How MSPs should choose a SASE platform: 8 questions to ask
When choosing a SASE platform, an MSP should check for some key things first:
- True multi-tenancy with per-client isolation
- A low per-client seat minimum for small clients
- Flexible or pooled licensing across clients
- Flexible billing terms and co-branding options
- Partner margins for profitability and low spend commitments
- Deployment architecture: where security actually runs
- Integration with existing identity, SIEM, and API tools
- Data sovereignty and regional compliance
Many SASE solutions send user traffic to the cloud for inspection. As data sovereignty has become a bigger concern, distributed architectures with local enforcement give MSPs more control over where client traffic is processed, helping reduce latency and address data sovereignty requirements.
Here are 8 questions to ask any vendor, with Zenarmor's answers as an example.
Why MSPs buy SASE differently
Most SASE platforms were designed for one large organization with one security team. An MSP's situation is the opposite: dozens or hundreds of small clients, each with its own network, users, and budget, all run by one team.
Because of this, MSPs need to look for different criteria: A platform that's excellent for a 5,000-seat enterprise can be unworkable for an MSP if it has a high seat minimum, needs a separate instance per client, or makes every client's traffic take a detour through the vendor's cloud.
1. Is it multi-tenant, with real isolation between clients?
Ask: Can I see every client from one console? Is each client's policy, data, and visibility kept separate?
Ensure the platform is natively multi-tenant, rather than a single-tenant architecture retrofitted with a client switcher. You should be able to fix one client's problem without touching another's.
Zenarmor: built multi-tenant from the control plane out. Zenconsole shows the health of all client networks in one view without switching instances, and each customer's policy, data, and visibility stay separate.
2. What's the smallest client I can serve?
Ask: What's the minimum seat count per client?
Many MSP clients have 5 to 50 users. Enterprise-oriented vendors often require hundreds of seats before the economics work, which rules out most of an MSP's book.
Zenarmor: you can allocate as few as 5 seats to a client from your pool.
3. How does licensing work across many clients?
Ask: Do I buy per client or from a pool? Can I move seats when a client grows, shrinks, or leaves?
Per-client contracts create paperwork every time a client changes. A shared pool lets you allocate seats as your book changes.
Zenarmor: buy a shared seat pool and reallocate it freely between tenants. Pricing is pre-purchased and volume-tiered, so it improves as your pool grows. There are no metered egress charges or bundle add-ons.
4. Can I sell it the way I sell everything else?
Ask: Can I bill clients monthly? Annually? Can I put my brand on it?
Zenarmor: recurring SaaS that you can sell monthly, annually, or multi-year, delivered as a co-branded service with your brand leading.
5. What's my margin?
Ask: What margin does the partner program give, and what are the minimum commitments?
Zenarmor: up to a 40% partner margin. Partner capabilities (client and tenant management, co-branding, pool licensing) start at $250 per month in Business-plan spend. See Zenarmor for MSPs.
6. Where does security actually run?
Ask: Does client traffic have to route through your cloud? Can I use the firewalls and servers my clients already have?
In PoP-based architectures, traffic travels to the vendor's points of presence for inspection. Each round-trip typically costs 20 to 300 milliseconds, and you depend on the vendor's network. In local enforcement, traffic is inspected on equipment at the client site or on the endpoint.
Zenarmor: security runs locally, and inspection adds about 0.2 milliseconds. It deploys onto the OPNsense, OpenWRT, FreeBSD, and Linux systems clients already run, bare-metal or virtual, with no mandatory hardware and no mandatory cloud. Endpoint agents cover Windows, macOS, and Linux for remote staff.
7. Does it fit my clients' identity and logging tools?
Ask: Can policies use my clients' existing directories? Can logs go to my SIEM? Is there an API?
Zenarmor:
- Policies can target cloud identity provider users and, since release 2.7, legacy Active Directory and LDAP users and groups
- Session logs can stream to Elasticsearch or OpenSearch for SIEM and SOAR workflows (2.6)
- A REST API covers organizations, gateways, policies, and Zero-Trust networks (2.6 and 2.7)
- Admin audit trails record policy and configuration changes (2.6)
For regulated clients, Zenarmor's access control, logging, and visibility map to HIPAA, PCI-DSS, SOC 2, and ISO 27001 requirements. Compliance is still the client's responsibility.
8. Can it meet my clients' data sovereignty requirements?
Ask: My clients in the EU (or other regions) need to keep their data in-country and outside of any vendor's cloud. Will your solution fit?
Zenarmor:
Zenarmor was built from the ground up as a sovereign, distributed security solution. Zenarmor provides security solutions and traffic inspection locally, without requiring the cloud.
Zenarmor’s Geo-Aware Data Residency can store reporting and analytics data in a regional data center, which administrators can choose to match their clients’ requirements.
Zenarmor's local inspection and regional data storage can help organizations meet data residency and compliance needs under the General Data Protection Regulation (GDPR), SOC 2, and similar mandates. Compliance remains the client's responsibility.
Checklist at a glance
| Question | What good looks like | Zenarmor |
|---|---|---|
| Multi-tenant with isolation? | One console, separate policy/data/visibility per client | Yes, built multi-tenant |
| Smallest client? | Single-digit seat minimum | 5 seats per client |
| Licensing? | Shared pool, reallocate freely | Shared seat pool, volume-tiered |
| Billing and brand? | Monthly or annual, co-branded | Monthly, annual, multi-year; co-branded |
| Margin? | Clear, published | Up to 40% partner margin |
| Where does it run? | On client hardware or endpoints, no forced backhaul | Local enforcement, about 0.2ms |
| Identity, SIEM, API? | Works with existing tools | AD/LDAP and cloud IdP, Elasticsearch/OpenSearch, REST API |
| Data sovereignty? | Keeps client traffic and data in the client's region | Yes, designed and built for securing environments with data sovereignty requirements |
Frequently asked questions
What's the smallest client an MSP can serve with Zenarmor? You can allocate as few as 5 seats to a client from your shared pool.
If my client has data sovereignty requirements, does Zenarmor support both security and data sovereignty? Yes. Zenarmor was designed to inspect traffic locally without requiring cloud-based PoPs for traffic inspection.
Can we reuse our clients' existing firewalls? Yes. Zenarmor runs on OPNsense, OpenWRT, FreeBSD, and Linux, bare-metal or virtual, and installs as a plugin from the OPNsense or pfSense CE web UI.
How does billing work across many clients? You buy a pre-purchased seat pool with volume-tiered pricing, allocate seats to clients, and reallocate them as clients change. You can sell to clients monthly, annually, or multi-year.
Can one console cover every client? Yes. Zenconsole is multi-tenant and shows the health of all client networks in one view. Each client's policy, data, and visibility stay separate.
Do we have to route client traffic through a vendor cloud? No. Zenarmor enforces security locally on the gateway or endpoint, so there's no PoP detour.
How do we become a partner? VARs, MSPs, and MSSPs all apply through the Zenarmor partner program.