SASE vs zero trust: The basics

January 23, 2024
Author: Kevin Johnston
Blog | Security

What are zero trust and SASE?

As users increasingly adopt hybrid or fully remote work models and IT environments become more distributed, securing data only becomes more complicated. The traditional data-centric security approach falls short in distributed environments, with each user, mobile device, and network request representing a potential breach.

These challenges require nimble, evolving ways to address network and data security. Two of the most prominent methods are adopting a secure access service edge (SASE) solution or zero trust framework. SASE is a solution comprised of multiple components but packaged as a singular product. There may be some flexibility, but typical SASE solutions will include SD-WAN, SSE, secure VPN, and CASB. By contrast, CBTS definesthe zero trust framework as an aspirational, comprehensive security journey rather than a specific product or group of products. It involves many steps to an end goal that an organization may never fully reach because of the rapidly evolving security landscape. No individual point solution or OEM can fully encompass zero trust, but SASE is a current component of a successful zero trust framework.

In this post, we will compare and contrast SASE vs zero trust, exploring how these approaches support the security of your organization both individually and in combination.

Key terminology:

  • Zero trust: CBTS defines zero trust as an aspirational strategy to ensure the most secure network possible. Under this ideology, there is “zero trust” given to people, places, and data across the network regardless of status, requiring layers of secure connectivity methods to protect the network. New components are continually adopted to meet evolving security standards.
  • Secure access service edge (SASE): SASE (pronounced “sassy”) is a suite of networking and security tools that includes four key technologies: SD-WAN, SSE, secure VPN, and CASB. Within the SASE framework, these technologies are combined and enhanced to provide a secure solution.
    • Software-defined wide area network (SD-WAN): A virtualized network alternative to traditional hard-lined networks, SD-WAN speeds network traffic and boosts reliability through intelligent routing through multiple network transports (DIA, broadband, LTE, etc.).
    • Secure service edge (SSE): A solution that dynamically secures access to applications, data, and networks through cloud-hosted security tools, such as secure web gateway (SWG) and Firewall-as-a-Service (FWaaS) technologies.
    • Secure virtual private network (VPN): An encrypted connection between a device and an organization’s network.
    • Cloud access security broker (CASB): Security enforcement points for cloud-hosted resources. CASB tools provide visibility, access control, threat protection and data loss prevention (DLP) service to ensure the security of an organization’s Software-as-a-service (SaaS) and Infrastructure-as-a-Service (IaaS) platforms.
Learn more: The six pillars of cloud security strategy

The technologies driving zero trust and SASE

Let’s start with the absolute basics. The momentum in security over the past few years has been consolidating and simplifying security platforms, leading organizations to seek comprehensive security options that address their networking needs. Zero trust and SASE evolved from this movement as options to help prevent network managers from adopting multiple different security measures that all address different goals. By adopting a zero-trust framework or SASE solution, managers can streamline their security efforts while still protecting all aspects of their organization.

However, zero trust is not a technology solution for consolidating existing technologies, but a set of guiding principles. As outlined by NIST and CISA, these principles combine to create a zero-trust strategy that simplifies various aspects of security into a singular framework for creating a comprehensive strategy to secure an organization’s digital landscape. CISA defines six pillars that include securing:

  1. Identity.
  2. Devices.
  3. Networks.
  4. Applications.
  5. Workloads.
  6. Data.

As organizations embark on the zero-trust journey, they may draw on multifactor authentication (MFA), next-gen extended detection and response (XDR), data encryption, and best practices such as e-mail security and password hygiene, to protect each pillar. “May” is the key word here, as zero trust neither requires nor is limited to those solutions as a framework. The components used to build a zero trust framework will continue to evolve according to best practices, security developments, and business needs.

SASE is a technology solution that many businesses view as a core component when designing a zero-trust strategy, and it encompasses technologies such as SD-WAN, SSE, VPN, and CASB to provide a combined secure networking product. In doing so, the SASE product seeks to address several key security needs. According to Microsoft, those pillars of SASE include:

  • Identity: Ensures access is limited to verified identities of devices and users.
  • Cloud-native delivery: Improves overall security and infrastructure.
  • Complete edge support: Supports all digital, physical, and logical network edges.
  • Global distribution: Supports all users worldwide, regardless of location.
Read more: Ten essential benefits of a managed SASE solution

Even though there is a lot of overlap in the focus and security coverage of SASE vs zero trust, and both options are rooted in an effort to consolidate security platforms, the two are not interchangeable.


  • Identity: Identity is a key element in both zero trust architectures and SASE, with organizations needing well defined business policies and rulesets to ensure appropriate access to resources.
  • Consolidation: SASE consolidates several network security products into a single solution. Zero trust consolidates several security pillars into a framework with which to address your changing security needs.
  • Constant authentication: SASE and zero trust both require users to be verified to perform specific functions or access different data sets. Unlike a traditional VPN, the user does not have total access to any operation once they are in your system.
  • Contextual access: Both frameworks utilize contextual risk assessments and access.


  • Identity: In a zero-trust approach, a user’s access is continuously verified to ensure they are who they claim to be. Beyond the technology itself, a zero trust framework defines which identities and users within an organization should have access to which resources. On the other hand, SASE is the technology tool that actually is integrates with identity sources and monitors connections between users and data to ensure that real-world access matches an organization’s zero trust security policies.
  • Scope: Zero trust is a framework to address organizational security broadly. SASE focuses on network security.
  • Solution type: SASE is a technology product that combines several products into a unified solution. Zero trust is an aspirational method of securing your business to the best possible standard and adapting to evolving security needs and trends.

The advantages of merging zero trust and SASE

The trend in security is to integrate, centralize, and streamline operations. With that in mind, we recommend the adoption of not just zero trust or SASE, but a zero trust framework that involves the right SASE solution for your business. This approach provides many compelling benefits.

  • Comprehensive security: SASE and zero trust provide enhanced visibility into the IT environment and eliminate gaps and silos within security architecture.
  • Reduced complexity: Reduce network complexity by centralizing the security toolset and streamlining some aspects of the IT environment.
  • Improved scalability: Easily scale up or down depending on the organization’s needs, which helps improve business performance and agility, as well as reduce costs.
  • Resource optimization: Automate some routine and recurring aspects of the security agenda, which frees staff to focus on higher-value tasks.

The integration of SASE and zero trust principles enable organizations to move toward zero trust through a unified solution that can uniformly uphold security protocols through the digital estate and beyond.

Which is right for my business?

Ultimately, the situation is not SASE vs zero trust. SASE is not the next level of zero trust or vice versa. Zero trust is an overall approach to enterprise IT security with SASE being a crucial tool in the security and network too.

SASE provides crucial secure networking protections for your organization. But as a product, it the implementation can be a heavy lift for some organizations. Implementation can be time consuming and complex, especially for smaller IT teams.

Zero trust is more straightforward because it begins wherever you are on the road to an aspirational goal of perfect security. Most organizations can take immediate steps to increase security, resulting in swift ROI. However, it can be challenging for some organizations to step back from the day-to-day focus on IT operations and spend the time to develop a comprehensive zero trust roadmap.

We recommend consulting with our team to identify your specific needs and develop a customized security strategy involving zero trust and SASE.

Building out a zero-trust approach to your network security is crucial for any business, especially retailers that maintain large customer databases of personal information. As a common cybercrime target, retailers can especially benefit from the enhanced security provided by a merged SASE and zero trust security fabric.

Learn more: Revolutionizing retail: The storefront of the future

Related Stories

Schedule a complimentary
30-minute consultation with an engineer

Join the Conversation!

Related Solutions