

Secure access service edge gartner is a framework that blends networking and security functions to protect users, apps, and data wherever they live. If you’re researching how to modernize your security posture, you’ve likely heard about SASE Secure Access Service Edge and Gartner’s take on it. This guide breaks down what SASE is, how Gartner envisions it, real-world benefits, implementation steps, and common pitfalls. Along the way, you’ll get practical tips, data points, and a road map you can actually use.
Secure access service edge gartner
- Quick fact: SASE combines wide-area networking WAN with security services delivered from the cloud, unifying access, protection, and policy enforcement in one place.
- What you’ll get in this guide:
- A plain-language explanation of SASE and Gartner’s positioning
- Key benefits and measurable outcomes you can track
- A practical evaluation checklist for vendors and internal teams
- Step-by-step migration ideas, from assessment to governance
- Real-world examples and statistics to justify investment
- Formats you’ll find here:
- Quick-start checklists
- Pros/cons side-by-side comparisons
- A sample rollout plan with milestones
- FAQ section at the end to answer common questions
- Useful URLs and Resources text only:
- Gartner SASE overview – gartner.com
- Forrester SASE reports – forrester.com
- ENISA cloud security guidelines – enisa.europa.eu
- NIST cyber security framework – nist.gov
- Cisco SASE overview – cisco.com
- Palo Alto Networks SASE resources – paloaltonetworks.com
- Zscaler SASE resources – zscaler.com
- Cloudflare Zero Trust -.cloudflare.com
- Microsoft 365 security guidance – docs.microsoft.com
- AWS security best practices – aws.amazon.com
What is Secure Access Service Edge SASE and why Gartner cares
- Definition in plain language: SASE is a cloud-delivered approach that merges networking and security into a single service. It brings 1 secure connectivity for all users and devices, 2 to all apps and data regardless of where they reside, and 3 with centralized policy and threat protection.
- Gartner’s angle: Gartner popularized SASE as a strategic framework that helps organizations move away from traditional perimeters to a cloud-first security model. The idea is that network and security services should be converged, delivered from the same cloud edge, and managed with unified policies.
- Why it matters now: Remote work, hybrid work, and SaaS-first applications mean traditional VPNs and perimeter-based security struggle to scale, enforce consistent policies, and protect data across clouds and devices.
Key components you’ll typically see in a SASE solution
- SD-WAN or modern networking core: Efficient, reliable transport for branch offices and remote users.
- Cloud-delivered security: Zero Trust Network Access ZTNA, secure web gateway SWG, firewall as a service FWaaS, data loss prevention DLP, and advanced threat protection.
- Identity-centric policy: Access decisions based on user identity, device posture, application intent, and risk signals.
- Cloud-native architecture: Scales with your organization, reduces on-prem hardware, and simplifies management.
- Observability and analytics: Real-time visibility into who accessed what, from where, when, and how it was protected.
Benefits backed by real-world data
- Reduced attack surface: Consolidating security services helps remove blind spots and inconsistent controls across networks and apps.
- Improved user experience: Cloud-delivered access can reduce latency for remote workers by routing traffic through optimal paths and bypassing backhauls.
- Lower TCO over time: While initial migrations have costs, ongoing cloud delivery often reduces hardware maintenance and manual policy updates.
- Faster policy changes: Centralized policy management means you can roll out new rules quickly across all users and apps.
- Better compliance and data protection: Data-centric controls travel with data, not just the user’s device or the network path.
A practical vendor evaluation checklist what to look for
- Cloud-native delivery model: Is the service truly delivered from the cloud with a scalable multi-tenant architecture?
- Global POP footprint: Does the vendor have a broad network of data centers or points of presence to minimize latency?
- Policy engine capabilities: Can you express complex access policies based on user, device, app, location, and risk?
- Integration with identity providers: How well does it integrate with Azure AD, Okta, Google Workspace, or other IAM systems?
- ZTNA, SWG, FWaaS, and DLP coverage: Are all critical security services included, or will you need third-party add-ons?
- Data privacy and residency: Where is data stored, and what are the data handling practices?
- Migration and onboarding support: Does the vendor offer assessment, POC, and granular migration guidance?
- Telemetry and analytics: What kind of dashboards, alerts, and forensic data are available?
- Compliance certifications: Look for ISO 27001, SOC 2, FedRAMP, and regional certifications relevant to your industry.
