SASE TERMS

SASE terms explained

Short answer

Thirty-two terms used across this site, defined in one to three sentences each. Where a term is a vendor's product name, it is labelled as such and linked to the profile.

A2A (agent-to-agent): Communication between AI agents, where one agent calls another to complete a task. Some vendors describe controls that broker and inspect this traffic.
Backbone: The network that carries traffic between a vendor's points of presence. A private backbone is one the vendor operates itself rather than relying on the public internet between locations.
CASB (cloud access security broker): A security function that gives visibility and control over the use of cloud and SaaS applications, such as who can upload or share data.
Clientless access: Access to a private application through a browser, without installing an agent on the device. Useful for contractors and unmanaged devices.
Converged SASE: A SASE service in which networking and security run on one software stack with one policy and one console, as opposed to separate products joined together.
CVE: Common Vulnerabilities and Exposures, the public catalogue of known security vulnerabilities, each with an identifier such as CVE-2021-44228.
Data lake: A single store of logs and events from every part of a platform. A shared data lake lets one query cover networking and security events together.
DEM (digital experience monitoring): Monitoring of application performance as users experience it, used to find whether a slowdown comes from the device, the network or the application.
DLP (data loss prevention): Inspection that detects sensitive data, such as personal or financial records, and blocks, redacts or logs its movement.
FedRAMP: The U.S. federal program that authorizes cloud services for use by federal agencies, at Low, Moderate or High impact levels. An authorization covers a specific cloud offering.
FWaaS (firewall as a service): Firewall functions delivered from the cloud instead of an appliance at each site.
GenAI app controls: Policies that decide which generative AI tools users may reach and which actions, such as uploads, are allowed.
IPS (intrusion prevention system): A function that matches traffic against known attack patterns and blocks matches. It is the usual layer for virtual patching.
Jailbreak: A prompt crafted to make an AI model ignore its safety instructions.
MCP (Model Context Protocol): An open protocol that lets AI applications and agents connect to tools and data sources through MCP servers. Security controls for MCP inspect or restrict these connections.
Multi-tenant console: A management view that lets a service provider run many customer environments from one place.
Path selection: Choosing the network route for each flow based on conditions such as latency or loss, a core SD-WAN function.
PoP (point of presence): A location where a vendor runs its service and where user and site traffic enters its network. Vendors count PoPs differently, so counts are not directly comparable.
Prompt injection: An attack that hides instructions in content an AI model reads, aiming to change what the model does.
PSIRT: Product security incident response team: the group at a vendor that handles reports of vulnerabilities in its products.
RBI (remote browser isolation): Running web sessions in an isolated remote browser and sending only a safe rendering to the user, to keep web content off the device.
SASE (secure access service edge): A cloud service model that combines wide-area networking (SD-WAN) with security functions (SSE) and delivers both from the vendor's cloud.
SD-WAN (software-defined wide-area network): Networking that connects sites over several links and steers traffic across them with central policy.
Service chaining: Passing traffic through several separate security engines in sequence, each with its own processing.
Shadow AI: Use of AI tools or agents in an organization without approval or visibility from IT and security teams.
Single-pass inspection: A design in which traffic is decrypted and inspected once, with every security function applied in that one pass.
Single-vendor SASE: A SASE offer in which one vendor provides both the networking and the security parts.
SLA (service level agreement): The contract terms that set the service levels a vendor commits to, such as uptime, and what happens when they are missed.
SSE (security service edge): The security half of SASE: typically SWG, CASB, ZTNA and FWaaS, often with DLP and RBI, delivered from the cloud.
SWG (secure web gateway): A function that filters and inspects web traffic to enforce policy and block threats.
Virtual patching: Blocking attempts to exploit a vulnerability at the network layer, usually with an IPS rule, before the vulnerable system itself is patched.
ZTNA (zero trust network access): Access to specific private applications granted per user and device after verification, instead of broad network access through a VPN.