Question 1

What does SASE stand for?

Accepted Answer

Secure Access Service Edge — a cloud-delivered architecture Gartner named in 2019 that merges SD-WAN with SSE security services. Pronounced "sassy." The name is less important than the idea: stop backhauling traffic to a data center for inspection and instead push security to the cloud edge where your users already are.

Question 2

SASE vs SSE — what's the difference?

Accepted Answer

SSE is the security stack: SWG + CASB + ZTNA. SASE adds SD-WAN, FWaaS, DLP, and DEM on top. In practice, 80% of organizations start with SSE because it solves the immediate problem (secure remote access) without touching WAN infrastructure. You only need SD-WAN when you have branch offices with poor connectivity or you're killing an MPLS contract.

Question 3

How does SASE relate to Zero Trust?

Accepted Answer

Zero Trust is the design principle — never trust, always verify. SASE is the architecture that actually enforces it at the network layer. You can talk about Zero Trust all day, but without ZTNA brokering per-app connections and SWG inspecting encrypted traffic, you don't have Zero Trust — you have a PowerPoint deck.

Question 4

Is SASE replacing VPN?

Accepted Answer

Yes, and it should. VPNs drop users onto a flat network segment where a single compromised credential gives an attacker lateral access to everything. ZTNA replaces that with per-app micro-tunnels scoped to identity and device posture. The user experience is also dramatically better — sub-second connection times vs. the 5-15 second IPsec handshake dance. The only reason VPN survives is legacy thick-client apps that need L3 network access; plan for a 6-12 month coexistence period while you modernize those.

Question 5

How long does a SASE deployment take?

Accepted Answer

Most SASE deployments take 9-18 months end-to-end, but you can get DNS-layer protection live in hours and SWG in 2-3 weeks. Full ZTNA replacing VPN is typically a 2-4 month effort. SD-WAN is another 3-6 months because you're touching physical branch infrastructure. The hardest part isn't the technology — it's getting the TLS bypass list right. Expect 3-4 weeks of tuning before users stop complaining about broken apps.

Question 6

Single vendor vs best-of-breed SASE?

Accepted Answer

Go single vendor unless you have a very specific reason not to. The integration tax on best-of-breed is brutal — you're writing custom API glue between your SWG, CASB, and ZTNA, maintaining three policy engines, and troubleshooting cross-vendor blame games when something breaks. The theoretical best-in-each-category advantage rarely survives contact with operational reality. The exception is DEM: Cisco's ThousandEyes is genuinely better than anyone else's built-in DEM, so a Zscaler-plus-ThousandEyes combo is defensible.

Question 7

How should I evaluate SASE vendors?

Accepted Answer

Start with PoP coverage — pull your user geo data and verify the vendor has PoPs within 50ms of 90%+ of your workforce. Then run a real PoC with production traffic, not a vendor-controlled demo. The three things that separate vendors in practice: TLS inspection throughput under load, policy sync time across PoPs (should be under 60 seconds), and the quality of the FWaaS engine (is it a real NGFW or a glorified ACL?). Ignore throughput marketing numbers — they're measured in lab conditions that don't exist in production.

Question 8

Agent-based vs agentless ZTNA?

Accepted Answer

You need an agent for full SASE. Agentless is a compromise — you lose endpoint posture checks, can't inspect non-HTTP traffic, and have zero visibility into the device's security state. Use agentless only for contractors and BYOD where you can't install software. For your managed fleet, the agent gives you posture-based policy, DNS-layer protection, non-web traffic routing to FWaaS, and DEM telemetry. Running both is normal; just don't pretend agentless gives you the same security posture.

Question 9

How does TLS inspection work in SASE?

Accepted Answer

The SWG terminates the user's TLS session at the PoP, decrypts it, runs it through the SWG/CASB/DLP inspection pipeline in cleartext, then re-encrypts toward the destination. You deploy a root CA cert to every endpoint so browsers trust the re-signed certificate. The gotcha everyone underestimates: certificate-pinned apps (banking, healthcare portals, some government sites) will hard-fail because they reject the re-signed cert. Build your bypass list before go-live, not after. Every vendor ships a default list — start there and expect to add 20-40 entries in the first month.

Question 10

What is the market size for SASE?

