A company with 1,200 employees moved email, files and its CRM to SaaS, sent most staff home three days a week, and kept its security stack in one data center. Every remote user's web traffic now travels through a VPN to headquarters for filtering and then back out to the internet, the VPN concentrator runs at 95 percent on Monday mornings, and users who turn the VPN off to make video calls bypass inspection entirely. The controls themselves work; they are just in the wrong place.
Security Service Edge (SSE) moves those controls into the cloud, close to wherever the user is. On the CompTIA Security+ SY0-801 exam, SSE sits under objective 3.2, which presents scenarios and expects you to manage the security architecture. This lesson covers what SSE is, its main components (the secure web gateway, cloud access security broker, zero trust network access and firewall as a service), how SSE relates to SASE and SD-WAN, and how to pick the right component from a scenario.
SSE delivers the security stack from the cloud, close to every user
SSE is a set of security services that a provider runs from points of presence (PoPs) around the world. A user's traffic goes to the nearest PoP, is inspected there under the organization's policy, and continues to its destination: a website, a SaaS application or a private application in the company's own data center. Because inspection happens near the user, there's no need to send traffic back to headquarters, and the same policy applies at home, in a branch and in an airport.
Traffic reaches the service in a few ways:
- An endpoint agent on managed laptops and phones, which forwards traffic and also reports device posture.
- IPsec or GRE tunnels from branch routers or firewalls, which cover every device at a site, including printers and phones that can't run an agent.
- Proxy settings or a PAC file, for browsers on systems where an agent isn't possible.
- A browser-based portal for unmanaged devices that need a few web applications.
Gartner, the analyst firm that coined the term in 2021, defines SSE around three core services: a secure web gateway, a cloud access security broker and zero trust network access. Most products add firewall as a service, data loss prevention, remote browser isolation and sandboxing, and vendors package and name these pieces differently. For the exam, know what each component does and which problem it solves; the exact boundary of what a given vendor calls SSE matters less.
A secure web gateway inspects web traffic wherever the user is
A secure web gateway (SWG) is a forward proxy for web traffic. It applies the organization's acceptable use and threat policy to every web request: blocking categories such as malware, phishing, newly registered domains or gambling, scanning downloads, detonating unknown files in a sandbox, and applying DLP rules to uploads. An on-premises web proxy does the same job for users inside the building; a cloud SWG does it for everyone.
Most web traffic is encrypted, so a gateway that can't decrypt sees little more than domain names. Full inspection uses TLS interception: the gateway terminates the user's TLS session, inspects the content and opens its own session to the site. Devices accept the gateway's certificates because the organization deploys the gateway's root CA certificate to them. Organizations normally exempt categories such as banking and healthcare for privacy and legal reasons, and applications that pin their certificates must bypass inspection or they break.
A gateway log entry shows the policy at work:
2026-10-21T14:03:12Z user=rgarcia device=LT-3307 pop=dfw1 action=block
host=files-share.example.net method=POST category=personal-storage
rule="Block uploads to unsanctioned storage" dlp_match=US-SSN count=14
On the exam, a requirement to filter or log web access for remote users without routing their traffic through the VPN points to a cloud SWG.