Secure Edge
Your VPN is not slow because it is old. It is slow because it was built for a building you no longer work in.
Security that follows your people instead of your office, with a New Zealand point of presence so nobody is backhauled to Sydney to get online. It is the Secure Edge tier of our managed plans.
Point of presence
New Zealand
Platform
Todyl SASE
Plan tier
Secure Edge
Certified
ISO/IEC 27001:2022
How it is sold
Not on its own. Secure Edge is a tier of our managed plans. The controls only work if someone tunes the policy and acts on what it finds, and that is the part you are actually buying.
Your firewall
For most organisations this replaces what the firewall was doing for user traffic, and often the VPN concentrator with it. Site-to-site links and anything genuinely on-premises are assessed individually rather than assumed.
Where traffic goes
New Zealand users join the platform at the New Zealand point of presence instead of being backhauled to Sydney. Inspection itself currently runs in Todyl's United States infrastructure — onshore inspection is expected but not available yet.
Your identity platform
It integrates with Entra ID, so your existing groups and conditional access rules drive the policy instead of a second set nobody maintains.
Unmanaged devices
Device posture is part of the access decision, so an unmanaged device can be given a reduced level of access rather than all or nothing.
Your existing VPN
It stays up during the rollout. We move people across in groups and turn the old path off only once the new one is proven for them.
01
The problem
Staff work from home, airports, client sites and phones. The data lives in Microsoft 365 and SaaS. The firewall still sits in a building most of them rarely visit.
Shape
Traditional firewalls protect a perimeter that assumed everyone was inside it. That assumption stopped being true years before most architectures changed.
Workaround
Backhauling every connection to head office adds latency, drops out, and depends on people remembering to switch it on. Poor adoption is not a training problem. It is a design problem.
Trust
Once a flat network trusts anything that reaches it, one compromised laptop can reach the file server, the finance system and the backups.
The difference
A firewall in the office
Policy applies to traffic that happens to pass through the box. Everyone outside it is either on a VPN or unprotected, and when it runs out of capacity the answer is a purchase order.
Secure Edge
Identity and device are checked before access is granted, and the same policy applies on the office LAN, at home and on hotel wifi. Capacity is the platform's problem, not yours.
New Zealand
Every SASE platform routes traffic to the nearest point of presence before it goes anywhere else. For New Zealand organisations that has usually meant Sydney, and sometimes the United States.
Our partnership with Todyl, and the New Zealand customer base behind it, is what persuaded them to build a point of presence here. New Zealand traffic now enters the platform locally instead of hopping to Sydney first.
Entry point
New Zealand users join the platform at the New Zealand point of presence rather than being backhauled to Sydney. Inspection and policy enforcement currently run in Todyl's United States infrastructure. Onshore inspection is expected but is not available yet.
Reliability
A local on-ramp removes the Sydney hop from every connection, and removes one link outside your control from the path between your people and the platform.
Data residency
The New Zealand point of presence is an entry point, not an inspection point. Traffic is analysed in Todyl's United States infrastructure today. If you carry a data-residency requirement that inspection itself must happen onshore, this service does not meet it yet — ask us where it is up to rather than assuming either way.
Security telemetry and case records are a separate matter, handled in the Todyl platform. Our Managed SOC page states plainly where that data sits and who sees it.
What is in it
Todyl consolidates more than twelve network security and access controls into a single agent. These are the ones that change how an environment behaves.
01
Identity and device are authenticated before an application is reachable. Nothing is exposed simply because someone is on the network.
02
Web traffic filtered and controlled at the edge, under the same rules whether the user is in the office or not.
03
Malicious domains blocked at resolution, before a connection is made.
04
Full inspection including SSL, so encrypted traffic is not a blind spot.
05
Rules that account for who, on what device, and in what circumstances, rather than a single yes or no.
06
Internal traffic blocked by default, so a compromised device cannot reach the rest of the network.
07
Access decisions that change with where the connection comes from, applied automatically.
08
Known malicious infrastructure blocked in line, rather than reported after the fact.
