Cloudflare lands Forrester Strong Performer nod for email security

Forrester has named Cloudflare Email Security a Strong Performer in its "The Forrester Wave™: Email, Messaging, And Collaboration Security Solutions, Q2 2025" report. Cloudflare ranked among the top three providers in the current offering category, scoring the maximum possible marks in nine of the 27 evaluation criteria. Forrester characterized Cloudflare as "a solid choice for organizations looking to augment current email, messaging, and collaboration security tooling with deep content analysis and processing and malware detection capabilities."

Where Cloudflare scored highest

Cloudflare's strengths in the evaluation reflect a platform that leans heavily on its network edge and AI-driven analysis. Key areas of differentiation include:

Advanced sandboxing and malware protection

The sandboxing engine analyzes files that are directly attached or accessed via cloud storage links using both static and dynamic analysis. AI-powered detectors examine attachment structure and behavior in real time, catching known malware and previously unseen threats.

URL inspection and web isolation

URLs are checked at delivery and again at click-time across Cloudflare's global network. OCR and machine learning models review metadata and page behavior to determine risk. Suspicious links can be opened in remote browser sessions, isolating users from compromise. Links are continuously monitored, with retroactive remediation triggered if a URL's risk profile changes.

Threat intelligence at scale

Cloudflare ingests more than 4.4 trillion signals daily across DNS, HTTP, and email layers. Campaigns spotted through its DNS or HTTP traffic are used to proactively block related email threats, often before those threats appear in traditional intelligence feeds.

Content analysis with LLMs and NLP

An ensemble of large language models, NLP techniques, and machine learning classifiers examines message tone, thread behavior, QR codes, and invoice language. The approach targets fraud indicators, business email compromise, and social engineering patterns that legacy signature-based engines tend to miss.

Unified visibility and user controls

The Zero Trust dashboard gives SOC teams a single view across email, web, cloud, and data events, with the ability to pivot across user activity and export data. Quarantine workflows offer flexible notification options to reduce user disruption, while SPF, DKIM, and DMARC alignment is enforced automatically. Cloudflare also offers a free DMARC reporting tool that surfaces email authentication failures for brand protection management.

Security and ecosystem foundations

All Cloudflare services undergo continuous penetration testing, adhere to SOC 2 Type II and ISO 27001 standards, and run on Cloudflare's own infrastructure. Native integrations with Splunk, Microsoft Sentinel, Palo Alto XSOAR, and ServiceNow let organizations fold email security into existing SOC workflows, while partnerships with human-risk awareness platforms add a user-centric view of behavior.

Security beyond the inbox

Forrester's take on market direction aligns with what Cloudflare has observed across its customer base from Fortune 100 firms to startups: phishing attacks have moved beyond the inbox. Attackers increasingly steer users toward external apps, unaudited chat platforms, and legitimate third-party services, bypassing traditional email defenses. Cloudflare was an early proponent of treating email security as part of a broader SASE and Zero Trust architecture, securing not just messages but the entire user attack surface.

Upcoming priorities

Cloudflare's roadmap centers on four areas:

  • AI-driven automation — using LLMs to summarize incidents, auto-label threats, and recommend response steps to cut alert fatigue and manual triage.
  • Deeper ecosystem integrations — unifying signals across email, web, cloud, and data for a single view of user behavior and faster remediation.
  • Real-time user coaching — delivering contextual guidance through banners, isolation flows, or in-app warnings at the moment of risk.
  • Advanced detection models — applying global network telemetry to identify novel phishing campaigns more quickly.

Organizations can try Cloudflare's Retro Scan tool for free, whether they are customers or not. The tool uses predictive AI models to scan existing inbox messages, flag threats, and allow direct remediation. Cloudflare also offers a free phishing risk assessment for organizations evaluating their current email defenses.