In short
A SASE platform is the vendor's cloud service plus the edges that connect to it: points of presence that inspect traffic, one console and one policy for SD-WAN and security. Cisco licenses Secure Access per user, or per site by bandwidth (currently in Secure Internet Access Essentials), in Essentials or Advantage packages.
Get a quote for SASE platform
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
Cloud SASE or appliance-led SASE
All SASE platforms use the cloud, but they differ in how much happens on devices and appliances.
| Approach | How it works | Vendor examples |
|---|---|---|
| Cloud-first | Most inspection happens at the provider's points of presence; sites and users tunnel in | Cisco Secure Access; WatchGuard FireCloud (opens in a new tab) through WatchGuard Cloud |
| Hybrid (device, branch and cloud) | Some checks run on the device or branch appliance, the rest in the cloud | Check Point lists on-device, in-browser and cloud protection; Barracuda inspects in the cloud, at the branch or on the device |
| Appliance-led | A firewall or SD-WAN appliance at each site does the inspection, joined to cloud services for remote users | Barracuda says SecureEdge can run as secure SD-WAN replacing existing firewalls at sites |
A hybrid or appliance-led design can suit sites with heavy local traffic or strict data handling rules; a cloud-first design suits dispersed teams. The question is not which is right in general, but where inspection should happen for each user, site and application.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Points of presence and private backbones
A SASE cloud is a set of points of presence (PoPs): data centres where your traffic enters the service and is inspected. Some vendors also run a private backbone between PoPs; Check Point describes Private Access as delivered over a "full mesh global private backbone", and Todyl describes global points of presence with intelligent routing.
Rather than comparing PoP counts, check the things that affect your users:
- Where your traffic will land: the vendor's UK and European locations, and which one your offices and remote staff will use.
- Where logs and decrypted data are processed and stored, which matters for data protection.
- What happens if a PoP is unavailable: how users and sites fail over to another location.
- Dedicated egress IPs: some SaaS apps and partners only accept connections from known addresses, and HPE, for example, offers managed connectors with allowlist-ready egress IPs for HPE Networking (opens in a new tab) Security Service Edge (SSE), formerly HPE Aruba Networking.
One console and one policy
The promise of a SASE platform is that networking and security are managed together. Cisco says Secure Access gives "a single console, unified client, and centralized policy management", and that Cisco Cloud Control brings SD-WAN and Secure Access management together. HPE describes its Security Service Edge (SSE) as integrating ZTNA (opens in a new tab), SWG, CASB, FWaaS and DEM "into a single, easy to use, interface". WatchGuard manages FireCloud through WatchGuard Cloud.
In practice, check whether one policy really covers web, SaaS, private apps and sites, or whether some components still have their own console. That is often the difference between a single-vendor SASE platform and two products joined together.
Is SASE platform the right fit for you?
We will check it against your systems and requirements and recommend the right option.
SASE as network as a service
SASE is sometimes described as network as a service: instead of buying routers, VPN concentrators and web proxies, you subscribe to a service that provides connectivity policy and security, with appliances or virtual edges supplied as part of it. It does not replace your internet links themselves; you still need broadband, leased lines (opens in a new tab) or mobile connections at each site.
If you would rather not run the platform yourself, the service can also be managed for you. See managed SASE.
Automation and APIs
Automated SASE is about removing manual steps from roll-outs and changes.
- Zero-touch site provisioning: Check Point and Barracuda both list zero-touch deployment for sites.
- Automated tunnels: Cisco automates tunnels between Catalyst SD-WAN or Meraki Auto VPN sites and Secure Access.
- APIs and webhooks: Cisco lists standards-based integrations, APIs, webhooks and ecosystem connectors, so policy, user changes and logs can tie into your own tools.
- Policy migration: Cisco's data sheet describes tools to move existing Cisco Umbrella and ASA VPN configurations into Secure Access.
Ask each vendor which tasks can be scripted, what the API limits are and whether changes made through the API show up in the console audit log.
How SASE platforms are licensed
| Licence unit | What it covers | Example from vendor material |
|---|---|---|
| Per user | Security Service Edge (SSE) services for each user, often across several devices | Cisco: "User-based pricing is typical" for Secure Access |
| Per site or bandwidth | Branch traffic sent to the cloud from an SD-WAN site | Cisco offers bandwidth-based site licensing for Secure Internet Access Essentials |
| Per appliance or edge | SD-WAN hardware or virtual edges at each site | Barracuda lists SecureEdge models for sites |
| Packages and tiers | Which components and features are included | Cisco: Secure Internet Access, Secure Private Access and DNS Defense, each in Essentials or Advantage |
| Add-ons | Extras such as browser isolation, advanced DLP or experience monitoring | Listed per vendor; confirmed at quote |
Many organisations mix units: Cisco notes that customers may prefer site licensing for branch users and user-based licensing for remote and roaming users. Subscriptions we supply can be billed monthly, with terms confirmed at quote. For the vendors themselves, see SASE vendors.
SASE platform checklist
| Question | Why ask it |
|---|---|
| Which components are included at the tier we would buy? | Labels such as SASE or Security Service Edge (SSE) do not tell you whether DLP, RBI or FWaaS are included |
| Is there one policy for web, SaaS, private apps and sites? | Separate consoles mean separate rules to keep in step |
| Which PoPs will our users and sites use? | Location affects performance and data handling |
| Does it work with our identity provider and device management? | Identity and device signals drive access decisions |
| Can we keep our current SD-WAN or firewall? | Decides between single-vendor and dual-vendor designs |
| How are logs exported and kept? | Needed for your SIEM, MDR and audits |
| Can we run a trial on our own apps? | The NCSC recommends testing with realistic scenarios before committing |
How we help you shortlist a SASE platform
We supply several SASE platforms, so we can shortlist the ones that fit your sites, users and existing kit, arrange demonstrations or trials where vendors offer them, and quote the licence units that suit you. Contact us for advice or a quote.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What is a SASE platform?
A vendor's cloud service, with points of presence and a management console, that delivers SD-WAN and Security Service Edge (SSE) controls under one policy, plus the agents and site edges that connect to it.
What is SASE cloud?
The provider's network of points of presence where traffic from your users and sites is inspected and forwarded. The vendor runs the cloud; you set the policy.
Is SASE network as a service?
In part. SASE provides connectivity policy and security as a subscription, which is why it is sometimes called network as a service, but you still need internet or WAN links at each site.
What is automated SASE?
Using zero-touch provisioning, automated tunnels between SD-WAN sites and the security cloud, and APIs to roll out sites and policy changes without manual configuration on each device.
How do SASE platforms differ?
In which components each tier includes, where inspection happens (cloud, device or appliance), how many consoles you use, which PoP locations they run and how they are licensed.
Still have a question about SASE platform?
Ask us and a member of our team will get back to you.