# Most organisations buying SASE only need SSE — and are quoted for both.

*SASE & SSE — a TechBag decision guide. Last reviewed 2026-10-21.*

> SASE moves enforcement out of your rack and into a provider’s cloud, so policy applies wherever the user is. It has two halves: the security half (SSE — web gateway, CASB, ZTNA, DLP) and the network half (SD-WAN). Buying the second when your WAN is already fine is the most common overspend in this category.

**The checkable fact:** Netskope documents eight data centres in India and a NewEdge management plane in Mumbai; Cloudflare’s Indian PoPs include Mumbai, Chennai, New Delhi, Bengaluru, Kolkata and Nagpur. Several major vendors publish no named Indian city list at all — and PoP distance decides user experience more than any feature.

- Canonical: https://www.thetechbag.com/browse/network-security-sase/sase-sse
- Category: [Network Security & SASE](https://www.thetechbag.com/browse/network-security-sase)
- Products compared: 23

## What sase & sse actually is

A set of security controls delivered from a provider’s global network instead of a box in your building. The user’s device connects to the nearest point of presence, the provider inspects and enforces there — web filtering, malware inspection, data-loss rules, application access — and the traffic goes on to the internet or the private application without ever transiting your network. **SSE** is that security bundle. **SASE** is SSE plus SD-WAN, the network half that connects your sites.

Three things decide the purchase and only one is a feature comparison. **Which half you need** — most estates need SSE. **PoP presence** where your people actually are, because latency is the experience. **What is genuinely bundled** versus licensed separately, which is where quotes diverge from expectations. The appliance estate this replaces — and the overlap you will pay for twice during the transition — is the [firewall guide](https://www.thetechbag.com/browse/network-security-sase/firewall-network-security).

**The most common mis-purchase.** Signing for SASE and discovering that DLP, CASB or browser isolation are separate SKUs — then running the new subscription alongside an unamortised firewall estate for three years. **Ask which modules are in the base tier, and put the parallel-run cost in the business case before the purchase order.**

## SASE vs SSE · single-vendor vs dual-vendor · what SSE excludes

One split that decides the price, one architectural choice, and one boundary buyers discover after signing. None of these is a maturity ladder.

### SASE vs SSE

SSE is the security half: secure web gateway, CASB, ZTNA, DLP, and often firewall-as-a-service, delivered from the provider's cloud. SASE is SSE plus the network half — SD-WAN connecting your sites. If your WAN works and your problem is people and applications outside the building, SSE is the whole purchase. The quote will usually be for SASE.

### Single-vendor vs dual-vendor SASE

Single-vendor means one policy model, one console, one negotiation — and one vendor's weakest module. Dual-vendor means best-of-breed SSE from one provider and SD-WAN from another, with two policy models to keep in step. Neither is more mature; the honest question is whether your team would rather run one console badly or two consoles well.

### What SSE excludes

SSE inspects traffic to and from users and applications. It does not secure the workload itself — container runtime, cloud posture, identity entitlements in your cloud accounts are CNAPP and identity products, on other guides. It also does not replace east-west inspection inside a data centre. Buying SSE and assuming those cloud workloads are covered is a scope error, not a product failure — that ground is the Cloud & Workload Security guide under Security.

### SASE is not 'firewall, evolved'

It is a different enforcement location with different failure modes. An appliance fails by running out of capacity; a SASE platform fails by PoP distance, an outage in someone else's cloud, or a module you did not license. Cost behaves differently too — subscription rather than refresh cycle — and the renewal trap is module creep rather than a hardware end-of-life.

**These are not a maturity ladder.** An estate with heavy site-to-site traffic and on-premises applications may be right to keep appliances; an estate whose people work from anywhere may be right to buy no appliance at all. The expensive middle — owning both, reconciling neither — is what the [category page](https://www.thetechbag.com/browse/network-security-sase) opens with, because no vendor will write it down.

## The decision variables

Eight variables decide this purchase. The instrument tests what documentation establishes (scope, modules, bundling, India PoPs and logs, experience monitoring, firewall lineage); real latency, contractor counting and the migration path are prose because they need measurement and a contract, not a datasheet.

**SASE or SSE — do you need the network half.** SD-WAN included, or the security half alone. The single largest difference between what buyers need and what they are quoted.

**PoP presence and performance in India.** The nearest point of presence decides user experience more than any feature on the datasheet. Documented by city for Netskope, Cloudflare and Palo Alto; not established for several major vendors — flagged, never assumed.

**Single-vendor versus best-of-breed.** One policy model and one weakest module, or two consoles and two contracts. An operating-model question, not a maturity one.

**What is genuinely included versus licensed separately.** SWG, CASB, ZTNA, DLP, browser isolation and firewall-as-a-service are bundled differently by every vendor. Zscaler's ZPA is a separate subscription from ZIA; Palo Alto, Fortinet, Check Point, Cisco and Versa bundle ZTNA into the base.

**Digital experience monitoring.** The capability that tells you whether the platform is working, and where it is not. Documented at Zscaler (as its own subscription), Netskope, Palo Alto, Cisco and Versa; absent at the others here.

**Migration path from an existing firewall estate.** Same vendor (Palo Alto, Fortinet, Check Point, Versa, Cisco, Trend) or a second vendor in parallel (Zscaler, Netskope, Cloudflare, Coro). It decides whether the transition is one policy model or two.

**Data residency for inspected traffic and logs.** Where traffic is decrypted and where the logs are stored are two separate questions. Only Netskope documents the second in India here.

**Bandwidth-based versus user-based pricing.** Per user is the norm and it meets contractors, seasonal staff and service accounts awkwardly; Versa's network half is per site. Ask how a user is counted and what happens when the count moves.

## The 23 products

Every product carries one stated limitation. Prices are USD with an indicative INR conversion, tier- and term-matched where the vendor publishes one.

