SASE (Secure Access Service Edge, pronounced 'sassy') is a converged network and security architecture defined by Gartner in 2019. It combines five categories — SD-WAN (networking) plus SWG, CASB, ZTNA, and FWaaS (security) — delivered as a unified cloud service. The goal: replace dozens of legacy point products (firewalls, VPN concentrators, web proxies, MPLS) with a single cloud-native platform that provides secure access from anywhere to anywhere. SASE is the architectural answer to hybrid work, cloud-first applications, and Zero Trust. By 2026, more than 60% of enterprises have an active SASE strategy, though full-stack consolidation is still rare.

SASE combines two pillars and five categories: **Networking pillar:** (1) **SD-WAN (Software-Defined WAN)** — replaces MPLS with policy-driven internet routing across branch offices and home offices. **Security pillar (SSE):** (2) **SWG (Secure Web Gateway)** — modern proxy filtering web traffic, malware scanning, URL filtering, (3) **CASB (Cloud Access Security Broker)** — visibility and control of SaaS applications, (4) **ZTNA (Zero Trust Network Access)** — identity-based application access replacing VPN, (5) **FWaaS (Firewall as a Service)** — cloud-delivered firewall replacing on-premises appliances. Some vendors add: DLP, RBI (Remote Browser Isolation), DEM (Digital Experience Monitoring), DNS security.

**SASE** = SD-WAN + SSE. **SSE (Security Service Edge)** is the security-only subset of SASE, without the SD-WAN networking layer. Most enterprises buy SSE first because: (1) easier — doesn't require rewiring branch networks, (2) faster ROI — replaces VPN, firewalls, web proxies independently, (3) more vendor choice — many SSE specialists don't have SD-WAN, (4) less disruptive — SD-WAN integration is a separate decision. Pure SASE platforms (Zscaler, Cisco) bundle SD-WAN; SSE specialists (Netskope, Forcepoint, Palo Alto Prisma Access) often partner with SD-WAN vendors (Aruba, VMware, Versa). Most large enterprises end up with a 'best-of-breed' approach combining different vendors for SD-WAN and SSE.

Five SASE / SSE leaders: (1) **Zscaler** — pioneer SSE, comprehensive ZIA + ZPA + ZDX, premium pricing, market leader, (2) **Palo Alto Networks Prisma Access** — strong for existing Palo Alto firewall customers, comprehensive SASE, (3) **Netskope** — strong CASB heritage, broad cloud app catalogue, comprehensive SSE, (4) **Cloudflare One** — fast deployment, transparent pricing, popular with mid-market and digital-first companies, (5) **Cisco Umbrella + Secure Connect** — strong if you're a Cisco shop. Other notable: Microsoft Entra Internet/Private Access (rapidly maturing, M365-centric), Forcepoint ONE, Skyhigh Security, Versa Networks (strong SD-WAN heritage). Selection criteria: cloud app coverage, geographic POP density (latency), integration with existing identity (Entra ID, Okta), mature DLP and threat intelligence, pricing model.

Six-phase rollout (typical 18-36 months for enterprise): (1) **Inventory current state** — branches, VPN concentrators, web proxies, MPLS contracts, security stack, (2) **Identity foundation** — Entra ID/Okta with phishing-resistant MFA on every account; SASE depends entirely on identity, (3) **Replace VPN with ZTNA** — start with high-value applications, expand gradually, (4) **Replace web proxy with SWG** — TLS inspection, URL filtering, threat protection, (5) **Add CASB** — discover Shadow IT, enforce DLP on M365 and other SaaS, (6) **SD-WAN refresh** — typically aligned with MPLS contract renewals; replaces traditional WAN. Don't try to do everything at once. Common pattern: ZTNA + SWG first (replaces VPN + web proxy), then CASB and SD-WAN as separate projects. Total 5-10 year journey for large enterprises.

Benefits: (1) **Reduced complexity** — one platform instead of dozens of point products, (2) **Better user experience** — direct internet from branches/home, no backhauling, (3) **Stronger security** — consistent policy enforcement everywhere, (4) **Lower TCO** — eliminates appliances, MPLS, VPN concentrators over time, (5) **Faster deployment** — cloud-native rollout in weeks, not months. Limitations: (1) **Vendor lock-in** — full-stack SASE deeply integrated with one vendor, (2) **TLS inspection complexity** — required for visibility but creates privacy and compliance issues, (3) **Performance / latency** — POP coverage matters; insufficient regional presence creates problems, (4) **Identity dependency** — SASE security relies entirely on strong IdP; weak IdP = weak SASE, (5) **Cost** — premium SASE costs $30-80/user/month, much more than legacy stack on-paper, though TCO benefits compound over time.

Different concepts, often combined: **Zero Trust** is a *security philosophy* — 'never trust, always verify' for every access request. **SASE** is an *architecture / delivery model* combining networking and security as cloud services. SASE is a vehicle for delivering Zero Trust principles to distributed users and applications. Most SASE deployments are de facto Zero Trust deployments because ZTNA is a core SASE component. But Zero Trust is broader than SASE (covers identity, devices, data, internal segmentation), and SASE doesn't automatically deliver Zero Trust without proper policy design. Best approach: define Zero Trust strategy first, then choose SASE/SSE as the delivery mechanism for the network and access layers.