What Is SASE? The Complete Guide to Secure Access Service Edge

Remote work is now permanent infrastructure, not an edge case. Your users connect from home offices, hotels, coffee shops, and branch sites spread across every time zone, and the tools that secured that access a decade ago were never designed to handle it. The architecture that replaced them is called SASE, and the global market for it is projected to reach $28.5 billion by 2028.  

Understanding what SASE actually is, how it works, and what it changes for your organization or your clients is worth your time. This guide covers everything, from the basic definition to the technical components to real-world decisions you need to make.

Quick answer: SASE, pronounced "sassy," stands for Secure Access Service Edge. It is a cloud-native architecture that combines network connectivity, specifically SD-WAN, with a full stack of security services, including ZTNA, SWG, CASB, and FWaaS, into a single unified platform delivered from the cloud. SASE secures users wherever they are without backhauling traffic through a central data center or appliance.

What Is SASE? The SASE Definition Explained for Every Audience

SASE stands for Secure Access Service Edge. Gartner analysts Neil MacDonald and Joe Skorupa coined the term in July 2019 to describe a convergence that the market had been moving toward for years: combining wide-area networking with cloud-delivered security into one integrated architecture.

Before SASE, organizations handled networking and security as separate disciplines. Your network team managed SD-WAN or MPLS circuits and VPN concentrators. Your security team managed firewalls, web proxies, and cloud access brokers. When a user in a remote office tried to reach a SaaS application, traffic might route through a data center two time zones away just to hit a firewall before going back out to the internet. Every additional hop added latency. Every separate system added management overhead. And none of it was built for a world where most users work outside the traditional office perimeter.

SASE eliminates that separation. It delivers both the network and the security stack from a distributed cloud infrastructure, meaning every user, regardless of location, gets consistent performance and consistent policy enforcement from the nearest point of presence.  

The SASE meaning in practice is simpler than the technical definition: it is the architecture that lets your organization extend fast, secure, policy-enforced access to every user and device, wherever they are, from a single platform you do not have to maintain on-premises.  

The History Behind SASE: Why the Architecture Had to Change

To understand why SASE exists, you need to understand what it replaced and why that model stopped working.

The traditional network security model was built around a perimeter. You had a headquarters, a data center, and a firewall sitting at the boundary between your trusted internal network and the untrusted internet. Remote users connected through a VPN, which extended a tunnel from their device back to that perimeter. Everything inside the perimeter was implicitly trusted. Everything outside it was not.

That model worked when most users sat in the office most of the time. Remote access was occasional. Cloud applications were a small portion of the workload. The internet was primarily a threat surface, not the primary transport for business-critical traffic.

Three things changed that model permanently.

1. Cloud adoption moved the data. Applications migrated from on-premises servers to SaaS platforms and public cloud infrastructure. The data your users needed was no longer inside your perimeter. Routing all traffic through a central chokepoint to reach applications that were hosted outside that perimeter was genuinely backward, adding latency without adding security.
2. Remote work became the default. The shift to hybrid and distributed work arrangements made remote access a primary use case, not an edge case. VPN infrastructure that worked for occasional access under the old model cracked under the daily load of a full workforce operating outside the office.
3. The perimeter disappeared as a meaningful concept. When your users are everywhere, your applications are in the cloud, and your data flows through SaaS platforms you do not host, the idea of a fixed perimeter to defend became obsolete. Security had to follow the user and the workload, not sit at a fixed boundary.  

SASE is the architectural answer to that shift. It moves security enforcement to the cloud, distributes it globally, and applies it to every connection regardless of where the user is, what network they are on, or what application they are reaching.

What Is SASE in Cybersecurity? The Security Model Explained Simply

At its core, SASE in cybersecurity is about replacing perimeter-based security with identity-based, cloud-delivered security enforcement.

Traditional security asked: is this device inside or outside our network perimeter? SASE asks: who is this user, what device are they on, what is the health of that device, what resource are they trying to reach, and does current context support granting that access?

Every connection through a SASE platform is evaluated against those questions in real time. A user who has authenticated with valid credentials on an enrolled device in good health gets access to the specific applications and resources their role permits. A user on an unmanaged personal device, or one that has not received recent security updates, gets blocked at the access layer before they can reach any internal or cloud resource.

That shift from location-based trust to identity-based trust is the security principle called Zero Trust. SASE is the architectural framework that makes Zero Trust operational for distributed organizations.  

