Cato Security Services

Cato FWaaS delivers cloud-native firewall protection across the Internet, WAN, and LAN traffic without the constraints of physical or virtual firewalls. It inspects all traffic across ports, protocols, and encrypted sessions, eliminating the blind spots and fragmented enforcement common in legacy architectures.

Because FWaaS is part of the Cato platform, it benefits from shared context and unified policy. Rules can use rich objects such as user identity, device, organization, host, application, protocol, location, network, and VLAN. This supports granular segmentation and zero-trust enforcement across the enterprise. Cato further extends firewall administration with Autonomous Policies for FWaaS, using AI-driven analysis to identify misconfigurations, optimize rulesets, and support continuous zero-trust enforcement. The result is stronger control, fewer manual errors, and policy management that scales with enterprise complexity.

Additional strengths include full logging and monitoring, centralized audit trails, cloud-scale performance, support for microsegmentation, and DPI-based visibility into applications and users from the first packet.

Cato SWG protects users against risky and malicious web destinations while enforcing enterprise browsing policies based on content category and risk. It includes pre-defined policies and more than 80 built-in website categories, enabling rapid deployment and immediate enforcement of best-practice controls.

Cato SWG also strengthens protection against phishing and malware delivery sites by maintaining current intelligence on malicious, compromised, phishing, and parked domains. It helps prevent policy circumvention through support for Safe Search and YouTube restriction controls, and improves user experience with customizable block and prompt pages. All activity is logged into the Cato data lake, giving administrators strong visibility for auditing, reporting, and policy tuning.

Within the broader platform, SWG is one layer in a multi-layer threat prevention model. It works alongside IPS, DNS Security, RBI, CASB, and DLP to reduce exposure and improve overall resilience.

Cato IPS provides real-time protection across Internet, WAN, and cloud traffic to stop ransomware, lateral movement, malicious communications, and exploit activity. It combines signatures, threat intelligence, heuristics, and inline AI/ML to prevent attacks across both known and unknown techniques.

Cato IPS is complemented by Dynamic Prevention, a behavior-based adaptive prevention capability described below, that helps stop attacks that emerge over time and evade traditional event-based controls.

Cato IPS also supports phishing and malware protection using AI/ML, virtual patching for fast mitigation of emerging CVEs, cloud-scale TLS inspection, geofencing for attack surface reduction, and a heuristics language designed to use platform context such as app ID, URL category, user identity, target risk, and device fingerprint. Automated threat intelligence management based on 250+ feeds helps keep protections current with near-zero customer effort.

Cato Dynamic Prevention is a behavior-based security capability that adds an adaptive prevention layer to Cato’s threat prevention architecture. Rather than relying only on static signatures, rules, or point-in-time inspection, Dynamic Prevention continuously analyzes activity over time to establish normal behavioral baselines for entities such as hosts and devices, and detect deviations that may indicate an emerging attack.

When suspicious behavior is identified, Dynamic Prevention automatically applies temporary, context-aware controls to reduce the exposed attack surface and disrupt attack progression early. These controls can restrict access to exposed services, risky actions, or access paths even before a confirmed malicious payload or signature match is observed. This is especially effective against attacks that unfold gradually and use legitimate tools or low-signal actions that appear benign in isolation.

Dynamic Prevention complements existing security engines such as IPS, Anti-Malware, and DLP by correlating signals across extended timeframes and multiple data sources, including inline and out-of-band telemetry. It continuously reevaluates behavior and automatically adjusts or removes controls as risk changes. This enables earlier mitigation of sophisticated threats, reduces manual tuning, and strengthens protection without adding operational complexity.

Cato Malware Prevention combines next-generation anti-malware with sandbox analysis to deliver layered malware defense. The platform detects known, unknown, zero-day, and polymorphic malware in real time, while suspicious files can be detonated in a sandbox to produce behavioral analysis and forensic insights.

Because it runs in the Cato Cloud, malware inspection can be applied broadly, including on TLS-encrypted traffic, without appliance sizing constraints. Policies are simple to manage and can be tuned by source, destination, application, and traffic type. Support for nested archives and encrypted file handling further reduces common evasion paths. The result is comprehensive malware prevention at scale, supported by up-to-date signatures, heuristics, and deep behavioral analysis.

Cato DNS Security inspects DNS traffic to block phishing sites, malicious domains, command-and-control communications, DNS tunneling, and crypto-mining activity before a connection is established. It serves as an important early prevention layer because many attacks begin with DNS resolution.

