What Is Cato Networks? Cato SASE, Explained for 2026

Cato Networks is a SASE company that started as a network company and stayed proud of it. The pitch: replace your MPLS, your branch firewalls, and your remote access VPN with one global cloud, and get security as part of the package. That pitch has made Cato a Gartner Leader three years running and one of the most valuable private companies in security. So what is Cato Networks, exactly, how does Cato SASE work, and who is it built for heading into 2027? Here is the straight answer.

If you are already comparing vendors, our head-to-head on Cato Networks vs Zscaler is the fastest way in.

The short answer

Cato Networks is a Tel Aviv-based SASE vendor that runs its own global private backbone of more than 85 points of presence (PoPs). Sites connect through Cato Socket appliances, cloud workloads through vSockets, and remote users through the Cato Client or browser-based options. Cato inspects all of that traffic in its cloud with a single-pass engine that handles firewall, secure web gateway, IPS, CASB, DLP, and more.

Put simply, Cato is a network company that sells security as a property of its backbone. That is a great fit if you have a lot of WAN to fix. If most of your people work from laptops on home and hotel networks, you are buying a backbone to solve a device problem. dope.security takes the opposite approach: it inspects traffic on the device and sends it direct.

What is Cato Networks? The company in 2026

Shlomo Kramer, who remains CEO, and Gur Shatz founded Cato in 2015. Kramer previously co-founded Check Point and Imperva, which helps explain why Cato has never been shy about taking on incumbents.

The numbers, as of late 2026:

• Revenue. Cato says it passed $415 million in annual recurring revenue on July 27, 2026, up 42% year over year, and now serves more than 4,800 customers.
• Funding. Cato raised a $359 million Series G in June 2025 at a valuation above $4.8 billion, bringing total funding past $1 billion.
• IPO. Cato is still private. Its leadership has said it has not stopped planning an IPO, but it has not filed.
• Acquisitions. Cato bought Aim Security in September 2025 to build out AI security.

On the analyst side, Cato announced on July 31, 2026 that it was named a Leader in the 2026 Gartner Magic Quadrant for SASE Platforms for the third year in a row. SDxCentral's coverage of the report placed Cato second among the Leaders, behind Netskope, and noted Gartner's cautions: a newer modular adoption approach, pricing higher than others in the market, and a comparatively low financial score.

How Cato SASE works

Cato's architecture has three parts. They only make sense together.

• The backbone. Cato operates a private global network of 85+ PoPs, linked by its own backbone instead of the public internet.
• SPACE, the single-pass engine. Inside each PoP, the Single Pass Cloud Engine runs firewall as a service, secure web gateway, IPS, CASB, DLP, remote browser isolation, ZTNA, and anti-malware in one pass over each flow. In March 2026 Cato added Neural Edge, which puts NVIDIA GPUs inside PoPs to run AI inspection inline.
• The edges. Physical sites connect with Socket appliances, cloud sites with vSockets, and third-party gear over IPsec. Remote users run the Cato Client. Cato also offers a browser extension, a clientless portal, and, as of Q2 2026, the Cato Enterprise Browser.

For a remote user, the model is a tunnel to the cloud. The Cato Client connects to the best PoP based on location and live latency and packet-loss measurements, and inspection happens there. If you want the background on why SASE and SSE draw the line where they do, read SASE vs SSE architecture.

What changed at Cato in 2026

2026 was a busy year. The changes worth knowing before you evaluate:

• Cato AI Security. Built from the Aim Security acquisition and introduced in March 2026, it covers employee use of public AI tools, homegrown AI apps, and AI agents. Cato says it has since expanded coverage to local, managed, and homegrown agents.
• Modular adoption. In Q2 2026 Cato introduced a modular adoption model so customers can start with the capabilities they need and expand later. That is a notable shift for a vendor that has always sold the whole platform.
• Enterprise Browser. Launched in Q2 2026 to extend Cato's ZTNA to unmanaged and third-party users.
• Ecosystem integrations. Cato announced integrations with CrowdStrike for unified security operations and with Cyera for DSPM.
• Faster CVE response. Cato says its agentic CVE mitigation cut time-to-protect for newly disclosed vulnerabilities to 45 minutes.

Does Cato add latency for remote users?

For sites, Cato's backbone can beat the public internet between offices. That is the core of its value. For a laptop on home Wi-Fi reaching a SaaS app, the picture changes. The request goes up a tunnel to a Cato PoP, gets inspected, then heads to its destination. A good backbone speeds up the middle of the trip. It does not remove the first leg.

Measured cloud-proxy latency typically runs 40 to 80 milliseconds near a PoP and 150 to 400 milliseconds when users are far from one, and a modern SaaS page chains dozens of requests. We walk through the arithmetic in the latency math behind cloud proxy SWGs.

How much is the detour costing you? Run the Fly-Direct Speed Test on this page to measure your real round-trip latency and compare a cloud PoP detour with inspection on the device. Can't run it? Book a 20-minute demo and we will run it with you.

The takeaway: a private backbone speeds up the middle of the trip. On-device inspection removes the trip.

What Cato does well

Credit where it is due. Cato has earned its reputation.

• WAN consolidation. If you are retiring MPLS and branch firewalls across dozens of sites, one vendor for SD-WAN and security is a real simplification. Carrefour, for example, says it connected and secured 2,000 locations on Cato in a year.
• Built as one product. Cato built its platform instead of stitching together acquisitions, and users consistently praise the single management interface.
• Single-pass inspection. Running every engine in one pass is a clean design that avoids the stacking penalties of multi-module proxies.
• Customer experience. Gartner's 2026 report, per SDxCentral, credited Cato with above-average customer experience.

