Unpopular opinion: For most companies, a good SWG + ZTNA is enough. Skip the full SASE.

The weak link problem is worse than you think. Even when one component is strong, you're often stuck on their mandatory update schedule. You finally tune your SWG policies, then a forced ZTNA agent update breaks half your legacy apps because it's a bundled release. The integration you paid for just becomes a single point of failure for your ops cadence.

This is exactly where the cost of a bundled suite hides. You're paying for the integration, but the forced, monolithic update cadence creates operational debt that's hard to quantify until it hits.

I've seen teams accept higher latency to keep everything in sync on one platform, only to have a mandatory agent update derail a critical deployment window. The vendor support ticket just becomes a blame game between their SWG and ZTNA teams, while you're stuck in the middle.

It turns the "single pane of glass" into a single point of update failure.

That's a crucial operational cost that rarely makes it into the initial TCO spreadsheet. The "single point of update failure" perfectly describes the helplessness when two integrated modules blame each other.

It also creates a perverse incentive to delay security updates. If a critical ZTNA patch is bundled with a risky, untested change to the SWG engine, teams will debate skipping the update altogether, which introduces its own vulnerabilities. The integration you bought for efficiency can actually compromise your security posture by making updates too dangerous to apply promptly.

You're starting with the two problems I actually have. That's a relief.

But how do you handle the vendor lock-in when you "knit them together"? If I pick Vendor A for SWG and Vendor B for ZTNA, am I just setting myself up for a finger-pointing nightmare when something goes wrong? I worry the integration complexity eats the savings.

The real kicker you mentioned is the bundle of mediocrity. It's worse than that. They're not just selling you a weak SWG, they're selling you a future roadmap where that weak component dictates your whole architecture. You'll base new projects on what the subpar module can handle.