Cato’s ASK AI Assistant: Turning Complex Network Operations Into Simple Conversations

Every superhero needs a sidekick. For your network and security teams, that is Cato’s ASK AI Assistant, our new AI Assistant built to help you see, solve, and secure faster than ever. This isn’t a basic Q&A tool. It brings customer-specific information and ability to work with other tools to answer complex questions about AI security and more.

The Next Chapter of SASE Operations

Networking and security teams face endless complexity: multiple dashboards, fragmented logs, and hours of manual correlation just to answer a simple “Why is this slow?”

Cato’s ASK AI Assistant changes that. Built into the Cato SASE Platform , it is a unified AI Assistant that brings context, reasoning, and data together in a single conversational flow. Ask a question in natural language, and Cato’s ASK AI Assistant delivers clarity in seconds.

Insight at the Speed of Conversation

Real-World Scenario Examples Where Cato’s ASK AI Assistant Can Save Time

Before you watch the demo, here is a quick overview of the three examples we will showcase. Each one highlights how Cato’s ASK AI Assistant turns operational challenges into fast, guided analysis that saves time and improves visibility.

• User Access Investigation: OneDrive Tenant Blocked
  A user reports they cannot access their OneDrive tenant. Cato’s ASK AI Assistant analyzes the issue step by step by checking the user’s status, performing application access analysis, and reviewing recent activity. It then suggests mitigation steps to restore access securely. 

• Client Version and Compliance Check
  Cato’s ASK AI Assistant retrieves the installed Cato Client versions across the account, along with the operating system distribution. Using its reasoning loop mechanism, it gathers data from multiple sources and agents to provide a comprehensive view. The Assistant then applies best practices for client upgrades and compliance, summarizing key recommendations tailored to the account’s current posture.

• Environment Health Report Generation
  Cato’s ASK AI Assistant compiles a complete health report for the environment, including site connectivity status, network health metrics, and user connectivity summaries. The result is a clear, actionable view of the environment’s overall state and stability.

Each of these workflows would normally require much more time of cross-team analysis. With Cato’s ASK AI Assistant, they become a guided conversation that dramatically reduces investigation time and gives teams confidence in their next move.

Why We Built Cato’s ASK AI Assistant

An Assistant That Understands Your World

Cato’s ASK AI Assistant is designed to think the way your team does, allowing you to explore the SASE platform in new ways with true convergence across networking, access, identity, and security.

It is built on three guiding principles:

• Context That Matters
  It is account aware. By leveraging Cato’s GraphQL queries, it pulls live data from your environment, so every response reflects your reality.
• Toolsets That Work Together
  Instead of single API calls, Cato’s ASK AI Assistant uses toolsets: curated bundles of queries and documentation scoped to networking and security domains. Whether you need guidance or live data, it brings the right tools to the conversation.
• Reasoning That Scales
  It goes beyond simple Q&A. It can plan, chain steps, and combine multiple tools to resolve complex tasks, which reduces the back-and-forth analysts face today.

What’s in This Release

Making Cato’s ASK AI Assistant Agentic with Toolsets and Reasoning

The real transformation from Knowledge Assistant to Agentic Assistant was done by providing tools to access account specific data and enabling reasoning and planning of steps to take to derive an answer. Let’s unpack both of these capabilities.

Toolsets

Toolsets are bundled tools covering a specific functionality. They enable Cato’s ASK AI Assistant to take action and interact with real account data. Tools cover the functionality of our public GraphQL API, with additional tuning to enable easier and more accurate interaction for the LLM. Cato’s ASK AI Assistant receives as context the full API documentation with tailored instructions and generates the query arguments to fetch relevant data based on the user’s query. In the example below (Figure 1), Cato’s ASK AI Assistant calls the Entity Lookup query with relevant arguments to validate there is a VPN user named “John” connected to the platform in the given account.

Figure 1: Accessing account data with tool usage. 

