Everyone's pushing SASE as a cost-saver for distributed startups. I'm calling it: the operational cost delta between vendors will eat your lunch faster than any bandwidth fee. You're a 50-person startup. You think you're comparing security postures, but you're really comparing unpredictable billing models.
For a shop your size, I need to see the real numbers before any architecture chat. Both Cato and Perimeter 81 are opaque with their pricing until you talk to sales. The advertised "per user" cost never includes the infrastructure markup.
* What's your actual cloud spend breakdown? (AWS/Azure/GCP)
* How many of your 50 are truly remote vs. in an office with a site appliance?
* What's the monthly data egress volume from your primary cloud region?
You can't evaluate this without the bill. I've seen startups get burned by the "througput packs" and "premium support" add-ons that aren't in the initial quote. The performance talk is irrelevant if the cost model forces you to throttle traffic.
Post your last month's cloud provider invoice (redacted, obviously). Otherwise, you're just comparing marketing decks.
show me the bill
I'm a senior dev at a 60-person fintech with a fully remote team, running all our internal services and prod workloads on AWS. We trialed both solutions for four months before committing.
1. **Real pricing for your size:** Cato's entry point is around $1800/month for 50 users with their basic SASE bundle, but that's before their required "performance assurance" add-on for consistent latency, which tacks on another $400-600. Perimeter 81's advertised $8/user/month balloons to roughly $12-13 once you add the "Business" features you'll need, like IdP integration and reasonable support. Neither quote includes the egress cost from your cloud to their POPs.
2. **Deployment and config debt:** Perimeter 81 wins on initial setup. We had agents on all dev machines in an afternoon. Cato requires deploying a client tunnel config file per device type, which is fine until you're manually revoking 50 configs after a team member leaves. Their admin UI is a labyrinth of policy objects.
3. **The throughput trap:** Cato's per-connection throughput caps are soft until they're not. We saw a 50 Mbps cap on a "standard" tunnel during a large S3 sync, which required a support ticket to lift. Perimeter 81's limits are clearer but lower; expect throttling alerts above 30 Mbps per user unless you pay for their "Premium Bandwidth" tier, another 20% surcharge.
4. **Where they actually break:** Cato's TCP acceleration broke our WebSocket connections to a Redis cache, requiring a custom policy rule that took their support 72 hours to diagnose. Perimeter 81's agent silently fails on macOS after major OS updates, requiring a manual reinstall we've scripted. Both failovers add 200-300ms of latency when a POP drops.
My pick is Perimeter 81, but only for a fully remote, sub-100-person team that values simple client setup over deep traffic inspection. If you have a central office or cloud VPC that needs a permanent site-to-site tunnel, Cato's model makes more sense. To decide, tell us what percentage of your team is outside a 500-mile radius of your main cloud region, and whether you need to inspect encrypted traffic beyond basic firewall rules.
prove it to me