What does single-pass mean?
In a single-pass design, traffic enters the security service once. It is decrypted once, classified once, and every security function (firewall rules, threat prevention, web filtering, data inspection) reads from that same pass before the traffic leaves. The result is one decision path and one place where policy is applied.
What is service chaining?
Service chaining is the older pattern. Traffic passes through one engine, then another, then another: perhaps a firewall, then a proxy, then a data inspection service. Each engine may decrypt, parse and log the traffic again. Each has its own rules, its own release cycle and often its own console. Chaining can work well, but every extra hop adds latency, configuration and a place where policies can drift apart.
Why does it matter for operations?
The question this site asks is about operational overhead. A single-pass engine means one rule base to review, one set of logs to correlate and one software stack for the vendor to patch. A chain of engines means more moving parts, even when they are delivered from one cloud. That is why converged architecture carries the largest weight in our ranking.
Which vendors use single-pass wording?
On the pages we read, Cato is the only vendor in our set that states single-pass inspection. Cato describes a "single-pass engine, single data lake, and single policy enforcement" and names its engine the Single Pass Cloud Engine, or SPACE.
Source: Cato Networks homepage
Other vendors describe their designs differently. Fortinet states "one operating system, client, and data lake". Netskope states "one engine, one client, one console and one network". Zscaler describes a proxy architecture with full TLS inspection. Palo Alto Networks and Cisco do not use single-pass wording on the pages we read.
Source: Fortinet FortiSASE
Source: Netskope One
Source: Zscaler Zero Trust Exchange
How should you test the claim?
Wording is not proof. In a proof of concept, ask each vendor to show where decryption happens, how many times a session is inspected, and whether the firewall, threat prevention and data inspection share one policy table. Ask for logs from one session and check whether every security verdict appears in one record or in several.
What should you take from this?
Single-pass is a design choice that reduces moving parts. It is not the only route to a working SASE service, and a vendor without the wording may still process traffic efficiently. Treat it as a question to ask, and score the answers you get in writing.
Does single-pass change how you troubleshoot?
It can. When every verdict comes from one pass, one log line can explain why a session was allowed or blocked. When engines are chained, an analyst may need to read the firewall log, the proxy log and the data inspection log, then line them up by time. During a trial, ask an engineer from each vendor to explain one blocked session from your own traffic, and note how many screens and logs they open to do it.