SASE Architecture: Design and Deployment

April 15, 2026·3 min read·469 words

SASE (Secure Access Service Edge) is the converged SD-WAN and cloud security framework introduced by Gartner in 2019. It combines ZTNA, SWG, CASB, FWaaS, and DNS Security in a single cloud platform. Adoption accelerated after COVID due to the widespread shift to remote work. 2026 SASE architecture guide.

SASE Components

SD-WAN: intelligent site-to-cloud and site-to-site connectivity
ZTNA (Zero Trust Network Access): access to private applications
SWG (Secure Web Gateway): outbound web proxy, URL filtering, and AV
CASB (Cloud Access Security Broker): SaaS visibility and control
FWaaS (Firewall-as-a-Service): Internet traffic inspection
DNS Security: secure DNS resolution, such as Cisco Umbrella
DLP (Data Loss Prevention): prevention of data exfiltration
RBI (Remote Browser Isolation): isolation of risky traffic

SSE vs. SASE

Since 2021, Gartner has distinguished between:

SSE (Security Service Edge): ZTNA + SWG + CASB + FWaaS (security only)
SASE = SSE + SD-WAN (with added connectivity)
For organizations with an existing SD-WAN: deploy SSE only

POP-Based Architecture

SASE is cloud-native and uses global POPs (Points of Presence):

User → nearest POP (<20ms)
Traffic inspection within the POP (all SASE services)
Egress to the Internet, SaaS, and private applications
Typical footprint: 100-200 POPs worldwide per vendor

Leading Vendors in 2026

Zscaler: pure-play SSE leader, 150+ POPs, excellent SLA
Palo Alto Prisma Access: integrated SSE + SD-WAN (CloudGenix → Prisma)
Netskope: established CASB leader with a comprehensive SSE offering
Cato Networks: cloud-native, single-pass SASE
Cisco Secure Access (Umbrella SIG + Duo + SD-WAN): Cisco integration
Fortinet SASE: FortiSASE delivered through the FortiGate VM cloud platform
Cloudflare One: SSE + ZTNA + SWG delivered over a global anycast network
Versa Networks: SASE with strong SD-WAN capabilities

Sizing and Costs

Basic SSE: €8-15 excluding tax/user/month
Complete SASE (SSE + SD-WAN): €20-35 excluding tax/user/month
SASE for an organization with 500 users: ~€15,000 excluding tax/month = €180,000 excluding tax/year
3-year TCO vs. a traditional architecture (FW + SWG + VPN): often 30% lower

Phased Deployment

Phase 1: DNS + SWG (2-3 months)

Migrate corporate Internet DNS to the SASE provider. Add an SWG browser proxy. A quick win with minimal disruption.

Phase 2: ZTNA (3-6 months)

Migrate internal applications from VPN to ZTNA. See the dedicated ZTNA guide.

Phase 3: CASB + DLP (3-6 months)

Gain visibility into M365, Google Workspace, and Salesforce. Apply DLP rules, such as blocking credit card data uploads to Dropbox.

Phase 4: FWaaS + SD-WAN (6-12 months)

Replace site firewalls and MPLS with SASE SD-WAN connectivity to POPs.

Selection Criteria

Number and location of POPs relative to users
ZTNA maturity (agent-based vs. agentless)
IdP integration (Azure AD, Okta)
Reporting and SIEM integration
TCO and vendor consolidation
Support maturity in France/Europe (French-speaking support, Paris/Marseille POPs)

Order from OPTINOC

OPTINOC provides SASE assessments, vendor selection, and turnkey deployment. Fortinet FortiSASE, Cisco, and Palo Alto Prisma. Quotes for SMBs and large enterprises within 48h.