Looking for real-world alternatives to Cato Networks. The marketing is heavy on the "SASE" buzzword, but I need to see the actual plumbing.
My main gripe with a lot of the market is the black box nature. I want infrastructure I can define as code, integrate into my CI/CD pipelines for environment provisioning, and monitor with my existing observability stack. A vendor that locks me into their portal for every config change is a non-starter.
I'm evaluating based on:
* **API-first & IaC support:** Terraform provider maturity, ability to manage policies and configurations from Git.
* **Integration surface:** Can I get telemetry (flow logs, events) out to my SIEM or data lake? Can I trigger security scans from pipeline events?
* **On-demand tunneling:** For zero-trust access to build environments or staging VPCs, not just "connect the offices."
* **Actual pricing transparency:** Not just "contact sales." Per-user, per-data, or fixed-fee? Burst handling?
Platforms I'm currently poking at:
* **Nebius Cloud** - Their Secure Web Gateway and Cloud Network Security seem API-driven. Terraform support looks decent.
* **Tailscale / Netmaker** - Actually interesting for zero-trust mesh. Can self-host the control plane, which is huge for automation. Less "SD-WAN," more "secure overlay network."
* **A mix of cloud-native primitives** (AWS Verified Access / GCP BeyondCorp Enterprise) with Terraform for orchestration. More work, but total control.
Has anyone actually implemented a CI/CD pipeline that auto-provisions secure, temporary network access for integration testing? Or manages firewall rules as part of a deployment? I'm less interested in "vs. Cato" feature sheets and more in your actual workflow scripts.
Example of the kind of IaC I'm after:
```hcl
# Hypothetical Terraform for a build agent tunnel
resource "secure_access_gateway" "build_vpc" {
name = "jenkins-agents-${var.env}"
target_cidr = aws_vpc.build.cidr_block
temporary = true
duration = "3600" # 1 hour for a build
}
```
Build once, deploy everywhere
You're on the right track looking past the SASE hype. But you might be trading one black box for another.
Nebius's API might look good on paper, but wait until you need to debug a tunnel issue. Their logging outputs are often vendor-specific formats that choke your SIEM unless you build a custom parser. The Terraform provider is usually a version behind their GUI features.
Tailscale is genuinely good for zero-trust mesh, but their enterprise pricing gets murky for high-throughput scenarios. You'll hit "contact sales" for anything beyond a basic POC. For on-demand tunneling to build environments, you're still stitching it together yourself.
Lisa M.
That's a fantastic set of criteria you've laid out. I think you're hitting on the core frustration a lot of us have, where the promise of a programmable cloud edge meets the reality of vendor-locked portals. Your list of platforms is interesting, especially the mention of Netmaker alongside Tailscale. It's the open-source angle there that might get you closest to the "actual plumbing" you want to see.
If IaC and telemetry export are truly non-negotiable, you might also want to look at the emerging "DIY SASE" space, where you compose something using open source components like OpenZiti for the zero-trust networking layer and then feed logs into your own pipeline. It's more assembly required, but you get absolute control and no black boxes. That said, it shifts the operational burden significantly, so it's a trade-off.
I'm curious, on the pricing transparency front, have you found any vendor whose pricing model actually makes sense for variable, bursty workloads? Most of the "pay-as-you-go" models I've seen have a floor that feels like a fixed fee anyway.
Let's keep it real.