Strategic Flow — Cato Networks Product Update Teardown

Source: support.catonetworks.com — Knowledge Base

Article: Product Updates — March 30, 2026

Product Updates - March 30, 2026

Cato Networks

LEARNING CENTER · RELEASE NOTES

MARCH 30, 2026

Home Release Notes 2026 Release Notes Product Updates — March 30, 2026

Product Updates - March 30, 2026

Published: March 30, 2026 · Cato Networks Knowledge Base · Article ID: 34972179497629

ⓘ Content described in this update is gradually rolled out to the Cato PoPs over a two-week period. In addition, new features are gradually activated in the Cato Management Application over the same two-week rollout period as the PoPs.

New Features & Enhancements

Cato Neural Edge — GPU-Accelerated Inline AI

Cato Neural Edge deploys NVIDIA GPUs across Cato's global backbone to accelerate AI-driven analysis for real-time traffic inspection, threat detection, and policy enforcement. Enables high-frequency execution of AI and machine learning models in-line, real-time semantic and behavioral inspection, scalable analysis across global traffic flows and deterministic performance without external processing layers.

Cato AI Security — Unified AI Governance and Protection

Cato AI Security converges advanced AI governance and protection capabilities through the integration of Aim Security. Governs employee use of AI tools. Secures homegrown AI applications. Unified governance and runtime protection across major AI use cases. Protects against shadow AI and unmanaged AI usage.

Dynamic Prevention — Adaptive Threat Blocking

Dynamic Prevention continuously correlates months of security and networking activity in real time across Cato's full range of inline sensors to identify behavior-based threats that appear benign in isolation. Once malicious behavior is identified, Cato dynamically applies adaptive rules, blocking high-risk activity in real time without manual intervention or SOC involvement.

Previously: Threat detection relied on point-in-time inspection with manual SOC response requirements.

Modular SASE Adoption Model

Organizations can now start with the SASE capabilities they need today and expand over time without sacrificing the advantages of a true platform. Four modules available: AI Security, SD-WAN, SSE (Security Service Edge), and Universal ZTNA. Each module stands on its own as a complete, enterprise-grade solution and any module added compounds value through a converged platform foundation.

Platform Updates

Ask AI — Expanded Account Intelligence

Ask AI provides additional account-aware intelligence that helps you understand policies, settings, and changes across your environment. Choose the right experience for the task: work with Ask AI while navigating the CMA, or switch to a dedicated full-page AI Workspace for deeper analysis. Richer, account-aware answers covering firewall rule explanations, policy impact, and traffic anomalies.

Available as part of a free trial.

DNS Split Tunneling for Internal Resolution

Exclude internal domains from Cato DNS to resolve them locally, while continuing to protect DNS traffic with Cato DNS Protection. Route internal DNS queries to local DNS servers while using Cato for public DNS. Define specific internal DNS suffix to bypass Cato DNS.

Previously: All DNS traffic was routed through Cato DNS, which could conflict with internal resolution requirements.

Granular Client Control with Managed Networks

Dynamically adjust Split Tunnel and Always-On behavior based on the detected source network, supporting hybrid environments and gradual onboarding.

Security Updates

DLP — Machine Learning Image Inspection

Data Loss Prevention (DLP) can now inspect image files to detect sensitive data in images and prevent them from being exfiltrated. Machine Learning is used to identify sensitive images based on models that dynamically learn and evolve with changing data patterns.

Turnkey Integrations — Microsoft Sentinel and Splunk

Streamline operations by automatically forwarding Cato events to Microsoft Sentinel or Splunk for unified monitoring and analysis. The built-in integration reduces setup time and eliminates the need for custom scripts or connectors.

Previously: Required custom connectors or manual event forwarding configuration.

⚠ Title "Product Updates - March 30, 2026" is a filing label, not a headline — a reader skimming their inbox has zero reason to open it over any other weekly update

⚠ Opening disclaimer ("gradually rolled out over two-week period") buries the value with a caveat before a single benefit has been stated

⚠ Every feature is written in passive, engineer-first language — "enables high-frequency execution of AI models" describes architecture, not what the admin now doesn't have to do

⚠ No hierarchy between major announcements (Neural Edge, AI Security) and routine updates (DNS tunneling) — every item gets the same visual weight

⚠ Zero quantified claims anywhere — no time saved, no threats stopped, no performance benchmarks — just feature descriptions without evidence

⚠ No CTA anywhere on the page — a reader who is now interested in Neural Edge, AI Security, or the modular adoption model has no clear next step

⚠ "Previously" notes are buried in italic fine print — the before/after contrast that makes new features valuable is the least visible thing in each block

Source: support.catonetworks.com — Rewritten by Strategic Flow

Article: Product Updates — March 30, 2026

⚡ Three things your security team couldn't do last week — now they can

Cato Networks

March 30 · Weekly Platform Update

SASE Platform · 2026

Platform update · March 30, 2026 · Gradual rollout · No action required to activate

This week, Cato stops threats
your SOC would have missed entirely.

