SASE SSE: The Relationship Between SASE and Security Service Edge

Security Service Edge (SSE) is a converged, cloud-delivered security service set that secures access to the web, cloud services, and private applications, with Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), and Zero Trust Network Access (ZTNA) as its core functions. Gartner introduced the SSE category in 2021 and published the first Security Service Edge Magic Quadrant in February 2022, with Netskope, Zscaler, and McAfee Enterprise (now Skyhigh Security) positioned as the initial Leaders.

SSE packages the security half of SASE for organizations whose networking layer is not ready to converge, and Gartner predicts that by 2026, 85% of organizations buying CASB, SWG, or ZTNA will buy them from a converged platform.

Where traffic is inspected and security policies are enforced depends on the architecture. Traditional cloud-delivered SSE performs these functions in the vendor’s points of presence (PoPs), while distributed SASE architectures perform them directly on the organization’s endpoints, gateways, and cloud infrastructure.

Secure Access Service Edge (SASE) is the converged architecture that combines SD-WAN networking with SSE security functions into a single service under one policy plane. Gartner defined SASE in the August 2019 report “The Future of Network Security Is in the Cloud”, authored by Neil MacDonald, Lawrence Orans, and Joe Skorupa, and later added a dedicated Single-Vendor SASE Magic Quadrant, first published in August 2023.

The complete SASE capability set is SD-WAN, Firewall as a Service (FWaaS), SWG, CASB, and ZTNA, with Data Loss Prevention (DLP) and threat prevention embedded across them, as documented in SASE Solutions. SASE's defining property is convergence: one enforcement fabric, one identity context, and one inspection pass for both networking and security.

The relationship between SASE and SSE is compositional. SASE equals SSE plus SD-WAN, so SSE is the security service edge of the SASE architecture, packaged as an independent offering. Gartner created the split in 2021, two years after defining SASE, because buying behavior had split: security teams were ready to converge SWG, CASB, and ZTNA immediately, while network teams held SD-WAN refresh cycles of 3 to 5 years that did not align.

SSE therefore functions as both a destination and a stage: a destination for organizations that keep networking separate by design, and a stage for organizations on a phased road to full SASE. The equation also explains vendor positioning, since SSE specialists such as Netskope and Zscaler expanded toward SASE while networking vendors such as Fortinet and Cato Networks arrived from the SD-WAN side.

The core components of SSE within SASE are the 3 security functions listed below.

FWaaS and DLP travel with the set in most platform implementations.

The SWG component of SSE is the function that governs all web-bound traffic, inspecting HTTP and HTTPS sessions against URL categories, malware engines, and data policies. The SWG descends from the proxy appliance market that Blue Coat led before Symantec's 4.65 billion USD acquisition in 2016, and Gartner retired the standalone SWG Magic Quadrant after 2020 in favor of the SSE evaluation. Inside SSE, the SWG performs TLS 1.3 interception, category filtering across databases of hundreds of millions of domains, sandbox detonation of downloads, and application-level action control, all bound to user identity. Full capabilities, deployment models, and comparisons are detailed in SASE SWG.

The CASB component of SSE governs cloud application usage and the data within it across both sanctioned and unsanctioned services. The CASB operates in two modes: inline through the SSE enforcement point for real-time session control, and out of band through APIs into platforms such as Microsoft 365, Google Workspace, and Salesforce for data at rest.

Its four pillars, defined by Gartner with the category in 2012, are visibility, compliance, data security, and threat protection, covering duties from Shadow IT discovery, where McAfee measured 1,935 cloud services per enterprise in 2019, to General Data Protection Regulation (GDPR) and Payment Card Industry Data Security Standard (PCI DSS) 4.0 enforcement. The component boundary against the full architecture is analyzed in SASE vs CASB.

The ZTNA component of SSE is the function that replaces remote access virtual private network (VPN) with identity-based, per-application brokered access. ZTNA evaluates identity from providers such as Microsoft Entra ID or Okta, checks device posture, and connects the verified user to the single authorized application through outbound-only connectors, leaving no inbound ports exposed. The model implements the Zero Trust principles of NIST Special Publication 800-207 (August 2020) at the access layer: default deny, least privilege, and continuous verification with mid-session revocation. Gartner forecast that by 2025 at least 70% of new remote access deployments would use ZTNA rather than VPN, up from under 10% in 2021, the substitution examined in SASE vs ZTNA.

The difference between SASE and SSE is the networking layer: SASE includes SD-WAN and the WAN edge, while SSE delivers only the security services. The table below compares the two across 6 attributes.

SSE trades WAN control for faster, security-only adoption, and distributed implementations go further by removing the PoP dependency from the security half itself.

Gartner separated SSE from SASE in 2021 because the two halves of SASE were being bought by different teams on different timelines, and a single category obscured that reality. Security teams faced immediate drivers, expiring proxy contracts, VPN vulnerabilities under active exploitation, and SaaS sprawl, while network teams sat mid-cycle on SD-WAN and Multiprotocol Label Switching (MPLS) contracts running 3 to 5 years. The split let Gartner evaluate security convergence on its own merits, producing the SSE Magic Quadrant in February 2022, while the Single-Vendor SASE Magic Quadrant of August 2023 evaluated the full convergence. The separation also disciplined vendor marketing, since networking vendors could no longer claim SASE without the security depth, nor security vendors without SD-WAN.

Yes, SSE is a subset of SASE because it contains exactly the security services defined by SASE, with the networking layer removed. The relationship is compositional by design because Gartner carved SSE out of SASE in 2021 rather than defining a new discipline. Every SSE capability is a SASE capability, while SD-WAN capabilities exist only on the SASE side.

No, SSE is not the same as SASE because SSE lacks the SD-WAN networking layer that SASE mandates. An organization running SSE still operates its WAN separately, with its own routing, path selection, and branch connectivity. The terms name a half and a whole, and vendor materials that use them interchangeably compress a distinction that buyers pay for.

No, SSE does not include SD-WAN because the networking layer is precisely what Gartner removed when defining SSE in 2021. SSE secures access over whatever network exists, from legacy MPLS to a third-party SD-WAN. Adding SD-WAN to an SSE deployment produces full SASE, and the boundary between the two technologies is detailed in SASE vs SD-WAN.

The benefits of SSE compared to full SASE are listed below.

The use cases for SSE versus full SASE are listed below.

The four scenarios recur across the documented SASE Use Cases.

An organization should choose SSE over full SASE when the factors below favor cloud-delivered security without changing the existing network. Four points weigh the decision:

Migrating from SSE to full SASE is a 5-step process that adds the networking layer to a running security platform.

Validate completion when every site and user reaches applications through the same converged fabric under one policy plane, with the component boundary tracked in SASE vs SD-WAN.

Choosing an SSE vendor on the path to SASE is a 5-step evaluation that scores today's security depth against tomorrow's convergence.

Weight steps 2 and 3 highest, because an SSE choice is silently a SASE choice. The platform selected for the security half determines which architectures remain available when the networking half arrives.