When a VPN Wasn’t Cutting It

Back in 2015, Cloudflare’s internal applications were reached the same way most companies reached theirs: through a hardware VPN. For an on-call engineer paged to a Grafana alert, that meant fumbling with a VPN client on a laptop before they could even see what was broken. It was slow, clunky, and felt particularly absurd for a company whose entire business is cloud-based network security.

Three engineers eventually decided enough was enough. Why was a cloud network security company relying on on-premise hardware? That frustration led to the creation of what is now Cloudflare Access, a zero-trust VPN replacement built on the company’s own edge network.

Eating Our Own Cooking

Access, originally known internally as EdgeAuth, started small. The first application put behind it was Grafana. Engineers who received an alert on their phone could simply tap a link, authenticate in their browser, and immediately see the relevant dashboard. No VPN client required.

The initial success was enough to expand. The security team soon found that locking down internal applications at Layer 7 with Access policies was far easier than managing network-layer access controls. What once involved complex VPN configuration became a few clicks in the Cloudflare dashboard.

Adoption grew organically at first. Teams were so eager to use the new authentication flow that they wanted it everywhere. Eventually, security mandated it. But the beauty of the tool is that a wholesale rip-and-replace was never necessary. Teams could start by protecting their most-used internal tools and expand from there.

As the team moved beyond HTTP-based services, support for git was added, allowing developers to securely push code from anywhere in the world with full auditing. That made the security team happy—every authentication event, even a git push, was logged and trackable.

Performance Gains at the Edge

VPNs are notorious for slowing down connections, and Cloudflare’s own experience was no different. Forcing every employee’s internet traffic through a single standalone VPN appliance created a serious performance bottleneck and a single point of failure.

Access takes a different approach. Authentication happens at Cloudflare’s network edge, which spans 200 cities across more than 90 countries. Instead of routing all traffic through one appliance, employees connect to a data center close to them. The result is a faster, more reliable connection to internal applications—an important advantage for a globally distributed workforce.

The shift also improved security. With the legacy VPN, strong two-factor authentication was difficult to enforce. With Access, the team can rely on the robust MFA mechanisms of their identity provider.

Cleaner Onboarding and Offboarding

Managing access for a growing team is hard. It gets even harder when employees and contractors have multiple accounts across different tools and environments. Cloudflare’s IT team used to spend significant time making sure every box was checked when someone joined or left.

With Access, onboarding is much smoother. New employees are quickly granted rights to the applications they need, and a launchpad makes those apps readily available. When someone leaves, a single configuration change revokes access across every application—no guesswork involved.

Visibility is another major win. A traditional VPN gives you minimal insight into user activity—basically a username and an IP address. If someone gets in, retracing their steps is difficult. Access, built on a zero-trust model, authenticates every packet. It grants granular permissions through Access Groups and logs extensive activity, allowing the security team to detect unusual behavior across all applications.

Not Just for Cloudflare

The same tool that solved these problems for Cloudflare is available to any organization. Access can secure Jira, Confluence, SAP, or custom-built applications, and it can be up and running in minutes. Cloudflare is offering Access free to all organizations through September 1, with a quick start guide available for immediate setup, or a 30-minute onboarding call with a specialist for those who prefer a guided walkthrough.