In short
SASE joins SD-WAN and cloud security, the Security Service Edge (SSE) of secure web gateway, CASB, ZTNA and firewall as a service, under one policy for offices and remote staff. Cisco licenses Secure Access per user, or per site by bandwidth in Secure Internet Access Essentials. Forever Systems supplies several platforms and can quote and set one up.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What a SASE solution combines
SASE (secure access service edge) brings two things together that most organisations have bought separately: the network that connects offices, and the security that checks what people do on it. Check Point describes SASE (opens in a new tab) as "a unified, cloud-based architecture that merges networking and security functions".
Instead of sending everyone's traffic back to a head-office firewall, a SASE solution applies policy in the provider's cloud, close to the user or site, and gives you one place to manage it.
| Component | What it does | Covers |
|---|---|---|
| SD-WAN | Chooses the best path for each site's traffic across broadband, leased line (opens in a new tab) and mobile links, with failover | Offices and branches |
| Secure web gateway (SWG) | Filters web traffic, blocks malicious sites and scans downloads | Staff on any network |
| Cloud access security broker (CASB) | Finds and controls SaaS use, inline or through API connections | SaaS and AI apps |
| Zero trust network access (ZTNA) | Per-application access to private apps after identity and device checks | Private apps in your data centre or cloud |
| Firewall as a service (FWaaS) | Network firewall policy applied in the provider's cloud | Site and user traffic |
| Data loss prevention (DLP) | Stops sensitive data leaving through web, SaaS and AI tools | Data, by licence tier |
The security components together are called the Security Service Edge (SSE). The networking half is SD-WAN. How they fit is covered on SASE architecture, and the plain-English definition is on what is SASE?
Vendors we supply
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
SASE or Security Service Edge (SSE) first?
Not every organisation needs both halves on day one. The right first step depends on where the pain is.
| Your situation | Usual starting point | Why |
|---|---|---|
| Mostly hybrid or remote staff, apps in SaaS, one or two offices | Security Service Edge (SSE) | People are the perimeter; office networking is not the problem |
| A remote access VPN is the main headache | Security Service Edge (SSE), with ZTNA first | Private access and web protection replace the VPN and the backhaul |
| Several branches on MPLS or ageing routers, renewals due | Full SASE | SD-WAN and security can be replaced and managed together |
| Branches already on an SD-WAN you want to keep | Security Service Edge (SSE) joined to your SD-WAN | Keep the WAN investment and tunnel sites into the security cloud |
Starting with Security Service Edge (SSE) and adding SD-WAN at the next router or WAN refresh is a common route. The detail is on SASE vs Security Service Edge (SSE) and SASE vs SD-WAN.
SASE platforms and products we supply
We supply SASE and Security Service Edge (SSE) products from several vendors, so the recommendation follows your sites, people and existing kit. Listed A to Z within each group; each page has the vendor's own facts and links.
- Barracuda SecureEdge: Barracuda describes SecureEdge (opens in a new tab) as a SASE platform with ZTNA, firewall as a service, web security and Secure SD-WAN, with inspection in the cloud, at the branch or on the device.
- Check Point SASE: formerly Harmony SASE (opens in a new tab); Check Point lists Internet Access, Private Access, SaaS Security, GenAI Security and Secure SD-WAN (opens in a new tab) in one platform.
- Cisco SASE: Cisco Secure Access (opens in a new tab), Cisco's Security Service Edge (SSE), joined to Cisco SD-WAN or Meraki SD-WAN.
- HPE Aruba Networking SASE: HPE Networking (opens in a new tab) Security Service Edge (SSE), formerly HPE Aruba Networking, with HPE Networking EdgeConnect SD-WAN, plus Juniper Secure Edge from HPE Juniper Networking.
- Sophos SASE: how Sophos secure access products fit a SASE design.
- WatchGuard SASE: WatchGuard's FireCloud family (opens in a new tab) of SASE services, managed in WatchGuard Cloud.
