What Is SASE?
SASE—Secure Access Service Edge, pronounced "sassy"—is a framework Gartner coined in 2019 to describe a fundamental shift in how enterprises deliver networking and security. At its core, SASE converges two traditionally separate technology stacks into a single cloud-delivered platform: software-defined WAN (SD-WAN) for intelligent network routing and network security services for access control and threat prevention.
The problem it solves is straightforward: the traditional network perimeter is dead. Your users don't sit in your office anymore. Your applications don't live in your data center. Your infrastructure lives across AWS, Azure, Google Cloud, and SaaS platforms. Yet most enterprises still route traffic the 1990s way—backhauling everything to a central data center where a firewall inspects it before sending it out to the internet. This model is both too slow (extra latency and hops) and too expensive (you're paying MPLS carriers for ever-more bandwidth to a single point).
SASE replaces this with a cloud-native architecture where security and networking are delivered as services at the edge—near users and applications, not centralized in a data center.
The SASE Components
SD-WAN (Software-Defined WAN) is the networking foundation. Traditional WAN relies on MPLS circuits from carriers—expensive, rigid, and slow to provision. SD-WAN uses the internet and other underlay transports (broadband, 4G LTE, fiber) and applies intelligent steering policies on top. Packets are routed based on application type, source, destination, and real-time link quality—not just "always use this MPLS circuit." The result: lower cost, faster failover, and better use of available bandwidth.
CASB (Cloud Access Security Broker) inspects traffic to cloud applications (Salesforce, Microsoft 365, Box, Slack) and enforces policies—blocking unapproved SaaS apps, preventing data exfiltration, enforcing encryption. Think of it as the cloud equivalent of a web proxy.
FWaaS (Firewall as a Service) is a stateful firewall delivered from the cloud instead of an appliance at your branch office. It inspects inbound and outbound traffic, enforces policies, and logs connections.
SWG (Secure Web Gateway) filters web traffic—blocking malicious sites, scanning downloads for malware, enforcing content policies. It's the next generation of the web proxies many enterprises have run for 20 years.
ZTNA (Zero Trust Network Access) replaces traditional VPN. Instead of "connect to the network, then you can access apps," ZTNA requires authentication and authorization for every application access request. Users never get broad network access—only per-application connectivity based on identity, device posture, and context.
These services are delivered from cloud points of presence (PoPs) operated by the SASE vendor, close to users and the internet. A user on a branch network, working from home, or on a mobile device connects to the nearest PoP, where all these security checks happen, then gets routed to their destination.
SASE vs. the Alternatives
Understanding SASE requires understanding what it replaces. Most enterprises operate one of these models today:
Traditional MPLS + On-Premise Firewall. Dedicated MPLS circuits from your carrier connect all sites to a central data center. A firewall appliance (Palo Alto, Fortinet, Cisco) at the data center inspects all traffic before it hits the internet. VPN concentrators let remote users dial in. This is secure, but slow (all traffic funnels through one point), expensive (MPLS pricing), and rigid (provisioning new circuits takes weeks).
SD-WAN Only. You deploy an SD-WAN solution (Cisco Meraki, Fortinet FortiGate, Versa) at branches but keep your existing security stack. You get better WAN performance but no integrated cloud security. Users still use VPN or connect directly to SaaS with no CASB inspection.
SSE (Security Service Edge). This is SASE's security half without SD-WAN. You get cloud-delivered firewall, web gateway, CASB, and zero-trust access from a vendor like Zscaler or Cloudflare—but you manage your WAN separately, often with SD-WAN from another vendor. This is how most large enterprises actually deploy today: Zscaler for security, Cisco SD-WAN for networking, for example.
Full SASE. Single-vendor SASE gives you both networking and security from one platform. This sounds ideal on a PowerPoint but introduces vendor lock-in risk—are they truly best-in-class at both disciplines?
For a 10-person startup with one office, traditional MPLS + firewall is overkill. For a 100-person company with three offices and 40% remote work, SD-WAN plus cloud security (even from two vendors) makes sense. For a 1,000-person enterprise with complex, distributed architecture, SASE—or more realistically, SSE plus carefully selected SD-WAN—is necessary.
Top SASE Vendors in 2026
Palo Alto Prisma SASE. Palo Alto's unified platform includes SD-WAN, cloud firewall, CASB, and ZTNA. Strong security pedigree; less mature on the networking side compared to pure SD-WAN vendors. Pricing: $100-150/user/month depending on features. Best for enterprises already bought into the Palo Alto ecosystem.