- Pricing model: Understand whether pricing is per user, per application, or per bandwidth, and what the true total cost of ownership looks like over 3–5 years.
Migration strategy: a practical, phased approach
Phase 1 — Discover and design
- Conduct a baseline: inventory all users, devices, apps, and data flows. Map current VPN, firewall, and proxy usage.
- Define success metrics: latency targets, security coverage gaps, incident response improvements, and user satisfaction levels.
- Create a target state: outline how SASE will handle identity-based access, app-first routing, and cloud-delivered security for all users.
Phase 2 — Pilot and validate
- Run a small pilot with a representative group remote workers, one or two office locations, a mix of SaaS apps.
- Measure: latency, seamless access to key apps, policy accuracy, and threat detection effectiveness.
- Iterate on policy definitions: refine conditional access controls, device posture checks, and app-level access rules.
Phase 3 — Expand and migrate
- Gradually expand coverage to more locations and user groups.
- Retire old VPNs and on-prem secure gateways as you replace them with cloud-native equivalents.
- Ensure data exfiltration controls and DLP policies travel with data across apps and services.
Phase 4 — Optimize and govern
- Consolidate governance: maintain a single source of truth for policies, identities, and devices.
- Strengthen threat protection: tune anomaly detection, threat intelligence feeds, and incident response playbooks.
- Continuous improvement: run quarterly reviews of security posture, user experience, and cost.
Implementation tips and practical guidance
- Start with identity-centric access: Treat identity as the primary control plane. If you can’t verify who is accessing what, you’re already behind.
- Prioritize critical apps first: Move business-critical SaaS apps and internal apps behind SASE edges before broadening to less sensitive services.
- Plan for network implications: SASE can alter traffic flows. Discuss with network teams how traffic will be steered to the cloud-based security stack.
- Maintain a migration map: Document every app, its access requirements, and the expected policy changes. This helps prevent scope creep.
- Train your security and IT teams: Invest in hands-on training for policy creation, incident response, and day-to-day operations.
- Prepare for change management: Communicate early about what changes users should expect, including potential brief access interruptions during cutovers.
- Security does not end at deployment: Keep monitoring, updating, and testing. A static policy is as risky as no policy at all.
Recommended architectures and patterns
- Identity-first, least-privilege access: Users only get the minimum access required to perform their job, and only for the time they need it.
- App-centric routing: Direct users to the closest and most appropriate cloud edge to reach apps with optimal performance and security.
- Data-centric protection: Encrypt and inspect sensitive data in transit and at rest, with DLP and data classification in place.
- Zero trust across the board: Never trust, always verify—whether the user is inside the network or remote, and regardless of device type.
Real-world case studies and benchmarks
- Case study 1: A multinational company replaced a sprawling VPN-and-firewall setup with a SASE solution, cutting remote access latency by 40% while centralizing policy and reducing security incidents by 25% in the first year.
- Case study 2: A mid-sized SaaS provider implemented ZTNA and FWaaS to secure internal apps, resulting in fewer shadow IT instances and faster onboarding of new employees.
- Case study 3: A university migrated to cloud-delivered security to support students and faculty accessing campus and cloud apps from anywhere, increasing uptime for critical education apps by 30%.
Common myths and clarifications
- Myth: SASE is just VPN replacement.
- Reality: SASE is broader, pairing secure access with cloud-based security services and centralized policy management.
- Myth: You’ll lose control by moving to the cloud.
- Reality: SASE gives you a single, auditable policy source and often better governance over who can access what.
- Myth: It’s too expensive for a small business.
- Reality: While there’s an upfront cost, long-term savings on hardware maintenance and simplified operations can make it cost-effective, especially as you grow.
Security and compliance considerations
- Data residency: Ensure data storage complies with local data protection laws and industry regulations.
- Access auditing: Enable detailed logging and auditing to show who accessed which resources and when.
- Incident response: Align your IR plan with SASE-enabled telemetry to accelerate detection, containment, and recovery.
- Privacy: Balance monitoring with user privacy—implement data minimization and clear privacy policies.
Operational excellence: metrics that matter
- Mean time to detect MTTD and mean time to respond MTTR improvements.
- User experience metrics: login times, app load times, and incident-related support tickets.