For MSP-style platforms that bundle SASE with other security services:
- Exium SASE: Exium, now part of NETGEAR (opens in a new tab), offers SASE Essentials, SASE Pro and the Cyber Gateway.
- Timus SASE: Timus lists a secure web gateway, ZTNA and cloud firewall as a service (opens in a new tab).
- Todyl SASE: a managed SASE platform (opens in a new tab) built for service providers.
Comparing with platforms such as Zscaler or Palo Alto Networks Prisma SASE? Our factual Zscaler SASE and Palo Alto SASE comparisons and the SASE vendors overview set them side by side with the SASE products we supply.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Choose SASE services by size and sector
The same platform can be set up very differently for a 40-person firm and a multi-academy trust. Our guides cover the questions each type of organisation tends to ask.
- SASE for small business: Security Service Edge (SSE) or SASE without a large IT team.
- SASE for hybrid working: one policy for the office, home broadband and travel.
- SASE for the NHS: SASE alongside HSCN and NHS access requirements.
- Public sector SASE: councils and central government bodies.
- SASE for schools: filtering, staff remote access and multi-site trusts.
How we help with a SASE service
A SASE service from us starts with what you already run, not with a product.
- Assess: we look at your remote access VPN, firewalls, WAN links and contracts, identity set-up and the applications people need to reach.
- Recommend: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, with the components and licence tier that match your needs.
- Pilot: where the vendor offers a trial, we can set up a pilot with one group of users or one site, so you see it working on your own apps.
- Roll out in phases: users, then sites, then retiring old access routes, so the change can be made in stages.
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote.
The NCSC's ZTNA guidance recommends testing products through trials or proof-of-concept deployments (opens in a new tab) that reflect your own users, devices and applications before committing, which is why we suggest a pilot. If you would rather hand day-to-day running to us, see managed SASE. Contact us to talk it through.
SASE solutions in the UK: what to check before you buy
| Check | Why it matters |
|---|---|
| Licence unit (per user, per site or bandwidth) | Cisco, for example, offers user-based and bandwidth-based site licensing for Secure Access, and many buyers mix the two |
| Points of presence near your users | Policy is applied where traffic enters the provider's cloud, so check the locations the vendor lists for the UK |
| Identity provider and device management | Access decisions rely on identity and device signals, so the platform must work with what you run |
| Existing firewall and SD-WAN | Some platforms run alongside your current kit; others replace it |
| Logs and integration | The NCSC advises understanding what logs are available and how incidents involving the service are handled |
| Data handling | Ask where traffic is inspected and logs are stored, especially if you plan TLS inspection |
These points are covered in more depth on how to choose SASE and SASE implementation.
Explore SASE: guides, vendors and providers
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
Is SASE a product or an architecture?
Both, depending on who is talking. SASE started as a way of describing an architecture: networking and security delivered together from the cloud. Vendors now sell SASE platforms that deliver that architecture, either from one vendor or by joining a Security Service Edge (SSE) to an SD-WAN from another.
Can we keep our firewall with SASE?
Often, yes. Barracuda, for example, says SecureEdge can be rolled out as SD-WAN alongside existing firewalls or as secure SD-WAN replacing them, and Cisco Secure Access (opens in a new tab) can enforce ZTNA locally on existing Cisco firewalls. We check what your current firewall can do before recommending a change.
Is SASE a type of SaaS?
No. SaaS is software you use, such as email or file sharing. SASE is networking and security delivered as a cloud service, and one of its jobs is controlling SaaS use through CASB. See what is SASE? for more.
How are SASE solutions licensed?
Usually per user for the security services, with per-site or bandwidth-based licences for branches and SD-WAN appliances. Editions add features such as DLP or browser isolation. Ask us for a quote based on your users, sites and components.
Can a small business use SASE?
Yes. Several platforms we supply, such as Timus, Todyl and Exium, are built to be delivered by a service provider to smaller organisations. Our SASE for small business guide explains the options.
Still have a question about a SASE platform?
Ask us and a member of our team will get back to you.