Cloudflare offer granular SASE solutions, with strong offerings for remote workers.
Author: Netify Research Team
If you have questions about Cloudflare and how their capability is aligned to your needs, email the Netify research team. UK: uk@netify.co.uk North America: northamerica@netify.com
(Please use the UK email for ROW - Rest of the World - questions or enquiries)
Request the very latest Cloudflare SASE sales PDF directly from your local account team. Please check your junk folder if not received.
Complete your details to arrange a demo of Cloudflare. You will receive contact requesting available dates and times - please check your junk folder if not received.
Request your local in-country sales contact. You will receive details as soon as possible - please check your junk folder if not received.
Cloudflare offer granular SASE security with strong Zero Trust services. Clients can benefit from the company’s wide range of solutions, each one with strong integration capabilities with other Cloudflare products. They also leverage their own global network, with connectivity to 100 countries, including hard to reach areas such as China.
Netify recommends Cloudflare to SMEs and large global enterprises in a variety of industry verticals looking for a SASE security solution that is available worldwide. However, caution may be taken as the solution does not offer Network Detection and Response (NDR) or Extended Detection and Response (XDR) services - these will have to be sourced from a third party provider.
Take our 90 second assessment quiz to find out which top 3 vendors or managed providers are a match for your answers.
Cloudflare is a security company that was founded in July 2009. They provide content delivery network, DDoS mitigation and SASE security for businesses, non-profits, developers and consumers. Their headquarters is in San Francisco, California, North America, employing 1,800 staff members. Cloudflare has its own global network, which can access over 250 cities in 100 countries worldwide, including hard-to-reach areas such as China. Over 10,000 networks already connect to Cloudflare with 100Tbps, allowing access to data centres located in Europe, North America, Mainland China, Latin America, Oceania, Asia, Africa and the Caribbean.
Cloudflare caters for E-commerce, the public sector, SaaS, financial services, healthcare, gaming, education and media and entertainment industry verticals. As of 2022, Cloudflare is running an exclusive program in partnership with Yubico, offering Yubico hardware security keys at a discounted rate for Cloudflare customers. Hardware keys are phish-proof and provide a high level of authentication security. Yubico keys, in particular, integrate easily with Cloudflare's Zero Trust service.
List of the pros and cons associated with Cloudflare SASE security.
Consider the points below to compare Cloudflare vs Crowdstrike vs FireEye SASE security.
Click the service provider logo to find out more about each respective Cybersecurity solution.
Cloudflare’s SASE offering is available as a product called Cloudflare One, which is designed to combine network connectivity services with Zero Trust security on one purpose-built global network, to replace legacy circuits. The solution includes built-in DDoS mitigation, Zero Trust functionality, traffic acceleration and network firewalling. Users can connect to resources without the need of a VPN, offering them the ability to block ransomware, phishing, malware and lateral movement.
Cloudflare One runs in one of Cloudflare’s 250 sites world-wide, removing the need for manual integration of multiple point products. Each of the Cloudflare data centers offer single-pass routing and traffic inspection allowing users to remain secure regardless of their location worldwide. The SASE solution is able to run on Cloudflare’s peered network, which means that clients are able to integrate new and existing endpoint, identity and cloud providers. Cloudflare One SASE includes Secure Web Gateway (SWG), Firewall as a Service (FWaaS), Zero Trust Network Access (ZTNA) and Wide Area Network as a Service (WANaaS), all of which is supported by the Cloudflare global network.
Cloudflare offer powerful ZTNA which primarily creates secure boundaries around business applications, with users required to verify their context, identity and policy adherence before they are allowed to access a service. The platform has the capability to replace VPN connections with universal policies, granting access based on users context and identity. It also allows engineers and other related functions SSH access to infrastructure, which is often required for such services, in order to keep businesses functioning. Privileged technical users are granted access to to business-critical infrastructure from a remote location, without the need to experience tradeoffs.
ZTNA can be managed by clients using the Instant-On Cloud Platform which leverages Cloudflare’s large global network to access external users with multiple forms of identity supported at once. Clients have the ability to enforce least privilege on vulnerable resources such as RDP, web applications, SSH and other infrastructure. Users can engineer authentication for partners and contractors, which saves room in the corporate directory by integrating with multiple identity providers. Remote workers are able to authenticate corporate or personal accounts that offer the same ease of use as that offered to internal employees.
Cloudflare offer CASB solutions as part of their Cloudflare for Teams product, controlled by a simple management plane. CASB is offered as standard and comes with ZTNA, SWG, recursive DNS filters, Layer 4 firewall filters, Layer 7 proxy filters, antivirus inspection and remote browser isolation is available as an add-on service.
Cloudflare SWG offers protection from phishing, shadow IT, malware, command and control as well as many other internet risks, over all ports and protocols, with data on user interactions saved for later. The service is designed to stop malware and phishing attacks before they start, protecting any compromised devices to avoid further breaches. Traffic inspection with a policy border is also included, offering the ability to control how data flows and clients are able to block known risky, bad or unwanted destinations at HTTP or DNS level.