For MSPs managing dozens or hundreds of client environments, SASE changes the operational model entirely. Instead of configuring and maintaining VPN appliances at each client site, you manage access policies through a single cloud platform. Instead of backhauling client traffic through infrastructure you maintain, traffic routes through a globally distributed network of cloud points of presence. Instead of hoping clients patch their VPN appliances before the next critical CVE is exploited, there is no on-premises infrastructure to patch.  

The 5 Core SASE Components Every Technical Engineer Needs to Know

SASE is not a single product. It is a converged architecture built from five distinct technologies that work together. Understanding each component and what it contributes is essential for evaluating whether a SASE platform will genuinely meet your requirements or whether it is simply co-locating separate tools under one vendor name.

SASE Component 1: Zero Trust Network Access (ZTNA): The VPN Replacement

Zero Trust Network Access is the component that replaces the traditional VPN as the mechanism for remote access. The distinction matters, and it is worth being specific about why.

A VPN authenticates a user once and grants broad access to the network segment behind it. There is no ongoing verification, no device posture check after the initial connection, and no enforcement of least-privilege access once the session is established. A stolen credential gives an attacker the same broad access as a legitimate employee.

ZTNA operates from a fundamentally different assumption: nothing is trusted by default, not the user, not the device, not the network the request originates from. Access requires continuous verification of identity, validation of device health and security posture, and evaluation of the context surrounding the request. Once granted, access is scoped to the specific resource the user needs through least-privilege enforcement. Internal resources remain hidden from and inaccessible to users who have not been explicitly authorized for that specific application.  

Todyl's SASE implements ZTNA through its Secure Global Network (SGN) cloud platform, using a deny-by-default design that integrates with identity providers to allow users access only to the specific applications and services their role permits. The SGN enforces this at the packet level, preventing lateral movement to other devices or systems that the user was not explicitly authorized to reach.  

The business difference for MSPs is concrete. When Blueclone Networks needed to rebuild secure remote access after a ransomware incident, they moved clients from vulnerable VPN and RDP connections to Todyl's SASE. Milan Baria, Founder and CEO of Blueclone Networks, described what their end users experienced: "End users have shared that they love that they log in to their PC and it just works, whether they are in one of the office locations, at home, or traveling.

That experience reflects what ZTNA through SASE actually delivers: consistent access that is both more secure and more seamless than what a VPN provides.

SASE Component 2: Secure Web Gateway (SWG): Protecting Users from Web-Based Threats

A Secure Web Gateway filters and inspects all internet-bound traffic before it reaches its destination. It blocks access to malicious sites, enforces acceptable use policies, prevents data exfiltration through web channels, and applies corporate security policy regardless of where the user is connecting from.

In a traditional architecture, SWG capability is delivered through on-premises appliances that only protect users when they are inside the corporate network or have traffic backhauled through the corporate proxy. A remote worker connecting directly to the internet, bypassing the VPN for performance reasons, receives no protection from that appliance.

In a SASE architecture, SWG runs inline at the cloud point of presence that handles the user's traffic. Protection follows the user, not the office. An employee connecting from a hotel gets the same filtering, the same threat inspection, and the same policy enforcement as one sitting at a corporate desk.  

Todyl's SGN implements web proxy capabilities including SSL inspection, URL allow and deny rules, content filtering at the URL level rather than just the domain level, and download scanning that inspects files before they reach endpoints. The Detection Engineering team continuously updates threat intelligence to block malicious destinations before they ever reach users.  

SASE Component 3: Cloud Access Security Broker (CASB): Governing Cloud Application Usage

A Cloud Access Security Broker sits between users and the cloud applications they access. It provides visibility into how those applications are used and enforces security policy over what data moves through them. As SaaS adoption has grown, the volume of sensitive data flowing through cloud applications has expanded well beyond what traditional perimeter tools can see or control.

CASB addresses three fundamental problems that grow with SaaS adoption. First, shadow IT: employees use cloud applications that IT has not approved and does not know about. Second, data governance: sensitive information gets shared, downloaded, or stored in ways that violate policy. Third, compliance: regulated data ends up in applications that do not meet the compliance requirements for that data type.

In a SASE platform, CASB capability is integrated with the same traffic inspection infrastructure that handles ZTNA and SWG enforcement. Policy is centralized and consistent across all cloud application access, not managed through separate tools with separate consoles.

