SD-WAN Companies: Vendors, Managed Providers and Carriers

An SD-WAN solution company is one of three things, and the name on the proposal rarely tells you which. Platform vendors build the software and the appliances: Cisco, Fortinet, VeloCloud by Arista, Versa Networks, Cato Networks and their peers. Managed providers run a platform for you, occasionally their own and usually a vendor's, with the hardware, the monitoring and the support folded into a monthly fee per site. Carriers sell SD-WAN as a line on the same contract as the circuits it rides on. The same platform reaches a buyer through all three, at prices that differ more than the products do, so the first job is to sort the companies by kind and the second is to compare quotes within each kind. This guide does the sorting, names the companies in each group, and says which kind fits which business.

The three kinds of SD-WAN company

A vendor sells you a platform. A managed provider sells you a working network. A carrier sells you circuits with the network wrapped around them. All three put "SD-WAN" on the proposal, and a buyer who compares a vendor's license quote against a carrier's per site bundle is comparing a box of parts against a finished service. The table sets out what each kind actually sells, what the invoice covers, and who answers when a site goes down.

SD-WAN vendors: the companies that build the platform

A vendor sells licenses and hardware, and in this category it almost never sells them to you directly. Versa Networks states on its partner page that it sells globally one hundred percent through partners. Cisco, Fortinet and Palo Alto Networks reach mid size businesses through resellers. VeloCloud reaches a large share of its customers through carriers and managed providers that sell it under their own names. Buying from a vendor therefore means buying through a reseller, running the platform yourself or hiring someone to run it, and accepting that the vendor's support covers the software and the boxes, never your circuits. The vendors sort into four groups, and our ranked evaluation of SD-WAN providers states who each one fits.

Converged SASE platforms

These companies sell networking and security as one product, which is what the category now calls SASE. Cato Networks is the pure form: one cloud service that routes, optimizes and secures traffic on Cato's own global backbone, managed in one console, with no appliance stack to maintain. Versa Networks built the deepest single vendor stack, routing, SD-WAN and a full security suite as one operating system, and because it sells only through partners it is the platform behind many carrier and managed offers, including Lumen's and Zayo's. Netskope sells Netskope One SD-WAN, formerly Borderless SD-WAN, from its Infiot acquisition, a SaaS delivered SD-WAN that applies the same policy from the endpoint client through branch and data center gateways, and it suits buyers whose project is led by data protection. Palo Alto Networks sells Prisma SD-WAN on its ION devices and pairs it with Prisma Access to form Prisma SASE, licensed by bandwidth and deployment model for branch and data center locations. Our Cato Networks vs Zscaler and Zscaler vs Netskope verdicts cover how the converged and security led approaches differ in practice.

Networking first SD-WAN

These companies came to SD-WAN from routing and sell the WAN half, with security from a partner or an add on. VeloCloud by Arista effectively defined cloud delivered SD-WAN, appliances at each site steered by cloud gateways, and it has the widest distribution in the market: AT&T, Zayo, GTT, Granite and Windstream Enterprise all sell it. The platform passed from VMware to Broadcom in 2023 and to Arista in July 2025, which ended two years of ownership uncertainty. Cisco sells two SD-WANs: Catalyst SD-WAN, the Viptela heritage platform Cisco positions for complex, SASE ready networks, and Meraki SD-WAN, the cloud managed option with an integrated firewall that Cisco aims at lean IT teams. Carriers resell both; Lumen offers each as a separate product and Spectrum Enterprise builds its Managed Network Edge on Meraki. HPE Aruba Networking EdgeConnect, built by Silver Peak, earned its name on path conditioning that keeps voice and video clean on imperfect circuits, and it pairs with third party security clouds or with HPE's own security service edge. HPE also owns Juniper Networks since July 2025, and with it the Session Smart Router, a tunnel free SD-WAN managed through the Mist cloud, so one vendor now sells two SD-WAN lines.

Firewall anchored platforms

For many businesses SD-WAN arrives inside the branch firewall they were buying anyway. Fortinet runs Secure SD-WAN and its security on the same FortiOS operating system with a single policy engine, and FortiSASE supplies the cloud security edge; it is the platform most often resold by the carriers and aggregators in our table, from Zayo and GTT to Granite, Masergy and Spectrum Enterprise's Enterprise Network Edge. Cisco's Secure Firewall Threat Defense combines SD-WAN capabilities with firewalling in the same way. The appeal is one device and one quote per site; the limit is that the value compounds only when you commit to that vendor's fabric broadly. Our Cato Networks vs Fortinet and Palo Alto Networks vs Fortinet verdicts weigh that trade.

