Alright, looking for some real-world operational experience here. We're in the middle of a major zero-trust and secure access overhaul. Current environment is a classic hybrid mess:
* Primary AWS VPCs hosting containerized apps (EKS, some EC2 legacy)
* Two physical data centers for legacy systems and data storage
* ~500 users, mix of corporate and contractor, fully remote/distributed
* Current stack is a cobbled-together VPN gateway (OpenVPN) + on-prem FortiGate firewalls for data center traffic, cloud-native security groups in AWS. Monitoring via a self-managed Prometheus/Grafana stack scraping everything we can get metrics from.
The goal is to replace the user-to-workload access layer with a proper SASE model. The shortlist after a ton of vendor meetings is down to FortiSASE and Netskope. The sales pitches are, of course, identical: "we're the best, most seamless, etc." I need the ground truth from people who have to build and maintain the pipelines that interact with this stuff.
My specific operational concerns:
1. **Terraform/API Coverage:** I need to manage as much as possible as code. I don't want to click in a UI to onboard a new AWS VPC or set up a new application policy. What's the actual state of the Terraform providers or REST APIs for these platforms? For example, can I truly define a full Secure Web Gateway rule set in HCL, or is it just a few basic resources with the heavy lifting still manual?
2. **Kubernetes Integration (EKS):** How does the traffic steering work for pods inside EKS? Do you use a sidecar model, a node-level agent, or is it all based on routing through a cloud gateway? We've had nightmares with some solutions that required custom CNI configurations that broke our Cilium setup. Any concrete examples of the agent deployment method? A snippet of the DaemonSet or Deployment you used would be gold.
3. **Performance & Observability:** Both claim "no latency impact." What's the real story? More importantly, what metrics can you actually extract? Can you feed logs into your own SIEM or Prometheus/Loki stack easily, or are you locked into their dashboard? I need to be able to build my own Grafana dashboards for things like tunnel health, packet loss, and policy decision latency.
4. **The Hybrid Quirk:** For traffic destined for the on-prem data centers, what's the connector model? Is it a virtual appliance I have to manage, update, and monitor myself? If so, that's just another piece of infrastructure I now own. How reliable has that link been?
I'm leaning slightly towards FortiSASE because we have FortiGate experience on-prem, but I'm wary of assuming the cloud service operates the same way. Netskope seems cloud-native from the ground up, which is attractive but also a potential learning curve.
What I don't care about: the marketing buzzwords, the Gartner quadrants. What I do care about: the actual day-to-day of deploying, maintaining, and troubleshooting this as part of a broader DevOps pipeline. Who's actually living with this?
Automate everything. Twice.
That's a critical starting point. I had the same API-first requirement when we evaluated both. Fortinet's API for FortiSASE felt... bolted on? Like they built the GUI first and then generated endpoints as an afterthought. Some actions, especially around connector deployment in AWS, still required manual steps or weren't fully idempotent in Terraform.
Netskope's API coverage was more consistent for core SASE functions - their private app connector config, security policies, and user/group mapping could all be driven programmatically. Their Terraform provider was actually maintained by a third-party, but it was reliable for our core infra-as-code needs. The real question is whether their API's rate limits will trip you up when you're syncing 500 users from your IDP multiple times a day.
Webhooks or bust.
I need to push back on that API-first requirement being the critical starting point. In your environment, with EKS workloads and legacy EC2, the fundamental architectural decision is how the SASE platform's connector integrates with your VPC routing tables and security groups. Both solutions will claim full automation, but the operational reality is in the routing adjacencies and failover behaviors.
FortiSASE's connector deploys as a managed FortiGate-VM, which gives you BGP peering into your VPC. This is a double-edged sword. The API might feel bolted on, but the underlying network control is predictable if you're already in the Fortinet ecosystem. You can manipulate route advertisements programmatically via the FortiOS API on the managed device itself, which is well-documented, even if the SASE orchestration layer isn't.
Netskope's private app connector is a lighter-weight agent. Its API for the cloud control plane is better, as noted, but you trade that for a more opaque routing layer. It handles path selection automatically, which is great until you need to troubleshoot why a user session from a specific region is hairpinning through a non-optimal POP. For your Prometheus stack, ask each vendor for the specific metrics they expose on connector health and tunnel states. FortiSASE will give you classic firewall telemetry; Netskope's data will be more application-centric. Which model fits your existing monitoring workflows?
Boring is beautiful
You've nailed a key operational difference that gets lost in the feature sheet comparisons. The routing control vs. automation trade-off is real.
We had similar debates on our team. The predictable BGP peering with FortiSASE is comforting, but it adds that extra layer you have to manage and monitor. For your Prometheus stack, you'll be scraping different metrics endpoints for the network layer versus the security events, which can complicate your dashboards.
I'd ask what your team's comfort level is with troubleshooting opaque routing paths. If you have strong network ops, the Fortinet model might be fine. If your team is more dev-focused and just wants the access to work, the trade-off for Netskope's simpler but less visible routing might be worth it.
Raise the signal, lower the noise.