In short
SASE implementation works best in phases: discover, design policy, pilot, then move internet access, private applications and sites before retiring the VPN. The NCSC's UK guidance warns against deploying SASE as a straight VPN swap that keeps broad network access, so each phase narrows access per application. Timescales are confirmed at quote.
Get a quote for SASE implementation
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
SASE implementation in seven phases
Moving everything at once is rarely necessary. A phased SASE implementation lets each step prove itself before the next:
- Discover. List users, devices, sites, WAN links, applications and data flows, and update your threat model. Record how people reach each application today, including VPN and firewall rules.
- Design policy. Group applications by risk and business criticality, decide who needs what, and write access policy per application rather than per network. Decide deliberately whether to tunnel internet traffic and where TLS inspection is needed.
- Pilot group. Roll the agent or browser access out to a small group with a mix of roles and devices. Test policies before enforcing them, then switch enforcement on.
- Internet access. Move web and SaaS traffic for everyone onto the secure web gateway (opens in a new tab) and CASB controls, with DNS protection and logging in place.
- Private applications. Place connectors beside each private application and publish them one group at a time, so users reach only what they are authorised to use.
- Sites and SD-WAN. Bring offices onto the platform with SD-WAN or IPsec tunnels, site by site, alongside existing WAN contracts where needed.
- Retire the VPN and backhaul. Once every application has moved, remove VPN access, direct routes and static firewall rules that bypass the policy engine, and stop backhauling internet traffic through head office.
The order of phases 4 to 6 can change: an organisation with many small offices may move sites earlier, and one with mainly remote staff may not need SD-WAN at all.
Phase by phase: what each step delivers
| Phase | Main tasks | Done when |
|---|---|---|
| Discover | Inventory of users, devices, sites and applications; data flows; threat model review | You know every route into every application |
| Design policy | Application groups, access policy, internet traffic and inspection decisions | Policy is written down and agreed with the business |
| Pilot group | Agent or browser roll-out, policy testing, recovery tests | The pilot group works normally under enforced policy |
| Internet access | Secure web gateway, CASB, DNS protection, logging | All users' web and SaaS traffic is under policy |
| Private applications | Connectors, application publishing, posture checks | Each private application is reached only through the platform |
| Sites and SD-WAN | SD-WAN or IPsec tunnels, site policy, failover | Each office is on the platform with its WAN links in use |
| Retire VPN and backhaul | Remove legacy routes, firewall rules and VPN licences | No route to an application bypasses the policy engine |
Logs from every phase should reach your SIEM or log store, and the NCSC suggests considering infrastructure as code to define and manage network segments, access rules and dependencies, which makes changes easier to review and roll back.
Not sure which plan fits? Ask us
Tell us what you need and we will recommend the right plan for your organisation, with a quote.
How to deploy SASE in a hybrid cloud
Most organisations implementing SASE have applications in more than one place: on-premises servers, private cloud and infrastructure as a service (IaaS) in a public cloud, plus SaaS. The NCSC's implementation guidance (opens in a new tab) treats them differently:
- Private applications, wherever they are hosted (on-premises, private cloud or private networking in a public cloud) should be reached through an outbound-only connector, proxy or VPN endpoint, deployed close to the applications and scoped narrowly to limit lateral movement
- SaaS applications are controlled at the identity and application layer, through single sign-on and the application policy engine, rather than the network
- Segmentation still matters: firewalls, security groups and network access control lists restrict movement between segments once access is granted
SASE platforms provide the connectors for this. Cisco Secure Access (opens in a new tab), for example, runs its resource connector as a lightweight service in a virtual machine in your cloud environment, and provides pre-configured connector images for AWS and Azure (Cisco: AWS (opens in a new tab), Azure (opens in a new tab)). Check Point describes full-mesh connectivity for its SASE platform, from "data center to cloud or cloud to cloud" (Check Point (opens in a new tab)). Sources checked 9 November 2026.
In practice, plan one connector group per cloud environment or data centre, keep the connectors in their own tightly controlled segment, and remove any public IP addresses from the applications behind them.
SASE platform implementation: pitfalls to design out
The NCSC's ZTNA anti-patterns (opens in a new tab) apply directly to SASE. Stated as what to do instead:
| Do this | Instead of |
|---|---|
| Scope access to the specific applications each user needs, evaluated by policy | Deploying SASE as a straight VPN swap that still gives broad network access once connected |
| Evaluate every request by the policy engine, whatever its source IP address | Trusting office IP ranges or VPN address pools as a reason to grant access |
| Broker private applications through connectors or proxies designed for untrusted networks | Publishing internal applications or management interfaces with public IP addresses |
| Remove legacy routes once applications have moved, and tightly restrict any that must stay | Keeping VPN access, direct routes or static firewall rules that bypass the policy engine |
| Test policies before enforcing them, with clear recovery paths | Switching on strict policy for everyone at once |
Source: NCSC, checked 9 November 2026. The phased plan above is built to avoid each of these.
Is SASE implementation the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Timescales and who does what
How long a SASE implementation takes depends on the number of users, sites and private applications, how much discovery has already been done, and whether SD-WAN is in scope. A pilot can usually start once policy is designed, and each later phase can run at the pace your organisation is comfortable with. We confirm the plan, the phases and the timescales at quote.
The split of work is agreed up front. We can run the design, pilot and roll-out, with your team handling internal communication, identity provider changes and application owners' sign-off; or we can work alongside your IT team as they lead. After go-live, the platform can be supported or run for you as managed SASE.
SASE and ZTNA implementation
The private access part of SASE is zero trust network access, and the NCSC's eight design requirements for ZTNA (secure transport, policy before access, multiple signals, minimal exposure, limiting compromise, continuous re-evaluation, observability and resilience) apply to every SASE platform. Our sister site covers them step by step in how to implement ZTNA (opens in a new tab), and the VPN side in VPN replacement (opens in a new tab). If you have not chosen a platform yet, start with how to choose SASE.
How Forever Systems helps with SASE implementation
We can help at any phase:
- Discovery and design: an assessment of your VPN, firewalls, WAN links, identity set-up and applications, and a written policy design
- Pilot: a proof of concept with a small group of users and real applications
- Roll-out: internet access, private applications and sites in phases, with connectors placed on-premises and in the cloud
- VPN retirement: removing legacy routes and licences once everything has moved
- Licensing: subscriptions that can be billed monthly, terms confirmed at quote
Contact us to plan your SASE implementation.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
How do you implement SASE?
In phases: discover what you have, design policy per application, pilot with a small group, move internet access, then private applications, then sites, and finally retire the VPN and any routes that bypass the policy engine.
How long does a SASE implementation take?
It depends on the number of users, sites and private applications and whether SD-WAN is in scope. Phases can run at your organisation's pace, and we confirm the plan and timescales at quote.
How do you deploy SASE in a hybrid cloud?
Place the platform's connectors beside private applications in each data centre and cloud environment, so access is brokered outbound without exposing the applications, and control SaaS access through single sign-on and the application policy engine.
Should we replace our VPN with SASE in one go?
Usually not. Moving applications in groups lets each step prove itself. The NCSC also warns against a straight VPN swap that keeps broad network access, so access should narrow per application as you migrate, with the VPN removed at the end.
Do we need SD-WAN to implement SASE?
Not to start. Many organisations begin with Security Service Edge (SSE) for users and add SD-WAN for sites later, or connect existing firewalls with IPsec tunnels. SD-WAN becomes important when you want to replace branch routers or MPLS.
Still have a question about SASE implementation?
Ask us and a member of our team will get back to you.