What is SASE?
SASE, short for secure access service edge and pronounced "sassy", is an architecture that delivers wide area networking and network security together as one cloud service. Instead of sending branch and remote-user traffic back to a headquarters data center for inspection, each user or site connects to the provider's nearest point of presence (PoP). The organization's security policy is applied there, and the traffic continues to the internet, a SaaS application or a private data center.
The analyst firm Gartner introduced the term in 2019. In 2021 it gave the security half its own name, security service edge (SSE). The simplest way to remember the relationship is SASE = SD-WAN + SSE.
The parts of SASE
| Component | What it does |
|---|---|
| SD-WAN | Edge devices that use broadband, fiber and cellular links, build encrypted tunnels between sites and steer each application over the best path |
| Secure web gateway (SWG) | Filters and logs web traffic, scans downloads and applies DLP to uploads |
| Cloud access security broker (CASB) | Discovers cloud app use and controls data inside sanctioned SaaS services |
| Zero trust network access (ZTNA) | Connects users to individual private applications after identity and device checks |
| Firewall as a service (FWaaS) | Next-generation firewall rules for all ports and protocols, run in the provider's cloud |
Vendors package these differently and often add remote browser isolation, sandboxing and DNS filtering. Some organizations buy everything from one vendor; others pair an SD-WAN vendor with a separate SSE provider.
Example: replacing MPLS circuits and branch firewalls
A retailer has 150 stores, each with an MPLS circuit back to headquarters and its own firewall appliance with slightly different rules and firmware. Remote staff use a VPN that hairpins their web traffic through headquarters before it goes back out to the internet. With SASE, each store gets a small SD-WAN edge device on two inexpensive internet links. The device builds tunnels to the nearest PoP, where one policy filters web traffic, enforces firewall rules and controls SaaS use. Remote staff run an agent that connects to the same PoPs, so they get the same inspection at home without a VPN to headquarters. The security team writes policy once instead of 150 times.
Benefits and risks
- Benefits: consistent policy for every user and site, less backhauled traffic, fewer appliances to patch, and inspection that follows users wherever they work.
- Provider dependence: branch internet access and inspection depend on the provider's availability and on the tunnels or agents that reach it. Decide in advance whether agents fail open, letting traffic flow uninspected, or fail closed, blocking it.
- Visibility into your traffic: the provider decrypts and inspects much of the organization's traffic, so vendor due diligence, contract terms and TLS inspection exemptions for categories such as banking and healthcare are part of the design.
- Migration: most organizations run SASE beside existing appliances for a while before retiring them.
SASE vs. SSE vs. SD-WAN
SD-WAN is networking: it connects sites and steers traffic, and threat inspection is not its main job, even when a product adds basic firewall features. SSE is the cloud-delivered security stack (SWG, CASB, ZTNA and usually FWaaS) without the WAN. SASE is both. If a scenario only needs to secure remote users and SaaS access, SSE fits. If it also replaces branch routers and private circuits, SASE fits. A remote access VPN concentrator is the older on-premises approach that SSE and SASE usually replace for remote users.
SASE on the CompTIA Security+ exam
SY0-801 objective 3.2, which covers making architecture decisions that protect the infrastructure, names security service edge rather than SASE, so questions are more likely to ask about SSE and its components. Know SASE as the broader term for scenarios that include the network itself: wording such as "replace MPLS circuits and branch firewalls with one cloud service" or "combine WAN connectivity and security inspection" points to SASE. The usual distractors are SSE (security without the WAN), SD-WAN (networking without the security stack), a single component such as a CASB or secure web gateway, and a site-to-site VPN.