A Security Package (SPack) is a regularly updated content bundle from the Versa security research team, delivering antivirus signatures, IDS/IPS definitions, URL and IP reputation data, and other security databases to Versa Director, Concerto, and VOS devices. SPacks install once and then update automatically, keeping detection current without manual intervention.
Key takeaways
- An SPack bundles antivirus, IDS/IPS, and URL/IP reputation data.
- Two flavors exist: Premium (full database) and Sample (basic).
- SPacks preinstall on Director and update automatically by default.
- OS SPacks patch system software – a separate package from content SPacks.
- Director and Concerto both orchestrate SPack downloads and installs.
On this page: Why it mattersHow it worksTypesSPacks & VersaFAQ
Why are SPacks important?
Security signatures go stale fast – a threat database that’s weeks old already misses newly discovered malware, phishing domains, and attack patterns. SPacks solve the problem of keeping that data current without tying it to the VOS software release cycle: a device can run the same software version for months while its antivirus, IDS/IPS, and reputation data refresh continuously in the background. Decoupling content from code is what lets Versa push a new IPS signature within hours of a threat being identified, rather than waiting for the next quarterly software release.
That separation also protects operational stability. Updating an SPack has no operational impact on a running Director node or VOS device – no reboot, no service interruption – which is what makes daily or even real-time automatic updates practical at scale. For managed deployments, the Versa Managed Services team downloads and applies SPacks centrally; for on-premises and private SASE deployments, enterprise administrators own the same process directly from Director or Concerto.
What is a Security Package?
An SPack is a software bundle preinstalled on a Versa Director node the first time headend and branch components are deployed. Director acts as the centralized patch and lifecycle management server, downloading updates from a Versa cloud server and pushing them to VOS devices. Each SPack update rolls together several distinct data sets, each on its own cadence: antivirus and IP-reputation signatures refresh with every release, IDS/IPS signatures update weekly, CASB signatures every two weeks, application identifiers (AppIDs) roughly every three months, and URL category and reputation data continuously.
SPacks also carry DLP predefined patterns and IoT security objects, alongside the antivirus, IDS/IPS, and reputation databases used across firewall configurations. A related but separately managed artifact, the application identification library (also called the application engine protocol bundle), ships inside SPack updates too – but unlike the rest of the bundle, it does not install automatically; an administrator upgrades it manually, and doing so restarts services on the VOS device.
Types of SPacks
Content SPacks come in two flavors, selected when configuring a download. Premium contains the complete antivirus, IDS, IPS, and URL filtering database – 900 MB to 1.1 GB – and is recommended for all security deployments, though it needs a minimum of 8 GB of RAM and cannot install on two-core, 4 GB VOS devices. Sample contains only the core security configurations needed to load the features, under 100 MB, with far fewer signatures; Versa does not recommend it for unified threat management (UTM) deployments.
A separate package family, the OS SPack, is easy to confuse with the content SPack but solves a different problem: instead of security content, it patches the underlying system software on Analytics, Director, and VOS devices against newly identified vulnerabilities. Versa recommends installing OS SPacks as they become available, alongside routine VOS software upgrades roughly every 60 to 90 days.
SPacks & Versa
Both Director and Concerto orchestrate the same lifecycle: configure download parameters (source URL, timeout, full or incremental download, flavor, and an optional schedule), download to the headend node, then push to VOS devices – immediately or on a schedule – from an Upgrade Appliances workflow. Each node retains the last five downloaded SPacks by default, configurable up to whatever the node’s memory allows.
Per-device automatic updates support two modes: a scheduled update, which checks for a new SPack at a recurring interval (for example, daily at a fixed time) and installs it automatically, and a real-time update, which targets a specific one-time check. If the Director node has no internet access, an administrator can download an SPack and its checksum file manually – via a browser URL or shell command against the Versa SPack cloud server – and upload both to the node for offline installation.
Frequently asked questions
What’s the difference between the Premium and Sample SPack flavors?
Premium contains the complete antivirus, IDS, IPS, and URL filtering database – 900 MB to 1.1 GB – and is recommended for all security deployments, given enough RAM. Sample contains only the core security configurations, under 100 MB, with fewer signatures, and isn’t recommended for UTM deployments.
Does updating an SPack disrupt a running device?
No. Updating the content SPack has no operational impact on a running Director node or VOS device – signatures and reputation data refresh in place. The related application identification library is the exception: upgrading it manually restarts services on the VOS device.
What’s the difference between an SPack and an OS SPack?
An SPack updates security content – antivirus, IDS/IPS, and URL and IP reputation signatures. An OS SPack instead patches the underlying system software on Analytics, Director, and VOS devices against newly identified vulnerabilities. They’re downloaded, tracked, and installed through separate workflows.
Can VOS devices update their SPack automatically?
Yes. Each VOS device can be configured for scheduled updates – checking periodically, such as daily or monthly, for a new SPack and installing it automatically – or for a real-time update at one specific time. Versa recommends automatic updates over manual downloads.
How do I get an SPack if the Director node has no internet access?
Download the SPack file and its checksum from a system that does have internet access – via a browser URL or shell command against the SPack cloud server – then manually upload both files to the Director node, which validates the filenames and checksum before installing.
More on Versa security content
If you want to learn more, these are sources we trust.
| Versa Networks: products | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages, covering the security services that SPack content protects across the VersaONE platform. | The SD-WAN and security service that SPack-delivered signatures and reputation data feed into on every VOS device. | Training and labs that cover Director, Concerto, and appliance lifecycle management, including package updates. |
Related terms
If you’re reading about SPacks, these are worth looking at next.
| Intrusion Detection System | Appliance | Organization |
|---|---|---|
| The detection service whose intrusion signature definitions an SPack update refreshes on a weekly cadence. | The physical or virtual VOS device that receives and installs SPack updates pushed from Director or Concerto. | The Director and Controller construct under which SPack-protected devices and their organization-scoped configuration are managed. |