What to Look for in a SASE Provider

For MSPs and SMBs looking to modernize their network security stack, deciding on the best option is tough, and even more so with all the noise in the space. Many vendors offer some sort of SASE product, but the term has been stretched to the point where it can mean almost anything depending on who's selling it.

Done properly, Secure Access Service Edge converges networking and security into a single cloud-delivered service. It replaces the patchwork of point solutions that most organizations have accumulated over the years with a unified approach. But that's the promise. The reality of what vendors deliver varies significantly, and the gaps between them only tend to show up after the contract is signed.

Here's what to look for before you get there.

Questions for your Potential SASE Provider

Is it purpose-built or stitched together?

Many SASE platforms weren’t built but rather acquired. Stitching together a bunch of purchased point solutions, these vendors create a product that, for all intents and purposes, looks like SASE should. Although the billing is consolidated, the approach is not.

When security tools are forced together rather than built together, the seams show. You end up with multiple consoles, inconsistent policy enforcement, and telemetry that doesn't flow between components automatically. And you end up with more work, more overhead, and less  

Look for a purpose-built platform that was designed from the ground up so that each layer communicates with the others. Network telemetry feeds into detection. Firewall events surface into your SIEM. Access policies enforce consistently across users regardless of where they're working. When the pieces were designed to work together, they will do so more smoothly than the alternative.

What capabilities does it include?

SASE should cover more ground than solely VPN replacement. Seek solutions that addresses the full lifecycle of a network connection: encrypted tunneling, deep packet inspection, next-generation firewall, intrusion prevention, secure DNS, SSL inspection, web content filtering, and access control down to the user and device level. Each of those layers catches something the others won't.

Zero Trust Network Access (ZTNA) specifically deserves scrutiny. The phrase gets used loosely, but real ZTNA operates on a trust nothing, verify everything model, enforced through identity-based access policies and network microsegmentation. If a vendor's version of ZTNA sums to an always-on VPN with MFA added on top, that's important to know before you buy.

It's also worth asking how SASE connects to the rest of your security stack. A network security solution that doesn't talk to your endpoint protection or SIEM leaves gaps in event correlation that attackers can slip through. The more integrated the platform, the fewer places there are to hide.

How fast does it deploy, and how hard is it to manage?

Security tools that take weeks to stand up introduce risk during the deployment window. Tools that are difficult to configure on an ongoing basis create additional risks though misconfigurations, unchecked policies, and complexity avoidance.

Cloud-native SASE remediates most of the hardware dependency that made traditional network security slow to deploy. Instead of racking servers, maintaining firmware, and standing up location-dependent VPNs, a single lightweight agent on the device handles connectivity and enforcement, and policies are managed centrally.

For MSPs, the immediate impact is scale. Onboarding a new client or a new user should take minutes, not hours. One MSP described slimming their operations from eight networking security tools per machine to just SASE and his RMM, cutting onboarding time to under an hour. That's not a minor efficiency gain. That's fundamentally different operations.

How is the infrastructure built, and where is it?

Cloud-nativity doesn't mean much if the infrastructure is thin. A SASE solution routes all user traffic through its global network, so the performance of that network directly affects the experience of every user on it. Look for a solution with multiple points of presence (PoPs) dispersed both nearby and worldwide, plus intelligent traffic routing and automatic failover. If users in different regions are taking long paths to reach nearby destinations, that latency shows up in productivity.

Some SASE providers don’t even host their own infrastructure, instead relying on other vendors to maintain their SASE. Any lapses in uptime then waterfall down on to MSPs and the SMBs they manage.  

The best SASE platforms use their own private fiber backbone across dozens of PoPs worldwide, with intelligent routing to optimize performance and automatic failover built into the architecture. Connectivity is always on: no manual VPN login, no dropped sessions when a node goes offline.

How will SASE fit in your broader security program?

This question separates a point solution purchase from a strategic one. SASE handles the network layer, but a complete security program also needs endpoint protection, threat detection and response, event logging, and compliance management. If each of those functions runs independently, you're managing multiple vendor relationships, multiple data streams, and multiple response workflows.

That's where a platform approach changes the math. Todyl's security platform combines SASE, Endpoint Security (EDR + NGAV), cloud SIEM, MXDR, GRC, and Security Automation into a single-agent deployment with one management interface. Telemetry from the network flows directly into the SIEM. Detections from the endpoint inform network access decisions. The whole system shares context in a way that siloed tools cannot replicate.

Wayne Stanley, President and CEO of Iron Dome, put it plainly: "Switching to Todyl helped us achieve every initial goal and more. With Todyl, my team can deliver better security through a single pane of glass with robust reporting that we didn't have with multiple vendors." Read the full case study.

That kind of outcome is the difference between a vendor that checks boxes and a partner with a platform that actually reduces risk.

Want to see how Todyl's SASE platform works in practice? Book a demo with a platform specialist.