SASE Component 4: Firewall-as-a-Service (FWaaS): Enterprise Firewall Without the Hardware

Firewall-as-a-Service moves traditional firewall capabilities to the cloud, delivering traffic inspection and policy enforcement without physical hardware at each location. Unlike hardware-based firewalls tied to specific sites, FWaaS inspects traffic from any source to any destination and applies consistent policy across the entire organization regardless of where users or resources are located.

For MSPs managing multi-site clients, FWaaS eliminates the capital expense and maintenance burden of deploying and patching firewall hardware at each location. Policy is managed centrally and enforced at the cloud edge, reducing both procurement complexity and the operational overhead of keeping site-specific infrastructure current.

Todyl's SGN implements a next-generation firewall that allows policy control down to the user and device level. Policies can be set using IP addresses, hostnames, specific devices, ports, protocols, applications, geographies, and time windows. Identity integration enables MFA enforcement for specific resource access, addressing one of the core weaknesses of traditional VPN architectures where a user decides whether to connect at all.  

SASE Component 5: SD-WAN: The Networking Foundation That Enables It All

Software-Defined Wide Area Networking is the connectivity layer that underpins SASE. It uses software to manage and optimize traffic routing across the wide-area network, ensuring users reach applications efficiently regardless of where they connect from.

In traditional architectures, network traffic follows fixed paths that do not adapt to changing conditions. SD-WAN introduces dynamic traffic management, directing high-priority application traffic over the most efficient available path in real time. For distributed organizations with multiple branches and a remote workforce, this translates to consistent application performance and a significantly better user experience.

SD-WAN alone is a networking tool. Paired with the security stack that SASE delivers, it becomes the foundation for a unified architecture where traffic optimization and security enforcement work from the same platform and the same policy engine.

How SASE Works: Following a Packet Through the Architecture

Understanding what SASE does conceptually is useful. Understanding how it works technically is what separates a surface-level grasp from the depth you need to evaluate platforms and explain the architecture to clients.

Todyl's SGN provides a concrete example of how a production SASE platform processes every connection. Following a single packet through the system illustrates how the components work together.

Step 1: Encrypted connection establishment. When a packet leaves a device, it travels over an encrypted connection to the SGN cloud. This encryption protects data and devices on untrusted networks, including hotels, airports, co-working spaces, and coffee shops, against malicious hotspots and data interception.  

Step 2: Policy Enforcement Module. The initial gatekeeper applies configurations, drops traffic destined for known malicious destinations maintained by Todyl's Detection Engineering team, and performs integrity checks on packets entering the cloud.  

Step 3: Deep Packet Inspection (DPI) Engine. The DPI Engine identifies and classifies the packet by application type, analyzing it against hundreds of application classifications built into the SGN. This classification drives the subsequent firewall and policy decisions.  

Step 4: Next-Generation Firewall. After classification, the packet passes through the SGN Firewall, where access policies are enforced at the user and device level. MFA requirements apply here for sensitive resources. A member of the finance team, for example, authenticates to access accounting applications before the connection proceeds.  

Step 5: Intrusion Prevention and Detection. If the packet clears the firewall, it proceeds to the IPS and IDS layer. The IPS proactively identifies and drops a broad spectrum of malicious traffic, including exploits, command-and-control callbacks, protocol abuse, and exfiltration attempts. The IDS reports suspicious activity to the SIEM for detection and investigation.  

Step 6: Secure DNS. DNS traffic routes through the Secure DNS module, which identifies and redirects requests to malicious hostnames before a connection is ever established. DNS over HTTPS and DNS over TLS, frequently used by threat actors to evade standard controls, can be blocked at the firewall layer.  

Step 7: Web Proxy. HTTP and TLS traffic passes through the web proxy, where SSL inspection, URL filtering, content filtering, and download scanning are applied before the packet reaches its destination.  

Step 8: Routing and SIEM integration. The packet routes to its destination, with the IP address changed to Todyl's for privacy. Throughout every step, telemetry and logs flow to the SIEM, supporting continuous threat detection and compliance documentation.  

The result is that every connection made through the Todyl SGN is inspected, filtered, and logged before it reaches its destination, from any device, on any network, anywhere in the world.

