For providers

Build managed Layer 7 security services on infrastructure you control.

Deploy VxSure as a compact software-defined appliance in your own environment, operate it for many customers from one console, and define the service, the SLA and the price yourself.

Foundation tier: no fee, six Advanced evaluation instances.

Who it is for

Provider typeProblem todayHow VxSure fits
MSSPsWeb security is resold, not operated, so it adds little to the managed serviceRun inspection on your own infrastructure and feed every web decision into your SOC
System integratorsClient designs need a Layer 7 control that fits custom networks and identityDeploy on the client's platform of choice, with JWT-based SaaS integration in Advanced
Telcos and ISPsConnectivity is sold without a security layerInline inspection for subscriber traffic, with traffic mirroring to your monitoring
Cloud operatorsCustomers ask for security that stays in your region and your data centreRun VxSure alongside your existing services, with logs kept in-region
Security specialistsAdvisory work ends at a report, with no recurring service behind itTurn policy and compliance work into an operated service

ProblemA platform is only useful to a provider if it maps to services customers buy.

Eight services, each mapped to an edition.

Managed secure web gateway (SWG)

Basic

Problem: DNS and category filtering cannot see inside HTTPS or files hosted on trusted domains.

Controls: TLS inspection with the customer's own CA, inline file inspection, DNS filtering and tunnelling detection, command-and-control blocking, content disarm.

Typical buyer: small and mid-sized organisations.

AI and SaaS governance

Power

Problem: staff paste and upload company data into AI tools and personal SaaS accounts.

Controls: identifies AI and SaaS destinations, separates company and personal accounts, applies allow, limit or block per app.

Typical buyer: any organisation where staff use AI tools at work.

Data loss prevention (DLP)

Power

Problem: sensitive data leaves through browser uploads, including inside archives and images.

Controls: detects PII, financial and health records in text, files, archives and images (OCR); blocks uploads to unapproved destinations.

Typical buyer: finance, healthcare, IT and outsourcing firms.

Compliance evidence

All editions

Problem: auditors need long-term decision logs kept in a specific jurisdiction.

Controls: every decision logged with user, rule and action; versioned policy changes; logs stored on your in-region infrastructure.

Typical buyer: regulated organisations.

Remote browser isolation (RBI)

Power

Problem: unknown sites are either blocked, which stops work, or allowed, which exposes the endpoint.

Controls: risky pages render in a remote browser on your infrastructure; active code never reaches the device.

Typical buyer: finance teams, executives, front-office staff.

Clean-pipe security

Advanced

Problem: connectivity is sold without inspection.

Controls: inline inspection of subscriber traffic; network traffic mirroring to the provider's monitoring.

Typical buyer: business subscribers of telcos and ISPs.

Integrated SaaS access

Advanced

Problem: custom environments need consistent identity across internal and SaaS applications.

Controls: JWT-based SaaS integration; advanced usage controls.

Typical buyer: clients of system integrators.

SOC web telemetry

All editions

Problem: SOCs lack application-layer evidence from web sessions.

Controls: structured logs of every web decision forwarded to the SIEM, ticketing and automation tools.

Typical buyer: customers of MSSPs with a security operations centre.

ProblemUnclear responsibility between vendor and provider is where outages and disputes start.

Who does what.

AreaPartnerVxSure
Infrastructure (compute, storage, bandwidth, including RBI)IncludedNot included
Deployment and configurationIncludedGuidance and reference material
Customer contract, service scope, SLA and priceIncludedNot included
First-line operations and customer supportIncludedNot included
Platform software, updates and threat intelligenceNot includedIncluded
Second-line partner supportNot includedIncluded
Product defects and fixesNot includedIncluded
Enablement: workshops, reviews, documentationNot includedIncluded

ProblemRunning one stack per customer does not scale for a provider team.

Many customers, one console.

