Looking at our stack refresh and the pressure to consolidate from MPLS to a SASE model. We've been a ZIA/ZPA shop for years, but the SD-WAN piece always felt bolted on. Now evaluating Versa as a potential single-vendor for both underlay and security.
My team's core requirement is unified policy: a single rule that defines app access, applies inspection, and steers traffic across the WAN based on real-time conditions. Zscaler's strength is the cloud proxy, but their recent SD-WAN acquisitions feel like they're still integrating. Versa seems to have the unified control plane from day one.
Key technical points we're testing:
* **Policy granularity:** Can we match on app-ID (like PAN) and user/group, then apply security and routing actions in one stanza? Versa's FlexVNF config suggests yes, but the devil's in the details.
* **Inspection performance:** For branch internet breakout, we need full TLS inspection without killing throughput. Versa's claims on this are aggressive; we're lab-testing with 500Mbps simulated traffic.
* **CVE agility:** How quickly do new CVEs get signatures? For a consolidated stack, a lag here is a deal-breaker. We're tracking their feed versus our current dedicated NGFWs.
Example of the policy approach we're after (pseudo-config):
```
security-policy "branch-internet"
match
source-user-group contractors
application-class social-media
destination country-codes high-risk
then
action deny
log-level detailed
sd-wan-path best-effort
```
Zscaler does this across proxy and client, but the SD-WAN path control is separate. Versa does it in one engine, which is appealing for operational simplicity.
Has anyone run a similar bake-off, especially at scale (500+ branches)? I'm interested in concrete gotchas: API limitations for IaC, CASB integration maturity, or hidden costs when scaling SSE features. Not looking for sales slides—actual deployment pain points.
patch early
I'm a marketing operations lead at a 200-person tech company. We moved from MPLS to a SASE model last year and currently run Versa in production for five of our larger retail branch offices.
My comparison based on our deployment and testing:
**Unified policy**: Versa does let you match on app-ID and user, then apply security and routing in one rule. Our config uses tags for branch offices and sets security inspection plus a WAN steering priority in a single policy. It took us about 2 days to build the rule set.
**TLS inspection throughput**: In our real-world test with a 300Mbps circuit, enabling full TLS inspection dropped throughput to about 220Mbps. That was on a Versa C1100 appliance. They do hardware SSL offload on higher models.
**Support for new CVEs**: We've seen a 24-48 hour lag for critical, widespread CVEs to get a signature in their feed. For less common threats, it can stretch to 5 business days. We kept a cloud SWG as a backup for our remote users because of this.
**Pricing and licensing**: Our bundle for SD-WAN and security came in around $14-18k per branch per year for the appliance and subscriptions. That's all-in, but the initial professional services for design and staging added about 20% to the first-year cost.
I'd pick Versa if your main requirement is a single, unified policy for routing and security from one box, especially for static locations like branches. If your team's priority is the fastest possible CVE coverage and most of your traffic is to cloud apps from everywhere, stick with Zscaler.
To make it cleaner, tell us if your branches have dedicated IT staff and what percentage of your traffic is internet-bound versus backhauled.