Performance at the Core of Zero Trust
Cloudflare for Teams is engineered around a simple premise: security should not come at the cost of speed. The platform's Zero Trust products are built on Cloudflare's own network infrastructure, avoiding the backhaul and latency penalties that plague traditional security architectures. In fact, the same optimizations that power Cloudflare's Speed Week features are the foundation of its Zero Trust platform.
The platform replaces legacy private networks, enforces access decisions in Cloudflare Workers, filters DNS through the same technology as 1.1.1.1, accelerates web traffic through its Secure Web Gateway, and delivers browser isolation with fundamentally different architecture. Each component is available today, and the first 50 users are free.
Eliminating VPN Backhaul
Traditional private networks operate on an implicit trust model: anyone inside the network is trusted by default. That model creates a broad attack surface, but the alternative — legacy VPNs — introduced their own problems. VPN clients punch holes back into private networks, forcing traffic to travel from the user to the office and then to the destination application. When applications live outside the office, that backhaul becomes a significant performance drag.
Some organizations deploy multiple VPN instances across hubs and connect them with dedicated MPLS lines. Those lines are expensive and consume IT resources to maintain. Zero Trust solutions partially address this by removing the VPN appliance from the path, but Cloudflare argues that "slightly faster" isn't sufficient.
Cloudflare Access connects resources to Cloudflare's network via Cloudflare Tunnel, a service that creates outbound-only connections to the edge using Argo Smart Routing technology. Users reach a nearby data center among Cloudflare's 250+ global locations, and the network's dedicated fiber optic backbone handles routing between cities. The backbone splits roughly 55/45 between metro capacity and long-haul capacity, meaning there are no individual VPN instances or MPLS lines to manage.
The result: no per-application VPN configurations or MPLS lines. Users simply access their applications, and Cloudflare handles the routing logic. When organizations shift from private networks to Cloudflare, they accelerate application performance while layering in the additional security controls that Zero Trust requires.
Authentication Decisions at the Edge
Cloudflare Access evaluates every request against administrator-configured rules, checking signals such as identity, device posture, location, and multifactor method. Despite processing these signals, the authentication layer is built entirely on Cloudflare Workers, the serverless platform that runs in every Cloudflare data center.
Instead of backhauling traffic to a central authentication server, Access policies are stored and evaluated at each of the 250+ data centers. User traffic flows from the nearest data center directly to the target application. Cloudflare reports that Workers is "210% faster than Lambda@Edge and 298% faster than Lambda," and this performance translates to an average authentication time of under three milliseconds for a given resource.
This distributed approach also provides resilience. If one data center goes offline, user requests are rerouted to a nearby location, so Access doesn't become a single point of failure the way a VPN can.
DNS Filtering at 1.1.1.1 Speeds
External threats are the next concern after internal resources are secured. Cloudflare Gateway handles DNS filtering, blocking queries to dangerous hostnames before a connection is even established. Historically, DNS filtering meant appliances inside physical offices, which forced remote users back through a VPN to reach the filtering service. Cloud-based alternatives improved on that but remained limited by resolver speed and data center distribution.
Cloudflare Gateway sends DNS queries from devices to the nearest data center and checks them against a comprehensive threat list. The underlying resolver is the same one powering 1.1.1.1, which processes hundreds of billions of queries daily and is consistently ranked as the fastest public DNS resolver. Organizations that adopt Gateway get those same optimizations, meaning faster DNS resolution for their employees than any other resolver offers.
A Web Gateway That Doesn't Add a Detour
Secure Web Gateways inspect and filter Internet-bound traffic for threats and data loss. The problem is that filtered traffic often takes an artificially long path. A browser's DNS, TLS, and HTTP requests that would normally travel from the local ISP directly to the destination are instead routed to a centralized SWG — possibly hundreds or thousands of miles away. This tromboning effect degrades performance even when the end destination is geographically close to the user.
Eliminating this effect requires filtering on a network that is directly interconnected with the user's ISP. Cloudflare operates in over 250 cities and is highly interconnected, enabling inspection and filtering at the same Internet exchange points where ISPs connect users to the Internet.
To quantify the latency difference, Cloudflare used Catchpoint to measure zero trust network round trip times from multiple international cities. Publicly available endpoints for Cisco Umbrella, ZScaler, McAfee, and Menlo Security were also measured.
Cloudflare's average response time was 10.63ms, versus 26.39ms for Cisco Umbrella, 35.60ms for ZScaler, 37.64ms for Menlo Security, and 59.72ms for McAfee.
These figures represent simple network latency and don't capture the full end-to-end impact on DNS, TLS, and HTTPS connections, nor the benefits of Cloudflare's content delivery network serving cached content for millions of websites. Unlike CDNs, which are publicly benchmarked, zero trust networks are often hidden behind enterprise contracts, limiting industry-wide transparency.
Why browsing speed matters for security tools
The browser is now the primary application in most workplaces, which also makes it a primary target for phishing, malware, and data theft. Remote browser isolation (RBI) has become a common defense, but it introduces a unique latency problem: page loads can be fast because the remote browser has a low-latency, high-bandwidth path to the website, yet interactions like scrolling, typing, and mouse movements can stutter and buffer. That lag in interaction feels worse than a slow page load on a local browser.
Latency consistency is just as important as raw speed. When measured per continent, centralized zero trust architectures show highly uneven performance, while Cloudflare's decentralized network delivers far more stable results across regions.
Cloudflare's response times stay consistently under 11ms worldwide, while other vendors show irregular and unpredictable performance. If past RBI tools felt sluggish or broken, the root cause was often the underlying network, not the isolation technology itself.
Security without the speed penalty
Strong security should not require users to accept degraded performance. Cloudflare designed its Zero Trust platform with that principle in mind. The same tools are also meant to be accessible beyond large enterprises with dedicated security teams. To that end, all of the solutions described here are free for up to 50 users, and can be set up through the Teams Dashboard.
