Enterprises have an immediate opportunity to move toward a secure access service edge (SASE) architecture by consolidating core security services under a single vendor, said Neil MacDonald, VP and analyst at Gartner, during a keynote at Palo Alto Network's SASE Converge virtual event this week.

“SASE at first might seem like a grand vision but there are absolutely things that you can do to move toward a SASE architecture today,” he said.

MacDonald is one of a handful of Gartner analysts who coined the sassy-sounding product category back in 2019, which combined elements of SD-WAN, security, and edge compute into a single cloud-delivered service. In many ways, he's the father of SASE, Palo Alto Networks SVP Kumar Ramachandran said during the keynote.

By consolidating secure web gateway, zero-trust network access, cloud access security broker, and cloud-based firewalls under a single vendor, MacDonald claims enterprises can not only better support remote workers and contractors, but do so in a way that cuts down on the number of products required, and allows for consistent policy enforcement across all channels.

“You could include SD-WAN in the scope of that project… but if you can’t get the teams together, or you have investments that are going to take a while to pan out, go ahead and converge the security services today,” he said.

And when evaluating security vendors, MacDonald argues that malware protection and sensitive data discovery should be a high priority.

“It used to be … the data center was the center of the universe,” MacDonald said. “This is not the reality of the world today."

These network and security patterns that have served enterprises for the past two decades are now “fundamentally broken,” he explained. “There are more things outside than inside [the data center]. You have more apps outside than inside. You have more users outside than inside. You have more data outside than inside.”

SASE attempts to address this new reality by putting the user, not the data center, at the center of the modern IT universe.

That’s not to say the data center is going away, but going forward “the data center may be just a piece of what we’re trying to access,” MacDonald added.

While the world has changed, he noted that it’s not going to be practical for every enterprise to adopt a single-vendor SASE architecture overnight.

“We know it's a journey,” he said. “The first and most important thing you need to do is start tearing down some of these silos that hurt us internally in our organizations.”

It’s not enough to consolidate these networking and security technologies under a single vendor, enterprises also need to get their digital workforce, networking, and security teams on the same page, MacDonald added.

“Regardless of whether you go one vendor or two, these teams still have to integrate,” he said.

There’s also a common misconception that SASE needs to be 100% cloud delivered, according to MacDonald.

“Instead of a rack of appliances, what we’re saying is you probably still need a small on-premises footprint, but the heavy lifting goes out to the cloud,” he said. “The rule is cloud where you can, but on premises where you must. It’s a shift in patterns.”

A prime example is SD-WAN. SD-WAN still has an important role to play in SASE, either by serving as an aggregation point at the branch or using quality of service to prevent bandwidth hungry applications like Netflix or streaming games from interfering with business-critical traffic.

“The digital worker is essentially a branch office of one. In the same way, a branch office is just a collection of people who happen to be at the same location at the same point in time,” MacDonald said.

This concept can be applied to agent-less applications like IoT, where rather than a branch full of people, it might be a field full of wind turbines, he explained.

SD-WAN also presents a significant opportunity for cost savings through MPLS offload, MacDonald said, adding that as enterprises eliminate MPLS in favor of broadband, “they may as well get rid of any physical firewall at the branch and go all firewall-as-a-service.”