| Primary control location | Management systems and control functions remain in the organization’s facilities. | Centralized management is delivered through a hosted service, while local devices continue forwarding traffic. | Critical control functions stay local, with selected analytics or management services hosted remotely. | Choose according to data-residency rules, operational skills, and acceptable dependence on external connectivity. |
| Typical deployment time | Usually longer because hardware installation, configuration, and local integration are required. | Usually faster for standardized sites because policies and templates can be applied centrally. | Moderate; the timeline depends on how many functions are split between local and hosted environments. | Use cloud-managed deployment for repeatable branches and on-premises deployment for highly customized environments. |
| Capital expenditure | Higher initial spending for equipment, spare capacity, installation, and lifecycle planning. | Lower initial hardware investment, but recurring service fees apply. | Combines upfront equipment costs with recurring hosted-service costs. | Compare five-year total cost rather than purchase price alone. |
| Operating expenditure | Internal teams manage upgrades, monitoring, backups, and replacement planning. | The service provider maintains the management platform; the customer still manages policies and local connectivity. | Responsibilities are divided between internal teams and the hosted-service provider. | Select the model that matches available engineering capacity and automation maturity. |
| Licensing structure | May include perpetual software rights, device subscriptions, or separate feature licenses. | Commonly uses term-based subscriptions linked to devices, users, sites, bandwidth, or enabled functions. | May combine device entitlements with subscriptions for centralized management and advanced services. | Confirm renewal dates, automatic renewal terms, transfer rights, and what happens after expiration. |
| Scalability | Scaling requires additional capacity planning, equipment, power, rack space, and configuration work. | New sites and policies can generally be added through centralized workflows and reusable templates. | Supports gradual migration while preserving local control for selected workloads. | Estimate growth in sites, endpoints, traffic, encryption sessions, and management objects for at least five years. |
| Resilience requirements | Can operate with local management and redundant power, links, and control components. | Requires reliable access to the hosted management service for administration and policy changes. | Can maintain local operations during temporary loss of access to hosted management, depending on design. | Define behavior during management-plane outages before approving the architecture. |
| Security and compliance | Provides direct control over data paths, administrative access, logging, and system placement. | Requires review of provider security controls, encryption, identity integration, and data-processing locations. | Allows sensitive functions to remain local while using hosted capabilities for selected operations. | Map requirements to recognized controls such as access management, encryption, audit logging, and data retention. |
| Support coverage | May include business-hours, 24×7, replacement, software-update, and professional-services options. | Support typically covers the hosted platform and may require separate coverage for local devices and access circuits. | Requires coordinated support for both local infrastructure and hosted management services. | Check response targets, escalation paths, replacement logistics, service exclusions, and regional availability. |
| Best-fit environment | Data centers, regulated facilities, high-customization networks, and sites with strong local IT teams. | Distributed branches, standardized deployments, lean IT teams, and organizations prioritizing centralized operations. | Enterprises transitioning gradually to hosted operations or combining regulated and flexible workloads. | Use workload segmentation rather than forcing every site or application into one deployment model. |