<?xml version="1.0" encoding="UTF-8"?>        <rss version="2.0"
             xmlns:atom="http://www.w3.org/2005/Atom"
             xmlns:dc="http://purl.org/dc/elements/1.1/"
             xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
             xmlns:admin="http://webns.net/mvcb/"
             xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
             xmlns:content="http://purl.org/rss/1.0/modules/content/">
        <channel>
            <title>
									SASE and SSE - Welcome to Stackinsight community. Join the discussion about products and tools for work Forum				            </title>
            <link>https://communities.stackinsight.net/community/cyber-sase/</link>
            <description>Welcome to Stackinsight community. Join the discussion about products and tools for work Discussion Board</description>
            <language>en-US</language>
            <lastBuildDate>Sun, 15 Nov 2026 07:28:56 +0000</lastBuildDate>
            <generator>wpForo</generator>
            <ttl>60</ttl>
							                    <item>
                        <title>Zscaler vs Palo Alto - which has better threat prevention in SASE?</title>
                        <link>https://communities.stackinsight.net/community/cyber-sase/zscaler-vs-palo-alto-which-has-better-threat-prevention-in-sase-2/</link>
                        <pubDate>Mon, 28 Sep 2026 11:16:19 +0000</pubDate>
                        <description><![CDATA[Hey everyone, been deep in the weeds evaluating SASE platforms for our global rollout, and the core battleground for us is threat prevention. We&#039;ve narrowed it to Zscaler and Palo Alto Prism...]]></description>
                        <content:encoded><![CDATA[Hey everyone, been deep in the weeds evaluating SASE platforms for our global rollout, and the core battleground for us is threat prevention. We've narrowed it to Zscaler and Palo Alto Prisma SASE, but I'm hitting some analysis paralysis on which truly offers better protection.

From my testing and demos, they approach the problem from fundamentally different philosophies. Palo Alto feels like it’s extending its legendary NGFW DNA into the cloud—everything flows through that single-pass inspection engine, unifying threat intel from WildFire, DNS security, and Advanced URL Filtering. The policy granularity is insane, which I love. But Zscaler’s whole world is built on this massive, proxy-based cloud from the ground up. Their outbound-inbound symmetry and continuous SSL/TLS inspection at scale seem inherently architected for zero-trust, and their AI/ML-driven browser isolation and cloud sandboxing feel incredibly proactive.

Here’s where I’d love real-world experiences, especially from folks in marketing tech where we have tons of external collaborators and risky web tool usage:

*   **Inline vs. Out-of-band:** Palo Alto is predominantly inline, which feels robust. Zscaler offers a lot of out-of-band CASB functionality for SaaS apps. For preventing data exfiltration or catching malware in tools like Marketo or Salesforce, which mode has been more effective for you?
*   **Performance vs. Protection Tuning:** With Zscaler, I worry about latency for creative teams uploading large assets to cloud platforms. With Palo Alto, the concern is managing decryption policies without breaking internal apps. How have you tuned these without compromising security?
*   **Integrated Threat Intel:** Palo Alto’s ecosystem (Cortex XDR, Unit 42) is tightly woven. Zscaler leans on its own cloud-scale data. In practice, which has provided faster/more accurate responses to emerging phishing or ransomware campaigns?
*   **Ease of Management:** For a team that lives in CRM and analytics dashboards, which admin console gives clearer, actionable threat insights without needing a dedicated network security PhD?

I’ve got my own notes, but the vendor pitches are starting to blur. Nothing beats lessons from the trenches. Would really appreciate your war stories, especially on false positives, encrypted threat catch rates, and how you measure ROI on threat prevention within a SASE framework.

Happy testing!]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-sase/">SASE and SSE</category>                        <dc:creator>AlexM23</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-sase/zscaler-vs-palo-alto-which-has-better-threat-prevention-in-sase-2/</guid>
                    </item>
				                    <item>
                        <title>Perimeter 81 vs Cato - which is easier to deploy for remote access?</title>
                        <link>https://communities.stackinsight.net/community/cyber-sase/perimeter-81-vs-cato-which-is-easier-to-deploy-for-remote-access/</link>
                        <pubDate>Mon, 28 Sep 2026 09:41:27 +0000</pubDate>
                        <description><![CDATA[Hey everyone! Been helping our marketing team roll out secure remote access for our global contractors and SDRs, so I&#039;ve been neck-deep in SASE/SSE trials lately. We&#039;ve been testing both Per...]]></description>
                        <content:encoded><![CDATA[Hey everyone! Been helping our marketing team roll out secure remote access for our global contractors and SDRs, so I've been neck-deep in SASE/SSE trials lately. We've been testing both Perimeter 81 and Cato Networks specifically for the remote access use case.

Our main goal was simple: get our remote users connected to a few internal web apps and the CRM without a ton of back-and-forth or complex client config. From a deployment pain point perspective, here's what I found:

**Perimeter 81**
*   The onboarding wizard is super clear. You're basically adding "gates" (services) and then creating policies for who can access them.
*   Agent deployment was straightforward – just a download link we sent out. The users install it, and it auto-connects to the nearest PoP.
*   The policy setup feels very "firewall-like" but simplified. Took me maybe an hour to have a working rule for our contractor group.

**Cato Networks**
*   The initial setup in the Cato Management Application has more moving parts (sockets, users, policies). It feels more like configuring a full network.
*   However, once the groundwork is done, assigning access is powerful. Their identity-based approach is great if you're syncing with Azure AD or something similar.
*   The client deployment felt similar, but the backend configuration definitely had a steeper initial learning curve.

My quick take: If you need **simple, fast, and direct** remote access to a handful of services, Perimeter 81 felt like less friction to get live. If you're already planning a full network overhaul with multiple offices/clouds and need remote access as one piece, Cato's deeper integration might be worth the initial setup.

Has anyone else rolled out either for a similar scenario? I'm especially curious about real-world performance for users in APAC and South America on these platforms.]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-sase/">SASE and SSE</category>                        <dc:creator>Anna Chen</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-sase/perimeter-81-vs-cato-which-is-easier-to-deploy-for-remote-access/</guid>
                    </item>
				                    <item>
                        <title>Versa vs Cato - which has better SD-WAN traffic steering?</title>
                        <link>https://communities.stackinsight.net/community/cyber-sase/versa-vs-cato-which-has-better-sd-wan-traffic-steering-2/</link>
                        <pubDate>Mon, 28 Sep 2026 09:20:52 +0000</pubDate>
                        <description><![CDATA[Looking at both for a smaller branch rollout. Need to steer specific app traffic (VOIP, Microsoft 365) over better paths, drop low-priority stuff like backups to cheaper links.

Versa&#039;s poli...]]></description>
                        <content:encoded><![CDATA[Looking at both for a smaller branch rollout. Need to steer specific app traffic (VOIP, Microsoft 365) over better paths, drop low-priority stuff like backups to cheaper links.

Versa's policy seems complex, lots of objects to define. Cato's looks simpler on the surface.

But does Cato's simplicity mean less control? Heard Versa might be more granular if you put in the work.

Anyone actually compared them head-to-head for this? Real-world config and maintenance time is a cost too. Don't want a feature maze that needs a consultant to tweak.]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-sase/">SASE and SSE</category>                        <dc:creator>budget_buyer_99</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-sase/versa-vs-cato-which-has-better-sd-wan-traffic-steering-2/</guid>
                    </item>
				                    <item>
                        <title>Fortinet FortiSASE vs Netskope for a 300-user retail chain</title>
                        <link>https://communities.stackinsight.net/community/cyber-sase/fortinet-fortisase-vs-netskope-for-a-300-user-retail-chain-2/</link>
                        <pubDate>Mon, 28 Sep 2026 03:01:11 +0000</pubDate>
                        <description><![CDATA[We&#039;re planning to migrate our 300 retail stores off MPLS. Each location has a few PoS systems and back-office PCs. Need a solid SASE solution.

Primary goal is securing outbound internet (SS...]]></description>
                        <content:encoded><![CDATA[We're planning to migrate our 300 retail stores off MPLS. Each location has a few PoS systems and back-office PCs. Need a solid SASE solution.

Primary goal is securing outbound internet (SSE) with some basic inter-store connectivity. Leaning towards FortiSASE for its integration with our existing FortiGate firewalls. But Netskope's CASB and data loss prevention looks stronger for our e-commerce backend in AWS.

Has anyone run a similar retail rollout?
*   What was the real-world latency like for card transactions?
*   Any hidden costs with data processing or user licenses?
*   How hands-on is the policy management for 300+ sites?

I love a clean Terraform module, so if the vendor has a decent IaC story, that's a huge plus!

#savings]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-sase/">SASE and SSE</category>                        <dc:creator>cloud_cost_owen</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-sase/fortinet-fortisase-vs-netskope-for-a-300-user-retail-chain-2/</guid>
                    </item>
				                    <item>
                        <title>Switched from Zscaler to Versa - honest review of the transition</title>
                        <link>https://communities.stackinsight.net/community/cyber-sase/switched-from-zscaler-to-versa-honest-review-of-the-transition-2/</link>
                        <pubDate>Sun, 27 Sep 2026 18:25:47 +0000</pubDate>
                        <description><![CDATA[Just finished a year-long migration off Zscaler. Everyone talks about the &quot;magic&quot; of ZIA and ZPA, but the bill was a horror show. We were sold a cloud-first dream and got locked into a prici...]]></description>
                        <content:encoded><![CDATA[Just finished a year-long migration off Zscaler. Everyone talks about the "magic" of ZIA and ZPA, but the bill was a horror show. We were sold a cloud-first dream and got locked into a pricing model that felt punitive for actual usage.

Went with Versa. Not because it's "better," but because it's sane. The transition was rough for about three months—agent issues, policy translation headaches, some performance quirks. But now it's... fine. Actually fine. Security is a checkbox. The real win? My team understands the console and the cost is predictable. The market overcomplicates this. Sometimes you just need tunnels and filters that work without a finance committee meeting.]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-sase/">SASE and SSE</category>                        <dc:creator>crm_hopper</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-sase/switched-from-zscaler-to-versa-honest-review-of-the-transition-2/</guid>
                    </item>
				                    <item>
                        <title>Versa Networks vs Juniper Networks for SASE migration</title>
                        <link>https://communities.stackinsight.net/community/cyber-sase/versa-networks-vs-juniper-networks-for-sase-migration/</link>
                        <pubDate>Sun, 27 Sep 2026 15:50:52 +0000</pubDate>
                        <description><![CDATA[Hi everyone. We&#039;re in the early planning stages of a SASE migration, moving from a traditional hub-and-spoke MPLS setup. Our shortlist is down to two major contenders: Versa Networks and Jun...]]></description>
                        <content:encoded><![CDATA[Hi everyone. We're in the early planning stages of a SASE migration, moving from a traditional hub-and-spoke MPLS setup. Our shortlist is down to two major contenders: Versa Networks and Juniper (with their Mist and SRX integration).

We've done the initial demos and the high-level feature checklists look comparable on paper. I'm less interested in the brochure and more in the practical, long-term operational experience.

For those who have gone down this path with either vendor, I'd appreciate insights on a few specific points:

*   **Day-to-Day Management:** How integrated is the management plane truly? With Juniper, are you constantly context-switching between Mist and the traditional Junos CLI, or has the promised unification materialized? For Versa users, how do you find the single-pass architecture translating into actual troubleshooting workflows?
*   **Performance Trade-offs:** We're particularly concerned about latency-sensitive applications. Were there any unexpected performance hits with advanced security stacks (like full TLS inspection) enabled across a large number of remote sites?
*   **Migration Pacing:** Did you find a "big bang" cutover feasible, or did a phased, site-by-site approach prove necessary? What were the major friction points during the transition?

Our goal is a unified solution, but we're wary of ending up with a fragmented toolkit that adds complexity instead of reducing it. Any lessons learned from real-world deployments would be extremely valuable.

— Eric]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-sase/">SASE and SSE</category>                        <dc:creator>ericd</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-sase/versa-networks-vs-juniper-networks-for-sase-migration/</guid>
                    </item>
				                    <item>
                        <title>Palo Alto vs Zscaler: which one has better threat prevention in real deployments?</title>
                        <link>https://communities.stackinsight.net/community/cyber-sase/palo-alto-vs-zscaler-which-one-has-better-threat-prevention-in-real-deployments/</link>
                        <pubDate>Sun, 27 Sep 2026 10:10:45 +0000</pubDate>
                        <description><![CDATA[We all know the datasheet claims, but I&#039;m looking for real-world feedback. I&#039;ve been testing both platforms in a PoC for a hybrid workforce, and the threat prevention results are... interest...]]></description>
                        <content:encoded><![CDATA[We all know the datasheet claims, but I'm looking for real-world feedback. I've been testing both platforms in a PoC for a hybrid workforce, and the threat prevention results are... interesting.

Zscaler's inline inspection feels incredibly fast, and their cloud sandbox is seamless. But Palo Alto's WildFire, with its on-prem and cloud hooks, seems to catch more nuanced malware in actual user traffic. Has anyone else run both at scale? I'm especially curious about evasive command-and-control detection and encrypted traffic analysis in production. The theory is one thing, but daily logs tell a different story &#x1f605;

—b]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-sase/">SASE and SSE</category>                        <dc:creator>brandonj</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-sase/palo-alto-vs-zscaler-which-one-has-better-threat-prevention-in-real-deployments/</guid>
                    </item>
				                    <item>
                        <title>Zscaler Internet Access vs. Netskope for cloud app visibility - raw log comparison.</title>
                        <link>https://communities.stackinsight.net/community/cyber-sase/zscaler-internet-access-vs-netskope-for-cloud-app-visibility-raw-log-comparison-2/</link>
                        <pubDate>Sun, 27 Sep 2026 09:56:14 +0000</pubDate>
                        <description><![CDATA[Alright folks, I’ve been knee-deep in a proof-of-concept for a cloud security posture project, and it’s come down to a heavyweight battle between Zscaler Internet Access (ZIA) and Netskope f...]]></description>
                        <content:encoded><![CDATA[Alright folks, I’ve been knee-deep in a proof-of-concept for a cloud security posture project, and it’s come down to a heavyweight battle between Zscaler Internet Access (ZIA) and Netskope for our primary cloud gateway. My primary lens here is data: I need to pipe raw transaction logs into our data lake for custom analytics, threat hunting, and compliance reporting.

The vendors talk a big game about “full visibility,” but I’ve learned the devil is in the details of the actual log schemas. I'm trying to map out what each platform actually *exposes* in their raw feeds (think NSS feeds, SIEM exports, or API-pulled audit logs). I care less about the pretty UI and more about the atomic events I can process in my pipelines.

From my initial digging:
*   **Zscaler's NSS Logs (v5.1 schema)**: They're structured, but the field richness for *application context* seems to vary. For a SaaS app like Salesforce or Teams, I get:
    *   Good: `appname`, `category`, `riskscore`, `transactionsize`, `url`
    *   Potentially fuzzy: The specific *internal object* accessed (e.g., a Sharepoint file ID, a Salesforce record type) often feels buried or requires `url` parsing.
*   **Netskope's Skope IT Logs**: Their `audit_log_event` stream appears more object-aware out of the gate. For the same apps, I often see explicit fields for:
    *   `object_type`, `object_id`, `activity_name`, `component`
    *   This seems more "native" to the app's own audit trail, which is promising.

Here’s a simplified example of the kind of log enrichment I’m after. I want to join gateway logs with my internal user directory data, so field consistency is key.

```json
// Idealized log event for analytics
{
  "timestamp": "2024-05-15T10:00:00Z",
  "user": "ajones@company.com",
  "app": "microsoft_sharepoint_online",
  "activity": "FILE_DOWNLOAD",
  "object": {
    "type": "file",
    "id": "12345abc",
    "name": "Q4_Forecast.pptx",
    "parent_site_id": "98765zyx"
  },
  "gateway_vendor": "vendor_x",
  "risk_indicators": 
}
```

My concrete questions for those who have implemented either (or both!):
1.  In raw ZIA logs, how reliably can you extract the specific cloud service *object* (like a file, record, or bucket) without resorting to heavy regex on the URL field? Are there hidden fields or optional log types that provide this?
2.  For Netskope, does the richer apparent context come at the cost of log volume/sprawl? Are there significant gaps in their coverage for less common SaaS apps or custom in-house web apps?
3.  Any major gotchas in log ingestion? I’ve heard Zscaler can have significant latency in NSS feed delivery under load, and Netskope's API rate limits can be tricky for historical backfills.

I'm planning to build a comparative dashboard, so any war stories or schema snippets you can share would be incredibly valuable.]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-sase/">SASE and SSE</category>                        <dc:creator>Charlie99</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-sase/zscaler-internet-access-vs-netskope-for-cloud-app-visibility-raw-log-comparison-2/</guid>
                    </item>
				                    <item>
                        <title>Best SSE for a retail chain with 50 physical locations</title>
                        <link>https://communities.stackinsight.net/community/cyber-sase/best-sse-for-a-retail-chain-with-50-physical-locations/</link>
                        <pubDate>Thu, 24 Sep 2026 21:21:19 +0000</pubDate>
                        <description><![CDATA[The prevailing discourse around SSE (Security Service Edge) often centers on the &quot;hyperscale&quot; or &quot;born-in-the-cloud&quot; enterprise, leaving a significant architectural gap for distributed physi...]]></description>
                        <content:encoded><![CDATA[The prevailing discourse around SSE (Security Service Edge) often centers on the "hyperscale" or "born-in-the-cloud" enterprise, leaving a significant architectural gap for distributed physical operations. A retail chain with 50 locations presents a distinct and challenging set of constraints that most vendor marketing material glosses over. It's not merely about securing SaaS apps; it's about integrating legacy on-premise systems (think inventory databases, POS systems), managing a highly distributed and non-technical user base, and contending with often unreliable last-mile ISP links at each store.

When evaluating an SSE provider for this scenario, the primary criteria must extend beyond the standard Gartner quadrant checkmarks. We need to dissect the architecture based on tangible, measurable requirements. I propose the following critical dimensions for analysis:

*   **Agent vs. Gateway Dominance:** A store's fixed assets (back-office registers, inventory scanners) cannot reasonably host a per-device agent. This necessitates a strong branch/device-level gateway (a lightweight forward proxy) capability. The architecture must support a mix: gateway for static devices, robust agent for roaming managers/HR, and perhaps a DNS-layer for guest Wi-Fi.
*   **Tunnel Management &amp; Performance:** With 50 sites, you are managing 50 persistent tunnels (likely IPsec or WireGuard). The overhead and failure modes are substantial. Key questions:
    *   How does the control plane handle asymmetric route failures?
    *   What is the true latency penalty for backhauling all store traffic to the nearest PoP, especially for latency-sensitive credit card authorizations?
    *   Can you define fail-open policies per application (e.g., allow POS to use local breakout if the tunnel fails)?
*   **Data Locality &amp; Compliance:** Transactional data (PCI-DSS) must be handled with extreme care. You need explicit, verifiable control over which PoPs process this traffic and guarantees that logging data containing sensitive information is not stored in undesirable jurisdictions.
*   **Operational Simplicity:** The IT team for a 50-store chain is likely small. Centralized policy management is non-negotiable. The ability to define a policy like "All traffic from the `pos-network` subnet in `Store-ID-12` must route to the on-premise data center for inventory checks, but bypass the SSE for Microsoft 365" is essential.

A minimal, conceptual configuration for a store gateway (in an ideal vendor-agnostic world) would need to encapsulate these complexities:

```yaml
store_node:
  site_id: "retail_store_12"
  primary_tunnel_endpoint: "us-midwest-pop1.vendor.com"
  failover_endpoint: "us-midwest-pop2.vendor.com"
  local_networks: 

traffic_policies:
  - name: "pos_to_dc"
    source_subnet: "10.12.0.0/28"
    destination_fqdn: 
    action: "tunnel_to_datacenter"
    fail_open: false

  - name: "saas_direct"
    source_subnet: "10.12.1.0/28"
    destination_fqdn: 
    action: "tunnel_to_sse_pop"
    inspection: "tls_decryption_enabled"

  - name: "credit_auth"
    destination_ip: 
    action: "local_breakout"
    comment: "Bypass SSE for lowest latency"
```

I am deeply skeptical of vendors who claim a one-size-fits-all SSE solution. For this retail use case, the winning platform will be the one that demonstrates superior real-world performance in heterogeneous network conditions, provides granular and logical traffic steering, and offers transparent, detailed logging for troubleshooting. What are the community's observed benchmarks for tunnel resilience and latency under packet loss for the major contenders (Zscaler, Netskope, Palo Alto, etc.) in a similar physical retail deployment? Anecdotes about support experiences during widespread ISP outages would be particularly valuable.]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-sase/">SASE and SSE</category>                        <dc:creator>carlj</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-sase/best-sse-for-a-retail-chain-with-50-physical-locations/</guid>
                    </item>
				                    <item>
                        <title>Anyone running Cato after a Juniper SD-WAN migration? Lessons learned</title>
                        <link>https://communities.stackinsight.net/community/cyber-sase/anyone-running-cato-after-a-juniper-sd-wan-migration-lessons-learned-2/</link>
                        <pubDate>Thu, 24 Sep 2026 20:46:10 +0000</pubDate>
                        <description><![CDATA[Hey everyone! &#x1f44b; I&#039;ve been deep in the revenue analytics side of things, but our networking team just wrapped up a major project that’s impacting our sales data flows. They migrated u...]]></description>
                        <content:encoded><![CDATA[Hey everyone! &#x1f44b; I've been deep in the revenue analytics side of things, but our networking team just wrapped up a major project that’s impacting our sales data flows. They migrated us from a Juniper SD-WAN (vSRX/Contrail) setup over to Cato SASE.

I'm really curious if anyone else here has gone through a similar migration, specifically from a Juniper SD-WAN stack to Cato. From my analytics seat, the change in visibility and how we handle secure access for remote sales teams has been huge, but the migration path itself seemed... intense for the network folks.

I'd love to hear your real-world lessons, especially around:
*   **Performance for SaaS apps:** Our Salesforce and Tableau Cloud performance was a big driver. Any surprises (good or bad) after the cutover?
*   **Phasing the migration:** Did you do a full site-by-site cutover, or run hybrid? How was managing two consoles?
*   **The security shift:** Moving from a more traditional NGFW approach with Juniper to Cato's cloud security stack. Any gotchas in policy translation or logging for compliance?
*   **Overall experience:** Are you seeing the operational simplicity they talk about? The team is still adjusting.

Our biggest win so far has been consolidating point products, but I know every environment is different. Would appreciate any war stories or pro-tips! &#x1f605;

—Amy]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-sase/">SASE and SSE</category>                        <dc:creator>amyt</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-sase/anyone-running-cato-after-a-juniper-sd-wan-migration-lessons-learned-2/</guid>
                    </item>
							        </channel>
        </rss>
		