COMMENTARY: Mid-market IT teams are being asked to protect environments that now look a lot like enterprise networks, without enterprise budgets or staffing. This is the real challenge. Many teams are still stuck managing VPNs, gateways, and point tools that were built for a more centralized world. Mid-market companies understand Zero Trust and SASE. The hard part is making these models work without slowing users down or adding more complexity. These teams need security that stays on, gives them better visibility, and protects users close to where work is happening. They do not need another tool that only works when people follow every rule perfectly.
Most mid-market IT teams traditionally consist of between two and twenty-five people who have to manage IT and security for the entire company. Many have multiple work locations, remote workers, and a mix of cloud and on-premise systems. Not only that, just like larger organizations, they are tasked with protecting company data against ransomware, phishing attacks, compliance failures, and more.These smaller teams are required to juggle many things at once. For example, work is moving away from closed networks and into cloud apps, SaaS platforms, and distributed workforces. Their security stacks are also often fragmented.Mid-market teams don't need bells and whistles when it comes to security; they need outcomes and protection that stays active no matter where or how work happens.
Not too long ago, VPNs helped users stay secure when they were outside of the office, which was usually an exception rather than the norm. When users face latency, they disconnect, and security immediately loses visibility. That’s because when VPNs are turned off, all traditional security stacks are blind, web traffic goes direct, SaaS sessions bypass inspections, and malicious links slip through into the network before any gateway can stop them.PoP-based SASE models suffer from the same thing. They depend on traffic being routed to a specific point for inspection. This can lead to a slowdown, and users turning off protection. Every moment spent off-path becomes a possible exposure window.
Most organizations now recognize that Zero Trust is a critical piece of their security strategy, but it must be enforced everywhere continuously. If it depends on users exhibiting perfect behavior, it will not live up to its promise.
What happens when a user clicks a malicious link?
How do you ensure compliance while reducing the need to manage multiple tracking tools?
How quickly can your users get access to the applications they need to do their jobs?
ChannelE2E Perspectives columns are written by trusted members of the managed services, value-added reseller, and solution provider channels or ChannelE2E staff. Do you have a unique perspective you want to share? Check out our guidelines here and send a pitch to [email protected].
VPNs are no longer the answer
Sales teams now work from home, developers access information from the cloud, and finance teams use SaaS applications. None of this behaves like traffic inside a closed network. VPNs create secure tunnels, but SASE models often force that traffic through centralized cloud gateways, which can hurt performance.Not too long ago, VPNs helped users stay secure when they were outside of the office, which was usually an exception rather than the norm. When users face latency, they disconnect, and security immediately loses visibility. That’s because when VPNs are turned off, all traditional security stacks are blind, web traffic goes direct, SaaS sessions bypass inspections, and malicious links slip through into the network before any gateway can stop them.PoP-based SASE models suffer from the same thing. They depend on traffic being routed to a specific point for inspection. This can lead to a slowdown, and users turning off protection. Every moment spent off-path becomes a possible exposure window.
Why mid-market teams feel stuck
Most mid-market teams don't have the luxuries of a larger company, which can usually absorb this complexity with dedicated SecOps teams, big budgets, and layered defenses. Mid-market IT and security teams are juggling multiple systems: VPNs, web gateways, CASB tools, and endpoint agents, none of which were made to work with each other. Each application has its own logs, policies, and potential blind spots. Each new user adds to this burden.These mid-market teams are facing more security risks, more compliance pressure, and more customer expectations than ever before. They don't need more tools, they need faster deployment, and security that works perfectly 100% of the time, even when people do not.Protecting the mid-market enterprise
Access must be identity driven. Users must be given access to only the apps and data that they are specifically authorized to use at that given time. To adequately protect mid-market enterprises, security has to do one thing: Move closer to the user and the data.Protection must always be on. Data inspection must happen at the source and it must be continuous. Threats need to be blocked where they originate, not sent off to a distant tunnel or gateway, and trust cannot stop once a user is initially authenticated. A connection has to be continuously re-evaluated as context, behavior, and risk change.Security depends on architecture
Instead of stitching together multiple security applications, users need a single-app, single-stack architecture that runs directly on the endpoint, at the edge, or in the cloud where all Zero Trust enforcement, threat inspection, and policy controls happen inside one solution.Security should run where the traffic originates from, not where it is routed. Inspection needs to happen at the source, so there is no security gap. When logging into a SaaS session, access is immediately governed by user identity and policy. If a user clicks a phishing link, it is blocked before it leaves their device.Users should no longer have to choose between network speed and secure protection. This solves the exposure holes that plague legacy security models.A game-changer for mid-market teams
For mid-market teams, a security solution is required where remote employees can work from anywhere and are fully protected at all times. They need SaaS platforms like Salesforce, Jira, and Microsoft 365 to have seamless access and data protection rules. This includes a combination of Zero Trust enforcement, threat inspection, and policy controls. Developers and contractors should have access to only what they need, when they need it, without having to access the internal network.In this approach, branch offices are now fully secure without the need for expensive hardware. New team members can be onboarded effortlessly, without needing to rebuild or revamp the network, with deployment taking minutes, not months.Most organizations now recognize that Zero Trust is a critical piece of their security strategy, but it must be enforced everywhere continuously. If it depends on users exhibiting perfect behavior, it will not live up to its promise.
SASE fell short until now
Originally, SASE was developed to bring network security to cloud-first, distributed organizations. Unfortunately, the implementation was based on an outdated model. PoP-heavy network architectures introduce latency, rising costs, and new security risks. Multi-vendor stacks add complexity. A single-stack, built-for-distributed architecture would bring SASE back to its original promise: Secure access everywhere work actually takes place, with consistent policy enforcement and real-time protection.Mid-market vendor evaluation suggestions
Mid-market enterprises have unique issues that demand unique answers from network security vendors. Specific questions should be asked to determine if a security platform was designed for how work actually happens, or for a marketing diagram. Questions should include:How are your networks protected if users turn off their VPNs?What happens when a user clicks a malicious link?
How do you ensure compliance while reducing the need to manage multiple tracking tools?
How quickly can your users get access to the applications they need to do their jobs?
