Remote work is now permanent infrastructure, not an edge case. Your users connect from home offices, hotels, coffee shops, and branch sites spread across every time zone, and the tools that secured that access a decade ago were never designed to handle it. The architecture that replaced them is called SASE, and the global market for it is projected to reach $28.5 billion by 2028.
Understanding what SASE actually is, how it works, and what it changes for your organization or your clients is worth your time. This guide covers everything, from the basic definition to the technical components to real-world decisions you need to make.
Quick answer: SASE, pronounced "sassy," stands for Secure Access Service Edge. It is a cloud-native architecture that combines network connectivity, specifically SD-WAN, with a full stack of security services, including ZTNA, SWG, CASB, and FWaaS, into a single unified platform delivered from the cloud. SASE secures users wherever they are without backhauling traffic through a central data center or appliance.
SASE stands for Secure Access Service Edge. Gartner analysts Neil MacDonald and Joe Skorupa coined the term in July 2019 to describe a convergence that the market had been moving toward for years: combining wide-area networking with cloud-delivered security into one integrated architecture.
Before SASE, organizations handled networking and security as separate disciplines. Your network team managed SD-WAN or MPLS circuits and VPN concentrators. Your security team managed firewalls, web proxies, and cloud access brokers. When a user in a remote office tried to reach a SaaS application, traffic might route through a data center two time zones away just to hit a firewall before going back out to the internet. Every additional hop added latency. Every separate system added management overhead. And none of it was built for a world where most users work outside the traditional office perimeter.
SASE eliminates that separation. It delivers both the network and the security stack from a distributed cloud infrastructure, meaning every user, regardless of location, gets consistent performance and consistent policy enforcement from the nearest point of presence.
The SASE meaning in practice is simpler than the technical definition: it is the architecture that lets your organization extend fast, secure, policy-enforced access to every user and device, wherever they are, from a single platform you do not have to maintain on-premises.
To understand why SASE exists, you need to understand what it replaced and why that model stopped working.
The traditional network security model was built around a perimeter. You had a headquarters, a data center, and a firewall sitting at the boundary between your trusted internal network and the untrusted internet. Remote users connected through a VPN, which extended a tunnel from their device back to that perimeter. Everything inside the perimeter was implicitly trusted. Everything outside it was not.
That model worked when most users sat in the office most of the time. Remote access was occasional. Cloud applications were a small portion of the workload. The internet was primarily a threat surface, not the primary transport for business-critical traffic.
Three things changed that model permanently.
SASE is the architectural answer to that shift. It moves security enforcement to the cloud, distributes it globally, and applies it to every connection regardless of where the user is, what network they are on, or what application they are reaching.
At its core, SASE in cybersecurity is about replacing perimeter-based security with identity-based, cloud-delivered security enforcement.
Traditional security asked: is this device inside or outside our network perimeter? SASE asks: who is this user, what device are they on, what is the health of that device, what resource are they trying to reach, and does current context support granting that access?
Every connection through a SASE platform is evaluated against those questions in real time. A user who has authenticated with valid credentials on an enrolled device in good health gets access to the specific applications and resources their role permits. A user on an unmanaged personal device, or one that has not received recent security updates, gets blocked at the access layer before they can reach any internal or cloud resource.
That shift from location-based trust to identity-based trust is the security principle called Zero Trust. SASE is the architectural framework that makes Zero Trust operational for distributed organizations.
For MSPs managing dozens or hundreds of client environments, SASE changes the operational model entirely. Instead of configuring and maintaining VPN appliances at each client site, you manage access policies through a single cloud platform. Instead of backhauling client traffic through infrastructure you maintain, traffic routes through a globally distributed network of cloud points of presence. Instead of hoping clients patch their VPN appliances before the next critical CVE is exploited, there is no on-premises infrastructure to patch.
SASE is not a single product. It is a converged architecture built from five distinct technologies that work together. Understanding each component and what it contributes is essential for evaluating whether a SASE platform will genuinely meet your requirements or whether it is simply co-locating separate tools under one vendor name.
Zero Trust Network Access is the component that replaces the traditional VPN as the mechanism for remote access. The distinction matters, and it is worth being specific about why.
A VPN authenticates a user once and grants broad access to the network segment behind it. There is no ongoing verification, no device posture check after the initial connection, and no enforcement of least-privilege access once the session is established. A stolen credential gives an attacker the same broad access as a legitimate employee.
ZTNA operates from a fundamentally different assumption: nothing is trusted by default, not the user, not the device, not the network the request originates from. Access requires continuous verification of identity, validation of device health and security posture, and evaluation of the context surrounding the request. Once granted, access is scoped to the specific resource the user needs through least-privilege enforcement. Internal resources remain hidden from and inaccessible to users who have not been explicitly authorized for that specific application.
