Cato Networks SASE deployment India: a Bengaluru SaaS bake-off against Fortinet

Our CTO asked which SASE platform is cheapest. That is not the question. Cato Networks SASE deployment India gets quoted as a line item, and for a month we treated it like one. Achha, the cheaper firewall and the faster customer login were not the same product, and the DPDP auditor only cared about one of them.

I am Karthik. I run cloud architecture for a 180-person SaaS firm in Indiranagar with branches in Hyderabad, Pune, and a Mumbai sales office. Our IT lead, Anand, sat with the incumbent Fortinet stack for four years and did not want to rip it out. I wanted to. We argued for six weeks. Then we ran both stacks in parallel for 90 days. One of us changed his mind by week four.

Why we even started this argument

The trigger was a DPDP readiness review in March. The auditor asked one question that broke our week. “Show me east-west traffic visibility between your Bengaluru product environment and the Pune analytics environment.” We could show north-south. The Fortinet 100F logged what left HQ to the internet. We could not show what flowed between branches over the IPsec tunnels without pulling pcaps from three boxes and merging them in Excel. The auditor did not say no. He wrote “manual reconciliation” on his sheet and moved on. We knew that line would come back.

At the same time our Mumbai sales lead, Priya, kept losing video calls from the office. The traffic was hairpinning to the Bengaluru Fortinet, out to AWS Mumbai, and back. Eighty-six ms one way. For a sales call. A Mumbai bank we work with had cut over to Check Point Quantum a month earlier for similar reasons. Anand pointed at their war-room weekend as proof that replatforming is painful. He was right about the weekend. He was wrong about what we needed.

We asked our partner to put us on a 90-day Cato pilot. Mumbai PoP, Singapore PoP, single client on every laptop, all four offices behind a Cato Socket. The Fortinet stack kept running in parallel. We logged whichever path the user took.

Get my free Cato SASE assessment
200+ Indian businesses. Response within 8 hours.

Stack one: the Fortinet floor

Anand’s floor was the one we had built. A Fortinet 100F at HQ, three FortiGate 60Fs at the branches, IPsec site-to-site, and Cisco AnyConnect for the 72 work-from-anywhere laptops. UTM licences renewed every March. The CFO knew the number to the rupee, which is half of why Anand defended it.

It worked most days. Hyderabad had a 19-month uptime streak. Mumbai hairpinned because we never bothered with a local internet break-out. Adding one meant a new firewall policy, a new tunnel, and a Sunday window. We always deferred it.

Admin time was where it bled. Anand and his junior, Rohan, spent about 14 hours a week between them on firewall ops. Policy tweaks. AnyConnect ticket triage. IPsec flaps after the Pune ISP rebooted a router at 3 am. Three times a quarter a tunnel went down and Rohan drove to the office to bring it up. We never costed those drives.

DPDP was the other bleeder. The visible gap was east-west visibility. The invisible one: enforcing “Mumbai sales laptops cannot reach the Pune analytics server” meant tunnel rules on three boxes. Pray nobody copy-pasted a wrong subnet. The Fortinet stack was built for north-south. We had bolted east-west on top.

Cato Networks SASE deployment India: the test floor

The Cato setup took our partner two days. A Socket at each office plugged in behind the existing router. No IPsec tunnel between branches anymore. The Cato Client on every laptop. Every packet now reached its destination via the nearest Cato PoP, Mumbai for India and Singapore for our two engineers in Manila.

The Pune office onboarded in 35 minutes. Anand did not believe me and drove to Pune the next morning to check. The Socket had been pre-staged in Bengaluru, shipped, plugged in, and self-configured. The branch was online before our partner’s invoice came through. Bas, that was the moment Anand stopped fighting the pilot.

Latency to AWS Mumbai averaged 19 ms over the 90 days, down from 38 ms on the Fortinet path. The hairpin was gone. Priya’s calls stopped dropping by week two. We did not announce the change. She did not know we were running both.

The east-west piece is what hooked me. Cato’s FWaaS logs every flow between sites without us doing anything. The dashboard already had the answer to the auditor’s question. We just had to find the saved view.

The bake-off math

We measured five things across the 90 days. Latency to AWS Mumbai. Mean time to onboard a branch. Admin hours per week. Security incident count, counted the same way for both stacks. And total monthly run cost in INR.

The ₹90,000 monthly delta was the wall. Anand pointed at it. The CFO pointed at it. I had to argue against it.

What I told the CFO

I walked her through three lines. Admin hours first. Anand and Rohan were spending 9 hours a week more on the Fortinet stack than they would on Cato. At their fully loaded cost, that is roughly ₹62,000 a month in time we were not redeploying. This month it meant Rohan finally finishing the Intune rollout that had been parked for two quarters.

