I like that the product is managed by PAN. I'm responsible for implementing the security features and policy, without having to maintain the backend systems that enable these features and policies. I can focus on the security aspects that bring value instead of putting effort and specialist-power into product operations.

If you run have snowflake use-cases or cannot modernise some of your applications / designs, there are fewer knobs to turn to make it work, as it is a managed service. In other solutions where you have direct control over the devices and infrastructure - you have more options to implement workarounds for your tech-debt. In a perfect world, this would be a positive as it forces you to follow proper design / application guidelines, but for our imperfect, legacy-riddled, brown-field environments it can complicate matters.