Accepted Answer

Over $13B in annual revenue as of 2026, growing at 22% YoY per Dell'Oro Group. The real story is consolidation: Palo Alto, Zscaler, and Cisco control about 60% of the market. Fortinet and Netskope are the meaningful challengers. Everyone else is either getting acquired or fighting for niche MSP business.

Question 11

What is SSE (Security Service Edge)?

Accepted Answer

SSE is the security half of SASE — SWG, CASB, and ZTNA delivered as one cloud service. Gartner split it out in 2021 because most organizations don't need SD-WAN on day one. SSE is where you start if your users are primarily remote or hybrid. It secures web traffic, SaaS apps, and private application access without requiring you to rip out your existing WAN. Think of SSE as 'SASE for organizations that aren't ready to touch their network yet.'

Question 12

What is CASB and why do I need it?

Accepted Answer

CASB sits between your users and SaaS apps to enforce security policies on cloud usage you don't control at the infrastructure level. The real value is shadow IT discovery: the first time you turn on CASB, you'll find 900-1,500 cloud apps in use — 10x what IT sanctioned. That's 10x the data exposure you didn't know about. Inline CASB gives you real-time controls (block upload to personal OneDrive); API CASB scans data already sitting in M365 and Google Workspace. You need both modes because each has blind spots the other covers.

Question 13

What is DLP in SASE?

Accepted Answer

DLP inspects traffic inline to detect and block sensitive data leaving the organization — credit card numbers, SSNs, source code, files matching custom patterns. The SASE advantage over legacy DLP is channel coverage: the same policy engine covers web uploads (SWG), SaaS sharing (CASB), non-web protocols (FWaaS), and private app tunnels (ZTNA) in one pass. The biggest mistake is enabling blocking on day one. Every DLP deployment generates false positives — start in monitor mode for 4-6 weeks, use coaching actions first, and only hard-block after tuning. Otherwise you'll block a revenue-generating workflow and the project gets killed politically.

Question 14

What is FWaaS (Firewall as a Service)?

Accepted Answer

FWaaS inspects everything the SWG doesn't: SSH, RDP, database protocols, DNS, SMTP, and the long tail of non-web traffic. Without it, your SASE deployment has a massive blind spot — any non-HTTP exfiltration or C2 channel walks right past SWG inspection. The critical evaluation question is whether the vendor runs a real NGFW engine in their PoPs or a basic ACL with port/protocol filtering. Palo Alto and Fortinet run their actual NGFW engines in the cloud; some cloud-native vendors don't. Test it yourself with a port scan and IPS evasion test — the marketing won't tell you the difference.

Question 15

What is DEM in SASE?

Accepted Answer

DEM is hop-by-hop performance monitoring that decomposes 'the app is slow' into exactly where the bottleneck lives: user's Wi-Fi, ISP, SASE PoP, or the app itself. It should show per-user, per-app latency at each hop — not just endpoint-to-cloud averages. Without it, every performance complaint becomes a finger-pointing exercise between your team, the ISP, and the SaaS vendor. Watch the licensing: Cisco's ThousandEyes is a separate SKU, Palo Alto bundles ADEM only in higher tiers, and Fortinet charges extra for advanced synthetic testing. Negotiate DEM into your base license during procurement or you'll regret it later.

Question 16

How much does a SASE deployment cost?

Accepted Answer

SSE-only runs $5-$15/user/month depending on vendor and tier. A 2,000-user SSE deployment typically lands at $120K-$300K annually. Full SASE with SD-WAN adds site-level licensing that varies wildly by bandwidth and PoP count — budget an extra 40-60% on top of SSE. Professional services for initial rollout add 15-25% of year-one license cost, and that's money well spent if your team hasn't done this before. The hidden cost nobody warns you about: the internal labor for TLS bypass tuning, DLP policy development, and the 6-12 month VPN coexistence period.

Question 17

Can I deploy SASE in phases?

Accepted Answer

Phased deployment is how every successful SASE project works — anyone who tries a big-bang rollout is asking for trouble. The proven sequence: Phase 1 is DNS protection and SWG (weeks, immediate security value). Phase 2 is ZTNA replacing VPN (1-2 months, best user-experience win for executive buy-in). Phase 3 is CASB and DLP for SaaS visibility (1-2 months, start in monitor mode). Phase 4 is SD-WAN for branches (3-6 months, because you're touching physical infrastructure). Each phase delivers standalone value, which is critical because you need early wins to keep the project funded.

