Understanding Threat Prevention Policies in Cato

Cyberattacks have evolved well beyond what legacy firewalls were designed to handle. Ransomware dropper payloads, DNS tunneling, encrypted C2 (command-and-control) channels, and zero-day exploits now routinely bypass perimeter-only defenses — leaving organizations exposed.

Cato SASE (Secure Access Service Edge) takes a fundamentally different approach. Rather than bolting security onto the network edge, Cato integrates multi-layered threat prevention natively into its global private backbone — enforcing policy inline, at wire speed, without latency trade-offs.

This guide covers everything you need to know to configure, tune, and monitor Cato SASE threat prevention policies in 2026 — from IPS and Anti-Malware to DNS Security, TLS Inspection, and Managed Threat Intelligence.

Key Takeways

• What threat prevention policies in Cato are and how they work
• Key inspection engines (IPS, Anti-Malware, DNS Security, TLS Inspection)
• How Managed Threat Intelligence enhances protection
• Configuring prevention profiles per site, user, or application
• Using policy exceptions for business needs
• Monitoring security events and threat logs
• Real-world example of blocking ransomware traffic

Core Threat Prevention Engines in Cato SASE

Cato's security stack operates across all traffic — WAN and internet — through five integrated inspection engines:

1. Next-Generation Firewall (NGFW)

Application- and identity-aware access controls that go beyond port/protocol rules. NGFW enforces who can access what, based on user identity, device posture, and application context.

2. Intrusion Prevention System (IPS)

Cato IPS detects and blocks exploits, known vulnerabilities, protocol tunneling, stealth protocols, and anomalous behavior — in real time and inline. It covers WAN, inbound, and outbound traffic simultaneously.

3. Anti-Malware

Combines cloud-based signature databases with behavioral heuristics to detect and block malware, ransomware droppers, and file-based attacks at the point of entry — before execution.

4. DNS Security

Blocks malicious DNS queries, stops phishing domain lookups, restricts newly registered domains, and supports DNS sinkholing to immediately identify compromised hosts. This is one of the most underutilized — yet highly effective — threat prevention controls available.

5. TLS/SSL Inspection

Up to 95% of enterprise traffic is now encrypted. Without TLS inspection, IPS and Anti-Malware are effectively blind. Cato decrypts, inspects, and re-encrypts traffic inline — with no detour to a separate proxy appliance.

Key advantage: All five engines operate in a single-pass architecture. There's no backhauling, no chained appliances, and no noticeable latency impact.

Get Your Free SASE Assessment

Managed Threat Intelligence (MTI)

What makes Cato's prevention effective at scale is the Managed Threat Intelligence platform feeding each engine continuously.

MTI feeds directly into IPS signatures, DNS blocklists, Anti-Malware definitions, and the XDR (Extended Detection and Response) correlation engine. Unlike static signature updates on traditional appliances, this is a living, continuously tuned intelligence feed — with no manual intervention required.

Also Read: Auto-Adaptive Threat Prevention: How SASE Stops Modern Cyberattacks

How to Configure Threat Prevention Policies in Cato SASE

Cato's threat prevention is profile-driven, meaning each site, remote user group, or socket can inherit a tailored prevention profile. This gives security teams granular control without creating policy sprawl.

Step-by-Step Configuration

Step 1: In the Cato Management Application, navigate to Security → Threat Prevention.

Step 2: Select an existing Prevention Profile or create a new one.

Step 3: Toggle the relevant inspection engines:

• IPS (Intrusion Prevention)
• Anti-Malware
• DNS Security
• TLS/SSL Inspection

Step 4: Set enforcement actions per engine:

• Block — Drop the traffic silently or with a reset
• Alert — Log and notify without blocking (useful during testing)
• Allow — Permit with logging for audit purposes

Step 5: Configure logging preferences for blocked and allowed events.

Step 6: Apply the profile to the appropriate sites, user groups, or individual sockets.

Pro tip: Use separate profiles for headquarters and datacenters (strict) vs. branch offices (balanced). This prevents over-blocking at critical sites while maintaining strong protection everywhere else.

