In short
SASE for hybrid working applies one access and web security policy to every member of staff, whether they are at home, in the office or travelling, without sending traffic back through an office VPN. UK organisations usually start with one group of hybrid staff, then extend to contractors and personal devices. Subscriptions can be billed monthly, terms confirmed at quote.
Get a quote for SASE for hybrid working
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
Why hybrid working strains the old model
Hybrid working splits each person's week between home broadband, the office network and whatever connection is to hand when travelling. The traditional set-up was built for the office: a firewall at the edge, a VPN for the occasional remote worker, and web filtering that works only when traffic passes through the office.
That leaves three gaps. Laptops at home may have no web filtering at all, or send every request back to the office first. Once connected, VPN users can usually reach far more of the network than their job needs. And contractors or staff on personal devices are either given a full VPN or left to work around it.
SASE closes those gaps by moving the policy to the cloud and to the device, so it travels with the person. The NCSC's ZTNA anti-patterns (opens in a new tab) are a useful warning: replacing a VPN with SASE while keeping broad network access recreates the "walled garden" problem. The gain comes from per-application access, not just a new tunnel.
Advantages of SASE for hybrid workforce security
- The same policy everywhere. Web filtering, DNS security and firewall rules apply at home, in the office and on public Wi-Fi, from one console.
- Access to applications, not networks. ZTNA connects each person to the applications their role needs, which limits what an attacker can reach from a compromised laptop.
- No VPN backhaul. Internet and SaaS traffic is inspected by the SASE platform or on the device, rather than hairpinning through the office line.
- Device checks before access. Most platforms can check device posture, such as whether the device is managed or up to date, before allowing a connection.
- Safer access for unmanaged devices. Agentless access and enterprise browsers (opens in a new tab) let contractors and staff on personal devices reach approved applications without a full network connection.
- Simpler joiners and leavers. Access follows the identity provider, so removing an account removes access everywhere.
These advantages depend on design choices. The NCSC's guidance on deciding whether to tunnel internet traffic (opens in a new tab) notes that tunnelling all traffic "should not be treated as a default design choice": it suits outcomes such as advanced content filtering or consistent policy enforcement, and should follow your threat model. We help you decide which traffic goes through the SASE platform and which is protected on the device. More on the security model is on SASE security and SASE benefits.
Hybrid working scenarios and how SASE handles them
| Scenario | Typical risk | How SASE helps | Platform examples |
|---|---|---|---|
| Working from home broadband | Shared home network, no web filtering, VPN backhaul slows SaaS | Agent applies web and DNS filtering and firewall rules on the home line; ZTNA reaches office applications directly | Timus, Todyl, Check Point SASE (opens in a new tab), Cisco Secure Access (opens in a new tab) |
| In the office on Wi-Fi | Being on the office network is treated as trusted | The same per-application policy applies on site, so location is not a trust signal | Cisco SASE with universal ZTNA, Barracuda SecureEdge, Check Point SASE |
| Travelling and public Wi-Fi | Untrusted hotspots and captive portals | Always-on agent connects to the nearest point of presence and filters traffic before it reaches the internet | Timus, Todyl, Exium, Check Point SASE |
| Contractors and third parties | A full VPN account gives far more access than the contract needs | Agentless ZTNA or an enterprise browser grants access to named applications only, with a time limit | Check Point SASE (Agentless ZTNA, Enterprise Browser), Island |
| BYOD with an enterprise browser | Company data on a personal device the organisation does not manage | A managed browser keeps work inside controlled sessions, with copy, download and upload controls | Island Enterprise Browser, Sophos Protected Browser, Check Point Enterprise Browser |
Platform examples come from each vendor's own site, checked 9 November 2026: Check Point SASE (opens in a new tab) lists Agentless ZTNA and an Enterprise Browser and says Private Access accommodates "any employee, third party or branch office"; Island (opens in a new tab) offers solutions for third-party contractors and BYOD alongside its Enterprise Browser; Sophos Workspace Protection (opens in a new tab) includes Sophos Protected Browser and Sophos ZTNA; Timus (opens in a new tab) and Todyl (opens in a new tab) connect devices through an agent to cloud gateways. Our vendor pages cover each in more detail, starting from SASE vendors.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
SASE vs a VPN for hybrid staff
A remote access VPN suits a few people reaching one office. Hybrid working stretches it: every home worker becomes a remote user part of the week, and SaaS traffic that never needed the office still goes through it. SASE replaces the VPN with ZTNA for private applications and cloud or on-device inspection for internet traffic. SASE vs VPN compares the two in detail, and ztna.org.uk covers the zero trust side of secure remote access (opens in a new tab), including remote desktop access.
Rolling SASE out to a hybrid workforce
- Map how people work. Which applications each group uses, from where, and on which devices; which suppliers allowlist your office IP.
- Check identity and devices. The NCSC's prerequisites (opens in a new tab) include an authoritative identity provider, phishing-resistant authentication such as FIDO2, and centralised device management.
- Pilot with one group. Hybrid staff in one team are a good start: deploy the agent, build access and filtering policy, and keep the VPN as a fallback for a short period.
- Add contractors and personal devices. Move third parties to agentless access or an enterprise browser, scoped to the applications they need.
- Close the old routes. Retire VPN accounts and open ports once each group has moved, so nothing bypasses the new policy.
The full phased plan is on SASE implementation. If your organisation is working towards Cyber Essentials, our sister site explains how its BYOD and home working (opens in a new tab) rules apply.
Is SASE for hybrid working the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How Forever Systems helps
We supply several SASE and Security Service Edge (SSE) platforms, so we can match one to the way your people work rather than the other way round. We can assess your current VPN and web filtering, run a pilot with one hybrid team, and then roll out access policy, browser controls for contractors and personal devices, and filtering for everyone. Scope and timescales are confirmed at quote, and subscriptions can be billed monthly, terms confirmed at quote. Contact us to talk about SASE for hybrid working.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What are the advantages of SASE for hybrid working?
The same security policy applies at home, in the office and on the move; staff reach individual applications rather than the whole network; internet traffic no longer has to go back through the office VPN; and contractors and personal devices can be given narrow, browser-based access.
Does SASE replace the VPN for hybrid workers?
Usually, yes. ZTNA replaces VPN access to private applications, and the SASE platform or device agent filters internet traffic. Some legacy applications may need a narrow route for a while; we plan that during the pilot.
How does SASE handle personal devices (BYOD)?
Most platforms offer agentless access or an enterprise browser for devices you do not manage. Island Enterprise Browser, Sophos Protected Browser and Check Point's Enterprise Browser keep work inside a controlled browser session, so company data can be protected on a personal device.
Should all hybrid workers' internet traffic go through the SASE cloud?
Not necessarily. The NCSC says tunnelling all internet traffic should not be a default design choice; it suits outcomes such as content filtering and consistent policy. Some platforms protect traffic on the device instead. We help you decide per group and per type of traffic.
Is SASE only for large organisations with hybrid staff?
No. Platforms such as Timus, Todyl and Exium are sold as per-user or as-a-service subscriptions and suit small teams. See SASE for small business for the options.
Still have a question about SASE for hybrid working?
Ask us and a member of our team will get back to you.