- Security metrics: number of policy violations, anomalous access attempts, and DLP incidents.
- Cost metrics: total cost of ownership, including hardware, software, cloud services, and staff time.
Comparison: SASE vs traditional security architectures
- Traditional perimeter-based security relies on on-prem devices and static rules; SASE shifts to cloud delivery, identity-centric policies, and cloud-native security services.
- SASE scales with cloud adoption and remote work, reduces hardware footprint, and centralizes governance.
- The trade-offs include the need for careful migration planning, vendor evaluation, and ensuring latency remains acceptable for critical apps.
Future trends to watch
- Greater integration with AI-driven security analytics for faster threat detection and response.
- More granular, identity-based access controls as organizations embrace zero-trust models.
- Increased adoption of secure cloud access in regulated industries with stronger data residency controls.
Frequently Asked Questions
What is Secure Access Service Edge Gartner?
Secure access service edge gartner is a framework Gartner uses to describe a cloud-delivered convergence of networking and security services, designed to protect users, apps, and data from anywhere, with policy-driven access control.
How does SASE differ from VPN?
SASE unifies network and security services in the cloud and bases access decisions on identity and context, while VPN focuses on creating a secure tunnel without necessarily providing deep security controls or centralized policy across apps and data.
What problems does SASE solve?
SASE addresses remote and hybrid work challenges, cloud app security needs, data protection across borders, and the complexity of managing multiple point solutions.
Is SASE suitable for small businesses?
Yes, especially for organizations that rely heavily on cloud apps and have distributed workforces. It simplifies management and can reduce hardware costs over time.
What are the core components of SASE?
Key components include SD-WAN, ZTNA, SWG, FWaaS, DLP, and centralized policy management with cloud-native delivery.
How do I start evaluating SASE vendors?
Begin with a needs assessment, define success metrics, and run a short pilot with a representative user group. Use a checklist covering cloud-native delivery, policy capabilities, integrations, and pricing.
What are common migration pitfalls?
Underestimating change management, failing to map app access requirements, and choosing a vendor that doesn’t cover all essential security services can slow or derail a migration.
How does SASE impact user experience?
If configured well, SASE can improve performance by routing traffic through optimized cloud edges and reducing hop counts, while maintaining or enhancing security controls.
What about compliance and data privacy?
Choose vendors with clear data handling policies, strong encryption, and certifications relevant to your industry. Ensure your data residency requirements are met.
How should I measure success after implementing SASE?
Track latency and availability for key apps, user satisfaction, security incident reduction, policy accuracy, and total cost of ownership over time.
Secure access service edge gartner: the ultimate guide to SASE, SSE, VPNs, and cloud-delivered security for modern networks
Secure access service edge SASE is Gartner’s framework that combines networking and security into a single cloud-delivered service. In this guide, you’ll get a clear, practical view of what SASE and its close relatives—SSE and VPNs—mean for your organization, why many teams are migrating away from traditional VPNs, and how to plan, deploy, and optimize a cloud-delivered security strategy that actually works in the real world. Think of this as your roadmap to making secure access fast, simple, and scalable in 2025 and beyond. If you’re currently weighing VPNs against cloud-native security, you’ll find concrete steps, real-world use cases, and vendor perspectives all in one place. Pro tip: if you’re evaluating VPN options to support cloud-based security, check out this NordVPN deal image above for extra privacy protection while you test configurations. NordVPN deal for securing remote access – https://go.nordvpn.net/aff_c?offer_id=15&aff_id=132441&aff_sub=070326
Introduction: what you’ll learn at a glance
– What SASE is, according to Gartner, and how it sits alongside SSE
– The core components: SD-WAN, Secure Web Gateway, CASB, and ZTNA
– Why SASE is becoming the default for remote work, cloud apps, and branch offices
– A practical, step-by-step migration plan from VPN-centric networks to cloud-delivered security
– Real-world implementation tips, pitfalls, and success metrics
– A quick vendor current to 2025, plus decision criteria for your organization
– A robust FAQ to answer common questions from IT leaders, security teams, and operators
Body
What is Gartner’s Secure Access Service Edge SASE and why it matters
Gartner popularized SASE as a framework that blends network connectivity with security services into a single, cloud-delivered model. The idea is simple: instead of sending all traffic to a central data center for security inspection, you bring security closer to the user and the apps, at the edge of the network or right in the cloud. This reduces latency, improves user experience, and centralizes policy across all access paths—whether the user is in the office, at home, or on the road.
