MSASE
For distributed sites and connected enterprises.
NETWORKING AND SECURITY UNIFIED. MIGRATED STEP BY STEP. OPERATED FLEXIBLY.
United Security Providers securely connects sites and employees to enterprise and cloud applications via the Cato SASE Cloud Platform and enables controlled access to approved applications for external partners. We develop the target architecture, support migration and rollout, and – depending on the operating model – take on defined or complete operational responsibilities.
WHY COMPANIES CHOOSE USP MSASE
SASE with USP combines technology convergence with a controlled migration and operating model.
Manage Networking and Security Together
Networking, security and access policies are managed through a common platform. This reduces separate management interfaces, policy silos and the effort caused by different technology and hardware lifecycles.
Migrate Step by Step Instead of with a Big Bang
The transition can start with individual sites, user groups or functions. Existing firewalls, WAN connections or VPN solutions can continue to operate during a controlled transition phase.
Connect Globally and Protect Consistently
The Cato SASE Platform brings site connectivity, the Cato Global Private Backbone, security enforcement and central management together in a common architecture.
Choose the Right Operating Model
You decide which responsibilities remain in-house and which USP takes on – from self-managed operations through co-management to managed operations.
Rely on One Partner Across the Entire Lifecycle
USP supports you from assessment and target architecture through validation and migration to operations, reporting and continuous optimisation.
MORE CLOUD. MORE SITES.
MORE EXTERNAL ACCESS.
Fragmented architectures slow down operations and change.
Enterprise applications now reside in data centres, public clouds and SaaS platforms. Employees, external partners and distributed sites all require secure, high-performance access at the same time.
Yet many networking and security environments consist of historically grown point solutions.
Fragmented Architecture
WAN, firewalls, VPN, web security and monitoring are spread across different products, policies and management interfaces.
High Operational Effort
Patching, lifecycle, provider and troubleshooting tasks consume resources. Networking, security and experience data are difficult to analyse in context.
Change Takes Too Long
New sites, cloud projects, acquisitions or new access models require coordination across multiple teams, providers and vendors.
The Result
Networking and security become a bottleneck for transformation, resilience and growth.
WHAT IS SASE?
Secure Access Service Edge, or SASE, brings networking and security together in a cloud-native service. Instead of operating SD-WAN, firewalls, Secure Web Gateway, ZTNA, CASB or DLP as separate products, connectivity, access and security are delivered through a common architecture and centrally managed.
For this purpose, the Cato SASE Platform combines SD-WAN, the Cato Global Private Backbone and an integrated Security Service Edge. Sites, users, data centres and cloud environments can therefore be connected and protected with consistent networking and security policies.
-
Managed SASE adds the services required for implementation and ongoing operations to the SASE technology. These include assessment, target architecture, migration, policy design, rollout, monitoring and continuous optimisation.
Companies do not need to build every SASE capability in-house or fully outsource operations. Depending on their needs, SASE can be self-managed, jointly managed with USP or largely consumed as a managed service.
SASE CAN START WHERE THE GREATEST NEED FOR ACTION EXISTS TODAY
You do not need to replace the entire networking and security architecture at once. The starting point can be the area with the greatest current need for transformation, access or security.
SASE Convergence
Consolidate Networking and Security
When SD-WAN, FWaaS, Secure Web Gateway, ZTNA, and cloud and data security are operated across multiple platforms, SASE Convergence brings these functions together in a common architecture.
Typical Starting Situations
MPLS or firewall renewal · security tool consolidation · high networking and operational complexity
Universal ZTNA
Access Applications Instead of Entire Networks
When employees, external partners or unmanaged devices need to access internal applications, Universal ZTNA enables context- and risk-based access decisions based on identity, device and application.
Typical Starting Situations
VPN replacement · partner and third-party access · BYOD and unmanaged devices
M&A and Expansion
Integrate Sites and Acquired Companies Faster
When new companies, plants, stores or depots need to become operational before all inherited systems have been harmonised, a standardised integration path provides connectivity, access and baseline security.
Typical Starting Situations
acquisition or carve-out · new sites or plants · geographic expansion
AI Security
Use, Develop and Operate AI with Control
When employees use public AI services or companies develop their own AI applications and agents, AI Security provides visibility and policies for interactions, data and permitted actions.
