Secure Access Service Edge
Your perimeter left the building. Your security model should follow it.
“One policy, wherever the user happens to be.”
SASE converges networking and network security into a single cloud-delivered service, so access is decided by who the user is and what the context is — not by which side of a firewall they happen to sit on.
Why this came up
Three things changed, and the old model did not follow.
The enterprise perimeter is no longer a building and a data centre. Managing access and security across every session, without giving up performance, is the part that actually got harder.
Icon
The workplace is everywhere
Users reach applications from home networks, hotel wifi and personal devices. The data centre stopped being the place everything passes through.
Icon
The estate is hybrid and multi-cloud
Applications sit in your data centre, in more than one public cloud and in SaaS. Backhauling all of it through one location costs latency and money.
Icon
The tooling sprawled
Separate products for web filtering, remote access, cloud app control and firewalling, each with its own console, policy language and renewal date.
What SASE actually is
Not new technology. One place to run it from.
Gartner coined the term in 2019, in The Future of Network Security Is in the Cloud. SASE converges networking and network security into a single cloud-delivered service. These are the parts.
SD-WAN
The network half
Dynamic path selection and WAN optimization, so traffic takes a sensible route instead of a fixed one and holds up when a link degrades.
SWG
Secure web gateway
Inspects and filters outbound web traffic, applying the same rules to a laptop in a coffee shop as to one at a desk.
CASB
Cloud access security broker
Gives visibility and control over the SaaS applications in use, including the ones nobody told IT about.
ZTNA
Zero trust network access
Verifies identity and entitlement for each request, and grants access to a named application rather than to the network.
FWaaS
Firewall as a service
Firewalling delivered from the cloud edge, so a branch does not need its own appliance and its own refresh cycle.
DNS and DLP
The controls alongside
DNS filtering, data loss prevention and intrusion prevention, enforced on the same traffic under the same policy.
Almost none of this is new on its own. What changes is that one vendor delivers it as one service, under one policy — which is where the cost and complexity actually come out.
The decision most people actually face
Do you need all of SASE, or just the security half?
This is the question worth settling before anyone demos a product. Full SASE converges the network and the security. SSE takes the security half on its own and leaves your WAN alone.
Full SASE
Network and security together
Best for
Organizations with branches, an SD-WAN refresh due, or MPLS contracts coming up — where the network and the security decision land at the same time.
You converge both halves with one vendor. Routing and policy are designed together, which is where the operational saving actually comes from.
Includes
- SD-WAN with dynamic path selection
- SWG, CASB, ZTNA and FWaaS
- One policy across sites and users
- Branch appliances retired on a plan
- Single console and single renewal
The tradeoff
Bigger change, and it couples your network refresh to your security vendor. Worth it when both are due anyway, harder to justify when only one is.
SSE only
The security half first
Best for
Organizations whose network is fine but whose remote access and SaaS control are not — most commonly where VPN is the thing actually causing pain.
Gartner split security service edge out of SASE in 2021 precisely because many organizations want this half on its own. You can add the network half later without redoing it.
Includes
- SWG, CASB and ZTNA
- VPN replaced for remote access
- Shadow SaaS discovered and controlled
- No change to your WAN contracts
- A shorter path to a visible result
The tradeoff
You solve access and SaaS control, not WAN cost or branch latency. Those stay on the list for later.
What it buys you
Four things change once it is one service.
The gains are mostly operational, and they compound — every console you retire is also a policy you no longer have to keep in step with three others.
Icon
Less to run
One solution for network and network security, so the product sprawl comes down and provisioning happens from one console instead of four.
Icon
Cost that scales
One subscription instead of acquiring, scaling and refreshing several overlapping products — and fewer appliances on a renewal cycle.
Icon
Security that follows the user
Policy is centralized and enforced on context, so the same rules apply whether someone is in the office, at home or on a hotel network.
Icon
Performance under load
Dynamic path selection and latency optimization keep access consistent when a link degrades, instead of failing over to a slower fixed route.
Where it earns its keep
Two situations where the model pays for itself.
Intelligent traffic routing improves how applications perform. Converged enforcement is what improves the security position. These are the two cases where both show up at once.
Use case 01
Remote staff on networks you do not control
People work from home routers, shared offices and public wifi. SASE secures the device and the session rather than the network it is sitting on, and allocates resources by context — so the line-of-business application still performs on a connection you have no say over.
Technologies in play
Use case 02
A mixed workforce under real compliance pressure
Some staff on site, some remote, and an auditor who expects access to be provable. Zero trust verifies identity and entitlement before granting access to anything — including for users already inside the perimeter, which is the case the old model never covered.
Technologies in play
Why organizations choose LKMethod
Trusted where performance and compliance are not optional.
Based in Arizona, LKMethod is an infrastructure architecture and managed services firm specializing in cybersecurity and cloud — right-sized for the organization in front of us, from compliance-driven environments to cloud-first transformations. We work in regulated verticals, where a misconfigured deployment is not just an IT problem.
Vendor-neutral by design
The SASE market is crowded and the products differ more than the category suggests. We start from your estate, not from a shortlist.
Consultative, not prescriptive
The process starts with your requirements and your renewal dates, not with a product recommendation chosen before the first call.
Built for regulated environments
Security is the floor, not the feature. Every design is architected to hold up under an audit.
Where we work
Organizations that count on us
Mesa Airlines · Haydon Construction · OneAZ Credit Union · Arizona Community Physicians
The right fit, not the easiest sale
Not sure whether you need SASE or SSE?
That is exactly what the review is for. Thirty minutes with a solution architect, a look at your current estate and renewal dates, and an honest recommendation — even when it is not the biggest project.