Prisma Access by Palo Alto Networks vs Saviynt Identity Cloud comparison

The compared Palo Alto Networks and Saviynt solutions aren't in the same category. Palo Alto Networks is ranked #1 in SASE , with an average rating of 8.2, and holds a 12.3% mindshare in the category. Saviynt is ranked #4 in IGA , with an average rating of 7.3, and holds a 19.0% mindshare. Additionally, 92% of Palo Alto Networks users are willing to recommend the solution, compared to 80% of Saviynt users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Feb 8, 2026

Saviynt and Prisma Access by Palo Alto Networks are competing in the identity governance and network security categories. Prisma Access appears to have the upper hand due to its comprehensive features and ease of deployment.

Features: Saviynt includes robust identity management, scalable governance options, and strong security compliance features. Prisma Access offers advanced threat prevention, global network security, and integrates threat intelligence directly with network protection, making it superior for network security.

Room for Improvement: Saviynt could enhance its deployment speed and user interface for more straightforward navigation. Its documentation and community resources need expansion for easier user support. Scalability options may also need enhancement. Prisma Access may improve on customizability to suit specific organizational needs, expand initial setup support, and offer more detailed user training for complex configurations.

Ease of Deployment and Customer Service: Prisma Access excels with a streamlined deployment process and extensive customer support, ensuring rapid implementation and problem-solving. Saviynt requires more configuration, which can delay deployment, although its support team is knowledgeable and helpful.

Pricing and ROI: Saviynt is perceived to have reasonable setup costs with increasing returns as identity management needs scale. Prisma Access, while having higher initial costs, delivers a significant ROI due to its extensive security features, making it valuable for enterprises prioritizing network security.

To learn more, read our detailed Prisma Access by Palo Alto Networks vs. Saviynt Identity Cloud Report (Updated: July 2024).

Buyer's Guide

Prisma Access by Palo Alto Networks vs. Saviynt Identity Cloud

July 2024

Download the complete report

Helped 882,333 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

iboss

Mindshare comparison

Secure Access Service Edge (SASE) Market Share Distribution
Product	Market Share (%)
Prisma Access by Palo Alto Networks	12.3%
Cato SASE Cloud Platform	10.2%
Zscaler Zero Trust Exchange Platform	9.7%
Other	67.8%

Secure Access Service Edge (SASE)

Identity Governance Administration (IGA) Market Share Distribution
Product	Market Share (%)
Saviynt Identity Cloud	19.0%
SailPoint Identity Security Cloud	33.8%
Omada Identity	11.5%
Other	35.7%

Identity Governance Administration (IGA)

Featured Reviews

reviewer2701851

Managing Director

Enhances web security with a single pane of glass and flexible deployment

I don't see any need for improvement; one of the really good things about iboss as a company is that they listen to customer feedback. I have suggested enhancements, and they are responsive, making changes for the better, and they do a lot of testing. To improve iboss, although we haven't used it, we considered the VPN solution that comes with the highest tier licensing, which includes DLP and various other add-ons. We prefer using another product which automatically logs you back onto your network when turning on your PC. With iboss, the connection is manual, which doesn't meet our needs. Additionally, sizing can be tricky because, although the initial recommendations may seem adequate, actual usage may require more gateways than anticipated.

Read full review

IgorPinter

Director at PULSEC

Zero-trust access has improved remote security and now simplifies cloud-based firewall management

Regarding the integration part for Prisma Access by Palo Alto Networks, the integration with identity providers is pretty much good. It is basically firewall as a service, so it performs well. I completed the integration without any issues. What Palo Alto Networks can do better for Prisma Access by Palo Alto Networks is probably to have the point of presence available in more locations. The point of presence from the Serbia region has the nearest POP in Frankfurt, which is an issue since it is your gateway—when you start browsing the internet, you go through a commercial connection in Germany. They definitely need to spread the service in other countries.

