Why do vendor numbers need care?
Numbers look precise, which makes them persuasive. On vendor pages they rarely come with a method. A figure can be correct and still not comparable with another vendor's figure on the same topic. On this site, every such number appears in a box labelled with the vendor's name and linked to its source page.
Uptime figures
Cato states a "99.999% uptime SLA" on its backbone page.
Source: Cato global private backbone
Palo Alto Networks states a 99.999% uptime SLA for Prisma Access.
Source: Palo Alto Networks Prisma Access
Five nines allows a little over five minutes of downtime a year. What matters is in the SLA document: what counts as downtime, where it is measured, whether partial outages count, and what credit you receive. Neither page includes the terms.
Network size
Cato states 100+ PoPs on its private backbone.
Source: Cato global private backbone
Fortinet states 200+ PoPs on Fortinet-owned infrastructure, extended through public clouds.
Source: Fortinet FortiSASE
Netskope states 120+ data centers in 80+ regions.
Source: Netskope NewEdge
These are three different units. A larger count does not tell you which services run at the location nearest your users, or how traffic travels between locations.
Threat and signal totals
Palo Alto Networks states "8.95 M New Zero-Day threats prevented everyday" without a stated basis on the page.
Source: Palo Alto Networks Prisma Access
Zscaler states its policy decisions use "more than 500 trillion daily signals".
Source: Zscaler Zero Trust Exchange
Totals like these describe the size of a vendor's customer base and telemetry as much as the quality of its protection. They are not a measure of how well the platform protects your traffic.
App catalogue sizes
In AI security, vendors state catalogue sizes. Palo Alto Networks states "4000+ GenAI applications" for AI Access Security.
Zscaler states discovery "across 2,900+ apps" on its AI security page and "thousands of AI apps" on its AI Access page.
Source: Zscaler AI security
A catalogue matters only if the apps your staff use are in it and classified correctly; ask for a search against your own list.
Research statistics
Netskope quotes its own research that "72% of generative AI use in the enterprise is shadow AI", from a 2025 Netskope Threat Labs report.
Source: Netskope securing generative AI
Research statistics describe a sample, not your organization. They are useful for framing a problem, less so for choosing a vendor.
Response times
Cato publishes a Detect to Protect log of critical CVEs; most 2026 entries read 1 or 2 days, and Log4Shell is listed at 17 hours and 2 minutes.
Source: Cato Rapid CVE Mitigation
Cato's blog describes an AI-agent pilot in which signature generation took as little as 45 minutes, with researcher review before deployment.
A log is more specific than a headline figure because it lists cases, but it is still the vendor's record.
How should you use the numbers?
Ask three things of every figure. What is the unit? What is the basis or method? Can the vendor give the same figure for your own environment during a trial? A number you can reproduce is evidence. A number you cannot is a claim.
How does this site handle them?
We do not score raw counts. Network scores reflect what each vendor states about owning and operating its network and any uptime commitment, quoted in its words. Response transparency rewards a published record, not a headline number.
What about customer counts and testimonials?
Vendor pages also carry customer counts and quotes. Cato states "thousands of customers worldwide" in its July 2026 press release.
Source: Cato news: Leader in the 2026 Gartner Magic Quadrant for SASE Platforms
Zscaler quotes a transportation customer with "80,000+ employees, 350+ locations worldwide".
Source: Zscaler Zero Trust Exchange
These are selected by the vendor. They show that a platform runs at scale somewhere, not that it fits your estate. Ask for reference customers with a similar number of sites, regions and users, and speak to their network team, not only their security team.
The short version
Treat every vendor number as a labelled claim. Check the unit, ask for the method, and measure what you can yourself.