The End of the Corporate Moat
For a decade, Cloudflare has focused on one side of the enterprise IT coin: securing the infrastructure that organizations expose to the Internet. The company built a network spanning more than 200 cities to absorb attacks and accelerate web traffic. Today, it is turning its attention to the other side of that coin—the people who work for an organization and the tools they use to get their jobs done.
This shift reflects a fundamental change in how we work. A decade ago, the Internet was something you visited. Now, work and private life depend on it, and the speed, reliability, and safety of that connection are paramount. But, as Cloudflare points out, a significant portion of the modern workplace relies on IT models that were designed for a different era.
An Obsolete Security Strategy
The dominant security strategy for most of the last two decades has been a kind of digital castle-and-moat. All valuable data and applications live inside the castle; a firewall acts as the moat to keep out malicious actors; and a VPN serves as the drawbridge for authorized employees trying to get in. It is an approach that is showing its age through three distinct strains.
The first problem is that the model is brittle on the inside. An attacker who slips over the moat—via a phishing email, a compromised contractor’s credentials, or a rogue device plugged into the network—can roam freely and cause significant damage. There are very few hurdles inside the perimeter.
Second, the walls are disappearing. Increasingly, an organization’s resources live not in one on-premises castle but distributed across third-party public cloud and SaaS platforms like Salesforce, Box, or Workday. IT teams have no way to ship a hardware firewall to those vendors to wrap a moat around external data sources, and the security tools these vendors provide are not always interoperable with on-premises solutions.
Third, the workforce is no longer static. Employees work from home, from the road, and from their own devices. The image of a remote worker dialing into a centralized VPN to complete a task is becoming less practical—and less plausible—by the day. As a company that relied on this itself, Cloudflare was not immune. When it audited its own VPN-dependent approach, it found frustration had already led multiple internal teams to build workarounds: unauthorized drawbridges over its own carefully constructed moat.
A Zero Trust Foundation
Around the time these models reached their breaking point for Cloudflare, a new framework emerged: BeyondCorp from Google. The central proposition is stark and simple—an internal network should be as untrusted as the public Internet. Rather than relying on one hardened perimeter, every application and every piece of data should authenticate each user and each device individually, at the moment of access.
This idea, now widely known as the Zero Trust model for security, proved influential in Cloudflare’s search for a solution. Because the company had built a fast, global, flexible network to protect large-scale public infrastructure, it was able to use that same network to enforce internal identity-based policies and filter web traffic for its own employees. This agility paved the way for productizing the solution.
The result is a new product suite called Cloudflare for Teams. The suite is built around two core products. Cloudflare Access is designed as a modern VPN—it grants employees access to internal tools while keeping unauthorized users and threats out. Splitting the difference, Cloudflare Gateway acts as a modern Next Generation Firewall, protecting employees against malware while enforcing an organization’s net policies.
Both products find common ground in the underlying architecture they share with the Cloudflare network itself. That network infrastructure provides speed, resilience, and global scale for over 200 cities. Because the platform is built at that scale, pricing can be kept intentionally lean to make adoption—and a positive return on investment—as easy as possible. What’s more, the products are buttressed by the threat intelligence Cloudflare gathers from across the totality of its global traffic, supplemented by additional data sources from security vendors.
Born from Consumer Products
Cloudflare Gateway builds on the foundation of the company’s widely adopted 1.1.1.1 Public DNS resolver. With more than 40 million users trusting it as one of the fastest DNS resolvers globally, the company was able to add malware scanning to create an entry-level Gateway product—one provisionable in minutes through a simple change to recursive DNS settings. This basic layer allows network administrators to block domains based on malware signatures and domain categorization, without any hardware or software rollout.
Meanwhile, Cloudflare Gateway Pro extends protection beyond the domain level to full proxying of specific URLs. Pro is provisioned through the WARP client—now extended beyond its mobile origins to Windows, macOS, and Linux—or managed through MDM-provisioned proxy settings and GRE tunnels from office routers. A beta for this tier is now open as the features roll out over coming months.
Both high-end offerings depend on engineering that was seemingly unrelated at the start: the WARP and WARP+ consumer VPNs. Cloudflare built these consumer services knowing they would be difficult to deliver well. Millions of users stress-testing the products have hardened the underlying technology to the point the company feels comfortable trusting it inside an enterprise. For a user-embedded baseline of quality, those efforts produced a 4.5-star rating across more than 200,000 iOS reviews alone.
An On-Ramp for All Teams
Cloudflare insists that free or entry-level access to its infrastructure is part of its identity. That ethos starts with the protected Internet and extends to this expansion with Access and Gateway. Both offer free versions meant to shield individuals, home networks, and small businesses, and remain available on a good, better, best framework of segments spanning Basic, Pro, and Enterprise tiers, with Enterprise features rolling out throughout subsequent months.
The initial ecosystem is already in place via partnerships, with endpoints covered by integration into VMware Carbon Black, Malwarebytes, and Tanium. Logs and analytics pair well with Datadog, Sumo Logic, and Splunk. Identity providers of note include Okta, OneLogin, and Ping Identity. Any organization—from the smallest startups to the largest enterprises—seeking to trade a worn-down moat for stronger, location-independent infrastructure now has a technologically proven path directly out of the castle walls.
