IBM Security expanded its secure access service edge (SASE) partnership with Zscaler today, adding new blueprints targeting common business objectives.

The goal is to help organizations adopt a SASE framework and extend a zero-trust architecture to the edge, explained Laurène Hummer, product manager and program director for IBM's Digital Trust Security services. “Enabling SASE is a key element of a zero-trust security posture.”

IBM Security Services for SASE builds on the company's zero-trust blueprints announced in May, which provided a framework for implementing and managing zero-trust architectures.

The new blueprints address many of the challenges faced by enterprises as they return to the office. As part of the service, IBM provides security and cloud support services along with security monitoring, management, and threat mitigation, while Zscaler provides the bulk of SASE security stack.

“Speaking with a lot of our customers, we realize that many CISOs understand the benefits of moving security controls to the edge,” Hummer said. “The tricky part is how to actually do that for a complex organization.”

To address this challenge and move more customers toward a zero-trust architecture, the offering pairs customers with an IBM security and cloud specialist tasked with guiding them through a five-step "maturity model" to help them plan for and implement a SASE architecture.

“There’s a big need in the market for professional and managed SASE services. As organizations have dug in, started learning, and begun planning, many have realized that this is a multi-year transformation that requires a phased approach,” John Grady, senior analyst at Enterprise Strategy Group, wrote in response to questions. “Offerings that help users through the planning, integration, and management stages will be in demand, and this is what IBM is offering.”

IBM is tackling five SASE business outcomes from the get go. These include the shift to remote or hybrid work; access for third-party contractors; mergers and acquisitions; broader network transformation initiatives; and emerging 5G, IoT, and edge applications.

However, Hummer notes enterprises don't have to do them all at once. "It can be a multi-step journey," she said, adding the journey "doesn't have to be full bang all of a sudden."

Many of these use cases — hybrid work and third-party access in particular — center around replacing legacy VPN technologies with Zscaler’s zero-trust network access (ZTNA) and secure web gateway (SWG) capabilities.

Similarly, IBM is billing the service as a means of facilitating mergers and acquisitions. In this scenario, IBM’s SASE service acts as a go between for the two company’s existing WAN infrastructure, even if they are from different vendors.

IBM’s decision to partner with Zscaler makes sense, Grady explained.

“Zscaler is one of the leading cloud security and SASE vendors in the market,” he said, adding that IBM understands that many enterprises don’t want to rip and replace existing services to support a SASE architecture. “Support for Zscaler is more built out and turnkey, which will allow organizations that want to move more quickly toward a single vendor approach to do so.”

But while Hummer declined to comment on whether IBM would introduce additional SASE technology providers in the future, Grady indicated he wouldn't be surprised to see IBM extend to additional vendors over time.