Read full review

reviewer2774067

Software Engineer at a tech consulting company with 11-50 employees

Has reduced manual work and shortened project timelines through faster deployment and intuitive workflows

One of the challenges regarding Saviynt is the lack of material available on the web, as searching on Google or YouTube often yields little information. Advertising Saviynt is necessary because I was not aware of it a couple of months ago, and it is a very helpful product for many organizations. In India, IGA solutions are not widely recognized, and Saviynt can utilize this point by promoting itself in the cybersecurity field. A significant challenge is the lack of people discussing Saviynt in the open market, as the forums provide slower responses compared to platforms like Reddit. Advancements related to AI would be very helpful. Saviynt should provide pricing for their university certifications, which is currently not publicly available. Information about enrolling requires an ID that is not easily obtained, as it can only be acquired through an organization. Some small wishlist features are related to APIs. As I work on projects, I find certain features to be much needed, but at a glance, they may not seem necessary. As I continue working with Saviynt, these small API-related features become apparent and would greatly enhance the experience.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It was a very easy product to install. It can be deployed very fast."

"iboss has significantly lowered the number of security incidents. It is crazy how much it blocks and how much it is aware of the outside danger."

"The security aspect of the solution, particularly the malware behind it, is excellent. That's something that really helped us out. It's not just a simple proxy that just blocks the insights of potential threats that come on behind it. They do malware detection and that helps us a lot."

"We were impressed by the solution's mental health function, which can detect if someone needs help. It scans what users are browsing and flags warning signs so we can check to see if they are okay. We've had to use it a couple of times."

"First of all, the security policies are essential. I do not have to rely solely on Active Directory for our users."

"Our primary use case for this product is DLP,"

"iboss is easy to use despite its complexity. Multiple engineers manage it, but it's significantly more straightforward to administer than traditional VPNs and web proxies."

"From a use-case scenario, what I like the most is the plug-in. I like the fact that we can do the filtering of these devices offsite independent of the network they are connected to, and we do not have to have traffic coming back inside our network."

More iboss pros

"There is a system for monitoring the traffic. You can monitor the traffic of the connected people and point out any issues on the connection part."

"Overall, the cost savings, ease of deployment, and better VPN user experience and performance are valuable."

"Prisma helped us build a moat around our production systems. It's now impossible to log into our production from a non-MDM laptop. Prisma Access provides decent security overall."

"The most valuable feature is the ability to join your network and provide access through the VPN."

"Security is absolutely spot-on, really top-notch. It's the result of all the components that come together, such as the HIP [Host Information Profile] and components like Forcepoint, providing end-user content inspection, and antivirus. It incorporates DLP features and that's fantastic because Prisma Access makes sure that all of the essential prerequisites are in place before a user can log in or can be tunneled into."

"The remediation process is easy compared to other platforms."

"The most valuable feature is the ability to change the gateway. For example, if there's a problem with a specific region or vendor, we can make modifications. The solution is scalable, and there are different gateways that can be created depending on the demand."

"Prisma Access protects all app traffic, so that users can gain access to all apps and that's very important because we need to be able to access everything. It also allows us to access non-web apps; anything internal that we need access to, we can access."

More Prisma Access by Palo Alto Networks pros

"The product's initial setup phase is easy."

"Saviynt is easy to configure and manage."

"The feature that we use the most is the global, third-party user management."

"Saviynt has positively impacted my organization by significantly reducing the time for a project where we previously used a spreadsheet for manual work to keep the data, and helped reduce that time from around two weeks to two to three days or even less."

"It's a highly functional system and a very well rounded solution. The onboarding of applications is solid. Their user access reviews are very good. Their role-based model and their identity life cycle stuff are solid. It's a very well rounded, strong product."

"We have found the implementation process to be very easy."

"Based on my experience working with Saviynt, they deserve a rating of nine because they are very responsive to support."

"The workflow in Saviynt is easier compared to other tools. It's pretty straightforward."

More Saviynt Identity Cloud pros

Cons

"Sometimes, obviously, there are bugs."

"Sometimes the agent stops working in iboss, and we have to reinstall the agent."

"Fold that in with the risk intelligence they're getting from all of the different subscriptions they are a part of. Now, these security companies subscribe to things like emerging threats, databases, etc. You can fold all this intelligence to decide what's happening on an endpoint. I would love to see them start moving into that space. That would compete directly with Microsoft. Maybe that's why they haven't. Having that ability native within the solution would be great. The other area in which I would love to see improvement is more detailed descriptions of why they block websites."

