Adoption of SASE, or secure access service edge, is accelerating—especially, according to IDC, at organizations of over 1,000 employees, while it’s estimated the global SASE market will grow from last year’s $1.83 billion to over $17 billion by 2033.
The business case for such rapid take-up is simple: SASE is the perfect way of blending the best of your network, the cloud, and cybersecurity. According to Gartner, because SASE is primarily delivered as software as a service, it’s a great way to enable full zero trust access based on the identity of the device or entity, and it’s easily combined with real-time context and security and compliance policies.
But there are decisions to be made as to which on-ramp organizations decide to use to get to full SASE functionality. Recent research from Xalient surveyed 250 IT, network, and security leaders from UK organizations with over 2000 employees to understand what they were looking for from any potential SASE solution. Respondents cited three main business drivers for looking to combine their networks and their security postures this way: the rising costs of traditional network architecture, a desire to move away from the use of legacy VPNs, and addressing performance issues with business-critical SaaS apps.
Multiple SASE production benefits—but also multiple SASE implementation challenges
Intriguingly, when the same SASE ‘buy-reason’ question was put to a global audience, securing remote access was the priority, sparking the question of whether the ongoing OPEX of legacy infrastructure might be more of an issue in the UK than in other regions. In any case, the UK-based senior practitioners surveyed did confirm a range of benefits from working at the edge, led by improved cloud app performance (35%) with more secure remote access, which is listed as the second highest benefit, at 30%.
These are solid business benefits, but we live in a world where the ‘arms race’ between organizations and hackers is only speeding up. This is why the zero trust principles Gartner (amongst others) is talking about, where nothing, human user or machine, is automatically trusted, is so important. The question for most CIOs or CISOs is whether they want to get there working with a single-vendor SASE solution or adopt a multi-vendor approach.
According to the survey findings, 50% of the UK respondents had adopted a single-vendor SASE solution, while 42% had gone down the multi-vendor route. But expectations had not always met reality with both options: 29% of single-vendor respondents were frustrated that they weren’t getting the required security controls envisaged, 26% said they were trying to get to a SASE network safely by working with one partner and admitted to difficulty obtaining the control they wanted, and 25% were worried about vendor lock-in; however, 26% of multi-vendor respondents found that the pricing isn’t always clear and it is more challenging to manage more than one vendor.
One SASE size does not fit all
On the face of it, a single-vendor SASE solution might feel like the right approach; however, while customers might think this model is tightly integrated and coherent, on closer inspection of the component parts, they may find some areas don’t cover their requirements. Some of these teething issues are baked into the basic nature of SASE itself; it’s complex and brings together both security and networking; therefore, consolidating and simplifying as much as possible is key.
However, there were equal challenges with multi-vendor SASE environments. While respondents said this delivered better security controls (31%) and the flexibility to introduce different vendors on a best-of-breed basis, they reported concerns about the complexity of making all this work day-to-day.
With multi-vendor, the SASE buyer leader can theoretically choose best-of-breed functionality— going to a security specialist to buy the best on the market and going to a network expert to buy the network components. Most vendors now have open integration frameworks so they can pair this together. The issue here is that vendor X may not support the integration required for SASE component Y, so the customer may have to implement some of the middleware. Additionally, not all those integrations are simple to configure and don’t have the single pane of glass to manage everything from a single-vendor SASE, so complexity tends to spread.
Understanding what outcomes you want to achieve
This is why it is so important for customers to scope requirements first and understand the outcomes they want and the use cases they need to support to make the right design decisions and approach. If the requirement definition and vendor selection were influenced by one more than the other, this would impact the overall outcomes and satisfaction levels. Therefore, it is important to make sure that the requirements encompass both network and security and that these are prioritized accordingly.
Above all, organizations should avoid doing a fractional SASE implementation. They don’t necessarily need to implement it at the same time, but they should consider the implications one has on the other, and they shouldn’t try to solve the same problem in two different ways.
Working with a good MSP to shape your strategy
This is where a good Managed Service Provider (MSP) who knows their way around SASE can help at the selection process stage (in both single and multi-vendor scenarios), ensuring that the organization implements and continues to manage the SASE solution that’s right for their business. With SASE, if implemented right, organizations can address all aspects in a single solution rather than bolt on numerous discrete solutions. Here, a good MSP will help ensure the solution is not only more secure but also more efficient and less complex.
SASE adoption is definitely growing, however, the research results suggests that there’s no ‘one size fits all’ SASE answer. Therefore, it is best to understand what solution will best meet the network, cloud, and security goals that the organization requires—and work back from that to where it is today rather than focus first on how to implement it. Again, this is where an MSP with SASE expertise could help the organization shape its strategy and requirements.
- Right Now, There is No Right or Wrong SASE Answer - January 17, 2025