Where Cato falls short heading into 2027

Most of the trade-offs trace back to one fact: Cato is priced and built around the network.

Licensing still follows sites and capacity

Cato's product catalog has licensed sites by bandwidth (bandwidth pools or per-site bandwidth) and remote users as ZTNA users per region group, with security capabilities such as Threat Prevention, CASB, DLP, and AI Security sold as add-ons. The catalog has also required several of those add-ons to cover your total licensed capacity. The new modular adoption model may loosen that, so ask for it in writing. Either way, for a mostly remote company, the bill is shaped by a backbone and capacity model, not by the laptops you are trying to protect. Gartner's pricing caution points the same direction.

Remote users still ride a tunnel

Every Cato Client connection ends in a PoP, because that is where inspection happens. Like every cloud inspection model, certificate-pinned apps break under TLS inspection and need bypasses. We explain why in certificate pinning and SSL inspection.

China works, within the rules

Cato documents its China design clearly. China PoPs egress in-country, so the Great Firewall still applies, and Cato's terms prohibit using a non-China PoP to get around it. Cato has also listed browser-based access options as unsupported in China. For the broader picture, see cloud proxy SSE in China and restricted regions.

AI security lives in the PoP

Cato AI Security is a serious investment. It also sits in the PoP and is licensed as an add-on. The hard AI test is the same for every vendor: allow the corporate ChatGPT workspace, block personal ChatGPT on the same domain, and read the prompt before it leaves. We walk through it in how to block personal ChatGPT while keeping the corporate account.

Cato Networks vs dope.security

Both platforms protect remote users. They start from different problems.

• What it is built to fix. Cato replaces the WAN and branch security stack. dope.security secures the device wherever it works, with no network redesign.
• Where inspection happens. Cato inspects in its PoPs after the client or a Socket tunnels traffic there. dope.security runs SSL inspection, URL filtering, Cloud Application Control, and DLP on the device.
• Network path. Cato routes remote traffic to the best PoP and across its backbone. dope.security flies direct to the destination, with up to 4x performance over legacy proxy SWGs.
• AI governance. dope.security AI Analytics shows every AI app in use, who used it, and whether they used a personal or enterprise-licensed account. Cloud Application Control then allows the corporate ChatGPT, Claude, Google, or Microsoft 365 tenant and blocks the personal login, from the same screen.
• DLP for prompts and uploads. Dopamine DLP reads the document instead of matching patterns. Text is extracted on the device and classified by an LLM with zero data retention, and it covers ChatGPT, Claude, Perplexity, Abacus, and Copilot.
• Footprint and console. The dope.security agent is Mac native and Windows and uses under 100 MB of RAM. SWG, CASB Neural, SSPM, and Dopamine DLP run under one dope.console.

For the wider field, see our Cato Networks alternatives guide and our roundup of SASE vendors.

Do you need Cato, or just the SSE piece?

If you run many branches, are retiring MPLS, and want one vendor for networking and security, Cato is a strong choice. Evaluate it seriously.

If most of your people work from laptops, your offices are small or shrinking, and the real problem is web security, AI governance, and data loss on those laptops, you need the SSE piece, delivered on the device. That profile is common in the 250 to 5,000 employee range, and deployment is measured in days. Greylock Partners went from first proposal to signed contract in 27 days, and a Fortune 100 company scaled from 900 to more than 18,000 devices in weeks.

The bottom line on Cato Networks

Cato is an excellent answer to a network question. Its security comes attached to a backbone and a capacity-shaped license, so companies whose people mostly work off the network pay for infrastructure they barely touch, and every remote request still tunnels to a PoP. If you want web security, AI tenant control, and DLP to run on the laptop and send traffic straight to its destination, that is what dope.security was built to do. Explore the Fly-Direct Secure Web Gateway or book a 20-minute demo and we will run the personal ChatGPT test live.

Frequently asked questions

What does Cato Networks do?

Cato Networks sells a cloud-delivered SASE platform that combines SD-WAN and network security on its own global private backbone of 85+ PoPs. Sites connect through Socket appliances, cloud workloads through vSockets, and remote users through the Cato Client, and Cato inspects the traffic in its PoPs with its Single Pass Cloud Engine.

Is Cato Networks SASE or SSE?

Cato is a SASE platform: it combines networking (SD-WAN and its backbone) with security service edge capabilities like SWG, CASB, DLP, and ZTNA. dope.security focuses on the SSE side and delivers it from the device instead of a PoP.

How is Cato Networks licensed?

Cato has licensed sites by bandwidth and remote users as ZTNA users per region group, with security capabilities such as Threat Prevention, CASB, DLP, and AI Security sold as add-ons. In 2026 Cato introduced a modular adoption model, so confirm current packaging and any capacity-coverage rules in your quote.

Is Cato Networks a public company?

No. As of October 2026 Cato is private. It reported more than $415 million in ARR in July 2026 and was valued above $4.8 billion in its 2025 Series G. Leadership has said IPO planning continues, but no filing has been made.

What is the best Cato Networks alternative for remote workforces?

If your main goal is protecting laptops that work from anywhere rather than rebuilding the WAN, dope.security is a strong alternative. It runs SSL inspection on the device with no PoP in the data path, adds AI Analytics, Cloud Application Control, and Dopamine DLP, and deploys through standard device management like Intune.