Cato's Greenfield Sales Challenge
Cato Networks
The real edge for Palo Alto Networks and Cisco is not just bigger sales teams, it is that they can turn an existing box in a branch into the starting point for a broader SASE deal. A company already running Palo Alto firewalls or Cisco SD-WAN can add cloud security, remote access, and policy controls during a normal refresh cycle, while Cato usually has to win a full rip and replace before it can land the account.
-
Cato sells a cleaner architecture, one console, one backbone, one policy engine, but that simplicity matters most when a customer is willing to redesign the network. In large enterprises, branch hardware, renewal calendars, and channel relationships often matter more than technical elegance in getting the first deal signed.
-
Palo Alto can cross sell SASE from a large firewall footprint and nearly $5.8B of next generation security ARR, which funds more channel coverage and product bundling. Cisco has over 340,000 SD-WAN sites and is embedding SASE into routing, switching, and Meraki environments customers already operate.
-
This is why Cato leans on greenfield and simplification driven wins. It is strongest where the buyer wants to replace MPLS, VPN, firewall appliances, and separate security tools in one move, or where Cisco and Palo Alto’s multi console sprawl has become painful enough to justify a full migration.
Going forward, the market should split more clearly between incumbents harvesting their installed base and cloud native vendors winning full redesigns. Cato’s path is to make those redesigns easier to justify, then expand inside accounts with added modules like ZTNA, XDR, IoT/OT security, and AI controls after the initial network replacement is done.