Where the term SASE came from
SASE (Secure Access Service Edge, pronounced "sassy") is a term coined in 2019 by the analyst firm Gartner to describe the convergence of two previously separate worlds — networking technology (chiefly SD-WAN) and security services (firewalls, web gateways, cloud app protection, secure remote access) — into a single, cloud-delivered platform.
It isn't one specific product or protocol, but an architectural model: instead of dozens of separate appliances deployed across branch offices and data centers, both networking and security functions move into a global network of cloud nodes that every user, device, or branch connects to — regardless of where they physically sit.
The problem SASE solves: the collapse of the perimeter
The traditional enterprise model assumed a clear perimeter — the corporate network was a trusted "fortress," protected by a firewall at the edge (the so-called castle-and-moat model). Branch offices connected to a central data center over expensive MPLS lines, all traffic was routed through headquarters, passed through security inspection there, and only then continued on to the internet.
That model broke down the moment most enterprise applications moved to SaaS and the cloud (Microsoft 365, Salesforce, Google Workspace) and remote work became the norm rather than the exception. Routing a work-from-home employee's traffic through company headquarters, just so it can reach an application running in a completely different cloud, adds latency, cost, and complexity without any real security benefit.
The building blocks of SASE
SASE isn't a single technology — it's the convergence of several previously separate services into one platform:
| Component | What it solves |
|---|---|
| SD-WAN | Software-defined management of WAN connections, intelligently routing traffic across multiple links based on performance and cost |
| SWG (Secure Web Gateway) | Filtering web traffic, protecting against malware and malicious sites, URL filtering |
| FWaaS (Firewall-as-a-Service) | Firewall functionality delivered from the cloud instead of a physical appliance at each branch |
| CASB | Visibility and control over how cloud and SaaS applications are used — covered in detail in a dedicated article |
| ZTNA | Secure access to specific applications without a traditional VPN — covered in detail in a dedicated article |
| DLP (optional) | Protection against sensitive data leaking out, often integrated directly into the SASE platform — covered in detail in a dedicated article |
Architecture: single-pass inspection from the cloud
Instead of chaining together separate appliances (e.g. a packet first passes through a firewall, then a web gateway, then a DLP system — each adding its own overhead), SASE platforms typically implement single-pass inspection: every security check is applied during a single pass of the data through the cloud node. This significantly cuts latency compared to a chain of separate "boxes."
These cloud nodes (Points of Presence, PoPs) are geographically distributed so that one is always close to the user — similar to how CDN networks distribute web content. Security policy is applied consistently regardless of whether the user is connecting from the office, home, or an airport.
Benefits and limits
- Consistent policy everywhere — the same rules apply to a user in the office or on the road, with no separate configuration per location.
- Lower latency — thanks to inspection happening close to the user instead of an unnecessary backhaul through headquarters.
- Less hardware at branches — no need for physical firewalls and other appliances at every location.
- Simpler management — a single central console instead of dozens of separately managed devices from different vendors.
The price for these benefits is greater dependency on a single provider (vendor lock-in), a complex migration away from existing infrastructure, and the fact that the entire company's performance and security now directly depend on the availability and quality of one vendor's cloud platform.
SASE concentrates both networking and security control in the hands of a single cloud provider — a compromise of its infrastructure or an admin account could have a far greater impact than with a fragmented infrastructure of many separate appliances. When choosing a provider, it's therefore worth thoroughly vetting its own security practices, multi-tenant isolation between customers, and incident history.
Zero Trust ("never trust, always verify") is a security philosophy — the principle that no user or device should be implicitly trusted just because it's "inside" the corporate network. SASE is an architecture that implements this principle at the networking level, among other things through ZTNA as one of its core components.
Summary
SASE emerged as a response to a world where applications live in the cloud and employees work from anywhere — in that world, routing all traffic through a central firewall stops making sense. By merging networking functions (SD-WAN) with security services (SWG, FWaaS, CASB, ZTNA, and optionally DLP) into a single cloud platform with nodes distributed close to users, SASE offers consistent security with lower latency — at the cost of greater dependency on a single provider. In the next three articles, we'll take a detailed look at its most important components — ZTNA, CASB, and DLP.