Security clouds that now sell the WAN half

Two companies that built security networks now sell an SD-WAN to feed them. Zscaler sells Zero Trust SD-WAN, a physical or virtual Zscaler Edge appliance that manages the site's internet connections and forwards traffic to the Zero Trust Exchange, and it positions the design against conventional SD-WAN, which it says extends the network everywhere. Cloudflare sells Cloudflare WAN, documented as Magic WAN, through a physical or virtual Cloudflare One appliance, with a light branch, heavy cloud approach it says can augment or replace legacy MPLS or SD-WAN. Both fit businesses that are already standardizing on that security cloud; neither is the natural starting point for a buyer whose problem is branch connectivity.

Managed SD-WAN providers: the companies that run it for you

A managed provider sells the outcome: a working, monitored WAN at each site for a monthly fee that usually covers the appliance, the license, the deployment and the ticket. The provider chooses the platform, or offers a short menu, and your team deals with one company. Two kinds exist.

A few managed providers run their own platform. Aryaka delivers managed SD-WAN and SASE over its own private global backbone, with deployment, monitoring and operation handled by Aryaka, which is why it fits multi region networks where the public internet underperforms between continents. Bigleaf Networks sits between a site's firewall and two or more internet connections and steers traffic across them automatically; it is not a full SD-WAN with site to site policy, and that is the point, because for a small business living on broadband it fixes the actual problem without a network engineer.

Most managed providers run a vendor's platform, and these are the companies most mid size businesses actually sign with. GTT has sold managed SD-WAN on VeloCloud since 2017 and added Fortinet in 2020, with a Fortinet based SASE service since 2024. Expereo offers Arista, Cisco Meraki and Cisco SD-WAN, sources the underlay circuit in any country where a customer operates, and runs follow the sun management. Masergy has been part of Comcast Business since October 2021 and runs its managed SD-WAN and SASE on Fortinet, fully managed or co managed. Granite manages Fortinet, VeloCloud and Meraki under its Granite Guardian service and positions each for a different site profile. MetTel and Nitel, the latter part of Comcast Business since April 2025, source access at every address from carriers nationwide and wrap the circuits in managed SD-WAN, which makes them the right shape for a business whose real problem is a hundred locations on a hundred local contracts. TPx does the same for smaller multi location businesses with voice and managed IT alongside, and many of the managed IT providers we rank fold SD-WAN into a wider network contract.

Four things to check before signing with a managed provider. Which platforms they offer and why they steer you to one, since the answer is sometimes their margin rather than your fit. Whether your team gets to see the orchestrator, because a managed service with no visibility is a black box you are paying monthly for. What leaves with you at the end of the term, the hardware, the configuration, the circuits. And whether the provider owns the circuit ticket as well as the overlay ticket, because a managed WAN whose provider cannot call the carrier is only half managed.

Carriers: SD-WAN bundled with the circuits

Every large US carrier sells managed SD-WAN, and each sells it from a menu of vendor platforms rather than a platform of its own. AT&T names three: AT&T SD-WAN with Cisco, with VMware, which is the VeloCloud platform, and with Aruba. Verizon describes its managed SD-WAN as supporting multiple technology partner solutions, with Verizon planning, monitoring, managing and securing the network. Lumen sells Lumen SD-WAN with Versa Networks, with Cisco Meraki and with Cisco Viptela as three separate products, each with customer self service. Comcast Business built its managed WAN business by acquisition, Masergy in 2021 and Nitel in 2025, and now calls itself one of the fastest growing SD-WAN providers. Spectrum Enterprise sells Managed Network Edge, a Cisco Meraki service that includes SD-WAN, and Enterprise Network Edge on Fortinet for larger organizations. Zayo offers the widest menu among the carriers, VeloCloud, Fortinet, Palo Alto Networks and Versa, with full management, co management or a takeover of an existing deployment, and says customers can change their management level without lock in. Cox Business sells SD-WAN and a Managed SD-Network bundle without naming the platform publicly. Windstream Enterprise, part of Uniti since the August 2025 merger, built its SD-WAN Concierge service on VeloCloud and resells Cato for SASE. Our AT&T vs Comcast Business and Lumen vs Zayo verdicts cover the carriers' circuits, which is where their SD-WAN offers start.

