Closing the SaaS Visibility Gap in Zero Trust
Cloudflare has acquired Vectrix, a cloud-access security broker (CASB) that scans SaaS applications for misconfigurations, risky sharing, and permission errors. The technology will be folded into Cloudflare's Zero Trust product group rather than sold as a standalone tool. The company's stated goal is that CASB capabilities should function as one layer of a broader Zero Trust deployment, with each component reinforcing the others.
The Evolution of Cloudflare's Zero Trust Model
Cloudflare's own security journey began with a conventional castle-and-moat approach. Employees inside the San Francisco office joined a private network via secure Wi-Fi, while remote workers connected through VPN clients that extended that network's boundaries. The problem: once authenticated, any user could reach nearly any destination on the private network, and security teams had little visibility into internal traffic.
Rather than building out a traditional segmented network with internal firewalls and synchronized VPN appliances, Cloudflare developed Cloudflare Access. That product evaluates every request against identity, group membership, device posture, and multifactor method before granting access. Rules can be scoped to specific applications or private network IPs, and every connection is logged. Access runs inline with the WAF and load balancers, with policy decisions made at data centers in more than 250 cities.
Cloudflare Access eliminated the VPN model for internal resources, but protecting users as they browsed the public Internet required a different mechanism. Organizations historically backhauled all outbound traffic to a central data center where physical appliances provided firewall, proxy, and secure web gateway functions. That model broke down as employees spent most of their day in SaaS applications; user experience suffered from latency, IT teams struggled to scale appliances, and MPLS backhaul costs ate into the savings from cloud migration.
Cloudflare Gateway flipped that architecture. Users connect to a nearby Cloudflare data center, where security filtering and logging are applied before traffic is accelerated to its destination. Deployment can start with DNS filtering on Cloudflare's resolver, or by replacing network firewall appliances outright. The Secure Web Gateway inspects HTTPS traffic for malware and data loss, and Browser Isolation moves execution to Cloudflare's network, enabling granular controls like blocking file uploads or copy-paste at the page level.
Why SaaS Data-at-Rest Needed a New Tool
Controlling access to resources and filtering outbound traffic solves two of the three Zero Trust problems: who can reach your infrastructure, and what threats reach your users. The missing piece is the data sitting inside SaaS applications your organization doesn't host. A document shared to the public Internet, an unprotected S3 bucket, or a malicious plugin installed on corporate email are all single-click breaches that network-level controls cannot catch.
Cloudflare had already shipped features to address part of this. Access for SaaS forces logins through the Secure Web Gateway, and the Shadow IT report surfaced which applications employees were actually using. Gateway app policies can block unapproved SaaS tools entirely or restrict specific actions like file uploads. But the configuration and permission state of sanctioned applications themselves remained largely unexamined.
Vectrix scans those applications to detect anomalies in configuration, permissions, and sharing. The risk profile differs by platform—a public Google Sheet presents a different threat than leaked secrets in GitHub—and Vectrix aggregates those findings into a single control plane for auditing and remediation.
Why Cloudflare Chose Vectrix
Cloudflare evaluated building its own API-driven CASB and spoke with other vendors before settling on Vectrix. Three factors drove the decision.
Customer focus. Vectrix targets organizations of any size, including those without dedicated security teams, with straightforward scans that lower the barrier to entry. That aligns with Cloudflare's approach of making security tools accessible—free SSL certificates and a free Zero Trust tier for up to 50 users are cited as examples.
Speed to value. The Vectrix product is designed to deliver results within five minutes of a two-to-three-click setup. No complex deployment is required to begin flagging risks.
Product synergy. Vectrix will be integrated into the Zero Trust bundle, not positioned as an add-on. Cloudflare argues that combining CASB data with Secure Web Gateway telemetry produces a more comprehensive solution than either product alone.
The Vectrix team has started migrating its services onto Cloudflare's network. Beta sign-ups are open, with waitlist priority given to teams already using Cloudflare's Zero Trust products.
