Cato Networks

Overview

Cato Networks sells a single-vendor SASE platform, the Cato SASE Cloud, which converges SD-WAN, security service edge (ZTNA, SWG, NGFW, IPS, CASB, DLP), and newer XDR and IoT/OT modules into one cloud service. Founded in 2015 in Tel Aviv by Shlomo Kramer and Gur Shatz, it is privately held. In June 2025 it announced a 359 million dollar Series G at a valuation above 4.8 billion dollars, taking total funding past 1 billion dollars, and said it had more than 3,500 enterprise customers (a company figure).

Everything connects to Cato's points of presence (PoPs): branches through Socket appliances, remote users through the Cato Client or clientless access, and clouds through IPsec or virtual Sockets. Cato's documentation describes the PoPs as an SLA-backed backbone interconnected by multiple tier-1 carriers and peered with more than 500 networks.

What they are good at

Convergence that is native rather than acquired. One policy engine and one console (the Cato Management Application) cover site-to-site, remote user, and internet traffic, so access rules and inspection are written once. For identity-based access, Cato's ZTNA supports client and clientless access, device posture, pre-login and always-on modes, and inspection across all ports and protocols rather than only web traffic. Users and groups sync from Microsoft Entra ID, Okta, or OneLogin over SCIM, with changes applied in near real time. For organizations replacing MPLS, branch connectivity and remote access come from the same backbone, which removes a whole class of integration work.

Where they fall short

The model is all-in. You get Cato's SWG, CASB, and DLP rather than your preferred point products, and moving off later means replacing networking and security together. There is no self-operated deployment: even a Private PoP in your own data center is run remotely by Cato, so air-gapped or sovereign-control requirements are out of reach. Network rollout involves shipping and installing Sockets at every site, so in our assessment a full migration is a multi-quarter program, not a software install. Cato is not an identity provider; you need an IdP for SSO and MFA. Published capability claims (PoP counts, customer numbers) come from Cato itself, which is why our confidence is medium.

Pricing

Quote-based subscription across sites and remote users; Cato does not publish list prices, so expect a sales-led design and quote. See the Identity Pricing Transparency Index for how SASE vendors compare on disclosure.

Best for, and who should look elsewhere

Choose Cato if you are a distributed enterprise retiring MPLS and legacy VPN at the same time and you want one vendor accountable for both. If you only need private app access, Twingate is far lighter. If you want SSE without handing over the WAN, compare Zscaler, Netskope, and Cloudflare (see Cloudflare vs Zscaler), or Cisco Secure Access for Cisco shops. More context: the best zero trust tools ranking.

Bottom line

Cato is the cleanest single-vendor SASE for enterprises that want networking and security from one cloud and are willing to commit both to one supplier.