- 01SASE = SD-WAN + SWG + CASB + ZTNA + FWaaS in one fabric. The marketing pitch is integration; the buying decision is whether each leg clears the bar individually first.
- 02Real fabric integration shows up in three places: unified policy plane, unified telemetry / investigation, and a single user+device identity across all decisions. If any of the three is missing, you have a billing bundle, not a SASE.
- 03A defensible buying process runs each component through a vendor-agnostic scorecard before integration testing. The scorecard catches 80% of post-deployment regret.
- 04TLS inspection scale at p99 — not at marketing-banner peak — is the most-faked SASE metric. Ask for documented sustained-load test results, not 'capable of'.
- 05The contract clauses that protect you are: regional latency SLOs with credits, PoP capacity disclosure, per-service data residency, third-party audit per component, and a written exit / data extraction plan.
Secure Access Service Edge (SASE) bundles SD-WAN, secure web gateway, CASB, ZTNA, and FWaaS into a single fabric. The Gartner-coined term has been around since 2019; the buying market has matured; the marketing has not. The pitch is still 'integration,' and the buying decision is still whether each component meets your bar individually before you bet on integration.
This piece is the buying guide we run when we are advising a CISO on a SASE selection. It deliberately separates the per-leg evaluation from the integration evaluation, and it ends with the contract clauses that protect you on the day a vendor relationship goes sideways.
SASE vs SSE — the distinction that actually matters.
SSE (Security Service Edge) is SASE minus SD-WAN. If your network team owns SD-WAN already and is happy with it, you are buying SSE — and you should reject any SASE deal that forces you to rip out a working SD-WAN to land the security fabric. The decoupling is 2024 vendor reality; do not let a salesperson tell you otherwise.
Evaluating each leg on its own merits
Before any integration story, each of the five components must clear the bar your operations team would set if it were buying that product standalone. Below is the scorecard we hand to evaluation teams. Score each leg 1–5 against the criteria; do not aggregate across legs.
The most-faked SASE metric.
TLS inspection throughput is the metric that vendor decks lie about most often. Marketing numbers are usually unconditioned peaks; production numbers are sustained at p99 with full inspection enabled. Insist on a written sustained-load test report from the vendor, run with your traffic mix and your decryption policy. Anything less and your users will hate you on day 31.
/PER_LEG_SCORECARD
| Leg | Hard criterion | What 'good' looks like in 2026 |
|---|---|---|
| SD-WAN | App-aware steering, p99 latency | Per-app overlay; loss-aware tunneling; on-prem reach |
| SWG | TLS-inspection scale | Sustained 10 Gbps+ per PoP, p99 < 30 ms decryption tax |
| CASB | Sanctioned + unsanctioned coverage | API + inline; 1000+ apps; DLP integration native |
| ZTNA | Policy expressiveness + posture | Identity-aware, device-aware, app-aware policies |
| FWaaS | N-S + E-W; cloud peering | Native to AWS/Azure/GCP transit; not just N-S |
The three integration tests that matter
Real integration value comes from three specific places. None of them are visible in a vendor demo; all of them are visible in a 30-day proof-of-concept if you ask the right questions.
- 01Unified policy plane — can you express one policy ('finance users on managed devices may access SaaS X with DLP class A applied') ONCE and have it enforced across SWG + CASB + ZTNA + FWaaS without restating it per component? Most vendors fail this test.
- 02Unified telemetry / investigation — can your analyst pivot from a SWG block, to the CASB user activity, to the ZTNA session, to the firewall flow, in one console with one identity? If the investigation requires four consoles, the fabric is fictional.
- 03Single identity across all decisions — does the same user + device + risk score drive all five components, or does each leg query the IdP separately and reach a different verdict? Independent verdicts produce contradictory user experiences and audit nightmares.
A reference proof-of-concept plan
A 30-day PoC structured around the three integration tests above will surface most of the architectural truth a vendor demo hides. Below is the cadence we recommend.
/SASE_POC · 30-day plan
Week 1 — Per-leg baseline
- Stand up SWG, ZTNA, CASB, FWaaS for a 50-user pilot cohort.
- Capture per-leg latency, error rate, policy-author UX.
- Run vendor's recommended config; do NOT customize yet.
Week 2 — Unified-policy test
- Author ONE business policy in plain English.
- Translate to vendor policy plane(s).
- Count how many places you had to restate it. Target = 1.
- Test the policy by violating it in 4 ways (web, SaaS, ZTNA app, DC app).
Week 3 — Investigation test
- Inject a benign indicator (controlled malware sample, test creds).
- Time the analyst's path: SWG block → CASB activity → ZTNA session.
- Target: < 10 minutes, < 2 console pivots.
Week 4 — Identity-consistency test
- Trigger a posture downgrade on a test endpoint (disable EDR).
- Verify ALL legs deny within posture-refresh window.
- If any leg still allows, identity is not unified.
Where SASE deployments actually fail
Across our 2023–2025 SASE assessments, the failure modes cluster in four buckets. None of them are technology problems; all of them are buying or operating decisions made too late.
- 01Buying the bundle without the per-leg scorecard — one weak leg drags the whole fabric (usually CASB or FWaaS)
- 02Skipping the unified-policy test in PoC — discovered post-deployment that 'one fabric' means 'four policy planes with shared SSO'
- 03Underestimating the inspection tax — TLS decryption at scale degrades p99 latency by 40–80 ms when not properly sized
- 04No exit plan in the contract — when the relationship sours in year 3, the data extraction takes six months and a litigation reserve
What to insist on in the contract
/CONTRACT_CLAUSES
| Clause | Specifics | Why it matters |
|---|---|---|
| Regional latency SLO | p99 by region with service credits | Holds vendor accountable for PoP capacity |
| PoP capacity disclosure | Quarterly utilization per PoP | Catches oversubscription before it bites |
| Per-service data residency | Each leg's data stays in named region | Required for GDPR / NIS2 / DORA |
| Third-party audit report | SOC 2 Type II + ISO 27001 per component | Not 'corporate' — per service |
| Exit / extraction plan | Documented format, max 90 days | Prevents lock-in extortion at renewal |
| TLS inspection benchmark | Sustained throughput per PoP, written | Holds the most-faked metric to account |
A 90-day buying timeline
- 01Days 0–30 — Define requirements per leg using the scorecard. Issue an RFP that asks for sustained-load test reports, not marketing throughput. Shortlist three vendors max.
- 02Days 30–60 — Run the 30-day structured PoC against all three integration tests. Score each vendor; insist on the policy-plane and investigation tests in the customer's environment, not the vendor's lab.
- 03Days 60–90 — Negotiate the contract clauses above. Pilot rollout to 5–10% of seats with a clear go / no-go gate at day 30 of production.
Monday morning — the one question that filters 70% of SASE pretenders.
Ask any prospective SASE vendor: 'Show me the policy I would write to allow finance users on managed devices to access Workday with PII redaction in the response.' If the answer requires opening more than one console or restating the policy more than once, the vendor's fabric is a billing construct. Move on.
- ▸Pose the policy question to every shortlisted vendor
- ▸Insist on a screenshare of the actual policy authoring
- ▸Count consoles opened and policy restatements
- ▸Eliminate any vendor that requires more than one of either
Closing — buy the fabric, not the bundle
SASE done well is genuinely transformative — one policy plane, one investigation surface, one identity, lower latency, simpler operations. SASE done badly is a billing-line consolidation that hides four products you now have to operate together with weaker individual quality. The difference between the two outcomes is entirely in the buying process: per-leg scorecard, three integration tests, defensible contract. Spend the time. The five-year operating cost difference is enormous.