Cato uses AI and ML to identify domain squatting, impersonation attempts, suspicious patterns, and tunneling behavior. Its optimized threat intelligence helps block malicious domains and C2 sites in real time, while centralized logging and visibility enable security teams to investigate DNS-based threats through the same management interface used for all other protections.

Although DNS Security is part of Cato’s broader threat prevention architecture and closely aligned with IPS, it is presented here as a distinct capability due to its dedicated DNS-layer controls, visibility, and policy enforcement.

Cato RBI enables safe access to uncategorized or risky websites by isolating browsing sessions in a remote, containerized environment. Instead of executing website code on the endpoint, RBI streams only a visual representation to the user's browser. This reduces the risk of malware delivery, credential theft, and browser-based compromise.

Because RBI is instantly available from the cloud, organizations can deploy it quickly without new infrastructure. It provides a practical middle ground between allowing and blocking risky sites outright, preserving productivity while reducing exposure. Integrated logging and policy controls help administrators understand usage patterns and adjust enforcement as needed.

RBI complements Cato’s SWG and broader Internet security controls, but is presented here as a distinct capability because it adds a dedicated isolation-based protection layer for risky web access.

Cato IoT/OT Threat Prevention extends visibility, access control, and threat prevention to connected operational and embedded devices. Native AI/ML-based discovery and fingerprinting identify devices by type, manufacturer, and model, giving teams the visibility needed to secure a critical and often under-managed attack surface.

Granular policies can restrict device access to internal or external resources, while the broader threat prevention stack protects IoT and OT devices from known and zero-day threats. Because the capability is fully integrated into the Cato platform and management interface, it reduces sprawl and eliminates the integration burden typically associated with separate IoT/OT tools.

Cato CASB gives organizations visibility and control over cloud application usage across both inline and API-based channels, including sanctioned applications, Shadow IT, and Shadow AI. It continuously monitors internet traffic to identify cloud app usage, classify applications, assess risk, and help IT teams distinguish approved from unapproved services.

CASB is especially important for modern SaaS-heavy environments. Cato uses ML-based application risk analysis to build detailed cloud app profiles with relevant security and compliance context. It also enables granular inline and API-based controls over user actions such as login, view, upload, and download. This lets organizations govern what users do inside cloud applications, not just whether they can access them.

Cato CASB also supports SaaS tenant restriction to reduce the risk of employees moving sensitive data into personal accounts within otherwise sanctioned applications. Together, these capabilities support adaptive SaaS access decisions based on user risk, device trust, and application posture.

Cato CASB also includes API-based capabilities that provide out-of-band visibility into sanctioned SaaS applications, including:

Through App Activities integrations, Cato captures granular audit events across connected SaaS applications and presents them in a unified view, enabling security teams to monitor actions such as logins, downloads, permission changes, sharing activity, administrative actions, and other sensitive operations.

API-based CASB also strengthens governance by improving visibility into application ecosystems, including interconnected SaaS applications, extensions, and plugins. This helps organizations better understand how sanctioned SaaS platforms are being used, what third-party integrations may introduce risk, and where suspicious or non-compliant activity may require investigation or policy response.

Together, Cato’s inline and API-based CASB capabilities provide more complete SaaS security coverage across managed, unmanaged, and direct-access scenarios.

Cato DLP provides consistent data protection across users, locations, web traffic, SaaS applications, and private applications. It is designed to help organizations protect intellectual property, reduce accidental and malicious data leaks, and support regulatory requirements such as GDPR, PCI DSS, and HIPAA.

A major strength is its broad classification capability. Cato includes more than 350 pre-defined data types, along with support for custom data types, Exact Data Match, keywords, regex, labels such as Microsoft Information Protection, and OCR for image-based content. This enables organizations to identify sensitive data in many real-world business formats and scenarios.

Cato applies DLP both inline and through API-based inspection. Inline controls provide real-time governance over data in motion across web, SaaS, and private application traffic. API-based Data Protection extends this coverage with out-of-band content inspection for sanctioned cloud applications, allowing organizations to monitor and react to sensitive data exposure even when traffic does not traverse the Cato Cloud. This is particularly valuable for BYOD scenarios, unmanaged devices, remote users connecting directly to SaaS applications, and cases where the Cato Client is not operating in always-on mode.

API-based DLP also improves coverage for applications and sessions that are difficult to inspect inline, including scenarios where TLS inspection is disabled or where certificate pinning limits inline inspection. Using the same underlying data classification engines as inline DLP, Cato enables consistent detection across both channels while adding near real-time visibility into cloud content, sharing activity, and misconfigurations. Together, inline and API-based DLP provide broader and more resilient protection for sensitive data across managed and unmanaged access scenarios.

