What is SASE?
Secure Access Service Edge, told as a story about hubs built all over town.
Every road used to pass through the gate.To reach the shed next door, you went all the way to the castle and back. Long and slow.
Everyone queues at the gate.The checkpoint, the shed broker and the escort are all crammed at one gate.
SASE builds hubs all over town, fully equipped.Wherever you start, you pass the nearest hub — and every hub has a checkpoint, a shed broker and an escort.
The hub picks the best road, too.Skip the jam, take the fast road — that's SD-WAN. Half security, half roads, in one hub.
The hubs usually belong to one company.All-in-one, but hard to switch away from. And if the hubs stop, every road stops.
SASE = put the checkpoint, the shed broker and the escort in hubs all over town instead of at the gate, and let the hub pick the road too.
Secure Access Service Edge: SSE (the checkpoint bundle) + SD-WAN (road picking) = SASE. Named by Gartner in 2019. Zscaler, Netskope, Palo Alto Prisma, Cato.
When grown-ups say it
- SSE
- The checkpoint bundle. The security half: checkpoint + shed broker + escort.
- SD-WAN
- Road picking. The network half: around the jam, onto the fast road.
- PoP · edge
- The hub. Little gates built all over town. You use the nearest.
- Hairpinning / backhaul
- To the castle and back out. The old detour through the castle to reach the shed next door. What SASE removes.
- Branch
- The little office in town. Where castle folk work outside the walls. Faster when a hub is near.
- Single-vendor SASE
- One company's hubs. All hubs built by one company. Convenient, hard to leave.
- Unified policy
- The same rulebook. However many hubs, one rulebook — the same at home and at the branch.
- Latency
- The long way is slow. The nearer the hub, the faster. Which is why there are so many.