SASE, explained: what it is and how to choose a platform (a buyer's guide for Indian enterprises)

"SASE" is now stamped on almost every networking and security product sold, which makes it oddly hard to find out what it actually is. Strip away the marketing and it's a simple, genuinely useful idea: stop hauling traffic back to a data-centre stack of appliances, and instead deliver your networking and your security together, from the cloud, as close to the user as possible. This guide is the plain-English version — what SASE is, the acronyms demystified, the one architectural decision that matters most, and how to pick a platform if you're buying for an Indian enterprise.

We sell SASE from more than one vendor — Cato Networks (pure-play), Fortinet FortiSASE (firewall-led) and Aruba EdgeConnect — so this is written to help you choose well, not to push one logo. Where a vendor genuinely suits a situation, we'll say so.

FundamentalsWhat SASE actually is

SASE (Secure Access Service Edge, a term Gartner coined in 2019 — say it "sassy") is the convergence of two things that used to be bought, built and run separately:

• The network edge — how your sites, cloud and users connect and how traffic is steered. In SASE terms, largely SD-WAN.
• The security edge — the inspection and access controls that used to live in a rack of appliances. The industry calls this bundle SSE (Security Service Edge).

Both are delivered from a provider's global network of points of presence (PoPs). A user or branch connects to the nearest PoP; their traffic is inspected and policy-enforced there, then sent on to the internet, SaaS or your applications. The security follows the user instead of living in a building they may never visit. That's the whole idea: one cloud-delivered fabric that connects and protects, wherever work happens.

ComponentsThe acronyms, demystified

The security half (SSE) is really four or five services that each replace something you probably own today as a box or a point product:

You don't have to adopt all of them on day one. Most Indian enterprises we work with start with ZTNA (because the VPN is the loudest pain) or SD-WAN (because MPLS is the biggest bill), then grow into the rest on one platform.

DriversWhy it's happening now

The old model assumed your people and your applications were inside a building, behind a firewall. Three shifts broke that assumption at once, and SASE is the response:

ArchitectureThe one decision that matters most: single-vendor vs two-vendor

Almost every real SASE choice comes down to this. There are two honest ways to build it, and a vendor's heritage usually tells you which one they're really selling.

Layered on top of that, platforms tend to come from one of three heritages, and it shows in what they're best at:

EvaluationHow to actually evaluate a platform

Past the logo, these are the questions that separate a SASE platform that works for you from one that demos well:

• PoP proximity. Where are the provider's PoPs relative to your users and your apps? A SASE cloud with no PoP near your people adds the very latency it's meant to remove. For India this is the single most important question — see below.
• One agent or many? A single lightweight agent that does ZTNA, SWG and device posture beats three agents fighting on the endpoint.
• ZTNA maturity. True per-application access with device posture, or a VPN with a new name? Can it cover unmanaged devices and third parties?
• SD-WAN capability. Real path conditioning and application-aware steering across broadband / MPLS / 5G, or just basic failover?
• Encrypted-traffic inspection. Most traffic is TLS. Can it decrypt and inspect at scale without falling over — and can you manage the exceptions cleanly?
• One policy, one console. Is policy written once and enforced everywhere, or re-implemented per module? This is where single-vendor earns its keep.
• Licensing you can predict. Per-user, per-site, bandwidth-based — model it against your real headcount and growth, not the brochure.

IndiaWhat's different about buying SASE in India

• PoPs in-country matter. Latency to a SASE PoP is felt on every request. Providers with PoPs in or near India (Mumbai, Chennai, Delhi, Bengaluru and regional neighbours) deliver a materially better experience than one routing your traffic to Singapore or Europe. Make in-country PoP presence a hard requirement, and test it.
• Data-handling under the DPDP Act. With India's Digital Personal Data Protection Act in force, where traffic is inspected and where logs and personal data are stored is a compliance question, not just a performance one. Ask the provider plainly where your data lives.
• MPLS economics. Inter-city MPLS in India is expensive relative to the broadband and 5G now available. SD-WAN plus local breakout is often where the business case pays for itself first.
• A distributed, hybrid workforce. Large, spread-out teams and plenty of remote work make ZTNA — not a strained VPN concentrator — the sane way to give access.
• Billing that finance accepts. A rupee, GST-compliant invoice from an Indian entity turns a SASE subscription into an ordinary domestic vendor line rather than a cross-border headache.

DecisionHow to choose — a shortcut

OgmaWhere Ogma fits

SASE is one of the few areas where the reseller's independence actually matters, because the "right" platform genuinely differs by customer. We carry Cato Networks, Fortinet FortiSASE and Aruba, so we can run an honest comparison instead of fitting your problem to the one product we're allowed to sell. In practice that means:

• A design scoped to your sites and users — including a PoP-proximity and latency check against where your people and apps actually are.
• A proof of concept before you commit — so the platform is tested on your traffic, not a demo.
• Migration done in the right order — usually ZTNA or SD-WAN first, then the rest, so you get value without a big-bang cutover.
• Rupee, GST-compliant invoicing from an Indian entity, and pan-India rollout and support.

FAQFrequently asked