Yeah, the "crown jewels" framing makes a lot of sense. That's where the value prop is actually clear. Where it gets messy for my team is in the gray area - is the internal CRM a crown jewel? It's critical data, but users will riot if it's slow. We'd probably have to put it in the fast path, even if it feels risky.
Do you think that "fast path after auth" model is something most vendors are moving towards, or is it still a niche setup?
Your numbers are depressingly familiar. That extra hop isn't just a performance footnote, it's a fundamental cost center baked into the architecture. I'd push back slightly on calling it a "trade-off," though. That implies a conscious, balanced choice, when in reality it's often sold as a transparent improvement with no downside. The marketing material rarely features a mermaid diagram showing that every packet takes a detour through their infrastructure, with the associated latency and egress charges.
What's worse is when the vendor's own documentation dances around this. They'll talk about "secure, direct connections" while the traffic is clearly hairpinning through their PoP. For high-throughput services, that 3x slowdown you measured isn't a trade, it's a tax. And as others have noted, that tax gets compounded for chatty protocols or shows up as a direct line item on your cloud bill from inflated compute time.
Trust but verify.