### Zscaler Internet Access (ZIA) — Zscaler

- **Who it's for:** Estates whose internet traffic should never touch their own network again — the reference proxy-based SSE, with the largest deployed footprint and the deepest inspection.
- **The honest limitation:** The base edition is the web gateway; DLP, CASB and browser isolation arrive as higher editions or add-ons, which is where quotes diverge from expectations. Zscaler sells no firewall, so a migration from an appliance estate means two vendors in parallel. Named Indian PoP cities are not established from the vendor's own documentation here — flagged.
- **Price:** ~$6–12 (≈ ₹498) — per user / month reported (roughly $72–325 per user / year by edition); the secure web gateway is the base and CASB, DLP, browser isolation and firewall-as-a-service are edition or add-on SKUs
- **Details:** https://www.thetechbag.com/zscaler/zscaler-internet-access

### Zscaler Private Access (ZPA) — Zscaler

- **Who it's for:** Estates replacing remote-access VPN with per-application access — the most widely deployed ZTNA, and the reason many buyers arrive at Zscaler at all.
- **The honest limitation:** A separate subscription from ZIA: the combined bill is what most buyers actually pay, and it is rarely what they were first quoted. Server-initiated protocols need the Network Connector, an extra component to deploy.
- **Price:** ~$6–11 (≈ ₹498) — per user / month reported (ZPA Business roughly $4–7, Transformation roughly $7–11); the private-application half, sold alongside ZIA rather than inside it
- **Details:** https://www.thetechbag.com/zscaler/zscaler-private-access

### Zscaler Digital Experience (ZDX) — Zscaler

- **Who it's for:** Estates that have deployed SSE and now need to answer “is it the network, the PoP, or the application?” when a user complains.
- **The honest limitation:** Monitoring, not enforcement — it protects nothing. It is a third Zscaler subscription on top of ZIA and ZPA, and the case for it only becomes obvious after the first month of unexplained complaints.
- **Price:** Add-on — per user / month add-on; hop-by-hop visibility from the device through the PoP to the application — the product that tells you whether the SASE is actually working
- **Details:** https://www.thetechbag.com/zscaler/zscaler-digital-experience

### Zscaler Zero Trust Exchange (platform) — Zscaler

- **Who it's for:** Enterprises consolidating internet access, private access and experience monitoring under one platform and one negotiation.
- **The honest limitation:** Platform pricing is quoted, not listed, and the edition ladder decides what is included — the reported enterprise figures are large enough that a per-user comparison against point products is misleading. Still no firewall: the appliance estate remains someone else's.
- **Price:** Bundle quote — the platform bundle that combines ZIA, ZPA, ZDX and data protection — reported around $312,000 a year for 500 users on the Transformation edition, which is the number to reason from rather than any per-module list
- **Details:** https://www.thetechbag.com/zscaler/zscaler-zero-trust-exchange

### Netskope One SSE Platform — Netskope

- **Who it's for:** Estates where data protection is the reason for the project — CASB and DLP are in the platform's DNA rather than bolted on — and where Indian data residency must be documented, not assumed.
- **The honest limitation:** Module creep is the pattern to watch: entry bundles look competitive and the fully-loaded per-user figure converges with Zscaler's. No firewall estate of its own, so an appliance migration runs in parallel with another vendor.
- **Price:** ~$15+ (≈ ₹1,245) — per user / month for a fully-bundled configuration (entry bundles list lower and rise through add-on modules); NewEdge carries eight data centres in India, and a NewEdge management plane in Mumbai supports DPDP-aligned data residency
- **Details:** https://www.thetechbag.com/netskope/netskope-sse-platform

### Netskope Next Gen SWG — Netskope

- **Who it's for:** Estates whose control requirement is by application instance — allow the corporate tenant, block the personal one — which domain-level filtering cannot express.
- **The honest limitation:** Instance awareness is the differentiator and the reason it is priced as a platform module rather than a cheap filter. DNS-layer-only estates will find this more product than they need — the secure web guide covers that end.
- **Price:** Per user — per user / month within the Netskope One platform; inline inspection of web and cloud application traffic with application-instance awareness rather than domain-level allow or block
- **Details:** https://www.thetechbag.com/netskope/netskope-swg

### Palo Alto Prisma SASE — Palo Alto Networks

- **Who it's for:** Palo Alto firewall estates moving enforcement to the cloud without changing vendor, policy model or account team — the cleanest migration path on this page.
- **The honest limitation:** The full SASE bundle includes the network half you may not need; buying Prisma Access alone is the SSE-shaped purchase, and the quote will not default to it. Premium-priced, and the value assumes you adopt the platform.
- **Price:** Per user bundle — per user / year bundles combining Prisma Access with Prisma SD-WAN; a Mumbai cloud location has been documented since 2021, and Prisma Access falls back to India West for users who cannot connect in-country
- **Details:** https://www.thetechbag.com/palo-alto/prisma-sase

### Palo Alto Prisma Access — Palo Alto Networks

- **Who it's for:** Estates that want the firewall's inspection model applied to users who never come back to the office, without buying the network half.
- **The honest limitation:** Still enterprise-priced, and the migration only feels seamless if you already run Palo Alto policy. In-country log storage for Indian buyers is not established from documentation — confirm in writing.
- **Price:** Per user — per user / year, quoted; the security half without SD-WAN — the same App-ID policy model as the firewall estate, delivered from Palo Alto's cloud
- **Details:** https://www.thetechbag.com/palo-alto/prisma-access

### Fortinet FortiSASE — Fortinet

- **Who it's for:** FortiGate estates extending the same policy and console to remote users at the lowest published entry price on this page.
- **The honest limitation:** Digital experience monitoring is not a documented capability here, and named Indian PoP cities are not established from vendor documentation — both flagged rather than ruled out. The Fabric discount is real and it deepens the single-vendor commitment.
- **Price:** Quote — quoted per user per year through partners in Standard, Advanced and Comprehensive tiers; the only public figures are a UK reseller’s 2024 G-Cloud list (£78, £101 and £304 at 50–499 users, falling with volume), not an Indian price
- **Details:** https://www.thetechbag.com/fortinet/fortinet-fortisase

