TL;DR: Many SASE offerings only look unified after consolidation, while real gaps emerge in policy consistency, telemetry flow, ZTNA design and deployment complexity, according to Todyl. For practitioners, the test is whether the platform behaves as one control plane across users, devices and security data, not whether the billing is bundled.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Todyl's blog post: Stitched-together SASE platforms often create policy gaps, fragmented telemetry and operational overhead.
Why it matters: It matters because SASE now sits on the path between users, devices and enterprise data, so IAM and security teams need to judge whether identity-based access, logging and enforcement actually stay consistent across the stack.
Context
SASE is meant to collapse networking and security into one cloud-delivered control plane, but many offerings still behave like assembled point products rather than a coherent service. That creates governance gaps in how policy is enforced, how telemetry is shared and how fast teams can detect drift across users, devices and locations.
The identity connection is real because SASE decisions increasingly depend on user, device and session context. Where the access layer is inconsistent, zero trust network access can devolve into a renamed VPN with weaker visibility and more manual exception handling.
Key questions
Q: What breaks when a SASE platform is stitched together from separate tools?
A: The main failure is fragmented control. Policy decisions, telemetry and enforcement stop sharing a single state, so access rules can differ across components and events may not correlate cleanly. That creates blind spots, more administrative overhead and slower response, especially when teams assume they bought one control plane but actually received several loosely connected ones.
Q: Why does weak ZTNA design increase risk in remote access environments?
A: Because ZTNA should scope access to a specific application or resource, not open a broad tunnel after authentication. If the design still behaves like a VPN with MFA added, lateral movement becomes easier and access review becomes less meaningful. Identity-based policy only reduces risk when the session remains tightly bounded throughout its lifetime.
Q: How do security teams know whether SASE is actually reducing operational complexity?
A: Look for faster onboarding, fewer handoffs, consistent policy changes and telemetry that reaches the SIEM without manual stitching. If the team still manages separate consoles, exceptions and troubleshooting paths, the platform has reduced tool count but not operational complexity. Real simplification is visible in day-to-day change management, not in procurement slides.
Q: When should organisations prioritize Unified SASE over Secure SD-WAN alone?
A: Choose Unified SASE when networking and security are being consolidated, when access decisions need to follow identity as well as location, or when AI and cloud workloads cross regions under compliance pressure. Secure SD-WAN is enough when the immediate need is performance and the security stack is already settled. The decision hinges on whether one policy plane is required.
Technical breakdown
Why stitched-together SASE platforms create control seams
A SASE platform only behaves as a single control system when networking, security inspection and access policy share the same state. When vendors assemble acquired components, each layer may keep its own console, policy logic and event schema. The result is inconsistent enforcement, delayed telemetry correlation and more brittle operations. In practice, that means a policy decision in one layer may not immediately inform another layer that should block, log or step up access. The architecture is not just about feature count. It is about whether the enforcement plane and the visibility plane are actually unified. See the SASE and SSE Buyer's Guide.
Practical implication: Validate whether policy, logging and enforcement are truly shared across components before treating a SASE bundle as one control plane.
What real ZTNA should do in a SASE stack
Zero Trust Network Access should enforce per-application access based on identity, device posture and contextual policy, not simply wrap a legacy remote-access model in MFA. In a proper design, the user never receives broad network reach just because the session is established. Instead, access is scoped, segmented and continuously evaluated at the connection layer. That matters because ZTNA is often the point where SASE either becomes identity-aware or remains a thin transport layer. If the vendor cannot show application-level policy and microsegmentation, the model is still too close to classic VPN behaviour. See the ZTNA Guide.
Practical implication: Insist on application-scoped access decisions rather than accepting VPN-style connectivity with an identity wrapper.
How deployment model affects operational risk
Cloud-native delivery reduces the operational burden of appliance-heavy network security, but the deployment model still needs disciplined governance. If the platform requires too much manual configuration, policy drift and exception sprawl appear quickly. If the infrastructure is opaque, performance and failover issues become hard to diagnose. SASE should therefore be evaluated as an operating model as much as a product category. The relevant question is whether the team can deploy, monitor and change access safely without creating new blind spots in the process. A fast rollout that cannot be governed reliably is not a durable control. See the SASE and SSE Guide.
Practical implication: Test rollout speed, change control and failover handling together, not as separate procurement criteria.
Threat narrative
Attacker objective: The attacker seeks to exploit inconsistent enforcement and visibility in a network access stack to move laterally or remain hidden inside legitimate traffic.
- Entry begins when users or remote systems connect through a network access layer that is treated as trusted once a session exists.
- Escalation occurs when fragmented policy enforcement or weak ZTNA design allows broader reach than intended across applications and security layers.
- Impact follows when the platform cannot correlate telemetry or enforce consistent policy fast enough to stop misuse, hide abnormal activity or sustain outages.