Rethinking Browser Isolation
For enterprises, the web itself has become a threat vector. Every page a user visits can pull in third-party code — JavaScript and other executables — that runs directly on their device. The obvious defensive answer is browser isolation: render pages away from the endpoint so untrusted code never touches local hardware. The catch has always been performance. Most isolation products use pixel pushing, sending a bitmap of the rendered page down to the browser. That approach tends to be slow, bandwidth-heavy, and prone to breaking sophisticated web apps.
Cloudflare initially hoped its global network, which sits closer to end users than most providers, could make pixel-pushed isolation usable. After testing with multiple leading vendors in the space, however, the sluggish feel persisted regardless of network proximity.
Acquiring S2 Systems
The breakthrough came from S2 Systems, which Cloudflare has since acquired. S2’s isolation technology takes a fundamentally different approach: instead of transmitting a bitmap of the screen, it sends the vectors needed to draw it. The result is a browsing experience that is typically at least as fast as local browsing, without broken pages or the heavy bandwidth demands of pixel pushing.
A useful, if imperfect, analogy is the difference between the early graphical user interfaces of Windows XP and macOS X, both released in 2001. Windows XP relied on bitmapped images; macOS X used vectors. The now-familiar "genie" effect of macOS windows animating in and out of the dock was impossible with bitmaps — and that sense of speed and fluidity is what vector-based rendering brought to the desktop. S2 applies the same principle to remote rendering.
Cloudflare plans to integrate S2's technology into Gateway Enterprise, running it across Cloudflare's entire global network to put isolation within milliseconds of virtually any Internet user. The company expects to offer a full isolation product that doesn't sacrifice performance by the second half of 2020.
The Evolution of Cloudflare for Teams
Cloudflare for Teams extends the company's network infrastructure to protect the people and organizations that rely on the Internet for work. The same technology now being deployed for enterprise security points toward a broader goal: shifting more of the Internet's heavy lifting from end devices to the network itself.
Modern web applications demand increasing bandwidth and processing power. Recent flagship phones handle them easily, but older devices struggle. As Cloudflare aims to help bring the next four billion users online, that gap matters. Making the latest Internet applications work on cheaper, less powerful hardware means reducing the local CPU, battery, and bandwidth requirements of browsing.
If S2's vector-based isolation, running on Cloudflare's network, can let low-end devices run sophisticated web apps with far less local overhead, it could make the Internet more affordable and accessible. For now, the company's immediate focus is protecting teams and enterprises — but its stated ambition extends further, toward a network that carries more of the Internet's workload for everyone.
Analyst, Customer, and Partner Reactions
Cloudflare for Teams is being positioned as a direct response to the frustrations of traditional remote access. Customers like Ziff Media Group and Udaan highlight the shift away from complex network configurations and VPN backhauls. Amod Malviya, CTO of Udaan, frames the product as a fundamental upgrade, stating that conventional VPNs create a "false sense of security," whereas Cloudflare's per-user, per-access model functions on a more reliable and intuitive basis.
Security signals are a core theme in the feedback. Roman Health's Engineering Director notes that Cloudflare enables them to evaluate every request for identity and permission, which is critical for their healthcare services. This is echoed by Tom Barsi of VMware, who explains that the partnership allows VMware Carbon Black's device health to be used as a signal for granular access control. Similarly, Tanium's Matt Hastings points to the synergy of combining endpoint visibility with Cloudflare’s enforcement capabilities to secure data and off-network devices.
Partners emphasize the integration benefits for identity and networking. Okta’s VP of Corporate & Business Development, Chuck Fontana, focuses on the goal of seamless authentication without friction, allowing any organization to use any technology. Ping Identity and OneLogin echo this, noting that the combined solutions offer comprehensive identity and network control for teams of any size, operating in any environment.
Observability emerges as a major value proposition. Sumo Logic's VP of Business Development highlights the ability to log every request to internal applications and push those logs directly for retention and analysis. Datadog also notes the expansion of visibility from web and DNS traffic into corporate environments, which is increasingly critical for operational and security use cases. For customers, this provides real-time insights into who is accessing what, providing a clear audit trail.
Distribution partners are focusing on the architectural shift. Rackspace emphasizes the software-defined networking aspect, which is central to modern cloud-journey strategies. Ingram Micro Cloud's Michael Kenney articulates the challenge of distributed work: employees outside headquarters need the same security as those inside, but the solution should not require backhauling traffic. This strategy is furthered by Cloudgenix, whose Field CTO discusses a combined branch-to-cloud solution that addresses the move off expensive legacy MPLS networks.
Beyond access control, partners are examining end-to-end protection. Malwarebytes' Chief Product Officer describes a combined defensive posture that leverages the strengths of endpoint detection with network-level security, resulting in a more resilient security stack. CipherCloud’s CEO Pravin Kothari addresses the data aspect, noting that the integration secures data both in-transit across the network and at its destination in the cloud or at endpoints.
