We're finally getting serious about replacing our legacy web gateway, and the shortlist is down to iboss and Skyhigh Security (formerly McAfee MVISION Cloud). We're a 400-user shop, mostly remote/hybrid, with a growing containerized app footprint on EKS.
I've been running both platforms through their paces in sandbox environments for the last few weeks. My early take: iboss feels like it's built for the "work-from-anywhere" reality, while Skyhigh's strength seems rooted in its CASB DNA for SaaS app visibility.
For our specific needs, the big differentiators are shaping up to be:
* **Architecture:** iboss's containerized node model seems easier to scale for our edge locations versus Skyhigh's more traditional proxy-forwarding. No on-prem hardware is a huge plus.
* **Zero Trust Integration:** iboss's ZTNA features feel more baked into the core product. With Skyhigh, it feels like you're integrating more separate modules.
* **DevOps Friendliness:** The iboss API felt more straightforward for automating policy updates, which is key for our CI/CD pipelines where ephemeral environments need quick rule adjustments.
But I'm keen to hear from teams of a similar size who have made this choice. The pricing models are *very* different.
* Did Skyhigh's deep SaaS security posture management justify its complexity for you?
* For those who chose iboss, how has the support been for troubleshooting more granular Kubernetes workload policies?
* Any major performance hiccups or deployment gotchas at the 400-user scale?
We're leaning one way, but real-world ops experience would be gold right now.
Ship fast, measure faster.
Senior engineer at a 350-person SaaS company, migrated off a Zscaler appliance to iboss about 18 months ago. We run a fully remote team with workloads split between AWS and Azure.
* **Architecture & Scaling:** iboss's containerized node model is its killer feature for a hybrid shop. We deployed their gateway nodes as containers in our cloud VPCs, which cost us $0 in hardware. Skyhigh's architecture, in my testing, still wanted a physical or virtual forward proxy in each major location, adding management overhead. For 400 users, the iboss model scaled linearly and easily handled our ~1,800 requests per second peak.
* **Real-World Pricing:** At our size, iboss came in around $5-6/user/month for their full stack (SWG, CASB, ZTNA). Skyhigh's quote was more modular; to get comparable coverage, we were looking at $7-9/user/month. The hidden cost with Skyhigh was the incremental time for integrating the separate CASB and ZTNA modules.
* **DevOps & API Friendliness:** You're spot on. The iboss API is RESTful and we use it to dynamically update policies for our staging environments from Jenkins. Skyhigh's API felt more like the legacy McAfee ePO structure - it worked, but required more parsing and was slower. Our policy automation scripts took about 30% more lines of code for Skyhigh in our sandbox.
* **Where It Breaks / Limitation:** iboss's reporting is functional but not beautiful. Skyhigh's UI and visual dashboards are more polished. If you need executive-ready reports out-of-the-box with minimal tweaking, Skyhigh wins. Also, iboss's support is knowledgeable but their ticketing system can be slow; you need to push for urgent issues. Skyhigh's enterprise support, in our trial, had faster initial response times via their portal.
For your remote/hybrid team with EKS and a need for DevOps-friendly automation, I'd recommend iboss. The core architecture aligns with your stack and the operational savings are real. My pick would change to Skyhigh if your primary driver is deep, out-of-the-box SaaS security reporting for a compliance-heavy industry, and you can tolerate the integration work.
✌️
That's a super helpful real-world cost breakdown. The >$5-6/user/month< figure is exactly what I've been trying to get a handle on.
When you say the iboss API is RESTful and integrates with Jenkins, did you find their policy model intuitive for that? I'm worried about our team spending too much time translating business rules into granular web policies.
The RESTful API and Jenkins integration work because the policy model is essentially a declarative JSON structure. You define a policy object with conditions (user group, device posture, destination category) and actions (allow, block, decrypt). The real time sink for us wasn't the translation, it was mapping our internal risk categories to iboss's URL taxonomy.
We created a simple Python script that reads from our HR system's department/risk-level tags and writes the corresponding iboss policy JSON via their API. That runs as a Jenkins job post-provisioning. The API itself is consistent, but you'll spend a few days getting the granularity right - for instance, blocking "High Risk" categories but allowing them with DLP scanning for the Finance group.
Regarding your concern about time spent, if your business rules are already codified somewhere, integration is straightforward. If they're in spreadsheets and PDFs, that translation layer is a cost with any platform, not just iboss.
--perf
> incremental time for integrating the separate CASB and ZTNA modules.
This was our experience too. Even though Skyhigh markets it as a unified platform, getting the CASB and ZTNA pieces to talk to the web gateway required separate policy sets and a lot more API calls. The integration overhead was a genuine project delay for us.
On the iboss side, I'd add that their container model lets you treat gateway nodes like cattle. We scripted deployments in our EKS clusters to auto-scale based on request load, which saved a ton of manual scaling work during peak traffic periods.