We’ve all heard the promise of SASE. It will simplify networks, strengthen security and give organisations better control through one unified cloud service. But in practice, many customers find themselves waiting far longer than expected to see those benefits.
Surprisingly, the root of the problem is often the very first stage of deployment: connecting the customer’s edge infrastructure to the provider’s cloud service. This step sounds straightforward, but it is more complicated, costly and time consuming than anyone would care to admit. And because of how SASE projects are usually scoped and budgeted, those early delays can ripple through the entire rollout and throw the whole project off course.
Phase one: why is it so much harder than it looks?
In most SASE projects, deployment is divided into stages. The first is typically about establishing secure connectivity: setting up tunnels from customer edge devices to the provider’s points of presence, configuring routing, policies and authentication, and testing performance.
While the design may look simple on a slide, the real world work rarely is. Teams have to integrate legacy firewalls, MPLS or SD-WAN configurations, resolve DNS and certificate issues, and plan for failover. These are often highly manual processes that need coordination between the customer’s networking team, the SASE provider’s engineers and sometimes external partners. As a result, this first phase is often underestimated. What was supposed to take weeks can stretch into months.
The risks of getting it wrong
Beyond delays, mistakes or shortcuts in this first step can introduce serious operational and security risks. Misconfigured tunnels can flap, leading to unpredictable connectivity and a poor user experience. Weak routing policies or certificate mismanagement can cause outages that disrupt critical business traffic.
Even small manual errors in tunnel setup or policy assignment can create security gaps, leaving some traffic unprotected or bypassing inspection altogether. In large, distributed environments, the sheer volume of manual configuration increases the chance of inconsistency between sites. When multiple vendors, points of presence or migration phases are involved, the risks multiply, putting uptime, security and reputation on the line.
The case of the disappearing professional services budget
One of the biggest consequences of these delays is financial. Many SASE vendors scope professional services in phases, aligning budget and engineering hours to each stage. When the first phase drags on, it quickly consumes the hours allocated for the entire rollout. That leaves two choices:
- Pause the rollout and request more budget, adding further delay while a frustrated customer works to free up funds.
- Carry on without enough engineering support, risking security oversights and yet more delay.
Neither is appealing. Later stages, such as rolling out ZTNA, cloud firewalling or advanced data protection, get postponed or only partly delivered. Customers pay significant implementation costs yet fail to see the promised benefits.
Why customers feel frustrated
From the customer’s point of view this is especially painful. They sign an expensive contract for a platform that promises simpler operations, better security and unified policy management. Until every piece is in place, those benefits remain theoretical.
SASE offers companies a compelling security strategy, but it takes time to ensure network teams have the visibility and management oversight they need.
That visibility and control only arrive once traffic actually flows through the SASE service, which depends entirely on the first step being fully deployed.
What makes the first phase so time consuming?
The bottom line
The promise of SASE is real. But too often the deceptively simple first phase becomes the biggest barrier to realising it. Delays connecting the customer edge to the provider can cascade through the whole project, draining professional services budgets and leaving customers waiting months for meaningful benefits.
By understanding why this happens, vendors and channel partners can plan, scope and align early, and choose the right automation to deliver SASE projects on time and on budget.
