What is ASC?

ASC (Versa Advanced Security Cloud) is a set of licensed cloud security microservices – ATP and DLP sandboxing, clientless access, remote browser isolation, and device risk scoring – that Versa Cloud Gateways call on to enforce threat and data-loss policy. It also deploys on-premises, in reduced form, as Versa Secure Lens.

Key takeaways

• Delivers ATP/DLP sandboxing, RBI, and device risk scoring as microservices.
• Licensed separately from the base SASE gateway or SD-WAN subscription.
• Scores endpoint risk by combining EDR, UEM, and vulnerability data.
• Versa Secure Lens runs a streamlined ASC subset on-premises via Kubernetes.
• Outbound and inbound email protection runs through an ASC SMTP proxy.

On this page: Why it matters · How it works · ASC deployment models · ASC & Versa · FAQ

Why is ASC important?

Threat sandboxing, DLP inspection, browser isolation, and risk scoring are compute- and data-intensive, and they depend on constantly updated threat intelligence – not something every gateway can run well on its own. ASC centralizes that work in shared cloud infrastructure so Versa Cloud Gateways and SASE gateways consume it as a call-out microservice instead of a per-device workload, keeping security policy consistent across every user and site a gateway serves.

It also matters because access decisions increasingly need endpoint context, not just network telemetry. ASC’s device risk score service pulls signal from a device’s own security stack – EDR, endpoint management, vulnerability data – and turns it into one score that policy engines like Concerto can act on, so access can tighten automatically when a device’s posture degrades rather than waiting for an administrator to notice.

What is ASC?

ASC is a cluster of microservices reachable from Versa Cloud Gateways, SASE clients, and Concerto. Its device risk score (DRS) service ingests inputs from EDR platforms such as CrowdStrike, Microsoft Defender, and SentinelOne, from Unified Endpoint Management, and from vulnerability and threat-management systems, computes a unified entity risk score, and distributes it to SASE gateways through Versa Messaging Service – so access policy can react to a device’s real-time posture rather than a static allow-list.

ASC also runs an SMTP proxy that inspects outbound and inbound email for DLP and ATP violations, using the same DLP and ATP engines applied to web and endpoint traffic: blocking, redacting, quarantining, or rewriting risky URLs to route through Remote Browser Isolation, all enforced at the individual-recipient level.

ASC deployment models

Two deployment models exist. Full ASC runs as Versa-hosted cloud infrastructure, delivering the complete microservice set – sandboxing, DLP, RBI, clientless access, device risk scoring, and email protection – to Versa Cloud Gateways and tenants with no on-premises footprint. Versa Secure Lens is the on-premises alternative: a streamlined subset of ASC functionality deployed on a customer-managed Kubernetes cluster, with at least one control-plane node and three worker nodes, for organizations with data-residency requirements that need EDR integration and device risk scoring to stay on their own infrastructure.

Worker nodes can also be converted from existing Versa Messaging Service nodes, letting a VMS deployment absorb ASC workloads incrementally rather than standing up a wholly separate cluster.

ASC & Versa

Deploying Versa Secure Lens starts with sizing the Kubernetes cluster to minimum CPU and RAM requirements, then converting VMS nodes to workers and joining them to the control-plane node, as detailed in Configure ASC Worker Nodes and Deploy Versa Secure Lens. Getting ASC’s risk-scoring microservices talking to a tenant requires enabling the ASC service inside a VMS connector – FQDN, port, and TLS settings – plus a Kafka cluster and EDR platform integration, covered in Configure VMS to Integrate EDR Platforms.

ASC’s email protection microservice is configured from Concerto: DLP and ATP profiles define what the SMTP proxy blocks, redacts, quarantines, or sandboxes, and Gmail or Microsoft 365 connectors route outbound and inbound mail through the Versa ASC cluster, as walked through in Configure Email Protection in Concerto.

Frequently asked questions

What is the difference between ASC and Versa Secure Lens?

ASC is the full cloud-delivered security framework, hosted by Versa. Versa Secure Lens is a streamlined, on-premises deployment of a subset of that same functionality, run on a customer-managed Kubernetes cluster – for organizations that need ASC-class services like device risk scoring without sending data off-premises.

What is the device risk score (DRS) service?

DRS is an ASC microservice that combines signals from EDR platforms, Unified Endpoint Management, and vulnerability data into a single risk score per device. Versa Concerto uses that score to drive dynamic, risk-based access and protection policy rather than static rules.

How does ASC protect email?

Through an SMTP proxy integrated into your mail flow. Outbound and inbound email is routed through the Versa ASC cluster, where DLP and ATP policies can block, redact, quarantine, or sandbox messages, and rewrite risky URLs to route through Remote Browser Isolation.

What EDR platforms integrate with ASC?

CrowdStrike, Microsoft Defender, and SentinelOne are supported EDR platforms. Integration is configured through Versa Messaging Service: a Kafka cluster carries the data, and the ASC service enabled in VMS forwards device risk information on to Concerto and the SASE gateways it protects.

Does ASC require a separate license?

Yes. ASC is a licensed cloud security framework, distinct from the base SASE gateway or SD-WAN subscription – an organization enables specific ASC microservices, such as sandboxing or device risk scoring, as licensed add-on capability rather than getting them by default.

More on Versa Advanced Security Cloud

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about ASC, these are worth looking at next.