Versa Secure Lens is a streamlined on-premises deployment of Versa Advanced Security Cloud (ASC) functionality, running on a Kubernetes cluster of control-plane and worker nodes. It supports EDR platform integration and the device risk score (DRS) service, for organizations whose data-residency requirements rule out the cloud-hosted ASC service.
Key takeaways
- On-premises, Kubernetes-based subset of Versa Advanced Security Cloud.
- Deploys as a control-plane node plus a minimum of three worker nodes.
- Supports on-premises EDR platform integration, such as SentinelOne.
- Runs the device risk score (DRS) service alongside ASC functionality.
- Built for organizations with strict data-residency requirements.
On this page: Why it mattersHow it worksVersa Secure Lens deployment modelVersa Secure Lens & VersaFAQ
Why is Versa Secure Lens important?
Versa Advanced Security Cloud delivers services like device risk scoring and EDR-fed endpoint intelligence as a cloud-hosted framework – the simplest path for most SASE deployments. But regulated industries and organizations with strict data-sovereignty rules often cannot send endpoint and risk telemetry off-premises at all, regardless of how the cloud service is secured. Versa Secure Lens exists for that case: the same ASC functionality, run on infrastructure the organization controls.
That matters operationally, not just for compliance sign-off. An on-premises deployment keeps device risk scoring and EDR data inside the organization’s own network boundary while still integrating with the rest of the Versa security stack – the risk signals still reach the same policy engines, they just never leave infrastructure the organization owns. For organizations that would otherwise forgo ASC-driven risk scoring to meet a residency requirement, Versa Secure Lens is what makes the capability available at all.
What is Versa Secure Lens?
Versa Secure Lens is less a separate product than a deployment mode of ASC: a streamlined subset of ASC functionality, packaged to run on a self-managed Kubernetes cluster rather than in Versa’s cloud. The cluster has two node roles. A control-plane node manages cluster operations – scheduling, health, and orchestration. Worker nodes run the actual application workloads, including the device risk score (DRS) service, and can be added to scale the deployment or separate the control plane from workload processing.
Versa Secure Lens builds on the same Kubernetes foundation as Versa Messaging Service (VMS), the messaging layer that streams data between VOS devices, Versa Director, Controller, Concerto, and Analytics. In practice, an existing VMS node can be converted into a worker node and joined to a control-plane node, rather than standing up separate hardware – a path documented in Configure ASC worker nodes and deploy Versa Secure Lens.
Versa Secure Lens deployment model
A Versa Secure Lens cluster needs, at minimum, one control-plane node (32 cores, 64GB RAM) and three worker nodes (16 cores, 32GB RAM each), plus two public IP addresses – one for the control plane and one for worker ingress. Existing VMS nodes are converted to worker nodes with a CLI command, then joined to the control-plane node, which generates a join token and ingress certificate per worker. Cloud deployments (for example, on AWS) use elastic IP addresses for this northbound communication instead of static public IPs.
Once the cluster is up, an ASC Infra installer configures Versa Secure Lens – cluster ingress, base domain, and hostname settings – and a separate installer deploys the DRS service on top of it. On-premises EDR integration, such as a SentinelOne connector, is added the same way: by extending worker nodes on the existing VMS cluster rather than deploying separate infrastructure. Deployment is verified with standard Kubernetes tooling – kubectl get pods -A to confirm pods run on worker nodes, and helm list to confirm the expected charts are deployed.
Versa Secure Lens & Versa
Versa Secure Lens sits inside the broader VMS ecosystem: VMS is the messaging backbone connecting VOS devices, Director, Controller, Concerto, and Analytics, and ASC – including its Versa Secure Lens form – is one of the services VMS can host on worker nodes, alongside SCIM, third-party authentication, and threat intelligence. Versa Director still onboards tenants and services against the cluster the same way it does for any VMS deployment, so an organization running Versa Secure Lens keeps the same multitenant administration model as a cloud-hosted ASC deployment – only the infrastructure location changes. See Install and configure VMS and Enable and configure VMS services for how the underlying cluster and its services are set up more broadly.
Frequently asked questions
What is the difference between Versa Secure Lens and Versa Advanced Security Cloud?
ASC is the full cloud-hosted security framework. Versa Secure Lens is a streamlined subset, packaged to run on a self-managed, on-premises Kubernetes cluster for organizations that cannot send security telemetry off-premises.
What are the minimum hardware requirements for a Versa Secure Lens cluster?
One control-plane node with 32 cores and 64GB RAM, at least three worker nodes with 16 cores and 32GB RAM each, and two public IP addresses – one for the control plane, one for worker ingress.
Does Versa Secure Lens need separate hardware from VMS?
Not necessarily. Existing VMS nodes can convert to worker nodes with a CLI command and join a control-plane node, rather than deploying entirely new infrastructure.
Which EDR platforms can integrate with Versa Secure Lens?
It supports on-premises EDR integration by adding worker nodes to the existing VMS cluster; SentinelOne is a documented example deployed this way.
How do I verify that a Versa Secure Lens deployment is healthy?
Run kubectl get pods -A to confirm Versa Secure Lens and DRS pods are running on worker nodes, and helm list in the relevant namespace to confirm the expected charts are deployed.
More on Versa Secure Lens
If you want to learn more, these are sources we trust.
| Versa Networks: products | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages, including Versa Advanced Security Cloud and its on-premises deployment options. | The Secure SD-WAN service Versa Secure Lens feeds risk and endpoint intelligence into, as packaged by the vendor. | Training and labs covering Versa security services and on-premises deployment. |
Related terms
If you’re reading about Versa Secure Lens, these are worth looking at next.
| Versa Advanced Security Cloud | Endpoint Detection and Response | Organization |
|---|---|---|
| The cloud security framework Versa Secure Lens packages a streamlined, on-premises subset of. | The third-party security category Versa Secure Lens integrates via worker-node connectors like SentinelOne. | The tenant construct whose data-residency requirements often drive the choice to deploy Versa Secure Lens. |