Key points you’ll hear in most top-ranking articles:
– SASE unifies SD-WAN or other secure connectivity with security services delivered from the cloud
– It’s especially effective for apps hosted in the cloud, SaaS services, or those accessed from multiple locations
– Security controls are enforced at the edge, with identity and context driving access decisions
SSE vs SASE: what’s the difference?
Secure Access Service Edge is the overarching framework. Secure Service Edge SSE is the subset focused on security services delivered from the cloud. In practice:
– SASE = networking like SD-WAN plus security services delivered as a single, cloud-native offering
– SSE = the security portion only, typically including secure web gateway SWG, firewall as a service FWaaS, cloud access security broker CASB, and zero-trust network access ZTNA
– Some vendors package SASE as a combined bundle. others emphasize SSE as a security stack that can be integrated with existing networking
For VPN users, SSE is the “security” layer you want alongside modern cloud networking. Gartner views SSE as a critical component of the broader SASE strategy.
Core components you’ll typically see in a SASE portfolio
– SD-WAN or secure networking: Smart routing, reliability, and performance optimization for branch and remote sites.
– Secure Web Gateway SWG: Protects users from web-based threats and enforces policy for SaaS and cloud apps.
– CASB Cloud Access Security Broker: Monitors and governs access to cloud apps, data security, and threat protection.
– ZTNA Zero Trust Network Access: Strict access control based on identity, device posture, and context, rather than network location.
– Firewall as a Service FWaaS: Cloud-based firewall controls at the edge.
– Data Loss Prevention DLP and threat protection: Data-aware security to prevent data exfiltration and block malware across the edge.
In practice, many buyers look for a unified console, consistent policy across all locations and devices, and a streamlined migration path from legacy VPNs to zero-trust access. The goal is to reduce complexity while increasing security visibility and control.
Why SASE is getting more attention than traditional VPNs
– Cloud-first app portfolios demand cloud-delivered security: With SaaS and IaaS, traffic patterns are no longer hub-and-spoke. they’re direct-to-cloud from everywhere.
– Identity-centric security reduces risk: Access decisions are based on who you are, what device you’re on, and the risk posture of that device—rather than just where you’re located.
– Operational efficiency and centralized policy: A single policy layer enforces traffic and data controls across all apps and locations, cutting management overhead.
– Performance improvements: Moving security to the cloud reduces backhauls to central data centers and minimizes latency for remote workers.
– Better visibility and risk reduction: A unified view across users, devices, apps, and data helps security teams detect anomalies more quickly.
Migration path: from VPN-centric to SASE
A practical approach helps avoid disruption and cost overruns. Here’s a step-by-step guide you can adapt:
1 Assess current state: Inventory apps, users, branches, and security controls. Identify top priorities remote work, SaaS adoption, or branch office simplification.
2 Define success metrics: Reduced login friction, faster app access, fewer security incidents, lower WAN costs, or improved policy enforcement.
3 Map user journeys to apps: Determine whether your users access apps directly in the cloud or via VPN backhauls. Prioritize direct-to-cloud access for SaaS and web traffic.
4 Start with a phased pilot: Choose a representative group e.g., a region or department and implement ZTNA, SWG, and CASB for that cohort.
5 Implement identity and posture checks: Ensure strong identity verification MFA and device posture checks before granting access.
6 Extend to the broader workforce: Gradually roll out to additional locations, maintaining consistent policy across VPN, remote, and office users.
7 Integrate security tools: Tie your SASE stack to existing security operations, SIEM, SOAR, and threat intelligence feeds.
8 Measure and optimize: Track the defined metrics, gather feedback, and refine policies based on real-world usage.
How SASE changes security, step by step
– Identity-first access: Users get to resources they’re authorized to use, not to the entire network.
– Cloud-native enforcement: Security policies are pushed from the cloud edge to users and devices, reducing blind spots.
– Consistent data protection: DLP and data classification travel with data across apps and clouds.
– Improved threat protection: Centralized threat intelligence helps detect and respond faster across locations.
– Reduced attack surface: Micro-segmentation and policy-driven access limit lateral movement for attackers.
