PSE SASE key terms

A lightweight component deployed in a private network or VPC that brokers connections from Prisma Access to internal applications, so private apps are reachable without exposing them to the public internet.

An internal workload such as an intranet site, ERP system, or SSH host that is not published to the internet and is reached by users only through the ZTNA Connector path.

The policy object that defines which hostnames, IP subnets, and ports belong to one protected private application, along with the connectors that serve it.

A DNS configuration in which Prisma Access resolves internal domains through the customer's own DNS servers via the connector, keeping private name resolution working for remote users.

The endpoint agent and gateway service that connects user devices to Prisma Access, applying host posture checks and steering traffic into the closest mobile user location.

A regional Prisma Access compute location where remote-user traffic is processed; users are assigned to the nearest one, which hosts the security stack for that region.

The encrypted link between a customer's network location or data center and Prisma Access, carrying traffic for remote networks and for private application access.

A branch or site that Prisma Access secures by tunneling its internet-bound traffic to a nearby compute location instead of backhauling it to a central data center.

A host information profile evaluation that inspects endpoint attributes such as disk encryption, patch level, and antivirus state before granting access to sensitive applications.

The ZTNA principle of granting each user only the specific applications and ports their role requires, verified per session rather than by broad network-level trust.

A Prisma Access deployment mode where endpoints send web traffic to a proxy via PAC file or agent, allowing user-based policy without a full tunnel.

A rule set that selects the best path for an application based on link quality metrics such as latency, jitter, and packet loss, with fallback and failover behavior defined per traffic class.

Continuously measured characteristics of a WAN link, including latency, jitter, packet loss, and throughput, used to decide whether traffic stays on a path or moves to another.

The threshold profile that defines acceptable latency, jitter, and loss for a given application, so SD-WAN can flag violations and trigger path switching.

A logical grouping of applications with shared SLA targets and priority, letting administrators express business requirements once and apply them consistently across all sites.

The act of directing a flow to a particular WAN link, tunnel, or breakout based on policy and live path measurements, including failover when the preferred path degrades.

Sending branch internet traffic directly to the local ISP rather than backhauling it to a central site, which reduces latency but requires cloud-delivered security inspection.

The physical or virtual appliance at a site that runs SD-WAN policy, maintains multiple WAN links, and forms tunnels toward Prisma Access or other sites.

The continuous process of measuring available links and moving traffic to the link that best satisfies the application's SLA at that moment.

A resilience technique that sends the same critical packet over two links so the first copy to arrive is used, reducing loss at the cost of extra bandwidth.

A cloud-delivered enterprise browser that enforces security policy on the user's web session itself, so protection follows the user regardless of device or network.

Rendering web content in a remote or containerized environment and sending only a safe representation to the user, so malicious code never executes on the endpoint.

A specific isolation mode where the full browsing session runs on a remote server and the endpoint receives pixels or a sanitized stream rather than live page code.

An endpoint the organization does not own or control, such as a contractor laptop or personal phone, which cannot carry an agent and needs browser-level control instead.

Allowing personal devices to reach corporate web applications through a controlled browser session with policy, data controls, and no persistent local data.

A cloud-hosted service such as a productivity suite or CRM that users reach over the internet and that requires visibility and policy independent of network location.

A cloud access security broker that connects to a SaaS provider's APIs to scan stored data, classify it, and enforce settings without proxying user traffic.

A proxy-based control point that inspects SaaS traffic in real time as users access it, enabling blocking, coaching, and data protection at the moment of use.

Unsactioned cloud services adopted by employees without security review, discovered by analyzing traffic or API data and then managed through approval or blocking policy.

The process of identifying which cloud applications are in use, who uses them, and how much data flows to each, typically by inspecting logs and traffic metadata.

Controls that limit which SaaS tenants and accounts a user can authenticate to, preventing corporate data from flowing to personal or unapproved instances.

A detection method in DLP that matches structured identifiers such as credit card or national ID formats using regex, checksums, and proximity logic to reduce false positives.

A reusable rule set that combines data patterns, file types, and thresholds to define what sensitive content looks like and what action to take when found.

Labels applied to files, either by the user or automatically, that indicate sensitivity and can be read by DLP to drive policy decisions.

A recorded event generated when traffic or stored data matches a DLP rule, containing the matched pattern, severity, user, destination, and action taken.

A centralized data loss prevention capability that applies consistent content inspection and response across web, SaaS, email, and endpoint channels from one policy engine.

A policy object attached to a security rule that specifies which file types may be uploaded or downloaded and what happens when a restricted type is detected.