Zscaler + Partner SD-WAN. Zscaler dominates SSE (security service edge)—exceptional at CASB, web filtering, and zero-trust. They position as SASE but don't own SD-WAN, so you'll pair them with Cisco, Fortinet, or Versa for routing. Pricing: $75-120/user/month for security, plus SD-WAN costs. Best for organizations that want best-of-breed security and don't mind managing two vendors.
Cato Networks. True single-vendor SASE from the ground up. They built both SD-WAN and security in-house. Strong performance benchmarks, good integration, smaller customer footprint than Palo Alto or Zscaler. Pricing: $95-180/user/month depending on throughput and features. Best for organizations comfortable with a smaller vendor and wanting unified operations.
Fortinet Secure SD-WAN. Fortinet's FortiGate appliances support SD-WAN and security together. Not cloud-native SASE (you still manage appliances at sites), but a bridge between traditional and SASE architecture. Pricing: typically $50-100/site/month. Best for enterprises making a gradual transition from appliances to cloud delivery.
Cloudflare One. Cloudflare's emerging SASE offering includes firewall, secure DNS, browser isolation, and ZTNA. Not yet a complete networking stack, but rapid iteration and competitive pricing ($60-100/user/month). Best for organizations with simple WAN topologies and strong commitment to Cloudflare's ecosystem.
Most mature enterprises deploying today use a dual-vendor approach: SSE from Zscaler or Palo Alto, SD-WAN from Cisco or Fortinet. The "true" single-vendor SASE platforms (Cato, Cloudflare) are gaining traction but haven't displaced the giants.
Zero Trust and SASE
ZTNA—Zero Trust Network Access—is often used synonymously with SASE, but it's more accurately SASE's access-control mechanism. Zero Trust means: never assume trust based on location. A user on your corporate network isn't automatically trusted any more than a user on a coffee shop WiFi.
Traditional VPN says: "Connect to our network tunnel, and you can access any resource your account permits." Your firewall trusts everything inside the network perimeter.
Zero Trust Network Access says: "To access Application X, authenticate with MFA, pass a device compliance check, and I'll grant you a tunnel to that application only—not to the entire network."
This seems subtle but has profound security impact. An attacker who compromises a user's laptop still can't reach internal databases, printers, or other systems—they only have access to the specific applications authenticated for. Lateral movement—the attacker jumping from the compromised device to other internal systems—becomes dramatically harder.
In practice, SASE vendors implement ZTNA by authenticating users (usually SAML with Okta or Azure AD), checking device posture (is your laptop patched? is antivirus running?), then issuing short-lived certificates or tokens that grant access only to specified applications. The user never gets a broad "network" connection.
This doesn't just improve security—it also simplifies management. You're no longer managing network access (who can reach which subnets?); you're managing application access (who can use which SaaS apps and internal services?). This maps cleanly to how modern enterprises actually organize access control.
Implementing SASE: The Realistic Path
Here's what enterprise SASE deployment actually looks like, not what vendors promise:
Phase 1: SD-WAN at Branches (Months 1-4). Deploy SD-WAN appliances at your office locations (if you have more than one). Configure intelligent routing policies, test failover to backup circuits, migrate traffic off MPLS gradually. By month four, branches are routing over broadband instead of MPLS. Cost: new appliances (one-time), broadband subscriptions (lower than MPLS), licensing.
Phase 2: Cloud Security (Months 3-7). While SD-WAN rolls out, begin deploying SSE—cloud firewall, web gateway, CASB. Proxy traffic from users and branches to the security platform. This is where you see immediate wins: better visibility into cloud app usage, fewer cloud-based breaches due to CASB enforcement.
Phase 3: Replace VPN with ZTNA (Months 8-12). Configure zero-trust access for your critical internal applications and SaaS. Migrate remote users from VPN concentrators to ZTNA. This is the longest phase because users need retraining, legacy applications may not support modern authentication, and you need to map applications carefully.
Phase 4: Optimization and Decommissioning (Months 12+). Fine-tune policies, decommission old MPLS circuits and on-premise firewalls, train operations teams on new tooling.
For a 10-site enterprise, 12-18 months is realistic. For a more complex organization with legacy applications, add 6-12 months.
What Can Go Wrong
Vendor Lock-In. You've built your routing and security around a single vendor's platform and API. Switching later is expensive and disruptive.
Integration Complexity. Your legacy applications may not support modern authentication. Your current firewall rules may have thousands of entries that don't map cleanly to application-based policies. You'll spend more time integrating than vendors estimate.
