CATO always on

It's because the initial client doesn't have a configuration and it's the same package for everyone. To push configuration prior to authenticating even once and getting a policy, certain registry keys can be rolled out to systems alongside the install package. One is mentioned on this article for initial always on: https://support.catonetworks.com/hc/en-us/articles/4417643184529-Protecting-Users-with-Always-On-Security 

To configure the Windows registry to enforce Always-On:

1. Go to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\CatoNetworksVPN
2. Define this key:
3. • InitialAlwaysOn=1 (DWORD)