SASE - Secure Access Service Edge

Secure Access Service Edge (SASE)—pronounced "sassy"—is Gartner’s answer to the fundamental architectural question of the cloud era: How do you secure network access when users are everywhere and applications run in the cloud? The traditional approach (VPN → corporate network → Internet) is too slow, too expensive, and too inflexible.

The Problem SASE Solves

Traditional Network Architecture (Hub-and-Spoke)

Remote User → VPN → Central Data Center → Internet → Cloud App

Problems:

• Latency: Traffic from Frankfurt → Munich Data Center → Azure Frankfurt (Detour!)
• Bottleneck: All remote users go through a single VPN tunnel
• Complexity: Firewall, VPN, proxy, CASB, SWG as separate systems
• Costs: Multiple management tasks, multiple licenses
• COVID-19 proof: VPN capacity was insufficient for 100% remote work

SASE Architecture (Cloud-Edge Model)

Remote User → Nearest SASE Point of Presence (PoP) → Cloud App directly

Advantages:

• Latency: User connects to nearest SASE PoP (e.g., Frankfurt)
• Cloud Apps directly via PoP (no detour via data center)
• All security functions combined in a single service
• Consistent policy everywhere: office, home office, on the go

SASE Components

1. SD-WAN (Software-Defined Wide Area Network)

• Intelligent WAN connections: combine MPLS, Internet, LTE
• Traffic optimization: which connection for which traffic?
• Zero-touch provisioning for branch locations

2. ZTNA (Zero Trust Network Access)

• Replaces VPN for application access
• No more "everything allowed on the network"
• Least privilege: Users see only the applications they need
• Continuous authentication (not just at login)

3. CASB (Cloud Access Security Broker)

• Visibility and control over cloud apps
• DLP for cloud data
• Shadow IT discovery

4. SWG (Secure Web Gateway)

• Web filtering and security
• Malware inspection (SSL inspection for encrypted traffic)
• URL categorization (block social media, gaming)
• Replaces on-premises web proxy

5. FWaaS (Firewall as a Service)

• Next-generation firewall as a cloud service
• L3-L7 inspection
• Consistent firewall policy for all locations and users

Optional but common

• DNS Security: DNS-based malware protection
• Remote Browser Isolation (RBI): Browser runs in the cloud
• DEM (Digital Experience Monitoring): Measure user experience

SASE vs. SSE (Security Service Edge)

• SSE = SASE without SD-WAN (security functions only)
• SSE: for companies that manage SD-WAN separately
• Trend: SSE often serves as an entry point to SASE

Leading SASE Providers

Netskope

• Strongest CASB and DLP capabilities
• Combines inline CASB and API-CASB
• Good for: data-sensitive industries, GDPR compliance
• SSE focus, SD-WAN integration via partners

Zscaler

• SSE market leader (Gartner Magic Quadrant: Leader)
• Zscaler Internet Access (ZIA): SWG + FWaaS
• Zscaler Private Access (ZPA): ZTNA
• Largest proxy infrastructure (150+ PoPs globally)
• Weakness: no proprietary SD-WAN

Palo Alto Networks Prisma Access

• Complete SASE platform (including SD-WAN via Prisma SD-WAN)
• Strength: deepest security inspection (NGFW quality in the cloud)
• Good for: companies with existing Palo Alto products

Cloudflare One

• Zero Trust platform with robust ZTNA and SWG
• Fastest performance (global anycast network)
• Best value for money
• Weakness: less mature CASB features than Netskope

Cato Networks

• Only "true" SASE provider (SD-WAN + security natively combined)
• Easiest administration
• Good for: Mid-sized businesses that want an all-in-one service

Microsoft (Azure)

• Azure Virtual WAN + Microsoft Entra Private Access (ZTNA) + Defender for Cloud Apps
• Not a complete SASE solution, but good integration for M365 customers

SASE Migration Recommendation

Phase	Action	Value
Phase 1	ZTNA for remote access (VPN replacement)	Immediate value
Phase 2	SWG + CASB (proxy and cloud security)	Centralized policy
Phase 3	FWaaS for branch locations (MPLS replacement)	Cost reduction
Phase 4	SD-WAN integration	Full SASE