Access & usage: unified networking and security, driven by AI
With the Cato Networks SASE platform, networking and security converge in a single cloud service, managed from one console. Every site, mobile user, cloud application and AI agent is connected and protected as close as possible, over a global backbone with 99.999% availability.
Performance and security: for everyone, everywhere, all the time
How SASETY and Cato Networks bring networking and security together to give every user fast, protected access, at the office or on the move.
Networking and security in a single cloud service
SD-WAN networking
- Multiple links in active-active mode, best path selection
- Bidirectional QoS per application
- TCP optimisation and packet loss mitigation for voice
- Sites hidden from the Internet: no public IP, no open port
SSE security
- Firewall as a Service, east-west and north-south
- Secure web gateway and URL filtering
- IPS, next‑generation anti-malware, DNS security
- TLS inspection and browser isolation
Zero Trust (ZTNA)
- Internal traffic blocked by default
- Rules based on identity rather than IP address
- SSO with Entra ID, Okta, Google; device posture checks
- Always-On client for Windows, macOS, Linux, iOS and Android, or clientless access
Data & SaaS
- CASB: visibility and risk score per application
- Blocking of specific actions, such as file uploads
- DLP: 350 data types, 8 compliance categories (GDPR, PCI DSS…)
Cloud & datacentres
- Native connection to Azure, AWS and GCP
- With no need for ExpressRoute or Direct Connect
- Datacentres and remote sites on the same backbone
Always up to date
- New features every week, enabled automatically
- Protections updated every hour
- More than 250 threat intelligence sources
- Virtual patching of critical vulnerabilities within hours
NIS 2: SASE technology contributes to 27 strong and 32 partial requirements of the ANSSI ReCyF framework (v2.5, working version of 17/03/2026, SASETY mapping). A contribution measured requirement by requirement, separate from any certificate of compliance.
Automated attacks require protection that decides at machine speed
The time between intrusion and impact is now counted in minutes. A response based on static rules and manual analysis comes too late: the platform has to detect, understand and block on its own, in the context of the environment.
What AI changes on the attacker side
- AI agents plan, execute and adapt multi‑stage attacks
- Behaviours mutate continuously to evade rules and signatures
- Generative AI enters everyday use: shadow AI and sensitive data typed into prompts
How AI strengthens defence
- Agentic Threat Prevention: AI agents analyse traffic continuously, compare it with usual behaviour, explain their reasoning and apply dynamic controls on the host (lateral movement, C&C), lifted once behaviour returns to normal. Zero rules to write
- AI Security for Users: inventory of AI applications, shadow AI included; allow, limit or block per application; enforced corporate tenant; inspection of prompts and files to block sensitive data
- XDR: anomaly detection through AI and machine learning, incident stories generated by generative AI to speed up analysis
- Activated in the existing console, with no new appliance, agent or console
Internet access chosen site by site
To create, complement or replace existing links, we select the Internet access best suited to how each site is used. For critical sites, we recommend up to 3 local loops from different operators and technologies, combined with 3 separate Internet transits, to reduce the impact of physical incidents or operator backbone failures.
A multi‑operator approach
Three layers, several operators at each layer: SASETY chooses the combination best suited to the address, criticality and number of users of each site.
1Physical connectivity
Fibre infrastructure operators (FTTO, FTTE, FTTH), in France and internationally
2Wireless connectivity
Mobile and satellite access
3Aggregation and Internet transit
Several aggregation operators and separate IP transits
End‑to‑end redundancy
Two links on a site protect the local loop. SASETY goes further by routing each link through a different Internet transit.
Local loop redundancy only: an incident or maintenance on the Internet transit takes the site offline.
End‑to‑end redundancy: the site stays reachable during a transit incident, with availability of up to 99.99% per month.
The access catalogue
Eligibility checked at the address, then confirmed during the operator site survey. FTTO and FTTH routers included in the subscription, with remote installation.
| Access | Typical use | Speeds | Bandwidth type | Lead time | Response / restoration |
|---|---|---|---|---|---|
| FTTO / FTTE | Critical sites, headquarters, datacentres | From 2 Mbps to 10 Gbps symmetrical | Guaranteed | 8 to 16 weeks | 30 min / 4 h |
| FTTH | Small sites, secondary link | From 200 Mbps to 1 Gbps asymmetrical | Shared | 2 to 8 weeks | 1 h / 10 h |
| Satellite | Remote sites, overseas territories | Depending on coverage | Shared | 2 to 4 weeks | 1 h / 10 h |
| International | Subsidiaries and sites outside France | Dedicated fibre, broadband | Depending on country | 8 to 18 weeks for FTTO | 4 to 8 h (restoration) |
Monitoring of every link
- Automatic 24/7 alerts
- Immediate diagnosis: operator outage or Cato incident
- Operator incident management and dispatch of field interventions
On‑premises works
- Survey visit and identification of the blocking point
- Installation of conduits, trunking and ducts
- Indoor works in private or shared areas
- Outdoor works on the grounds up to the equipment room
Deployment management
- Order and operator site survey
- Works, fibre pulling and installation of operator equipment
- Router installation
- Handover and start of monitoring
From the current network to SASE, with zero service disruption
- ScopeArchitecture workshop, TLS, voice and QoS assessments, migration of existing security rules
- PilotHub and pilot site, functional acceptance tests before any roll‑out
- MigrateGradual cut‑over of sites in line with contract end dates, then mobile users
- OperateDecommissioning of the former network, 24/7 monitoring and continuous improvements
One team, from architecture to 24/7 operations
Industrialised deployment
- Dedicated project manager and weekly steering committees
- Automated site creation through APIs
- Roles matrix and formal acceptance tests
Multi-operator Internet access
- FTTO, FTTE, FTTH, 4G/5G and Starlink depending on coverage
- The best local loop site by site, over two separate IP transits
- International coverage
Managed services
- 24/7 monitoring of every link, independently of the tunnel
- Incident and change management, performance metrics
- Customer Success Manager and quarterly reviews
Commitments
- SASE service availability: 99.999%
- Response within 15 min and restoration within 2 h, 24/7
- Cato Networks Excellence & MSSP partner since 2022