How Cloudflare's Security Team Protects Its Own Accounts
Cloudflare has released several products designed to protect customers from credential stuffing, compromised credentials and proxy services. But the company's own Security Team also relies on these same tools to prevent account takeovers on internal applications, combined with custom detections and automation layers to identify and remediate suspicious employee activity.
Attackers use a variety of techniques to compromise accounts: brute force attacks, credential stuffing, botnets, social engineering and phishing. To counter these threats, Cloudflare's internal strategy targets the early stages of an attack lifecycle, making unauthorized access as difficult as possible before an attacker can move laterally or exfiltrate data.
A Typical Account Compromise Scenario
In one common attack chain, credentials from a prior breach are reused across multiple platforms via credential stuffing. Once an attacker gains initial access with a valid username and password, they can explore the system and pivot to other connected services. Even a single leaked password can lead to an unrelated company suffering a data breach if users repeat passwords across platforms.
Phishing is another prominent vector. Attackers often use Evilginx, a man-in-the-middle framework, to create a lookalike login page and harvest credentials or session cookies. After capturing this data, they immediately sign in, exfiltrate sensitive information and attempt to compromise other accounts. As email filters improve, attackers increasingly turn to vishing, or voice phishing, to trick employees into visiting malicious sites.
Two-factor authentication methods like time-based one-time passwords (TOTP) and SMS codes offer limited protection in these scenarios. Social engineering can convince employees to share a TOTP code, and attackers can perform SIM-swapping by tricking a phone carrier into transferring a victim's number to a device the attacker controls. These limitations highlight why stronger authentication mechanisms are necessary.
Real-World Takeover Examples
In 2020, a teenager hijacked numerous verified Twitter accounts by spoofing an employee's phone number through SIM-swapping and then social engineering a Twitter employee by impersonating their IT department. The attacker directed the employee to a phishing page mirroring Twitter's Okta login portal and used the captured credentials to access internal systems. This attack succeeded because the employee used SMS or TOTP for multi-factor authentication. A U2F hardware security key such as a YubiKey would have prevented access by requiring physical presence to complete any login attempt.
For this scenario, Cloudflare Access could restrict internal system access to company-issued devices and enforce granular policies limiting which accounts each user group can access. Administrators can require U2F hardware token authentication and block all authentication events using TOTP or SMS.
A 2018 breach of MyFitnessPal exposed user passwords. Two years later, that data was used in credential stuffing attacks against Independence Blue Cross and AmeriHealth New Jersey, resulting in unauthorized access to insurance claims information. These attacks demonstrate that any organization may be targeted regardless of industry. Cloudflare's bot management tools like Super Bot Fight Mode could proactively block such credential stuffing attempts, and WAF Exposed Credential Checks can detect users attempting to log in with breached passwords and force a password change.
Internal Application of Cloudflare Products
Cloudflare's Security Team uses several Cloudflare services to block common account takeover vectors before they reach critical internal systems, allowing focus on more sophisticated, Cloudflare-specific threats.
Cloudflare Gateway proactively blocks potentially malicious domains through its UI rule builder. When the Security Team observes a new domain used in credential harvesting attacks, it adds that domain to a Gateway blocklist. This prevents corporate endpoints from resolving the site, even if an employee accidentally clicks a link. Unlike many security tools that only block by IP address, Gateway also blocks by domain name for rapid response. If an attacker rehosts the same site at a new IP address, the domain block minimizes risk without requiring an update.
All Cloudflare employees must use a FIDO2 hardware security token to authenticate to company resources, mitigating many factors that simplify account takeover.
The Security Team also enforces a managed-device policy through Cloudflare Access, allowing only corporate endpoints to connect to internal systems. Access policies combine multiple signals such as authentication factor and IP geolocation. This turns security from reactive to proactive by blocking login attempts from non-corporate devices, countries where Cloudflare has no employees, or authentication events that rely on SMS or TOTP rather than U2F hardware tokens.
An Internal Detection Layer
Beyond these preventive controls, the Detection & Response Team exports Gateway and Access logs into an internal pipeline alongside other system logs. These enriched logs enable custom detections and incident response automation. The team builds detections that focus on MITRE ATT&CK initial access tactics to act as a second layer of protection for employee accounts.
Account compromise detections include:
- A login or other authentication event to an internal system from a VPN.
- A change in an employee's multi-factor authentication token and use of a new device.
- A login or authentication event from an unfamiliar IP address.
- A login or authentication event from an IP address in a high-risk country.
- An authentication event with a multi-factor authentication soft-token to an internal system.
- Any event from an IP address associated with known threat actors.
Static rules cannot catch every behavioral variation, so the team also prioritizes machine learning models that detect anomalous authentication patterns. These models use risk signals to evaluate how likely a particular behavior is malicious. All organizations must account for similar security signals, but they differ significantly depending on infrastructure. Cloudflare combines its security products with internal engineering to apply consistent protection across both external-facing and internal systems.
Product Roadmap Influence
Cloudflare's Security Team actively informs the product roadmap. Through a continuous feedback loop, it shares internal detection and response strategies with product teams, then dogfoods the resulting products to verify they protect both employee and customer data effectively. This collaboration ensures Cloudflare's security suite addresses real current threats.
Recommended Strategy
Account takeover is one of the most common cybersecurity attack types. Focusing on mitigations that target initial access can quickly improve an organization's security maturity. These measures stop attackers at the reconnaissance phase of the cyber kill chain, as modeled by the MITRE ATT&CK framework.
Make account takeover attacks as difficult as possible to execute. Cloudflare enforces hardware security token authentication, strong password complexity, proactive blocks of known malicious domains, and bot protection on external-facing applications. Each control disrupts the earliest phases of the attacker's kill chain.
