What is SASE? Networking and security unified in the cloud
SASE (Secure Access Service Edge) brings networking (SD-WAN) and security functions (firewall, web filtering, ZTNA, CASB, DLP) together in a single cloud platform. Every user, site and application follows the same rules, wherever the connection comes from.
SASE in one definition
Gartner defined SASE in 2019 in the report "The Future of Network Security Is in the Cloud". The principle: security follows the user's identity and the context of each connection. It is enforced as close to the user as possible, in cloud points of presence around the world.
SASE replaces the stack of appliances on every site (router, firewall, VPN concentrator) with a single cloud service, managed from one console. Sites, datacenters, cloud and remote users are all managed the same way.
The 6 components of SASE
A complete SASE brings 6 functions together in the same cloud service. They share the same policy, the same logs and the same console.
SD-WAN
Connects sites and picks the best link for each application, with QoS and real-time traffic optimisation.
FWaaS, cloud firewall
Filters traffic between sites, to the Internet and to the cloud, with IPS and anti-malware.
SWG, secure web gateway
Controls web browsing and blocks malicious or risky sites.
CASB
Gives visibility and control over SaaS applications, including generative AI.
ZTNA
Grants access to each application based on the user's identity and the device's trust level.
DLP
Detects and protects sensitive data across all traffic, files and applications.
SASE vs SSE: what is the difference?
SSE (Security Service Edge), defined by Gartner in 2021, is the security part of SASE. SASE adds the networking part, with SD-WAN and site connectivity.
SSE
- Scope: users and access to applications
- Functions: SWG, CASB, ZTNA, DLP
- Typical use: a first step focused on remote work and SaaS
SASE
- Scope: users, sites, datacenters and cloud
- Functions: SSE + SD-WAN + FWaaS
- Typical use: full transformation of networking and security
Moving from MPLS to SASE in 3 phases
The migration runs site by site, in step with MPLS contract end dates, with continuity of service. A pivot site links the new SASE network to the existing network throughout the transition. Technical workshops prepare each phase.
- Pivot and pilot
- Pivot site between SASE and the existing network
- Pilot on 1 or 2 sites
- Security enabled in the cloud
- Progressive migration
- MPLS and IP-VPN sites migrated as contracts end
- Internet links deployed
- VPN remote users moved to the SASE client
- Migration complete
- All sites and users on SASE
- Internet and application traffic optimised
- MPLS and IP-VPN decommissioned
Why SASE with Cato Networks?
Cato Networks built its SASE platform in the cloud from day one: a single software stack, a private global backbone and a single console for networking, security and AI. Cato Networks was named a Leader in the 2025 Gartner Magic Quadrant for SASE Platforms.
MPLS, Internet SD-WAN or Cato Networks SASE?
MPLS guarantees performance between sites, Internet SD-WAN brings flexibility. SASE combines both and adds cloud-delivered security, as close as possible to every user.
MPLS
- Guaranteed performance between sites only
- QoS limited to a few flows
- Centralised Internet: a bottleneck towards the cloud
- Inter-site security to be added
- Separate firewalls, manual updates
- Remote users on a separate VPN
Internet SD-WAN
- Best effort, across several carriers
- SLA limited to each carrier
- Public IP exposed on every appliance
- Heterogeneous security, manual updates
- Remote users on a separate VPN
Cato Networks SASE
- Private backbone with guaranteed performance, all the way to the cloud
- Fine-grained QoS per application
- 99.999% availability SLA
- Sites invisible from the Internet, public IPs hidden
- Security centralised in the cloud, always up to date
- Remote users protected by the same service, with ZTNA
Fewer appliances, one policy, guaranteed performance
With Cato Networks SASE, every site and every user connects to the nearest point of presence. Security updates are deployed continuously in the cloud.
- One security policy for the office, remote work and travel
- Full visibility over traffic, applications and AI usage
- Compliance evidence for NIS 2 and DORA: logs, policies, access traceability
Source: Cato Networks, 2026 figures.
Securing AI with Cato Networks: usage, agents and applications
Generative AI, copilots, coding assistants, AI agents: AI now flows through every part of the business. Cato Networks builds its protection into SASE, in the same platform, the same policy and the same console, with two dedicated modules.
SASE foundation
- Dashboard of generative AI apps, shadow AI included
- Users, volumes and data shared for each tool
- Access restricted to corporate accounts of AI tools
- Blocking of specific actions, such as file uploads
AI Security for Users
- Inventory of AI apps, models, copilots and agents, sanctioned or not
- Real-time analysis of prompts, responses and agent actions, based on intent
- Control of MCP servers and blocking of risky tool calls
- Automatic blocking or redaction of sensitive data
- Source code protection against coding assistants
- Redirection to approved tools and audit log
AI Security for Applications
- AI firewall on prompts, responses and agent actions
- Detection of jailbreaks, prompt injection and off-policy responses
- Guardrails that block or redact risky outputs
- Discovery of AI applications, models and RAG workflows
- Model red teaming, findings ranked by impact
- Light deployment: proxy, AI gateway or API (AWS Bedrock, Azure ML)
Why SASE with SASETY?
SASETY deploys and operates Cato Networks SASE, named a Leader in the 2025 Gartner Magic Quadrant for SASE Platforms. One platform, one agent, one console: a single-vendor SASE, deployed on more than 850 sites in 35 countries.
Excellence partner
- Cato Networks Excellence partner 2022, 2023, 2024 and 2025
- Cato Networks MSSP since 2022
From architecture to operations
- Design, transition and installation
- 24/7 monitoring and operations
- End-to-end SLAs, from access to the SASE service
At the heart of Identity Guard
- SASE works with Silverfort, Mimecast, Halcyon and Pentera
- Every network signal feeds each identity's risk score
Frequently asked questions about SASE
What does SASE stand for?
SASE stands for Secure Access Service Edge. It is a model defined by Gartner in 2019 that brings networking (SD-WAN) and security (FWaaS, SWG, CASB, ZTNA, DLP) together in a single cloud service.
What is the difference between SASE and SSE?
SSE groups the security functions of SASE: SWG, CASB, ZTNA and DLP. SASE adds the networking part, with SD-WAN and site connectivity.
Does SASE replace MPLS?
Yes, progressively. SASE relies on Internet links and on the provider's global backbone. MPLS coexists during the transition, site by site.
How do you move from MPLS to SASE?
In 3 phases: a pivot site and a pilot, a progressive migration as contracts end, then MPLS decommissioning.
What is single-vendor SASE?
It is a SASE where all networking and security functions come from one platform, with one agent and one console. Gartner assesses these platforms in its Magic Quadrant for SASE Platforms.
Does SASE help with NIS 2 and DORA compliance?
Yes. It provides the access control, traffic encryption, logging and traceability required by NIS 2 and DORA, with evidence available in a single console.
Does SASE secure the use of generative AI?
Yes. CASB, DLP, AI Security the AI tools in use and the data sent to them. The Cato Networks AI Security for Users and AI Security for Applications modules go further: analysis of prompts and agent actions, control of MCP servers, guardrails and red teaming for in-house AI applications.
How do you secure AI agents and MCP servers?
AI Security for Users inventories AI agents, analyses their actions in real time and controls MCP servers and tool calls. For in-house agents, AI Security for Applications enforces runtime guardrails and traces every action.