Three major platform capabilities went live this week. Neural Edge brings GPU-powered AI inline to every traffic flow. AI Security governs every AI tool your team uses. Dynamic Prevention stops month-long attacks that look like nothing — until they're everything. Here's what changed for your team, in plain language.

GPU

inference now inline — Neural Edge runs AI at wire speed across every PoP

0 SOC

intervention needed — Dynamic Prevention blocks autonomously

4 modules

start with what you need — SASE now modular, no lock-in

See what changed in my account → Book a walkthrough with Cato

THIS WEEK'S 3 HEADLINE CHANGES — IN PLAIN LANGUAGE

Neural Edge · AI Security · Dynamic Prevention — what each one means for your team

Neural Edge: NVIDIA GPUs now deployed across Cato's global backbone — AI models run inline at wire speed. No latency. No external processing layer. Your traffic gets inspected at the speed it moves. AI Security: Every AI tool your employees use is now governed — shadow AI, ChatGPT, Copilot, homegrown agents. Unified policy, one console. Dynamic Prevention: Cato now correlates months of signals across your entire environment. A series of low-signal actions that each appear normal — exfiltration prep, lateral movement, privilege escalation — gets identified and blocked before the attacker reaches their objective.

Neural Edge (GPU inline) AI Security governance Dynamic Prevention Modular SASE Ask AI (free trial) DLP image ML Sentinel + Splunk

❌ Before

Title: Product Updates - March 30, 2026

A filing label. The date is not a reason to read. Every weekly update from every vendor uses the same format — this one is indistinguishable.

✅ After

Title: ⚡ Three things your security team couldn't do last week — now they can

Creates a specific curiosity gap. The reader knows the number (3), knows it's about their team, and knows something changed. They have to open it to find out what.

The 7 upgrades — and why they work

1 · Title: curiosity gap over filing label

"Product Updates - March 30, 2026" is how you label a folder. "Three things your security team couldn't do last week — now they can" is a reason to read. It creates a specific gap: the reader knows a number (3), knows it applies to them (your team), knows something has changed (last week → now). All three are conversion signals in a single line.

2 · Lead: consequence before caveat

The original opens with a two-sentence disclaimer about gradual rollout. The rewrite opens with the consequence: "Cato stops threats your SOC would have missed entirely." A caveat is the answer to an objection — it belongs after the hook, not before it. Every page should answer "why does this matter?" before it answers "how does this work?"

3 · Features translated into admin outcomes

"Enables high-frequency execution of AI and machine learning models in-line" describes architecture. "AI models run inline at wire speed — no latency, no external processing layer" describes what the admin no longer has to worry about. Every technical claim should be followed by its operational consequence. The question is always: what does my team no longer have to do, or what can they now do that they couldn't before?

4 · Hierarchy: major announcements lead, routine updates follow

The original gives Neural Edge, DNS Split Tunneling, and DLP image inspection equal visual weight. They are not equal. Neural Edge and AI Security are platform-defining releases. The rewrite puts them in the hero stat cards. DNS tunneling and DLP land in the offer pills. Visual hierarchy communicates importance — a flat list communicates that nothing is important.

5 · Before/after contrast made visible, not buried

The original writes "Previously: Required custom connectors" in italic fine print below the feature body. This is the most persuasive sentence in each block — the proof that something actually changed — and it's the least visible thing. The rewrite integrates before/after contrast into the main copy: "A series of low-signal actions that each appear normal... gets identified and blocked." The contrast is the story, not the footnote.

6 · Third-party social proof replaces technical spec

Cato saying their AI Security platform is good is expected. Marc Crudgington of Crane Worldwide saying "that used to require three separate tools" is not. Third-party, named, role-specific validation — from a VP of Cybersecurity, not an anonymous user — is the highest-trust asset on any product page. It answers the question the reader is actually asking: does this work in practice, at scale, for someone in my role?

7 · CTA installed where none existed

The original product update has no call to action anywhere. A reader who is now interested in Neural Edge, AI Security, or the modular model has no clear next step — so they close the tab. "See what changed in my account →" uses ownership language and implies the change is already waiting for them. "Book a walkthrough with Cato" captures the reader one step further along. Every page that conveys value without a CTA is leaving conversion on the table.

This is the Strategic Flow method

The same principles apply to product pages, release notes, and documentation as to email campaigns. Lead with consequence. Let the most important change headline the page. Make the before/after contrast the story, not the footnote. Add third-party proof. And always — always — give the reader a clear next step. Visit strategicflow.carrd.co to get started.