What is SASE?

Legacy enterprise networking backhauled all traffic, including internet-bound traffic, through a hub-and-spoke MPLS network to a central data center where the security stack, firewalls, web gateways, DLP appliances, actually lived. That design made sense when most users worked from a handful of office locations, but it adds latency and cost for a distributed, cloud-first, remote-heavy workforce whose traffic increasingly goes to SaaS applications that have nothing to do with the corporate data center. SASE, a term Gartner coined in 2019, restructures this by moving the entire security stack into the cloud and delivering it from points of presence geographically close to wherever the user actually is, so a remote employee's traffic gets inspected a few milliseconds away instead of routed halfway around the world to headquarters.

The architecture bundles several previously separate products into one platform with unified policy and logging. SD-WAN handles intelligent routing and traffic optimization across a mix of MPLS, broadband, and cellular links. A secure web gateway inspects and filters general internet-bound traffic for malware and policy violations. CASB extends visibility and control specifically over SaaS and cloud application usage, catching shadow IT and enforcing data-handling policy. ZTNA replaces broad VPN access with per-application, identity-verified connections to private corporate resources. Firewall-as-a-service delivers the equivalent of an NGFW's inspection and blocking capability from the cloud edge rather than a physical appliance. A well-implemented SASE platform processes traffic through these functions in a single pass rather than chaining separate inline appliances, reducing the latency penalty that stacking discrete security tools traditionally added.

Vendors approach convergence differently: some, like Cato Networks and Cloudflare, built SASE as a single platform from the ground up, while others, including Palo Alto Networks and Zscaler, converged previously separate acquired or built products under one management plane and licensing model. The practical result for an enterprise is one policy engine and one set of logs covering network and security decisions that used to live in five separate consoles.