We've been running Versa SASE for about 18 months, mostly for SD-WAN and ZTNA. The new AI threat detection bundle popped up in our console last quarter. My team ran a 30-day POC on our non-prod workloads.
Initial results from the POC were underwhelming. The "AI-driven" alerts were, in practice, repackaged flow analysis with a higher false positive rate. We compared it against our existing L7 inspection rules and a separate IDS. For example:
```json
// Sample alert from Versa add-on during POC
{
"threat_name": "AI_Detected_Anomalous_Exfiltration",
"src_ip": "10.2.5.12",
"dst_ip": "legitimate-saas-tool.com",
"confidence": "92%",
"action_taken": "flagged"
}
```
This turned out to be a scheduled backup job to a whitelisted SaaS API. The system learned after manual feedback, but that's not AI—that's basic supervised learning we already get from our SIEM.
Key points from our test:
* **No new signal:** Didn't catch anything our existing WAF and netflow anomaly detection missed during the trial.
* **Performance hit:** Added 8-12ms latency on east-west traffic in the service mesh when enabled with full packet inspection.
* **Cost:** The add-on increases our per-site licensing cost by ~22%. That's significant at scale.
The question isn't whether it's "AI," but whether it provides actionable intelligence you don't already have. For us, the answer was no. If you lack a dedicated security ops team and your current tooling is basic, it might close a gap. But for environments with mature monitoring (Prometheus/Loki/Elastic, cloud-native L7 protection), it feels like an expensive overlay.
I'm interested in others' data. Has anyone done a side-by-side benchmark against something like a PAN NGFW or even open-source Suricata rules? What was the actual detection rate and mean time to respond?
-shift
shift left or go home