SASE — Secure Access Service Edge Total Cost of Ownership technology and investment research

Technology Overview

SASE converges SD-WAN (software-defined wide area networking) with cloud-delivered security (SWG, CASB, ZTNA, FWaaS) into a single platform. The economic thesis: consolidate 5-8 point security products into 1-2 SASE platforms, reduce branch office hardware, and shift from CAPEX (appliances) to OPEX (cloud subscription). The switching cost is the multi-year network architecture migration — once traffic is routed through a SASE provider's Points of Presence (PoPs), changing providers means re-architecting the global network.

Quantitative Bottleneck Analysis

Enterprise TCO — Before vs. After SASE (5,000-User Enterprise, 50 Sites)

`text

Pre-SASE (point products):

• MPLS/private WAN: $120K-300K/year (dedicated circuits)
• SD-WAN appliances (branch): $150K-250K CAPEX every 3-5 years
• Firewall appliances (per site): $50K-100K CAPEX every 3-5 years
• VPN concentrators: $30K-80K CAPEX every 3-5 years
• SWG (secure web gateway): $15-30/user/year = $75K-150K/year
• CASB (cloud access security broker): $10-20/user/year = $50K-100K/year
• ZTNA: $8-15/user/year = $40K-75K/year
• Management overhead: 2-4 FTEs @ $150K loaded = $300K-600K/year

Total annualized (CAPEX amortized 4 years): $850K-2.1M/year

Post-SASE (single platform):

• SASE subscription (all features): $25-45/user/year = $125K-225K/year
• SD-WAN edge device (thin CPE): $20K-50K CAPEX every 3-5 years (50 sites)
• Internet circuits (replacing MPLS): $60K-150K/year (cheaper broadband links)
• Management overhead: 1-2 FTEs @ $150K loaded = $150K-300K/year

Total annualized: $360K-725K/year

Annual savings: $490K-1.4M (40-65% reduction)

Migration cost: $200K-500K (professional services + parallel run)

Payback period: 4-8 months

`

The PoP Moat — Why Switching SASE Providers is Hard

`text

SASE provider network build cost:

• Global Points of Presence (PoPs): $5-15M per PoP (colo, compute, networking)
• PoPs needed for <50ms latency globally: 30-60
• Total PoP build cost: $150M-900M
• Annual PoP operating cost: $30-100M (bandwidth, power, staffing)

Enterprise switching friction:

1. Traffic re-routing: All 50 branch offices must re-point tunnel endpoints → 4-8 week migration
2. Policy migration: 500-5,000 firewall/SWG/CASB/ZTA policies must be manually migrated → 8-16 weeks
3. User re-enrollment: 5,000+ users must re-enroll devices (ZTNA client, certificates) → 4-8 weeks
4. Parallel run: Old + new SASE operating simultaneously during cutover → 4-12 weeks

Total migration: 20-44 weeks + $150K-400K professional services

`

The moat: A SASE provider that owns its PoP infrastructure (PANW, ZS) has a 3-5 year build advantage over a reseller that leases PoPs from AWS/Azure. The enterprise switching cost ($150K-400K + 5-11 months of disruption) creates stickiness once deployed.

Company Exposure

Purest SASE toll-road: PANW — owns the most complete platform (SD-WAN + all security services on owned PoPs). ZS has the largest security cloud but lacks native SD-WAN. FTNT has the largest SD-WAN base but weaker security cloud.

Differentiation Assessment

Quantitative model: ✅ (TCO comparison + PoP moat above)

Disconfirming evidence:

• Hyperscaler entry: AWS (Verified Access), Azure (Entra Global Secure Access), and GCP are building SASE-like services into their cloud platforms. If enterprises adopt hyperscaler-native SASE, it commoditizes the transport layer — but the hyperscalers lack the security depth of PANW/ZS.
• AI commoditization of policy migration: If LLMs can auto-translate 5,000 firewall/SWG policies between platforms with >90% accuracy, the switching cost drops from $150K-400K to <$50K — cutting migration time from 20-44 weeks to 4-8 weeks. Expected 2028-2029.
• SSE (Security Service Edge) unbundling: Some enterprises are buying ZTNA from one vendor and SWG/CASB from another, breaking the single-platform thesis. PANW and ZS push bundling but the market is bifurcating between "best of suite" and "best of breed."

Research Update — 2026-08-02

_Source: Industry research during Technology Deep Research_

Technical readiness: Deployed at scale — PANW, ZS, and FTNT have $1B+ SASE businesses with 30-40% growth rates. Enterprise adoption is mid-cycle: ~30-40% of enterprises have adopted SASE; 60-70% still on legacy point products.

Key papers / sources:

• PANW Q2 FY2026: Prisma SASE $400M+ quarterly, +35% YoY, 70%+ gross margin
• Gartner SASE Magic Quadrant 2026: PANW and ZS as Leaders; market $8B+ growing 25% CAGR
• Cloudflare Zero Trust: 330+ cities, <50ms to 95% of the internet-connected world

Bottleneck update: Strengthened — SASE TCO savings are real (40-65% reduction), PoP infrastructure is a 3-5 year moat, and enterprise switching cost creates multi-year lock-in.

Alternative/substitute risk: Medium — hyperscaler-native SASE (AWS, Azure) is the structural threat on 2028+ timeline. AI-driven policy migration could reduce switching costs.

Timeline signal: 3-5 year moat durability for PANW/ZS with specific erosion signals: hyperscaler SASE GA with security parity, LLM policy migration tools reaching 90%+ accuracy.

Adoption rate data: 30-40% enterprise SASE adoption in 2026, growing to 70-80% by 2029. TAM $8B growing 25% CAGR — one of the fastest-growing enterprise infrastructure markets.

Thesis impact: Confirms DT-2 (Zero Trust Security) as a high-moat toll-road with measurable TCO economics. PANW is the purest SASE platform play; ZS is the cloud security specialist; FTNT captures the SD-WAN-to-SASE upgrade cycle.

Deep Research — 2026-08-03

Thesis-Relevant Finding

• SASE_TCO requires verified SEC financials and competitor filing checks before conviction changes.

Financial Verification

• Revenue, margin, and backlog figures: needs primary source validation.

Contradiction Check

• Competitor filings should be checked for demand, pricing, and share-shift contradictions.

Sources

• https://www.sec.gov/edgar/search/
• https://www.sec.gov/ixviewer/