Versa Secure Private and Internet Access (VSPIA) is a Versa endpoint-client service option that combines Versa Secure Internet Access (VSIA) and Versa Secure Private Access (VSPA), giving a single client both split-tunnel and full-tunnel connectivity for private application traffic and general internet traffic.
Key takeaways
- VSPIA combines VSIA and VSPA in one endpoint-client service option.
- Supports both split-tunnel and full-tunnel connectivity in one client.
- Available at Essential and Professional gateway license tiers.
- Titan Portal introduced a version 2 behavior model in Release 11.2.
- A VSPIA or VSAF Professional license is required for unified risk scoring.
On this page: Why it mattersHow it worksVSPIA license tiersVSPIA & VersaFAQ
Why is VSPIA important?
Remote and hybrid users need two kinds of connectivity at once: tightly scoped access to private, internal applications, and broad, secured access to the general internet. Provisioning those as two separate client policies – one for VSIA, one for VSPA – adds administrative overhead and creates gaps where a user’s traffic doesn’t cleanly fall into either bucket. VSPIA collapses that into a single endpoint-client option, so an administrator configures one service that already understands both traffic types.
Tunnel-mode flexibility matters just as much. Some organizations need full-tunnel connectivity, backhauling all traffic through the SASE gateway for consistent inspection; others need split-tunnel, sending only private-application traffic through the tunnel while letting the rest go direct. VSIA and VSPA each support only one of these modes cleanly; VSPIA is built to support both, which is also why it unlocks capabilities – like unified risk scoring – that require full visibility across both traffic types.
What is VSPIA?
VSPIA is best understood as VSIA and VSPA combined into a single service option, not a separate product built from scratch. Where VSIA alone is limited to full-tunnel connectivity and VSPA alone is limited to split-tunnel connectivity with SD-WAN steering, VSPIA supports both tunnel modes together, along with Endpoint Information Profile (EIP) checks, Digital Experience Monitoring (DEM), and full application steering – the complete feature set, rather than the partial support each standalone option carries. Private prefixes are also fully available under VSPIA, rather than defaulting to a broad catch-all route.
Titan Portal tracks two behavior generations for VSIA, VSPA, and VSPIA: version 1, preserving pre-Release-11.2 behavior for existing organizations, and version 2, the default for new organizations from Release 11.2 onward, which refined gateway tiering and feature allocation. Under version 1, tunnel mode was tied to subscription tier – split tunnel was available on every tier, while full tunnel required a professional or secure-app-optimization tier. Version 2 replaced that with explicit per-service, per-tier feature tables, documented in VSIA, VSPA, and VSPIA behavior changes between Titan Releases 11.0 and 11.2.
VSPIA license tiers
VSPIA licensing follows the same Essential-versus-Professional structure as VSIA and VSPA. At Essential, VSIA’s endpoint client is available with full tunnel but no UTM and a ten-application cap; VSPA’s client is split-tunnel only, likewise without UTM and capped at ten applications. At Professional, both lose the application cap and gain UTM – VSIA staying full-tunnel, VSPA staying split-tunnel. VSPIA removes the need to choose: it supports split tunnel and full tunnel together, rather than the single mode each standalone option is capped to per tier.
For multitenant remote access VPN (RAV) deployments, the version-2 model documents VSIA with full-tunnel endpoint-client support at Essential, Professional, and Secure App Optimization tiers, though without EIP, DEM, application steering, or client security in that configuration. Version 1’s multitenant-with-RAV rows instead paired VSIA and VSPA together, tying VSA tunnel mode to the same three-tier structure.
VSPIA & Versa
VSPIA is one of the licenses that unlocks unified risk scoring: a VSPIA license, or alternatively a Versa Secure Access Fabric (VSAF) Professional license, is a prerequisite for Versa’s risk-scoring capability, which composites signals from EDR, UEBA, UEM, and vulnerability-threat-manager categories into a single entity risk score. That risk score, in turn, feeds enforcement decisions – for example, denying access to private applications for users whose risk band crosses a configured threshold. Because VSPIA already carries both private-application and internet traffic through the same client, it is positioned to apply that risk-based enforcement consistently across both traffic types, rather than only the portion covered by a single-purpose VSIA or VSPA license. New VSPIA-related documentation, including behavior-change notes, is tracked in the new articles listing alongside the rest of the Versa knowledge base.
Frequently asked questions
What is the difference between VSPIA, VSIA, and VSPA?
VSIA provides secure internet access with full-tunnel connectivity; VSPA provides secure private-application access with split-tunnel connectivity and SD-WAN steering. VSPIA combines both into one endpoint-client option, supporting split tunnel and full tunnel together rather than being limited to one mode.
Does VSPIA support both split-tunnel and full-tunnel connectivity?
Yes. That combination is VSPIA’s defining feature – VSIA and VSPA each support only one tunnel mode cleanly in the endpoint client, while VSPIA supports both, along with full EIP, DEM, and application-steering coverage.
What license do I need for unified risk scoring?
A Versa Secure Private and Internet Access (VSPIA) license, or alternatively a Versa Secure Access Fabric (VSAF) Professional license. Either license is a prerequisite before you can configure and use unified risk scoring.
What changed for VSPIA between Titan Release 11.0 and 11.2?
Titan Portal introduced a version 2 behavior model, defaulted for new organizations from Release 11.2, that refined gateway tiering and per-tier feature allocation compared to the version 1 behavior that existing organizations retain.
Is VSPIA available at every license tier?
VSPIA-related feature support is documented at Essential and Professional tiers, mirroring the structure used for VSIA and VSPA; higher tiers generally remove application-count caps and add UTM support.
More on VSPIA
If you want to learn more, these are sources we trust.
| Versa Networks: products | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages, including where VSPIA fits among Versa’s secure access offerings. | The Secure SD-WAN platform VSPIA’s connectivity and tunnel modes operate alongside. | Training and labs covering Versa secure access and SASE gateway configuration. |
Related terms
If you’re reading about VSPIA, these are worth looking at next.
| Versa Secure Access Fabric | Secure SD-WAN | Versa Operating System |
|---|---|---|
| The bundled tenant offering that also unlocks unified risk scoring at its Professional tier, like VSPIA. | The platform whose device-level configuration VSPIA’s endpoint-client tunnels connect into. | The software stack running on the gateways and devices VSPIA’s tunnels terminate on. |