"I'd like to see them accelerate development on the security side, particularly around data loss prevention."

"Our biggest problem with their service was it did not recognize the device and filtering did not always work correctly."

"One thing I would like to see differently with their Zero Trust platform is that some of the AI aspects related to high-risk activities have more false positives."

"Our biggest problem with their service was it did not recognize the device and filtering did not always work correctly."

"The solution could be stronger on the integration side and offer more cloud applications like G Suite or Oracle."

More iboss cons

"It applies commits to the firewalls slowly. There isn't an API you can use for anything. We've previously had trouble with the egress IP addresses though we expressed to engineering that those mustn't change. They changed several times without warning, causing a lot of headaches."

"It's not very easy to use. Sometimes it's buggy and there are problems when doing updates. The user interface is okay, but some configuration items are difficult. I would like it to be less buggy and easier to configure, to better streamline the user experience."

"Palo Alto's operational and support model needs improvement since we have faced issues with resolving problems."

"GlobalProtect can face challenges with latency, especially when remote workers connect to centralized locations."

"There is some particular traffic that the security team wants to filter out and apply their own policies and they cannot."

"The solution’s stability could be improved."

"The Prisma Access could improve in terms of adding more machine learning and AI capabilities to automate tasks such as incident response."

"Sometimes, you have these notifications sent out about changes in App-IDs, modifications in App-IDs, or even the introduction of entirely new App-IDs to replace. Sometimes, the recommendations are followed, but even then, when the package is installed on the firewall, it gets messed up. I remember a particular one was with Tableau, and suddenly, people weren't able to use Tableau, which is an analytics tool for business."

More Prisma Access by Palo Alto Networks cons

"It should support more customizations. In SailPoint, we can do many customizations, but we are not able to do that in Saviynt. For workflows and other things, we can only use what is already in place. Saviynt has a lot of scope for improvement on the customization part."

"The UI doesn’t enhance the user experience."

"One of the challenges regarding Saviynt is the lack of material available on the web, as searching on Google or YouTube often yields little information."

"The custom application integration is a little complex, and this tool doesn't provide so many plugins or additional applications."

"One of the challenges regarding Saviynt is the lack of material available on the web, as searching on Google or YouTube often yields little information."

"While one product performed excellently, another was quite complex with code dating back 15 years."

"The product can improve the customer support offered to users since it is an area with shortcomings."

"One of the challenges regarding Saviynt is the lack of material available on the web, as searching on Google or YouTube often yields little information."

More Saviynt Identity Cloud cons

Pricing and Cost Advice

"It is expensive compared to one of its competitors."

"We have not priced the solution recently, but they were competitive with other vendors in the past."

"The overall pricing for iboss is very competitive and transparent."

"We had the cost of purchasing a new appliance along with the implementation and licensing costs. However, the following year, the cost of just licensing was similar to what was paid the previous year for a new appliance along with the implementation and licensing costs."

"It is not expensive, and it is also not cheap. iboss is priced right in the sweet spot for the number of features it offers."

"It is probably in line with other solutions, but I do not deal with the financial side."

"Compared to other products, the price is slightly high."

"Prisma is in the middle of the road. It's not the most expensive, but it's not the cheapest. There aren't any additional costs, to my knowledge. I know they have some extra modules, but we didn't use them."

"Prisma Access by Palo Alto Networks is an expensive solution, especially when compared to other solutions like Cisco. There are no additional charges apart from the standard licensing costs attached to the solution."

"Based on what I have heard from others, it is a pricey solution as compared to its peers, but I am not sure. However, considering the features that it offers, it is a break-even point. You get whatever they are promising."

"The pricing is very friendly. It's not confusing to figure out your workload and how much you'd be paying for the solution."

"The licensing model for this product is complicated and changes all the time, making it very hard for the user to comprehend the configuration."

"The pricing for this solution is on the higher end."

"The solution requires a license and the technical support has extra costs. The licensing model could improve."

More Prisma Access by Palo Alto Networks pricing and cost advice

"The pricing is comparable to Azure Entra ID. Kind of the same"

"Saviynt's pricing is acceptable and licensing costs are yearly."