### Check Point Harmony SASE — Check Point

- **Who it's for:** Mid-market and distributed estates that want network-level access and web security quickly, with a Check Point firewall estate alongside.
- **The honest limitation:** Narrower module set than the SSE leaders — CASB and DLP depth are not its ground — and no documented digital experience monitoring. Its Indian PoP cities rest on a June 2025 announcement rather than a current admin guide.
- **Price:** Quote — per user, quoted — the Perimeter 81 price list is no longer published; the former Perimeter 81, now integrated with Check Point's estate, with an India data-residency region (May 2025) and PoPs announced in Bengaluru, Chennai, Mumbai and New Delhi
- **Details:** https://www.thetechbag.com/checkpoint/checkpoint-harmony-sase

### Cisco Secure Access — Cisco

- **Who it's for:** Cisco estates consolidating Umbrella, VPN and firewall policy into one cloud service under an existing enterprise agreement.
- **The honest limitation:** Newer than Zscaler's and Netskope's platforms and carrying the Umbrella lineage; module depth varies by tier. Named Indian PoP cities are not established from vendor documentation — flagged, and worth asking for in writing given the latency stakes.
- **Price:** Per user — per user / year, quoted; the successor to Umbrella's SIG tiers with ZTNA, and the natural extension for estates already running Cisco networking and Duo
- **Details:** https://www.thetechbag.com/cisco/cisco-secure-access

### Cloudflare One (Zero Trust) — Cloudflare

- **Who it's for:** Estates that want real SSE capability at a published price they can start on today, on the largest Indian PoP footprint here.
- **The honest limitation:** The $7 tier is genuinely capable and genuinely not the enterprise product: DLP depth, CASB breadth and log retention move to Enterprise, which is quoted. No firewall estate, and no documented digital experience monitoring.
- **Price:** Free → $7 (≈ ₹581) — free for up to 50 users, then $7 per user / month pay-as-you-go with no user cap; Enterprise adds expanded CASB, custom DLP, browser isolation, dedicated egress IPs and longer log retention — India PoPs include Mumbai, Chennai, New Delhi, Bengaluru, Kolkata and Nagpur
- **Details:** https://www.thetechbag.com/cloudflare/cloudflare-one-zero-trust

### Versa SASE — Versa Networks

- **Who it's for:** Estates that want one software stack from branch to cloud, and are willing to buy it through a carrier-managed service.
- **The honest limitation:** Frequently reached through a carrier rather than directly, which changes who owns support and how fast policy changes move. Named Indian PoP cities are not established from Versa's own documentation.
- **Price:** Per site / per user — subscription per site for the network half and per user for the security half; the same software runs the branch appliance, the data centre and the cloud PoP — often delivered in India through a carrier
- **Details:** https://www.thetechbag.com/versa/versa-sase

### Versa SSE — Versa Networks

- **Who it's for:** Estates that want Versa's inspection and access controls without replacing the WAN they already run.
- **The honest limitation:** Smaller deployed footprint than Zscaler or Netskope in the SSE market specifically, and PoP presence in India is not documented by city. Support often sits with a partner.
- **Price:** Per user — per user / year for the security half alone, without committing to Versa's SD-WAN — the honest answer for estates that keep their existing network
- **Details:** https://www.thetechbag.com/versa/versa-sse

### Coro Network & SASE — Coro

- **Who it's for:** SMB and mid-market estates that want network access, web security and endpoint protection on one modular per-user bill with no appliance.
- **The honest limitation:** Built for the mid-market and documented there: inspection depth, module breadth and enterprise controls are well behind the SSE leaders, and it is unverified above 2,000 users. No documented India PoP presence.
- **Price:** $10.50 (≈ ₹872) — per user / month published for the SASE module (Coro Essentials $10.50, Complete $15 unmanaged / $20 managed); individual modules from $4 per user / month on a modular platform built for the mid-market
- **Details:** https://www.thetechbag.com/coro/coro-network-sase

### Cato SASE Platform — Cato Networks

- **Who it's for:** Estates where the network is the problem as much as the security — Cato owns and operates the backbone, so latency and local breakout are testable from your own branches before you sign.
- **The honest limitation:** You commit to one vendor's backbone: the traffic path becomes their architecture decision, and where their PoPs are thin no feature compensates. In-country log storage is not established — their site sits behind bot protection, so it could not be verified and should be asked for in writing.
- **Price:** Quote-only — quoted by sites, bandwidth and which of the four modules you license; the whole platform runs on Cato's own private backbone of 85+ PoPs rather than public cloud, with Chennai and Mumbai among them and a stated 99.999% uptime SLA on the SD-WAN half
- **Details:** https://www.thetechbag.com/cato

### Cato SSE — Cato Networks

- **Who it's for:** Estates that want the security half without the network half, and value inspection happening on the path rather than beside it — particularly where TLS decryption has been quietly scoped down on branch appliances.
- **The honest limitation:** The no-hairpin advantage largely disappears if your network is not also on Cato, at which point you are comparing it to the SSE specialists on features alone. Private application access overlaps with their ZTNA module — confirm which one the quote covers.
- **Price:** Quote-only — per user, quoted; the security half alone, with inspection running inside the PoP the traffic already crosses rather than as a separate cloud service you hairpin to
- **Details:** https://www.thetechbag.com/cato/cato-sse

### Cato Universal ZTNA — Cato Networks

- **Who it's for:** Estates that secured remote users and left the office on implicit network trust — the universal half is the seam most ZTNA projects postpone into a phase that never gets funded.
- **The honest limitation:** Application-level segmentation needs an inventory of your applications and who legitimately needs each. That is the real project and no vendor supplies it. Private app access also appears in their SSE module.
- **Price:** Quote-only — per user, quoted; one policy across user types and locations with continuous verification through the session and entitlement granted per application rather than admission to a network
- **Details:** https://www.thetechbag.com/cato/cato-ztna

