Security Service Edge (SSE) is the security-only subset of Secure Access Service Edge (SASE), not a separate category or a rebranding of the same thing. SASE is the convergence of networking (SD-WAN) with security services in one cloud-delivered platform. SSE includes the same security services, secure web gateway, cloud access security broker, and zero trust network access, but leaves the networking piece out entirely. Gartner split SSE out as its own market category in 2021 specifically because many organizations weren’t ready to replace their networking infrastructure and security stack at the same time.
That distinction matters more than it sounds like it should, because getting it wrong shapes what an organization actually buys. This page covers what each framework includes, why the split happened, and how to decide whether SSE alone or full SASE fits your current infrastructure and connectivity needs.
The Difference at a Glance
SASE bundles networking and security together. SSE is the security half only, with networking sourced separately. Since the security services largely overlap between the two, vendor security capabilities are often comparable, the real decision point is whether networking needs to change too.
SASE vs. SSE
| SASE | SSE | |
|---|---|---|
| Networking (SD-WAN) | Included | Not included, sourced separately |
| Zero trust network access | Included | Included |
| Secure web gateway | Included | Included |
| Cloud access security broker | Included | Included |
| Firewall-as-a-service | Included | Included (varies by vendor) |
| Typical adopter | Organizations doing a broader infrastructure refresh | Organizations with working SD-WAN, upgrading security only |
| Vendor relationship | Single vendor for network and security | Security vendor, networking sourced separately or existing |
What Is SASE?
Secure Access Service Edge is a cloud-native architecture combining wide area networking (SD-WAN) with a bundled set of security services, typically zero trust network access (ZTNA), secure web gateway (SWG), cloud access security broker (CASB), and firewall-as-a-service (FWaaS). Gartner introduced the concept in 2019 to describe consolidating what had previously been separate networking and security vendors into a single platform and policy engine.
The networking half of that bundle isn’t just basic connectivity. SD-WAN in a SASE architecture typically includes WAN optimization and dynamic traffic routing across branch offices and remote sites, which is a real networking capability organizations lose if they only adopt the security half. Adopting full SASE is a bigger project than it might sound like from the marketing. It typically means evaluating a new networking vendor alongside a new security stack, since SD-WAN is a core part of the bundle, not an optional add-on. That’s the right move for organizations doing a broader infrastructure refresh, but it’s a heavier lift than security teams sometimes expect going in.
What Is SSE?
Security Service Edge (SSE) is the security-focused subset of SASE: the same cloud-delivered security services (ZTNA, SWG, CASB) without the SD-WAN and networking components. Gartner formally split SSE into its own Magic Quadrant category in 2021, acknowledging that a large share of the market wanted the security consolidation SASE promised without replacing their existing networking infrastructure at the same time.
SSE became the practical entry point for organizations that already had working SD-WAN, sometimes from a recent networking refresh, and specifically wanted to replace or upgrade their security stack. It’s not a smaller or lesser version of SASE. It’s the security half of SASE, sold and deployed on its own, and its ZTNA component is often the piece organizations lean on hardest, since it governs access to private applications without exposing them to the broader internet the way a traditional VPN gateway does.
The Core Difference: Networking vs. Security-Only
The distinction is scope, not capability. SASE = networking (SD-WAN) plus security services. SSE = the security services alone, with networking sourced separately or left as-is. An organization that keeps its current SD-WAN vendor while replacing its firewall, web gateway, and access broker with a cloud-delivered stack is adopting SSE, not SASE, even if the security vendor markets its product under the broader SASE label.
This is where a lot of the confusion in the market actually comes from. Some vendors sell SSE and describe it loosely as SASE because the security services overlap heavily. Reading a vendor’s actual architecture diagram, specifically whether SD-WAN or WAN optimization is included, is the fastest way to tell which one you’re actually being sold.
Why Gartner Split SASE Into Two Categories
Full SASE adoption in 2019 and 2020 asked organizations to change two things at once: their networking vendor and their security stack. For companies that had just invested in SD-WAN, or whose networking team and security team operated as separate budget owners entirely, that was a harder sell than a security-only upgrade.
SSE gave those organizations a path to the same security consolidation, ZTNA replacing VPN, a unified SWG and CASB, without touching the network layer. Many organizations that start with SSE do eventually expand into full SASE, but SSE removed the all-or-nothing framing that made early SASE adoption slower than Gartner initially projected.
Security Capabilities: Where SASE and SSE Overlap
| SASE | SSE | |
|---|---|---|
| Zero trust network access | Included | Included |
| Secure web gateway | Included | Included |
| Cloud access security broker | Included | Included |
| Data loss prevention | Often included | Often included |
| Firewall-as-a-service | Included | Included (varies by vendor) |
Since these security capabilities largely overlap, vendor security posture is often comparable between a full SASE platform and a standalone SSE offering from the same provider. The real decision point isn’t security capability, it’s whether networking needs to change too.
Choosing Between SASE and SSE
An organization with a recent, working SD-WAN deployment and a specific pain point in its security stack, outdated firewalls, no consistent security policies across branch offices, weak remote access, is a strong SSE candidate. Adding a full SASE platform on top of SD-WAN that’s already functioning well means paying for and managing networking capability that isn’t actually needed.
An organization doing a broader infrastructure refresh, replacing aging WAN links, opening new branch offices, or consolidating multiple regional vendors, is better positioned to evaluate full SASE, since the networking and connectivity change is happening anyway. The honest tradeoff to acknowledge: single-vendor SASE simplifies management by consolidating everything under one policy engine, but multi-vendor setups (existing SD-WAN plus a separate SSE security layer) preserve prior infrastructure investment at the cost of one more integration point to maintain. The right use case ultimately comes down to what’s already working in your network, not which label sounds more complete.
How Portnox Fits Into Either Path
Portnox focuses on the access control layer within broader SASE and SSE strategies. What it delivers is the cloud-native zero trust access control layer, combining network access control and ZTNA, that both SASE and SSE architectures depend on for identity and device verification at the access layer.
Whether an organization is scoping a full SASE strategy or evaluating SSE on top of existing networking, Portnox strengthens the identity and device-posture foundation underneath either choice, including governing access to private applications, without requiring that decision to be made first. This matters in practice because access control is the piece most often left thin in early-stage SASE and SSE rollouts, teams focus budget on the visible networking or gateway components and underinvest in verifying who’s actually connecting.
FAQs
Is SSE a smaller version of SASE or a separate framework?
SSE is the security-only subset of SASE, not a smaller or lesser version. It includes the same core security services as SASE, such as ZTNA, secure web gateway, and CASB, but excludes the SD-WAN and networking components that full SASE bundles in.
Should an organization adopt SSE before moving to full SASE?
It depends on existing infrastructure. Organizations with a recent, working SD-WAN deployment often adopt SSE first to upgrade security without disrupting networking that already functions well. Organizations doing a broader infrastructure refresh are often better positioned to evaluate full SASE directly.
Does SSE include zero trust network access as a core component?
Yes. Zero trust network access is one of the standard security services included in SSE, alongside secure web gateway and cloud access security broker. It’s one of the areas where SSE and full SASE overlap almost entirely.
What networking capability does SASE include that SSE leaves out?
SASE includes SD-WAN (software-defined wide area networking), which handles routing, traffic optimization, and connectivity between branch offices and users. SSE excludes this entirely and focuses only on the security services layer, leaving networking to be sourced separately or handled by existing infrastructure.
SASE and SSE aren’t competing standards, one is the security half of the other. If your current gap is weak identity and device verification underneath whichever framework you’re evaluating, request a demo to see how Portnox’s access control layer supports either path.