In short
SASE security applies the same controls to every user and site from the cloud: web filtering and malware scanning, CASB for SaaS and AI apps, ZTNA for private apps, firewall as a service and data loss prevention. Higher licence tiers usually add DLP and browser isolation, so the edition you buy decides which threats are covered.
Get a quote for SASE security
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What SASE security protects against
SASE cyber security is a set of controls, each aimed at a different way attacks and data loss happen. This is the map we use when scoping a project.
| Threat or risk | SASE control that addresses it | How |
|---|---|---|
| Phishing and malicious websites | Secure web gateway and DNS-layer security | Blocks known-bad domains and URL categories, scans pages and downloads |
| Malware downloads | Secure web gateway with sandboxing | Scans files and detonates unknown ones before they reach the device |
| Shadow SaaS and unsanctioned AI tools | CASB | Discovers apps in use, blocks risky ones and applies tenant restrictions |
| Data loss through web, SaaS and AI | DLP | Detects sensitive content in uploads, prompts and shares and blocks or logs it |
| Lateral movement after a compromise | ZTNA (opens in a new tab) and firewall as a service | Grants per-application access only, so a stolen account cannot roam the network |
| Exposed private apps | ZTNA with app connectors | Apps sit behind outbound-only connectors with no public IP address |
| Risky websites that must stay reachable | Remote browser isolation or enterprise browser | Renders the site away from the device or restricts copy, paste and download |
Cisco's Secure Access data sheet (opens in a new tab) is a useful example of how one platform covers these: content filtering, file scanning and sandboxing in its secure web gateway, CASB discovery of generative AI apps, DLP across internet, SaaS and private apps, intrusion prevention in its firewall as a service, and DNS-layer security.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
TLS inspection: what it adds and what it costs
Most web traffic is encrypted with TLS, so a secure web gateway can only see page content and file contents if it decrypts the traffic. Platforms let you choose: Cisco offers "full or selective TLS decryption", and Barracuda lists SSL inspection.
The NCSC is clear that this is a trade-off, not a default. Its guidance on what to do before building a ZTNA architecture (opens in a new tab) says TLS inspection "concentrates trust in a small number of systems and increases the impact of compromise, misconfiguration, or operational failure", and that it "should not be treated as a default component of internet access". It suggests that outcomes such as detecting malicious activity can often be achieved with other controls, including EDR, device posture signals, DNS protections and application-level logging.
In practice that means deciding deliberately:
- Decrypt where it gives you something you need, such as DLP on uploads to file-sharing sites or malware scanning of downloads.
- Bypass categories such as banking and health, where inspection adds privacy risk for little gain.
- Document the decision, including where decrypted data is processed and how the vendor protects it.
Identity and device posture in SASE network security
SASE network security decisions rest on identity. Every request is checked against who the user is, what device they are on and how that device looks right now. The NCSC's signals and policy engines (opens in a new tab) guidance lists user identity, device identity, device health and user behaviour as the signals a policy engine weighs, and notes that a network-level policy engine of this kind is "commonly provided" by Security Service Edge (SSE) or SASE platforms.
Two practical points follow. Your identity provider and MFA need to be in good shape before SASE goes live, because the platform inherits their strengths and gaps. And device rules should allow for the fact, as the NCSC puts it, that compliance checks "can lag behind changes made on the device".
Is SASE security the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Logging into your SIEM or MDR
A SASE platform sees every web request, SaaS action and private app connection, which makes its logs valuable to whoever watches your security. The NCSC advises organisations to understand (opens in a new tab) "what security logs are available, how they can be accessed, and how incidents involving the service will be detected and handled".
Most platforms export logs to a SIEM, and several integrate with the vendor's own detection tools. If you use, or plan to use, a managed detection and response or SOC service, check the export format and retention before you choose. Our sister site covers SIEM as a service (opens in a new tab) and managed detection.
What stays on premises
SASE moves most inspection to the cloud, but some security stays local.
- Site firewalls: still useful where sites carry traffic that never involves a remote user, such as between building systems or to on-site servers. Barracuda says SecureEdge can run alongside existing firewalls or replace them, and Cisco Secure Access (opens in a new tab) can enforce ZTNA locally on existing Cisco firewalls, so office staff reach local apps without going to the cloud first.
- Network access control (NAC) and segmentation: deciding which devices can join the office LAN and Wi-Fi is a local job.
- Endpoint protection and EDR: SASE protects the connection, not the operating system.
The trade-offs between cloud and appliance security are covered on SASE vs firewall, and hardware is on our sister site's firewalls (opens in a new tab) range.
SASE security checklist
| Check | What good looks like |
|---|---|
| Identity | Single sign-on and MFA for every user, with joiner and leaver processes in place |
| Devices | Managed devices enrolled; a clear rule for personal and contractor devices |
| Web policy | Categories agreed with HR and leadership; decryption choices documented |
| SaaS and AI | Sanctioned apps listed; tenant restrictions and AI app rules set |
| Private apps | Each app published by its own rule; old VPN and port-forward routes removed |
| Data | DLP rules for the data types that matter to you, in monitor mode first |
| Logs | Export to your SIEM or MDR tested; retention agreed |
| Fallback | What happens to users and sites if the service is unavailable |
The last row comes straight from the NCSC's advice to understand "which users and services are affected, and what fallback or contingencies exist" if the service is unavailable.
How we help with SASE security
We can check your current controls against this checklist, recommend the platform and licence tier that close the gaps, and set up policy in stages to keep disruption low. Scope is confirmed at quote. Contact us for advice or a quote.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What is SASE in cyber security?
SASE is a way of delivering cyber security controls (web filtering, CASB, ZTNA, firewall as a service and DLP) from the cloud, joined to SD-WAN networking, so every user and site is protected under the same policy wherever they connect.
What is SASE security?
The security half of SASE, also called the Security Service Edge (SSE). It inspects web, SaaS and private app traffic and applies zero trust access rules, data controls and threat prevention.
Is SASE network security or cloud security?
Both. SASE is network security delivered from the cloud: firewall, web and access controls that used to sit in office appliances now run in the provider's points of presence, alongside SaaS controls that only make sense in the cloud.
Does SASE replace endpoint protection?
No. SASE protects connections and data in transit. You still need endpoint protection or EDR on devices, and the NCSC lists EDR among the controls that can reduce the need for TLS inspection.
Does SASE decrypt my traffic?
Only if you configure it to. Platforms offer full or selective TLS decryption. The NCSC advises treating it as a deliberate, documented choice rather than a default.
Still have a question about SASE security?
Ask us and a member of our team will get back to you.