Todyl's SASE implements ZTNA through its Secure Global Network (SGN) cloud platform, using a deny-by-default design that integrates with identity providers to allow users access only to the specific applications and services their role permits. The SGN enforces this at the packet level, preventing lateral movement to other devices or systems that the user was not explicitly authorized to reach.
The business difference for MSPs is concrete. When Blueclone Networks needed to rebuild secure remote access after a ransomware incident, they moved clients from vulnerable VPN and RDP connections to Todyl's SASE. Milan Baria, Founder and CEO of Blueclone Networks, described what their end users experienced: "End users have shared that they love that they log in to their PC and it just works, whether they are in one of the office locations, at home, or traveling.
That experience reflects what ZTNA through SASE actually delivers: consistent access that is both more secure and more seamless than what a VPN provides.
A Secure Web Gateway filters and inspects all internet-bound traffic before it reaches its destination. It blocks access to malicious sites, enforces acceptable use policies, prevents data exfiltration through web channels, and applies corporate security policy regardless of where the user is connecting from.
In a traditional architecture, SWG capability is delivered through on-premises appliances that only protect users when they are inside the corporate network or have traffic backhauled through the corporate proxy. A remote worker connecting directly to the internet, bypassing the VPN for performance reasons, receives no protection from that appliance.
In a SASE architecture, SWG runs inline at the cloud point of presence that handles the user's traffic. Protection follows the user, not the office. An employee connecting from a hotel gets the same filtering, the same threat inspection, and the same policy enforcement as one sitting at a corporate desk.
Todyl's SGN implements web proxy capabilities including SSL inspection, URL allow and deny rules, content filtering at the URL level rather than just the domain level, and download scanning that inspects files before they reach endpoints. The Detection Engineering team continuously updates threat intelligence to block malicious destinations before they ever reach users.
A Cloud Access Security Broker sits between users and the cloud applications they access. It provides visibility into how those applications are used and enforces security policy over what data moves through them. As SaaS adoption has grown, the volume of sensitive data flowing through cloud applications has expanded well beyond what traditional perimeter tools can see or control.
CASB addresses three fundamental problems that grow with SaaS adoption. First, shadow IT: employees use cloud applications that IT has not approved and does not know about. Second, data governance: sensitive information gets shared, downloaded, or stored in ways that violate policy. Third, compliance: regulated data ends up in applications that do not meet the compliance requirements for that data type.
In a SASE platform, CASB capability is integrated with the same traffic inspection infrastructure that handles ZTNA and SWG enforcement. Policy is centralized and consistent across all cloud application access, not managed through separate tools with separate consoles.
Firewall-as-a-Service moves traditional firewall capabilities to the cloud, delivering traffic inspection and policy enforcement without physical hardware at each location. Unlike hardware-based firewalls tied to specific sites, FWaaS inspects traffic from any source to any destination and applies consistent policy across the entire organization regardless of where users or resources are located.
For MSPs managing multi-site clients, FWaaS eliminates the capital expense and maintenance burden of deploying and patching firewall hardware at each location. Policy is managed centrally and enforced at the cloud edge, reducing both procurement complexity and the operational overhead of keeping site-specific infrastructure current.
Todyl's SGN implements a next-generation firewall that allows policy control down to the user and device level. Policies can be set using IP addresses, hostnames, specific devices, ports, protocols, applications, geographies, and time windows. Identity integration enables MFA enforcement for specific resource access, addressing one of the core weaknesses of traditional VPN architectures where a user decides whether to connect at all.
Software-Defined Wide Area Networking is the connectivity layer that underpins SASE. It uses software to manage and optimize traffic routing across the wide-area network, ensuring users reach applications efficiently regardless of where they connect from.
In traditional architectures, network traffic follows fixed paths that do not adapt to changing conditions. SD-WAN introduces dynamic traffic management, directing high-priority application traffic over the most efficient available path in real time. For distributed organizations with multiple branches and a remote workforce, this translates to consistent application performance and a significantly better user experience.
SD-WAN alone is a networking tool. Paired with the security stack that SASE delivers, it becomes the foundation for a unified architecture where traffic optimization and security enforcement work from the same platform and the same policy engine.
Understanding what SASE does conceptually is useful. Understanding how it works technically is what separates a surface-level grasp from the depth you need to evaluate platforms and explain the architecture to clients.
Todyl's SGN provides a concrete example of how a production SASE platform processes every connection. Following a single packet through the system illustrates how the components work together.
