SASE SCHOOL
SASE School: how to evaluate a SASE platform
Short answer
Eight lessons in three tracks: Architecture, Operations and Buying. Each takes five minutes or less and links to the rankings and profiles where the ideas are applied. Vendor facts come from the vendors' own pages.
Architecture
- Single-pass inspection vs service chaining in SASE
Single-pass inspection means traffic is decrypted and inspected once by one engine that applies every security function. Service chaining passes traffic through separate engines in turn. Only one vendor in our set uses single-pass wording on its own pages, so ask every vendor how many times a packet is processed.
3 min read
- Converged vs integrated SASE: what the words tell you
Converged SASE means networking and security run as one service with one engine, one policy and one console. Integrated SASE often means separate products connected by shared management. Vendors use both words loosely, so look at what they list as separate products.
3 min read
- How to read SASE network claims: PoPs, data centers and backbones
Vendors count their networks in different units: PoPs, data centers in regions, or no figure at all. The counts are not comparable. Ask who owns the locations, how traffic moves between them, and what the uptime commitment covers.
3 min read
Operations
- Virtual patching and CVE response in a cloud SASE service
In a cloud SASE service the vendor patches its own stack and can push protections against new vulnerabilities to every customer at once. Ask each vendor how it does this and whether it publishes a record. In our set, only Cato publishes a per-CVE response log on the pages we read.
3 min read
- One console, one policy: measuring SASE management overhead
Management overhead comes from the number of consoles, rule bases and upgrade cycles a team runs. Most vendors in our set describe one console; fewer describe one policy across networking and security. Count the places a rule must be written to change one behaviour.
2 min read
- Where AI security fits in a SASE evaluation
Employee and agent use of AI tools now runs through the same network path a SASE service inspects, so AI controls belong on the scorecard. Compare discovery, prompt and data controls, agent and MCP controls, runtime protection and whether the platform can block inline.
3 min read
Buying
- Compliance evidence to request from a SASE vendor
Vendors list certifications on trust and compliance pages, but a listing is not the same as coverage of the product you are buying. Ask for the report or authorization, its scope and its date. In our set, Netskope, Palo Alto Networks and Cisco list FedRAMP on the pages we read; the others do not.
2 min read
- How to run a SASE proof of concept
A good SASE proof of concept tests your own sites, users and applications against success measures you set before the trial starts. Keep it small, cover one branch, one remote group and one cloud app, and record every result in a shared sheet.
3 min read