Cato Networks SD WAN & SASE Cybersecurity Solutions

Cato Networks SD WAN and SASE Solution: Comparisons, Review, Benefits, Use Cases, Pros & Cons

Author: Netify Research Team

If you have questions about Cato Networks and how their capability is aligned to your needs, email the Netify research team.
UK: uk@netify.co.uk North America: northamerica@netify.com

(Please use the UK email for ROW - Rest of the World - questions or inquiries)

Netify Review

Cato's offering is rare, in that they are one of few vendors who offer both overlay (SD WAN, SASE) and underlay (global private backbone) as well as managed services. The difference between Cato and other vendors is that usually the vendor offers overlay, such as SD WAN and forms partnerships with Managed Service Providers (MSPs) to offer underlay and management of the solution. This is why Cato is a strong choice for companies looking for a comprehensive single-vendor solution and for large global enterprises requiring connectivity to multiple sites worldwide, as they can make use of Cato's network of over 60 PoPs worldwide (including in China, an area that is typically difficult to reach). 

Cato mainly operate with small-medium sized businesses and have a strong presence in North American and Asia/Pacific markets. Although in a majority of use cases their out of the box SASE and SD WAN solutions are a good fit, for companies that require complex offerings, Cato lacks the essential granular features.  

Cato have expertise in security solutions (SASE) and a competitive edge across threat intelligence. Their security-as-a-service solution performs to a high degree of accuracy when compared to rival offerings. Cato also have a very low false positive rate, avoiding downtime by keeping applications running unless there is a genuine security threat.

About Cato Networks

Cato Networks is an SD WAN and SASE security vendor based in Tel Aviv, Israel. The company was founded in 2015 by Shlomo Kramer and currently employs approximately 500 staff worldwide.

Cato caters to both regional and international needs, via a global private backbone for large worldwide firms, whereas regional needs are secured through a single cloud service. Their deployment regions include North America, the United Kingdom, Canada, Latin America, South Africa, Africa, Europe, the Middle East, Australia and Asia/Pacific Countries. 

What is the Cato Networks SD WAN Solution?

Cato’s SD WAN offering combines the benefits of WAN Edge, a global backbone and their full network security stack (See, What is the Cato SASE Security Solution?). Their SD WAN offering is available as a managed service, with full cloud functionality, connecting all enterprise resources, physical locations, cloud datacenters and mobile workforces into one seamless network - meaning there is no need for a multiple point solution. 

Part of Cato’s SD WAN offering is their Socket SD WAN Device. The device is designed to connect a physical location to the nearest Cato point of presence (PoP) using any number of last mile connections. Clients are able to choose a mix of fiber, cable, xDSL and 4G/LTE connections. 

Cato’s SD WAN offering is cloud native - it combines networking and security into one managed cloud. This means that no proprietary hardware is required to run in the cloud, such as global routing, security and management. They also offer a hybrid solution for enterprises looking to either augment or replace their MPLS, removing the need for branch security appliances and supporting cloud applications and mobile users. 

Configuration-Based Key Features

Security-Based Key Features

• Security as a Service: Cato’s Security as a Service builds a high grade security stack into Cato SASE and Cloud features (See What is the Cato SASE Security Solution?)

Performance-Based Key Features

What is the Cato Networks SASE Security Solution?

Cato's SASE security solution is cloud-native and built directly into its global backbone. Available both regionally and globally, it is accessible even by remote users. Users and resources are identity-driven, meaning each network connection is associated with an identity. Users can leverage a set of networking and security policies regardless of location, reducing operational overheads. The SASE offering is also cloud-native, leveraging key cloud capabilities such as elasticity, adaptability, self-healing and self-maintenance - lowering costs and improving efficiency. Further, Cato's security offering can support all Edges - meaning that the SASE creates one network for all company resources such as data centres, branch offices, cloud resources and mobile users. 

Cato offers their full network security pack built directly into their global backbone, called 'Security-as-a-Service'. This solution avoids the need for backhauling traffic to specific choke points and third-party security products that require chaining together. All SASE policies are cloud-native. Cato's security-as-a-service is also directly integrated into the Cato Cloud network. This multi-layered system provides uniform security solutions and policies with global reach, provisioning integrated flexibility of the cloud. Cato uses Next Generation Firewall and a Secure Web Gateway to provide granular access management to internet-bound traffic and web access control. 

Cato's cloud-native SASE solution is distributed over the global private backbone to ensure that a single, interconnected facility addresses security and network requirements. 

