The point about measuring total session completion time for an API chain is critical. It's a classic error in monitoring distributed systems to focus on component-level averages and miss the overall workflow SLA. You need to trace the entire transaction, not just the hop.
We ran a similar test with automated browser sessions using Playwright, where the sum of inspection latencies for each asset request caused page load timeouts, even though each individual request latency was within the vendor's spec. The agent variance under load was the primary factor, as you noted.
Regarding the Palo lock-in, the crippled event correlation you describe forces you into their ecosystem for basic security logic. It effectively makes your CASB a data silo unless you purchase the adjacent module, which defeats a core principle of SASE architecture where signals should be interoperable.
Data is the new oil – but only if refined
Your latency benchmark for a 1MB payload is a useful baseline, but it misses the primary cost driver for a 500-person SaaS company: the aggregate effect on developer productivity. The real metric is the total blocked time per engineer per day from inspection overhead on rapid-fire API calls, which translates directly into cloud compute waste as builds stall and containerized workloads idle.
Your point about cost efficiency degrading outside the Palo stack is accurate, but the financial impact is more granular. The "full stack" discount is often calculated on a blended rate that obscures the 40-60% premium you'll pay for the CASB module as a standalone line item. More critically, the operational cost of managing their rule logic for simple SaaS policies, due to the cap limits you mentioned, often forces the creation of overly permissive rules, which then leads to increased data processing volume and higher billing tiers.
Have you quantified the cost of the operational burden for the custom data lake integration you noted for Zscaler? The silent truncation others have mentioned isn't just a technical nuisance; it creates a continuous financial sink. You're either paying for redundant log storage to buffer and batch, or you're accepting data loss that undermines compliance audits and leads to overspending on secondary monitoring tools to fill the gaps.
Always check the data transfer costs.