### Cato AI Security — Cato Networks

- **Who it's for:** Estates that cannot list the AI services their staff actually use, and where an endpoint agent rollout is the objection blocking every other option — this rides inspection that already exists.
- **The honest limitation:** The newest of the four modules, so ask what is generally available today versus roadmap, especially around AI agents. Network-based, so AI use that never crosses the network is outside its view.
- **Price:** Quote-only — quoted; packaging against the other three modules is worth confirming rather than assuming, since this one was added in March 2026 and recently introduced modules tend to be repackaged
- **Details:** https://www.thetechbag.com/cato/cato-ai-security

### Trend Micro Zero Trust Secure Access — Trend Micro

- **Who it's for:** Trend Vision One estates that want access decisions informed by the same risk score their endpoint and email products already produce.
- **The honest limitation:** Credit-based billing is opaque until you run it, and the SSE module set is narrower than the platform leaders'. Its value depends on running Trend elsewhere; the Internet Access gateway runs in AWS Mumbai.
- **Price:** Credits / quote — consumed as Vision One credits alongside Trend's other modules rather than as a standalone per-user list; risk signals from the endpoint and email products feed the access decision
- **Details:** https://www.thetechbag.com/trendmicro/trendmicro-zero-trust-secure-access

### Skyhigh Security Service Edge (Essential, Advanced, Complete) — Skyhigh Security

- **Who it's for:** Estates moving to SSE without retiring their on-premises web gateway on day one — one policy runs in the cloud and on the appliance.
- **The honest limitation:** A Niche Player in Gartner’s 2025 SSE Magic Quadrant (a Visionary in 2024; named in 2026, quadrant unconfirmed), though first of eight in the Advanced SSE use case in Gartner’s 2026 Critical Capabilities. ZTNA and firewall come only with Complete or as add-ons; all pricing is partner-quoted.
- **Price:** Quote — per user, quoted through partners: Essential bundles the cloud and on-prem web gateway, shadow-IT CASB, DLP and risky-web isolation; Advanced adds unlimited sanctioned-app CASB and endpoint DLP; Complete adds Private Access and Cloud Firewall; status page lists PoPs in Bangalore, Noida and Mumbai
- **Details:** https://www.thetechbag.com/skyhigh-security/skyhigh-security-service-edge

### iboss Zero Trust SASE (Core, Advanced, Complete) — iboss

- **Who it's for:** Estates that want each customer’s gateway in its own container, with the option to run it in iboss’s cloud, a chosen country or their own data centre.
- **The honest limitation:** A Niche Player in Gartner’s 2025 SSE Magic Quadrant; named in the 2026 edition, quadrant unconfirmed. Indian log storage is not documented, and ZTNA and DLP need the higher packages; the UK reseller prices seen online are not iboss list prices.
- **Price:** Quote — per user per year, quoted: Core carries the web gateway, DNS security, HTTPS decryption and basic CASB; Advanced adds ZTNA, inline CASB and SD-WAN; Complete adds DLP and API CASB; browser isolation is always an add-on and the reporting licence is sold separately; iboss lists data centres in Mumbai and Delhi
- **Details:** https://www.thetechbag.com/iboss/iboss-zero-trust-sase

### Fortra Cloud Security (CASB, SWG, ZTNA) — Fortra

- **Who it's for:** Data-led estates, especially those already running Fortra DLP or DSPM, that want web, SaaS and private-app traffic held to one DLP and file-encryption policy, including unmanaged contractor devices through the reverse proxy.
- **The honest limitation:** The line came to Fortra with Lookout's Cloud Security business on 12 May 2025, and it was not evaluated in Gartner's 2025 or 2026 SSE Magic Quadrant (KuppingerCole rated it a Product and Market Leader for Zero Trust Platforms in July 2026). Fortra publishes no PoP list, no Indian PoP and no India log region, documents no experience monitoring and has no SD-WAN.
- **Price:** Quote — quoted product by product, with Fortra CASB, Fortra SWG and Fortra ZTNA each on its own quote request and no bundle, tier or meter published (per user is the usual SSE meter; confirm it); one agent, one proxy and one policy across all three, with inline DLP and encrypt-on-download EDRM
- **Details:** https://www.thetechbag.com/fortra/fortra-cloud-security

## Why each constraint rules out what it does

The full narrowing logic, as prose. Nothing here is hidden behind an interaction.

**The security half only.** Rules out Palo Alto Prisma SASE, Fortinet FortiSASE, Check Point Harmony SASE, Versa SASE, Coro Network & SASE, Cato SASE Platform and iboss Zero Trust SASE (Core, Advanced, Complete) — sold as full SASE including the network half; the SSE-shaped purchase is a different SKU from this vendor. That leaves Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX), Zscaler Zero Trust Exchange (platform), Netskope One SSE Platform, Netskope Next Gen SWG, Palo Alto Prisma Access, Cisco Secure Access, Cloudflare One (Zero Trust), Versa SSE, Cato SSE, Cato Universal ZTNA, Cato AI Security, Trend Micro Zero Trust Secure Access, Skyhigh Security Service Edge (Essential, Advanced, Complete) and Fortra Cloud Security (CASB, SWG, ZTNA).

**SD-WAN included.** Rules out Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX), Zscaler Zero Trust Exchange (platform), Netskope One SSE Platform, Netskope Next Gen SWG, Palo Alto Prisma Access, Cisco Secure Access, Cloudflare One (Zero Trust), Versa SSE, Cato SSE, Cato Universal ZTNA, Cato AI Security, Trend Micro Zero Trust Secure Access, Skyhigh Security Service Edge (Essential, Advanced, Complete) and Fortra Cloud Security (CASB, SWG, ZTNA) — security-only; SD-WAN comes from another product or another vendor. That leaves Palo Alto Prisma SASE, Fortinet FortiSASE, Check Point Harmony SASE, Versa SASE, Coro Network & SASE, Cato SASE Platform and iboss Zero Trust SASE (Core, Advanced, Complete).