09
Traffic takes an optimal path, with static IPs available where an application or a partner requires one.
How it works
Five things, none of which the user has to think about.
01
The agent authenticates the user against your identity platform. For most organisations that is Entra ID.
02
Posture is checked. An unmanaged or non-compliant device does not get the same access as a managed one.
03
A secure tunnel comes up to the New Zealand point of presence. The user does nothing and notices nothing.
04
Traffic is inspected in line, including SSL, and policy is applied before anything reaches its destination.
05
Traffic is routed onward, optionally from a static IP where an application or partner requires one.
One agent, the same policy on the office LAN, at home and on hotel wifi. There is no "remember to connect to the VPN" step, which is what makes the policy hold in practice rather than only on paper.
Zero trust
Zero trust is an overused phrase attached to a small number of concrete behaviours. These are the ones that apply here.
Access is granted to a person on a device, not to anything that can route to the address. Being on the LAN proves nothing on its own.
Devices on the same network cannot talk to each other unless a rule says they can. Lateral movement is the step this removes.
Enforced by the agent rather than by redesigning your switching and VLANs, so it can be applied to the network you already have.
Policy accounts for context - device state, location, circumstances - so access can be tightened without blocking legitimate work.
Integrated with Entra ID, so the groups and conditional access policies you already maintain drive what happens here.
The rules that apply in the office apply everywhere else. Working from home does not quietly downgrade anyone's protection.
How it is sold
Secure Edge is a tier of our managed plans, not a product you buy and run yourself. That is deliberate, and it is worth saying why.
Why
These controls only earn their keep if someone tunes the policy, reviews what is being blocked, and acts on what is found. Deployed and forgotten, it becomes a tax on your users and nothing more.
Where it sits
Our plans run Manage, Protect, Secure Edge and Sentinel. Secure Edge adds the network and access layer on top of everything in Protect.
What that means
The people who write the policy are the people monitoring it. That is what stops a control being quietly switched off because it broke something on a Friday.
Rollout
Phased, with the old path left in place until the new one is proven.
01
We map what you have: VPN concentrators, remote access, firewall rules, and which applications actually matter to the business.
02
An architecture covering your sites, remote users, SaaS and private cloud, with the policy written down before anything is switched on.
03
Integration with Entra ID, so the groups and conditional access rules you already maintain drive the policy rather than a second set.
04
Site by site or team by team. The existing path stays available until the new one has been proven for that group.
05
Ongoing review of what is being blocked and what is being allowed, because a policy nobody revisits drifts out of date quietly.
The network behind it
21+
Years delivering managed IT, security and cloud
40+
Todyl points of presence worldwide
6
Continents covered by the Todyl network
1
In New Zealand, opened through our Todyl partnership
The global network figures are Todyl's. Layer3 is the founding Todyl partner in New Zealand and operates under an ISO/IEC 27001 certified information security management system.
Customers
Customer example
60 people, distributed
The New Zealand Police Association runs a distributed workforce for whom technology is critical to productivity. Access that follows the person rather than the office is the whole problem.
Read the New Zealand Police Association case studyBefore you ask
If yours is not here, ask it directly and you will get a straight answer.
Book a discovery callNew Zealand users join the platform at the New Zealand point of presence rather than being backhauled to Sydney. Inspection and policy enforcement currently run in Todyl’s United States infrastructure, so traffic is analysed offshore before it continues to its destination. Onshore inspection is expected but is not available yet — if that matters to you, ask us where it has got to.
Next step
Most organisations have never measured the round trip their traffic takes, or counted how many people quietly stopped using the VPN. Both are worth knowing before you decide anything.
Layer3 is a managed IT provider operating an ISO/IEC 27001-certified ISMS, with offices across New Zealand.
Contact
0508 LAYER3 Book a discovery call Service status Notices
Level 2, CBD Towers
84-90 Main Street
Upper Hutt, Wellington 5018
© 2026 Copyright Layer3.
Layer3
Book a discovery call - 30 minutes, no obligation