SASE
Battle Cards

Where PAN Wins

• ZTNA 2.0 vs. ZPA: Prisma SASE's ZTNA 2.0 performs continuous post-connect trust verification and security inspection. Zscaler ZPA grants access then trusts the session — no ongoing inspection. Critical for insider threat and compromised-credential scenarios.
• App compatibility: Prisma SASE's route-based model handles legacy protocols, proprietary apps, and east-west traffic natively. Zscaler's pure-proxy model requires workarounds for non-HTTP/HTTPS traffic.
• Prisma Browser: Native secure browser integration with SASE — industry first. Zscaler has no equivalent.
• Single management (SCM): Unifies on-prem NGFW + Prisma Access + Prisma SD-WAN. Zscaler requires separate ZIA, ZPA, ZDX consoles.
• Infrastructure resilience: PAN uses AWS + GCP hyperscale backbone with dedicated per-customer data planes. Zscaler relies on manually scaled colo hardware with shared data planes.
• Policy consistency: Existing NGFW customers enforce identical PAN-OS policies in Prisma Access — same engine, same rules.

Where They're Strong

• 150+ PoPs: Largest PoP footprint — though hardware-dependent and less elastically scalable.
• SWG maturity: Zscaler's SWG is best-in-class; 100% TLS inspection without performance degradation claimed.
• 40% of Fortune 500: Strong enterprise installed base creates credibility and reference accounts.

Landmines to Set

• "Show us inspection performance with IPS + DLP + Advanced Threat + sandboxing all enabled simultaneously — not just TLS inspection alone."
• "Does ZPA continuously inspect traffic after the initial ZTNA connection is established? What happens if a session is compromised mid-connection?"
• "How do you handle legacy RDP, SSH, and non-HTTP/HTTPS protocols without a VPN overlay?"

Traps They Set

• "Zscaler has more PoPs" — Counter: PoP count matters less than PoP quality. Zscaler runs on manually scaled colo hardware. PAN runs on AWS + GCP hyperscale infrastructure with elastic scaling and dedicated customer data planes.
• "PAN's SASE is just their firewall in the cloud" — Counter: Exactly — and that's the advantage. Same PAN-OS engine means identical security policies, same threat prevention, zero policy gaps. Zscaler has to replicate each security capability separately.

Key Objections

Where PAN Wins

• Full network + security stack: Netskope is SSE-only (no native SD-WAN). PAN is a true single-vendor SASE with both SSE and SD-WAN in one platform.
• ZTNA maturity: Prisma SASE ZTNA 2.0 is more mature than Netskope's NPA for complex legacy protocol environments.
• Threat prevention depth: WildFire + Advanced Threat Prevention + Content-ID provides deeper threat inspection than Netskope's DLP-centric approach.
• Browser security: Prisma Browser is unmatched; Netskope has no secure browser.

Where They're Strong

• Best-in-class DLP/CASB: If the primary driver is preventing data exfiltration to GenAI tools, Netskope competes strongly.
• GenAI governance: Superior controls for ChatGPT, Copilot, and other GenAI applications.

Landmines to Set

• "How does your ZTNA handle legacy RDP, SSH, and non-HTTP/HTTPS protocols without a VPN overlay?"
• "What is your SD-WAN story for branch offices? Will you need a separate vendor for WAN optimization?"

Traps They Set

• "Netskope has the best DLP" — Counter: Acknowledged for pure DLP, but PAN's AI Access Security module and Enterprise DLP close this gap significantly. And DLP alone doesn't solve SASE — you need ZTNA 2.0, threat prevention, SD-WAN, and browser security.

Key Objections

Where PAN Wins

• Cloud-native vs. hardware PoPs: Prisma SASE is cloud-delivered on hyperscaler backbone. Fortinet SASE is hardware-dependent and less elastically scalable.
• PoP coverage: 100+ PAN locations vs. Fortinet's hardware PoP footprint.
• ZTNA 2.0: Prisma SASE provides continuous inspection. Fortinet's ZTNA is basic by comparison.
• Browser security: Prisma Browser is unique — no Fortinet equivalent.

Where They're Strong

• FortiGate-embedded customers: If a customer is deeply embedded in FortiGate + FortiManager + FortiSwitch, Fortinet SASE appears operationally simpler.
• SD-WAN integration: Built-in SD-WAN at no extra SKU is compelling for price-sensitive deployments.

Landmines to Set

• "Is your SASE truly cloud-delivered or running on hardware PoPs? What is the SLA for traffic inspection and elastic scaling?"
• "How does Fortinet SASE handle dedicated per-customer data planes vs. shared infrastructure?"

Key Objections

Where PAN Wins

• PoP scale: 100+ PAN locations vs. 30+ for Cisco. Critical for global enterprises with users in secondary markets.
• ZTNA 2.0 continuous inspection: Cisco's ZTNA grants access but doesn't continuously inspect after connection.
• Unified management: SCM unifies SSE + SD-WAN today. Cisco's Security Cloud Control is still converging through 2025–2026.
• Prisma Browser: No equivalent at Cisco for securing unmanaged/BYOD devices at the browser layer.

Where They're Strong

• ThousandEyes DEM: Best-in-class digital experience monitoring at enterprise scale (separate license at full tier).
• Catalyst SD-WAN: Most mature WAN optimization with sub-second failover for 50+ branch environments.
• Deep networking install base: Cisco networking shops face high transition costs.

Landmines to Set

• "When will SSE and SD-WAN management be fully unified in one console?"
• "What's the ZTNA gap for post-connect continuous inspection?"
• "How do 30+ PoPs serve users in Southeast Asia, Latin America, and Africa compared to 100+?"

Key Objections