In short
ZTNA vs SASE is a part versus the whole. Zero trust network access controls access to private applications. Add web and SaaS protection (secure web gateway, CASB, usually firewall as a service) and you have a Security Service Edge (SSE). Add SD-WAN for branches and you have SASE. Many UK organisations start with ZTNA and add the rest later.
Want an impartial recommendation?
Tell us about your users, systems and priorities and we will tell you which option fits, and why.
How ZTNA, Security Service Edge (SSE) and SASE nest
Think of three concentric circles.
ZTNA is the innermost: per-application, deny-by-default access to private applications in your offices, data centres and clouds, after checking identity, device and context. ztna.org.uk explains how ZTNA works (opens in a new tab) in detail.
Security Service Edge (SSE) wraps ZTNA with the controls that protect people using the internet and SaaS: a secure web gateway (SWG), a cloud access security broker (CASB) and, usually, firewall as a service (FWaaS), data loss prevention (DLP) and remote browser isolation (RBI).
SASE (secure access service edge) adds the networking: SD-WAN for branch offices, so sites and users share one policy and one security cloud. For the general definition, see what is SASE.
ZTNA, Security Service Edge (SSE) and SASE components compared
| Component | ZTNA | Security Service Edge (SSE) | SASE |
|---|---|---|---|
| Zero trust access to private apps | Yes | Yes | Yes |
| Secure web gateway (web filtering, malware) | Not included | Yes | Yes |
| CASB (SaaS visibility and control) | Not included | Yes | Yes |
| Firewall as a service | Not included | Usually | Usually |
| DLP and remote browser isolation | Not included | Often, by tier | Often, by tier |
| SD-WAN for branch offices | Not included | Not included | Yes |
| Typical licensing | Per user | Per user | Per user plus per site or appliance |
"Not included" means the component is outside that category as usually defined; vendors draw the lines differently. The labels are not regulated: some ZTNA-focused products include DNS or web filtering, and some Security Service Edge (SSE) platforms include SD-WAN integrations without being full SASE. Compare the components, not the label.
Still not sure which way to go? Ask us
Tell us what matters most to you and we will recommend one, with the trade-offs explained.
ZTNA vs Security Service Edge (SSE)
The difference between ZTNA and a Security Service Edge (SSE) is the traffic they protect. ZTNA covers traffic to your applications. A Security Service Edge also covers traffic to everyone else's: websites, SaaS applications and, increasingly, generative AI services.
If remote staff currently send all their internet traffic back through the office firewall over a VPN so it can be filtered, replacing the VPN with ZTNA alone leaves that traffic unprotected. That is the most common reason a ZTNA project grows into a Security Service Edge project. That side of the decision, including how the NCSC classes Security Service Edge and SASE platforms as network-level policy engines and its warning against using them as a straight VPN swap, is covered on SASE vs Security Service Edge (SSE).
SASE and zero trust: where the zero trust edge fits
SASE vs zero trust is not a like-for-like comparison. Zero trust is an approach: never grant access because of where a request comes from, check identity, device and context for each request, and give the least access needed. The NCSC is clear that it is an architectural approach rather than a single product. SASE is one way to deliver that approach to users and sites from the cloud.
In a SASE zero trust design, the parts line up like this:
- ZTNA applies zero trust to private applications.
- The Security Service Edge (SSE) applies the same identity and device signals to web, SaaS and AI use.
- SD-WAN and local firewalls bring branch sites into the same policy, with segmentation inside each site.
Zero trust edge is another label for the same idea: zero trust access and security delivered at the edge of the network or from the cloud, for both people and sites. Whatever the label, the outcome still depends on identity and device foundations, per-application policy and removing old access routes. ztna.org.uk covers the zero trust side, from principles to choosing ZTNA providers (opens in a new tab).
Weighing up the options?
We can compare them against your own requirements and recommend what fits.
Which do you need?
| If this describes you | Start with | Why |
|---|---|---|
| Remote users reach a few internal apps; most work is in SaaS already protected by your identity provider | ZTNA | Replaces the VPN for private apps without changing internet traffic |
| Remote users' web traffic is filtered by backhauling it through the office firewall | Security Service Edge (SSE) | Moves web and SaaS protection to the cloud so the VPN can go |
| You need to see and control SaaS use, shadow IT or generative AI tools | Security Service Edge (SSE) with CASB | CASB adds SaaS visibility and policy |
| Several offices with an MPLS or router refresh coming up | SASE | SD-WAN plus a Security Service Edge under one policy |
| One office firewall due for replacement and most staff remote | Security Service Edge (SSE), or SASE with a software gateway | May remove the need for a like-for-like office firewall; see SASE vs firewall |
You do not have to buy everything at once. Most platforms are licensed per user by component, so ZTNA can be added first and web security or SD-WAN later. If the VPN is the trigger, SASE vs VPN compares the routes, and ztna.org.uk covers VPN replacement options (opens in a new tab) for a ZTNA-only project.