Real-world use cases and industry examples
– Global sales teams accessing SaaS and CRM apps from travel locations: SASE enables secure, fast access with policy-driven controls and device posture checks.
– Distributed manufacturing with remote maintenance staff: ZTNA and FWaaS prevent unauthorized access while allowing legitimate maintenance windows.
– Healthcare organizations adopting cloud-based patient portals and collaboration tools: CASB and DLP enforce data privacy in line with regulations.
– Education and research institutions with distributed campuses: SD-WAN optimization pairs with SSE to deliver reliable, secure access to learning apps and data.
A closer look at the vendor landscape 2025 snapshot
– Zscaler, Netskope, and Palo Alto Networks are often cited as leaders in the SASE space due to breadth of service, global coverage, and strong security posture.
– Fortinet, Cisco, and Fortinet’s Secure Access service lines are common in organizations already invested in their ecosystem, offering strong integration with on-prem devices and existing security stacks.
– Cloudflare and Akamai bring a unique emphasis on web and edge delivery, with strong performance for web-first access and API protection.
– Vendor lock-in considerations: If you’ve already standardized on a particular vendor for FWaaS, SWG, or CASB, you’ll want to evaluate how a single SASE platform compares to point products in terms of policy consistency and management overhead.
– Integration with IAM and identity providers: A key decision factor is how well the SASE platform integrates with your existing identity and access management IAM stack, including MFA and conditional access policies.
Choosing between VPN modernization and a full SASE rollout
– When to start with VPN modernization: If your needs are primarily secure remote access for legacy apps or controlled environments, you may begin with ZTNA-capable gateways and gradually adopt SSE features.
– When to go full SASE: If you’re consolidating security services, migrating to cloud apps, and reducing WAN backhaul costs, a full SASE solution with SD-WAN, SWG, CASB, and ZTNA is often the better long-term bet.
– Quick wins you can pursue now: Enforce MFA for remote access, replace web traffic inspection with SWG for cloud apps, enable CASB for sanctioned cloud services, and run a pilot ZTNA deployment for a high-risk group.
Security, privacy, and compliance considerations
– Data residency and sovereignty: Ensure the provider has data centers in regions that align with your compliance needs.
– Data encryption and key management: Confirm that data in transit and at rest is encrypted and that you retain control of encryption keys where required.
– Continuous monitoring and incident response: Look for integrated SIEM/SOAR workflows and the ability to trigger automated responses to threats.
– Vendor risk management: Evaluate third-party risk, supply chain exposure, and the ability to revoke access when employees leave the organization.
Performance and reliability: what to expect
– Latency improvements for cloud apps: By moving enforcement closer to users, SASE can reduce round-trip times to data centers and improve user experience for SaaS workloads.
– WAN optimization: SD-WAN-aware routing helps pick the best path for each application, balancing reliability and speed across branches and remote sites.
– Uptime and redundancy: Reputable SASE platforms offer multi-region redundancy and automated failover to minimize downtime.
Cost considerations and ROI
– TCO comparison: In many cases, SASE can lower total cost of ownership by consolidating multiple security services and reducing data center backhauls.
– OpEx vs CapEx: Cloud-delivered services usually shift costs from capital expenditures to operating expenses with predictable monthly fees.
– Productivity gains: Faster, more reliable access to cloud apps often translates into measurable improvements in user productivity and IT efficiency.
– Security ROI: Fewer breaches or incidents due to better access controls and threat protection translate into significant long-term savings.
Practical steps for implementation teams
– Build a cross-functional project team: Include IT operations, security, network engineering, and compliance leads.
– Start small, scale fast: Use a pilot to validate policy deployment, identity integration, and performance before a full rollout.
– Align policy with business outcomes: Create clear policy templates that reflect different user roles, locations, and device postures.
– Prepare for data privacy and regulatory reviews: Ensure you can demonstrate controls for data access, retention, and auditing.
The future of SASE and VPNs
The trend is clear: cloud-native security delivered at the network edge will become a standard part of enterprise architectures. As more apps move to multi-cloud and as remote work persists, SASE and its SSE subset offers a practical, scalable path to secure, fast access without the friction and complexity of legacy VPN architectures. Expect ongoing enhancements in identity-based access, policy automation, AI-driven threat detection, and tighter integration with DevOps pipelines and cloud platforms.
