Humans click. Agents swarm.
A person typically opens an application, submits a request, and waits for a response. An AI agent can break one assignment into multiple tasks, call several models, query business systems, invoke other agents, and continue working without another human prompt.
That shift is changing what enterprise networks and security architectures must support. As organizations scale AI-driven applications and autonomous systems, SASE still needs to fulfill its foundational purpose: connecting workers — and now agents — to the applications, data, models, APIs, and private resources they need.
This raises the stakes for performance, identity, access, and visibility. Agent workflows can generate substantially more traffic than equivalent human activity, remain active for longer, and move continuously across systems. Security and networking teams need to know which human or machine identity authorized an action, whether that action remains within policy, and where performance or access problems are disrupting the work.
For many organizations, fragmented networking and security environments make that harder. Disconnected consoles, policy engines, and telemetry sources provide only partial views of agent activity. This is where a more unified SASE approach — and, for some organizations, vendor consolidation — can provide a supporting benefit by creating shared visibility, more consistent policy enforcement, and a common operating context across networking, security, identity, and observability.
The forces reshaping enterprise security
These changes have created new requirements for enterprise security architectures.
Businesses need secure access regardless of location, visibility into user activity across cloud environments, identity-driven controls that adapt to risk and networking infrastructure capable of delivering consistent digital experiences.
These requirements have made integrated networking and security capabilities central to digital transformation strategies.
Industry forecasts reflect this momentum. Cisco expects 80% of organizations to adopt unified web, cloud, and private application access through SASE or Security Service Edge (SSE) frameworks in the coming years, while Gartner forecasts a 26% compound annual growth rate for the SASE market, reaching $28.5 billion by 2028.
The question for many companies is no longer whether to adopt SASE, but how to implement it in a way that supports long-term operational goals.
Complexity has become the hidden cost of security
Many organizations began their SASE journey by assembling capabilities from multiple vendors to connect and protect users, devices, branches, workloads, and applications across distributed environments.
That approach often made sense: Different vendors offered strengths in areas such as SD-WAN, secure web gateway, cloud access security broker, zero trust network access, identity management, and endpoint protection.
Over time, however, integrating multiple products can create operational challenges. Separate management consoles, policy engines, telemetry sources, support teams, and licensing cycles can fragment security operations. Teams may have to manage overlapping technologies while trying to maintain consistent policies across disconnected systems.
Visibility and troubleshooting also become more difficult when security events, user activity, network performance metrics, and application telemetry reside in separate tools. Policy management can become equally challenging when similar controls must be recreated across products, increasing the likelihood of configuration drift, inconsistent enforcement, and security gaps.
For businesses already facing cybersecurity talent shortages and pressure to do more with limited resources, that complexity can undermine consistent access, policy enforcement, visibility, and governance — especially as agentic work expands across enterprise systems.
Why consolidation is gaining momentum
The growing burden of operational complexity is one reason why vendor consolidation has become a strategic priority for many organizations.
Research shows that 75% of organizations are actively pursuing security vendor consolidation initiatives. Rather than managing an expanding collection of point solutions, many leaders are seeking platform-based approaches that simplify operations while maintaining strong security outcomes.
This shift is not necessarily about reducing vendor count for its own sake.
Instead, security teams are focusing on creating environments that are easier to manage, easier to secure, and easier to scale.
As networking, security, identity, and digital experience monitoring become increasingly interconnected, organizations are placing greater value on solutions that provide unified visibility and consistent operational workflows.
The conversation is evolving from "best of breed" toward what many organizations now view as "best integrated."
The growing appeal of unified SASE platforms
Unified SASE platforms can help organizations create a distributed access and control fabric across users, agents, devices, branches, workloads, applications, and data. Their value is not limited to consolidating networking and security functions. A more unified operating model can support three outcomes that are becoming central to AI-era SASE strategies: Work that performs, trusted actions, and resilient infrastructure.
Work that performs
Organizations need evidence of where work is slow, blocked, risky, costly, or producing the wrong result across the full digital path. Shared telemetry can connect signals from users, agents, devices, applications, network infrastructure, cloud platforms, and security controls, giving networking and security teams a common view of performance and risk.
This context can help teams identify whether a problem originates in the endpoint, network path, application, access policy, cloud service, or AI workflow. Rather than piecing together information from separate tools, teams can troubleshoot more quickly, reduce blind spots, and keep both human and agentic work moving.
Trusted actions
As AI agents and connected devices take on a larger role in enterprise environments, organizations need to extend zero trust principles beyond user access. They must govern not only who or what is requesting access, but also whether each action is authorized and remains within policy.
Trusted actions ground identity in a practical outcome. They connect user, agent, and device identity with context such as ownership, device posture, endpoint state, resource sensitivity, and real-time risk. This gives organizations a stronger basis for determining what a human, agent, IoT device, or operational technology system is allowed to do.
A unified policy framework can then apply granular, context-aware controls across models, tools, APIs, applications, data, and private resources. This includes just-in-time, just-enough, and just-long-enough access so that each actor receives only the permissions required to complete an approved task. It also gives teams the context needed to investigate actions that fall outside expected behavior.
Resilient infrastructure
AI-era work depends on infrastructure that remains available, secure, and responsive as demand and conditions change. Organizations need visibility into the health of branches, network paths, cloud services, applications, workloads, and security controls so they can identify weaknesses before they disrupt work.
A more integrated SASE architecture can provide shared operational context across networking, security, identity, and observability. That can help teams detect performance degradation, isolate failures, maintain consistent policy enforcement, and respond more quickly when infrastructure conditions change. The result is an environment designed not only to secure access, but also to keep work reliable and resilient at scale.
