I’m currently looking at Prisma Cloud and I’m keen to hear from people who have actually deployed and operated it, rather than just gone through the sales/demo process.
Main things I’m trying to understand:

How painful was the initial setup?
How much work was involved in deploying Defenders and setting up serverless coverage?
How long did it take before you had genuinely useful visibility across the environment?
Once it was up and running, did it actually improve security outcomes, or did you find yourselves spending a lot of time configuring/tuning the platform?
What’s the day-to-day UX like for the security team?

Anything you discovered after buying it that you wish you’d known beforehand?

I’m also interested in experiences with **Prisma Cloud Compute Edition / self-hosted**. It looks like there are some benefits, but also potentially a fair bit more operational overhead.

Would be great to hear from anyone running it in production, especially around upgrades, scaling, maintenance and whether you’d choose self-hosted again.

If anyone here is **in Australia** and has used Prisma Cloud at a decent scale or has chosen a different vendor, I’d also be happy to chat via DM. I’m mainly looking for independent references before we go too far down the procurement path.

Not looking for vendor pitches, just candid practitioner experiences, good or bad.

Looking for input from people who've actually shipped custom domains for a multi-tenant SaaS, because I want to avoid picking the wrong path and regretting it later.

Current setup:

• Multi-tenant events platform on AWS
• Frontend is a React app — dist folder on S3, served through CloudFront
• Today every tenant gets a platform subdomain (tenant.stage.example.com) via a wildcard cert on CloudFront. Frontend reads the hostname, asks the backend "which event is this?", renders accordingly.
• API calls go to a fixed, separate domain (api.example.com) — so the custom domain is only needed for serving the static frontend, not the API.

What we want:
Clients want to bring their own domains (portal.clientbrand.com) instead of our subdomain. So I need per-domain TLS that issues + renews automatically, with no manual step per client.

Options I'm weighing:

1. CloudFront manual + automation — add each domain as an alternate domain name + ACM cert via a script. Works, but there's the ~100 CNAMEs-per-distribution wall, and one cert per distribution feels fragile at scale.
2. CloudFront SaaS Manager (the multi-tenant distribution thing from 2025) — looks purpose-built for this, up to ~2000 domains, per-tenant ACM. Since we're already on CloudFront this seems like the least-effort path, but I haven't found many real-world reports.
3. Caddy on-demand TLS — reverse proxy that issues certs on first handshake. Unlimited scale, but it's a new component to run/monitor, and I'd need the ask endpoint to avoid getting our Let's Encrypt limits burned by random hostnames.
4. Managed service (Approximated / similar) — lowest effort, but monthly cost + another third party in the traffic path.

Questions:

• For anyone running CloudFront SaaS Manager in production — is it solid? Any gotchas with cert provisioning, DNS validation, or pricing at scale?
• Given our API is already on a fixed domain (custom domain = static content only), is a reverse proxy like Caddy overkill for us?
• Anyone regret going the manual-CloudFront-automation route and wish they'd started with something else?

Expected scale is realistically low-hundreds of custom domains over time, not thousands. Trying to pick something that won't need re-architecting in a year.

Thanks in advance 🙏