Arista debuts unified SD-WAN edge platform

Arista Networks announced Edge Threat Management (ETM) for VeloCloud SD-WAN, a unified platform that combines branch office security with SD-WAN connectivity, integrating next-generation firewall, intrusion prevention, URL filtering, and AI-driven policy intelligence via AVA. Brendan Gibbs, Arista's vice president of AI, routing, and switching platforms, said multi-vendor branch complexity creates blind spots that attackers exploit, and that up to 95% of network changes are still performed manually, leading to configuration mistakes. ETM is a software upgrade to VeloCloud SD-WAN, managed through VeloCloud Orchestrator, and aims to simplify branch operations with a common OS and uniform security policies.

Arista Networks is looking to simplify data protection at the edge of enterprise networks with a new security package that combines branch office security with SD-WAN connectivity in a single platform. The company announced AI-driven Edge Threat Management https://edge.arista.com/edge-threat-management/ ETM for VeloCloud SD-WAN, a platform that links typically separate products and capabilities including Arista’s next-generation firewall, IP reputation, external blocklists, intrusion prevention, URL filtering, application classification, geo-IP filtering, network address translation, deep packet inspection, and zone-based segmentation. ETM provides perimeter protection at the WAN edge and is a software upgrade option to VeloCloud SD-WAN, according to Arista. It can help simplify branch operations with a common operating system, a uniform enforcement engine, and common end-to-end security policies, the vendor stated. The new ETM solution also leverages Arista’s AVA Autonomous Virtual Assist for AI-driven policy intelligence. “Multi-vendor branch complexity creates the ultimate blind spot, and your adversaries are actively hiding in it,” wrote Brendan Gibbs https://www.linkedin.com/in/brendangibbs1/ , Arista’s vice president, AI, routing, and switching platforms, in a blog post https://blogs.arista.com/blog/the-unified-edge-for-a-secure-branch about the new platform. Sprawling multi-vendor infrastructure creates operational headaches and increases security risks, according to Gibbs. “When you have four or five different point solutions from different vendors stacked on top of each other, configuring them becomes a manual, disjointed process. In fact, industry data shows that up to 95% of network changes are still performed manually, which inevitably leads to configuration mistakes, the single biggest driver of network downtime and security policy gaps,” he wrote. “When security policies are decoupled from local network routing, critical blind spots emerge. An attacker doesn’t need to break your cloud-delivered SASE firewall; they just need to target the unmonitored local traffic gaps between your Wi-Fi AP, your LAN switch, and your SD-WAN edge router,” Gibbs wrote. ETM is integrated into VeloCloud Orchestrator as a dedicated enterprise application. “This enables security operators to configure policies that build on the same source of shared network configuration while maintaining a dedicated management console for security policy configuration, provisioning, and reporting,” Arista stated https://www.arista.com/assets/data/pdf/Datasheets/Arista-VeloCloud-SD-WAN-Edge-Threat-Management-Data-Sheet.pdf . ETM security policies are managed in VeloCloud Orchestrator. “Admins can build and assign reusable policies consisting of predefined objects and templates. This design makes updating security policies possible by a few simple clicks, while the associated changes are propagated throughout the network within minutes,” Arista stated. VeloCloud Orchestrator is the central management, configuration, and monitoring hub for VeloCloud SD-WAN and SASE networks. In addition, VeloCloud edge routers collect threat intelligence data from a variety of sources to determine in real-time the trustworthiness and identity of hosts inside and outside the network. Through integration with Arista Network Detection and Response https://www.arista.com/assets/data/pdf/Datasheets/Arista-NDR-Datasheet.pdf and other web-based dynamic lists, administrators can identify suspicious hosts and build policies to block potentially harmful activities, the vendor stated https://www.arista.com/assets/data/pdf/Datasheets/Arista-VeloCloud-SD-WAN-Edge-Threat-Management-Data-Sheet.pdf . Integration with Arista’s AVA policy assistant is aimed at simplifying management of branch security policies. AVA continuously analyzes configuration states and translates complex, multi-site security rules into plain English, Gibbs explained. For example, NetOps administrators can use AI with Ask AVA to predict “how specific traffic will be handled before committing to a deployment, preventing manual configuration errors that leave branches exposed,” Gibbs wrote. Arista also touted support for network-wide segmentation policies. “The flexible security policy configuration within the Edge Threat Management policy management extends the security coverage from the data center to the branch,” the vendor stated. “Security operations administrators can build access policies that are enforced across a distributed network. The centralized design enables admins to configure and deploy consistent zone based policies across the entire distributed network.” ETM is a significant addition to the Arista VeloCloud portfolio. Arista bought https://www.networkworld.com/article/4016270/arista-buys-velocloud-to-reboot-sd-wans-amid-ai-infrastructure-shift.html the VeloCloud SD-WAN platform from Broadcom a year ago and has been promising new technologies that expand the platform. ETM also could further the vendor’s stated plans to expand beyond its data center networking roots https://www.networkworld.com/article/4111354/arista-rides-ai-wave-but-battle-for-campus-networks-looms.html and compete more broadly with enterprise networking vendors such as Cisco, Palo Alto Networks, and Fortinet. In the SASE and SD-WAN world, vendors such as Cisco, Palo Alto, Fortinet, Cato Networks, and Versa Networks are among the most balanced suppliers, with both SD-WAN and SSE contributing meaningful revenue streams, according to a recently published report https://www.delloro.com/news/sase-1q-2026-revenue-climbs-21-percent-to-over-3-b-driven-by-ai-governance/ from Dell’Oro Group. “We forecast that SASE will remain on a double-digit growth path in 2026, with SSE-first rollouts remaining the most common entry point, and SD-WAN supported by branch modernization, software attach, and branch security refresh,” Dell Oro stated. “AI is changing the SASE discussion from access and inspection to governance, data protection, and control over agents and machine traffic,” Mauricio Sanchez, senior director, enterprise security and networking at Dell’Oro Group, stated in the report. “A 21 percent Y/Y quarter shows that SASE is not waiting for a future AI refresh cycle; it is already absorbing the early security and networking requirements created by AI adoption,” Sanchez added. ETM for VeloCloud SD-WAN will be available in Q4 of 2026 and will be available for all current VeloCloud hardware and virtual edge platforms.