Is Prisma Access worth the price for a 200-user mid-market shop?

Hey everyone, been deep in the SASE weeds lately evaluating platforms for our own setup and for clients. The pricing models are... something else. 😅

We're a classic 200-person tech company, fully hybrid, with devs jumping between cloud VPCs, on-prem labs, and coffee shops. Our current stack is a patchwork of legacy VPN, cloud-native FW, and manual ZTNA rules. The ops overhead is becoming unsustainable. Prisma Access keeps coming up, but the quote we got was significant. I'm trying to map its value to concrete technical capabilities, especially from a Kubernetes/cloud-native perspective.

Here’s my breakdown of needs versus the Prisma features I've been testing:

* **GitOps/DevSecOps Pipeline Integration:** Can we inject inline inspection into CI/CD traffic heading to, say, a private GitHub runner or an internal artifact registry? I'm thinking less about web filtering and more about malware scanning on `docker push` or `helm upgrade` traffic.
* **Service Mesh Adjacency:** With Istio handling east-west, Prisma would handle north-south. But does its API allow dynamic service-to-identity mapping from our OIDC provider to its security policies? Or are we stuck with static IP/port rules?
* **Infrastructure-as-Code (Terraform):** The deal-breaker for us. The entire posture—DLP, threat, URL filtering profiles—needs to be declaratively managed. The Palo Alto provider seems to have coverage, but I'm curious about real-world state drift in a multi-branch pipeline.
```hcl
# Example of what we'd need - managing a security rule via Terraform
resource "prismacloud_policy" "k8s-egress-control" {
name = "Block cryptomining to k8s namespaces"
description = "Generated from cluster labels"
rule {
applications = ["SSL"]
custom_urls = [var.threat_feeds]
from = [prismacloud_group.k8s-high-risk.id]
}
}
```
* **Cluster Autoscaling Interaction:** With nodes spinning up in new AZs/VNets, how seamless is the dynamic address group population? If a node gets a new IP, does policy enforcement follow immediately, or is there a cache/delay that creates a window?

The per-user licensing cost is high, but if it genuinely consolidates multiple point solutions (CASB, SWG, ZTNA) and reduces our operational toil, the TCO argument might work. But I'm skeptical about the agent footprint and the true "single pass" architecture.

For those who've implemented it at a similar scale: **did the technical automation capabilities justify the premium?** Were you able to achieve a true GitOps workflow for policy management, or did you hit a wall with the console? Any gotchas with non-HTTP/S protocols that our dev teams rely on (e.g., SSH, custom database ports)?

Really appreciate any war stories or config snippets you can share!