Step 1: Encrypted connection establishment. When a packet leaves a device, it travels over an encrypted connection to the SGN cloud. This encryption protects data and devices on untrusted networks, including hotels, airports, co-working spaces, and coffee shops, against malicious hotspots and data interception.
Step 2: Policy Enforcement Module. The initial gatekeeper applies configurations, drops traffic destined for known malicious destinations maintained by Todyl's Detection Engineering team, and performs integrity checks on packets entering the cloud.
Step 3: Deep Packet Inspection (DPI) Engine. The DPI Engine identifies and classifies the packet by application type, analyzing it against hundreds of application classifications built into the SGN. This classification drives the subsequent firewall and policy decisions.
Step 4: Next-Generation Firewall. After classification, the packet passes through the SGN Firewall, where access policies are enforced at the user and device level. MFA requirements apply here for sensitive resources. A member of the finance team, for example, authenticates to access accounting applications before the connection proceeds.
Step 5: Intrusion Prevention and Detection. If the packet clears the firewall, it proceeds to the IPS and IDS layer. The IPS proactively identifies and drops a broad spectrum of malicious traffic, including exploits, command-and-control callbacks, protocol abuse, and exfiltration attempts. The IDS reports suspicious activity to the SIEM for detection and investigation.
Step 6: Secure DNS. DNS traffic routes through the Secure DNS module, which identifies and redirects requests to malicious hostnames before a connection is ever established. DNS over HTTPS and DNS over TLS, frequently used by threat actors to evade standard controls, can be blocked at the firewall layer.
Step 7: Web Proxy. HTTP and TLS traffic passes through the web proxy, where SSL inspection, URL filtering, content filtering, and download scanning are applied before the packet reaches its destination.
Step 8: Routing and SIEM integration. The packet routes to its destination, with the IP address changed to Todyl's for privacy. Throughout every step, telemetry and logs flow to the SIEM, supporting continuous threat detection and compliance documentation.
The result is that every connection made through the Todyl SGN is inspected, filtered, and logged before it reaches its destination, from any device, on any network, anywhere in the world.
One of the most practical decisions in SASE adoption is whether to pursue a single-vendor SASE platform or assemble a dual-vendor approach combining a separate SD-WAN and SSE (Security Service Edge) solution.
Single-vendor SASE delivers the full architecture from one platform with one management console, one policy engine, one billing relationship, and one place to look when something needs attention. For MSPs managing multiple clients, this model dramatically simplifies operations. Policies are consistent across the entire platform. Adding a new client does not require configuring integrations between systems. Reporting, logging, and visibility all come from one place.
Dual-vendor SASE gives organizations the ability to select best-of-breed SD-WAN and best-of-breed SSE independently. The trade-off is integration complexity, management overhead, and the risk of policy drift between systems that were not designed to share a single data plane.
For most MSPs and SMBs, the operational efficiency of single-vendor SASE outweighs the theoretical customization benefits of dual-vendor approaches. Gartner projects the SASE market will reach $28.5 billion by 2028, growing at 26 percent annually, with demand split between single-vendor platforms and dual-vendor approaches. The trend toward platform consolidation is consistent across the market as organizations reduce the number of vendors they need to manage.
Paul Havens, CEO of IT Haven, described the consolidation impact directly: "Before Todyl, we were using about 8 tools per machine, which was a hassle to image and onboard. Now, we just use Todyl and our RMM, and have cut our onboarding time down to less than an hour. It's just as easy for offboarding.
The case against continuing to run VPN infrastructure is not theoretical. The vulnerability record on major VPN platforms is consistent and well-documented, and the security model is structurally flawed regardless of patching status.
VPNs were built for occasional remote access in a world where most users sat in an office most of the time. They authenticate a user once and grant broad access to a network segment. There is no ongoing verification, no device posture check, and no enforcement of what that user does once the session is established.
Ransomware operators and credential theft campaigns specifically target VPN access because the return on a single valid login is high. Gaining access to a VPN endpoint in a typical SMB flat network means gaining access to most of it.
Here is how VPN and ZTNA compare across the dimensions that matter most:
Three specific forces have converged to make VPN replacement an urgent operational decision rather than a future roadmap item:
MSPs who can demonstrate that SASE closes all three gaps simultaneously have a concrete differentiator in competitive conversations with clients in regulated industries.
The operational and security benefits of SASE are real, but they land differently depending on who is asking about them. Here is how the benefits map across the audiences who care about them most.