User Experience Degradation. If SASE platforms aren't sized correctly, users experience latency increases. A site routing traffic through a distant PoP or a congested PoP will feel slower than local routing. Proper sizing and PoP placement is critical.
Operational Readiness. Your network ops team has managed MPLS, firewalls, and VPN for years. SASE is a different operational model—cloud-managed, API-driven, less hands-on appliance management. Training and process change often lag technical deployment.
Cost and ROI: What SASE Actually Costs
SASE pricing comes in two flavors:
Per-User Pricing. Most cloud-native SASE and SSE vendors charge $75-200 per user per month depending on features and throughput. For a 500-user organization, that's $37,500-$100,000 annually just for licensing. If you add hardware (SD-WAN appliances at sites), implementation, and professional services, you're looking at $200,000+ in year-one costs.
Per-Site Pricing. Traditional appliance-based SASE (like Fortinet) might charge $3,000-$8,000 per site per year plus licensing. For a 10-site company, that's $30,000-$80,000 annually.
To understand ROI, model what you're replacing: MPLS circuits (typically $1,000-$3,000/month per site), firewall appliances and support ($20,000-$50,000/year), VPN concentrators ($15,000-$30,000/year), web proxies ($30,000-$60,000/year), CASB solutions ($50,000-$150,000/year). A mid-market company with 8 sites and 300 users might spend $400,000-$600,000 annually on these point products.
A SASE consolidation covering the same footprint costs roughly $80,000-$150,000 annually for licensing, plus implementation. Over three years, SASE typically delivers 15-30% cost reduction once fully deployed, with the biggest wins coming from MPLS elimination.
Don't factor in cost savings as your primary ROI argument, though. The real value is agility (new branch or remote user online in days, not weeks), security (cloud security visibility you didn't have before), and reduced operational overhead. Cost is a consequence of consolidation, not the driver.
Single-Vendor SASE: A Cautionary Note
Single-vendor SASE sounds appealing on paper—unified management, single vendor relationship, integrated roadmap. In practice, almost no vendor is truly best-in-class at both networking and security. Palo Alto is strong at security but still iterating on SD-WAN maturity. Cato built both in-house but has a smaller customer base than Cisco or Fortinet on the networking side. Most enterprise deployments you'll see in the wild use two vendors—best-of-breed SSE from Zscaler or Palo Alto, plus SD-WAN from a dedicated vendor. Evaluate them separately, not as a package.
ITG Perspective: The Phased Reality
SASE is sold as a complete replacement for your WAN and security stack. In practice, most implementations are phased over 12-24 months. Don't let vendors pressure you into a single large commitment before you've seen production performance. Start with one office or a department, validate the approach, then scale. Your first SASE implementation will teach you lessons—about integration, performance tuning, and operational readiness—that are worth the slower ramp.
Frequently Asked Questions
Is SASE the same as SD-WAN?
No. SD-WAN is just the networking piece—intelligent routing of traffic. SASE adds security services (firewall, web gateway, CASB, zero-trust access) on top of SD-WAN in a single cloud platform. You can have SD-WAN without SASE, but SASE always includes SD-WAN.
Does SASE replace our firewall?
For branch-level and remote access, yes—SASE's firewall-as-a-service component replaces traditional appliances. For data center perimeter security, you may keep your current firewall as a secondary layer while SASE handles user and cloud traffic. It depends on your architecture.
How long does SASE take to deploy?
Full enterprise SASE typically takes 12-18 months for a 10-site organization. Most organizations phase it: SD-WAN rollout (3-4 months), security services (3-4 months), VPN replacement with ZTNA (4-6 months), and optimization (ongoing). A smaller, simpler organization might finish in 6-9 months; a complex one with legacy systems might take 24+ months.
What's the minimum company size for SASE to make sense?
SASE ROI is strong for companies with 3+ office locations, significant remote work, or heavy cloud application usage. Organizations with a single office and minimal remote work may find traditional MPLS plus firewall more cost-effective—the overhead of SASE platforms doesn't justify the benefits at small scale.
What's the difference between SASE and SSE?
SSE (Security Service Edge) is SASE without the SD-WAN. It provides cloud-delivered security (CASB, FWaaS, ZTNA, SWG) but doesn't manage your WAN routing. Some enterprises deploy SSE from one vendor and keep SD-WAN from another—often by necessity, because no single vendor is best-in-class at both. SSE is also simpler to scope and deploy than full SASE.