Best SASE alternative for a mid-market logistics firm using NordLayer

Hello everyone,

I've been deep in the SASE (Secure Access Service Edge) evaluation trenches for the past few months, specifically for a logistics client of mine. They're a classic mid-market case: 300-500 employees, a mix of warehouse on-prem systems, cloud-based TMS (Transportation Management System), and a growing fleet of remote/field agents needing access. They're currently on NordLayer and have hit some scaling and feature walls.

NordLayer is fantastic for what it is—a straightforward, reliable VPN-as-a-Service for secure network access. It's like a robust, well-maintained highway. But as this firm's needs evolved towards true Zero Trust Network Access (ZTNA), granular application-level policies, and integrated SWG (Secure Web Gateway) capabilities, we started feeling the limitations. The conversation shifted from "can everyone connect?" to "*what* can each user, from each location, access, and under what conditions?"

So, the core question: **What's the best SASE alternative for a logistics operation outgrowing NordLayer's core VPN model?**

Here’s our specific context and requirements:

* **Legacy & Cloud Mix:** Warehouse scanners running on old protocols, modern SaaS like Salesforce and custom TMS, and IoT telemetry from trucks. We need a solution that doesn't force a forklift upgrade on the legacy side.
* **User Segmentation:** A warehouse floor manager, a remote dispatcher, and a third-party carrier rep should have *radically* different access rights.
* **Performance Critical:** Latency on warehouse order-picking updates or real-time tracking maps directly impacts operations. A full traffic backhaul to a centralized cloud just won't cut it.
* **Operational Simplicity:** Small IT team. They live in Azure AD for identity. Deep Kubernetes or complex networking expertise isn't on the table.

**Key trade-offs we're weighing:**

1. **Full-Stack SASE Platforms (e.g., Zscaler, Netskope, Palo Alto Prisma SASE):**
* **Pros:** Deep integration between ZTNA, SWG, CASB, and FWaaS. Rich application visibility and data loss prevention. Built for the cloud-native edge.
* **Cons:** Can be a significant leap in complexity and cost from NordLayer. Agent-based models for all devices can be heavy for some IoT/legacy scenarios. May require a re-architecture of network policies.

2. **Cloud-Native "DIY" with Open Source (e.g., Cilium + Pomerium or OpenZiti):**
* **Pros:** Maximum flexibility, avoid vendor lock-in, can be deeply integrated into a Kubernetes-centric stack if they go that route.
* **Cons:** This is a *major* operational lift. Requires dedicated in-house expertise. You're building and maintaining critical security infrastructure. Likely not the right fit for this team's size.

3. **Hybrid Approach (NordLayer + Tailscale/Cloudflare Zero Trust):**
* **Pros:** Potentially less disruptive. Keep NordLayer for site-to-site or legacy bulk connectivity, and layer a modern ZTNA solution (like Cloudflare Access) for specific application access.
* **Cons:** Now you're managing two policy planes, two dashboards. Can get messy and obscure true visibility.

I'm leaning towards a full-stack platform for them, but the migration path from the simple NordLayer "on/off" switch to granular, identity-aware policies is my biggest concern. Has anyone here navigated a similar journey, particularly from a logistics or operational tech background?

I'd be especially keen to hear about:
* Specific challenges with legacy/OT (Operational Technology) devices in a ZTNA model.
* Real-world performance impact for latency-sensitive applications.
* How you handled the policy migration—did you map existing VPN subnets to new app policies, or use it as a chance to clean-slate?

Let's discuss the architectural shifts, not just the product features.

—Chris