A shift to remote and hybrid work, multicloud and zero-trust adoption, and an ongoing skills shortage are contributing to the meteoric rise of secure access service edge (SASE), AT&T VP of Cybersecurity Rupesh Chokshi told SDxCentral.

However, Chokshi warns that for all of SASE’s promises, there is still a considerable amount of confusion among technology decision makers as to how it fits into the broader security and networking stack.

AT&T only recently threw its hat into the managed SASE game, announcing partnerships with Fortinet and Palo Alto Networks earlier this year.

“We’re seeing SASE being asked for more and more … and I believe firmly that [this trend] will continue for the next three to five years” as enterprises modernize around distributed, multicloud workloads, he said. “As a result, they need to ensure the data in transit is 100% protected.”

According to Chokshi, much of the confusion centers around what SASE can and can’t do.

In many enterprises, IT teams are used to having one tool for each problem, and as a result, they’re used to juggling dozens of tools at any given time.

SASE encompasses a range of capabilities including SD-WAN, security, and edge compute. In many cases, this allows enterprises to consolidate several tools under a single product, Chokshi explained.

However, this consolidation is a double-edged sword, and it may not always be obvious which point products SASE can and can’t replace, he added.

“So, the CISO is looking at ‘let's better understand my environment,’” Chokshi said. “If I’m a hospital or health care company, I have clinics, I have medical workers on site and off site, I have call centers, I have other ways of conducting business. Can I bring it all together in a platform approach.”

SASE’s mix of SD-WAN, zero-trust network access (ZTNA), and secure web gateway (SWG) provide customers with several options for addressing the needs of a distributed workforce, and the increasing reliance on IoT devices.

“Data in transit is very important because everything is connected. It’s going to continue to be more and more connected because that’s how the modernization, the business processes, the information, everything works,” Chokshi said.

But SASE also features technologies like cloud-delivered firewall and malware protection. According to Choksi, this often leaves CISOs questioning whether SASE is adequate on its own, or if a combination of complimentary services may be required.

“Security is no longer a technical kind of problem, it’s a business problem, and it’s being discussed in boardrooms,” he said. “It’s the responsibility of the board for that enterprise, as well as the C-suite, to make sure that there is clear understanding of what is the risk, and what are we doing to prevent the risk.”

For example, does SASE eliminate the need for endpoint detection and response (EDR) or its even hotter counterpart extended detection and response (XDR)?

The answer, of course, is different from customer to customer, but more often than not, Chokshi argues the two are complimentary.

“It’s never one and done. This is an ongoing innovation cycle and an ongoing effort,” he said. “You have to be broader because you have to solve for these [challenges] in multiple kinds of angles.”

These questions are anything but trivial, Chokshi notes. “The majority of the customers that I’ve had the pleasure of working with ... are always looking for a trusted advisor that can guide them through the transformation,” he added.

However, increasingly SASE services are being delivered as a software-as-a-service (SaaS) application directly from the vendor, effectively cutting out managed service and managed security service providers in the process.

For example, Cisco plans to offer its SASE platform as part of its Cisco Plus network-as-a-service (NaaS) offering, announced at Cisco Live this spring, and the vendor has repeatedly touted its middle-mile partnerships, which it claims eliminate the need for costly, service provider-managed MPLS circuits.

This strategy, Chokshi argues, locks customers into a walled garden and could potentially leave them vulnerable if the vendor fails to innovate.

“I don't think it will pan out at scale,” he said, adding that AT&T has spent years developing the technical expertise to serve the deepest needs of its customers.

“My point of view is that technology providers need to focus on the intellectual property and the technology that differentiates them … and let AT&T as a service provider take care of the managed services or the implementations, you know, putting it all together,” he added.