SASE Architecture: Single-Vendor vs. Dual-Vendor Approaches

One of the most practical decisions in SASE adoption is whether to pursue a single-vendor SASE platform or assemble a dual-vendor approach combining a separate SD-WAN and SSE (Security Service Edge) solution.

Single-vendor SASE delivers the full architecture from one platform with one management console, one policy engine, one billing relationship, and one place to look when something needs attention. For MSPs managing multiple clients, this model dramatically simplifies operations. Policies are consistent across the entire platform. Adding a new client does not require configuring integrations between systems. Reporting, logging, and visibility all come from one place.

Dual-vendor SASE gives organizations the ability to select best-of-breed SD-WAN and best-of-breed SSE independently. The trade-off is integration complexity, management overhead, and the risk of policy drift between systems that were not designed to share a single data plane.

For most MSPs and SMBs, the operational efficiency of single-vendor SASE outweighs the theoretical customization benefits of dual-vendor approaches. Gartner projects the SASE market will reach $28.5 billion by 2028, growing at 26 percent annually, with demand split between single-vendor platforms and dual-vendor approaches. The trend toward platform consolidation is consistent across the market as organizations reduce the number of vendors they need to manage.

Paul Havens, CEO of IT Haven, described the consolidation impact directly: "Before Todyl, we were using about 8 tools per machine, which was a hassle to image and onboard. Now, we just use Todyl and our RMM, and have cut our onboarding time down to less than an hour. It's just as easy for offboarding.

SASE vs. VPN: Why Legacy Remote Access Is Failing Your Clients

The case against continuing to run VPN infrastructure is not theoretical. The vulnerability record on major VPN platforms is consistent and well-documented, and the security model is structurally flawed regardless of patching status.  

VPNs were built for occasional remote access in a world where most users sat in an office most of the time. They authenticate a user once and grant broad access to a network segment. There is no ongoing verification, no device posture check, and no enforcement of what that user does once the session is established.

Ransomware operators and credential theft campaigns specifically target VPN access because the return on a single valid login is high. Gaining access to a VPN endpoint in a typical SMB flat network means gaining access to most of it.

Here is how VPN and ZTNA compare across the dimensions that matter most:

Three specific forces have converged to make VPN replacement an urgent operational decision rather than a future roadmap item:

1. ‍Remote and hybrid work made consistent remote access a daily requirement rather than an occasional edge case. VPN infrastructure provisioned for occasional use is now carrying the full weight of a distributed workforce. Performance issues drive users to work around it, and a VPN that users bypass provides no protection for the activity it cannot see. ‍
2. Cyber insurance underwriters have tightened requirements around access control, MFA enforcement, device posture checking, and session-level logging. A legacy VPN satisfies few of those requirements natively. Organizations that cannot demonstrate adequate remote access controls face higher premiums, coverage exclusions, or outright denials. ‍
3. Compliance frameworks in healthcare, defense contracting, finance, and professional services have provisions that speak directly to how remote access is managed, logged, and audited. HIPAA requires session-level logging of access to electronic protected health information that a VPN cannot provide. CMMC 2.0 requires device posture validation and access logging that map directly to ZTNA capabilities. PCI-DSS v4.0 requires that access to cardholder data environments be scoped, logged, and documented with a level of granularity that broad VPN access cannot deliver.  

MSPs who can demonstrate that SASE closes all three gaps simultaneously have a concrete differentiator in competitive conversations with clients in regulated industries.  

SASE Benefits: What Changes When You Deploy the Architecture

The operational and security benefits of SASE are real, but they land differently depending on who is asking about them. Here is how the benefits map across the audiences who care about them most.

For MSPs and Partners: SASE as a Practice-Builder

SASE built on a multi-tenant platform changes what MSPs can deliver and how efficiently they can deliver it. Single-pane-of-glass management across every client eliminates the tool fragmentation that makes scaling a security practice expensive. Consistent policy enforcement across all clients means security outcomes do not vary by how recently a specific appliance was patched or updated.

SASE also becomes a differentiated service offering. The compliance alignment with HIPAA, CMMC, PCI-DSS, and other frameworks gives MSPs a concrete security narrative for regulated-industry clients. That narrative translates to competitive wins against providers who cannot articulate what they do for remote access security and compliance beyond "we have a VPN."

Aaron Zimmerman, President and CEO of TotalCare IT, described what platform consolidation meant for his business: "Todyl has been invaluable to our growth over the past year. The team is more than just another vendor, they're a business partner we can turn to for crucial cybersecurity knowledge and support whenever we need it.