Breaches seen in the wild
- HPE Aruba Instant On hard-coded credentials: Hard-coded admin credentials in HPE Aruba Instant On access point firmware let anyone bypass login (CVE-2025-37103); no exploitation reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Purpose-built control planes matter more than consolidated branding: SASE is only operationally coherent when policy, telemetry and enforcement are designed to move together. Where vendors stitch together acquired components, the buyer inherits seam risk, not just feature diversity. That seam risk shows up as inconsistent access decisions and delayed event correlation, which weakens governance across the whole access path. Practitioners should treat architectural coherence as a control requirement, not a marketing claim.
ZTNA is the identity test inside SASE: The real question is whether access is driven by identity, device and application context, or by a disguised remote-access model with extra steps. If ZTNA still behaves like a broad tunnel, the organisation has not changed its trust model. That makes the connection to identity governance explicit: access should remain bounded by policy at every session, not become a standing pathway after login.
Operational simplicity is a security control, not just an efficiency metric: If deployment takes weeks or policy changes are hard to govern, the organisation creates a window where misconfiguration becomes the dominant failure mode. That is especially relevant in MSP environments, where scale multiplies the effect of one weak control decision. Practitioners should evaluate whether the platform reduces administrative friction without sacrificing inspection depth or auditability.
Cloud-delivered network security now sits inside broader security governance: SASE cannot be evaluated in isolation from endpoint protection, SIEM and response workflows. When those functions do not exchange context, the platform may look complete while the programme remains fragmented. The governance question is no longer whether a network control exists, but whether it contributes usable context to detection, response and access decisions across the stack.
What this signals
Control-plane coherence is the new SASE buying criterion: The category now needs to be judged by whether identity, policy and telemetry stay coherent under change, not by how many networking functions are bundled together. That shifts procurement from feature comparison to governance validation, which is where many deployments fail in practice.
Identity-aware access is what separates SASE from a repackaged VPN: If access is not continuously tied to user, device and application context, the platform becomes a transport layer with security branding. For practitioners, the signal is clear: the next programme milestone is not broader connectivity, but tighter control over who can reach what and under which conditions.
For practitioners
- Validate policy consistency across components Test whether access rules, inspection settings and logging behave the same way across all integrated modules, not just in the main console.
- Challenge any VPN-like ZTNA design Ask for evidence that access is application-scoped and identity-driven rather than a broad tunnel with MFA layered on top.
- Measure telemetry flow into your SIEM Confirm that network events, firewall signals and access decisions arrive in the SIEM with enough context for correlation and response.
- Test deployment and failover before commitment Run a proof of concept that proves onboarding speed, configuration change handling and automatic failover under realistic operating conditions.
Key takeaways
- SASE only reduces risk when policy enforcement, telemetry and access decisions operate as one system rather than as stitched-together components.
- The strongest failure mode in weak SASE designs is not feature absence but control fragmentation, especially where ZTNA is only a renamed remote-access tunnel.
- Practitioners should test identity-based access, SIEM integration and failover behaviour before they trust a provider with production connectivity.
Related NHI Mgmt Group resources: ZTNA Guide · SASE and SSE Buyer's Guide · Remote Access Identity Guide · SASE and SSE Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, NIST CSF 2.0, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | SASE access policy and identity-based enforcement map directly to authorisation control. |
| Recommendation — Use PR.AA-05 to verify access decisions remain identity-driven across users, devices and applications. | ||
| NIST Zero Trust (SP 800-207) | 3.4.5 — Policy Engine and Policy Enforcement Point | The article centres on whether policy enforcement is unified or fragmented across components. |
| Recommendation — Separate policy decision and enforcement functions only when you can still prove consistent control outcomes. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | SASE provider selection here depends on managing network controls, routing and resilience well. |
| Recommendation — Track network control changes, routing behaviour and failover settings under CIS-12 governance. | ||
| ISO/IEC 27001:2022 | A.8.20 — Network Security | The article is fundamentally about securing network access and enforcement architecture. |
| Recommendation — Apply A.8.20 to validate that network security controls enforce policy consistently across the access path. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Weak SASE enforcement can help attackers move through trusted network paths. |
| Recommendation — Map SASE blind spots to TA0006 and TA0008 when testing for misuse of trusted access paths. | ||
Key terms
- Secure Access Service Edge: SASE is a converged architecture that combines network connectivity with security controls such as zero trust access, secure web gateway, and firewall services. It is useful for consistent enforcement across distributed environments, but it does not replace identity governance or entitlement ownership.
- Zero-Trust Network Access: Zero-Trust Network Access is a way to give users secure access to specific applications without placing them on the internal network. Access is granted only after identity, device posture, and policy checks, then limited to the requested resource. ZTNA reduces lateral movement by replacing broad network trust with per-session authorization.
- Policy Enforcement Point: A policy enforcement point is the control that applies an authorization decision at the place where an action occurs. In distributed systems, it may sit inside an API gateway, application, or workflow engine, and it depends on a consistent decision format to avoid bespoke integrations.
- Telemetry correlation: The process of joining separate security and application signals into one timeline so analysts can interpret them together. For identity work, this means linking sign-in risk with downstream SaaS activity to decide whether an event is suspicious, confirmed, or benign.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle and machine identity security. It helps practitioners connect identity controls to broader security architecture decisions without losing governance detail.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org