What does SASE and SSE mean?
Security Service Edge (SSE) includes cloud-based security services for user, application, and data access. Secure Access Service Edge (SASE) adds WAN capabilities to this model, bringing network and security together as a common architecture.
The problem: An acronym is bought before the target architecture is determined
Companies often compare SASE suites, although it is initially unclear whether they only want to consolidate security, modernize remote access or also change MPLS, SD-WAN and branch firewalls.
As a result, network, security and operation end up with different target images. The result is duplicate controls, unnecessary backhauls or a platform whose organizational requirements are missing.
One company wants to introduce ZIA and ZPA, but at the same time plans to replace MPLS. Without a common target image, the security team optimizes access while the network team builds a new SD-WAN structure in parallel. SASE is an architecture decision here, not an additional license line.
Separate SSE and SASE by Area of Responsibility
The terms become understandable when they are mapped to concrete functions.
SSE
ZTNA, Secure Web Gateway, Cloud Firewall, CASB and Data Protection as a security layer.
SASE
SSE plus WAN/branch connectivity and shared control of data paths.
Identity
User, device and application replace the location as the sole basis of trust.
Data path
Model internet, SaaS, private apps, locations, and cloud workloads separately.
The establishment
Connect network, security, and service responsibilities with common measurement points.
Migration
SSE can be a first step; WAN transformation follows by site type and risk.
What needs to be checked before making a decision?
- Which access and data paths should be changed?
- Will SD-WAN remain or will it be reassessed?
- Which locations need local features?
- Who is responsible for policy, routing and incident end-to-end?
- Which platforms have already been set?
- What migration can happen without Big Bang?
Definition: SASE is not a single product, and SSE is not automatically an incomplete solution. The right target model depends on the initial situation, locations, applications and operational organization.
SourcingBlox turns acronyms into a roadmap
The decision starts with data paths and responsibilities.
Architecture Discovery
Make actual paths, controls, costs and responsibilities transparent.
Target Architecture
Define SSE and WAN building blocks per user, cloud, and site type.
Migration Waves
Plan pilot and waves according to risk, benefit and technical dependency.
Typical mistakes
- Equate SASE with a vendor SKU.
- Plan security and WAN in separate programs.
- Do not distinguish between location types and legacy protocols.
- Clarify the operating and support model only after the rollout.
Frequently Asked Questions
Can SSE make sense without SD-WAN?
Yes. Many organizations first modernize user and application access and leave existing WAN components in place for the time being.
Is ZTNA part of SSE?
ZTNA is typically one of the core SSE functions.
Does SASE have to come from a manufacturer?
Not necessarily. Integration, operability, and consistent policies are more important than the sheer number of vendors.
Check SSE and SASE target image against real data paths.
We classify users, applications, locations, WAN and security controls into a resilient architectural model.
Related Content
Sources and further information
The site describes architectural principles, not a blanket product recommendation.