**CASB.** Rules out Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX), Palo Alto Prisma Access, Check Point Harmony SASE, Coro Network & SASE and Cato Universal ZTNA — CASB is not a documented capability of this product. That leaves Zscaler Internet Access (ZIA), Zscaler Zero Trust Exchange (platform), Netskope One SSE Platform, Netskope Next Gen SWG, Palo Alto Prisma SASE, Fortinet FortiSASE, Cisco Secure Access, Cloudflare One (Zero Trust), Versa SASE, Versa SSE, Cato SASE Platform, Cato SSE, Cato AI Security, Trend Micro Zero Trust Secure Access, Skyhigh Security Service Edge (Essential, Advanced, Complete), iboss Zero Trust SASE (Core, Advanced, Complete) and Fortra Cloud Security (CASB, SWG, ZTNA).

**DLP.** Rules out Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX), Check Point Harmony SASE, Coro Network & SASE, Cato Universal ZTNA and Trend Micro Zero Trust Secure Access — DLP is not a documented capability of this product. That leaves Zscaler Internet Access (ZIA), Zscaler Zero Trust Exchange (platform), Netskope One SSE Platform, Netskope Next Gen SWG, Palo Alto Prisma SASE, Palo Alto Prisma Access, Fortinet FortiSASE, Cisco Secure Access, Cloudflare One (Zero Trust), Versa SASE, Versa SSE, Cato SASE Platform, Cato SSE, Cato AI Security, Skyhigh Security Service Edge (Essential, Advanced, Complete), iboss Zero Trust SASE (Core, Advanced, Complete) and Fortra Cloud Security (CASB, SWG, ZTNA).

**Browser isolation.** Rules out Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX), Netskope Next Gen SWG, Fortinet FortiSASE, Check Point Harmony SASE, Cisco Secure Access, Versa SASE, Versa SSE, Coro Network & SASE, Cato SASE Platform, Cato SSE, Cato Universal ZTNA, Cato AI Security and Trend Micro Zero Trust Secure Access — remote browser isolation is not a documented capability of this product. That leaves Zscaler Internet Access (ZIA), Zscaler Zero Trust Exchange (platform), Netskope One SSE Platform, Palo Alto Prisma SASE, Palo Alto Prisma Access, Cloudflare One (Zero Trust), Skyhigh Security Service Edge (Essential, Advanced, Complete), iboss Zero Trust SASE (Core, Advanced, Complete) and Fortra Cloud Security (CASB, SWG, ZTNA).

**Firewall-as-a-service.** Rules out Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX), Netskope One SSE Platform, Netskope Next Gen SWG, Cloudflare One (Zero Trust), Versa SSE, Cato SSE, Cato Universal ZTNA, Cato AI Security and Trend Micro Zero Trust Secure Access — firewall-as-a-service is not a documented capability of this product. That leaves Zscaler Internet Access (ZIA), Zscaler Zero Trust Exchange (platform), Palo Alto Prisma SASE, Palo Alto Prisma Access, Fortinet FortiSASE, Check Point Harmony SASE, Cisco Secure Access, Versa SASE, Coro Network & SASE, Cato SASE Platform, Skyhigh Security Service Edge (Essential, Advanced, Complete), iboss Zero Trust SASE (Core, Advanced, Complete) and Fortra Cloud Security (CASB, SWG, ZTNA).

**ZTNA in the base tier.** Rules out Zscaler Internet Access (ZIA), Zscaler Digital Experience (ZDX), Netskope Next Gen SWG and Cato AI Security — no ZTNA capability in this product; Netskope One SSE Platform, Skyhigh Security Service Edge (Essential, Advanced, Complete), iboss Zero Trust SASE (Core, Advanced, Complete) and Fortra Cloud Security (CASB, SWG, ZTNA) — ZTNA exists but is a separate subscription or higher edition. That leaves Zscaler Private Access (ZPA), Zscaler Zero Trust Exchange (platform), Palo Alto Prisma SASE, Palo Alto Prisma Access, Fortinet FortiSASE, Check Point Harmony SASE, Cisco Secure Access, Cloudflare One (Zero Trust), Versa SASE, Versa SSE, Coro Network & SASE, Cato SASE Platform, Cato SSE, Cato Universal ZTNA and Trend Micro Zero Trust Secure Access.

**Named India PoPs.** Rules nothing out on published terms. It flags Zscaler Internet Access (ZIA) — An India region is served but named PoP cities are not established from the vendor's own documentation, Zscaler Private Access (ZPA) — An India region is served but named PoP cities are not established from the vendor's own documentation, Zscaler Digital Experience (ZDX) — An India region is served but named PoP cities are not established from the vendor's own documentation, Zscaler Zero Trust Exchange (platform) — An India region is served but named PoP cities are not established from the vendor's own documentation, Fortinet FortiSASE — India PoP presence not established from vendor documentation, Cisco Secure Access — India PoP presence not established from vendor documentation, Versa SASE — India PoP presence not established from vendor documentation, Versa SSE — India PoP presence not established from vendor documentation, Coro Network & SASE — India PoP presence not established from vendor documentation and Fortra Cloud Security (CASB, SWG, ZTNA) — India PoP presence not established from vendor documentation — marked, not removed.

**In-country logs.** Rules nothing out on published terms. It flags Zscaler Internet Access (ZIA) — In-country log storage not established from documentation, Zscaler Private Access (ZPA) — In-country log storage not established from documentation, Zscaler Digital Experience (ZDX) — In-country log storage not established from documentation, Zscaler Zero Trust Exchange (platform) — In-country log storage not established from documentation, Palo Alto Prisma SASE — In-country log storage not established from documentation, Palo Alto Prisma Access — In-country log storage not established from documentation, Fortinet FortiSASE — In-country log storage not established from documentation, Check Point Harmony SASE — In-country log storage not established from documentation, Cisco Secure Access — In-country log storage not established from documentation, Cloudflare One (Zero Trust) — In-country log storage not established from documentation, Versa SASE — In-country log storage not established from documentation, Versa SSE — In-country log storage not established from documentation, Coro Network & SASE — In-country log storage not established from documentation, Cato SASE Platform — In-country log storage not established from documentation, Cato SSE — In-country log storage not established from documentation, Cato Universal ZTNA — In-country log storage not established from documentation, Cato AI Security — In-country log storage not established from documentation, Trend Micro Zero Trust Secure Access — In-country log storage not established from documentation, iboss Zero Trust SASE (Core, Advanced, Complete) — In-country log storage not established from documentation and Fortra Cloud Security (CASB, SWG, ZTNA) — In-country log storage not established from documentation — marked, not removed.

