Cloudflare Named Innovation Leader in Holistic Web Protection Report
Frost & Sullivan has recognized Cloudflare as the Innovation Leader in its Frost Radar™: Global Holistic Web Protection Market Report. The recognition reflects analysis of ten providers' competitive strengths and opportunities, and acknowledges Cloudflare's work across Web Application Firewall (WAF), Bot Management, and Distributed Denial-of-Service (DDoS) product lines—the scope of the report.
The report's view that the holistic web protection market "will gradually absorb the markets formed around legacy and point solutions" aligns with the consolidation trend forecast to occur before 2025, as standalone WAF, DDoS mitigation, and Bot Risk Management solutions converge.
Building Blocks: The "Toolbox" Approach
Cloudflare's product philosophy centers on a massive global network as the foundation for all security capabilities. Instead of forcing a performance-or-security tradeoff, features are built atop this network and customers can program and extend it using Cloudflare Workers and Firewall Rules. The approach is to deliver security primitives—functions, operators, and ML-trained data—then package them into streamlined interfaces.
Internally, the team discusses this in terms of building a "toolbox" of security controls. Customers receive the raw components and can construct whatever defenses they need. Observing how billions of attempts to evade those defenses unfold helps improve and repackage the tools for those who prefer ready-made solutions. API Shield is a recent example: a guided template for "positive security" models built from existing primitives plus new data structures like Cloudflare-managed client SSL/TLS certificates.
WAF Flexibility and Usability
In 2020, Cloudflare began decoupling WAF configuration from the zone/domain model, allowing rules to target arbitrary paths and groups of services across an account. The capability was only released to a small group of developers and select enterprise customers in Q4, with feedback being incorporated before a broader rollout.
Rules gained more expressive power with the release of IP Lists capabilities. These lists can be referenced as named variables anywhere in a customer's account and combined with all other request attributes, including Bot Management scores. A rule filter might, for example, block all bots except Pingdom from a login endpoint: http.request.uri.path contains "/login" and (not ip.src in $pingdom_probes and cf.bot_management.score < 30).
Security teams received upgraded tooling for triage and incident response. Edge-logging was enhanced in Q2 to push real-time security-specific logs directly to customer SIEMs. In Q4, sensitive payloads within these logs could be encrypted using customer-provided keys and a novel "Hybrid Public Key Encryption" (HPKE) scheme, accompanied by a data localization suite for controlling where customer data is stored.
Under the hood, a new rate limiting engine was built in Q4 as a component within the Rust-based Firewall Rules engine, moving matching and enforcement logic from a standalone tool into the performant, memory-safe engine. Earlier in the year, the engine's library of capabilities grew with the addition of HMAC functions and regex-based HTTP header and body inspection.
Bot Management: Detection and Mitigation Advances
Bot detection efficacy remained the highest priority for the Bot Management team, with significant engineering effort going into detection engines. In Q1 2020, a complete rewrite of the Machine Learning engine finished, nearly doubling the number of features used to evaluate and score requests. The bot likelihood score in logs was complemented with attribution to the specific engine that generated the score, providing better insight into why requests are flagged.
The same quarter saw an upgrade to the behavioral analysis engine, which now incorporates more features and higher overall accuracy. This histogram-based outlier scoring system is fully deployed to nearly all Bot Management zones.
A lightweight JavaScript element developed in Q2 advanced browser fingerprinting capabilities. The element silently challenges browsers and detects misrepresented User Agents, with the technique to be incorporated into ML models and combined with the heuristics engine. The feature is optional and can be disabled for performance-sensitive zones or traffic unsuitable for JavaScript, such as API or mobile app traffic.
Mitigation infrastructure was rebuilt as well. The entire JavaScript and CAPTCHA challenge platform was rewritten and deployed in stages during the second half of 2020. The new platform is faster and more robust at detecting automated systems attempting to solve challenges, and it provides a foundation for new challenge types and modes in the future.
One of the most well-received releases was dedicated Bot Management analytics, which appeared in Q3. The interactive graphs double as diagnostic tools, essential for spotting and eliminating false positives. In Q4, the __cfduid cookie was deprecated; it had been used primarily for bot detection but caused confusion around cookie banner requirements.
API and IoT Security
API Shield, released at the beginning of Q4, was purpose-built to secure, protect, and accelerate API traffic. The UI is built on Firewall Rules for maximum flexibility and includes a fully managed, domain-scoped private CA for each zone. Adoption has been strong among IoT companies using short-lived client certificates to lock down APIs on distributed devices. Customers can also upload OpenAPI schemas to match against incoming requests, with bad requests dropped at the edge before reaching origin infrastructure.
Q4 also brought support for gRPC-based API traffic. Early adopters are exploring use of Cloudflare as a secure API gateway between customer-facing JSON endpoints and internal gRPC or GraphQL endpoints, initially with Cloudflare Workers.
DDoS Protections for Applications and APIs
Application-layer security matters little if the service is unavailable due to a persistent L3-L7 DDoS attack. In response to a persistent increase in smaller, more localized attacks, a new system was fine-tuned in early 2020 to autonomously detect attacks on any server in any datacenter. The tool, called "dosd," leverages Linux's eXpress Data Path (XDP) to quickly and automatically deploy eBPF rules that run on each packet received. In its first month, it mitigated almost 300,000 network-layer attacks—roughly 55 times more than the previous tool. A Q3 enhancement added a protection layer that operates even in environments where only one side of the TCP flow is visible.
Visibility into attacks improved with the Q1 release of Network Analytics, a GraphQL-backed interface extending attack visibility from L7 down to L3. Detailed attack logs include top source and destination IPs and ports, ASNs, data centers, countries, bit rates, and protocol distributions. The interface was extended in Q4 to cover Cloudflare Spectrum-protected applications, which terminate at L4 (TCP/UDP).
Real-time DDoS alerting arrived near the end of Q4, sending emails or PagerDuty pages to alert security teams of ongoing attacks and mitigations. The feature came just in time for the wave of ransomware-DDoS attacks Cloudflare helped detect and defend against. Most automatic mitigations now block malicious traffic in less than 3 seconds.
Recognition and Road Ahead
The Frost & Sullivan report addresses "organizations' demand for consolidated, single pane of glass solutions, which not only reduce the security gaps of legacy products but also provide simplified management capabilities." Cloudflare was recognized for the capabilities accumulated across its security product lines through sustained investment throughout the year, culminating in greater protections than those available at the start of 2020.
