Startup Lessons From Cloudflare for Teams
When Cloudflare acquired S2 Systems earlier this year, it brought a remote browser isolation (RBI) platform with a different focus: run the browser in a cloud data center so web threats never execute code on the user's machine. The plan was to distribute that service across Cloudflare's global network of data centers in 200 cities.
RBI will sit alongside two other products in the Cloudflare for Teams suite: Access and Gateway. Together, they tackle the familiar security problems that plague any company, and for a small start-up without dedicated IT staff those problems are magnified. Three in particular stood out for the S2 team: securely trialing a beta product with prospects, protecting a small office network, and accessing powerful on-premises dev machines remotely.
Controlling Access to a Beta Product
When the team first built its RBI prototype, testers were a carefully curated set of early adopters. Keeping that access locked down proved costly: the custom solution took roughly six months to build, test and revise. It consisted of a reverse-proxy load balancer guarding an ASP.NET Core server, with identity management as the most complicated piece.
The approach required manually adding an identity provider each time a new prospect wanted in. The CTO spent hours per day adding customers and configuring policies to keep tenants separate. It was a giant time sink embedded in the product itself.
Switching to Access
Cloudflare Access presented a different model: it applies the Cloudflare network to authentication, so users reach self-managed applications without a VPN. The idea became concrete when Cloudflare staff visited the Kirkland office, connecting to internal services seamlessly. After the acquisition closed, the S2 team got early exposure — securing marketing pages and forms behind Access with just their S2 email logins. It worked immediately.
Within a day of trying it, they configured Cloudflare Access for their trial platform. A couple of UI rules controlled who could reach it, and when colleagues tested it, login used existing SSO credentials. No client software and no extra infrastructure were required. All the demo authentication servers were shut down. New customers can now be given trial access to the RBI technology in minutes, visiting a single hostname and logging in.
Replacing an Ad-Hoc Office Firewall
Outfitting the start-up's first office was a scattershot effort: after discovering a Comcast business card taped to the door, technicians set up a basic network and the team tried to bolt on a proper security posture. Multiple firewalls, access controls and outbound traffic filters went in, and then began breaking things. The system blocked legitimate traffic while letting through what it shouldn't, so almost everything was turned off out of frustration.
Cloudflare Gateway resolved the issue quickly — about 10 minutes of work. Gateway blocks traffic from reaching malicious destinations by adding DNS-based security to the 1.1.1.1 resolver. A policy to block security threats was created, the router's DNS settings changed, and nothing else was needed. Reports from the UI show what Gateway catches. With remote work now commonplace, Gateway has also been extended to the 1.1.1.1 mobile app so iOS and Android devices share the same protection, and desktop versions will follow.
Reaching Dev Machines Without a VPN
The office's high-powered Linux machines, needed for building Chromium, offer 16 cores, 32 threads and 32GB of RAM. Dragging them home was impracticable. The old physical VPN appliance proved a bottleneck as work shifted remote, requiring vendor-installed networking that synced with identity providers poorly. It was hard to set up and harder to operate.
Cloudflare Access offered a different path. A new hostname was added for the office network, and the Cloudflare daemon cloudflared was installed on the machines. The daemons hold outbound tunnels to Cloudflare, each assigned a subdomain. Developers installed cloudflared on their home machines and made a one-time change to their SSH config, adding two lines with a ProxyCommand. No alterations to SSH clients, workflows, or tools like Visual Studio Code Remote SSH were needed. When sessions start, Access handles authentication via SSO instead of a VPN.
Weighing the Trade-Offs
For a start-up, manually engineering these systems trades away product development time, but ready-made enterprise tools were beyond the budget. The for-Teams suite narrowed that gap considerably:
- Granting prospects access to the product is now a matter of updating rules instead of configuring identity infrastructure.
- Office network security no longer relies on fragile, hand-rolled firewall rules.
- Home-based developers get reliable SSH access to powerful machines without a legacy VPN.
Reflecting on the experience, the team notes that seeing the old-and-new contrast is more useful than lamenting the time spent building the old way. RBI itself will eventually draw on the same network advantages that make Access and Gateway straightforward, addressing a different customer problem. All the features described here are available through September at no cost via teams.cloudflare.com.
