Everyone's raving about Cloudflare One being the simpler, cheaper SASE. So we pulled the plug on Prisma Access. Regret started around day three.
The big one: traffic visibility. Prisma's session data and threat logs were actually usable. Cloudflare's? Good luck. It's either a firehose into a SIEM you have to pay extra for, or dashboards that feel like they're hiding the ball. Debugging a user complaint is now a guessing game.
App-ID style filtering? Gone. Their L7 policies are blunt instruments compared to Palo Alto's. Also, the tunnel stability isn't where it needs to be. More random drops, especially for legacy on-prem apps. Sure, it's cheaper. But we're burning more engineering time making it work.
Just my two cents.
Just my two cents.
Senior infra architect here at a 500-person logistics company, running hybrid everything. We've been live on Prisma Access for three years and I ran a six-month PoC of Cloudflare One before we ultimately stayed put.
- **Target audience:** Cloudflare One is for the SMB or startup where "good enough" security wins. Prisma Access is built for the mid-market and up, where you have a dedicated network or security team. If you're managing more than 1500 users or have regulatory log retention needs, Cloudflare's tooling forces you into a SIEM, which is a hidden project and cost.
- **True pricing:** Prisma Access runs us about $12-18/user/month on a committed term. Cloudflare One came in around $5-7/user/month for a comparable feature set, but that's before you factor in the engineering tax. You will spend 15-20% more of a senior engineer's time babysitting tunnel states and building custom dashboards for visibility, which for us negated the savings.
- **Visibility and logs:** This is the deal-breaker. Prisma's session data is queryable and you can trace a user's path through the service chain. Cloudflare's logs are indeed a firehose; you get raw flow data and have to reconstruct sessions yourself. Their own dashboard aggregates in ways that obscure detail. For debugging, we found a simple user complaint took three times as long to resolve.
- **Application filtering:** Prisma's App-ID is a mature signature-based system that actually recognizes thousands of applications. Cloudflare's L7 policies are port/protocol/DNS based. If you have legacy apps or SaaS platforms that use dynamic ports, you're writing a lot of manual allow rules. We had to maintain an allowlist of 40+ IPs for a single SaaS vendor because Cloudflare couldn't reliably identify the traffic.
My pick is Prisma Access, specifically for any organization with legacy or complex application mix, or where your security team demands detailed forensic capability. If you're a SaaS-native, greenfield shop with under 200 users and you live in a browser, Cloudflare One makes sense. To decide, tell us your headcount and whether you have any on-prem or non-web traffic.
monoliths are not evil
Your point about the "hidden project and cost" of a SIEM is fair, but isn't that just shifting the problem? Prisma's logs are more polished, sure, but you're still paying a huge premium for that polish within their walled garden. If you need truly deep, cross-platform analysis, you're likely piping those "queryable" logs to a SIEM anyway.
And I'm skeptical about that 15-20% engineering tax being a universal rule. For a greenfield setup, Cloudflare's API-first approach means you can script the monitoring you actually need, instead of paying for and learning Palo's entire predefined taxonomy. The tax only applies if you insist on rebuilding Prisma's exact model.
But what about the edge case?
The tunnel stability issue is real. We saw the same drops with some internal Java apps until we forced a TCP mux off in the warp client config.
You're right about the dashboards hiding the ball. But you can get usable session data out of the GraphQL API. It's just work Palo gives you for free.
Ship it, but test it first
The visibility gap is real, and that's a pain point I hear often from teams who switch from traditional firewalls. The dashboards are built for speed, not deep dives, so the jump to APIs feels jarring.
Have you looked at using the Network Analytics v2 datasets via GraphQL yet? It's not as intuitive as a built-in log viewer, but you can build some decent targeted queries for troubleshooting sessions that drop. It's a middle ground before a full SIEM commitment.
The tunnel drops for on-prem apps are frustrating. What client versions and OS are you running? The mux setting user751 mentioned helped in a few similar cases, especially with older TCP stacks.
Keep it civil, keep it real.
That visibility drop hit us hard too. Prisma's logs feel like a finished product, while Cloudflare's are more like raw materials.
I've found you can get decent session data using their GraphQL Analytics API, but it's definitely an API-first approach. You almost have to build your own dashboard for the deep dives, which is extra work Palo just bakes in.
App-ID is the real trade-off, isn't it? Palo's is mature. With Cloudflare, you're building those application rules from the ground up using their custom rules engine. It's powerful, but requires a different mindset.
Data-driven decisions.