**Experience monitoring.** Rules out Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), Netskope Next Gen SWG, Fortinet FortiSASE, Check Point Harmony SASE, Cloudflare One (Zero Trust), Coro Network & SASE, Cato Universal ZTNA, Cato AI Security, Trend Micro Zero Trust Secure Access, Skyhigh Security Service Edge (Essential, Advanced, Complete) and Fortra Cloud Security (CASB, SWG, ZTNA) — no documented digital experience monitoring; a slow user is a support ticket without evidence. That leaves Zscaler Digital Experience (ZDX), Zscaler Zero Trust Exchange (platform), Netskope One SSE Platform, Palo Alto Prisma SASE, Palo Alto Prisma Access, Cisco Secure Access, Versa SASE, Versa SSE, Cato SASE Platform, Cato SSE and iboss Zero Trust SASE (Core, Advanced, Complete).

**Same vendor as the firewall.** Rules out Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX), Zscaler Zero Trust Exchange (platform), Netskope One SSE Platform, Netskope Next Gen SWG, Cloudflare One (Zero Trust), Coro Network & SASE, Cato SASE Platform, Cato SSE, Cato Universal ZTNA, Cato AI Security, Skyhigh Security Service Edge (Essential, Advanced, Complete), iboss Zero Trust SASE (Core, Advanced, Complete) and Fortra Cloud Security (CASB, SWG, ZTNA) — this vendor sells no firewall estate, so the migration runs two vendors in parallel. That leaves Palo Alto Prisma SASE, Palo Alto Prisma Access, Fortinet FortiSASE, Check Point Harmony SASE, Cisco Secure Access, Versa SASE, Versa SSE and Trend Micro Zero Trust Secure Access.

**Above 5,000 users on the platform.** Rules nothing out on published terms. It flags Coro Network & SASE — Not documented at this platform size, Cato AI Security — Not documented at this platform size, Skyhigh Security Service Edge (Essential, Advanced, Complete) — Not documented at this platform size and Fortra Cloud Security (CASB, SWG, ZTNA) — Not documented at this platform size — marked, not removed.

**Most buyers who say SASE mean SSE.** SASE is the security half plus the network half (SD-WAN). SSE is the security half alone. If your WAN is fine and your problem is users and applications that left the building, you need SSE — and you will be quoted for SASE, because the bundle is larger. Zscaler, Netskope, Cloudflare and Cisco are SSE-shaped; Palo Alto, Fortinet, Check Point, Versa and Coro sell the fuller SASE, and Palo Alto and Versa also sell the SSE-shaped half separately. Ask which half you are being quoted, per line.

**India PoP presence decides user experience more than any feature.** The nearest PoP is the difference between a platform users forget about and one they route around. Documented here from vendor sources: Netskope carries eight data centres in India with a NewEdge management plane in Mumbai supporting DPDP-aligned residency; Cloudflare's Indian PoPs include Mumbai, Chennai, New Delhi, Bengaluru, Kolkata and Nagpur; Palo Alto has documented a Mumbai cloud location since 2021, with Prisma Access falling back to India West where in-country connection is unavailable. Zscaler's published enforcement-node list includes Mumbai, Chennai, New Delhi and Hyderabad; Check Point announced an India residency region with PoPs in Bengaluru, Chennai, Mumbai and New Delhi; Trend Micro's Internet Access gateway runs in AWS Mumbai. Fortinet, Cisco, Versa and Coro are not established — all flagged, none ruled out. Ask for the city list and a latency test from your own offices before signing; real measured latency from Indian cities is delivery-team knowledge: [TechBag to confirm].

**What is bundled, and what arrives as a separate SKU.** This is where quotes diverge from expectations. Zscaler's base is the web gateway with CASB, DLP and browser isolation as editions or add-ons, and ZPA is a separate subscription from ZIA — the combined bill is what estates actually pay. Netskope bundles CASB with the gateway and adds modules upward. Palo Alto, Fortinet, Check Point, Cisco and Versa bundle ZTNA into the base tier. Coro is modular from $4 per user per month. Read the line items, not the platform name.

**User-based pricing meets contractors and service accounts.** Per-user meters are simple until you count the people who are not employees: contractors, seasonal staff, partners, and the service accounts that also traverse the proxy. Ask how each vendor counts a user, whether inactive users are billed, and what happens when the number moves seasonally. Bandwidth-based and site-based meters (Versa's network half) behave differently again.

**Under 500 users.** No published term excludes an estate this size: Cloudflare is free to 50 users and $7 per user per month beyond, Coro publishes $10.50 for its SASE module, and Fortinet's per-user tiers start at 50 users (a UK reseller's 2024 G-Cloud list puts Standard at £78 per user per year). The platform leaders publish no floor but carry minimums through the channel — current minimums by vendor: [TechBag to confirm].

## Eight situations, eight shortlists — with the half named

Each shortlist states whether the answer is SSE or full SASE, and what the India question does to it. If your WAN is already fine, start from the first row.

### The WAN is fine — it is the users and applications that left

**Shortlist:** Zscaler Zero Trust Exchange (platform), Netskope One SSE Platform, Cloudflare One (Zero Trust)

**Why:** All three are SSE-shaped: security enforcement in the cloud without buying SD-WAN you do not need. Cloudflare publishes a price you can start on today; Netskope and Zscaler are the depth options.

**Trade-off:** You will be quoted SASE. Ask for the SSE-shaped configuration explicitly, line by line, and check whether ZTNA is inside the base tier or a second subscription.

### Migrating off a firewall estate without changing vendor

**Shortlist:** Palo Alto Prisma Access, Fortinet FortiSASE, Check Point Harmony SASE

**Why:** Same policy model, same console, same account team — Palo Alto's App-ID policy carries across, Fortinet gives FortiGate customers Security Fabric pricing worth a reported 20–25%, and Check Point extends the Quantum estate.

