We're a 250-person company looking to replace a mix of MPLS and VPNs. Our team manages Salesforce and Zendesk, so we're comfortable with cloud platforms, but networking isn't our core.
I see a lot about Cato's SASE being "transformative," but the pricing feels opaque. For those who have gone through a quote: is the per-site and per-user model actually competitive against traditional SD-WAN or rolling your own with a major cloud provider? I'm especially curious about the reality of the bandwidth commitment tiers and any hidden onboarding costs.
I got a quote for a similar sized rollout last quarter.
Per site and per user is competitive if you're comparing it to a full, supported SASE stack from Palo Alto or Zera. It's not competitive if you're comparing it to basic SD-WAN hardware from Fortinet or rolling your own IPSEC tunnels in AWS/Azure. You're paying for the managed service wrapper.
The bandwidth tiers are real and you'll commit to a minimum. Onboarding wasn't hidden but it wasn't free. They called it "professional services" and it was a five figure line item.
For your team's profile, the main question is if you need the built-in security or if you're just doing connectivity. If it's just connectivity, the premium is hard to justify.
Benchmarks don't lie.
I totally get where you're coming from on the opaque pricing - I went through the same evaluation last year. The bandwidth commitment tiers are very real, and they'll push you towards the 50 Mbps or 100 Mbps minimum per site unless you're really small. That can add up fast.
Where it gets interesting for your team's profile is the operational trade-off. If networking isn't your core, the managed service wrapper starts to look better when you factor in the 24/7 NOC and not having to patch firewalls or troubleshoot VPN drops at 2 AM. Rolling your own in AWS might seem cheaper on paper, but have you calculated the hours your team would spend building and maintaining it? For 250 users across multiple sites, the labor equation often tips the scales.
The "professional services" onboarding was a flat fee for us too, but they did throw in some extra training credits when we pushed back. Did you get a breakout of what that five-figure line item actually covers? Sometimes it's negotiable if you're bringing a certain volume of sites onboard.
Automate all the things.
The operational trade-off argument is the one every managed service vendor leans on. It's seductive until you realize you're trading one set of 2 AM problems for another.
Now your after-hours issue is explaining to their NOC why a critical business app is failing over their "optimized" global backbone, armed only with the vague metrics their portal provides. You traded patching for vendor management.
And while we're on that five-figure onboarding fee, "training credits" are a classic softener. Ask what the training actually covers. In my experience, it's often basic platform orientation that should be included if you're already committing to a hefty minimum spend.
Trust but verify
Great question. For a team that's already comfortable with cloud platforms like Salesforce, I think the pricing model can make sense, but you have to reframe it a bit.
You're right, the bandwidth commitment tiers aren't hidden, but they're designed for growth. They quoted us with a 50 Mbps minimum per site, which felt like overkill. The trick is to push back and ask about their "burstable" model - you might get the same commit at a lower price if you agree to a longer term. The per-user cost for the security stack was actually clearer than the bandwidth part.
And on the >"hidden onboarding costs", I'd echo the others - it's not hidden, it's just a separate project fee. Where Cato helped us was bundling it with training that was actually useful for my team (who sound a lot like yours). We got real sessions on their policy manager and analytics, not just a portal walkthrough. That made the operational handoff smoother. If you're not getting that, the fee is harder to swallow.
Clean data, happy life.
It really is opaque at first. Their sales team will map everything out for you if you engage, but getting to that point without committing feels tricky.
Since you manage Salesforce, did you find their pricing any clearer when you started? Or is all enterprise SaaS like this now?