What is Versa Secure Access Fabric (VSAF)?

Versa Secure Access Fabric (VSAF) is a tenant product offering that combines Versa Secure Internet Access, Versa Secure Private Access, and Premier Secure SD-WAN into a single licensed bundle. Four tiers, Essential, Essential Plus, Professional, and Elite, package these services with progressively richer optional security add-ons.

Key takeaways

• VSAF bundles VSIA, VSPA, and Premier Secure SD-WAN into one license.
• Four tiers: Essential, Essential Plus, Professional, and Elite.
• Higher tiers unlock richer VSIA and VSPA sub-bundle service levels.
• Add-ons like Privileged Access, DLP, RBI, ATP, and UEBA vary by tier.
• VSAF Professional or higher is required for unified risk scoring.

On this page: Why it matters · How it works · VSAF bundle tiers · VSAF & Versa · FAQ

Why is VSAF important?

Buying SASE piecemeal – internet security here, private-application access there, SD-WAN somewhere else – creates exactly the licensing and integration sprawl SASE was supposed to eliminate. VSAF exists to sell and provision the whole outcome as one product: when a provider onboards a tenant, one bundle selection determines what secure internet access, private-application access, and WAN connectivity that tenant gets, instead of three separate licensing conversations that might not even stay in sync.

It also gives providers and enterprises a clear upgrade path. A tenant that starts on Essential can move to Professional or Elite as its security needs grow – adding advanced threat protection, data loss prevention, or user and entity behavior analytics – without re-architecting how VSIA, VSPA, and SD-WAN work together. The tiering turns “what security features does this customer need” into a single, comparable choice at onboarding time.

What is VSAF?

VSAF is not a separate product so much as a packaging layer over three existing services. Every VSAF bundle includes Versa Secure Internet Access (VSIA) at some tier, Versa Secure Private Access (VSPA) at some tier, and Premier Secure SD-WAN as the underlying connectivity. What changes between VSAF tiers is which VSIA and VSPA sub-tiers are included and which optional add-ons – Privileged Access, API-based data protection, data loss prevention, remote browser isolation, advanced threat protection, and user and entity behavior analytics – are available to enable.

Selecting a VSAF bundle happens during tenant onboarding, alongside the SD-WAN and NGFW solution tiers (Essential, Professional, or Elite) a tenant is also assigned. The bundle choice determines default feature access levels: some add-ons ship with full access, others with restricted access – for example, a restricted-access API-based data protection feature caps a tenant at three connectors until the corresponding add-on is explicitly enabled.

VSAF bundle tiers

Essential is the entry tier: VSIA Essential, VSPA Essential, and Premier Secure SD-WAN, with no optional add-ons. Essential Plus upgrades VSPA to Professional while keeping VSIA at Essential, and adds Privileged Access as an optional add-on for RDP, SSH, and VNC clientless application access. Professional raises both VSIA and VSPA to Professional, and opens the full optional add-on set: Privileged Access, API-based data protection, data loss prevention, remote browser isolation, and advanced threat protection (cloud malware sandboxing with antivirus and AI/ML). Elite pairs VSIA Elite with VSPA Professional, includes data loss prevention by default, and adds user and entity behavior analytics (UEBA) to the optional add-on list alongside the others – though its API-based data protection and advanced threat protection features start with restricted access until their add-ons are explicitly selected.

VSAF & Versa

VSAF tiers gate specific product capabilities beyond the bundle itself. Configuring SASE tenants is where a provider selects a tenant’s VSAF bundle and any optional add-ons, alongside SD-WAN and NGFW solution tiers, digital experience monitoring, and direct internet access settings. Clientless application access – browser-based RDP, SSH, and VNC through Concerto’s Guacamole integration – requires the Privileged Access add-on, available on the Essential Plus, Professional, and Elite VSAF bundles (or on a standalone VSPA Professional bundle). Unified risk scoring, which combines EDR, UEBA, UEM, and vulnerability/threat-manager signals into a composite entity risk score for access policy, requires at minimum a VSAF Professional license.

Frequently asked questions

What three services does VSAF combine?

Versa Secure Internet Access (VSIA), Versa Secure Private Access (VSPA), and Premier Secure SD-WAN. Each VSAF tier includes a specific combination of VSIA and VSPA sub-tiers alongside the SD-WAN connectivity, sold, licensed, and provisioned together as one bundle at tenant onboarding.

What are the four VSAF tiers?

Essential, Essential Plus, Professional, and Elite. They differ in which VSIA and VSPA sub-tiers are included and which optional security add-ons, such as Privileged Access, DLP, RBI, ATP, and UEBA, are available to enable on top of the base bundle at each successive tier.

Which VSAF tier is needed for clientless RDP, SSH, or VNC access?

The Privileged Access add-on, which enables clientless application access through Concerto, is available on the Essential Plus, Professional, and Elite VSAF bundles. It is not included by default on any tier; it must be explicitly selected as an add-on during tenant onboarding.

Does every VSAF tier include the same add-ons?

No. Essential includes no optional add-ons at all. Essential Plus adds only Privileged Access. Professional opens Privileged Access, API-based data protection, DLP, RBI, and ATP. Elite includes DLP by default and adds UEBA alongside the same optional add-on set Professional offers.

What license does unified risk scoring require?

A Versa Secure Private and Internet Access (VSPIA) license or a VSAF Professional license, at minimum. Risk scoring combines signals from EDR, UEBA, UEM, and vulnerability/threat-manager categories into a single composite score that access policy rules can then match against.

More on VSAF

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about VSAF, these are worth looking at next.