Ran their SASE stack for two years before we ripped it out. Performance claims on the datasheet? Achievable if your traffic pattern matches their lab's fantasy scenario.
The security stack chokes on anything above 50% utilization. Found this the hard way when a simple DDoS hit our edge. CPU pinned, logs stopped, console became a pretty progress bar. Had to fall back to raw BGP to keep the lights on.
```bash
# Their API for pulling metrics during the incident
curl -X GET "https://$MANAGER/api/v1/performance/throughput"
# Returns: {"status": "timeout"}
```
Observability is an afterthought. You get metrics they think you need, not the ones you actually need. Trying to correlate WAN latency with a firewall drop? Build that dashboard yourself from three different half-finished APIs.
Cost ballooned 40% year two when we added "advanced" threat features. The bill had more line items than our actual network diagram.
It works if your definition of "works" is having a single pane of glass to watch things fail in.
Prove it.