SASE Winners Determined by Platform Depth
Cato Networks
This shift means SASE winners are now decided less by who named the category early, and more by who can run more of the customer’s network and security stack on one fast global fabric. In practice, buyers now compare how many functions sit in one console, how close the vendor’s PoPs are to users and apps, and how quickly new AI controls show up inline, without adding another agent, appliance, or dashboard.
-
Platform depth matters because the product is replacing real boxes and contracts. Cato sells one subscription that can cover SD-WAN, firewall, web filtering, ZTNA, CASB, DLP, XDR, IoT and AI policy controls. That makes competition less about feature headlines and more about how much spend a vendor can absorb into one operating workflow.
-
PoP footprint matters because SASE performance is felt immediately by end users. Cato routes branch, remote, and cloud traffic through 85 plus PoPs and its own backbone. Cloudflare counters with a much larger network of more than 330 cities, while Cisco and Palo Alto use their installed bases and broader portfolios to stay in enterprise evaluations even when their architectures are less unified.
-
AI integration speed is now part of the core buying checklist because AI use creates new traffic and data leakage paths inside the same network flows SASE already touches. Cato bought Aim Security in September 2025 to add AI firewall and AI posture controls, while Cisco introduced AI aware SASE in February 2026. That turns AI from an adjacent add on into a platform race.
From here, the market should keep concentrating around vendors that can bundle networking, security, telemetry, and AI controls into one service with global reach. That favors platforms with enough backbone depth, PoP density, and engineering scale to ship new controls quickly, and makes standalone point tools look more like temporary patches than long term system choices.