Color: Blue team.
What Is This Category?
Mix (10 tools)
- License: 1 open source · 9 proprietary
- Hosting: 1 self-hosted · 9 SaaS · 0 both
SASE (Secure Access Service Edge, Gartner 2019) and its narrower sibling SSE (Security Service Edge, Gartner 2021) are the cloud-delivered convergence of perimeter security services: SWG (web filtering), CASB (SaaS-app inspection), ZTNA (zero-trust app access – covered separately in vpn-ztna/), FWaaS (cloud-native firewall), and DLP (data loss prevention – covered separately in dlp/). The market is SaaS-dominated; open-source options are thin at the platform level (60-70% coverage via Squid + ICAP + ClamAV).
Distinct from neighbouring categories
- VPN & Zero Trust (ZTNA) – ZTNA is the per-app access tier of SASE / SSE; this category covers the rest (SWG, CASB, FWaaS) and the converged platforms
- Data Loss Prevention – DLP is the data- protection tier of SASE / SSE; standalone DLP is a separate category
- Email Security – Email security is a separate edge service; some SASE / SSE platforms include it
- Protective DNS / DNS Filtering – Protective DNS is a sub-tier of SWG; Cloudflare Gateway and Cisco Umbrella appear in both categories
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
Capability Matrix
| Tool | SWG | CASB | ZTNA | FWaaS | DLP | SD-WAN | Browser Isolation |
|---|---|---|---|---|---|---|---|
| Cloudflare One | yes | yes | yes | yes | yes | – | yes |
| Zscaler | yes | yes | yes (ZPA) | yes | yes | – | yes |
| Netskope One | yes | yes (first-class) | yes | yes | yes | partial | yes |
| Palo Alto Prisma Access | yes | yes | yes | yes | yes | yes (Prisma SD-WAN) | yes |
| Cato Networks | yes | yes | yes | yes | yes | yes (built-in) | yes |
| Cisco Umbrella SIG | yes | yes | yes (Duo) | yes | yes | partial | yes |
| Fortinet FortiSASE | yes | yes | yes | yes | yes | yes (Fabric) | partial |
| Check Point Harmony SASE | yes | yes | yes | yes | yes | – | yes |
| Microsoft Entra Internet Access | yes | partial | yes (Private Access) | yes | partial | – | – |
| DIY SWG (Squid+ICAP+ClamAV) | yes (60-70%) | – | – | – | partial | – | – |
License Comparison
All commercial except the DIY OSS stack.
| Tool | License | Tier |
|---|---|---|
| Cloudflare One | Proprietary | Free 50-seat + paid |
| Zscaler | Proprietary | Enterprise (premier) |
| Netskope One | Proprietary | Enterprise |
| Palo Alto Prisma Access | Proprietary | Enterprise (Palo aligned) |
| Cato Networks | Proprietary | Enterprise (SASE-native) |
| Cisco Umbrella SIG | Proprietary | Enterprise (Cisco aligned) |
| Fortinet FortiSASE | Proprietary | Enterprise (Fortinet aligned) |
| Check Point Harmony SASE | Proprietary | Enterprise + SMB |
| Microsoft Entra Internet Access | Proprietary | M365 E5 / Entra ID Suite |
| DIY SWG | GPL-2.0 (Squid) | Free (operator-time-heavy) |
Composition Patterns
1. Cloudflare-aligned customer
Cloudflare One (SWG / CASB / ZTNA / Browser Isolation / etc.)
+ Cloudflare Magic Transit (DDoS for IP space)Output: single-vendor SASE + DDoS + CDN at modest cost. Free 50-seat tier covers small / trial deployments.
2. Microsoft-aligned customer
Microsoft Entra Internet Access (SWG)
+ Entra Private Access (ZTNA)
+ Defender for Cloud (CNAPP -- see tools/cnapp/defender-cloud.md)Output: M365-native SASE bundled with E5 licensing. No incremental cost for already-aligned customers.
3. Enterprise premier-tier
Zscaler (or Netskope / Palo Alto Prisma Access / Cato)
Output: premier enterprise SASE with mature operational tooling + consultant ecosystem.
4. OSS-mandate customer
DIY SWG (Squid + ICAP + ClamAV)
+ Authentik for the auth tier
+ Pi-hole for protective-DNS layer
+ Wireguard / OpenVPN for ZTNA-adjacentOutput: ~60-70% of commercial SASE functionality at zero license cost + substantial operational overhead.
Cost Tier
Per-user annual cost.
| Tier | Tooling | Approx Cost |
|---|---|---|
| Free | Cloudflare One free 50-seat / DIY SWG | $0 |
| Mid | Cloudflare One paid / Check Point Harmony SASE | $7-15 per user / mo |
| High | Zscaler / Netskope / Cato / Prisma Access | $20-50 per user / mo |
| M365 included | Entra Internet Access | (included in E5) |
Tools
10 tools.
Cato Networks
Israeli converged SASE platform; Shlomo Kramer-founded; SASE-native architecture rather than security + SD-WAN bolt-on.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP · Provisioned account
Check Point Harmony SASE
Check Point’s SASE platform (formerly Perimeter 81); converged with Harmony endpoint + email + mobile.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP · Provisioned account
Cisco Umbrella SIG
Cisco’s Secure Internet Gateway / SASE tier; expansion of Umbrella DNS into full SASE; pairs with Cisco’s broader network-security ecosystem.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP · Provisioned account
Cloudflare One
Cloudflare’s converged SASE / SSE platform; Zero Trust + Gateway (SWG / DNS filter) + Magic WAN (FWaaS) + CASB on one global anycast network.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
DIY SWG (Squid + ICAP + ClamAV)
DIY open-source Secure Web Gateway stack: Squid forward proxy + ICAP content inspection + ClamAV antivirus; OSS alternative to commercial SASE.
License: GPL-2.0-only (OSS) · Kind: service · Deploy: direct, docker, package · SSO: OIDC, SAML
ResorsIT usage: Deployment Payload
Access & Identity: Single sign-on · Directory / LDAP · Local host account · Key-based access
Fortinet FortiSASE
Fortinet’s SASE platform; converged with Fortinet Security Fabric; competitive in Fortinet-aligned customer environments.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP · Provisioned account
Microsoft Entra Internet Access
Microsoft’s SASE entry into the market; Entra Internet Access (SWG) + Entra Private Access (ZTNA); positioning Microsoft as a SASE vendor.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP · Provisioned account
Netskope One
Major SASE / SSE platform; particularly strong CASB tier from Netskope’s original cloud-app visibility heritage.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP · Provisioned account
Palo Alto Prisma Access
Palo Alto Networks’ SASE platform; bundles with the broader Prisma Cloud + Cortex XDR ecosystem; firewall-vendor heritage.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP · Provisioned account
Zscaler Zero Trust Exchange
The market-leading SASE / SSE platform; ZIA (Internet Access) + ZPA (Private Access) + ZDX (Digital Experience) on Zscaler’s global cloud.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Directory / LDAP · Provisioned account