Managing Exceptions

Sometimes, legitimate applications may trigger false positives. To handle this:

• Add exceptions for trusted apps, file hashes, or domains.
• Narrow exceptions by user group or site instead of global.
• Review exceptions quarterly to minimize exposure.

DNS Protections Under IPS

Cato’s IPS policy includes DNS protections for advanced control:

• Block or sinkhole queries to malicious domains.
• Enforce restrictions on **newly registered domains **
• Allowlist trusted domains or DNS signatures to reduce false positives.
   

Also Read: Vendor Consolidation: Why SASE is the Future of IT

Monitoring Security Events

Cato provides detailed visibility into all blocked or allowed threats via:

• Events > Security Events – Shows IPS hits, malware blocks, DNS queries, TLS anomalies.
• Analytics > Threat Analytics – Trends, top affected sites, and user breakdowns.
• System Events – High-level prevention actions across the backbone.

Real-World Use Case: Blocking Ransomware Traffic

A financial services firm in Dubai deployed Cato SASE with IPS + Anti-Malware + DNS Security enabled. Within days:

• IPS blocked exploit attempts against an outdated VPN service.
• Anti-Malware prevented a ransomware dropper from downloading its payload.
• DNS Security sinkholed traffic to a known C2 domain, allowing quick host identification.

The SOC team used Threat Analytics to review all blocked attempts and reported zero successful breaches.
 

Tips for Effective Threat Prevention

• Enable TLS inspection for full visibility into encrypted traffic.
• Apply different prevention profiles for HQ/datacenters vs. branch sites.
• Use custom exceptions sparingly and review quarterly.
• Correlate threat prevention logs with your SIEM for end-to-end visibility.
• Test policies by running controlled red-team simulations.

MITRE ATT&CK Alignment

Cato's threat prevention maps directly to MITRE ATT&CK tactics, including:

8 Best Practices for Cato Threat Prevention in 2026

1. Enable TLS inspection — Encrypted threats are invisible without it. This is non-negotiable for effective Anti-Malware and IPS coverage.
2. Use tiered prevention profiles — Separate HQ/datacenter from branch and remote user profiles.
3. Start IPS in Alert mode, then promote to Block — Validate your environment before enforcing, especially for legacy or OT-adjacent systems.
4. Enable DNS sinkholing — It's one of the fastest ways to identify compromised hosts during an incident.
5. Restrict newly registered domains — Block or alert on NRDs unless your business has a legitimate reason to access them.
6. Scope exceptions tightly and review quarterly — Every broad exception is a potential blind spot.
7. Forward events to your SIEM — Inline prevention data is most powerful when correlated with endpoint and identity telemetry.
8. Run red team simulations — Test your prevention policies with controlled attack simulations at least twice a year.

Conclusion

Cato SASE delivers enterprise-grade threat prevention through a tightly integrated stack — IPS, Anti-Malware, DNS Security, TLS Inspection, and Managed Threat Intelligence — all enforced inline across every traffic flow without appliance overhead. When configured correctly with tiered profiles, targeted exceptions, and active monitoring, it provides the layered defense modern networks require against ransomware, C2 traffic, and zero-day exploits.

Book a free consultation with our experts to explore how Cato’s IPS, DNS Security, and TLS inspection can safeguard your network. 

Book Now

FAQ 

What is Managed Threat Intelligence and how often is it updated?

Cato ingests ~250 sources, totaling ~20 million IOCs. After filtering false positives, ~18 million validated IOCs are enforced, updated automatically every ~3 hours.
 

Can I run IPS in monitor-only mode?

Yes. IPS can be configured to alert without blocking, useful for testing before enforcement.
 

How does DNS sinkholing help in threat response?

When a domain is sinkholed, the malicious query resolves to an internal IP, enabling administrators to trace the compromised host and respond quickly.
 

How are Anti-Malware exceptions configured?

You can allow trusted domains, file hashes, or applications in the Anti-Malware policy. Exceptions should be reviewed regularly to avoid exposure.
 

Does TLS inspection improve threat prevention?

Yes. TLS inspection enables detection of hidden exploits, malware downloads, and stealth tunneling protocols inside encrypted traffic.