The SWG has the capability to allow clients to control data flows traveling in or out of an organization, using Data Loss Prevention (DLP). This comes with controls for file types, which prevent users from uploading spreadsheets and documents to unsanctioned sites and applications- an example of which is social media. Clients can make use of AV scanning to prevent malicious downloads and SaaS application control, which leverages Cloudflare’s logging capabilities to allow users to use unsanctioned SaaS applications, building a policy allowing access to such applications.
Cloudflare SWG allows clients to build policies and audits security or compliance incidents easily, with browser isolation to prevent risks from reaching endpoints. The entire solution leverages Cloudflare’s Edge network, which is available in over 250 locations globally, improving availability by keeping clients close to the service.
FWaaS is offered as Magic Firewall, a cloud-native network firewall which is designed for enterprise WAN. The service allows clients to enforce consistent network security policies across the entire network, including branch offices, headquarters and virtual private clouds. The product has the capability to offer fine-grained filtering rules which can be deployed globally using a single dashboard, from the Cloudflare global network, allowing the security to scale to an individual business's needs.
The FWaaS does not require downtime for appliance upgrades or artificial choke points and has the ability to filter unwanted traffic before it manages to reach a client’s network. Magic Firewall does this by applying client’s filtering policies directly to the Cloudflare global Edge network. This helps to prevent unwanted traffic from congesting network links or exploiting zero day vulnerabilities from the network environment. Further, intelligent L3 DDoS protection can be enabled for internet traffic using Magic Transit service. The solution also includes filtering rules, based on IP addresses, protocols, port, packet length and bit field match, as well as per rule unlimited scale, fast propagation of rule change sin under 500ms and traffic analytics. The service also provides the firewall foundation for Cloudflare One (SASE).
Cloudflare offer security for multi-cloud, public, hybrid and on-premises environments. The service offers clients the ability to enforce consistent policies across multiple clouds, regardless of vendor, with network infrastructure visibility and balanced workloads for both public and private clouds.
Cloudflare supports remote users through its ‘Cloudflare for Teams’ solution. Users based both on-premises and remotely are provided with secure connectivity and improved Internet performance. This is available for business-managed devices, as well as un-managed user devices and connects authorized users to any self-hosted SaaS or Internet application.
The solution includes the following:
Optional:
The solution is available in three service tiers - Free, Standard and Enterprise.
Free Plan: Maximum 50 users, support available from community forums, suitable for test runs and small teams.
Standard Plan: Suitable for teams of over 50 users that do not require enterprise level support. $7/user billed month-to-month with median initial support response of 4 hours for urgent issues.
Enterprise Plan: $14/user with tier-based custom quotes available. Suitable for large organizations requiring security transformations with enterprise level support services. Support median response time of 1 hour for urgent issues.
Cloudflare do not offer managed services directly, however they do have a wide range of integrator and service provider partnerships offering managed services for their products.
Cloudflare’s Peering Portal offers visibility into client networks, displaying the volume of data between the network and Cloudflare and where that data is moving. For proactive traffic management clients can dedicate Cloudflare traffic to a specific peering link. When a client decides to peer with Cloudflare, traffic is sent directly to the vendor's network, instead of sending it to a third party, improving performance.
Cloudflare’s Business Service Level Agreement offers 100% uptime backed by financial guarantees. Should the SLA be unmet, service credits are provided to the customer. Service credits for an outage during a monthly billing period are calculated as follows:
Service Credit = (Outage period minutes x Affected customer ratio) ÷ Scheduled availability minutes
Cloudflare’s Enterprise SLA is available by contacting an account manager or can be found in the subscription agreement.
Cloudflare offers solutions for the following industry verticals:
Cloudflare offers compliance with the following regulatory requirements:
ISO 27001:2013
ISO 27701:2019
SOC 2 Type II
PCI DSS 3.2.1
1.1.1.1 Public DNS Resolver Privacy Examination
BSI Qualification
Analytics Partnerships:
Bandwidth Alliance:
Endpoint Security Partnerships:
Interconnect Partnerships:
Network On-ramp Partnerships:
The most comprehensive top 10 guide we have ever created.
List your business with Netify Learn More →
Please complete the form to ask a question or send a message directly to Cloudflare. Netify have carefully curated global sales contacts based on your IP location. If you do not receive contact, please check your junk folder.
Book a demo of the Cloudflare SD WAN and SASE security capability over Zoom or Teams. Learn about their management portal, deployment, SLA and support. You will receive an email asking for times/dates, please check your junk folder if not received.
A Netify Vendor Briefing is a 30 minute Zoom research session for IT decision makers, and an opportunity to learn about the vendors products, services and business strategies specifically or a related technology or market. We'll also discuss their competitors and which other solutions your business should consider. If you do not receive contact, please check your junk folder.