Buying from a carrier means one bill and one term for access and overlay, with the co termination problem solved for you. It also means the platform menu narrows to what that carrier has certified, the overlay term moves with the circuit term at renewal so both come up at once, and diversity still requires a second carrier at every site that matters, whose circuit the first carrier's SD-WAN must manage too. The carrier's SD-WAN is at its best on the carrier's own footprint and at its weakest where it has to order and support someone else's access, which is exactly what our guide to buying business internet covers.

Resellers, distributors and advisors

Between the vendor and the buyer sit the companies that actually write most quotes. Value added resellers sell vendor licenses and hardware and often attach their own managed service, so one reseller can be both a vendor's channel and a managed provider. Distributors sit behind them; Comcast Business, for instance, opened its Masergy managed SD-WAN to resellers through the distributor Exclusive Networks in 2023. The route changes the price: the same platform at the same site count quotes differently through a reseller, a carrier and a managed provider, for reasons our SD-WAN pricing guide sets out. A technology advisor is the fourth route, and the one we run: quotes from all three kinds of company at once against one written configuration, at no cost to the buyer, with the decision and the contract staying yours.

Which kind of SD-WAN company should you buy from?

The right kind follows from your organization, not from the platform you like. Six situations cover most buyers.

• One network team that wants control, ten or more sites, and firewalls near refresh: buy the platform through a reseller, usually Fortinet, Cisco or Palo Alto Networks, and run it yourselves.
• No network engineers and many small sites: buy managed, from a managed provider or a carrier, and judge the companies on the ticket, not the platform.
• Sites on more than one continent: a provider with its own backbone, Aryaka or Cato, or a global managed provider such as Expereo or GTT, because the public internet between regions is the part a domestic carrier cannot fix.
• The circuits are the real problem: an aggregator, Granite, MetTel or Nitel, with SD-WAN on top, or Bigleaf for a handful of sites on broadband.
• A security consolidation driving the project: a converged vendor, Cato, Versa, Netskope, Palo Alto Networks or Fortinet, or a security cloud paired with whichever SD-WAN your team already runs.
• A platform you have already chosen: price it through every kind of company that sells it. VeloCloud alone reaches you through Arista's resellers, AT&T, Zayo, GTT, Granite and Windstream Enterprise, at prices that are not the same.

SD-WAN companies by type

The table lists the companies named in this guide with the kind they are, the platforms they sell and who they fit. It is a map, not a ranking; the ranking is in our evaluation of SD-WAN providers.

Mistakes to avoid

Comparing a vendor quote with a managed quote as if they were the same product. One is parts and the other is a service; put the management, the hardware and the circuit support on the same sheet before you look at the totals.

Letting the carrier choose the platform. The menu is the carrier's, built around its margins and its certifications; if the platform matters to you, decide it first and then ask which companies sell it.

Buying the two halves of SASE from two companies with no written ticket owner. A problem that sits between the SD-WAN and the security cloud is nobody's problem until the contract says otherwise.

Mistaking a reseller for a managed provider. A reseller that sold you the licenses has not agreed to run them; ask what the monthly fee covers at two in the morning.

Assuming the brand on the box is who you call. On a carrier or managed contract the vendor will not take your ticket; the company whose name is on the invoice will, and its support is what you are buying.

Questions to ask every SD-WAN company

1. Which platform is this, and who else sells it? The answer tells you whether you are talking to a vendor, a reseller or a managed provider, and gives you the list of companies to get competing quotes from.
2. Who owns a ticket, and for what? Platform, appliance, circuit and security cloud each need a name, and for a carrier or managed provider that name should be theirs for all four.
3. What is inside the per site number? Hardware, license, deployment, monitoring and the circuit, or some of those, decides whether two quotes are comparable at all.
4. What happens at the end of the term? Whether the configuration, the hardware and the circuits leave with you, and what the renewal cap is.
5. Does the overlay term end when the circuit terms end? A platform term that outlives the circuits, or circuits that outlive the platform, leaves you renegotiating one while captive to the other.

A Technology Advisor from our team takes a written site list and configuration to every kind of company that sells the platforms that fit, vendors through their resellers, managed providers and carriers, and pulls the quotes side by side, free. You keep the decision and sign directly with the company you choose.