In short
Zscaler SASE, which Zscaler calls Zero Trust SASE, joins its Security Service Edge (SSE) services to Zero Trust SD-WAN through its cloud proxy, the Zero Trust Exchange. Cisco, Check Point and HPE pair a Security Service Edge (SSE) with SD-WAN. UK organisations can ask Forever Systems to compare and quote the platforms we supply.
Want to compare it with the platforms we supply?
Tell us about your users, sites and current kit and we can show how Cisco, Check Point, HPE, Barracuda and the other platforms we supply would fit, with a quote.
What Zscaler SASE is
Zscaler calls its SASE offer Zscaler Zero Trust SASE (opens in a new tab). Zscaler describes it as converging networking and security in one cloud-native platform built on the Zero Trust Exchange, "a single-vendor SASE framework with a simpler, proxy-based architecture". Zscaler lists six core technologies:
| Component | Zscaler name | What Zscaler says it does |
|---|---|---|
| Zero Trust SD-WAN | Zero Trust Branch | Connects and segments branches, campuses, factories and clinics without routed overlays |
| Secure web gateway | ZIA | Protects users from internet threats and malicious traffic |
| Cloud access security broker | Data Security | Controls the use of cloud apps and services to prevent data leaks |
| Firewall as a service | Firewall | Cloud-based next-generation firewall capabilities, including access controls |
| Zero trust network access | ZPA | Least-privileged access to private applications without placing users on the network |
| Digital experience | ZDX | End-to-end performance monitoring and troubleshooting |
Zscaler's product menu also includes a Zero Trust Browser for secure browsing and private app access on any device. The secure web gateway, CASB, firewall as a service and ZTNA together make up a Security Service Edge (SSE), and Zero Trust SD-WAN adds the branch side that makes it SASE; SASE vs Security Service Edge (SSE) explains the split.
Still not sure which way to go? Ask us
Tell us what matters most to you and we can go through the options we supply with you.
How Zscaler Zero Trust SD-WAN differs from traditional SD-WAN
The most distinctive part of Zscaler's SASE is the branch. On its Zero Trust SD-WAN page (opens in a new tab), Zscaler describes branches that are "segmented and secured much like cafés":
- a physical or virtual Zscaler Edge appliance sits at the site, as the gateway or in one-armed mode
- it manages the internet connections and forwards traffic to the Zero Trust Exchange over any broadband connection
- there is no overlay routing and no site-to-site VPN mesh between branches; users and devices reach applications, not the network
- zero touch provisioning, application-aware path selection and agentless segmentation of IoT and OT devices are built in, with clientless browser-based SSH and RDP access for third parties
Cisco, Check Point and HPE take the more familiar SD-WAN route: branch appliances build a managed overlay between sites and the cloud, choose a path across each link and steer traffic to the Security Service Edge (SSE). Both approaches aim to stop backhauling internet traffic to head office. The practical question is whether you want to keep site-to-site routing between your offices, and what kit you already have there. SASE vs SD-WAN goes further.
Zscaler SASE compared with Cisco, Check Point and HPE SASE
| Zscaler Zero Trust SASE | Cisco SASE (opens in a new tab) | Check Point SASE | HPE Aruba Networking SASE | |
|---|---|---|---|---|
| Security Service Edge (SSE) | ZIA, ZPA, Data Security (CASB), Firewall, ZDX | Cisco Secure Access: ZTNA, SWG, CASB, firewall as a service, VPN as a service, DLP, RBI, DNS-layer security | Internet Access, Private Access, SaaS Security, GenAI usage monitoring | HPE Aruba Networking Security Service Edge (SSE): ZTNA, SWG, CASB, firewall as a service, DEM |
| Branch | Zero Trust SD-WAN with Zscaler Edge appliances, no overlay routing | Cisco SD-WAN or Cisco Meraki (opens in a new tab) SD-WAN | SD-WAN in the same platform, with failover across MPLS, 5G and broadband | EdgeConnect SD-WAN, described by HPE as the foundation for single-vendor SASE |
| Where web traffic is inspected | In the Zero Trust Exchange (proxy-based) | In Cisco's cloud, with full or selective TLS decryption | On the device, in the browser or in the cloud | In HPE's cloud, with security at the EdgeConnect branch |
| Remote users without an agent | Clientless access; Zero Trust Browser | Clientless ZTNA | Agentless access and Enterprise Browser | Agentless ZTNA |
| Existing on-premises kit | Replaces firewall-based branch designs | Can enforce ZTNA locally on existing Cisco firewalls | Hybrid architecture that can integrate with existing on-premises infrastructure | EdgeConnect includes a branch firewall |
Sources: Zscaler Zero Trust SASE (opens in a new tab), Zscaler Zero Trust SD-WAN (opens in a new tab), Cisco SASE (opens in a new tab), the Cisco Secure Access data sheet (opens in a new tab), Check Point SASE (opens in a new tab) and HPE Aruba Networking Security Service Edge (SSE) (opens in a new tab), read 9 November 2026. Barracuda SecureEdge, which we also supply, adds a further option: policy enforced in the cloud, at the branch or on the device.