Typical Starting Situations
uncontrolled AI usage · rollout of copilots · proprietary AI applications or AI agents
From the Existing Architecture to Managed SASE
The Cato SASE Platform
ONE PLATFORM FOR NETWORKING, SECURITY AND SECURE ACCESS
The Cato SASE Platform unifies networking, security and access in a cloud-native architecture with a common policy engine, centralised management and single-pass inspection on a global backbone.
Next Gen Networking
Cloud-delivered SD-WAN connects sites, clouds and users through the Cato Global Private Backbone. Central routing and QoS policies support a resilient and globally optimised WAN architecture.
Zero Trust Security (SSE)
Firewall as a Service, Secure Web Gateway, Threat Prevention, and cloud and data security protect users, applications and data with shared context. Cato’s Single Pass Cloud Engine (SPACE) executes security functions within a common architecture instead of chaining separate services.
Universal ZTNA
An adaptive, risk-based Zero Trust policy controls access to private applications based on identity, device and risk context. Cato supports client-based, Enterprise Browser and clientless access models for employees, partners and unmanaged devices.
XOps: Detection & Response
Cato XOps combines Security Detection & Response with AIOps in a common analytics layer. Networking, security and operational events are correlated and delivered as prioritised stories with analysis and remediation support.
AI Security
Cato AI Security protects employee AI usage, proprietary AI applications and AI agents. This includes Shadow AI detection, runtime protection and control of MCP connections, tool calls and agentic actions.
OPERATION AND OPERATING MODELS
AS MUCH OPERATION BY UNITED SECURITY PROVIDERS AS YOUR ORGANISATION NEEDS
Managed SASE does not have to be a black box. Customers retain visibility into their environment and can align responsibilities with internal resources and existing processes.
Self-managed
The customer operates the platform independently. USP supports architecture, implementation and migration and provides technical expertise as required.
Co-managed
The customer and USP share responsibilities by function or process. This retains internal expertise while allowing USP to take on selected operational tasks.
Managed Operations
USP takes on the contractually defined operational responsibilities and supports monitoring, incidents, changes, reporting and continuous optimisation.
TECHNICAL DEEP DIVE
-
Sites, data centres and cloud environments are connected to the Cato SASE Cloud via Cato Sockets and vSockets, IPsec-capable third-party devices or Cloud Interconnect. Cato Sockets steer traffic through suitable Cato PoPs based on application, QoS and link quality.
At the PoP, the Single Pass Cloud Engine (SPACE) processes routing, optimisation, security inspection and policy enforcement with shared context. Inter-site traffic is transported over the Cato Global Private Backbone.
INDUSTRY SOLUTIONS
MANUFACTURING
Plants, data centres, cloud services, employees and external service partners require reliable access to ERP, MES, PLM and other production-critical applications.
Typical requirements include controlled connectivity for internal teams and machine manufacturers, international sites, detection and classification of IoT/OT devices, segmentation of production networks, external machine maintenance, and protection of sensitive engineering and production data.
RETAIL AND COMMERCE
Stores, brands, franchise partners, e-commerce, payment systems, SaaS applications and changing user groups require a standardised architecture that can be operated quickly.
Typical requirements include new stores, central policies, resilience, seasonal users, external service partners, and protection of customer, pricing and transaction data.
CONSOLIDATE NETWORKING AND SECURITY
Depots, warehouses, hubs, offices, mobile employees and partners depend on TMS, WMS, scanner, labelling, driver and customer applications.
Typical requirements include 24/7 operations, resilient site connectivity, limited local IT capacity, centralised troubleshooting and secure partner access.
FAQ
Frequently Asked Questions About Managed SASE
-
SD-WAN optimises and manages WAN connectivity between sites, data centres and cloud environments.
SSE bundles cloud-native security functions such as ZTNA, Secure Web Gateway, and cloud and data security.
SASE brings networking and security together in a common cloud-native architecture.
UNIFY NETWORKING AND SECURITY – WITHOUT A RISKY BIG-BANG MIGRATION
USP works with you to develop an operable SASE target architecture, a realistic migration path and an operating model that fits your internal resources.