**Trade-off:** Single-vendor continuity makes the migration easier and the lock-in deeper. It also does not recover the appliance's book value — the parallel run is still real.

### Indian data residency has to be documented, not assumed

**Shortlist:** Netskope One SSE Platform, Cloudflare One (Zero Trust), Palo Alto Prisma SASE

**Why:** Netskope documents eight Indian data centres plus a Mumbai management plane for DPDP-aligned residency; Cloudflare documents six Indian PoP cities; Palo Alto documents a Mumbai cloud location.

**Trade-off:** PoP presence and log residency are different questions — only Netskope documents the second here. Get both in the contract, by name.

### Data protection is the reason for the project

**Shortlist:** Netskope One SSE Platform, Zscaler Internet Access (ZIA), Cloudflare One (Zero Trust)

**Why:** Netskope's CASB and DLP are the platform's origin rather than an add-on; Zscaler's are higher editions; Cloudflare's arrive at Enterprise.

**Trade-off:** The cheapest quote in this row is rarely the one with the DLP depth demonstrated — confirm which edition the demo was on.

### Users complain it is slow and nobody can prove where

**Shortlist:** Zscaler Digital Experience (ZDX), Netskope One SSE Platform, Cisco Secure Access

**Why:** Digital experience monitoring answers whether it is the device, the link, the PoP or the application. Zscaler sells ZDX as its own subscription; Netskope, Cisco, Palo Alto and Versa document it inside the platform.

**Trade-off:** Zscaler's is a third subscription on top of ZIA and ZPA. Fortinet, Check Point, Cloudflare and Coro document none — a slow user stays a support ticket without evidence.

### Mid-market, no appliance, one bill

**Shortlist:** Coro Network & SASE, Cloudflare One (Zero Trust), Check Point Harmony SASE

**Why:** Coro publishes $10.50 per user per month for SASE on a modular platform; Cloudflare starts free to 50 users and $7 beyond; Harmony SASE deploys quickly for distributed teams.

**Trade-off:** Coro is unverified above 2,000 users and its inspection depth is well behind the leaders. Cheap and adequate is a legitimate answer — cheap and assumed-equivalent is not.

### Branch connectivity and security together, one stack

**Shortlist:** Versa SASE, Palo Alto Prisma SASE, Fortinet FortiSASE

**Why:** Versa runs the same software in the branch, the data centre and the PoP; Palo Alto pairs Prisma Access with Prisma SD-WAN; Fortinet extends the FortiGate estate.

**Trade-off:** Versa is frequently delivered through a carrier in India, which changes who owns support and how fast a policy change moves. Confirm the operating model, not just the technology.

### Already inside a Cisco or Trend platform agreement

**Shortlist:** Cisco Secure Access, Trend Micro Zero Trust Secure Access, Cloudflare One (Zero Trust)

**Why:** Cisco Secure Access consolidates Umbrella, VPN and firewall policy under an existing enterprise agreement; Trend feeds endpoint and email risk into the access decision through Vision One credits.

**Trade-off:** Both carry narrower SSE module sets than the leaders, and neither documents Indian PoP cities. Credit-based billing at Trend is opaque until you run it.

## At scale

SASE scales by users and by PoP distance, and the second is invisible until it is not. The bill follows the per-user meter; the satisfaction follows the map.

### 500 users — Published pricing is the constraint

- Cloudflare ($7 per user per month beyond 50 free), Coro ($10.50 published for SASE) and Fortinet (a UK G-Cloud list from £78 per user a year) give you a number before an enterprise negotiation.
- One or two Indian offices means PoP distance is testable in an afternoon — do it before signing.
- The module question is simpler here: most estates this size need the web gateway and ZTNA, not the full data-protection stack.

**The test:** Run a two-week pilot from your actual offices and measure page-load times against the current path. If it is slower, no feature list fixes it.

### 5,000 users — Modules and the parallel run are the constraint

- Module creep is now the pattern: entry bundles that looked competitive converge upward as CASB, DLP and browser isolation are added.
- The firewall estate is still on the books — the parallel-run quarters belong in the business case, not in a surprise.
- Digital experience monitoring stops being optional: at this size, unexplained slowness becomes a weekly meeting.

**The test:** Price the same estate three ways — SSE only, full SASE, and staying on appliances — over five years. If nobody has, the decision is being made blind.

### 20,000 users — Residency and the operating model are the constraint

- Traffic decryption location and log residency become regulator-visible; only Netskope documents in-country log storage here.
- User counting matters commercially: contractors, seasonal staff and service accounts on a per-user meter add up to a negotiation of their own.
- Coro is flagged unverified above 2,000 users; everything else here documents large estates.

**The test:** Get the Indian PoP city list, the log-residency commitment and the user-counting definition into the contract — all three in writing, before the discount conversation.

Zscaler, Netskope, Palo Alto, Fortinet, Check Point, Cisco, Cloudflare, Versa and Trend Micro document large estates; Coro Network & SASE is flagged unverified above 2,000 users. Where a specific platform strains for your user population: [TechBag to confirm].

## Leaving a SASE platform means re-pointing every user and every application

The platform sits in the traffic path for everyone. Switching means new agents on every device, new tunnels from every site, and every private application re-published — while the old platform still carries production.

**The agent on every device** — A new agent pushed to every laptop and phone, with the old one removed in the right order. It is a device-management project before it is a security one. *(Re-deploy, device by device)*

**The private applications** — Every published application, connector and access policy is rebuilt on the new platform and tested — including the awkward ones that needed a workaround the first time. *(Re-publish and re-test)*

**Certificates and inspection** — The decryption trust chain is per platform: new certificates to every endpoint before inspection can work, or it silently stops working for someone. *(New trust chain first)*

**The overlap** — Both platforms run while users and sites cut over. Two per-user bills for a quarter is the honest cost of not breaking access for everyone at once. *(Two bills, one quarter)*

**Agent rollout, application re-publishing and overlap cost for your estate:** [TechBag to confirm] — TechBag scopes it from your device count, application inventory and contract dates.

