What Is SASE? Architecture, Components, and When It Fits
SASE brings wide-area networking and cloud-delivered security into a coordinated access architecture. Learn how it relates to SSE and SD-WAN, what problems it addresses, and when it may fit.
By Mark Poulton
What Is SASE? Architecture, Components, and When It Fits
Secure Access Service Edge (SASE, commonly pronounced “sassy”) is an architectural approach that brings wide-area networking and security capabilities together for users, sites, and applications distributed across the internet and cloud. It is intended to make access policy and network paths work coherently beyond a single office perimeter. SASE is not one product, a guarantee of better security or performance, or a requirement for every organisation.
The term was introduced by Gartner in 2019. The Gartner glossary describes the category; actual services differ in which functions they include, where those functions run, and how they integrate with an organisation's existing network and identity systems.
What does SASE bring together?
SASE connects two related concerns: how traffic reaches an application, and what security policy applies along that access path. A SASE design may combine SD-WAN or other WAN connectivity with cloud-delivered security services and identity-aware access controls. The components can be supplied as one service, integrated products, or a combination of existing and new systems.
| Term | Place in the model |
|---|---|
| SD-WAN | Provides policy-based connectivity and traffic steering across WAN links. It addresses the networking path; it is not the whole SASE security model. |
| Security Service Edge (SSE) | Commonly describes the cloud-delivered security side of the model, such as secure web gateway, cloud access security broker, and zero-trust network access capabilities. Product definitions vary. |
| ZTNA | Applies identity- and context-based access to specific applications or resources rather than granting broad network access by default. It is a capability, not a complete security strategy. |
| SWG and CASB | A secure web gateway applies controls to web traffic; a cloud access security broker provides visibility or policy for supported cloud services. Their coverage depends on configuration and service. |
| FWaaS | Cloud-delivered firewall capabilities for selected traffic. Its role and packaging vary across SASE and SSE offerings. |
SASE is often explained as the convergence of SD-WAN and SSE. That is a useful distinction, not a promise that every service contains the same components or that those components share one policy engine. Evaluate the actual access path, enforcement points, identity inputs, logging, and ownership.
What problem is SASE intended to address?
Many organisations now support people working from offices, homes, and other locations while their applications span data centres, SaaS, and public cloud. A design built around sending every connection through one central office can add unnecessary routing steps. Separate network and security products can also create policy gaps, duplicated work, and unclear ownership across teams.
SASE provides a way to consider connectivity and security together around users, applications, and access context. Depending on the design, selected traffic may be routed to a nearby cloud security point, a private application, or another network location. The goal is a suitable and supportable path with the required controls, not simply to move every function to the cloud.
Potential improvements such as simpler operations, more consistent policy, or better application experience depend on architecture, provider coverage, integration, configuration, and the organisation's ability to operate the service. They are outcomes to validate, not properties conferred by the SASE label.
Is SASE the same as SSE or SD-WAN?
No. SD-WAN focuses on WAN connectivity and traffic policy. SSE focuses on cloud-delivered security capabilities. SASE brings networking and security together in an access architecture; it is broader than either term alone. An organisation may use SD-WAN without SASE, SSE without replacing its WAN, or a combined SASE service. The SD-WAN Deep Dive and SD-WAN security article explain the networking and security boundaries in more detail.
Cloud-delivered security by itself does not automatically constitute SASE. The design also needs to account for connectivity, access paths, identity and policy, service integration, and operations. Nor does adopting SASE require replacing an existing SD-WAN or every security product at once.
When might SASE be worth evaluating?
It may be worth evaluating when an organisation has a clear access or operating problem across distributed users, sites, and applications, and current network and security controls are difficult to coordinate. Start with a specific workflow: for example, how a remote employee reaches a private application, or how a branch accesses SaaS while required security events remain visible to the response team.
SASE may be unnecessary if existing remote-access, WAN, and security services already meet the requirements and can be operated effectively. A narrower change, such as improving a particular identity-aware access path, may be more appropriate than adopting a broad platform. Consider contract commitments, application dependencies, data handling, provider service locations, resilience, skills, and transition effort before deciding.
The next articles in this sequence examine remote and distributed work use cases and SASE's strategic role and organisational readiness. Detailed architecture and rollout belong in the SASE implementation and architecture article, while provider comparisons belong in the SASE vendor evaluation.
Conclusion
SASE is a way to coordinate WAN connectivity and cloud-delivered security around distributed access. Its value depends on the problem being addressed and on how the service handles paths, identity, policy, integration, resilience, and operations. Define those requirements first; then decide whether SASE, a narrower capability, or the existing design is the better fit.