How the platforms we supply map to each layer
| Platform | ZTNA | Security Service Edge (SSE) components | SASE / branch |
|---|---|---|---|
| Check Point SASE (formerly Harmony SASE) | Private Access: agent-based and agentless ZTNA; Enterprise Browser for unmanaged devices | Internet Access, SaaS Security, GenAI Security | SD-WAN in the same platform |
| Cisco Secure Access | Client-based and clientless ZTNA, plus VPN as a service for apps that are not ZTNA-ready | Secure Internet Access package for internet and SaaS use, in Essentials or Advantage configurations; components confirmed at quote | Cisco SASE pairs it with Cisco SD-WAN or Meraki SD-WAN (opens in a new tab) |
| Barracuda SecureEdge | Zero Trust Network Access | Firewall as a service and web security | Secure SD-WAN in the same platform |
| Trend Micro ZTSA (opens in a new tab) | Private Access via connectors | Internet Access (SWG with CASB controls), AI Secure Access | Pair with your WAN; ask us |
| Exium SASE (now part of NETGEAR) | Secure Private Access; agentless access on Pro | Secure Internet Access: DNS, web and SaaS security | Cyber Gateway: software firewall with SD-WAN, per site |
| Timus SASE | Always-on ZTNA through an OS-agnostic agent | Dynamic cloud firewall and secure web gateway | Dedicated gateways and static IPs; ask us about sites |
| Todyl SASE | Identity-based conditional access rules | Secure web gateway, secure DNS, next-generation firewall with SSL inspection | SASE Tunnel (IPsec site-to-site) |
| WatchGuard FireCloud | Total Access: zero trust access to private resources | Firewall as a service and secure web gateway | Works with Firebox gateways |
| NordLayer | Identity-based access, device posture, Cloud Firewall segmentation on Premium | Web Protection on every plan; DNS filtering on Core and Premium | Site-to-Site connector on Premium |
| Island Private Access | ZTNA inside the Island Enterprise Browser | Browser-level data and web controls | Island Enterprise Network: ask us |
| Zero Networks Connect | MFA-gated remote access with no open ports | Not included | Part of a microsegmentation platform |
The SASE platforms are compared on SASE vendors, with a page each for Cisco SASE, Check Point SASE, Barracuda SecureEdge, Exium SASE, Timus SASE and Todyl SASE. Cisco packaging is from the Cisco Secure Access data sheet (opens in a new tab), checked 9 November 2026. For licensing, ask us for a quote.
ZTNA vs SASE vs CASB
CASB comes up in the same breath because it is the Security Service Edge (SSE) component that is easiest to misunderstand. ZTNA governs access to private applications; a CASB (opens in a new tab) governs how people use SaaS applications, either inline as traffic passes through the Security Service Edge or through API connections to the SaaS platform itself, covering things like shadow IT discovery, tenant restrictions and data controls. SASE contains both. If your main concern is data leaving through SaaS rather than attackers reaching internal systems, CASB may matter more to you than ZTNA.
Common misconceptions
- "SASE replaces ZTNA." It contains it. Every SASE platform has a ZTNA component, and that component is what replaces the remote access VPN.
- "ZTNA protects internet browsing." Not on its own. ZTNA covers private applications; web and SaaS protection comes from the Security Service Edge (SSE) components.
- "SASE means no firewalls." Many organisations keep firewalls at data centres and larger sites and use SASE for users. The NCSC also notes that ZTNA does not remove the need for local controls such as firewalls and access control lists.
- "Buying SASE gives you zero trust." Zero trust is an architectural approach rather than a single product. Policy design, identity and device foundations and removing old access routes still decide the outcome.
- "SD-WAN is the security." SD-WAN chooses paths across links and connects sites; the security comes from the Security Service Edge (SSE) or firewall it sends traffic through.
Single vendor or mix and match?
You can buy SASE from one vendor, or combine a Security Service Edge (SSE) from one vendor with SD-WAN from another. A single vendor gives one policy model, one agent and one console; mixing lets you keep SD-WAN or firewalls you already own and are happy with. Single vendor SASE sets out the trade-offs. The NCSC's advice on assessing providers is relevant either way: understand what you are delegating to the provider, how critical the service becomes, how much visibility and control you keep, and trial it before committing.
How Forever Systems helps
We supply ZTNA-only, Security Service Edge (SSE) and full SASE platforms, so the recommendation follows your situation. We can map your users, applications, sites and existing firewalls, show which layer you need now and which can wait, and run a trial with a pilot group where the vendor offers one. Scope and timescales are confirmed at quote, and pricing depends on users, components and sites, so ask us for a quote. Contact us for a recommendation that fits.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
Is ZTNA part of SASE?
Yes. ZTNA is one component of a Security Service Edge (SSE), and a Security Service Edge plus SD-WAN networking makes SASE. Every SASE platform includes ZTNA, but a ZTNA product on its own is not SASE.
What is the difference between ZTNA and Security Service Edge (SSE)?
ZTNA protects access to your private applications. A Security Service Edge (SSE) adds protection for internet and SaaS use: a secure web gateway, CASB and usually firewall as a service, DLP and remote browser isolation.
Do I need SASE or just ZTNA?
If your main need is replacing a remote access VPN for a set of internal applications, ZTNA may be enough. If remote users' web traffic currently goes through the office firewall, you probably need a Security Service Edge (SSE). Full SASE makes most sense when branch networking is also changing.
Is SASE zero trust?
SASE is a way to deliver zero trust to users and sites, through ZTNA for private apps and policy for web and SaaS use. Zero trust itself is an approach, so the result depends on how identity, devices and policy are set up.
What is a zero trust edge?
A label for zero trust access and security delivered at the network edge or from the cloud, for people and sites. In practice it describes the same combination of ZTNA, cloud security and SD-WAN that SASE platforms provide.
Can I add SASE later if I start with ZTNA?
Usually yes. Several platforms we supply license ZTNA, internet access and SD-WAN as separate components, so you can start with private access and add the rest when the need or the hardware refresh arrives.
Still deciding?
Ask us and a member of our team will get back to you.