Security Service Edge (SSE) is a group of security services delivered from the cloud that protect how users reach the web, SaaS applications and private applications, wherever they are working. It usually brings together a secure web gateway (SWG), a cloud access security broker (CASB) and zero trust network access (ZTNA), often with data loss prevention (DLP) and firewall as a service (FWaaS). SSE is the security half of Secure Access Service Edge (SASE), without the SD-WAN networking. The term is sometimes written “secure service edge.”
At a glance
- SSE combines web security (SWG), SaaS security (CASB) and private-app access (ZTNA) in one cloud service.
- Many SSE platforms also include DLP, firewall as a service and remote browser isolation; what’s included varies by vendor.
- Users connect through an agent or, for offices, a tunnel, to the provider’s nearest point of presence.
- It is SASE without SD-WAN, so it can be adopted without changing your WAN.
- It is a common replacement for remote-access VPNs and on-premises web proxies.
What problem it solves
For years, companies secured web browsing with an on-premises proxy, controlled remote access with a VPN and had little visibility into cloud apps. That worked when people sat in the office and applications ran in the data center. With staff working remotely and most applications in SaaS, traffic either gets backhauled through the data center to be inspected, which slows everything down, or bypasses inspection entirely.
At the same time, sensitive data moved into apps such as Microsoft 365, Google Workspace, Salesforce and file-sharing tools, and employees signed up for others without IT review. A VPN gives a remote user broad access to the network, which helps an attacker who steals their credentials.
SSE moves these controls into one cloud service that sits between users and everything they access, so the same policy applies whether someone is at home, in a branch or travelling.
How it works
Connecting users. A lightweight agent on laptops and phones sends traffic to the provider’s nearest point of presence. Offices can send traffic through an IPsec or GRE tunnel from an existing firewall or router. Some services also offer agentless access through a browser for contractors or unmanaged devices.
Web security (SWG). Web traffic is filtered by URL category and reputation, scanned for malware and, where policy allows, decrypted so the content can be inspected.
SaaS security (CASB). Inline controls can restrict actions inside sanctioned apps (for example, blocking uploads to a personal file-sharing account). API connections to apps such as Microsoft 365 let the service scan stored data and flag risky sharing settings.
Private-app access (ZTNA). Instead of a VPN, a connector inside the data center or cloud makes outbound connections to the provider. Users are granted access to specific applications after identity and device checks, and the applications are not exposed to the internet.
Policy and data protection. Rules are written against users, groups, devices and applications using your identity provider. DLP policies look for sensitive data such as card numbers or health records across web, SaaS and private-app traffic.
When it matters for buyers
- When the VPN is overloaded or under scrutiny. Exposed VPN appliances are a frequent attack target, and cyber insurers often ask how remote access is secured.
- When the web proxy or firewall subscription renews. Renewal is the time to compare a hardware refresh with a cloud service.
- When you can’t see or control SaaS use. If you don’t know which apps hold company data, CASB discovery is often the first useful output.
- When WAN contracts aren’t due yet. SSE lets you modernize security now and decide about SD-WAN and full SASE later.
- When contractors and partners need access. ZTNA can grant them one application rather than network access.
Questions to ask vendors
- Which of SWG, CASB, ZTNA, DLP and FWaaS are built on your own platform, and which come through partners or acquisitions?
- Is there one agent, one policy engine and one console across all components?
- Where are your points of presence, and what performance should users near our offices expect?
- How does TLS inspection work, and how do we exclude sensitive categories such as banking and healthcare?
- Which SaaS apps do you support with inline controls and which with API scanning?
- How does ZTNA handle non-web protocols and legacy applications?
- Can we add SD-WAN from you or a partner later, and how would policy carry over?
- How is it priced, and which features (DLP, browser isolation, log retention) cost extra?
How it differs from SASE
Secure Access Service Edge (SASE) is SSE plus networking, usually SD-WAN, so branch connectivity and security are managed together. If your main concern is protecting users and data, SSE may be all you need. If you are also replacing MPLS or branch routers, SASE brings both under one service.
How it differs from SWG, CASB and ZTNA
Secure web gateway (SWG), cloud access security broker (CASB) and zero trust network access (ZTNA) are individual products, each of which can be bought on its own. SSE is the category for buying them together as one service. Our Security Service Edge guide covers how to phase an SSE rollout, typically starting with web security and ending with private-app access.
Problems this helps with
- Remote users on a slow, overloaded VPN
- No control over which SaaS apps people use or what data they upload
- Separate tools for web filtering, cloud app security and remote access
- Needing zero trust access without replacing the WAN