Question 18

What is the difference between ZTNA 1.0 and ZTNA 2.0?

Accepted Answer

ZTNA 1.0 checks identity and posture once at connection time, then creates an allow-all tunnel for the session. That means a device compromised after connection, or a user exfiltrating data through the authorized tunnel, goes undetected. ZTNA 2.0 (Palo Alto coined the term) adds continuous posture re-evaluation every few seconds plus inline DLP and threat inspection on tunnel traffic. The practical test: ask the vendor if they can detect and block a 500MB data export through an already-authorized ZTNA tunnel. If the answer is no, it's ZTNA 1.0 with a 2.0 label.

Question 19

How does SASE handle GenAI applications like ChatGPT?

Accepted Answer

This is now the number-one DLP use case. SASE platforms use CASB to identify which GenAI apps are being used (you'll find 15-30 AI tools in any enterprise), DLP to block paste/upload of source code, customer data, and PII into prompts, and SWG to restrict access to unapproved AI tools entirely. Most vendors shipped GenAI-specific policy templates in 2024-2025. The gap to watch: not all vendors inspect API-based GenAI usage (developers calling OpenAI APIs from code), only browser-based chat interfaces. Ask specifically about API-level inspection.

Question 20

What compliance frameworks does SASE help with (NIS2, DORA, SOC 2)?

Accepted Answer

SASE provides the technical controls that map to requirements across NIS2, DORA, SOC 2, HIPAA, and PCI-DSS: centralized logging, encryption in transit, identity-based access controls, and DLP. For NIS2 and DORA specifically, SASE addresses incident reporting (centralized logs with 90-day+ retention), access management (ZTNA), and supply chain risk (CASB visibility into third-party SaaS). SASE is not a compliance product and won't check every box on an audit — but it provides the technical evidence that auditors actually verify, and the centralized logging alone saves weeks of audit prep time.

Question 21

Do I need SD-WAN if I already have SSE?

Accepted Answer

Probably not yet. If your users are mostly remote/hybrid and branches have stable internet, SSE alone handles 90% of the security problem. SD-WAN becomes necessary when you're killing MPLS contracts and need application-aware routing, when branch offices have unreliable last-mile connectivity and need active-active failover, or when latency-sensitive workloads like voice and video need QoS guarantees across the WAN. The honest answer: most organizations deploy SSE first and add SD-WAN 12-18 months later when a WAN refresh creates the budget event.

Question 22

What is shadow IT and how does CASB discover it?

Accepted Answer

Shadow IT is every cloud app your employees use that IT didn't approve or even know about. CASB discovers it three ways: analyzing SWG/firewall logs for all cloud destinations, inspecting inline traffic at the SASE PoP in real time, and querying SaaS APIs for OAuth token grants to your corporate tenants. A typical 5,000-person enterprise discovers 900-1,500 cloud apps on first scan — and about 200 of those are file-sharing or collaboration tools where corporate data is actively being stored. The discovery is the easy part; the hard part is having a governance process to triage 1,000+ apps into sanction, tolerate, or block categories without killing business productivity.

SASE & SSE for
people who deploy it.

What is SASE?

Use cases driving adoption

What are the SSE components?

SASE vendor comparison

Best fit by scenario

Deployment playbook

Guides & resources

Latest from the blog

Frequently asked questions

SASE & SSE for
people who deploy it.

What is SASE?

Use cases driving adoption

What are the SSE components?

SASE vendor comparison

Best fit by scenario

Deployment playbook

Guides & resources

Latest from the blog

Frequently asked questions

SASE & SSE for people who deploy it.

What is SASE?

Use cases driving adoption

What are the SSE components?

SASE vendor comparison

Best fit by scenario

Deployment playbook

Guides & resources

Latest from the blog

Frequently asked questions

SASE & SSE for people who deploy it.

What is SASE?

Use cases driving adoption

What are the SSE components?

SASE vendor comparison

Best fit by scenario

Deployment playbook

Guides & resources

Latest from the blog

Frequently asked questions

SASE & SSE for
people who deploy it.

SASE & SSE for
people who deploy it.