How Cisco brings the SASE architecture together
Cisco Secure Access provides the Security Service Edge, or SSE, and security-enforcement layer within the broader Cisco SASE architecture. As a cloud-delivered service, it brings together capabilities such as zero trust network access, secure web gateway, cloud access security broker functionality, and firewall-as-a-service to help protect access to applications, data, and resources.
The broader architecture combines Cisco Secure Access with Cisco SD-WAN for distributed connectivity and ThousandEyes for end-to-end visibility across users, branches, applications, networks, and cloud services. Together, these capabilities can help organizations connect and protect human and agentic work while identifying where performance, access, or infrastructure issues are disrupting outcomes.
Cisco Cloud Control provides a more unified operating experience across the architecture, while AgenticOps applies AI-assisted operations to help teams interpret telemetry, investigate issues, and act more quickly. This shared operating context supports the three outcomes shaping AI-era SASE strategies: work that performs, trusted actions, and resilient infrastructure.
By connecting security enforcement, networking, observability, and operations, Cisco SASE can help organizations apply policy more consistently, improve visibility across the full digital path, and govern access and actions without relying on disconnected operational workflows.
AI is raising the stakes
Agentic AI is changing both the volume and character of enterprise activity. Unlike a person who opens an application, completes a task, and waits for a response, an agent can break one assignment into multiple steps, call several models, query business systems, invoke other agents, and continue working without another human prompt.
These machine-to-machine action chains place new demands on both networking and security. Cisco research cited in the trend report found that an agent-executed task can generate up to 450% more traffic than the equivalent human task, with roughly 70% of that traffic tied to AI inference. Agent workflows also tend to be longer-lived and more upstream-heavy as they continuously send prompts, context, tool calls, and data across models, APIs, applications, and private resources.
That makes network performance part of the agent’s critical operating path. Latency, blocked access, or an unavailable service can interrupt an action chain and prevent the agent from completing its work. Organizations therefore need visibility across the full digital path so they can identify where agentic work is slowing down, where policy is blocking it, and where infrastructure conditions are putting outcomes at risk.
The security challenge extends well beyond deciding what an agent can access. Organizations must also govern what an agent can invoke, change, create, or expose as it moves through a workflow. Security teams need to know which human, agent, or device identity initiated an action, what permissions authorized it, whether the action remains within policy, and whether those permissions should be limited or revoked as conditions change.
Yet many organizations are not prepared to apply that level of control. According to research cited by Cisco, only 24% of organizations report being able to control agent actions with appropriate guardrails and live monitoring.
This gap strengthens the case for a more unified SASE strategy. A single-vendor approach can help organizations manage the network demands of agentic traffic and enforce policy through a shared operating model rather than across disconnected tools. By connecting security enforcement, identity, networking, telemetry, and observability, organizations can apply guardrails more consistently while maintaining visibility into how agent workflows are performing.
The goal is not simply to use AI to improve security operations. It is to create an architecture in which agentic work can perform reliably, every action can be appropriately authorized, and the underlying infrastructure remains resilient.
Balancing simplicity and flexibility
Despite the growing interest in unified platforms, there is no one-size-fits-all approach to SASE.
Many security teams continue to value best-of-breed architectures, as specialized requirements, existing technology investments, and unique operational needs can make multi-vendor environments the most practical choice.
Concerns around vendor lock-in also remain part of the conversation.
However, many organizations are approaching consolidation with a more pragmatic mindset than in the past. Rather than pursuing complete standardization, they are focusing on reducing unnecessary complexity while maintaining flexibility where it matters most.
For many enterprises, the objective is not to eliminate vendor diversity entirely. It is to create a manageable operating environment that supports security, performance, and business agility without overwhelming internal teams.
This is why phased adoption strategies continue to gain traction.
Security teams frequently begin with targeted initiatives such as replacing legacy VPNs with zero trust network access, modernizing branch connectivity, improving secure internet access, enhancing third-party access controls, or increasing visibility into cloud and AI application usage.
These incremental approaches allow businesses to modernize at their own pace while preserving existing investments where appropriate.
Looking ahead
As agentic AI moves into production, organizations need more than secure access. They need an architecture that can keep autonomous work performing reliably, authorize each action appropriately, and maintain resilient infrastructure as agents operate across models, tools, APIs, applications, data, and private resources.
Cisco SASE is designed to support those outcomes by connecting security enforcement, networking, identity, observability, and operations across a common architecture. Cisco Secure Access provides the SSE and security-enforcement layer, Cisco SD-WAN supports distributed connectivity, and ThousandEyes provides visibility across the digital path. Together, these capabilities can help organizations understand where work is slowing or being blocked, apply policy to human and machine actions, and identify infrastructure issues before they disrupt outcomes.
Single-vendor integration is one reason Cisco can deliver this more connected operating model. Through Cisco Cloud Control and AgenticOps capabilities, teams can work from shared context across networking and security, investigate issues more quickly, and coordinate action without piecing together information from disconnected systems. AI Canvas can further support this experience by helping teams bring relevant insights and operational context together as they assess and respond to issues.
The objective is not simply to reduce complexity. It is to make agentic work production-ready: work that performs, trusted actions, and resilient infrastructure.
For a deeper look at the trends shaping SASE adoption, vendor consolidation strategies, operational considerations, and platform evaluation criteria, explore the full trend report, The Case for Single-Vendor SASE: Evaluating Simplicity, Security, and Trade-Offs.