SSE

How it works

SSE (Security Service Edge) is the security-only half of SASE, a category Gartner carved out in 2021 for teams that need cloud-delivered security without also replacing their SD-WAN. It bundles ZTNA for private app access, a secure web gateway (SWG) for internet-bound traffic, a cloud access security broker (CASB) for SaaS visibility and control, and DLP, all enforced at the vendor's edge points-of-presence instead of on-prem appliances. Traffic from every user and branch gets steered through that edge, so one policy engine, not five consoles, decides what's allowed. Zscaler (Zscaler Internet Access/Private Access), Netskope, and Palo Alto Networks all sell SSE as a standalone product.

When it matters

SSE matters when the WAN itself is fine (existing SD-WAN, MPLS, or direct internet breakout already works) but the security stack is a pile of unconnected point products: a VPN concentrator for remote access, a separate proxy for web filtering, and no real visibility into shadow SaaS. Buying SSE alone avoids the multi-year WAN re-architecture that full SASE implies. Skip it and remote users keep tunneling through a flat-trust VPN, which is the exact failure mode ZTNA exists to close.

Common misconceptions

• "SSE is a smaller version of [SASE](/glossary/sase/)." It's not smaller in ambition, it's narrower in scope: all the security capability of SASE, none of the SD-WAN networking layer.
• "You need SASE eventually, so start with SSE and add networking later." Plenty of large enterprises run SSE indefinitely alongside a WAN they have no plan to replace; SSE is a valid end state, not just a stepping stone.
• "SSE replaces the VPN entirely on day one." Most rollouts run ZTNA and VPN in parallel for months while apps are migrated app-by-app; a flash cutover breaks things.