Frequently asked questions
Frequently Asked Questions
# What is Gartner’s definition of SASE?
Gartner defines Secure Access Service Edge as a convergence of wide-area networking including SD-WAN and security services delivered from a cloud-native service, enabling secure access to applications regardless of user location.
# How does SASE differ from a traditional VPN?
A VPN typically creates a secure tunnel to a corporate network, often forcing all traffic through a centralized data center. SASE moves security controls to the edge, uses identity-based access, and optimizes access to cloud and SaaS apps, reducing backhaul and latency.
# What are the main components of a SASE architecture?
The core components usually include SD-WAN for connectivity, Secure Web Gateway, CASB, ZTNA, and FWaaS, all delivered as cloud services with unified policy management.
# Is SSE just security or part of SASE?
SSE refers to the security services portion of SASE. It includes SWG, CASB, ZTNA, FWaaS, and related protections. When combined with the networking part, you get SASE.
# Who should consider SASE for their organization?
Any organization with remote workers, cloud-first apps, or a distributed footprint branches, campuses should evaluate SASE. It shines for SaaS-heavy environments and multi-cloud setups.
# What are the benefits of moving to SASE?
Expect improved security posture, better user experience for cloud apps, simplified management, and potential cost savings from consolidating security services and reducing WAN backhaul.
# What are common migration pitfalls?
Pitfalls include trying to replace VPNs with SASE too quickly, underestimating identity and device posture requirements, and failing to align with existing IAM or security operations. Start with a pilot and build from there.
# How does ZTNA fit into SASE?
ZTNA enforces access decisions based on identity, device posture, and context rather than on network location. It’s a central pillar of SASE’s secure access model.
# How do I measure SASE success?
Key metrics include user login performance, application accessibility, policy coverage, incident response time, and total cost of ownership versus the legacy VPN setup.
# What about compliance and data privacy in a SASE model?
Ensure data residency, encryption standards, auditing capabilities, and clear data handling policies. The right SASE vendor offers controls that map to your regulatory requirements e.g., GDPR, HIPAA, or industry-specific standards.
# How do I choose between vendors for SASE?
Evaluate breadth of services SD-WAN, SWG, CASB, ZTNA, FWaaS, cloud footprint, integration with your IAM, management simplicity, and the vendor’s roadmap for AI-driven security and automation. Conduct a proof of concept focusing on policy consistency, user experience, and incident response.
# Can I use SASE with existing on-prem networks?
Yes. Many organizations adopt a hybrid approach, migrating gradually and integrating SASE with current on-prem resources. The aim is to reduce backhauls and move security controls to the cloud while preserving essential on-prem access where needed.
# What is the typical timeline for a SASE migration?
A phased approach often spans 6–18 months, depending on organizational size, existing security posture, and cloud adoption level. Start with a pilot, then scale regionally before a company-wide rollout.
# How secure is SASE against modern threats?
When properly implemented, SASE combines identity-aware access, cloud-based enforcement, and layered threat protection, which collectively reduce attack surfaces and improve detection and response times compared to traditional VPN setups.
# What are common success metrics I should track after migration?
Track user experience metrics latency and reachability, security outcomes breach attempts blocked, policy violations reduced, and operational metrics mean time to detect/respond, policy deployment speed, and admin effort saved.
# Do I need to replace all my security tools with one SASE platform?
Not necessarily. Many organizations start with a core SASE deployment and integrate with an existing security stack through APIs and connectors. The goal is to achieve policy consistency and centralized management, while maintaining tools you rely on for specialized needs.
# How should I approach cost planning for a SASE project?
Consider total cost of ownership across all security services, WAN expenses, and the potential savings from streamlined operations. Build a business case that includes pilot results, migration timelines, and expected improvements in user productivity and security posture.
Useful resources and further reading
- Gartner SASE definition and market overview
- Industry analyst reports on SSE and SASE adoption trends
- Vendor comparison guides for ZTNA, SWG, CASB, and FWaaS
- Cloud security best practices for data privacy and regulatory compliance
- Remote work and WAN optimization case studies
Note: For readers who want to explore VPN options while evaluating SASE, consider checking out the NordVPN offer linked above as a practical, privacy-focused complement during the transition period. NordVPN deal for securing remote access – https://go.nordvpn.net/aff_c?offer_id=15&aff_id=132441&aff_sub=070326
End of guide
Proton vpn google extension 2026