Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Security Teams Use Secure Access Service Edge Architecture
Transcript
- Lucas: So let's talk about something that every enterprise security team is wrestling with right now — and that's Secure Access Service Edge, or SASE. Luna: SASE. It's one of those acronyms that sounds like a buzzword but actually describes a real architectural shift. Lucas: Exactly. And it's worth unpacking because the adoption numbers are climbing fast. Gartner predicted that by 2025, 80 percent of new digital business applications would be accessed through SASE. But as of mid-2026, we're seeing that play out faster in some sectors than others. Luna: So give me the one-sentence definition. What is SASE, practically? Lucas: SASE is a cloud-delivered architecture that converges wide-area networking — think sd wan — with security functions like secure web gateway, cloud access security broker, and zero-trust network access. Instead of backhauling traffic through a corporate data centre, users and devices connect directly to the cloud edge. Luna: Right. So it's not a product you buy off the shelf. It's a framework that combines networking and security into one service. Lucas: Exactly. And that's what makes it hard. Because traditionally, networking and security teams have been separate. Networking buys routers and circuits. Security buys firewalls and proxies. SASE forces them to coordinate. Luna: And I imagine that cultural friction is one of the biggest barriers to adoption. Lucas: It absolutely is. In fact, a 2025 survey from Enterprise Management Associates found that 43 percent of organisations cited organisational silos as the primary obstacle to SASE adoption. Not the technology — the people. Luna: That's a big number. But when it works, what does the payoff look like? Lucas: Let me give you a concrete example. There's a Fortune 500 retailer — I won't name them — that had 200 regional offices each running a traditional VPN concentrator back to a central data centre. Latency was a mess. Remote workers in Asia were routing through a U.S. hub just to get to a cloud app hosted in Singapore. Luna: That's absurd. You're doubling the round trip. Lucas: Right. They migrated to a single-vendor SASE stack from Palo Alto Networks. Within six months, they cut average latency by 40 percent and reduced their MPLS circuit costs by 30 percent. And their security team got a unified policy engine instead of managing separate firewall and proxy rules. Luna: So operational savings plus better performance. That's the dream combination. Lucas: It is. And that's why Gartner originally coined the term in 2019 — because they saw the cloud shift making traditional hub and spoke networking obsolete. But adoption was slow at first. By 2023, only about 15 percent of enterprises had deployed SASE. A 2025 survey by Zscaler — one of the big vendors in this space — put that number at 38 percent. Luna: So roughly doubling in two years. That's significant, but still a minority. Lucas: Yeah. And the market is consolidating fast. The 2024 Gartner Magic Quadrant for SASE had only two leaders: Palo Alto Networks and Zscaler. Everybody else — Cisco, Fortinet, Netskope, Check Point — they're all playing catch-up or focused on a subset. Luna: What about Microsoft? They have Entra and their global network. Lucas: Microsoft is strong in identity and has a massive cloud footprint, but Gartner placed them as a Challenger, not a Leader. Their SASE offering is still fragmented — you need Azure AD for identity, Microsoft Defender for Cloud Apps for CASB, and Azure Virtual WAN for networking. It works, but it's not a single-console experience the way Zscaler or Prisma Access from Palo Alto is. Luna: So the Leaders are the ones that deliver networking and security as one unified cloud service, not a bundle of separate products. Lucas: Exactly. And that's the key insight Gartner emphasizes: SASE is not just sd wan plus security. It's a converged platform where the network itself is security-enforced. If you're stitching together three different vendors, you're probably not getting the full benefit. Luna: But let's be realistic. For a lot of companies, ripping and replacing existing infrastructure is daunting. How do they start? Lucas: Most start with a specific use case. The most common is replacing remote-access VPNs with zero-trust network access, or ZTNA. That's a low-risk entry point because it affects only remote users, not the whole network. Then they expand to branch offices over time. Luna: And ZTNA is essentially the 'secure access' part of SASE, right? Lucas: Right. ZTNA gives users access to specific applications, not the whole network. So even if a laptop is compromised, the attacker can't just pivot across the corporate LAN. That's a huge improvement over traditional VPNs that drop users onto the internal network like they're in the office. Luna: I've heard CISOs say that moving from VPN to ZTNA reduced their incident response time by something like 60 percent because they could isolate a compromised device instantly. Lucas: That tracks. And it's one of those metrics that makes the business case write itself. When you can show a CFO that a ZTNA deployment paid for itself by avoiding a single ransomware containment event, the conversation changes. Luna: So let's talk about the elephant in the room: vendor lock-in. If you go with a single-vendor SASE platform, are you