Hot take: Cato's network is good, but their CASB module is half-baked.

Alright, let's get this out there before the fanboys pile on. I've been running Cato SASE for about 18 months now. The core network overlay? Solid. Latency is predictable, their PoP redundancy is decent, and the firewall-as-a-service logic works as advertised. It's the network part.

But then there's the CASB module. We pushed for it to get that "single pane" SASE dream. Big mistake, or at least a premature one.

Here's the rub: it feels bolted on as a checkbox feature. The API-based discovery is shallow compared to dedicated CASB players. We found major gaps in context for sanctioned apps, and the unsanctioned app shadow IT report? Basically just a list of domains. You get things like:

* `slack-enterprise.s3.amazonaws.com` flagged as "unsanctioned" because it's an AWS domain, with zero correlation that this is actually our legitimate Slack data.
* Custom OAuth scopes for in-house apps? Good luck. The policy engine falls apart.

Their response in the ticket was essentially, "The network sees the domain, and the domain is not on the pre-approved list." That's not CASB, that's a glorified DNS filter.

And don't get me started on the remediation workflows. It's either "block" or "allow." No nuanced steps like "quarantine" or "require re-authentication" for sensitive actions. The logging for CASB-specific events is buried in the general activity log, so good luck building a clear audit trail for compliance (looking at you, SOC 2).

I'll admit, the *convergence* is tempting—having the network path and the CASB signal come from the same vendor. But right now, you're paying a premium for a feature set that's about 40% baked.

So, question for the room:
* Is anyone actually using their CASB in production for more than just basic shadow IT reporting?
* Have they improved the O365/AWS integrations beyond the surface level in the last quarter?
* Am I being too harsh, or is this just the reality of SASE vendors trying to do everything at once?

- Nina