The Security Problem That SD-WAN Created
SD-WAN solved the cost and performance problem, but it introduced a serious security problem. When every branch office connects directly to the internet (DIA), that branch is no longer protected by the massive, carefully maintained firewall stack at headquarters. You have 50 branches, each with a direct internet connection, and no security between them and the open internet.
The naive solution — put a full enterprise firewall at every branch — doesn't work. A next-generation firewall with SSL inspection, IDS/IPS, URL filtering, and DLP costs $30,000–$100,000 per appliance, requires a dedicated security team to manage, and needs constant signature updates. Deploying and maintaining that at 50 locations is operationally impossible for most organizations.
SASE (Secure Access Service Edge), pronounced "sassy," is the architectural answer. Coined by Gartner in 2019, SASE takes the entire security stack that used to live in the HQ data center and moves it to cloud-hosted Points of Presence (POPs) distributed globally. Instead of traffic going to HQ for security inspection, it goes to the nearest SASE POP — which might be 10ms away instead of 150ms.
The SASE Architecture:
SASE is not a single product — it is a framework that combines two categories:
1. SD-WAN (the networking layer): Provides the intelligent, multi-link connectivity from branches and remote users to the nearest SASE POP.
2. SSE — Security Service Edge (the security layer): The cloud-hosted security stack, which includes:
| Component | Full Name | Function |
|---|---|---|
| FWaaS | Firewall as a Service | Layer 7 stateful firewall, IPS/IDS in the cloud |
| SWG | Secure Web Gateway | URL filtering, malware scanning, SSL inspection |
| CASB | Cloud Access Security Broker | Visibility and control over SaaS app usage |
| DLP | Data Loss Prevention | Detects and blocks sensitive data exfiltration |
| ZTNA | Zero Trust Network Access | Identity-based application access (replaces VPN) |
Traffic Flow with SASE:
- A user in a branch office (or a remote worker at a café) generates traffic.
- The SD-WAN appliance (or a lightweight agent on the laptop) tunnels the traffic to the nearest SASE POP — a Zscaler, Palo Alto Prisma, or Netskope data center, typically within 20–30ms.
- The SASE POP performs all security checks: identity verification, URL categorization, malware scanning, DLP policy evaluation.
- Clean traffic exits the POP directly to the internet or SaaS application — no backhauling to HQ.
The branch office firewall is replaced by a $500 SD-WAN appliance and a cloud subscription. Security policy is managed centrally in a single dashboard and applies uniformly to every user, everywhere.
Key Point: SASE resolves the tension between SD-WAN's direct internet access and enterprise security requirements. By moving the security stack to the cloud edge, inspection happens close to the user rather than at a distant HQ. The operational benefit is equally significant: one policy engine governs all users — branch, remote, and mobile — rather than managing dozens of independent appliances.