SECURITY ATLAS / EVALUATION BRIEF
Check Point SASE
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/checkpoint-sase/

THE ATLAS TAKE
Check Point SASE deserves a scoped trial for organizations seeking cloud-delivered workforce internet and private access. The immediate diligence issue is product lineage: current Check Point SASE documentation, former Harmony branding and Perimeter 81 history can lead to mismatched setup assumptions. Atlas would establish the actual tenant, subscription and supported agent first, then test access to specific applications. The result should be a supportable user-to-resource policy with visible decisions. A broad SASE feature list is less useful than evidence that the purchased configuration handles normal work and denies unnecessary access.

SCOPE
The profile covers the current Check Point SASE service. Perimeter 81 lineage, portal choice, agent version and selected internet/private-access subscription affect setup; a legacy entitlement should not be treated as the current complete suite.

WORTH A LOOK WHEN
Teams evaluating a current Check Point SASE tenant with managed endpoint and application owners.

THINK TWICE WHEN
The deployment is planned from legacy Perimeter 81 assumptions without validating the current subscription and agent.

IMPLEMENTATION
1. Validate current identity and entitlement
Record tenant portal, selected package and supported agent against the current documentation.

2. Pilot endpoint enrollment
Use a small managed group and verify token handling, identity association and the correct tenant connection.

3. Map application policy
Define one private workflow, required dependencies and support ownership before migrating broader access.

OPERATING REALITY
Tenant onboarding and agent configuration must stay aligned with identity and endpoint-management operations. Agent versions, enrollment tokens and support procedures need ownership. Application and policy changes should be reviewed together so a successful network connection is not mistaken for correct application authorization.

COMMERCIAL CONSIDERATIONS
Obtain a current Check Point SASE quote mapped to internet and private-access requirements. Confirm how any historical subscription maps to the proposed service and itemize additional controls.
- Current subscription and protected users
- Agent rollout and private-resource connectivity
- Optional controls and service-support commitments

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Enroll a managed test endpoint
Acceptance evidence: Keep agent version, tenant association and user context.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Allow one private workflow and deny adjacent access
Acceptance evidence: Retain applied policy and destination-side evidence.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Recover from a lab enrollment or access error
Acceptance evidence: Document support visibility and reversal without broad policy exceptions.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Which portal, agent version and subscription apply to this deployment?
- Which traffic is inspected on the device versus a cloud path?
- How do bypass rules affect visibility and enforcement?

EVIDENCE GAPS
- Atlas has not independently measured performance or threat-prevention efficacy.
- Confirm tenant-specific current versus legacy functionality and agent support.

SOURCES
Check Point SASE current platform (Product information)
https://www.checkpoint.com/harmony/sase/
Check Point SASE getting started (Documentation)
https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/SASE_Security/Topics/getting_started/getting_started_with_check_point_sase.html
Agent and tenant-token behavior (Documentation)
https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/SASE_Security/Topics/deploying_sase_agent_with_microsoft_intune/downloading_sase_agent_msi_and_tenant_token.html

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.