SASE vs VPN: Let the Firm’s Own Apps Decide

SASE vs VPN is a choice about where a staff member’s traffic goes and what the firm checks on the way. The answer depends on the firm’s own apps, users and devices more than on either term. A remote access VPN is an encrypted tunnel from a staff member’s device into the firm’s network. SASE, short for secure access service edge, is a group of network and security checks delivered from the cloud, close to the user, while the VPN tunnel ends at head office. If your firm already runs a VPN and is weighing SASE for remote workers, this guide starts from your own setup, but it ranks no option. The wider topic has its own page on protecting a team spread across sites and homes.

SASE vs VPN: Where Each Sends a Staff Member’s Traffic

Start with the path, then look at where the checks happen. With a remote access VPN, the staff member’s traffic goes through the tunnel into the head-office network and leaves from there. The firm does its checking at that one door, but traffic for cloud apps takes the same route there first. The guidance on virtual private networks from the UK National Cyber Security Centre says that only traffic routed over the VPN is protected by it, and that VPN services form part of an organisation’s internet-exposed attack surface, and so need updating promptly once security patches are released.

With SASE, a remote worker’s traffic reaches a nearby point in the cloud, where the firm’s rules apply per user and per application. Here the firm checks at the application rather than at the building. The trade is plain: the IT lead sets rules in more places, while less traffic travels to head office and back.

Either path can be well run, but each one is poorly run without a named owner for its rules. This guide compares where the checks happen, and it ranks neither path.

SASE vs VPN: Four Questions About Your Own Apps

Signisys uses four questions to turn the choice into something a firm can answer from its own records. They are a working method, though not a standard.

1. Where are the apps hosted? In head office, in the cloud, or split between the two. The answer shows where traffic has to end up, before any rule is written.
2. Who reaches them, and from where? Staff at home on firm devices, contractors on their own, or staff in shops and on sites. The answer also shows the number of different paths into the firm.
3. What runs on the staff member’s own device? The device may be firm-managed or personal, and the firm checks it or does not. The answer also shows what the firm can look at on the device itself.
4. Which sites reach the same apps, and how are they linked? One office, or several shops and branches. The answer also shows the number of separate links the IT lead looks after.

Each answer belongs to the firm. Write the four answers on one short sheet, then use that sheet as the input for the table further down.

Who Uses the Apps, and From Where

Questions 1 and 2 belong together, as an app’s location matters alongside the people who reach it. Picture three groups: staff at home on firm laptops, contractors on their own devices, and shop staff on shared tablets. Each group reaches the apps from a different place, and each needs its own path.

A small, stable team that reaches a few head-office apps can stay with its remote access VPN. Its checks already sit at the one door it uses, while a new cloud app would need a rule of its own.

When remote workers at home and staff in shops reach cloud apps, the firm can use SASE to check each app close to the staff member. The IT lead then writes a rule once per app and per group of users, instead of sending that traffic through head office first.

The two paths can run side by side during a change. A firm might keep the tunnel for shop staff while a group of remote workers tries SASE first. For each group, write down which apps it reaches and from which device.

Which Apps Sit Where

Question 1, together with the site links in question 4, sets the shape of the starting move. Where the larger share of the apps sits in head office and the team is small and stable, the firm already checks at the one door it uses. Where the larger share is cloud services, traffic that goes through head office first makes a detour, but a firm may accept it for a time.

Old applications are a separate case. Those that do not fit behind per-application rules stay on the tunnel whatever else changes, and the IT lead lists them first.

Several shops that reach the same apps also add a link question. Each shop either connects to head office or reaches the cloud apps directly. The IT lead needs to know which. Write the answer per app, not per firm, as one firm can hold apps of each kind.

The use case on getting to firm applications away from the office gives the wider view.

SASE vs VPN: Keep, Add or Move, Answer by Answer

For a firm weighing SASE vs VPN, the table below reads the four answers and offers a starting move for each pattern. Signisys uses it as a second working method; each move opens a conversation with the IT lead, not a verdict.

The IT lead tests each row before widening it. Migration steps sit outside this guide, and the longer account of SASE and remote staff covers a move in steps.

Keeping the Tunnel or Adding Cloud Checks

Each path asks something of the people who run it, but neither line below ranks one path above the other.

A firm weighs these lines against its own four answers, instead of a supplier’s diagram.

An Optician Group Answers the Four Questions

This example is invented for illustration: the optician group is not a real firm, and Signisys was not involved. An optician group has a head office and a handful of shops in different cities. The booking system and the stock records sit in head office, while the rest of its tools are cloud services.

Here are its four answers. The apps are split between head office and the cloud. Staff work at the shops and at head office, and some shop staff use tablets of their own. The firm does not check the booking tablets, and several shops reach the same apps.

From the table, the starting move follows. The firm keeps the VPN for the head-office apps and tries per-application rules for the cloud apps on one shop first. Then the owner and the IT lead note what they can see on that shop’s connections before and after the change.

The example also leaves some questions open. How to handle the tablets of the shop staff is one of them, and the IT lead decides that with the owner. For staff who also work from home, the exposure that comes before any fix is mapped in which office protections a firm loses on a home day job by job.

Starting With One Group of Staff

Pick one group of staff, such as remote workers trying SASE, then write down the four answers for it. Apply the starting move from the table to that group alone. Note what the IT lead can see before and after. Keep the group, the date and the notes together, where the owner and the IT lead can open them. Whoever tests the first group from home also needs the basics settled, and a working order for those is in remote-work basics for a firm with no security team.

Signisys can take the four answers into a working session with your IT lead and help pick the first group of staff.

Signisys provides digital workplace and endpoint management and end-user computing services, and it is not a neutral party in this choice. Booking through the box below starts a conversation with Signisys; the result depends on the firm’s own answers.

FAQ: SASE vs VPN, What IT Leads Ask Next