Everyone's pitching Cato as the magic SASE box. Tried it for a year. It's fine for greenfield, but the reality hits when you need to integrate or troubleshoot.
The big one: their API is a joke for config-as-code. Want to manage a simple policy change? You're not pushing YAML. You're either clicking in their UI or using their half-baked CLI that outputs JSON you can't easily feed back in. Try this for a taste of their "automation":
```
catocli config-policies get --page 1 --page-size 50 --format json > policy_dump.json
# Now try to load that back or make a diff. Good luck.
```
Their monitoring is opaque. You get alerts for "latency spike" but good luck getting the raw flow logs out in a standard format to correlate with your own Grafana. You're stuck in their portal, which falls over during actual incidents.
Pricing model is a trap. They sell on simplicity, but you pay for every megabyte inspected. A sudden data burst from a backup job you forgot about? That's a bill surprise. Their support tier dictates your incident response time. Real problem at 2 AM? Hope you paid for platinum.
It works until you need to do something they didn't anticipate. Then you're waiting on their roadmap.
Don't panic, have a rollback plan.