Another week, another round of "SASE Shootout" presentations from vendors promising the moon. Having just finished a real evaluation for a client, I figured I'd cut through the marketing fluff and share the raw numbers and architectural implications. The goal was straightforward: replace a crumbling mix of on-premise firewalls and a basic VPN for a 300-person company with developers, a sales team, and the usual corporate functions.
I've seen too many teams default to the "industry leader" and get a nasty surprise on the bill, or over-index on a single feature and miss the operational overhead. So I built a proper comparison model. The core criteria were:
* **Total Cost (3-year TCO):** The big one. Including all required user/seat licenses, egress fees, and support.
* **Zero Trust Implementation:** How much work to move from "anywhere VPN" to true app-level access.
* **Network Security Stack:** The quality and integration of SWG, CASB, DLP, and firewall.
* **Operational Burden:** The internal team hours needed to deploy, manage, and troubleshoot.
* **Egress Cost Trap:** The often-hidden cost of backhauling all traffic through the provider's cloud.
The contenders were Cloudflare One, Cisco Umbrella (as the core of their SASE), and Fortinet FortiSASE. Zscaler was omitted early due to cost and the client's allergy to vendor lock-in.
Here's the high-level spreadsheet summary. The devil, as always, is in the assumptions detailed below.
| Criteria | Cloudflare One | Cisco Umbrella | FortiSASE |
| :--- | :--- | :--- | :--- |
| **3-Yr TCO (300 users)** | **~$135k** | ~$210k | ~$180k |
| **Zero Trust Setup** | Simple, API/UI driven | Moderate, integrates with Duo/ISE | Complex, requires FortiGate logic |
| **Security Stack** | Solid SWG, evolving CASB/DLP | Excellent DNS, strong SWG | Very strong NGFW, full suite |
| **Ops Burden** | Low (single dashboard) | Moderate (multiple consoles) | High (requires Fortinet expertise) |
| **Egress Cost** | No premium (~$0.005/GB) | Significant backhaul premium | Moderate, depends on region |
| **Biggest Pro**| Cost & simplicity | Enterprise integration | Depth of security features |
| **Biggest Con**| Less "enterprise-feeling" | Cost & complexity | You're managing a virtual firewall |
**Why Cloudflare One "Won" This Round:**
For this specific company, the choice became obvious. They don't have a 10-person security team to tune virtual firewalls. They needed "good enough" security that was better than what they had, without creating a new full-time job. Cloudflare's model is fundamentally different: it's a global network built for performance, with security layered on. You're not paying for a virtual appliance with bloated specs.
The cost advantage wasn't just in licenses. It was in the lack of punitive egress fees and the fact that features like their WARP-based Zero Trust agent and basic DLP are included in the per-user seat. Setting up an application like "Internal Wiki" for secure access took 15 minutes and looked like this:
```yaml
# Not actual CF config, but a representation of the logic
resource "cloudflare_access_application" "wiki" {
zone_id = var.zone_id
name = "Internal Wiki"
domain = "wiki.internal.company.com"
session_duration = "24h"
allowed_idps = [cloudflare_access_identity_provider.azure_ad.id]
}
```
FortiSASE required provisioning a virtual FortiGate, building policies, and worrying about throughput licensing. Umbrella required stitching together DNS, SIG, and Duo.
**The Sardonic Truth:** Most companies at this scale are not Fortinet shops. Paying for a full virtual firewall suite you'll never properly configure is a form of architectural debt. The "FortiTax" is real. Umbrella feels like an enterprise product where you're subsidizing Cisco's sales team. Cloudflare One feels like a utility. It's not perfect—their CASB is younger, and if you need deep, custom firewall rules, look elsewhere. But for 90% of the use cases for a 300-user company moving to a hybrid model, it's simpler, significantly cheaper, and gets the job done.
The spreadsheet is a living document. I've added columns for things like "IdP integration quirks" and "support response time on P2 tickets." The lesson, as always, is to model the *actual* costs and the *actual* internal effort required. Not the vendor's slide deck.
keep it simple