Cato Universal ZTNA allows organizations to define a single risk-based access policy and enforce it consistently across office, home, remote, and hybrid users. Instead of granting broad network access, Cato applies per-user and per-application decisions based on identity, device posture, geography, application sensitivity, and other contextual risk signals.

Continuous posture evaluation is central to this model. Cato checks device compliance at connection and throughout the session, and can block or terminate access when posture degrades. This reduces the likelihood of compromised or non-compliant devices becoming a path to sensitive applications or data.

Cato extends this model to unmanaged devices and third parties through browser-based access and the Cato Browser Extension. It also improves user experience by leveraging the Cato global private backbone and optimization capabilities, reducing the performance issues often associated with legacy remote access and backhauled inspection.

All session traffic is continuously inspected by the Cato security stack, which means ZTNA is not isolated from the rest of the platform. Access, threat prevention, and data protection work together within one policy and one architecture.

Cato Enterprise Browser provides secure, policy-controlled access to public SaaS and private WAN applications from unmanaged devices without requiring installation of the Cato Client. It is designed for contractors, partners, guest users, and BYOD scenarios where organizations need to extend secure access without relying on full endpoint management.

Because it is fully integrated into the Cato platform, Enterprise Browser traffic is routed through Cato’s globally distributed PoPs and inspected by the same Single Pass Cloud Engine (SPACE). This allows organizations to apply the same Internet Firewall, CASB, and Data Protection policies used for managed devices, ensuring consistent enforcement across different user types and access methods.

Cato Enterprise Browser also enables browser-level controls such as restricting copy and paste, file downloads, printing, and unauthorized browser extensions. This helps reduce the risk of data leakage and browser-based threats while maintaining a controlled and productive user experience.

The Cato Browser Extension extends secure browser-based access to unmanaged and BYOD users such as contractors, partners, and temporary workers. It gives organizations a practical way to apply zero trust access and full-stack inspection to users who cannot or should not install a full client.

Because the extension is part of the same platform, it applies the same centrally managed policies and inspection logic used for client-based and site-based access. This delivers operational consistency without separate products or consoles. It also improves onboarding speed and user experience by allowing secure access from the existing browser, with traffic still benefiting from the Cato backbone and security inspection stack.

Cato XOps is the AI layer that helps customers quickly detect and resolve security and network issues by transforming millions of raw events into correlated, consumable incident stories. It spans both security and network operations, automatically processing events from licensed Cato capabilities, add-ons, and connected third-party tools.

Its value comes from correlation and shared context. Instead of forcing analysts to manually stitch together data from separate products, XOps presents incidents across users, devices, applications, and locations with relevant context and risk-based prioritization. This helps NOC and SOC teams collaborate more effectively, reduce alert fatigue, and respond faster.

Cato Detection & Response, as part of XOps, is a SASE-based detection and response capability that uses the platform’s native sensors and massive data lake to improve detection, investigation, and remediation. It aggregates prevention events into meaningful incidents, helping teams see through alert volume and focus on likely compromise.

Threat hunting incidents are created by AI/ML models that scan for anomalous indicators of threats that bypassed prevention layers. Cato also applies behavior analytics to identify suspicious user and entity activity, with risk scoring to help teams prioritize investigation.

To accelerate triage, Cato uses GenAI to generate human-readable incident narratives and maps activity to MITRE ATT&CK techniques. This helps teams understand what happened, how far an attack progressed, and what response steps are needed. Because XDR is native to the platform, remediation actions such as containment firewall rules or endpoint scans can be triggered within the same interface.

An additional advantage is the breadth of native sensor data. Cato XDR draws from FWaaS, SWG, IPS, NGAM, DNS Security, CASB, DLP, RBI, endpoint telemetry, and more, all collected into a single data lake. This produces richer incidents and more accurate analytics than tools dependent on reduced or disconnected telemetry. External data from third-party EDR tools can also be incorporated, supporting an open architecture.

Cato supports the full incident lifecycle from detection through investigation, response, and follow-up within the CMA. Analysts can review incident stories, inspect timelines, collaborate around findings, and take remediation steps without pivoting across multiple consoles from different providers.

This unified operating model is particularly valuable for phishing investigations and other cross-domain threats. Events from internet security, DNS protection, RBI, CASB, and ZTNA can be correlated into one story, allowing analysts to trace attacks across services and adjust policies from the same console.

For organizations that want expert support, Cato and its partners provide MDR services. These services include timely threat detection, remediation guidance, and optional preventive measures. MDR helps reduce dwell time, lowers the burden on internal teams, and extends the value of the platform’s detection and response capabilities.