For Technical Engineers: SASE as Operational Simplicity

For engineers responsible for deploying and maintaining security infrastructure across multiple environments, SASE eliminates the patching cycles, hardware refresh timelines, and integration work that legacy architectures demand.

Todyl's SGN deploys in minutes. Connectivity, threat inspection, ZTNA enforcement, and SIEM logging all activate from the same agent, with no on-premises hardware to rack, configure, or monitor. New clients enroll through a consistent onboarding process rather than a custom provisioning exercise for each site.  

The policy model supports granular control at the user, device, application, protocol, geography, and time-window level, giving engineers the specificity they need without the complexity of managing separate firewall, proxy, and access control systems.

For SMBs and End Users: SASE as Invisible Security

For the end users at the center of the architecture, a well-deployed SASE platform is largely invisible. Connections are faster because traffic routes to the nearest point of presence rather than backhauling through a central appliance. Access is consistent regardless of network, device, or location. Security does not interrupt the workflow.

That user experience is not a secondary concern. Users who find security tools painful work around them. Bypassing a VPN for performance reasons is one of the most common and most dangerous behaviors MSPs encounter in SMB environments. SASE removes the performance incentive to do it.  

For VARs: SASE as a Long-Term Revenue Model

For VARs and channel partners, SASE represents a shift from hardware-based point-in-time transactions to recurring managed security services. The platform model creates ongoing engagement with clients, continuous opportunities to expand coverage, and a service portfolio that grows with client needs rather than requiring hardware refreshes to generate revenue.  

What Is SASE for MSPs? The Multi-Tenant Operational Model

MSPs interact with SASE differently than organizations managing their own environments, and the platform has to be designed for that reality from the ground up, not adapted for it as an afterthought.

The MSP model requires clean tenant separation so one client's data and policies are never visible to another. It requires a single interface that allows efficient management across dozens or hundreds of client environments without context-switching overhead. It requires pricing and licensing models that let MSPs build profitable service offerings, not just consume a product at retail. And it requires fast onboarding that lets MSPs deploy new clients quickly without burning engineering hours on configuration work that should be automated.

Todyl's SASE is built specifically for the MSP delivery model, with multi-tenant architecture, unified management across the full platform including SIEM, MXDR, Endpoint Security, and GRC, and direct integration with RMM and PSA platforms that MSPs use to run their businesses.  

Wayne Stanley, President and CEO of Iron Dome, described the single-pane-of-glass operational model: "Switching to Todyl helped us achieve every initial goal and more. With Todyl, my team can deliver better security through a single-pane-of-glass with robust reporting that we didn't have with multiple vendors.

SASE and Zero Trust: How They Work Together

SASE is the architectural platform. Zero Trust is the security model. They are complementary, not synonymous, and understanding how they relate matters when you are making purchasing and architecture decisions.

Zero Trust is a philosophy about how access should be granted: trust nothing by default, verify everything continuously, enforce least-privilege access at every layer. It is not a product and it is not a checklist. It is an operating principle.

SASE is the architecture that makes Zero Trust operational at scale. ZTNA within SASE enforces the deny-by-default access model at the application layer. The SWG and FWaaS components enforce policy on every connection regardless of network. The integrated SIEM logging provides the audit trail and visibility that Zero Trust requires to be verifiable.

Todyl's SGN was built from inception on Zero Trust principles, implementing them at the LAN, WAN, and cloud layers simultaneously through both ZTNA for external access control and LAN Zero Trust (LZT) for internal network segmentation. LZT functions as a firewall for the internal network, isolating devices from each other so that a compromised device cannot communicate with or see other devices on the same network.  

The four Zero Trust principles as defined by Forrester, all of which the SGN addresses, are: assume every network is hostile, create an invisible network to operate in, segment and isolate users and applications, and deemphasize the physical network perimeter in favor of implementing security everywhere.  

SASE Use Cases: Where the Architecture Delivers the Most Value

SASE addresses a range of specific operational challenges. Here are the use cases where it delivers the clearest, most measurable outcomes.

