In short
SASE, or secure access service edge, is networking and security delivered together as a cloud service: SD-WAN for offices plus Security Service Edge (SSE) controls such as secure web gateway, CASB and ZTNA, applied at the provider's nearest point of presence. It is bought as a subscription, for example per user, with site licences for SD-WAN branches.
Want help with SASE?
We can plan it with you or do it for you. Tell us where you are up to.
SASE meaning: what the letters stand for
SASE stands for secure access service edge. Read the words backwards and the meaning is clearer:
- Edge: the point where a user or site connects, which in SASE is the provider's nearest point of presence rather than your head office.
- Service: the networking and security functions are delivered as a cloud service and paid for by subscription.
- Access: what is being controlled is who and what can reach the web, SaaS apps and your private applications.
- Secure: every connection is checked against policy on the way.
A simple SASE definition, then: SASE is a cloud service that connects your users and sites to the applications they need and inspects that traffic under one policy, wherever people work. Check Point's own definition (opens in a new tab) is "a unified, cloud-based architecture that merges networking and security functions", integrating SD-WAN with security services.
The UK's National Cyber Security Centre treats SASE as one of the platforms that can act as a network-level policy engine: its ZTNA guidance (opens in a new tab) says these capabilities are "commonly provided by cloud-based access platforms such as VPN-as-a-Service, Secure Service Edge (SSE) or SASE".
The two halves of SASE: SD-WAN and Security Service Edge (SSE)
| Half | What it includes | Who it protects |
|---|---|---|
| Network: SD-WAN | Path selection, failover and central management across broadband, leased lines (opens in a new tab) and 4G or 5G at each site | Offices, shops, schools and other sites |
| Security: Security Service Edge (SSE) | Secure web gateway, CASB, ZTNA and usually firewall as a service, DLP and DNS-layer security | Users on any network, and site traffic sent to the cloud |
Check Point's explainer puts it the same way: the connections to private applications, the web and SaaS form the security pillar of SASE, which it also calls the Security Service Edge (SSE), and SD-WAN forms the networking pillar. If you only need the security half, see Security Service Edge (SSE) and SASE vs Security Service Edge (SSE).
Not sure which option applies to you? Ask us
Tell us about your organisation and we will point you to the right option.
How SASE works: the path of a request
Here is what happens when someone opens an application on a SASE platform.
- Connect: the user's device runs the vendor's agent (or uses a browser for clientless access), or the office's SD-WAN edge sends site traffic through a tunnel. Either way, traffic goes to the provider's nearest point of presence.
- Identify: the platform checks who the user is through your identity provider, often with MFA, and how healthy the device is.
- Apply policy: web filtering and malware scanning for internet traffic, CASB rules for SaaS, per-application ZTNA rules for private apps, and firewall and DLP rules for everything.
- Deliver: allowed traffic goes on to the website, SaaS app or private application, which is reached through a connector so it is not exposed to the internet.
- Log: every decision is logged in one console, and can be passed to a SIEM or managed detection service.
The components behind each step are listed on SASE architecture.
SASE vs SaaS: not the same thing
The two acronyms look alike and are often searched together, but they answer different questions.
- SaaS (software as a service) is an application you use over the internet, such as email, file sharing or a CRM.
- SASE is the networking and security layer between your people and those applications. It is delivered as a cloud service, but it is not an application your staff work in.
In fact, controlling SaaS is one of SASE's main jobs. The CASB component discovers which SaaS and AI apps people use, applies rules such as tenant restrictions, and with API connections can scan data already stored in sanctioned apps. Cisco's Secure Access data sheet (opens in a new tab) lists tenant restrictions and the discovery and control of generative AI apps among its CASB features.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
Who SASE suits
| Organisation | Why SASE fits | Likely starting point |
|---|---|---|
| Hybrid or remote-first teams | Staff work from anywhere and apps are in SaaS | Security Service Edge (SSE), with SD-WAN later if needed |
| Multi-site businesses | Branch networking and security can be renewed together | Full SASE |
| Organisations replacing a VPN | ZTNA removes broad network access; web protection follows the user | Security Service Edge (SSE) with ZTNA first |
| Schools, trusts and councils | Many sites and many devices under one filtering and access policy | SASE, with local firewalls where needed |
| Firms that grow by acquisition | New offices and users can be brought under policy without joining networks | Security Service Edge (SSE) with connectors |
More on who gains what is on SASE benefits, and the sector guides start from the home page.
What the NCSC says to watch for
The NCSC's ZTNA anti-patterns (opens in a new tab) start with a warning that applies to any SASE project: deploying Secure Service Edge (SSE) or SASE "as a direct replacement for traditional VPNs" while keeping the old access model, where users authenticate once and then reach most of the network, recreates the "walled garden" that zero trust is meant to replace.
So SASE is a means, not the result. The gain comes from per-application access rules, removing old access routes and segmenting what is left. The ZTNA side of this is covered on ZTNA vs SASE, and our sister site explains how ZTNA works (opens in a new tab).
Talk to us about SASE
We supply SASE and Security Service Edge (SSE) platforms from several vendors and can help you work out whether SASE fits now, which half to start with, and what a pilot would look like. Scope and timescales are confirmed at quote. Contact us for advice or a quote.
SASE in more depth: architecture, security and comparisons
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What does SASE stand for?
SASE stands for secure access service edge: networking (SD-WAN) and security (the Security Service Edge (SSE)) delivered together as a cloud service at the edge closest to each user or site.
What is a SASE in simple terms?
A cloud service that sits between your people and the apps they use. It connects offices and remote staff, checks every connection against one policy, and blocks threats and data loss on the way.
What is SASE vs SaaS?
SaaS is an application you use, such as email or file sharing. SASE is the networking and security service that connects people to those applications and controls how they are used. SASE is delivered as a cloud service but is not itself a SaaS application.
Is SASE the same as zero trust?
No. Zero trust is a security approach: never grant access on network location alone. SASE is a way to deliver it, through ZTNA and identity-aware policy for every connection. See ZTNA vs SASE.
Does SASE replace a VPN?
It can. The ZTNA part of SASE gives per-application access to private apps, and many platforms also offer VPN as a service for apps ZTNA cannot reach. See SASE vs VPN.
Still have a question about SASE?
Ask us and a member of our team will get back to you.