Secure access service edge (SASE) combines networking and security services delivered from the cloud. It typically includes SD-WAN, a secure web gateway, a cloud access security broker (CASB), zero trust network access (ZTNA) and firewall as a service. The appeal is one policy and one platform for users wherever they work. The risk is buying a multi-year platform bundle. One or two components are strong and the rest are weaker than what the organisation already has.
CYBORIUM helps Australian organisations compare SASE platforms and providers through a structured vendor-neutral sourcing process. The selected provider pays CYBORIUM a capped fee. The client contracts directly with that provider, and CYBORIUM does not sell, deliver, operate or invoice the technology.
Map what you have and what is ending
List current network and security products with their contract end dates: WAN links and routers, firewalls, web proxies, VPN, CASB and any existing ZTNA. SASE projects work best when they follow contract expiries rather than replacing everything at once. The list also shows which components you actually need and which you are receiving as part of a bundle.
Record where users and applications are: office sites, remote workers, data centres, cloud platforms and SaaS. That determines which points of presence and connectors matter.
Single-vendor or dual-vendor
Some organisations buy all components from one vendor. Others combine a networking vendor for SD-WAN with a security vendor for the security service edge. Single-vendor designs can simplify policy and support. Dual-vendor designs can use the stronger product in each area and reduce dependence on one supplier. Decide which suits your team before shortlisting, because it changes who can bid.
Five areas that decide SASE value
1. Australian points of presence and performance
Ask where the vendor’s points of presence are in Australia and New Zealand, whether traffic is inspected in-country. Also ask whether those locations offer full services or only some. Test latency and throughput from your main cities to your most-used SaaS and cloud applications.
2. Component strength
Evaluate each component you need on its own merits: web filtering accuracy, CASB visibility of your SaaS applications, ZTNA application coverage and SD-WAN features. A strong overall platform can still have a weak component that matters to you. If data loss prevention is the weak component, read our guide to evaluating DLP coverage for endpoints. It explains why SASE platforms are often strong on web and cloud but weaker on actions like USB and printing.
3. Policy and management
Check whether one policy applies across all components, how changes are tested and rolled back, and how administrator access is controlled and logged.
4. Compliance and logging
Confirm where logs are stored, how long they are retained and whether they can be sent to your SIEM. If the organisation reports against the ASD Information Security Manual, ask how the vendor’s controls and assessments support that.
5. Commercial model
SASE is usually priced per user, per site or by bandwidth, with components in tiers. Price the full bundle and the components you actually need, and model what happens if you want to remove a component at renewal. Watch for early termination costs on existing network contracts.
A comparable evaluation
Run a pilot with a representative group of users and at least one branch site. Measure application performance, sign-in experience, policy enforcement and support response. Test a failure, such as a point of presence becoming unavailable, and record how traffic is rerouted. Score alongside written evidence on data location, logging, resilience and three-year cost.
Contract points to settle
The contract should state availability commitments for each service, where traffic is processed and logs held. It should also state notice of changes to point of presence locations and exit support. Commercial schedules should separate component prices so that individual services can be removed. They should also align the term with the replacement of existing products.
CYBORIUM’s role in the decision
CYBORIUM can map current contracts and requirements, design the pilot, coordinate vendors, evaluate evidence and compare bundled and component pricing. The organisation keeps the decision and contracts directly with the selected provider. See also the guides to ZTNA and cloud security.
Updated 15 September 2026. This guide explains CYBORIUM’s procurement evaluation method. It does not provide legal or regulatory advice.
Standards and further reading
SASE bundles controls that used to be bought separately, which makes like-for-like comparison difficult. That makes the underlying architecture the thing to evaluate.
- NIST SP 800-207. The zero trust architecture definition most SASE marketing refers to. Read it before accepting that a product implements it.
- ASD Information Security Manual. Australian control requirements the converged stack still has to meet, component by component.
- ASD Essential Eight Maturity Model. Establishes which maturity level the network controls have to support, which constrains the design rather than the brand.
Related from CYBORIUM
Should you buy SASE as one platform or in parts?
One platform simplifies support but can lock you in. Buying in parts keeps options open but adds integration work. Ask providers to price both and show the exit route for each.
How long should a SASE migration take?
Plan it in stages, starting with a small group of users and one location. Providers should give a realistic timeline for each stage and say what happens if it slips.
What happens to existing network contracts?
Many run to a fixed end date. Map the dates first, because overlapping contracts can add cost during the move.
Want a second opinion before you commit? Contact CYBORIUM or request a free market briefing.
Last updated:
