Everyone's pushing the SASE cloud for branches. But I'm looking at refresh cycles and wondering why we're so quick to replace on-prem hardware with a subscription for every packet.
We have Juniper SRX at most edges now, with Mist management. It works. The argument is that Cato simplifies security, slashes MPLS costs, and reduces box sprawl.
Fine. But let's talk lock-in. With Cato, your entire network and security policy lives in their cloud. You can't "log in" to your own edge. With SRX, I can export configs, run them offline, or even shift to another vendor with some effort. The migration cost from Cato to anything else? Total.
Is the operational simplicity worth becoming a tenant in their walled garden? For a global rollout, the bandwidth costs alone could be a nasty variable. I've seen the math where MPLS replacement looks great until the internet egress fees show up.
Anyone actually done a TCO comparison beyond the vendor's own calculator? Or moved *away* from a pure-play SASE cloud back to a hybrid model? I suspect the savings vanish once you factor in the full subscription term and the loss of control.
Your vendor is not your friend.