"The solution has a pay-as-you-go licensing model, and you can subscribe monthly or yearly."

"The price of the license for this product is quite expensive."

"The product is less expensive than one of the competitors."

"If you are investing in securing your data and avoiding any non-compliance issues, then yes, it is certainly recommended. To put it plainly, if you're willing to pay fines and aren't concerned about the misuse of data, then there might not be a problem. However, if you intend to safeguard the data of your employees, vendors, and customers, it becomes crucial. In this context, managing data security requires preventive and detective measures, such as enforcing segregation of duties and regularly reviewing permissions. Throughout an individual's life cycle within an organization or customer life cycle, various access permissions are granted. Without taking action on these permissions, there is a risk of exposure later on. If individuals retain access after leaving the organization, it poses a serious security threat. Implementing solutions like Saviynt can address these challenges, ensuring continuous access review, generating reports, alerts, and identifying potential risks."

"If you need to make any changes then there are additional fees."

"Saviynt has a competitive price."

More Saviynt Identity Cloud pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Secure Access Service Edge (SASE) solutions are best for your needs.

See recommendations

882,333 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

11%

Computer Software Company

10%

Manufacturing Company

Comms Service Provider

Financial Services Firm

11%

Manufacturing Company

11%

Computer Software Company

10%

Government

Financial Services Firm

16%

Manufacturing Company

Computer Software Company

Educational Organization

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	6
Midsize Enterprise	6
Large Enterprise	5

By reviewers
Company Size	Count
Small Business	24
Midsize Enterprise	21
Large Enterprise	27

By reviewers
Company Size	Count
Small Business	6
Midsize Enterprise	5
Large Enterprise	15

Questions from the Community

What needs improvement with iboss?

For zero trust implementation, we encountered complexity issues, especially with a large infrastructure company Exxon...

See all answers

What is your primary use case for iboss?

Previously when I used iboss, we did the POC for iboss for ExxonMobil. Four or five people wanted to move from our ol...

See all answers

What is your experience regarding pricing and costs for iboss?

Regarding pricing, setup costs, and licensing, iboss is not cheap, and that's my only concern. There are cheaper alte...

See all answers

What is the better solution - Prisma Access or Zscaler Private Access?

We looked into Prisma Access before choosing Zscaler Private Access (ZPA). Palo Alto’s Prisma Access is a secure ac...

See all answers

What do you like most about Prisma Access by Palo Alto Networks?

The most valuable features of the solution are in the areas of the secure remote access it provides while also being ...

See all answers

What is your experience regarding pricing and costs for Prisma Access by Palo Alto Networks?

From my experience, Palo Alto is more expensive compared to solutions like Netskope and Triscale.

See all answers

What do you like most about Saviynt?

It is very easy to use. It addresses most of the trends in identity governance and risk management.

See all answers

What is your experience regarding pricing and costs for Saviynt?

Saviynt is very affordable compared to its competitors. It is cloud-based, making it significantly cheaper than on-pr...

See all answers

What needs improvement with Saviynt?

One of the challenges regarding Saviynt is the lack of material available on the web, as searching on Google or YouTu...

