SASE (secure access service edge)
Also known as: SASE, secure access service edge
SASE, pronounced 'sassy' and short for secure access service edge, is an approach that moves network security into the cloud and combines it with networking.
Instead of sending all traffic back to a head office firewall, users and branches connect to the nearest point of a provider's cloud, where security checks such as web filtering, zero trust access, and data protection happen. While SASE suits a world of remote work and cloud apps, it means trusting one vendor with both your connectivity and your security.
SASE (secure access service edge), explained at three levels
At home
Imagine a company that used to have one security guard at its head office. Now staff work from home, coffee shops, and job sites, so the company hires a guard service with booths in every city, and each worker passes through the nearest booth. SASE works like that: security checks happen in the cloud, close to wherever people are, rather than only at the office.
At work
SASE, short for secure access service edge and pronounced 'sassy,' is an architecture that combines networking and security into one cloud service. Users and branch offices connect to a provider's nearby point of presence, where traffic is inspected and access policies are applied. Businesses adopt it to protect remote workers and cloud apps consistently, without routing everything back through a head office firewall and VPN.
At home
When you open a work app from home, a small agent on your laptop sends traffic to the provider's nearest data centre, often in Toronto or Montreal for Canadian users. There, the service confirms who you are through your company login, checks your device's health, scans websites for threats, and applies rules about which apps you may use. Approved traffic continues to the internet or to the company's private apps, without a traditional VPN.
At work
SASE combines SD-WAN with security service edge, or SSE, functions. The SSE side includes a secure web gateway that filters internet traffic, a cloud access security broker that controls use of SaaS apps, zero trust network access that grants access to individual private apps rather than whole networks, firewall-as-a-service, and data loss prevention. Users connect through an endpoint agent and branches through SD-WAN, and one policy engine applies the same rules everywhere.
At home
To inspect traffic, SASE services usually decrypt and re-encrypt your HTTPS connections, using a certificate your employer installed on the work device. That means the provider can see much of what you do on that device, including personal browsing, unless categories like banking are excluded. While that inspection blocks real threats, in my opinion employees deserve a clear explanation of what is decrypted and logged, and personal use belongs on personal devices.
At work
SASE moves the inspection stack into a provider's global network of points of presence, so performance depends on how close and well connected those locations are. Key questions include single-vendor versus mixing SD-WAN and SSE vendors, Canadian points of presence and log storage for data residency, TLS inspection exceptions for privacy, and what happens during a provider outage, since all traffic may stop if the service fails closed. Migrations usually replace VPNs first, then web security, then branch networking.
Real-world examples
At home
Aisha works from home in Gatineau. Her employer's SASE service blocked a fake login page she clicked in an email, even though she wasn't on the office network.
At work
Jerome is security manager at a national engineering firm. Moving to SASE let the company retire its overloaded VPN and apply the same web security rules to staff at offices, homes, and job sites.
How it compares
| feature | SASE (secure access service edge) | Traditional network security |
|---|---|---|
| Where security happens | Cloud points of presence | Head office firewall |
| Remote users | Protected directly | Through VPN back to office |
| Scaling | Provider handles it | Buy bigger appliances |
| Dependence | On the SASE vendor | On your own hardware |
SASE moves the security perimeter from the building to the user.
For analysts
SASE projects work best when phased: replace the VPN with zero trust access first, then web security, then SD-WAN. Big-bang migrations of networking and security at once are risky.
History & origin
As companies adopted cloud apps and remote work in the 2010s, routing everything through a central data centre's firewall became slow and costly. Analysts at Gartner, including Neil MacDonald, Joe Skorupa, and Lawrence Orans, coined the term SASE in a 2019 report. Vendors such as Zscaler, Netskope, Palo Alto Networks, and Cloudflare built or bundled cloud security services. The COVID-19 shift to remote work in 2020 accelerated demand. Gartner later defined 'security service edge' (SSE) in 2021 for the security-only portion, without SD-WAN. In my view, SASE is less a product than a direction, and many 'SASE' offerings are still a bundle of separate tools with one logo.