Everyone recommends Versa SASE without mentioning the bill. It's a budget killer for mid-market.
You need a stack you can actually afford.
* **Core requirement:** SD-WAN + ZTNA + basic FWaaS.
* **Avoid:** Full-featured CASB and advanced AI/ML features you won't use. They cost 3x.
Realistic alternatives:
* **FortiGate SASE:** Their pay-as-you-go is clearer. You can start with just ZTNA and SD-WAN. Watch for support costs.
* **Cato Networks:** Flat per-site pricing simplifies everything. Their PoP egress costs are predictable.
* **DIY with Open Source:** Consider Netbird for ZTNA + a cloud virtual appliance (like VyOS) for SD-WAN. This is the cheapest path but needs internal skill.
Key questions:
* What's your actual bandwidth per site?
* Can you commit to a 1-3 year term for discounts?
* Have you ruled out a simple VPN with a cloud firewall manager?
show me the bill
I'm the security lead for a 250-person manufacturing firm. We migrated off a big-vendor SASE platform last year and now run a hybrid of Netbird for internal access and FortiGate-VMs for site-to-cloud.
**Core Comparison**
* **Realistic Mid-Market Budget:** Versa's quote for our 20 branch sites was over $85k/year. Cato's flat per-site model came in around $45k. The FortiGate SASE pay-as-you-go for just SD-WAN/ZTNA ran $28k on a 3-year term.
* **ZTNA Deployment Friction:** Fortinet's integration requires their Fabric Agent on endpoints; it's reliable but a second agent if you aren't already using FortiClient. Cato's is a single agent. Netbird's open-source ZTNA took two weeks to harden and automate but costs $0 in licensing.
* **Operational Visibility & Breakage:** Cato's single pane is genuinely simple, but custom logging exports are a paid add-on. Fortinet's dashboard has a learning curve; we had a 4-hour routing outage traced to an auto-applied 'optimization' template. You need to lock those down.
* **Hidden Cost Triggers:** With Cato, predictable PoP egress is great until you need a dedicated MPLS-style circuit for a legacy site - that's a separate quote. Fortinet's support is an extra 22% annually; you *need* it for firmware updates. Bandwidth scaling with Versa or Fortinet can blow models up if you don't cap throughput per site.
**My Pick**
I'd recommend FortiGate SASE if you can commit to a 3-year term and have someone to manage the config minutiae. For true set-and-forget, Cato is the safer bet. To decide, tell us your highest-risk site's bandwidth and whether you have in-house staff who can handle CLI-level troubleshooting.
- Nina
Your point about avoiding overpriced add-ons is spot on. That's where a lot of vendors hide the real cost.
One caveat on FortiGate SASE: the pay-as-you-go is clearer, but watch the bandwidth tiers. If you have a site that bursts over its committed tier just once, the bill shock is real. Their support costs also scale with the license tier, which they don't always mention upfront.
For your DIY open source path, I'd swap VyOS for OpenWRT in a cloud VM if you're truly budget-constrained. The config is simpler for basic SD-WAN policies and it's lighter on resources.
Build once, deploy everywhere