• ‍Replacing VPN infrastructure at scale. For MSPs moving multiple clients off legacy VPN simultaneously, SASE provides a single platform to migrate to rather than a per-client configuration exercise. The phased migration approach, enrolling new users directly into SASE while validating policy coverage before transitioning existing users, keeps existing access intact throughout the process.  ‍
• Securing remote and hybrid workers. Every remote connection gets the same threat inspection, URL filtering, DNS security, and access control as an on-premises connection. No split-tunneling decision, no unmonitored direct-to-internet activity, no performance degradation from backhauling traffic.  ‍
• Meeting compliance requirements for regulated industries. HIPAA, CMMC, PCI-DSS, and SOC 2 all have provisions related to access control, session logging, and continuous monitoring. SASE delivers the granular access control and session-level logging those frameworks require, with telemetry feeding directly into the SIEM for audit reporting.  ‍
• Eliminating hardware refresh cycles. Every VPN appliance, firewall, and proxy device that SASE replaces is a hardware refresh cycle that disappears from the capital expense budget. Cloud-native infrastructure updates continuously without scheduled maintenance windows. ‍
• Supporting cyber insurance requirements. Insurers increasingly require documented evidence of MFA enforcement, device posture checking, session-level access logging, and consistent security policy across all users. SASE delivers all of those capabilities from a single platform, making it significantly easier to produce the documentation underwriters ask for.  ‍
• Scaling security across growing client bases. Adding a new client to a SASE platform means configuring access policies, not provisioning and hardening new infrastructure. The MSP operational model scales with the platform rather than requiring proportional increases in engineering effort.

SASE vs. SSE: Understanding the Relationship

Security Service Edge, or SSE, is a subset of SASE that includes only the security components: ZTNA, SWG, CASB, and FWaaS. It excludes the networking layer, specifically SD-WAN.

Gartner defined SSE as a distinct category in 2021 to describe organizations that were adopting the security components of SASE without replacing their existing WAN infrastructure. SSE is effectively SASE minus the connectivity layer.

For organizations with existing SD-WAN investments they want to retain while adding cloud-delivered security enforcement, SSE represents a viable path. For organizations building security architecture from scratch, or those replacing both their networking and security infrastructure simultaneously, single-vendor SASE provides the tighter integration and operational simplicity that separate SD-WAN and SSE stacks cannot match.

The practical question when evaluating platforms is whether the vendor's networking and security components are genuinely integrated on a single data plane, or whether they are co-sold products with API-based connections between them. The difference matters for policy consistency, correlation quality, and the operational overhead of managing the environment over time.

How to Evaluate a SASE Platform: Eight Questions That Actually Matter

Evaluating SASE platforms is not a features checklist exercise. The questions that separate strong platforms from mediocre ones are operational.

1. ‍Is it genuinely integrated or just co-located? Does the platform share a single policy engine and data plane across networking and security components, or are separate products loosely connected through APIs? ‍
2. What is the point-of-presence footprint? How many PoPs are deployed, where are they located, and what is the performance story for your clients in specific geographies? A PoP network that does not cover your clients' locations creates the same latency problems you are trying to solve. ‍
3. What is the multi-tenant model? If you are an MSP, can you manage all clients from a single console with clean data separation? How does onboarding a new client actually work in production, not in a demo? ‍
4. What integrations does it support natively? Identity providers, RMM platforms, PSA tools, SIEM systems, and EDR platforms all need to share data with SASE for the architecture to function as intended. How many of those integrations are pre-built versus custom work?
5. ‍How does detection content stay current? Who maintains the threat intelligence, detection rules, and malicious destination blocklists? At what cadence are they updated, and what qualifications does that team have? ‍
6. What does the migration path from VPN look like? A platform that requires a hard cutover introduces unnecessary risk. Phased migration that keeps existing access intact while validating new policies is the standard for any production deployment. ‍
7. How does it feed your SIEM and compliance posture? SASE telemetry should flow directly into your SIEM for correlation and compliance documentation. If that requires custom configuration for each client, the operational overhead negates some of the efficiency gains. ‍
8. What is the total cost of ownership, not just the license fee? Include the hardware you are retiring, the engineering hours you are freeing, and the patching and maintenance work that disappears from your calendar.

Frequently Asked Questions: What Is SASE?

What does SASE stand for?

SASE stands for Secure Access Service Edge. The term was coined by Gartner analysts in July 2019 to describe a converged architecture that combines wide-area networking, specifically SD-WAN, with cloud-delivered security services including ZTNA, SWG, CASB, and FWaaS into a single unified platform.

How is SASE pronounced?

