In short
ZTNA vs SASE is a part versus the whole. Zero trust network access controls access to private applications. Add web and SaaS protection (secure web gateway, CASB, usually firewall as a service) and you have a security service edge (SSE). Add SD-WAN networking for branches and you have SASE. Many organisations start with ZTNA or SSE.
Want an impartial recommendation?
Tell us about your users, systems and priorities and we will tell you which option fits, and why.
How ZTNA, SSE and SASE nest
Think of three concentric circles.
ZTNA is the innermost: per-application, deny-by-default access to private applications in your offices, data centres and clouds, after checking identity, device and context.
SSE (security service edge) wraps ZTNA with the controls that protect people using the internet and SaaS: a secure web gateway (SWG), a cloud access security broker (CASB) and, usually, firewall as a service (FWaaS), data loss prevention (DLP) and remote browser isolation (RBI). The NCSC's guidance writes it as "Secure Service Edge"; the industry term is security service edge, and they mean the same thing.
SASE (secure access service edge) adds the networking: SD-WAN for branch offices, so sites and users share one policy and one security cloud. For the general definition, see SASE on our cloud security site.
Component table
| Component | ZTNA | SSE | SASE |
|---|---|---|---|
| Zero trust access to private apps | Yes | Yes | Yes |
| Secure web gateway (web filtering, malware) | - | Yes | Yes |
| CASB (SaaS visibility and control) | - | Yes | Yes |
| Firewall as a service | - | Usually | Usually |
| DLP and remote browser isolation | - | Often, by tier | Often, by tier |
| SD-WAN for branch offices | - | - | Yes |
| Typical licensing | Per user | Per user | Per user plus per site or appliance |
The labels are not regulated, and vendors draw the lines differently. Some ZTNA-focused products include DNS or web filtering, and some SSE platforms include SD-WAN integrations without being full SASE. Compare the components, not the label.
Still not sure which way to go? Ask us
Tell us what matters most to you and we will recommend one, with the trade-offs explained.
ZTNA vs SSE
The difference between ZTNA and SSE is the traffic they protect. ZTNA covers traffic to your applications. SSE also covers traffic to everyone else's: websites, SaaS applications and, increasingly, generative AI services.
If remote staff currently send all their internet traffic back through the office firewall over a VPN so it can be filtered, replacing the VPN with ZTNA alone leaves that traffic unprotected. That is the most common reason a ZTNA project grows into an SSE project.
The NCSC's signals and policy engines guidance groups SSE and SASE with VPN-as-a-service as network-level policy engines, which control which network destinations a client can reach. It contrasts them with application-level policy engines, often provided by an identity provider or SSO service, and says organisations may use one or both. Either way, the NCSC's warning applies: an SSE or SASE platform dropped in as a straight VPN replacement, with users authenticating once and then reaching most of the internal network, recreates the old 'walled garden' model.
Which do you need?
| If this describes you | Start with | Why |
|---|---|---|
| Remote users reach a few internal apps; most work is in SaaS already protected by your identity provider | ZTNA | Replaces the VPN for private apps without changing internet traffic |
| Remote users' web traffic is filtered by backhauling it through the office firewall | SSE | Moves web and SaaS protection to the cloud so the VPN can go |
| You need to see and control SaaS use, shadow IT or generative AI tools | SSE with CASB | CASB adds SaaS visibility and policy |
| Several offices with an MPLS or router refresh coming up | SASE | SD-WAN plus SSE under one policy |
| One office firewall due for replacement and most staff remote | SSE, or SASE with a software gateway | May remove the need for a like-for-like office firewall; see SASE vs firewall |
You do not have to buy everything at once. Most platforms are licensed per user by component, so ZTNA can be added first and web security or SD-WAN later. For the SSE versus SASE decision in more depth, see SASE vs SSE, and for branch networking, SASE vs SD-WAN.
Weighing up the options?
We can compare them against your own requirements and give you a straight answer.
