In short
Security Service Edge (SSE) is the cloud security half of SASE: secure web gateway, CASB, ZTNA and usually firewall as a service, applied at the provider's points of presence for users anywhere. It is licensed per user, often in internet access and private access packages, such as Cisco's Secure Internet Access and Secure Private Access.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What is Security Service Edge (SSE)?
A Security Service Edge (SSE) moves the security checks that used to happen on an office firewall, web proxy and VPN into a provider's cloud. A user's device connects to the provider's nearest point of presence, and policy decides which websites, SaaS apps and private applications they may use and what data may leave.
Vendors describe it in similar terms. Cisco calls Secure Access a "cloud-delivered security service edge (SSE) solution, grounded in zero trust", and its data sheet (opens in a new tab) lists ZTNA, SWG, CASB and FWaaS as the core components. HPE's page for HPE Networking Security Service Edge (SSE) (opens in a new tab), formerly HPE Aruba Networking, says its platform "integrates ZTNA, SWG, CASB, FWaaS, and DEM into a single, easy to use, interface".
A note on names: the NCSC's ZTNA guidance writes "Secure Service Edge (SSE)", and you will also see "secure services edge". All refer to the same thing as Security Service Edge (SSE).
Security Service Edge (SSE) components
| Component | What it does | Usually included |
|---|---|---|
| Secure web gateway (SWG) | Filters web traffic by category and reputation, scans downloads, optionally decrypts TLS | Yes |
| Cloud access security broker (CASB) | Discovers and controls SaaS and AI app use, inline and through API connections | Yes |
| Zero trust network access (ZTNA) | Per-application access to private apps after identity and device checks | Yes |
| Firewall as a service (FWaaS) | Network firewall and intrusion prevention in the cloud | Usually |
| Data loss prevention (DLP) | Detects and stops sensitive data leaving through web, SaaS and AI | By tier |
| DNS-layer security | Blocks known-bad domains before a connection is made | Often |
| Remote browser isolation (RBI) | Renders risky sites away from the device | By tier or add-on |
| Digital experience monitoring (DEM) | Shows device, network and app performance to help troubleshoot | Some platforms |
| VPN as a service | Covers private apps and protocols that ZTNA cannot reach | Some platforms |
For the building blocks in depth, our Cloud Security site covers CASB (opens in a new tab) and the secure web gateway (opens in a new tab).
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
Security Service Edge (SSE) vs SASE
Security Service Edge (SSE) is a subset of SASE. Every SASE platform contains a Security Service Edge (SSE); SASE adds SD-WAN so that branch offices send their traffic into the same security cloud under the same policy. Check Point's explainer puts it this way: the security pillar of SASE is "also called Security Service Edge, or SSE", and SD-WAN is the networking pillar. If your staff mostly work remotely and your offices are simple, Security Service Edge (SSE) may be all you need for now; if branch networking is due for renewal, SASE may fit better. The full comparison is on SASE vs Security Service Edge (SSE).
ZTNA, SWG and CASB: how they fit in Security Service Edge (SSE)
People often compare these three as if they were alternatives. In a Security Service Edge (SSE) they work together, each covering a different destination.
| ZTNA | SWG | CASB | |
|---|---|---|---|
| Protects access to | Your private apps | The public web | SaaS and AI apps |
| Main question it answers | Should this user and device reach this app? | Is this website or download safe and allowed? | Is this app sanctioned, and what may be done in it? |
| Typical controls | Per-app rules, posture checks, no network-level access | URL categories, malware scanning, TLS inspection | App discovery, tenant restrictions, DLP, API scanning |
So ZTNA vs CASB is not either-or: ZTNA governs your own applications, CASB governs everyone else's that you have chosen to use. ZTNA with SWG is the combination that replaces a remote access VPN without leaving web traffic unprotected; Cisco, for example, says all internet traffic can go through the same Secure Client module as private traffic. Zero trust internet access is the term some vendors use for applying zero trust rules, identity and posture, to web and SaaS traffic, not just private apps.