SASE built on a multi-tenant platform changes what MSPs can deliver and how efficiently they can deliver it. Single-pane-of-glass management across every client eliminates the tool fragmentation that makes scaling a security practice expensive. Consistent policy enforcement across all clients means security outcomes do not vary by how recently a specific appliance was patched or updated.
SASE also becomes a differentiated service offering. The compliance alignment with HIPAA, CMMC, PCI-DSS, and other frameworks gives MSPs a concrete security narrative for regulated-industry clients. That narrative translates to competitive wins against providers who cannot articulate what they do for remote access security and compliance beyond "we have a VPN."
Aaron Zimmerman, President and CEO of TotalCare IT, described what platform consolidation meant for his business: "Todyl has been invaluable to our growth over the past year. The team is more than just another vendor, they're a business partner we can turn to for crucial cybersecurity knowledge and support whenever we need it.
For engineers responsible for deploying and maintaining security infrastructure across multiple environments, SASE eliminates the patching cycles, hardware refresh timelines, and integration work that legacy architectures demand.
Todyl's SGN deploys in minutes. Connectivity, threat inspection, ZTNA enforcement, and SIEM logging all activate from the same agent, with no on-premises hardware to rack, configure, or monitor. New clients enroll through a consistent onboarding process rather than a custom provisioning exercise for each site.
The policy model supports granular control at the user, device, application, protocol, geography, and time-window level, giving engineers the specificity they need without the complexity of managing separate firewall, proxy, and access control systems.
For the end users at the center of the architecture, a well-deployed SASE platform is largely invisible. Connections are faster because traffic routes to the nearest point of presence rather than backhauling through a central appliance. Access is consistent regardless of network, device, or location. Security does not interrupt the workflow.
That user experience is not a secondary concern. Users who find security tools painful work around them. Bypassing a VPN for performance reasons is one of the most common and most dangerous behaviors MSPs encounter in SMB environments. SASE removes the performance incentive to do it.
For VARs and channel partners, SASE represents a shift from hardware-based point-in-time transactions to recurring managed security services. The platform model creates ongoing engagement with clients, continuous opportunities to expand coverage, and a service portfolio that grows with client needs rather than requiring hardware refreshes to generate revenue.
MSPs interact with SASE differently than organizations managing their own environments, and the platform has to be designed for that reality from the ground up, not adapted for it as an afterthought.
The MSP model requires clean tenant separation so one client's data and policies are never visible to another. It requires a single interface that allows efficient management across dozens or hundreds of client environments without context-switching overhead. It requires pricing and licensing models that let MSPs build profitable service offerings, not just consume a product at retail. And it requires fast onboarding that lets MSPs deploy new clients quickly without burning engineering hours on configuration work that should be automated.
Todyl's SASE is built specifically for the MSP delivery model, with multi-tenant architecture, unified management across the full platform including SIEM, MXDR, Endpoint Security, and GRC, and direct integration with RMM and PSA platforms that MSPs use to run their businesses.
Wayne Stanley, President and CEO of Iron Dome, described the single-pane-of-glass operational model: "Switching to Todyl helped us achieve every initial goal and more. With Todyl, my team can deliver better security through a single-pane-of-glass with robust reporting that we didn't have with multiple vendors.
SASE is the architectural platform. Zero Trust is the security model. They are complementary, not synonymous, and understanding how they relate matters when you are making purchasing and architecture decisions.
Zero Trust is a philosophy about how access should be granted: trust nothing by default, verify everything continuously, enforce least-privilege access at every layer. It is not a product and it is not a checklist. It is an operating principle.
SASE is the architecture that makes Zero Trust operational at scale. ZTNA within SASE enforces the deny-by-default access model at the application layer. The SWG and FWaaS components enforce policy on every connection regardless of network. The integrated SIEM logging provides the audit trail and visibility that Zero Trust requires to be verifiable.
Todyl's SGN was built from inception on Zero Trust principles, implementing them at the LAN, WAN, and cloud layers simultaneously through both ZTNA for external access control and LAN Zero Trust (LZT) for internal network segmentation. LZT functions as a firewall for the internal network, isolating devices from each other so that a compromised device cannot communicate with or see other devices on the same network.
The four Zero Trust principles as defined by Forrester, all of which the SGN addresses, are: assume every network is hostile, create an invisible network to operate in, segment and isolate users and applications, and deemphasize the physical network perimeter in favor of implementing security everywhere.
SASE addresses a range of specific operational challenges. Here are the use cases where it delivers the clearest, most measurable outcomes.
Security Service Edge, or SSE, is a subset of SASE that includes only the security components: ZTNA, SWG, CASB, and FWaaS. It excludes the networking layer, specifically SD-WAN.
