Why SASE success starts with your network underlay

As enterprise IT leaders know, network transformation is closely tied to business continuity and innovation strategies. And for most organizations, that transformation includes embracing Secure Access Service Edge (SASE). But here’s the catch: even the most advanced SASE architecture can fall flat if it’s built on shaky foundations. That foundation? Your network underlay.

If your network underlay is slow, unreliable, or fragmented across regions, your SASE rollout will be too. Keep reading for how your underlay network’s connectivity could impact your SASE integration and how to avoid it.

A quick guide to SASE architecture

SASE architecture combines networking and security functions into a unified, cloud-native service. 

Key SASE’s security functions:

• Software-Defined Wide Area Network (SD-WAN).
• Secure Web Gateway (SWG).
• Cloud Access Security Broker (CASB).
• Firewall as a Service (FWaaS).
• Zero Trust Network Access (ZTNA).

The idea is simple: bring users as close as possible to the cloud and secure their access to applications, no matter where they are. This has become more important as hybrid workforces mean increasingly distributed network perimeters. And cybersecurity incidents are on the rise.

What is the first step when moving to Secure Access Service Edge (SASE)?

Here’s the mistake many organizations make: they jump into a SASE deployment by selecting vendors for security services or SD-WAN solutions. But they don't audit the performance of their global underlay network first.

Surprisingly, the latest data even shows that enterprise leaders are aware of this and taking action to correct it. The IDC InfoBrief, sponsored by Expereo, Enterprise Horizons 2025, Technology Leaders Priorities: Achieving Digital Agility revealed that two of the highest priorities for financial investment for the next 12 months were:

1. Networking/connectivity 
2. Security/cybersecurity

So if you’re considering SASE, or are currently implementing it, review your network underlay first. Because it's critical to have the right connectivity in place. In my opinion, the first step to a successful SASE deployment is to ask:

• Do we have consistent connectivity across regions?
• Are we relying on consumer-grade broadband in remote locations?
• Can we guarantee low latency and high availability at all sites?
• Have we built in enough network resiliency to cope with any outages? 
• How quickly can we troubleshoot underlay issues?
• Do we have the right level of network resilience built in?

If the answer to any of these questions is “no” or “not sure,” then it’s time to address your network underlay first.

The impact of a poor-performing network underlay on SASE

Think of SASE like a high-performance sports car. The overlay services (ZTNA, SWG, CASB, etc.) are your engine, suspension, and smart controls. But without a smooth, well-paved road underneath, the ride is rough, unpredictable, and slow.

That’s what a poor network underlay does to your overlay SASE strategy.

What is the difference between underlay and overlay?

When talking about overlay vs underlay network design, it’s important to start with a clear definition.

What is an underlay network?

A network underlay refers to the physical infrastructure and connections that transport data across your organization’s network. This includes your fiber lines, fixed wireless links, satellite, MPLS, and dedicated internet access circuits. It’s the foundational layer that data travels over.

What is an overlay network?

The overlay, by contrast, is the virtualized layer that runs on top of that infrastructure. In a SASE model, the overlay might include SD-WAN policies, encryption tunnels, application-aware routing, or cloud-based security services.

SASE relies heavily on low-latency, high-availability connectivity to provide seamless, secure access. If your underlay is a patchwork of broadband links, unmanaged ISPs, or aging MPLS circuits, then you're putting performance at risk. Especially for latency-sensitive services like voice, video or real-time apps.

In other words, your SASE framework is only as good as the network it's built on.

Secure your business at the speed of life with the right underlay

Too often, enterprises treat network underlay as an afterthought when implementing SASE. That’s a mistake with real consequences. Ultimately, you'll see poor application performance, higher operational costs, and frustrated end users.

Start by optimizing your underlay network to ensure it’s reliable, fast, and built to scale. That means partnering with a provider who can deliver resilient global connectivity, proactive monitoring, and the flexibility to support multi-cloud, hybrid work, and remote sites. Expereo’s managed Network-as-a-Service means you get the consultative support you need to assess your underlay requirements on a site-by-site basis. 

We look at your goals, your existing network architecture and can help you transition from legacy systems or implement a range of connectivity solutions to suit your unique needs. Whether that’s Global Internet, Dedicated Internet Access, Fixed Wireless Access, Low Earth Orbit satellites, or a mix of solutions for resilient, high-performing connectivity.

Finally, once your foundation is solid, Expereo can implement an SD-WAN or SASE solution that does what it’s meant to: deliver seamless, secure, scalable access at the speed your business needs.

Get in touch to discuss your needs. Alternatively, see how we deployed SASE to improve network control and accelerate cloud adoption for two international companies.