Cato’s ASK AI Assistant ships today with two foundational toolsets:

• Knowledge
  Tools backed by RAG to fetch product and API documentation on demand. This ensures explanations, examples, and guidance are always grounded and up to date.
• Network Data & Analytics
  Full support for account-specific network data and analytics, like Cato’s public MCP.

Together, these toolsets transform what used to be hours of doc-searching and log-parsing into a single guided conversation.

At this stage, Cato’s ASK AI Assistant provides knowledge and analytics. It does not yet perform configuration changes or direct actions in your environment.

Reasoning and Planning

Agents need reasoning to interpret information, make decisions, and adapt to uncertainty, and planning to sequence actions toward long-term goals efficiently. In our case, reasoning occurs within a reasoning loop – a cycle of observing the environment, interpreting information, choosing the next action, and reflecting on the outcome, allowing Cato’s ASK AI Assistant to adapt step by step.

Technical Walkthrough: How Cato’S ASK AI Assistant Reasoning Supports a user requests: “What Socket type do we have in AWS site in Frankfurt?”

Cato’s ASK AI Assistant solves this by combining a couple of tools from the Data & Analytics toolset:

• EntityLookup searches for entities of a specific type, with support for filtering and pagination. In this case, it interprets “AWS site in Frankfurt” to site name “AWS_Frankfurt_IT” and resolves it to a site ID (for example, main HQ → id: 30900).
• AccountSnapshot provides near real-time, snapshot-based metrics for an account. After resolving the site ID, it uses AccountSnapshot to fetch the connected socket type in the selected site.

In the example below (Figure 2), we illustrate how it uses its reasoning cycle to progressively observe account data, interpret information, choose the next tool call and reflect on the outcome until it reaches a final answer. For complex scenarios, it can also invest time in planning sequence actions before acting.

Figure 2: Applying reasoning to reach a solution.

Accessing Documentation when Needed

The first generation of our Assistant acted as a Knowledge Assistant. It pulled from product documentation and API references using a retrieval-augmented generation (RAG) pipeline to provide curated explanations and examples from relevant up to date context. This process included two phases – Data Indexing and Data Retrieval as displayed in Figure 3. The Data Indexing is a weekly offline job that collects all our public product and API documentation and indexes the information in embedded vector form into a knowledge vector DB. The Data Retrieval phase is executed online when a user submits a query to the Assistant. Each query is embedded in vector form and is used to retrieve relevant context from the knowledge vector DB based on semantic similarity.

Figure 3: The two phases of the RAG pipeline – Data Indexing (upper) and Data Retrieval.

RAG is now just one of many tools. With the new release of Cato’s AI Assistant relevant documentation is fetched depending on the user’s query as shown in Figure 4.

Figure 4 + 5: Workflow of Previous Knowledge Assistant vs New Release of Cato AI Assistant.

What’s Next

Scaling the Cato’s ASK AI Assistant Vision

This is just the beginning. Upcoming milestones include:

• More Product Coverage
  Expansion of toolsets to cover additional networking, security and audit areas.
• Remote MCP
  A single managed remote MCP server, enabling customers to connect their own MCP clients to Cato’s ASK AI Assistant’s toolsets.
• Safe Action Support
  Moving Cato’s ASK AI Assistant beyond insight into RBAC-controlled, permissioned configuration actions.

Why It Matters

The Convergence of Operations

SASE converges networking and security into a single platform. Cato’s ASK AI Assistant extends that convergence into operations, giving teams one assistant that understands their data, speaks their environment’s language, and helps them solve problems faster.

For our customers, the value is clear:

• Time savings: troubleshooting drops from hours to minutes.
• Efficiency: less context switching between consoles and teams.
• Precision: root causes are identified quickly and reliably.
• Empowerment: every team member gains access to expert-level insights.

Cato’s ASK AI Assistant is not just about faster answers. It is about transforming how NetSec operations get done and giving every team their own sidekick for the SASE era.

Want to dive deeper? Visit our Learning Center to see more about how Cato’s ASK AI Assistant helps you analyze your account data and accelerate operations.