Security as a Service (SSE 360) comes with several key features: 

• Firewall as a Service (FWaaS): Application-aware firewall-as-a-service (FWaaS). Cato can deliver firewall and network security capabilities with cloud service. Clients can access network security (URL Filtering, IPS, AM, NG-AM, Analytics, MDR) in any location, removing the need for appliance form factor firewalls.
• Secure Web Gateway (SWG): Included in the security pack is Secure Web Gateway (SWG). The SWG focuses on layer seven web traffic inspection, inbound and outbound, protecting against phishing, malware and many other internet-borne threats. Because it is cloud-based, security is available to remote users outside the office.
• Managed Threat Detection and Response Services (MDR): Designed to detect and eliminate malware threats, it offloads compromised endpoints to Cato's security operation centre team. It offers: automated threat hunting, which looks for anomalies across flows in Cato's data warehouse, correlating them with threat intelligence sources and complex heuristics; expert threat verification, Cato's security researchers evaluate the validity and risk level in flagged endpoints, removing the risk of false threats; threat containment, verified threats are automatically contained by blocking IP addresses and C&C domains, which disconnects compromised machines and users from the network; and guided remediation, Cato's security operation centre offers advice on the risk's level threat, and give recommendations on how to fix the problem, following up until the danger is completely removed.
• Cloud and Data Security: Enables control and visibility into cloud-hosted applications by leveraging Cato's Cloud Access Security Broker (CASB) and Data Loss Prevention (DLP).
• Cloud Access Security Broker (CASB): Provides insights into cloud application usage across sanctioned and Shadow IT applications, assessment of SaaS application potential risk, and definition of access rules
• Data Loss Prevention (DLP): Used to achieve regulatory compliance and protect sensitive data, preventing data from being extracted or uploaded to the cloud or physical data centres. 
• Advanced Threat Prevention: Features Casto Intrusion Prevention System and Next-generation Anti-Malware capabilities 
• Next-Generation Anti-Malware: Multi-layered and tightly-integrated anti-malware engines, including Cato's own and NGAM, delivered through a partnership with SentinelOne
• Managed Intrusion Prevention System (IPS): Cloud-based, fully managed IPS service

How does Cato Networks access cloud vendors?

Cato use their global backbone to integrate with major Cloud vendors (such as Amazon AWS, Microsoft Azure and Google Cloud) via IPsec tunnels. Traffic is optimally routed from the Edge direct to cloud providers - this eliminates the need for premium cloud connectivity solutions (such as AWS DirectConnect or Microsoft Azure ExpressRoute) making Cato’s offering simpler and more cost-effective.

Does Cato Networks offer WAN acceleration and optimization?

Cato’s WAN offering is optimized via a native cloud software, Cato Cloud. Cato uses packet duplication, correction and last-mile methods to improve the reliability of the network. Cato Cloud, integrated with the global private backbone has a 99.999% uptime SLA and the global PoP network is supported by various Tier-1 ISPs. The network is optimized to improve traffic flow by reducing latency issues. Cato’s offering reduces costs as its functionality does not require the use of Azure ExpressRoute or AWS Direct Connect. Optimization for mobile negates the need for backhauling as remote users can access the network through the nearest Cato PoP.

How does Cato Networks support remote users?

Cato is able to provide substantial support to individual remote users by connecting on-site or cloud data centers to the Cato SASE cloud. The global private backbone can be accessed either through the Cato client or client-less browser by remote users whose traffic can be routed to cloud applications on premises through the nearest PoP. Remote access is available to multiple users globally and is guarded by Cato’s security-as-a-service stack to ensure data traffic is protected.

What is the Cato Networks managed, co-managed and DIY services solution?

Cato’s managed services offering includes: Hands-free management, Intelligent last-mile management, managed SASE service, managed threat detection and response (MDR).  The advantage of Cato’s SASE platform offering is that due to its strong in house support and partnerships, it is very cost efficient with a notable lack of third party royalties. Cato’s offering is reliable and affordable for a global connectivity solution. Cato’s SD WAN offering can be DIY, co-managed or fully managed with support from Cato and partners.

What Reporting and Management is available via the Cato Networks Portal?

The Cato portal provides users with traffic summaries and application usage data. The system is single glass plane and shows network activity from different resources and top applications in the previous 24 hour period. The Cato portal allows users to view overall network activity and the ability to configure, manage & troubleshoot networks from a single system.

What is the Cato Networks SLA?

Below is a table displaying the main focus points of the Cato Networks Service Level Agreement (SLA).