Zero trust and Security Service Edge (SSE) are closely linked: the platform is one way to deliver a zero trust approach, but the NCSC warns that deploying it as a straight VPN replacement, while users still reach most of the network, recreates the old "walled garden" (opens in a new tab). Security Service Edge (SSE) and ZTNA work best when each private app has its own rule. Our sister site explains how ZTNA works (opens in a new tab) in detail.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
When Security Service Edge (SSE) first makes sense
Starting with Security Service Edge (SSE) and adding SD-WAN later is a sound plan in several situations:
- No SD-WAN refresh due: routers or WAN contracts have time to run, so there is no reason to change the network yet.
- Remote-first teams: most people work away from an office, so protecting the user matters more than the site.
- A VPN that needs replacing: ZTNA and web protection together remove the VPN and the backhaul.
- SaaS and AI governance: you need to see and control which apps people use.
Choose a Security Service Edge (SSE) that can later take branch tunnels or join the vendor's SD-WAN, so the move to full SASE is an extension rather than a new project.
Security Service Edge (SSE) products we supply
| Product | What the vendor lists | More |
|---|---|---|
| Barracuda SecureEdge Access | SecureEdge Access Agent for zero trust access and Secure Internet Access at the endpoint, with DNS security; part of the SecureEdge platform with firewall as a service | Barracuda SecureEdge |
| Check Point SASE Internet Access (opens in a new tab) and Private Access | Hybrid internet access (on-device, in-browser and cloud) with web filtering and in-browser DLP; identity-centric private access over a private backbone; SaaS Security | Check Point SASE |
| Cisco Secure Access (opens in a new tab) | Cisco's Security Service Edge (SSE): ZTNA, SWG, CASB and FWaaS, plus VPN as a service, DLP, DEM and RBI; Secure Internet Access and Secure Private Access packages | Cisco SASE |
| HPE Networking (opens in a new tab) Security Service Edge (SSE), formerly HPE Aruba Networking | ZTNA (agent-based or agentless), SWG, CASB, FWaaS and DEM in one interface; pairs with HPE Networking EdgeConnect SD-WAN for single-vendor SASE; HPE Juniper Networking also offers Juniper Secure Edge | HPE Aruba Networking SASE |
| WatchGuard FireCloud | Internet Access (FWaaS and SWG); Total Access adds ZTNA and identity, managed in WatchGuard Cloud | WatchGuard SASE |
Sources: Barracuda (opens in a new tab), Check Point (opens in a new tab), Cisco (opens in a new tab), HPE (opens in a new tab) and WatchGuard (opens in a new tab), each read on 9 November 2026. Packages or tiers decide which components you get, and per-user licensing is common (Cisco says user-based pricing is typical for Secure Access); subscriptions can be billed monthly, terms confirmed at quote.
Managed Security Service Edge (SSE)
If you would rather not run policy, updates and reporting yourself, a Security Service Edge (SSE) can be delivered as a managed service. We can set it up, make agreed changes and report on it, with the scope written into the quote. See managed SASE for how that works, or contact us to talk it through.
Security Service Edge (SSE) compared with SASE
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What is security service edge?
Security Service Edge (SSE) is cloud-delivered security for users wherever they work: secure web gateway, CASB, ZTNA and usually firewall as a service and DLP, applied at the provider's points of presence. It is the security half of SASE.
Is it secure service edge or security service edge?
Both names are used. The NCSC writes Secure Service Edge (SSE); most vendors write security service edge. They mean the same set of cloud security services.
What is the difference between ZTNA and CASB?
ZTNA controls access to your own private applications. CASB controls the use of SaaS and AI apps run by other companies, such as which apps are allowed and what data can be uploaded. A Security Service Edge (SSE) usually includes both.
Is ZTNA part of Security Service Edge (SSE)?
Yes. ZTNA is one of the core components, alongside secure web gateway and CASB, and usually firewall as a service.
What is zero trust internet access?
Applying zero trust rules (identity, device posture and least privilege) to web and SaaS traffic as well as private apps. In a Security Service Edge (SSE) this is done by the secure web gateway and CASB working with the same identity signals as ZTNA.
Do I need SD-WAN for Security Service Edge (SSE)?
No. Security Service Edge (SSE) works with an agent on each device, and offices can send traffic to it over IPsec tunnels from your existing router or firewall. SD-WAN is what turns it into full SASE.
Still have a question about Security Service Edge (SSE)?
Ask us and a member of our team will get back to you.