Security as a Service (SECaaS) is a delivery model in which a provider runs security functions on its own cloud infrastructure and you subscribe to them, much as you subscribe to software as a service (SaaS). Instead of buying, installing and maintaining appliances or servers for email filtering, web security, firewalling or endpoint protection, you point traffic or agents at the provider’s service and manage policy through its console. SECaaS is a way of buying security, not a specific product.
At a glance
- SECaaS covers many functions: email and web security, DNS filtering, firewall as a service, CASB, ZTNA, endpoint protection, identity services and more.
- The provider runs and updates the platform; you still set policy, act on findings and own the risk.
- Costs move from hardware purchases to a recurring subscription, usually per user, per device or by traffic volume.
- SECaaS describes delivery; whether people monitor and respond for you depends on the service, so check whether managed operation is included.
- SSE and SASE are bundles of several SECaaS functions from one provider.
What problem it solves
Security built on appliances assumed that users, applications and data sat behind one perimeter at the office or data center. Today many users work remotely, applications run in SaaS and public cloud, and branches connect directly to the internet. Protecting all of that with boxes means more hardware at more sites, more traffic backhauled to a central location for inspection, and more patching and refresh cycles for a small IT team.
SECaaS addresses this by putting the security function where the traffic already goes: the provider’s cloud. Remote users, branches and cloud workloads can be covered by the same policy without shipping equipment. The provider handles updates, threat signatures and capacity, which many mid-sized teams struggle to keep current on their own.
How it works
The provider operates the service in its own data centers or cloud regions. You connect to it in one of a few ways, depending on the function:
- Traffic redirection. Web, DNS or network traffic is sent to the provider through an agent on each device, tunnels from your sites, or DNS settings. Secure web gateways, DNS filtering and firewall as a service work this way.
- Mail routing or API connection. Email security either sits in the mail path through MX records or connects to your mailbox platform through its API.
- Agents. Endpoint protection installs a lightweight agent on each device and is managed from the provider’s cloud console.
- Identity integration. Many services connect to your identity provider so policy can be set by user and group.
Logs and alerts are available in the provider’s console and can usually be sent to your SIEM. Some subscriptions add a managed tier in which the provider’s analysts monitor alerts and respond, as in managed detection and response (MDR).
When it matters for buyers
- When appliances reach end of life. A hardware refresh is the natural point to compare a cloud-delivered option.
- When remote and branch users need the same protection as headquarters. Cloud delivery avoids backhauling their traffic or deploying boxes at every site.
- When you have too many overlapping tools. Consolidating onto fewer SECaaS platforms can simplify operations, though it increases dependence on each provider.
- When data location rules apply. Some regulations, contracts or customers restrict where traffic and logs may be processed or stored; confirm the provider’s regions and data handling before committing.
- When internal staff are thin. Delivery in the cloud reduces maintenance work, but someone still has to tune policy and act on alerts.
Questions to ask vendors
- Which functions are included, and which are separate products or licenses?
- Where are your points of presence and data centers, and where are our logs stored and for how long?
- How does traffic reach your service from offices, remote users and cloud workloads, and what latency should we expect?
- What uptime do you commit to, what happens to our traffic if your service is unavailable, and what credits apply?
- Is anyone on your side watching alerts, or is the service self-managed by us?
- How do we export policies and logs if we leave?
How it differs from managed security services
Managed security services (MSS) are about who operates security: a provider’s team monitors and manages tools, which may be in the cloud, on your premises or a mix. SECaaS is about where the tool runs: in the provider’s cloud, delivered on subscription. Many providers now sell both together, so a single contract can be SECaaS, MSS or both. The shared responsibility model applies either way: the provider runs its part, and you remain accountable for your policies, users and data. For bundled cloud-delivered security, see our Secure Access Service Edge (SASE) and Security Service Edge (SSE) overviews.