DPDP exposure second. The “manual reconciliation” line on the auditor’s sheet would become a finding at the next audit. We had two of those audits a year. One finding turning into a regulator letter would cost north of ₹6 lakh in legal review and evidence pull. Cato closed the east-west gap on day one.

Customer-facing latency third. Priya’s team had logged 11 customer demos in the previous quarter where audio dropped on Mumbai office calls. Two of those were on accounts that did not close, and the loss notes cited “reliability”. We did not claim Cato saved those deals. We did claim the hairpin was a known cause and we had removed it.

She signed. Not because Cato was cheaper. Because the ₹90,000 monthly delta was smaller than the three numbers on the other side.

If you are running this exercise yourself

Run both stacks in parallel for at least 60 days. The first three weeks are noise. By week five the numbers settle. Make the measurement person someone who does not have a horse in the race. We used our SRE lead, who did not care which firewall won.

Get east-west visibility into your first measure, not your third. If your DPDP auditor or your internal compliance lead has flagged it, the “manual reconciliation” note on the audit sheet is the cost you are not counting. It compounds at the next audit.

Do not pick on monthly run cost alone. The legacy stack always wins on paper because the AMC is amortised and the admin hours sit in a salary line nobody reads. Cato will look 20 to 30 percent dearer until you add admin time and audit exposure back in. We made the same mistake the first time we costed a Veeam pilot. The cheaper line item was not the cheaper outcome.

And do not assume your existing firewall vendor cannot stretch toward SASE. Fortinet, Palo Alto, and Check Point all have a SASE story at different points on the road. If your team’s muscle memory is in one of those stacks, that is a fair input. The same logic applied when we picked our productivity stack. Sometimes the answer is the platform your operators already know.

Get my free 4-hour quote
200+ Indian businesses. Response within 8 hours.

The CFO question we did not see coming

Three weeks after she signed, she asked one more thing. “What happens if we open a Chennai office?” On the Fortinet stack, a new branch was a six-hour project, a ₹4.5 lakh firewall, an IPsec tunnel, and a Sunday window. On Cato, a Socket shipped and a line on the existing subscription. The growth case was priced in. Cato is per-user. Fortinet is per-site and adds boxes plus AMC plus people. The curves diverge fast once you cross four offices.

FAQ

Is a Cato SASE bake-off realistic for a 50-person company? Yes, with caveats. The Cato PoP latency benefit shows up only if your traffic actually crosses geography. A single-office 50-person firm with one ISP gets less of it. The visibility and zero-touch branch story still pay off if you have any travelling sales or hybrid users.

How long should the pilot run? 60 to 90 days. Less than 60 days and the legacy stack’s slow-burn pain (tunnel flaps, AnyConnect tickets) does not show up in the numbers. More than 90 days and your team forgets the legacy stack existed.

Does Cato replace our Check Point or Palo Alto firewall completely? For a branch-and-mobile pattern, yes. For a single-datacentre estate with serious north-south policy, you may keep a perimeter firewall and use Cato for the SD-WAN and mobile layer. Our Mumbai bank customer kept Check Point on the datacentre edge and used Cato for branch.

What about DPDP and data residency? Cato’s Mumbai PoP keeps Indian user traffic on Indian infrastructure for the path. The control plane and logs are global. For our DPDP readiness review, that combination passed. Your auditor may want the same answer in writing.

How does the Cato Client behave on flaky home broadband? Better than AnyConnect in our test. It picks the nearest PoP, holds the tunnel, and resumes faster on a network change. Anand’s home BSNL line was the test bed.

If you are still deciding

The honest read is this. Cato is not the cheapest SASE. It is the easiest one to put on top of an Indian multi-branch SaaS firm without a long professional services engagement. If your DPDP auditor has flagged east-west visibility, that alone clears the cost delta in a year. If you are growing offices, the per-user model gets cheaper than the per-site model fast.

If you have a stable single-office estate and a happy Fortinet or SonicWall stack, sit tight. The bake-off will tell you the same thing it told us about our printer fleet two years ago. Replacing something that is not bleeding is a way to spend money. Replacing something that is bleeding is a way to make money.

Start your free SASE assessment
200+ Indian businesses. 17+ years in IT. Response within 8 hours.

P.S. Karthik here. We ran this same bake-off pattern for two other Bengaluru SaaS firms in the last six months. One picked Cato. One stayed on Fortinet and added a Cato Client for the WFH users only. Both decisions were right for their estate. If you want our SRE lead’s measurement template, ask in the form above. It is the same sheet she used for ours.