Cloudflare adds BastionZero for Zero Trust infrastructure access

Cloudflare has acquired BastionZero, a Zero Trust infrastructure access platform, to extend its Cloudflare One Zero Trust Network Access (ZTNA) offering beyond applications and networks to cover infrastructure such as servers, Kubernetes clusters, and databases. The goal is to let security teams manage access controls for these resources alongside the rest of their hybrid IT environment.

Application access often gets prioritized because it is the most visible entry point for users and attackers, and modern applications typically support strong authentication mechanisms like Single Sign-On (SSO) and Multi-Factor Authentication (MFA). Infrastructure access, however, is a different challenge. Many teams still rely on castle-and-moat network controls and local resource permissions to protect servers, databases, and Kubernetes clusters, which scatters security controls across hundreds or thousands of targets. Attackers increasingly target these infrastructure resources to disrupt large numbers of applications at once or steal sensitive data.

The difference in securing infrastructure

Infrastructure access involves a broader range of systems and protocols, each with its own authentication complexities:

  • SSH authentication: Public key authentication is standard for Linux and Unix systems. Keys must be distributed, rotated, and monitored for leakage; a leaked key can give an attacker direct control over the resource.
  • RDP authentication: Used for remote access to Windows systems. While it supports password- and certificate-based methods, it is frequently targeted by brute force and credential stuffing attacks.
  • Kubernetes authentication: Involves managing roles, service accounts, kubeconfig files, and user certificates, which adds its own layer of complexity.

Limitations of existing ZTNA policies

Cloudflare One already allows administrators to define identity-, device-, and network-aware policies for infrastructure access. For example, a policy could restrict port 22 access to members of a particular identity provider group—much finer control than a typical VPN with basic firewall rules.

This approach still has gaps because it operates on assumptions about how infrastructure is provisioned. If a resource is configured outside the expected network structure—for example, running SSH on a non-standard port—network-level controls can be bypassed. In that case, only the protocol's native authentication protections remain, which is often how leaked SSH keys or database credentials lead to larger breaches.

Organizations sometimes add bastion host models or Privileged Access Management (PAM) solutions as defense-in-depth. But these add cost and management overhead, and policies tend to drift from the intended security stance over time, eroding least-privileged access.

What BastionZero brings

BastionZero provides native integration with major infrastructure protocols and targets—SSH, RDP, Kubernetes, database servers, and more—so a target resource is configured to accept connections for a specific user rather than relying purely on network-level controls. Administrators can think in terms of resources and targets rather than IP addresses and ports.

BastionZero is built on OpenPubkey, an open source library that binds identities to cryptographic keys using OpenID Connect (OIDC). This enables the use of SSO for granting infrastructure access. The platform uses multiple roots of trust so that SSO does not become a single point of compromise for critical servers.

Key capabilities being added to Cloudflare's SASE platform include:

  • Elimination of long-lived keys/credentials: Frictionless infrastructure privileged access management modernizes credential management for SSH keys, kubeconfig files, and database passwords via an ephemeral, decentralized approach.
  • A DevOps-based approach for SSH: Supports least privilege access with session recording and command logging for compliance. Teams define just-in-time access policies and automate workflows in terms of auto-discovered targets.
  • Clientless RDP: Enables access to desktop environments without requiring a client installation on user devices.

Roadmap and availability

The BastionZero team will focus on integrating these infrastructure access controls directly into Cloudflare One. New features for Zero Trust infrastructure access will be announced during the third and fourth quarters of this year. All functionality delivered this year will be included in the Cloudflare One free tier for organizations with fewer than 50 users.

Cloudflare is seeking early beta testers to provide feedback on infrastructure access requirements. Interested teams can sign up via the infrastructure access landing page.