See all answers

Comparisons

Netskope vs iboss

Compared 12% of the time

FortiSASE vs iboss

Compared 8% of the time

Cisco Umbrella vs iboss

Compared 7% of the time

Fortinet FortiGate vs iboss

Compared 6% of the time

Zscaler Internet Access vs iboss

Compared 6% of the time

More iboss Competitors

Netskope vs Prisma Access by Palo Alto Networks

Compared 13% of the time

Zscaler Internet Access vs Prisma Access by Palo Alto Networks

Compared 9% of the time

FortiSASE vs Prisma Access by Palo Alto Networks

Compared 9% of the time

Cato SASE Cloud Platform vs Prisma Access by Palo Alto Networks

Compared 6% of the time

More Prisma Access by Palo Alto Networks Competitors

SailPoint Identity Security Cloud vs Saviynt Identity Cloud

Compared 24% of the time

Microsoft Entra ID vs Saviynt Identity Cloud

Compared 9% of the time

Okta Platform vs Saviynt Identity Cloud

Compared 8% of the time

Omada Identity vs Saviynt Identity Cloud

Compared 8% of the time

CyberArk Privileged Access Manager vs Saviynt Identity Cloud

Compared 7% of the time

More Saviynt Identity Cloud Competitors

Product Reports

Buyer's Guide

iboss

February 2026

Download iboss product report

Buyer's Guide

Prisma Access by Palo Alto Networks

January 2026

Prisma Access by Palo Alto Networks report

Download Prisma Access by Palo Alto Networks product report

Buyer's Guide

Saviynt Identity Cloud

January 2026

Download Saviynt Identity Cloud product report

Also Known As

iBoss Cloud Platform

Palo Alto Networks Prisma Access, Prisma Access, GlobalProtect, Palo Alto GlobalProtect Mobile Security Manager, Prisma SaaS by Palo Alto Networks, Prisma Access

No data available

Overview

Iboss offers a comprehensive cloud-based security platform valued for its scalability and autonomous features, ensuring robust security with easy deployment and management capabilities.

Renowned for its robust security architecture, Iboss integrates seamlessly within diverse networks, delivering efficient granular filtering and advanced content categorization. Its single pane of glass console provides ease of management, allowing rapid scalability suitable for rapidly deploying environments. Operates in BYOD setups due to inline filtering without device installation. Integration with cloud-based applications enhances user control, and features like SASE, SSL inspection, and ChatGPT risk protection stand as highlights. Despite its strengths, users have pointed out areas for enhancement like direct navigation in reports, SSL decryption, and better cloud integration while having room to improve data loss prevention.

What are the most important features of Iboss?

Scalability: Supports rapid deployment across diverse networks.
SASE: A consolidated approach to secure access.
SSL Inspection: Ensures safe data transmission.
Granular Filtering: Detailed control over accessible content.
Single Pane Management: Unifies control through a centralized console.

What benefits should users consider in reviews?

Cost-effectiveness: Offers competitive pricing with robust features.
Autonomous Operation: Reduces management overhead.
Responsive Support: Provides assistance when needed.
Flexible Deployment: Available for both cloud and on-premises environments.

The usage of Iboss spans educational institutions, specifically K-12, to enforce internet policies, protect data, and support remote work environments. It provides web filtering and security frameworks to ensure safe browsing. Its platform-as-a-service model offers flexibility for both cloud-based and on-premises requirements, integrating seamlessly to deliver enhanced security features suitable for various deployment needs including zero trust, CASB, and network security for work-from-home setups.

iboss

Prisma Access by Palo Alto Networks provides consistent security for all users and applications across your remote networks. Prisma Access grants users safe access to the cloud and data center applications and the internet as well. In addition, the solution combines all of your security and networking capabilities into a single cloud-delivered platform, enabling flexible hybrid workforces.

Prisma Access can be managed two ways:

Cloud Managed
Panorama Managed

Prisma Access delivers both networking and security services, including:

SD-WAN
VPN
Zero Trust network access (ZTNA)
Quality of service (QoS)
Clean Pipe
Firewall as a service (FWaaS)
DNS Security
Threat Prevention
Cloud secure web gateway (SWG)
Data loss prevention (DLP)
Cloud access security broker (CASB)

Prisma Access by Palo Alto Networks Features

Prisma Access by Palo Alto Networks has many valuable key features including: App-ID, User-ID, Device-ID, SSL Decryption, Dynamic User Group (DUG) Monitoring, AI/ML-Based Detection, IoT Security, Reporting, URL Filtering, Enterprise Data Loss Prevention (DLP), Digital Experience Monitoring (DEM)*, Logging, Policy Automation, Intrusion Prevention System (IPS), and many more.

Prisma Access by Palo Alto Networks Benefits

Some of the benefits of using Prisma Access by Palo Alto Networks include:

Security: Prisma Access gives you consistent security to protect against cyberattacks, with enforcement of policy at every location. By implementing Prisma Access, you also gain protection that works to prevent known and unknown malware, exploits, credential theft, command and control, and many other attack vectors across all ports and protocols.
Global connectivity: Prisma Access provides global coverage through use of its connectivity layer.
Scalability: With Prisma Access, scaling is automatically managed and is scalable, flexible, and agile.
Instant deployment: Deployment is fast, eliminating wasted time that may otherwise be associated with setting up a solution, operating it, or shipping hardware in order to get started.

