SSE / SASE single-pass architecture explainer

What engaged

Pillars

SWG

Cross-cutting

DLP, Threat protection

The pass, in order

1. ● Steeringnetwork

   Traffic reaches the service edge by client.

   The endpoint agent steers selected traffic to the nearest point of presence. It is the only method that carries device posture and user identity with the flow.

2. ● Point of presencenetwork

   The request arrives at an edge location running the complete inspection stack.

   The architectural claim worth checking in any SSE product is whether every location runs full compute, or whether some are thin nodes that only resolve DNS and forward. A thin node means a detour to somewhere that can actually inspect.

3. ● TLS decryptionconditional

   The session is decrypted once.

   Decryption happens ONCE for the whole pass. In a chain of separate appliances each device decrypts and re-encrypts, and that repetition is most of the latency people blame on inspection.

4. ● Application identificationcross-cutting

   Protocol, host and path are examined to identify the application, and often the specific instance and the activity.

   This is the step that distinguishes a corporate tenant of a service from a personal one. Without it, policy can only speak about domains, and 'allow the company account but not the personal account' is not expressible.

5. ● Secure web gatewaypillar

   URL category, risk and web policy are evaluated.

   The destination is web traffic, which is what a secure web gateway governs.

6. ○ Cloud access security brokerpillar

   Application, instance and activity are matched against policy - upload, download, share, post.

   Not engaged: no software-as-a-service application is involved.

7. ○ Zero trust network accesspillar

   The user is brokered to one private application, and to nothing else.

   Not engaged: no private application is involved.

8. ○ Cloud firewallpillar

   Ports and protocols outside web traffic are evaluated.

   Not engaged: this is web or application traffic.

9. ● Data loss preventioncross-cutting

   Content is classified against the data profile.

   DLP is NOT a pillar. It runs inside the same pass and receives whatever the pillars decrypted, which is why one data profile covers web, software-as-a-service and private applications alike.

10. ● Threat protectioncross-cutting

    Files and content are scanned, with sandboxing where the verdict is uncertain.

    Also cross-cutting, and running in the same pass on the same decrypted stream rather than after a re-encryption.

11. ● Adaptive decisionconditional

    The verdict can be more than allow or block: coach the user, isolate the session in a remote browser, require step-up authentication, or permit a read-only view.

    Device posture is known, so policy can be more permissive with justification rather than simply refusing.

Against chained appliances

• Chained appliances decrypt and re-encrypt at every hop. A single pass decrypts once and hands the same stream to every engine.
• Chained appliances each hold their own policy. A single engine holds one policy, so 'block this data leaving' does not need writing four times in four dialects.
• Chained appliances add their latencies together, and each one is a place the chain can break. A single pass adds its engines in parallel within one traversal.

Worth knowing

• Single-pass is an architectural claim, not a bundling claim. Several products are sold as converged and are four engines behind one invoice - the question to ask is whether the payload is decrypted once or once per engine.