In short: Cisco SASE combines Cisco Secure Access, its cloud security service edge, with Cisco SD-WAN or Meraki SD-WAN, managed through Cisco Cloud Control. Using both Cisco halves gives single-vendor SASE; Secure Access also works with third-party SD-WAN. Cisco now positions SASE for AI-era traffic, with controls for generative AI apps and agents.
What is Cisco SASE?
Secure access service edge (SASE) brings networking and security together as a cloud-delivered service. The networking half is SD-WAN, which steers branch traffic intelligently across broadband, leased lines and mobile links. The security half is security service edge (SSE), which inspects and controls that traffic in the cloud instead of backhauling it to a head office.
Cisco's SASE uses:
| Component | Role |
|---|---|
| Cisco Secure Access | The SSE: secure web gateway, DNS security, CASB, DLP, firewall as a service, ZTNA and VPN as a service |
| Cisco SD-WAN (Catalyst SD-WAN) | Cisco's enterprise SD-WAN platform, with automated tunnel set-up to Secure Access |
| Meraki SD-WAN | Cloud-managed SD-WAN on Meraki MX appliances, managed alongside Meraki switching, Wi-Fi and cellular WAN, with Auto VPN integration into Secure Access |
| Experience Insights | ThousandEyes-based monitoring of endpoint, network and SaaS performance, included with Secure Access user subscriptions |
| Cisco ISE and Duo | Identity and device context for policy, on site and remote |
| Cisco Cloud Control | Cisco's unified management platform, which Cisco says brings identity, inventory, topology, policy and operational context into one place |
For a vendor-neutral explanation of the model, see our SASE explainer.
Single-vendor or multi-vendor SASE
Cisco supports both approaches. Its Secure Access FAQ describes integration with Cisco Catalyst SD-WAN and Cisco Meraki SD-WAN as single-vendor SASE, and integration with third-party SD-WAN as a dual-vendor approach. Cisco's package guide lists SD-WAN tunnel automation and support for third-party SD-WAN.
| Single-vendor (Cisco SD-WAN or Meraki + Secure Access) | Multi-vendor (other SD-WAN + Secure Access) | |
|---|---|---|
| Tunnel set-up | Automated between SD-WAN and Secure Access | IPsec tunnels configured per site or via the SD-WAN vendor's integration |
| Policy | Network and security policy planned together across Cisco platforms | Security policy in Secure Access; network policy stays in the other platform |
| Operations | One vendor's support and a common management direction through Cisco Cloud Control | Two platforms, two support routes |
| Fits | New builds and Cisco or Meraki estates | Organisations that want to keep an existing SD-WAN investment |
Neither is wrong. Many UK organisations start multi-vendor because their WAN contract has years to run, then converge at the next refresh.
SASE for the AI era
Cisco's current SASE messaging centres on making both human and AI-agent work reliable and safe, as agents start retrieving data, calling services and triggering workflows on people's behalf. In practice that means:
- AI Access in Secure Access, giving visibility and control over third-party AI apps, with DLP to stop sensitive data leaking into them
- Zero trust for AI agents: discovering agents, mapping each to a human owner, authorising actions with short-lived, least-privilege tokens and quarantining compromised agents
- Semantic inspection of Model Context Protocol (MCP) traffic, which Cisco lists in the Secure Access data sheet
- Experience Insights monitoring of endpoint, network and SaaS performance, so that when an AI-heavy SaaS app slows down you can see whether the problem is the device, the network or the provider
For security of the AI applications you build yourself, see Cisco AI Defense.
How to phase SASE adoption
- Start with users: deploy Secure Access for remote users first, replacing VPN with ZTNA and Umbrella or proxies with Secure Internet Access.
- Connect branches: link existing branch routers or firewalls to Secure Access with tunnels, so office traffic gets the same web and DNS policy.
- Modernise the WAN: at refresh time, move branches to Cisco SD-WAN or Meraki SD-WAN and switch on automated Secure Access tunnels.
- Converge policy: bring identity from Duo and ISE into one policy model and enforce private access on site as well as remotely.
- Retire legacy: decommission backhaul links, central proxies and VPN headends once traffic has moved.
Licensing can follow the same path: user licences for remote staff, plus site-based licences for SD-WAN branches where they make sense. See Secure Access licensing.
Cisco SASE or a branch firewall?
SASE does not remove the need for every on-site firewall. Sites with servers, OT equipment or strict segmentation needs often keep a local Cisco Secure Firewall or Meraki MX, with SASE handling internet and remote access. Our Secure Firewall vs Meraki MX comparison helps with that choice, and Forever Group covers Meraki firewalls in detail. Larger estates with data centres and multiple clouds should also look at Hybrid Mesh Firewall.
Who it suits and how we help
Cisco SASE suits multi-site organisations with a growing remote workforce, heavy SaaS use and an ageing hub-and-spoke WAN: retail, professional services, education, healthcare suppliers and manufacturers among them.
Forever Systems works across both halves: we design and supply Secure Access, and Forever Group supplies Meraki networking and connectivity, so the WAN and security plans line up. Contact us to plan a phased SASE roadmap.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Cisco offer a single-vendor SASE?
Yes. Cisco's Secure Access FAQ describes Secure Access combined with Cisco Catalyst SD-WAN or Cisco Meraki SD-WAN as single-vendor SASE, with Cisco Cloud Control as the management platform. Secure Access also integrates with third-party SD-WAN for a dual-vendor approach.
Is Cisco Secure Access the same as Cisco SASE?
No. Secure Access is Cisco's SSE, the security part. SASE adds SD-WAN, from Cisco or another vendor, so that branch networking and security work together.
Can I use Meraki SD-WAN with Cisco Secure Access?
Yes. Cisco lists Meraki SD-WAN integration for Secure Access, which simplifies connecting Meraki branches to Secure Access, and its FAQ describes the combination as single-vendor SASE.
Do I need to replace my WAN to adopt Cisco SASE?
No. You can start with Secure Access for remote users and connect existing branch devices with tunnels, then move to Cisco SD-WAN or Meraki SD-WAN when your WAN is due for refresh.
How is Cisco SASE licensed?
The security part is licensed through Secure Access, per user or per site, and the SD-WAN part through Cisco SD-WAN or Meraki licences. Ask us for a quote covering both.