  • Per-customer policy: each tenant has its own rules, users and logs.
  • Policy consistency: policies, threat feeds and directory integration stay in sync across nodes and sites.
  • High availability: active-active behind a load balancer, or active-passive failover.
  • Change control: policy changes are versioned and backed up; a replacement node restores its configuration.
  • Evidence per tenant: structured logs per customer to your SIEM, ticketing and automation tools.
Console · TenantsIllustration
Customer ABasicpolicy v14
Customer BPowerpolicy v9
Customer CAdvancedpolicy v22
Customer DBasicpolicy v3
Customer EPowerpolicy v11

ProblemSecurity layers that need network redesign or endpoint rollout stall in delivery.

One appliance. Your platform.

  • Form factor: one compact software-defined appliance with a built-in console.
  • Platforms: public cloud, private cloud, KVM-based hypervisors, virtualised data centres, or the customer's own environment.
  • Network position: beside the existing firewall, adding Layer 7 inspection.
  • Traffic onboarding: the organisation's VPN for remote users; firewall and router tunnels from offices. No endpoint agent.
  • Identity: the organisation's existing identity provider.
  • Scaling: add CPU and memory to a node first, then add nodes.

ProblemA demo tenant shows the vendor's environment, not yours.

Test the Advanced edition before you sell it.

  1. Join as a Foundation partner

    No fee. Onboard up to two technicians and receive six Advanced non-production instances for proof of concept, evaluation and training.

  2. Build the proof of concept

    Deploy in your lab or a prospect's environment. Validate TLS inspection, DLP, RBI and logging against your own test cases, with fortnightly workshops and included assistance sessions.

  3. Move to production

    Deploy Basic without instance limits. Add Power and Advanced as customers need them.

Evaluation instances are non-production and subject to published usage rules.

Three tiers, by operating scale.

EntitlementFoundationGrowthStrategic
Suited toEvaluation and market entryRecurring managed servicesMSSPs, telcos, cloud operators
TechniciansUp to 2Up to 6Up to 10
Advanced evaluation instances61535
Basic production deploymentsUnlimitedUnlimitedUnlimited
Power production instancesNot includedIncludedIncluded
Advanced production instancesNot includedNot includedIncluded
Technical workshopsFortnightlyFortnightlyWeekly
Weekly Solution Performance ReviewNot included1 seatUp to 3 seats
Customer assistance sessionsIncludedIncludedIncluded
Discount on eligible add-ons and servicesNot includedIncludedIncluded
Product accessSelected betasPreviews and roadmap briefingsPriority beta and product planning

Instance entitlements and pricing: see Pricing

ProblemWhen a customer is down, a provider needs a defined path to someone who can fix the product.

Defined escalation, to the engineers who build it.

LineOwnerScope
FirstPartnerCustomer relationship and day-to-day operations
SecondVxSure partner supportEmail support on every tier; included assistance sessions for customer escalations
ThirdVxSure engineeringProduct defects and fixes

Production down goes first

Production-down issues are handled first, on every tier.

Enablement

Technical workshops, Weekly Solution Performance Reviews, documentation, deployment guides and a partner kit (coming soon).

ProblemTLS inspection, DLP, traffic mirroring and logging create legal obligations for whoever operates them.

Operate inspection responsibly.

As the operator, you process customer traffic and logs on their behalf. VxSure supports this with:

  • decision and policy-change logs for audit;
  • data and logs kept on infrastructure you choose;
  • a partner kit with contract and data-processing templates (coming soon).

Customers remain responsible for lawful authorisation and employee notice for TLS inspection in their jurisdiction.

Questions technical buyers ask

Is there an endpoint agent?
No. Traffic arrives through the organisation's VPN and office tunnels.
Who hosts VxSure?
You do, on infrastructure you control, or in the customer's environment.
Where does remote browser isolation run?
On your infrastructure, in the same operating model as the gateway. It is included in Power and Advanced.
Can I show my own brand to users?
Advanced includes custom branded warning pages.
Does VxSure replace the firewall?
No. It sits beside the firewall and adds application-layer inspection.
How is HTTPS inspected?
With the organisation's own certificate authority.

Start with the Advanced edition in your own lab.