How the platforms we supply map to each layer
| Platform | ZTNA | SSE components | SASE / branch |
|---|---|---|---|
| Check Point SASE (formerly Harmony SASE) | Private Access: agent-based and agentless ZTNA; Enterprise Browser for unmanaged devices | Internet Access (on-device, in-browser and cloud protection), SaaS Security, GenAI Security | Secure SD-WAN in the same platform |
| Cisco Secure Access | Secure Private Access: client-based and clientless ZTNA, plus VPN as a service | Secure Internet Access: SWG, CASB, DLP, FWaaS and RBI, with more in the Advantage tier | Cisco SASE pairs it with Cisco Catalyst SD-WAN or Meraki SD-WAN |
| Trend Micro ZTSA | Private Access via connectors | Internet Access (SWG with CASB controls), AI Secure Access | Pair with your WAN; ask us |
| Exium SASE (now part of NETGEAR) | Secure Private Access; agentless access on Pro | Secure Internet Access: DNS, web and SaaS security | Cyber Gateway: software firewall with SD-WAN, per site |
| Todyl SASE | Identity-based conditional access rules | Secure web gateway, secure DNS, cloud NGFW with SSL inspection | SASE Tunnel (IPsec site-to-site) |
| WatchGuard FireCloud | Total Access: zero trust access to private resources | Firewall as a service and secure web gateway | Works with Firebox gateways |
| NordLayer | Identity-based access, device posture, Cloud Firewall segmentation on Premium | Web Protection on every plan; DNS filtering on Core and Premium | Site-to-Site connector on Premium |
| Island Private Access | ZTNA inside the Island Enterprise Browser | Browser-level data and web controls | Island Enterprise Network: ask us |
| Zero Networks Connect | MFA-gated remote access with no open ports | - | Part of a microsegmentation platform |
Product detail is on each provider page under ZTNA providers, and the SASE platforms are compared side by side on SASE providers. For licensing, ask us for a quote.
ZTNA vs SASE vs CASB
CASB comes up in the same breath because it is the SSE component that is easiest to misunderstand. ZTNA governs access to private applications; a CASB governs how people use SaaS applications, either inline as traffic passes through the SSE or through API connections to the SaaS platform itself, covering things like shadow IT discovery, tenant restrictions and data controls. SASE contains both. If your main concern is data leaving through SaaS rather than attackers reaching internal systems, CASB may matter more to you than ZTNA.
Common misconceptions
- "SASE replaces ZTNA." It contains it. Every SASE platform has a ZTNA component, and that component is what replaces the remote access VPN.
- "ZTNA protects internet browsing." Not on its own. ZTNA covers private applications; web and SaaS protection comes from the SSE components.
- "SASE means no firewalls." Many organisations keep firewalls at data centres and larger sites and use SSE for users. The NCSC also notes that ZTNA does not remove the need for local controls such as firewalls and access control lists.
- "Buying SASE gives you zero trust." The NCSC is clear that zero trust is an architectural approach rather than a single product. Policy design, identity and device foundations and removing old access routes still decide the outcome.
- "SD-WAN is the security." SD-WAN chooses paths across links and connects sites; the security comes from the SSE or firewall it sends traffic through.
Single vendor or mix and match?
You can buy SASE from one vendor, or combine an SSE from one vendor with SD-WAN from another. A single vendor gives one policy model, one agent and one console; mixing lets you keep SD-WAN or firewalls you already own and are happy with. The NCSC's advice on assessing providers is relevant either way: understand what you are delegating to the provider, how critical the service becomes, how much visibility and control you keep, and trial it before committing. Our ZTNA providers page turns that into a shortlist method.
How Forever Systems helps
We supply ZTNA-only, SSE and full SASE platforms, so the recommendation follows your situation rather than a single product line. We can map your users, applications, sites and existing firewalls, show which layer you need now and which can wait, and run a trial with a pilot group. Scope and timescales are confirmed at quote, and pricing depends on users, components and sites, so ask us for a quote. Contact us for an independent view.
How Forever Systems helps with ZTNA and SASE
We are an independent IT and cyber security provider. We supply and support several zero trust access and SASE platforms, so we can recommend what fits how your people work rather than one vendor's answer to everything.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across ZTNA, SSE and SASE options, including Cisco Secure Access and Check Point Harmony SASE
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
Is ZTNA part of SASE?
Yes. ZTNA is one component of a security service edge (SSE), and SSE plus SD-WAN networking makes SASE. Every SASE platform includes ZTNA, but a ZTNA product on its own is not SASE.
What is the difference between ZTNA and SSE?
ZTNA protects access to your private applications. SSE adds protection for internet and SaaS use: a secure web gateway, CASB and usually firewall as a service, DLP and remote browser isolation.
Do I need SASE or just ZTNA?
If your main need is replacing a remote access VPN for a set of internal applications, ZTNA may be enough. If remote users' web traffic currently goes through the office firewall, you probably need SSE. Full SASE makes most sense when branch networking is also changing.
Is SASE better than ZTNA?
Neither is better; they solve different sized problems. SASE includes ZTNA, so the question is whether you also need web, SaaS and branch networking controls from the same platform.
Can I add SASE later if I start with ZTNA?
Usually yes. Several platforms we supply license ZTNA, internet access and SD-WAN as separate components, so you can start with private access and add the rest when the need or the hardware refresh arrives.
Still deciding?
Ask us and a member of our team will reply by email with a straight answer.