Reviews from Real Users

Below are some reviews and helpful feedback written by Microsoft Azure Synapse Analytics

users who are currently using the solution.

PeerSpot user Partha D., Global Network Tech Lead at a computer software company, speaks about his experience using the product, saying, "It protects all app traffic so that users can gain access to all apps. Unlike other solutions that only work from ports 80 and 443, which are predominantly for web traffic, Prisma Access covers all protocols and works on all traffic patterns... The most sophisticated attacks can arise from sources that are not behind 80/443."

Tejas J., a Sr. Cloud Security Architect at a computer software company, mentions that "it is geographically dispersed, and it sits on top of Google and AWS platforms. Therefore, you don't face the standard issues, such as latency or bandwidth issues, that you usually face in the case of on-prem data centers.”

Another PeerSpot reviewer, Max I., Associate Director at Cognizant, comments that "Security is absolutely spot-on, really top-notch. It's the result of all the components that come together, such as the HIP [Host Information Profile] and components like Forcepoint, providing end-user content inspection, and antivirus. It incorporates DLP features and that's fantastic because Prisma Access makes sure that all of the essential prerequisites are in place before a user can log in or can be tunneled into."

Palo Alto Networks

Saviynt Identity Cloud provides effective identity management with seamless enterprise integration, simplifying self-service requests, workflows, and access management tasks.

Saviynt Identity Cloud is renowned for its robust identity governance and lifecycle management capabilities, facilitating user authentication, access provisioning, and certification. Its intuitive design supports integration within enterprise workflows, aiding reporting, attestation, and auditing processes. This cloud platform enhances risk management through an analytics-driven approach, offering flexibility and scalability to serve industries such as finance and healthcare. Despite its strengths, it requires enhancements in interface customization, training resources, and better-performing high-volume tasks.

What key features does Saviynt Identity Cloud offer?

Identity Management: Centralized control over identities and access privileges.
Seamless Integration: Compatible with enterprise systems, ensuring smooth deployment.
Role-Based Models: Simplifies assignment and management of user roles.
Risk Management: AI-driven analytics to enhance security measures.
Customization: Supports diverse business needs through flexible configuration.

What benefits and ROI can users expect?

Cost-Effectiveness: Optimizes investment with flexible pricing plans.
Scalability: Accommodates growing business demands without additional complexity.
Efficiency: Streamlines processes for user onboarding and offboarding.
Comprehensive Reporting: Detailed insights for improved decision-making.

Industries such as government, finance, and education implement Saviynt Identity Cloud for identity management across enterprise applications. Its flexibility allows handling external identities and managing workflows, particularly for sectors needing robust security and compliance. Larger enterprises benefit from its ability to integrate well into existing systems, ensuring seamless onboarding and offboarding processes.

Saviynt

Sample Customers

More than 4,000 global enterprises trust the iboss Cloud Platform to support their modern workforces, including a large number of Fortune 50 companies.

Concord Hospital, State of Colorado, Essilor International, RheinLand Versicherungsgruppe, University of Westminster, Universidade Nove de Julho, SPAR Austria, CAME Group, ZipRealty, Greenhill & Co., IKT Agder, Aviva Stadium, Animal Logic, Management & Training Corporation, Brigham Young University Hawaii, School District of Chilliwack

Shell, McKesson, Kimberly-Clark, Ingram Micro, Intermountain Health Care, Forterra, CoreLogic

Buyer's Guide

Prisma Access by Palo Alto Networks vs. Saviynt Identity Cloud

July 2024

Free Report: Prisma Access by Palo Alto Networks vs. Saviynt Identity Cloud

Find out what your peers are saying about Prisma Access by Palo Alto Networks vs. Saviynt Identity Cloud and other solutions. Updated: July 2024.

DOWNLOAD NOW

882,333 professionals have used our research since 2012.

See our Prisma Access by Palo Alto Networks vs. Saviynt Identity Cloud report.

We monitor all Secure Access Service Edge (SASE) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.