License & Deployment Mix: 10 tools – 1 OSS DIY, 9 commercial. Almost-entirely-commercial category.
Color: Blue team.
What Is This Category?
SASE (Secure Access Service Edge, Gartner 2019) and its narrower sibling SSE (Security Service Edge, Gartner 2021) are the cloud-delivered convergence of perimeter security services: SWG (web filtering), CASB (SaaS-app inspection), ZTNA (zero-trust app access – covered separately in vpn-ztna/), FWaaS (cloud-native firewall), and DLP (data loss prevention – covered separately in dlp/). The market is SaaS-dominated; open-source options are thin at the platform level (60-70% coverage via Squid + ICAP + ClamAV).
Distinct from neighbouring categories
- VPN & Zero Trust (ZTNA) – ZTNA is the per-app access tier of SASE / SSE; this category covers the rest (SWG, CASB, FWaaS) and the converged platforms
- Data Loss Prevention – DLP is the data- protection tier of SASE / SSE; standalone DLP is a separate category
- Email Security – Email security is a separate edge service; some SASE / SSE platforms include it
- Protective DNS / DNS Filtering – Protective DNS is a sub-tier of SWG; Cloudflare Gateway and Cisco Umbrella appear in both categories
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Capability Matrix
| Tool | SWG | CASB | ZTNA | FWaaS | DLP | SD-WAN | Browser Isolation |
|---|---|---|---|---|---|---|---|
| Cloudflare One | yes | yes | yes | yes | yes | – | yes |
| Zscaler | yes | yes | yes (ZPA) | yes | yes | – | yes |
| Netskope One | yes | yes (first-class) | yes | yes | yes | partial | yes |
| Palo Alto Prisma Access | yes | yes | yes | yes | yes | yes (Prisma SD-WAN) | yes |
| Cato Networks | yes | yes | yes | yes | yes | yes (built-in) | yes |
| Cisco Umbrella SIG | yes | yes | yes (Duo) | yes | yes | partial | yes |
| Fortinet FortiSASE | yes | yes | yes | yes | yes | yes (Fabric) | partial |
| Check Point Harmony SASE | yes | yes | yes | yes | yes | – | yes |
| Microsoft Entra Internet Access | yes | partial | yes (Private Access) | yes | partial | – | – |
| DIY SWG (Squid+ICAP+ClamAV) | yes (60-70%) | – | – | – | partial | – | – |
License Comparison
All commercial except the DIY OSS stack.
| Tool | License | Tier |
|---|---|---|
| Cloudflare One | Proprietary | Free 50-seat + paid |
| Zscaler | Proprietary | Enterprise (premier) |
| Netskope One | Proprietary | Enterprise |
| Palo Alto Prisma Access | Proprietary | Enterprise (Palo aligned) |
| Cato Networks | Proprietary | Enterprise (SASE-native) |
| Cisco Umbrella SIG | Proprietary | Enterprise (Cisco aligned) |
| Fortinet FortiSASE | Proprietary | Enterprise (Fortinet aligned) |
| Check Point Harmony SASE | Proprietary | Enterprise + SMB |
| Microsoft Entra Internet Access | Proprietary | M365 E5 / Entra ID Suite |
| DIY SWG | GPL-2.0 (Squid) | Free (operator-time-heavy) |
Composition Patterns
1. Cloudflare-aligned customer
Cloudflare One (SWG / CASB / ZTNA / Browser Isolation / etc.)
+ Cloudflare Magic Transit (DDoS for IP space)Output: single-vendor SASE + DDoS + CDN at modest cost. Free 50-seat tier covers small / trial deployments.
2. Microsoft-aligned customer
Microsoft Entra Internet Access (SWG)
+ Entra Private Access (ZTNA)
+ Defender for Cloud (CNAPP -- see tools/cnapp/defender-cloud.md)Output: M365-native SASE bundled with E5 licensing. No incremental cost for already-aligned customers.
3. Enterprise premier-tier
Zscaler (or Netskope / Palo Alto Prisma Access / Cato)
Output: premier enterprise SASE with mature operational tooling + consultant ecosystem.
4. OSS-mandate customer
DIY SWG (Squid + ICAP + ClamAV)
+ Authentik for the auth tier
+ Pi-hole for protective-DNS layer
+ Wireguard / OpenVPN for ZTNA-adjacentOutput: ~60-70% of commercial SASE functionality at zero license cost + substantial operational overhead.
Cost Tier
Per-user annual cost.
| Tier | Tooling | Approx Cost |
|---|---|---|
| Free | Cloudflare One free 50-seat / DIY SWG | $0 |
| Mid | Cloudflare One paid / Check Point Harmony SASE | $7-15 per user / mo |
| High | Zscaler / Netskope / Cato / Prisma Access | $20-50 per user / mo |
| M365 included | Entra Internet Access | (included in E5) |
Tools
10 tools.
Cato Networks
Israeli converged SASE platform; Shlomo Kramer-founded; SASE-native architecture rather than security + SD-WAN bolt-on.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Check Point Harmony SASE
Check Point’s SASE platform (formerly Perimeter 81); converged with Harmony endpoint + email + mobile.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Cisco Umbrella SIG
Cisco’s Secure Internet Gateway / SASE tier; expansion of Umbrella DNS into full SASE; pairs with Cisco’s broader network-security ecosystem.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Cloudflare One
Cloudflare’s converged SASE / SSE platform; Zero Trust + Gateway (SWG / DNS filter) + Magic WAN (FWaaS) + CASB on one global anycast network.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
DIY SWG (Squid + ICAP + ClamAV)
DIY open-source Secure Web Gateway stack: Squid forward proxy + ICAP content inspection + ClamAV antivirus; OSS alternative to commercial SASE.
License: GPL-2.0-only (OSS) · Kind: service · Deploy: native, docker, package · SSO: OIDC, SAML
Fortinet FortiSASE
Fortinet’s SASE platform; converged with Fortinet Security Fabric; competitive in Fortinet-aligned customer environments.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Microsoft Entra Internet Access
Microsoft’s SASE entry into the market; Entra Internet Access (SWG) + Entra Private Access (ZTNA); positioning Microsoft as a SASE vendor.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Netskope One
Major SASE / SSE platform; particularly strong CASB tier from Netskope’s original cloud-app visibility heritage.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Palo Alto Prisma Access
Palo Alto Networks’ SASE platform; bundles with the broader Prisma Cloud + Cortex XDR ecosystem; firewall-vendor heritage.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Zscaler Zero Trust Exchange
The market-leading SASE / SSE platform; ZIA (Internet Access) + ZPA (Private Access) + ZDX (Digital Experience) on Zscaler’s global cloud.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
