Secure access service edge (SASE) is an industry term for delivering network connectivity and security controls, such as secure web access and remote access, as cloud services close to users. It is not a standard. A CISO should test any SASE plan against zero trust principles and their own traffic.
Is SASE a standard or a product category?
It is an industry term. We did not find a NIST or ISO definition of it, so treat vendor definitions as marketing until you have written your own requirements. NIST SP 800-207 on zero trust architecture is the neutral reference, and it explains why SASE became attractive.
NIST describes zero trust as a response to enterprise trends such as remote users, bring your own device and cloud assets outside an enterprise-owned network boundary. It focuses on protecting resources, not network segments, because network location is no longer the prime component of a resource's security posture.
Which zero trust ideas map to SASE?
SP 800-207 describes logical components. A policy engine decides whether to grant access, a policy administrator sets up or tears down the session, and a policy enforcement point sits in the path and enforces the decision. The document says a single product can combine several of these, and that in some offerings the engine and administrator are one service.
When you evaluate a SASE service, ask which of those functions it performs, where it sits, and what signals it consumes. Authentication and authorization of both user and device should happen before a session to a resource is established, per NIST's abstract.
What are the common failure modes?
The first is moving the old perimeter to the cloud: a broad network tunnel with one login, giving a user wide access once inside. That reproduces implicit trust.
The second is inventory. NIST's approach assumes you know your resources. If you cannot list your applications and who needs them, no policy engine can help.
The third is concentration. Routing all traffic through one provider is a dependency. SP 800-207 notes that portal style deployments can be discovered by attackers and may be targeted for denial of service, so availability and provider resilience belong in the contract.
How should you test a SASE plan?
A constructed example: a 400 person company with a data center, three SaaS apps and a remote workforce. Before talking to providers, the CISO writes down the ten applications that matter, the groups that need each, the device requirements and the logging needed for investigations. Each provider is then asked to show that exact scenario, including what happens when a device fails a posture check.
What about the branch office and the legacy data center?
Zero trust is easy to describe for a SaaS app and harder for a legacy system. SP 800-207 covers this. In its enclave model, gateways sit at the boundary of a resource enclave, such as an on-premises data center, rather than in front of each resource. NIST says this suits legacy applications that cannot have individual gateways, and that it needs a strong asset and configuration management program to run the device agents.
Ask any SASE provider how it would handle your oldest system, not your newest. The answer shows where the architecture stops being clean.
How to check or apply this
- List your applications, data stores and the user groups that need each one.
- Write access rules per application, not per network, and include device requirements.
- Map each provider capability to policy engine, policy administrator and enforcement point.
- Ask what is visible when a session is denied, terminated or re-evaluated.
- Check logging export formats, retention and who can read them.
- Plan for provider outage: fallback access, and a tested break glass path.
- Run a pilot on one application group before migrating everything.
Quick check
Does buying SASE give me zero trust?
No. Zero trust is an architecture and a set of decisions, per NIST SP 800-207. A service can help enforce it, but you still define resources, policies and trust signals.
What should I ask a provider first?
Which logical functions it performs, and a live demonstration of your own access scenario with denied and revoked sessions.
Sources
Last reviewed: 18 October 2026.
