Compare SD-WAN and SASE vendors with one scorecard
Twenty questions to send every SD-WAN or SASE bidder, grouped by architecture, security, India compliance, support and cost, with Nexapp's answers and evidence filled in.
How to use the scorecard
Score each bidder from 0 to 2 on every row: 0 means no, 1 means partial or on the roadmap, and 2 means yes, generally available today, with written evidence. Then weight the rows that matter most to you. Banks usually double rows 6 to 14; retail and logistics chains usually double rows 1 to 5 and 15 to 18.
Ask each bidder for evidence, not a slide: certificates, datasheets, a cryptographic bill of materials (CBOM) and a sample SLA. Download the scorecard as a spreadsheet to share with your evaluation team.
Architecture
| # | Question to ask every vendor | Why it matters | Nexapp's answer |
|---|---|---|---|
| 1 | One vendor for router, SD-WAN, firewall and ZTNA? | Fewer consoles, one SLA, no finger-pointing between vendors | Yes: Instaroute routers, NexappOS, the Nexapp Controller, NGFW and Nexapp SSE. See the platform |
| 2 | The same operating system on every form factor? | One policy model from branch to cloud | NexappOS runs on appliances, x86 servers, KVM, Hyper-V, VirtualBox, AWS, Azure, Google Cloud and data-centre hubs. See form factors |
| 3 | 4G and 5G built in, with dual-SIM failover? | Sites where fibre is late or fails | Yes, with sub-second failover and dual-SIM arbitration. See the routers |
| 4 | Zero-touch provisioning? | Rollout speed for 100 or more sites | Yes: devices are pre-registered by serial and configure themselves. SD-WAN Enterprise |
| 5 | Industrial protocols such as Modbus, DNP3 and IEC 60870-5-104? | ATMs, plants and utilities | Yes, with RS232 and RS485 serial ports. IoT and M2M |
Security
| # | Question to ask every vendor | Why it matters | Nexapp's answer |
|---|---|---|---|
| 6 | Is post-quantum encryption generally available and on by default? | Traffic recorded today can be decrypted later; India's DST roadmap sets milestones | Yes: hybrid ML-KEM (NIST FIPS 203) key exchange and ML-DSA (FIPS 204) authentication. Post-quantum cryptography |
| 7 | Can you provide a cryptographic bill of materials (CBOM)? | CERT-In guidance and the DST roadmap point buyers to one | Yes. Security and trust |
| 8 | IPS, antivirus, web filter, app control and SSL inspection at the edge? | Branch security without extra boxes | Yes. Next-Gen Firewall |
| 9 | ZTNA with device posture, plus SWG, CASB and DLP? | Replacing VPN for remote users | Yes. SSE and ZTNA |
India compliance
| # | Question to ask every vendor | Why it matters | Nexapp's answer |
|---|---|---|---|
| 10 | Can the controller be hosted in India, or in our own DC and DR? | RBI expectations and data residency | Both, with controller high availability and DC–DR replication |
| 11 | 180-day log retention and export to our SIEM? | CERT-In Directions of April 2022 | Configurable retention, with syslog export to your SIEM |
| 12 | Class-I local supplier status? | Government and PSU tenders under the PPP-MII Order | Yes, with a local-content certificate for each bid. Certifications |
| 13 | TEC MTCTE-certified routers? | Mandatory testing for notified telecom equipment | Yes: certificate 244903206, valid to March 2035 |
| 14 | ISO 27001, 20000-1, 9001 and 14001? | Vendor risk assessments | All four. Security and trust |
Support and operations
| # | Question to ask every vendor | Why it matters | Nexapp's answer |
|---|---|---|---|
| 15 | A 24×7 NOC in India, under one SLA? | Who fixes it at 2 a.m. | Yes: Nexapp's NOC in Pune, with one SLA across hardware, firmware and platform |
| 16 | Country-wide field teams? | Rural and tier-3 sites | Yes |
| 17 | Customer references in our industry? | Proof that it works at your scale | 400+ enterprise and banking customers. Case studies |
Cost and commercials
| # | Question to ask every vendor | Why it matters | Nexapp's answer |
|---|---|---|---|
| 18 | A per-site subscription option? | Operating cost instead of up-front capital | Yes: Nexapp NaaS. Network as a Service |
| 19 | Can we grow from one router to full SASE without replacing hardware? | Protects your investment | Yes: the same devices and NexappOS extend to NGFW and SSE |
| 20 | A written end-of-life and firmware support term? | Bank RFPs often ask for seven years | Coming soon: ask our team for the current policy |
Red flags when you compare
- "Quantum-safe" that is only a roadmap. Ask whether post-quantum key exchange is generally available and on by default today.
- A controller hosted only abroad, with no option to run it in India or in your own data centre.
- Separate consoles and contracts for router, firewall and remote access, which means separate SLAs and slower fixes.
- No written firmware support term for the devices you are buying.
- Support routed only through a reseller, with no OEM-run NOC in India.
A worked example
A bank with 300 branches and 1,200 ATMs compares three bidders. It doubles the weight of rows 6 to 14, because audits and tenders decide the purchase. The example scores below are illustrative only.
| Bidder 1 | Bidder 2 | Bidder 3 | |
|---|---|---|---|
| Architecture (rows 1–5, max 10) | 8 | 10 | 6 |
| Security (rows 6–9, max 8, doubled) | 10 | 16 | 12 |
| India compliance (rows 10–14, max 10, doubled) | 12 | 20 | 14 |
| Support (rows 15–17, max 6) | 4 | 6 | 4 |
| Cost (rows 18–20, max 6) | 4 | 5 | 6 |
| Weighted total (max 70) | 38 | 57 | 42 |
The cheapest bidder rarely wins once compliance and support are weighted for what an audit or an outage will cost.
Frequently asked questions
How do I compare SD-WAN vendors for an Indian bank?
Score each bidder on hosting in India or your own DC, 180-day log retention, Class-I and MTCTE status, post-quantum encryption and an India-based NOC, and weight those rows double.
Ask for certificates and a sample SLA as evidence, not a presentation.
What is the difference between comparing SD-WAN and SASE vendors?
SD-WAN connects your sites; SASE adds security service edge (ZTNA, SWG, CASB and DLP) for users and cloud apps.
When comparing SASE vendors, add rows 8 and 9, and check whether one console and one policy cover both.
Which certifications should an SD-WAN vendor have in India?
For tenders: Class-I local supplier status under the PPP-MII Order and TEC MTCTE for notified routers.
For risk assessments: ISO 27001, plus ISO 20000-1 if the vendor runs your service. Ask for certificate numbers and scope.
How do I compare the total cost of SD-WAN over five years?
Add hardware or subscription, licences, links, deployment, support and the cost of outages per site, then compare on a per-site, per-month basis.
A per-site subscription makes bids easier to compare like for like.
Should an SD-WAN vendor support post-quantum encryption today?
Yes, if your traffic must stay confidential for years.
Recorded traffic can be decrypted once quantum computers mature, and India's DST roadmap sets dates for critical sectors. Ask whether hybrid ML-KEM is generally available and on by default.
Send us your scorecard: we fill in every row for your sites and send a like-for-like proposal.
24×7 NOC in Pune · 75,000+ devices deployed · 400+ enterprise and banking customers since 2014.