SASE

How it works

SASE (Secure Access Service Edge), a term Gartner coined in 2019, bundles wide-area networking and network security into a single cloud-delivered service instead of routing traffic through a physical datacenter. The networking half is SD-WAN: it picks the best path (broadband, LTE, MPLS) for each packet. The security half is SSE: ZTNA, a secure web gateway (SWG), a cloud access security broker (CASB), and DLP, all enforced at edge points-of-presence close to the user rather than backhauled to HQ. Vendors selling a full SASE stack include Cloudflare, Palo Alto Networks (Prisma SASE), and Cato Networks.

When it matters

SASE matters once a company has enough remote and branch-office traffic that backhauling everything through a central firewall adds real latency, and once the WAN contracts are up for renewal anyway. Ripping out SD-WAN and security appliances mid-contract to adopt SASE rarely pencils out; the honest trigger is a hardware refresh or MPLS renewal cycle, not a security mandate on its own. Skip it and you keep paying for both the old WAN and a growing pile of point security products that don't share policy or logs.

Common misconceptions

• "SASE is a product." It is an architecture pattern. No single box does it; you buy it as a managed cloud service from one vendor or stitch together SD-WAN plus SSE from two.
• "SASE and [SSE](/glossary/sse/) are interchangeable." SSE is the security-only half of SASE. Gartner split it out in 2021 specifically for teams that want the ZTNA/SWG/CASB stack without replacing their existing WAN.
• "SASE replaces [zero-trust](/glossary/zero-trust/)." SASE is a delivery model that can enforce zero-trust policy; it isn't the policy itself. You still have to define who gets access to what.