SASE Part 1 — A Vendor-Neutral Reference
SASE is one of the most marketed terms in cybersecurity, and one of the most misunderstood. Every network and security vendor has a SASE story, but the definitions shift depending on who is selling. This post strips away the vendor positioning and explains what SASE actually is, what its components do, and when the architecture makes sense.
What Is SASE?
Secure Access Service Edge (SASE), pronounced "sassy," is a category defined by Gartner in 2019. It describes the convergence of wide-area networking and network security into a single, cloud-delivered service model. SASE is not a product — it is an architecture made up of five core components delivered as cloud services:
- SD-WAN (Software-Defined Wide Area Network) — Intelligent traffic routing across multiple connection types (MPLS, broadband, LTE). Replaces or augments traditional WAN with application-aware path selection.
- SWG (Secure Web Gateway) — Inspects and filters outbound web traffic. Enforces acceptable use policies, blocks malicious URLs, and provides SSL/TLS inspection.
- CASB (Cloud Access Security Broker) — Provides visibility and control over SaaS application usage. Enforces data loss prevention policies and detects shadow IT.
- NGFW (Next-Generation Firewall) — Cloud-delivered firewall with application awareness, intrusion prevention, and threat intelligence integration.
- ZTNA (Zero Trust Network Access) — Replaces traditional VPN by granting per-application access based on identity, device posture, and context. Users never sit on the network.
What Is SSE?
Security Service Edge (SSE) is a subset of SASE that includes only the security components — SWG, CASB, and ZTNA — without SD-WAN. SSE is the right category when an organization needs cloud-delivered security but already has a WAN strategy in place or does not need SD-WAN functionality.
Think of it simply: SASE = SSE + SD-WAN.
Five Benefits of SASE
- Reduced complexity. Instead of managing separate point products for firewalling, web filtering, VPN, and WAN optimization, a single platform handles all of it. Fewer consoles, fewer vendors, fewer integration headaches.
- Consistent policy enforcement. Security policies follow the user regardless of location. Whether someone is in the office, at home, or in a coffee shop, the same inspection and access controls apply.
- Improved performance. Traffic is routed through the nearest cloud point of presence rather than backhauled to a central data center. This reduces latency for SaaS applications and improves user experience.
- Scalability. Adding users or locations does not require shipping hardware. Cloud-delivered services scale elastically with demand.
- Better visibility. A converged platform provides a single pane of glass across network and security telemetry, making it easier to detect anomalies and investigate incidents.
Vendor Categorization by Management Approach
Not all SASE vendors deliver the same experience. One useful way to categorize them is by how they expect the platform to be managed:
| Approach | Description | Best For |
|---|---|---|
| Self-Managed | The organization deploys, configures, tunes, and operates the platform with its own staff. The vendor provides the technology and support, but day-to-day operations are internal. | Organizations with mature IT/security teams who want full control and have the headcount to manage the platform. |
| Managed / Co-Managed | A third party (MSSP, partner, or the vendor itself) handles some or all of the deployment, policy management, monitoring, and optimization. The organization retains strategic control. | Organizations with lean IT teams, limited security expertise, or those who want to accelerate time-to-value without hiring. |
When to Consider SASE
SASE is not right for every organization. It makes the most sense when:
- You have a distributed workforce — remote, hybrid, or multi-site — and need consistent security regardless of location.
- Your current stack is a patchwork of point products with overlapping functionality and management overhead.
- You are experiencing performance problems from backhauling traffic through a central data center for inspection.
- Your VPN infrastructure is aging, difficult to scale, or provides overly broad network access.
- You are undergoing a cloud migration and need security controls that are native to cloud-delivered applications.
If your organization is entirely on-premises with no remote users and no SaaS adoption, SASE solves a problem you do not have. Start with the problem, not the category.