SASE changed cybersecurity by challenging a basic assumption: that networking and security had to remain separate technology stacks. By converging connectivity, access and security policy into a cloud-delivered architecture, SASE simplified the edge and created richer context about users, applications, locations and activity.
But for many organizations, that convergence has not extended into the broader SOC workflow.
Inside the SOC, many organizations still operate a fragmented collection of SIEM, NDR, identity, endpoint, cloud, email, vulnerability and response technologies. MSSPs feel that fragmentation even more acutely because every additional console, pipeline and workflow is multiplied across customer environments.
We believe the next logical step is already underway: connecting SASE and security operations more closely. The objective is not to force every capability into one vendor. It is to connect the security edge and the SOC tightly enough that context, detection, investigation and response can work together across a consistent operating model.
For MSSPs, that shift is especially important. The winners will not simply aggregate more security tools. They will build a repeatable operating model that can be deployed across customers, powered by AI, and managed through a common SecOps layer.
SASE Was the First Convergence
The original SASE thesis was fundamentally operational. Networking and security had evolved as separate disciplines, with separate appliances, policies and management planes. That model became increasingly difficult to sustain as applications moved to SaaS and cloud, users became distributed, and the traditional network perimeter dissolved.
Cato Networks was built around the opposite idea: bring networking and security together as a single cloud-native platform. The result is not just simpler infrastructure. It is a common source of context across users, applications, sites, access policy and network activity.
That context matters to the SOC because a suspicious event rarely makes sense in isolation. An analyst needs to know who the user is, what application was involved, where the connection originated, what policy applied, and what else happened before and after the event. Cato’s SASE platform is well positioned to supply that edge context because it sits directly in the path of user and application activity.
Yet edge context alone is not a security operations model. The SOC still needs to connect it with endpoint, identity, cloud, email, vulnerability and other telemetry. That is where the next convergence begins.
The SOC Is Becoming the Next Convergence Point
The SOC has historically been assembled from layers: a SIEM to collect logs, separate network detection, identity analytics, endpoint tooling, threat intelligence, case management and response automation. Each product may be valuable, but the operating burden lands on the analyst – and on the MSSP responsible for delivering an outcome across many tenants.
AI is accelerating the pressure to change that model. The value of AI in security operations is not another chatbot sitting beside an alert queue. It is the ability to normalize diverse telemetry, enrich it, identify meaningful detections, correlate related activity, form cases, assist investigation and guide response while keeping human analysts in control.
That is the role Stellar Cyber is designed to play. Its AI-driven SecOps platform brings together SIEM, NDR/OT, ITDR/UEBA, detection, investigation, triage and response in a common workflow. It is not an MDR service. It is the platform enterprises and MSSPs use to operate security – and, for service providers, to deliver MDR and managed security at scale.
Cato + Stellar Cyber: A Practical Model for Network and Security Convergence
That is the opportunity behind the Cato Networks and Stellar Cyber collaboration.
Cato provides a converged SASE platform with rich context across users, applications, access, network activity and security events. Stellar Cyber provides the AI-driven SecOps layer: ingesting and normalizing that context, enriching it with telemetry from the rest of the security stack, applying detection and correlation, and turning related signals into case-centric investigations.
The result is not simply “Cato logs in a SIEM.” The objective is to make Cato context part of the broader security investigation – next to endpoint, identity, cloud and other evidence – so analysts can understand the incident rather than reconstruct it console by console.
The native integration available today gives Stellar Cyber a direct path to Cato data. Stellar Cyber can collect Cato Stories and multiple event categories, and Cato security events can be enriched, mapped and deduplicated into Stellar Cyber’s alert model. From there, those signals can be investigated as a part of the same detection and investigation workflow as other telemetry across the environment.
This is also why the case-centric model matters. A Story or alert can be the starting point, but the investigation should not end there. Analysts need to move from the signal to the surrounding evidence and relationships: the user, application, endpoint, identity, network session, cloud activity and other observables that explain what actually happened.
Why MSSPs Are the Center of This Opportunity
For an enterprise SOC, integration reduces pivots and improves context. For an MSSP, the economics are even more significant.
An MSSP cannot profitably build a bespoke security architecture for every customer. Every unique connector, workflow, policy model and console increases onboarding time, training requirements and service-delivery cost. Fragmentation also makes it harder to apply automation consistently because the same analyst task may look different in every tenant.
The stronger model is standardization without lock-in: a common SASE platform across customer environments, an open SecOps operating layer in the SOC, and the ability to integrate the endpoint, identity, cloud and other technologies the customer already uses.
This creates a different kind of “better together” story. It is not just a technology integration. It is a service-delivery architecture. An MSSP can standardize how Cato context enters the SOC, how it is enriched and correlated, how cases are formed, and how analysts investigate activity – while preserving an open ecosystem around the customer’s existing controls.
That repeatability is what turns convergence into business leverage. Faster onboarding, fewer custom pipelines, more consistent analyst workflows and a common multi-tenant operating model all create the potential to scale managed services without scaling operational complexity at the same rate.
From More Tools to a Better Operating Model
The first phase of security convergence happened with SASE. Networking and security came together because the old model had become too fragmented, too expensive and too difficult to operate.
Security operations is reaching a similar point. The SOC does not need another disconnected source of alerts. It needs a way to bring high-value context from the edge together with the rest of the attack surface, apply AI to detection and correlation, and give analysts a case-centric view of what matters.
For MSSPs, this is more than a product trend. It is a blueprint for the next generation of managed security: converged SASE at the edge, AI-driven SecOps in the SOC, and one repeatable operating model across customers.
Cato Networks and Stellar Cyber each bring a different layer of that architecture. Together, they create a path from SASE context to SOC outcome – without requiring either company to stop being what it does best.