Weighing up SASE platforms?
We can map the platforms we supply against your own requirements and talk you through the trade-offs.
Web security: proxy, hybrid or cloud gateway
Web security is at the heart of Zscaler SASE: ZIA, Zscaler's secure web gateway, is one of its six core technologies. When you compare, look at how each platform handles web and SaaS traffic:
- Proxy in the cloud. Zscaler sends user and branch traffic to the Zero Trust Exchange, where inspection and data protection are applied inline.
- Cloud gateway plus DNS. Cisco Secure Access combines a secure web gateway with DNS-layer security, forwarding traffic by tunnels, PAC files or proxy chaining, with full or selective TLS decryption.
- On the device as well as the cloud. Check Point SASE says its Internet Access lets employees connect directly to the web with on-device, in-browser and cloud protections.
- Cloud and branch. HPE pairs its Security Service Edge (SSE) gateway with the EdgeConnect branch firewall; Barracuda can inspect in the cloud, at the branch or on the device.
The NCSC notes (opens in a new tab) that TLS inspection concentrates trust in the systems doing the decryption and advises that it should be a deliberate choice rather than a default part of internet access, so whichever platform you choose, decide which categories to inspect and which to exempt. cloud-security.cloud explains the secure web gateway (opens in a new tab) itself, and for zero trust access alternatives to ZPA, ztna.org.uk covers Zscaler competitors (opens in a new tab).
Who each platform suits
| Platform | Often shortlisted by |
|---|---|
| Zscaler Zero Trust SASE | Organisations that want all user and branch traffic to go through one cloud proxy, without site-to-site routing between branches |
| Cisco SASE | Organisations with Cisco or Meraki networks, or Cisco security such as Duo and Umbrella |
| Check Point SASE | Organisations that want on-device and in-browser inspection, or already use Check Point firewalls or Harmony products |
| HPE Aruba Networking SASE | Organisations with HPE Aruba Networking or HPE Juniper Networking estates, or EdgeConnect at branches |
Check Point's own comparison is on check-point-harmony.co.uk's Harmony SASE vs Zscaler (opens in a new tab) page. For Palo Alto Networks, see Palo Alto SASE compared; the full list is on SASE vendors.
Licensing and how we help
SASE is licensed by a mix of users and sites, so a quote usually covers security services per user plus branch appliances and their subscriptions. Cisco says user-based pricing is typical for Secure Access, with site-based licensing by bandwidth available; Check Point, HPE and Barracuda license security per user with SD-WAN per site. Compare like for like on the same users, sites and term.
We supply Cisco, Check Point, HPE Aruba Networking, Barracuda and several MSP-ready SASE platforms, so we can:
- Assess your users, branches, web filtering and current VPN and firewalls.
- Shortlist the platforms we supply that match how you want traffic inspected and branches connected.
- Quote on the same requirements, with subscriptions that can be billed monthly, terms confirmed at quote.
- Pilot and deploy in phases, one group or one site at a time.
Scope and timescales are confirmed at quote. Contact us to compare SASE platforms.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What is Zscaler SASE?
Zscaler SASE, which Zscaler calls Zero Trust SASE, is Zscaler's single-vendor SASE offer. It combines its secure web gateway (ZIA), private access (ZPA), cloud access security broker (Data Security), firewall as a service, digital experience monitoring (ZDX) and Zero Trust SD-WAN, all running through its cloud proxy, the Zero Trust Exchange.
Is Zscaler single-vendor SASE?
Zscaler describes Zero Trust SASE as a single-vendor SASE framework, joining its Security Service Edge (SSE) services with its own Zero Trust SD-WAN and Zscaler Edge appliances.
What is Zscaler Zero Trust SD-WAN?
It is Zscaler's branch component. A physical or virtual Zscaler Edge appliance forwards branch traffic over broadband to the Zero Trust Exchange, without overlay routing or site-to-site VPNs, and segments IoT and OT devices at the site.
How does Zscaler SASE compare with Cisco SASE?
Both cover ZTNA, web security, CASB and firewall as a service. Cisco SASE pairs Cisco Secure Access with Cisco SD-WAN or Meraki SD-WAN, which build a managed overlay between sites; Zscaler's branch design forwards traffic to its cloud proxy instead of routing between sites.
What are the alternatives to Zscaler SASE?
Platforms covering the same SASE layers include Cisco SASE, Check Point SASE, HPE Aruba Networking SASE and Barracuda SecureEdge, plus cloud-only platforms such as Todyl, Timus and Exium for smaller organisations. Forever Systems can compare and quote these for you.
Still deciding?
Ask us and a member of our team will get back to you.
More SASE guides
Check Point SASECheck Point SASE, formerly Harmony SASE: private access, internet access, SaaS security and Secure SD-WAN in one platform.HPE Aruba Networking SASEHPE Aruba Networking Security Service Edge (SSE) with EdgeConnect SD-WAN, plus Juniper Secure Edge.