Cato prices the way it is built: one subscription that covers the network and the security on it, metered by the bandwidth each site is licensed for and the number of remote users, with the security tiers priced on top of that same capacity. Nothing is published for the commercial market, but the cloud marketplace listings, one public sector award, and a decent volume of buyer reported figures make the shape of a Cato bill clear enough to budget against. For how Cato compares to the rest of the market, see our Best SD-WAN Providers ranking, our Cato vs Zscaler verdict, and our Cato vs Fortinet verdict.
What you will actually pay
| What is priced | Price | What it covers |
|---|---|---|
| Bandwidth pool, 1 Gbps | $45,600 /yr | Marketplace list; about $3.80 per Mbps per month, shared across the sites in a region |
| Security only pool, 1 Gbps | $22,800 /yr | Marketplace list for sites that keep their existing WAN |
| Single site, reported | $100 to $500 /site/mo | 25 Mbps up to a few hundred Mbps, before security add ons |
| Remote user, reported | $8 to $14 /user/mo | Zero trust access with security, priced per region |
| Socket appliance | $3,000 to $6,000 /device/yr | Recurring, includes refresh and replacement; standby units licensed separately |
The bandwidth line is the one that sets the bill. Buyers report roughly $100 a month for a 25 Mbps site and about $255 for 100 Mbps before security, scaling to about $2,000 a month at 2 Gbps, so the per megabit price falls steeply as sites get bigger. Security add ons are then priced on the same capacity: threat prevention adds about a fifth to the networking line, and the cloud access and data loss layers add more. A documented public sector contract shows the whole stack at one site: a 100 Mbps site license with threat prevention, a main and standby appliance, and 650 remote users on a three year term at a little under $50,000 a year.
Across whole estates, procurement benchmark data puts the median Cato contract around $55,000 a year, with a wide range from under $10,000 to the mid $150,000s. For sizing, a business with 10 to 30 sites and fewer than 500 users typically lands between $100,000 and $300,000 a year, 30 to 100 sites with 500 to 2,000 users between $300,000 and $800,000, and estates past 100 sites and 2,000 users above $1 million. A five site business at 100 Mbps per site with 100 remote users should expect $35,000 to $60,000 a year with security included.
What moves the price
- Bandwidth per site. License the bandwidth each site actually uses, measured as the higher of its download or upload, rather than the circuit speed. A pooled license shared across a region costs less than exact per site allocations when sites peak at different times.
- Security tier. Threat prevention, advanced threat prevention with sandboxing and browser isolation, cloud access control, and data loss prevention are each priced on your licensed capacity, so every tier you add multiplies the bandwidth bill rather than adding a flat fee.
- Regions and users. Pools and users are priced per region group, so a global estate pays for each region it operates in. Remote users are a separate per user line and the cheapest part of the bill.
- Managed services. Managed detection and the operations analytics license must cover the whole account's licensed capacity, which makes them meaningful at scale. Gold and Platinum support are per account and worth it only if your team cannot carry a priority one case itself.
- Appliances and term. Every Socket, including high availability pairs and cold spares, is a recurring line. Multi year terms discount 15 to 30 percent, and discount depth rises with deal size: around 12 percent on deals under $250,000, into the twenties above it, and about 30 percent past $1 million.
Contract factors to watch
- Twelve months is the floor. The agreement sets a minimum term of twelve months including all renewals, add ons co terminate with the main order, and termination is for uncured breach only. There is no exit for convenience.
- Over usage true ups. Usage is measured per license per calendar month. Running over earns either a one time charge for that month or a permanent, co termed capacity increase at least equal to the overage. Size honestly and watch the monthly report.
- No credit for unused capacity. Under using a pool earns no refund. Combined with the true up rule, this rewards buying slightly under your peak and growing into it, not over buying for safety.
- Hardware terms. Title and risk pass to you on delivery, and shipping is yours. In exchange, the subscription carries the refresh, with the first generation appliances replaced free before their 2030 support end.
- Professional services expire. Prepaid services are billed in half hour increments and unused hours lapse after fifteen months. Buy deployment help in the amount you will use that year.
- License ramps and bursting. Cato now allows licenses to ramp over the first year of a deployment and is introducing a bursting model that lets capacity exceed the license temporarily with defined true up rules. Ask for both in writing if your rollout is staged.
The honest summary: Cato is priced as a converged platform, and it is competitive when you use it that way, which is why single site and remote user only buyers find it expensive and multi site estates retiring MPLS and a security stack together find it fair. The bill is decided by bandwidth sizing, the security tier, and the term, in that order. Exact pricing is quote based at any real size. We pull real numbers across Cato and every serious alternative at once, free, and you sign directly with whichever provider you choose.