What Is SASE? Secure Access Service Edge Explained

Your network used to have a clear edge. Employees sat in an office, apps lived in a data center, and a firewall at the front door decided what got in and out. That picture is gone for most companies. People work from home, coffee shops and client sites. Apps live in Microsoft 365, Salesforce and a dozen other SaaS tools. Traffic that once went through one firewall now goes everywhere.

SASE, short for secure access service edge and pronounced “sassy,” is the industry’s answer to that shift. Gartner introduced the term in 2019 to describe a single cloud service that handles both connectivity and security, wherever the user happens to be. Since then, almost every networking and security vendor has adopted the label, which makes it hard to tell what SASE actually is and whether you need it.

This guide breaks SASE into its parts, compares it with the alternatives and gives you a simple way to decide when consolidating makes sense.

What SASE means in plain English

SASE moves the security checks that used to sit in your office or data center into a provider’s cloud network. Instead of sending remote traffic back to headquarters over a VPN to be inspected, each user, branch or device connects to the nearest provider point of presence. There, one policy engine decides who can reach what, inspects the traffic and logs it.

The key idea is convergence. Networking and security, which were bought and run as separate boxes, become one service with one policy and one console.

Three principles sit underneath:

• Identity first. Access depends on who the user is, what device they are on and how risky the request looks, not on which network they are connected to.
• Cloud delivered. Inspection happens at the provider’s edge locations, close to the user, rather than in a central data center.
• One policy everywhere. The same rules apply whether someone is at a branch, at home or on hotel Wi-Fi.

That identity-first approach is the same thinking behind zero trust security. NIST’s Zero Trust Architecture guidance (SP 800-207, August 2020) describes access decisions based on the identity of users, devices and resources rather than network location. SASE is one common way to deliver that model at scale.

The 5 building blocks of SASE

Vendors package SASE differently, but most definitions include the same 5 components. Cisco, for example, lists SD-WAN, secure web gateway, cloud access security broker, firewall-as-a-service and zero trust network access, tied together by unified policy.

Many SASE services add data loss prevention (DLP), DNS filtering, remote browser isolation and digital experience monitoring on top. Some now also inspect traffic to generative AI tools, which matters if you’re worried about staff pasting company data into chatbots. If you’re weighing that risk, our guide on whether it’s safe to put company data into AI covers the policy side.

Where identity fits

SASE doesn’t replace your identity provider. It relies on it. Your identity and access management system (Microsoft Entra ID, Okta, Google and similar) tells the SASE service who the user is, and single sign-on plus strong MFA make that signal trustworthy. If identity is weak, SASE policies are only as good as a stolen password.

SASE vs SSE vs VPN

You’ll often see SASE mentioned next to SSE, or security service edge. Gartner introduced SSE in 2021 as the security half of SASE: SWG, CASB and ZTNA, usually without SD-WAN. Microsoft, for example, describes its Global Secure Access products (Entra Internet Access and Entra Private Access) as its SSE solution, with an identity-based secure web gateway for internet traffic and ZTNA for private apps.

For a team of 30 people who mostly work from home and use SaaS, SSE often covers what matters. For a company with 15 retail stores, 2 warehouses and a hybrid office staff, full SASE with SD-WAN is where the consolidation payoff shows up.

Key takeaway: SASE is SSE plus networking. If you don’t run branch offices or a wide-area network, you probably need the security half (SSE) more than the full SASE bundle.

Single-vendor or multi-vendor SASE

There are 2 broad ways to build SASE.

Single-vendor SASE means one provider supplies SD-WAN and every security service on one platform. You get one console, one agent and one contract. The trade-off is that you accept that vendor’s strengths and weaknesses across every component.

Multi-vendor (or dual-vendor) SASE pairs an SD-WAN product from one provider with an SSE platform from another, linked by tunnels and shared identity. This lets you keep a networking investment you already like. The trade-off is more integration work and 2 policy engines that need to stay in sync.

Neither approach is automatically better. A useful question is: which part of your current setup is causing the most pain? If it’s branch connectivity, start from the network side. If it’s remote access and SaaS visibility, start from the security side.

