# Is a firewall still needed if we have zero trust or SASE?

Yes, in most offices. Secure access service edge (SASE) moves web filtering, secure remote access and some firewall functions into a cloud service, and zero trust changes how access is granted, but you still need something that blocks unsolicited connections from the internet into the office, separates network segments from each other and controls what servers and devices that never run the SASE client may reach. Printers, cameras, machines and many servers run no agent and are protected only by the network around them. So the firewall's role shrinks rather than disappears: inbound protection, segmentation and outbound rules for unmanaged devices. Keep its rules short and reviewed. NetSenX does not replace a firewall or a SASE service and blocks nothing. It watches the traffic that crosses monitored segments and flags scanning, lateral movement, beaconing and unusual outbound volume, on every plan, which tells you when either layer is being bypassed.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/is-a-firewall-still-needed-with-zero-trust-or-sase

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [How do segmentation and least privilege limit lateral movement?](https://netsenx.com/en/faq/how-does-segmentation-limit-lateral-movement)
- [Where do I start segmenting a flat office network?](https://netsenx.com/en/faq/where-to-start-segmenting-a-flat-office-network)
- [How do I segment IT and OT with VLANs and access lists?](https://netsenx.com/en/faq/how-to-segment-it-and-ot-with-vlans-and-acls)
- [What is microsegmentation, and do small companies need it?](https://netsenx.com/en/faq/what-is-microsegmentation)
- [Is a VLAN a security boundary?](https://netsenx.com/en/faq/is-a-vlan-a-security-boundary)