SASE is pronounced "sassy." You will occasionally hear it pronounced letter-by-letter, but "sassy" is the accepted industry pronunciation.

What are the 5 core components of SASE?

The five core components of SASE are Zero Trust Network Access (ZTNA), Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), Firewall-as-a-Service (FWaaS), and Software-Defined WAN (SD-WAN). The first four make up the security service edge (SSE) layer. SD-WAN provides the networking foundation that underpins the entire architecture.

What is the difference between SASE and a VPN?

A VPN authenticates a user once and grants broad network access. SASE enforces continuous verification of identity, device health, and context before granting access, and limits that access to the specific resources the user is authorized to reach. VPNs provide no inspection of traffic through the encrypted tunnel, no device posture checking, and minimal logging. SASE delivers full session-level logging, inline threat inspection, and least-privilege access enforcement from a cloud-native platform with no on-premises hardware to maintain.  

What is the difference between SASE and Zero Trust?

Zero Trust is a security philosophy: trust nothing by default, verify everything continuously, enforce least-privilege access at every layer. SASE is the architectural framework that makes Zero Trust operational at scale for distributed organizations. ZTNA, one of the five core SASE components, is the specific mechanism that implements Zero Trust access enforcement. The two concepts are complementary. SASE is the platform. Zero Trust is the principle the platform operationalizes.

What is the difference between SASE and SSE?

SSE (Security Service Edge) is a subset of SASE that includes only the security components: ZTNA, SWG, CASB, and FWaaS. It excludes the SD-WAN networking layer. Organizations with existing WAN infrastructure they want to retain may adopt SSE to add cloud-delivered security without replacing their networking. SASE includes both the security layer and the networking layer in a single converged platform.

Is SASE only for large enterprises?

No. The Mordor Intelligence 2026 SASE market report projects that small and medium enterprises will post the fastest growth rate through 2031 at 20.66% CAGR, as managed service providers offer user-based monthly subscriptions that eliminate the need for large appliance purchases. For SMBs, MSP-delivered SASE provides enterprise-grade security architecture at a per-user service fee without the capital investment or staffing burden of building it internally.

How does SASE help with compliance?

SASE supports compliance frameworks including HIPAA, CMMC 2.0, PCI-DSS, and SOC 2 through several specific capabilities. ZTNA provides the granular, application-level access control and session-level logging those frameworks require. The SWG and FWaaS components enforce data protection and access policies. The SIEM integration provides continuous monitoring, audit trails, and compliance reporting. Organizations can demonstrate control over who accessed what, from what device, and when, answering the access logging questions that compliance audits ask.  

What is the SASE market size?

The SASE market was valued at approximately $15.54 billion in 2026 and is projected to reach $39.14 billion by 2031 at a 20.29 percent compound annual growth rate. Gartner projects the market will reach $28.5 billion by 2028 at 26 percent CAGR.

Take the Next Step: See SASE in Action for Your MSP or Business

Todyl's SASE delivers fast, secure, and reliable connections for users everywhere through the Secure Global Network cloud platform, with Zero Trust enforcement built in from the ground up. ZTNA, next-generation firewall, IPS/IDS, secure DNS, web proxy, and SSL inspection run as integrated layers that every connection passes through, feeding telemetry directly into the Todyl SIEM for continuous detection and compliance documentation.

For MSPs, SASE is one module in a unified platform that also includes AI-Powered SIEM, MXDR, Endpoint Security, SOAR, and GRC, all managed from a single interface designed for multi-tenant service delivery.

Book a demo to see Todyl SASE in action and find out how fast you can move clients off VPN infrastructure and onto a Zero Trust architecture built for the way distributed organizations actually work.

Not ready to talk yet? These resources take you deeper:

• VPN Is Dead: Why MSPs Are Moving to SASE : The full case for VPN replacement, including the migration playbook

• A Closer Look at Todyl's SASE and Zero Trust Network Access : The technical deep-dive on how the SGN processes every connection

• A Closer Look at Todyl's Zero Trust Strategy and Capabilities: ZTNA and LAN Zero Trust explained in full

• Improving Resilience Post-Ransomware: Blueclone Networks Case Study: A real-world example of SASE deployed after a ransomware event

• Explore Todyl's Platform Overview: See how SASE fits into Todyl's unified security architecture

• Explore Todyl Pricing: Find the right package for your business or client portfolio