## Per user per month — times the modules you actually need

What you may already hold, the platforms priced per user at three estate sizes in USD and INR, and what the subscription leaves out — which, during a transition, is the estate you are still paying for.

### Do you already own one?

Four subscriptions that may already carry part of this. Two of them genuinely do.

- **Your existing NGFW subscription — Often.** Web filtering, DNS security and application control are frequently already in the bundle you renew — for traffic that comes back to your network. It does not follow the user, which is the whole point of SSE.

- **Microsoft Entra ID P1 / P2 — Partly.** Conditional access decides whether a sign-in proceeds, based on device and risk. Real access control; no traffic inspection, no DLP on the wire, no web filtering.

- **Cloudflare's free tier — Partly.** Genuinely free for up to 50 users on Zero Trust, and real DNS ground beyond that. A legitimate starting point for a small estate, not an enterprise SSE.

- **Your endpoint vendor's web filtering — Partly.** Many endpoint agents filter web traffic on the device. It travels with the user, and it is thinner than a cloud gateway on inspection, CASB and DLP.

If what you already renew covers the traffic you were worried about, we say so. It costs us a sale and saves you one.

### What the rest actually cost

Published and reported per-user meters (INR for scale), worked at three estate sizes per year. The mid-market and published-price options are covered explicitly — they are absent from every global comparison, and at 500 users they are the honest answer more often than the leaders are.

### What isn't in the licence price

- **The estate you are still paying for.** The unamortised appliances, their renewing subscriptions, and the quarters during which both bills arrive. This is the double-spend the category opens with, and it belongs in the business case as a line rather than a surprise.

- **Circuits, bandwidth and the certificate rollout.** Breakout bandwidth at each site, the links themselves, and the TLS trust chain deployed to every endpoint before inspection works. None of it is in the per-user price; all of it is in the timeline.

- **The users who are not employees.** Contractors, seasonal staff, partners and service accounts on a per-user meter. Ask how a user is counted and whether inactive users are billed, before the count moves. Your number: [TechBag to confirm].

## What goes wrong

Documented platform behaviour and migration outcomes, cross-checked against TechBag engagements before any becomes a named case. Each is cheaper to read here than to discover after the cut-over.

- **PoP latency from Indian cities to the nearest node.** Users in a city with no nearby point of presence route through another country and notice every day. Test from your actual offices before signing — and get the city list in the contract.

- **Discovering DLP and CASB are separate SKUs after signing.** The demo showed data protection; the quoted tier was the web gateway. Read the module line items, not the platform name.

- **Running SASE and an unamortised firewall estate in parallel for three years.** Two enforcement estates, overlapping capability, two bills, and a saving that never materialised because nobody switched the duplicates off.

- **User-based pricing that ignored contractors and service accounts.** The employee count was the budget; the billable count included everyone who traversed the proxy. Define a user in the contract.

- **Logs stored outside India when the regulator asked otherwise.** Traffic residency and log residency are different commitments — only one vendor here documents the second. Ask for both by name.

- **No way to prove where the slowness is.** Without digital experience monitoring, every complaint is an argument between the network team and the platform vendor. Four products here document none.

- **Assuming SSE covers cloud workloads.** It inspects user and application traffic; container runtime and cloud posture are CNAPP, on another guide. A scope error, not a product failure.

- **Buying the network half nobody needed.** SD-WAN arrived in the bundle for an estate whose WAN was fine. Ask for the SSE-shaped configuration, explicitly, and compare it against the SASE quote.

## Questions this guide answers

### What is the difference between SASE and SSE?

SSE — security service edge — is the security half: secure web gateway, CASB, ZTNA, DLP and often firewall-as-a-service, delivered from a provider's cloud so policy follows the user. SASE is SSE plus the network half, SD-WAN, connecting your sites. Most organisations buying SASE only need SSE, because their WAN is already adequate and the problem is people and applications outside the building — but the quote will usually be for the fuller bundle. Ask which half each line covers. Zscaler, Netskope, Cloudflare and Cisco are SSE-shaped; Palo Alto, Fortinet, Check Point, Versa and Coro sell full SASE, and Palo Alto and Versa also sell the SSE half separately.

### Which SASE and SSE vendors have points of presence in India?

From vendor documentation: Netskope operates eight data centres in India and has introduced a NewEdge management plane in Mumbai supporting DPDP-aligned data residency; Cloudflare's Indian points of presence include Mumbai, Chennai, New Delhi, Bengaluru, Kolkata and Nagpur; Palo Alto Networks has documented a Mumbai cloud location since 2021, with Prisma Access falling back to India West where an in-country connection is unavailable. Zscaler's published enforcement-node list includes Mumbai, Chennai, New Delhi and Hyderabad, Check Point announced Indian PoPs in Bengaluru, Chennai, Mumbai and New Delhi alongside an India residency region, and Trend Micro's Internet Access gateway sits in AWS Mumbai; Fortinet, Cisco, Versa and Coro are not established — all flagged rather than ruled out. Ask for the city list and a latency test from your own offices; PoP distance decides user experience more than any feature.

### Why do SASE quotes come in so much higher than the per-user list price?

Three reasons, all avoidable. First, the network half: SD-WAN arrives in a SASE bundle even when the WAN is fine. Second, module separation — Zscaler's ZPA is a separate subscription from ZIA and ZDX is a third, while CASB, DLP and browser isolation move up editions at several vendors, so the demo and the quoted tier differ. Third, user counting: contractors, seasonal staff and service accounts traverse the proxy and appear on a per-user meter nobody budgeted for. Ask for the module line items, the definition of a billable user, and the SSE-shaped configuration alongside the SASE one.

---

*Vendor-neutral. Nothing gated. Figures marked [TechBag to confirm] are team-owned and deliberately not guessed.*
*TechBag — India-based software reseller and advisory. https://www.thetechbag.com/browse/network-security-sase/sase-sse*