global Network is Todyl's own network of cloud points of presence. It is the enforcement point in Todyl's design: every protected device tunnels to a regional point of presence, and that is where ZTNA rules, web filtering, DNS security and the firewall are applied before traffic continues to the internet, a SaaS app or one of your internal resources.

In the language of the NCSC's ZTNA guidance, the SGN is a network-level policy engine, the same family as SSE and SASE services from larger vendors. That has two practical consequences:

• Policy follows the device, not the building. A laptop in a coffee shop gets the same rules as one at a desk, which avoids the NCSC anti-pattern of trusting a network location such as the office LAN.
• Your office no longer has to be the front door. Internal resources are reached through the SGN rather than through a VPN port exposed on your firewall, and offices or cloud networks can be joined to the SGN with IPsec site-to-site tunnels.

People sometimes search for "Todyl VPN" because the agent does create an encrypted tunnel. The difference from a traditional VPN is what happens after the tunnel: the user is checked against conditional access rules and reaches only what the policy allows, rather than landing on the whole network. ZTNA vs VPN explains that difference in full.

Todyl SASE options and add-ons

Todyl also publishes Essentials, Advanced and Complete packages that bundle SASE with Endpoint Security, SIEM, MXDR and GRC. In those packages SSL inspection, two static IPs and LAN ZeroTrust come with Advanced, and unlimited IPsec tunnels and multi-engine download scanning come with Complete. We compare a package with hand-picked modules when we quote.

Todyl zero trust beyond remote access

Most ZTNA products stop at the question "can this user reach this application?". Todyl adds a second layer that matters for small offices and home networks: LAN ZeroTrust, which Todyl describes as microsegmentation combined with SASE. It blocks devices from talking to each other on the same local network by default, so one infected laptop cannot reach the next one over the office Wi-Fi.

That maps onto the NCSC design requirement to limit the impact of compromise, alongside the identity-based ZTNA rules for remote access. If internal segmentation is your main concern, read network segmentation vs microsegmentation, which compares LAN ZeroTrust with Zero Networks' agentless approach.

The SASE agent is also the same agent used by Todyl Endpoint Security, so adding endpoint protection later does not mean another install, and Todyl's SIEM and MXDR modules sit on the same platform if you want them. None of those modules is required to use SASE.

One design point to settle early is SSL inspection. It lets the firewall see threats inside encrypted traffic, but the NCSC's guidance on what to do before building a ZTNA architecture notes that TLS inspection concentrates trust in the systems doing the decryption. We can help you decide which categories of traffic to inspect and which to exempt, such as banking and health sites.

Who Todyl SASE suits

Todyl SASE tends to suit:

• Hybrid and remote teams replacing an ageing VPN or remote desktop gateway with one always-on agent
• Multi-site businesses that want the same web filtering and firewall rules at every office and at home, with IPsec tunnels for the offices
• Organisations that need a fixed IP for a supplier portal or cloud application without routing everything back through head office
• Businesses consolidating suppliers, which can add endpoint, SIEM and MXDR on the same agent later
• Organisations without in-house security staff, since Todyl describes itself as channel-only, so it is bought and run through a provider such as Forever Systems

It is less natural for an organisation already standardised on a large SSE vendor, or one that needs per-application browser-based access for contractors without an agent; for that, see agentless ZTNA. For the wider market, compare SASE providers and SASE vs SSE.

Licensing and how we help

Todyl SASE is a subscription counted by the devices running the agent, billed monthly in arrears on what was protected. Mobile devices are licensed through the mobile option or come as an allowance in a package, static IPs are a per-tenant charge and SASE Tunnels are per tunnel. Todyl describes SASE as offered as a service with no annual contracts, so it can be scaled up or down; we confirm the terms for each module when we quote. Prices depend on device numbers and options, so ask us for a quote, and see Todyl SASE licensing for the detail.

Here is how we can help:

1. Map access: list the internal applications, file shares and RDP hosts users reach today, and any systems allowlisted by IP.
2. Design policy: build ZTNA conditional access rules by group, web filtering categories and firewall policy.
3. Pilot: push the agent to a small group through your device management or RMM tooling and test.
4. Roll out: extend to all devices, add LAN ZeroTrust, static IPs or SASE Tunnels where needed.
5. Close the old route: retire the VPN and its open ports so nothing bypasses the new policy, as the NCSC recommends.

Scope and timescales are confirmed at quote. Contact us to discuss your estate.