When consolidating into SASE makes sense

SASE is a big architectural change. It’s worth it when the old model is clearly costing you. Watch for these signals:

• Your VPN is the bottleneck. Remote users complain about slow connections, or you’re backhauling Microsoft 365 and Zoom traffic through headquarters just to inspect it.
• Your firewall estate is sprawling. You maintain separate appliances at many sites, each with its own rules, firmware and renewal date.
• You have little SaaS visibility. You can’t say which cloud apps employees use or where sensitive files are shared.
• Hardware refresh is coming. Firewall or VPN concentrator renewals are a natural moment to compare a cloud service against another round of boxes.
• Contractors and partners need access. Giving third parties full VPN access is risky, and per-app ZTNA is a cleaner fit.
• Compliance or insurance is pushing you. Auditors and cyber insurance requirements increasingly ask about MFA, remote access controls and logging.

SASE makes less sense when nearly everyone works in a single office, you run few internal apps, or your current firewall and VPN are recent and working well. In those cases, tightening MFA, patching your VPN and adding DNS filtering may give most of the benefit at a fraction of the effort.

What SASE costs

SASE is sold as a subscription, usually per user per year, with extra charges for branch sites, bandwidth tiers or add-ons such as DLP and browser isolation. Bundles and list prices vary widely by vendor and contract, so compare quotes on the same feature set. Remember to factor in what you can retire: hardware firewalls, VPN concentrators, MPLS circuits and the staff time spent maintaining them. Our guide to cybersecurity costs for small businesses explains how to budget for security subscriptions more broadly.

How to start a SASE project

Most organizations phase SASE in over months rather than switching overnight. Here’s a practical order.

1. Map your traffic and apps. List users, sites, private apps and the SaaS tools people actually use. Note where the VPN and firewalls sit today and when their contracts end.
2. Fix identity first. Make sure every user signs in through one identity provider with MFA, ideally phishing-resistant options such as passkeys. SASE policies depend on this.
3. Pick a first use case. Common starting points are replacing the remote-access VPN with ZTNA, or moving web filtering to a cloud SWG. Choose the one tied to your biggest pain.
4. Pilot with one group. Start with IT and a friendly department. Measure login experience, app speed and support tickets.
5. Write policies by role, not by IP address. For example, “finance staff on managed laptops can reach the accounting app,” instead of opening a subnet.
6. Expand to branches. Once remote users are stable, bring sites onto SD-WAN or tunnel them into the SSE platform.
7. Retire old gear on a schedule. Decommission VPN concentrators and redundant appliances only after traffic has moved and logs confirm nothing still depends on them.

If you don’t have in-house network and security staff, a managed IT service provider can run a SASE rollout for you. Ask them which platforms they’re certified on and how they handle policy changes after go-live.

Common SASE mistakes to avoid

• Buying the label, not the features. Ask vendors to show each component working in their own cloud, not just on a slide.
• Ignoring user experience. If the agent slows down video calls, people will look for workarounds. Test from home networks, not just the office.
• Skipping the logs. SASE generates rich traffic data. Send it to your SIEM or at least review the dashboards weekly.
• Leaving the VPN running forever. Running both doubles your attack surface. Set a cut-over date.
• Forgetting devices that can’t run an agent. Printers, cameras and IoT gear at branches still need protection, usually through the site’s SD-WAN or tunnel.

The bottom line

SASE is a way of delivering networking and security as one cloud service, built around identity rather than location. Its 5 core pieces (SD-WAN, SWG, CASB, FWaaS and ZTNA) replace a scattered set of appliances and VPNs. Consolidating makes the most sense for companies with remote staff, several sites and heavy SaaS use, especially when hardware renewals are due. If you’re a smaller, office-based team, start with strong identity and an SSE service, and add networking later if your footprint grows.

Sources

• NIST SP 800-207: Zero Trust Architecture — zero trust principles and identity-based access decisions (August 2020)
• NIST SP 1800-35: Implementing a Zero Trust Architecture — NCCoE practice guide with sample zero trust builds (final June 2025)
• Cisco: What is SASE? — SASE components (SD-WAN, SWG, CASB, FWaaS, ZTNA) and Gartner’s 2019 introduction of the category
• Microsoft Learn: What is Global Secure Access? — example of an SSE product combining a secure web gateway and ZTNA