Gartner defined SSE as a distinct category in 2021 to describe organizations that were adopting the security components of SASE without replacing their existing WAN infrastructure. SSE is effectively SASE minus the connectivity layer.
For organizations with existing SD-WAN investments they want to retain while adding cloud-delivered security enforcement, SSE represents a viable path. For organizations building security architecture from scratch, or those replacing both their networking and security infrastructure simultaneously, single-vendor SASE provides the tighter integration and operational simplicity that separate SD-WAN and SSE stacks cannot match.
The practical question when evaluating platforms is whether the vendor's networking and security components are genuinely integrated on a single data plane, or whether they are co-sold products with API-based connections between them. The difference matters for policy consistency, correlation quality, and the operational overhead of managing the environment over time.
Evaluating SASE platforms is not a features checklist exercise. The questions that separate strong platforms from mediocre ones are operational.
SASE stands for Secure Access Service Edge. The term was coined by Gartner analysts in July 2019 to describe a converged architecture that combines wide-area networking, specifically SD-WAN, with cloud-delivered security services including ZTNA, SWG, CASB, and FWaaS into a single unified platform.
SASE is pronounced "sassy." You will occasionally hear it pronounced letter-by-letter, but "sassy" is the accepted industry pronunciation.
The five core components of SASE are Zero Trust Network Access (ZTNA), Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), Firewall-as-a-Service (FWaaS), and Software-Defined WAN (SD-WAN). The first four make up the security service edge (SSE) layer. SD-WAN provides the networking foundation that underpins the entire architecture.
A VPN authenticates a user once and grants broad network access. SASE enforces continuous verification of identity, device health, and context before granting access, and limits that access to the specific resources the user is authorized to reach. VPNs provide no inspection of traffic through the encrypted tunnel, no device posture checking, and minimal logging. SASE delivers full session-level logging, inline threat inspection, and least-privilege access enforcement from a cloud-native platform with no on-premises hardware to maintain.
Zero Trust is a security philosophy: trust nothing by default, verify everything continuously, enforce least-privilege access at every layer. SASE is the architectural framework that makes Zero Trust operational at scale for distributed organizations. ZTNA, one of the five core SASE components, is the specific mechanism that implements Zero Trust access enforcement. The two concepts are complementary. SASE is the platform. Zero Trust is the principle the platform operationalizes.
SSE (Security Service Edge) is a subset of SASE that includes only the security components: ZTNA, SWG, CASB, and FWaaS. It excludes the SD-WAN networking layer. Organizations with existing WAN infrastructure they want to retain may adopt SSE to add cloud-delivered security without replacing their networking. SASE includes both the security layer and the networking layer in a single converged platform.
No. The Mordor Intelligence 2026 SASE market report projects that small and medium enterprises will post the fastest growth rate through 2031 at 20.66% CAGR, as managed service providers offer user-based monthly subscriptions that eliminate the need for large appliance purchases. For SMBs, MSP-delivered SASE provides enterprise-grade security architecture at a per-user service fee without the capital investment or staffing burden of building it internally.
SASE supports compliance frameworks including HIPAA, CMMC 2.0, PCI-DSS, and SOC 2 through several specific capabilities. ZTNA provides the granular, application-level access control and session-level logging those frameworks require. The SWG and FWaaS components enforce data protection and access policies. The SIEM integration provides continuous monitoring, audit trails, and compliance reporting. Organizations can demonstrate control over who accessed what, from what device, and when, answering the access logging questions that compliance audits ask.
The SASE market was valued at approximately $15.54 billion in 2026 and is projected to reach $39.14 billion by 2031 at a 20.29 percent compound annual growth rate. Gartner projects the market will reach $28.5 billion by 2028 at 26 percent CAGR.
Todyl's SASE delivers fast, secure, and reliable connections for users everywhere through the Secure Global Network cloud platform, with Zero Trust enforcement built in from the ground up. ZTNA, next-generation firewall, IPS/IDS, secure DNS, web proxy, and SSL inspection run as integrated layers that every connection passes through, feeding telemetry directly into the Todyl SIEM for continuous detection and compliance documentation.
For MSPs, SASE is one module in a unified platform that also includes AI-Powered SIEM, MXDR, Endpoint Security, SOAR, and GRC, all managed from a single interface designed for multi-tenant service delivery.
Book a demo to see Todyl SASE in action and find out how fast you can move clients off VPN infrastructure and onto a Zero Trust architecture built for the way distributed organizations actually work.
Not ready to talk yet? These resources take you deeper:
Evaluate your security posture against AI-powered attacks and get recommendations to close any gaps.
Subscribe to our newsletter to get our latest insights.