painting yourself into a corner? Lucas: It's a legitimate concern. But I'd argue that SASE is less lock-in prone than traditional networking. Because the control plane is cloud-delivered, you can swap the underlying connectivity. You're not tied to a specific MPLS carrier. And the security policies are abstracted away from the hardware. Luna: Still, if you're using Zscaler's ZIA and ZPA, migrating to Palo Alto's Prisma Access later would be a major re-architecture project. Lucas: No question. But that's true of any major platform decision. The key is to choose a vendor whose roadmap aligns with your future needs. And to make sure you're not overbuying capabilities you don't need. A small business with 100 remote workers probably doesn't need the full Gartner Leader suite. Luna: Right. And that's where the market is going. We're seeing more mid-market SASE offerings from vendors like Cato Networks and Versa Networks that are simpler to deploy. Lucas: Exactly. Cato calls itself a 'single-vendor SASE' player and they've been growing fast. They combine sd wan, security, and global backbone into one subscription. No hardware appliances. That's appealing for companies that don't have a big network operations team. Luna: So we've got the Leaders, the Challengers, and the niche players. But what about the actual deployment? Is SASE really as easy as plug and play? Lucas: Not exactly. There's a maturity curve. The first step is typically sd wan rollout, because you need to get branch offices off MPLS and onto broadband. Then you layer on the cloud-delivered security. The trickiest part is policy translation — moving from a perimeter-based firewall rule set to identity-based policies. Luna: And that's where the networking and security teams really have to collaborate. Because the networking team understands traffic flows, and security understands threat models. They have to merge those mental models. Lucas: Yeah. And many organisations create a joint architecture review board to force that collaboration. Some even appoint a 'SASE architect' who reports to both the CISO and the head of networking. Luna: I like that. A dedicated role to bridge the silo. Lucas: It's becoming more common. And it's one of those moves that signals real executive commitment. Because without that kind of structural alignment, SASE projects tend to stall. Luna: We should also mention that SASE isn't just for large enterprises. Mid-sized companies with distributed workforces — say, a 500-person company with offices in three cities — can benefit too. Lucas: Absolutely. In fact, the total cost of ownership argument is often stronger for mid-market because they don't have the in-house expertise to manage complex firewall rules and VPNs. A cloud-delivered service eliminates that overhead. Luna: And you pay as you go, which is easier on cash flow than a big capital expenditure on hardware. Lucas: Right. And this hits on something broader. If these conversations about architecture and strategy are useful for what you're building or running, there's a simple way to support the show. Luna: We deliberately don't run ads on these episodes. That's a choice. It keeps the conversation clean and focused on what we think matters. Lucas: If you want to support that choice, the link is buy me a coffee dot com slash fexingo. It's a small gesture that helps keep this ad-free model sustainable. Luna: And it really does make a difference. So back to SASE — one thing we haven't touched on is the impact on the SOC. Lucas: Good point. Because SASE doesn't just change the network — it changes how security operations work. With traditional VPNs, the SOC sees traffic only after it hits the corporate perimeter. With SASE, all traffic is inspected at the cloud edge, so the SOC gets visibility into remote user traffic that they never had before. Luna: Which is a double-edged sword. More visibility is great, but it also means more alerts. Lucas: Exactly. Some organisations report a 3x increase in the volume of security events after a SASE migration. That forces them to invest in automation and SIEM upgrades. But the trade-off is worth it because they actually see threats they were missing. Luna: And that visibility is key for compliance too. If you're subject to PCI DSS or HIPAA, you need to log all access to sensitive data. SASE gives you a single place to enforce and audit that. Lucas: Right. So the compliance angle is another driver. I've talked to a CISO at a healthcare company who said SASE is the only way they could realistically audit third-party vendor access to their environment at scale. Luna: And that's a huge deal because third-party risk is one of the top attack vectors. Lucas: It is. So SASE isn't just a networking upgrade. It's a security architecture change that touches everything: user experience, cost, compliance, and SOC operations. Luna: So if someone is listening and thinking about whether to start a SASE project, what's the first concrete step you'd recommend? Lucas: Pick one pain point. Maybe it's slow remote access, or maybe it's the cost of MPLS circuits. Do a pilot with 50 users. Measure the before and after. If you see a 30 percent performance improvement and a lower security operations burden, you've got your business case. Luna: And don't try to boil the ocean. Start small, prove value, then expand. Lucas: Exactly. SASE is a journey, not a rip and replace overnight. But the destination is worth it.