A few years ago, most staff worked in an office, apps lived in a data centre, and a firewall at the edge protected everything. Today people work from home, apps run in the cloud, and that old “castle and moat” model struggles to keep up.
Secure Access Service Edge (SASE), pronounced “sassy”, is the architecture designed for this new reality. In this guide I’ll explain what SASE is, its building blocks, how traffic flows through it, and how small and mid-sized businesses can adopt it step by step.
What is SASE?
SASE is a cloud-delivered architecture that combines networking (SD-WAN) and security services into one service with one set of policies. The term was introduced by Gartner in 2019.
Instead of sending all traffic back to a central office or data centre to be checked, SASE checks it at a nearby cloud location (called a point of presence, or PoP), close to the user. Security follows the user wherever they are.
The core components of SASE
SASE brings together five main building blocks:
| Component | What it does |
|---|---|
| SD-WAN (software-defined wide area network) | Routes traffic intelligently across broadband, 4G/5G and MPLS links |
| SWG (secure web gateway) | Filters web traffic and blocks malicious sites and downloads |
| CASB (cloud access security broker) | Gives visibility and control over cloud apps (SaaS) and data in them |
| ZTNA (zero trust network access) | Gives users access to specific apps based on identity, device and context, instead of the whole network |
| FWaaS (firewall as a service) | Delivers firewall protection from the cloud instead of only from hardware boxes |
Many providers also add data loss prevention (DLP), DNS security and threat inspection.
SASE vs SSE: what’s the difference?
You’ll often see a related term: Security Service Edge (SSE).
- SSE is the security part of SASE (SWG, CASB, ZTNA and often FWaaS).
- SASE = SSE + SD-WAN networking.
Many organisations start with SSE (for example to secure remote workers and cloud apps) and add SD-WAN later.
How traffic flows in SASE
- A user opens a cloud app, such as Microsoft 365 or a CRM.
- Their traffic goes to the nearest SASE PoP, not back to head office.
- The service checks identity and device (ZTNA).
- Traffic is inspected by the security stack (SWG, CASB, firewall).
- If allowed by policy, it’s sent securely to the app.
Because traffic doesn’t take a detour through a central data centre, users get lower delay, and IT gets one place to set and see policies.
Identity is the new perimeter
The biggest shift in SASE is that identity replaces the network location as the main control. Decisions are based on:
- Who the user is (through an identity provider such as Microsoft Entra ID or Okta)
- What device they’re using and whether it’s healthy and up to date
- Context, such as location, time and behaviour
This is the heart of zero trust: never trust by default, always verify, and give only the access that’s needed. If you’re thinking about identity tools, my guide to RapidIdentity explains one approach to identity management.
SASE vs traditional network security
| Traditional | SASE | |
|---|---|---|
| Network design | Hub-and-spoke, traffic backhauled to HQ | Cloud-delivered, checked near the user |
| Security | Separate appliances in the data centre | One integrated cloud service |
| Remote access | VPN gives access to the whole network | ZTNA gives access to specific apps |
| Policies | Managed in several tools | One policy framework |
Benefits and challenges
Benefits
- Consistent security for office, home and mobile users
- Less traffic backhauling, so better performance for cloud apps
- Fewer boxes to buy and maintain
- Least-privilege access limits damage if an account is compromised
Challenges
- Migration takes time. Moving from VPN to ZTNA and from old firewalls to cloud policy is usually done in phases.
- Vendor choice. Some vendors offer “single-vendor SASE”; others combine products from different suppliers.
- Skills. Teams need to understand identity, cloud and networking together.
How to start with SASE (a practical path)
- Map your users and apps. Where do people work, and which apps matter most?
- Get identity right first. Use a single identity provider with multi-factor authentication.
- Start with one use case, such as replacing VPN for remote access with ZTNA, or securing web and SaaS traffic with SWG and CASB.
- Add SD-WAN when branch offices or network contracts come up for renewal.
- Review and tighten policies using the visibility the platform gives you.
For smaller businesses, it’s worth starting with the basics in my guide on how small businesses can improve their security.
Frequently asked questions
What does SASE stand for? Secure Access Service Edge.
Is SASE the same as zero trust? No. Zero trust is a security approach. SASE is an architecture that puts zero trust into practice, along with networking.
Does SASE replace VPNs? Often, yes, for remote access. ZTNA within SASE gives users access to specific apps instead of the whole network.
Is SASE only for large enterprises? No. Many providers offer SASE or SSE packages for small and mid-sized businesses.
Related guides on WebTechHelp
- How small businesses can improve their security
- 5 tips on improving online security for your business
- What type of proxy do you need?
Sources
- Cisco: What is SASE (secure access service edge)?
- Cato Networks: SASE as described in Gartner’s Hype Cycle 2019
- TechRadar: SASE vs SSE: what are the differences?