Zero Trust vs SASE vs SSE model, stack, then network

Lessons · Architecture · Zero Trust vs SASE vs SSE

Hero · user hits a stack, not a slogan

Why the board mixes the three

The day-one ticket is always the same: “We need Zero Trust. Which SASE do we buy?” Wrong question. Zero Trust is not a product category. SASE is not a synonym for Zero Trust. SSE is not “SASE without the marketing.”

Three silent-wrong states look identical in a board deck (one slide, one logo):

• The program is named Zero Trust; the purchase is a cloud proxy; identity and device posture were never wired.
• SSE is live; the old on-prem proxy and branch firewalls were never retired — two policy engines, two answers in audit.
• SD-WAN was ripped out two years early to “go SASE,” then the SSE vendor and the WAN vendor still don’t share a policy plane.

Concept — model, stack, network

Hold three layers. They nest. They are not interchangeable.

SSE stack — SWG, CASB, ZTNA, DLP

Gartner’s 2021 SSE category is the security half of SASE: cloud services that control access to websites, SaaS and private applications regardless of user location. The three services every vendor write-up agrees on are SWG, CASB and ZTNA. In production you operate a fourth as first-class: DLP, because the asset you are protecting is data, not a URL category.

FWaaS (cloud NGFW) is commonly bundled and is what you add when you retire branch firewalls. It is still security, so it sits in SSE. It is not SD-WAN — path selection and last-mile remain the network half.

Path · model, then stack, then network, then proof

How they nest

Zero Trust does not require SASE. SASE does not equal Zero Trust. ZTNA is one enforcement point inside SSE that implements a Zero Trust access pattern for private apps. Identity (IdP, MFA, device compliance) is a prerequisite, not an SSE feature.

CISO decision table

The WAN contract decides the architecture. The identity program decides whether Zero Trust is real. The data-protection program decides whether SSE is more than a proxy. Run the table before a bake-off.

Do — Side A / B / C

Lab-free architecture runbook. Output is a one-page CISO memo, not a CLI. Facts below are the ones you collect; they are not invented VIP addresses.

Side A — facts you collect before a quote

1. WAN and VPN inventory

   SD-WAN vendor, contract end, overlay health. SSL-VPN user count and whether it still dumps people onto a VLAN. If clients can reach private apps without the future ZTNA broker, that is a bypass — same class of bug as hitting a pool IP instead of a VIP.

2. Identity and device

   IdP (Entra / Okta / Ping), MFA coverage, device compliance signal. SSE consumes these. If MFA is optional and posture is empty, ZTNA will still grant based on a password. That is not the model. Source: NIST SP 800-207 — authentication and authorization as discrete functions before a resource session.

3. App and data inventory

   Private apps (ZTNA cannot broker what you cannot name). SaaS tenants (CASB). Data classes that must not leave (DLP). VPN never required an app list; ZTNA does. Budget discovery as a phase-0, not a surprise.

Side B — pick the layer and the first control

1. Score the decision table

   Recent SD-WAN → SSE-first. Greenfield / EoL WAN + appetite for one vendor → SASE. Identity-first with VPN pain → ZTNA as SSE phase 1 regardless. Write the row you chose in the memo; do not hide it in a 40-page RFP.

2. Phase the SSE stack

   Phase 1: ZTNA (replace VPN) after app inventory. Phase 2: SWG (replace on-prem proxy). Phase 3: CASB + DLP on the same labels. Phase 4: FWaaS only when branch NGFW retirement is a real project. Source: SSE as security-only subset — Cisco SASE explainer; Gartner SSE as web / SaaS / private-app access.

3. Write the decommission in phase 1

   For each SSE service, name the legacy box it kills and the date traffic stops hitting it. Running SSE beside the old proxy for 18 months is the default failure, not a “careful migration.”

4. Vendor as continuity, not a ranking

   If the SOC already writes Palo Alto or Zscaler or Cisco policy every day, that fluency is a cost input. Examples: Prisma Access for an existing PAN-OS estate; Cisco Secure Access where Umbrella/SD-WAN is incumbent; a CASB-strong SSE where data is the driver. Not a Magic Quadrant.

Side C — proof the board will accept

1. One sentence that uses all three terms

   “Zero Trust is the model. This year we deliver it as SSE (SWG + CASB + ZTNA + DLP) on the current SD-WAN. SASE consolidation is a renewal question, not a Q1 rip.” If the sentence needs a logo to make sense, it is still wrong.

2. Pilot evidence, not a PO

   ZTNA: named app, named IdP group, session log with user + device + app — not “VPN users migrated.” SWG: TLS inspect on a pilot OU, block page + log. DLP: one data class, one incident in the SSE queue, legacy channel silent. Identity: MFA + posture required on the ZTNA app.

3. Dual-perimeter test

   From an on-prem VLAN, hit a URL the SSE blocks. If it still loads through the old proxy, you have two engines. Fix steering (PAC, tunnel, GRE, explicit proxy) or you failed Side B even if the licence is paid.

Zero Trust = model (NIST SP 800-207).
SSE      = security stack this year: SWG + CASB + ZTNA + DLP
           on incumbent SD-WAN <vendor / contract end>.
SASE     = SSE + SD-WAN — evaluate at <renewal date>,
           not a Q1 rip-and-replace.
Phase 1  = ZTNA for <N private apps>; VPN retire date <YYYY-MM>.

One session after go-live

After SSE is steered, a WFH user opening a private app and a SaaS tenant does this:

1. Endpoint agent (or PAC / GRE) sends the session to the nearest SSE PoP. It does not land on a campus VLAN “because VPN.”
2. SSE asks the IdP: who, which device, which MFA. Fail closed if posture is missing — that is the model, not a nice-to-have.
3. ZTNA allows only the named app. SWG inspects internet. CASB + DLP inspect the SaaS path. Same labels.
4. If this is SASE, the branch underlay is the same vendor’s SD-WAN (or a designed pair). If this is SSE-first, the existing SD-WAN only carries bits; policy still lives in SSE.

Traps + proof

Proof · architecture is verified, not purchased

Sources

• NIST SP 800-207 — Zero Trust Architecture (model: no implicit trust from location; authN/authZ before a resource session)
• NIST SP 1800-35 — Implementing a Zero Trust Architecture
• Gartner glossary — Secure Access Service Edge (SASE) (category coined 2019: WAN + security, cloud-delivered)
• Cisco — What is SASE (SSE = security half; SASE adds SD-WAN; SWG / CASB / ZTNA / FWaaS listed as security services)
• Palo Alto Networks Cyberpedia — What is SSE (Gartner 2021 SSE: ZTNA, SWG, CASB, FWaaS)
• Zscaler glossary — What is Security Service Edge (SSE as SASE subset; DLP/FWaaS as common platform add-ons)
• CISA — Zero Trust Maturity Model

Related: F5 APM Zero Trust access · AI identity — the new insider threat