What is SASE?

Secure Access Service Edge (SASE) is an architecture that converges wide-area networking (SD-WAN) and network security services – secure web gateway, cloud access security broker, Zero Trust network access, firewall-as-a-service, and data loss prevention – into a single, cloud-delivered service enforced close to the user, wherever the user is.

Key takeaways

• SASE merges SD-WAN networking and cloud security into one converged service.
• Policy follows the user and device, not the office perimeter.
• Enforcement happens at distributed cloud points of presence near users.
• A single-vendor SASE platform avoids stitching together point products.
• Gartner coined the term in 2019; it now anchors most network-security roadmaps.

On this page: Why it matters · How it works · Types · SASE & Versa · FAQ

Why is SASE important?

Applications moved to the cloud and users moved everywhere, but traditional security stayed in the data center – forcing traffic to hairpin through a central firewall stack that adds latency and cost. SASE matters because it moves enforcement to where users and applications actually are: distributed cloud points of presence that apply the same policy whether someone works from headquarters, a branch, or a kitchen table.

For network and security teams, the payoff is consolidation. Instead of separately buying, integrating, and operating SD-WAN appliances, web proxies, VPN concentrators, CASB, and DLP tools, a SASE platform delivers them as one service with one policy model and one management plane. That reduces the appliance sprawl and policy drift that cause both outages and breaches, and it shortens the path to Zero Trust: identity- and context-aware access decisions applied continuously, on every connection.

What is SASE?

SASE combines two halves. The networking half is SD-WAN: intelligent path selection across broadband, MPLS, and LTE/5G, application-aware routing, and an encrypted overlay between sites, clouds, and users. The security half is Security Service Edge (SSE): secure web gateway (SWG) for web traffic, cloud access security broker (CASB) for SaaS control, Zero Trust network access (ZTNA) for private applications, data loss prevention (DLP), and firewall-as-a-service.

What makes it SASE rather than a bundle is convergence: both halves share one policy engine, one identity context, and one enforcement fabric. Traffic from any user or site enters the nearest point of presence, is inspected and policy-checked once, and exits toward the application – no backhaul to a data-center choke point.

Types of SASE

Deployments fall into three broad patterns. Single-vendor SASE delivers the networking and security halves from one platform with a unified console and policy model – the model analysts increasingly recommend, and the one that captures most of the operational savings. Multi-vendor (dual-vendor) SASE pairs one vendor’s SD-WAN with another’s SSE; it preserves existing investments at the cost of two policy models and an integration seam. SSE-only adopts the security half first – SWG, CASB, ZTNA from the cloud – and adds SD-WAN later, a common on-ramp for security-led organizations.

SASE & Versa

Versa delivers single-vendor SASE through VersaONE, a platform that runs networking and security in one software stack (VOS) under one management plane. The Versa SASE fabric provides the cloud-delivered security services – SWG, CASB, ZTNA, DLP, and next-generation firewall – while Versa Secure SD-WAN provides the connectivity fabric, with both governed by a single policy engine. Remote users connect through the Versa SASE Client, and the whole estate is managed through Versa Concerto or Versa Director. See the platform overview for how the pieces fit together.

Frequently asked questions

What is the difference between SASE and SD-WAN?

SD-WAN is the networking half of SASE: it steers traffic intelligently across multiple links. SASE adds the security half – SWG, CASB, ZTNA, DLP, firewalling – delivered from the cloud and converged with the network, so one service handles both connectivity and protection.

What is the difference between SASE and SSE?

SSE (Security Service Edge) is the security-only subset of SASE: SWG, CASB, ZTNA, and related services without the SD-WAN. Organizations often adopt SSE first and add SD-WAN later to complete the SASE architecture.

Does SASE replace VPNs?

Largely, yes. ZTNA – a core SASE service – replaces broad network-level VPN access with per-application, least-privilege access that continuously verifies identity and device posture, which removes the lateral-movement risk a flat VPN creates.

Is SASE cloud-only?

Enforcement is cloud-delivered, but SASE architectures still include on-premises elements: SD-WAN edge devices at sites, and in some designs on-premises enforcement for traffic that never leaves the campus. The defining trait is unified policy across all of it.

How does SASE support Zero Trust?

SASE operationalizes Zero Trust: every connection is evaluated against identity, device posture, and context before access is granted, and the evaluation is continuous rather than one-time. ZTNA within SASE applies least-privilege access per application instead of per network.

More on SASE

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about SASE, these are worth looking at next.