From Castle-and-Moat to Cloud-Delivered Security
The public Internet has become faster, safer, and more reliable over time — but businesses have largely missed out on those gains. While consumers enjoy low-latency connections to cloud services, corporate teams remain tethered to private networks built around VPN appliances and on-premise firewall hardware. That architecture forces employees to backhaul even ordinary Internet traffic through central locations, adding latency and cost while creating a security model that struggles to keep pace with modern work patterns.
Cloudflare’s first wave of products proved that a global network of data centers in over 200 cities could replace that hardware stack for securing public-facing infrastructure. The same principle now extends inward. Cloudflare for Teams applies that network to the three core challenges every organization faces: securing access to internally managed applications, protecting users from threats on the public Internet, and safeguarding corporate data wherever it lives.
Three Problems, One Legacy Answer
Organizations at the network level need to solve three distinct problems:
- Secure team member access to internally managed applications
- Secure team members from threats on the Internet
- Secure the corporate data that lives in both environments
Each of these challenges poses a real risk. If any component is compromised, the entire business becomes vulnerable.
Internally Managed Applications
The traditional answer to internal application access was to build a perimeter around those resources. Administrators deployed applications on a private network, and users outside the office connected through client VPN agents and on-site VPN appliances. That arrangement created friction for everyone. A salesperson in a taxi had to start a VPN client on their phone just to review meeting notes. An engineer working remotely watched every connection to developer tools get backhauled through a central appliance.
Security teams faced their own problems with this model. Once a user connected to the private network, they could typically reach multiple resources without proving they were authorized for each one. The front-door analogy applies: just because you can enter an apartment building doesn’t mean you should be able to walk into any unit. But enforcing additional security inside the network required complex microsegmentation — if it was implemented at all.
Threats on the Internet
Securing users who connect to SaaS tools and public cloud applications required protection against known threats and potential zero-day attacks as users left the protected perimeter. Most companies responded by forcing all traffic from branch offices and remote users back through headquarters, using the same hardware that secured their private network to build a perimeter around the Internet — at least the Internet their users accessed. A branch office in Asia might send all Internet-bound traffic through a central location in Europe, even when the destination was just down the street.
To keep those connections stable and prioritize functions like voice and video, organizations paid carriers for dedicated multi-protocol label switching (MPLS) links. MPLS improved performance by applying label switching so downstream routers could forward traffic without an IP lookup, but at eye-watering cost.
Securing Data
Keeping data safe became a moving target as it lived and moved between private tools and SaaS applications like Salesforce or Office 365. Organizations needed consistent security across both environments. The answer was more of the same: backhauling traffic over MPLS links to a place where inspection could happen, adding latency and introducing more hardware to maintain.
Why the Old Model Breaks Down
The balance of internal versus external traffic shifted as SaaS became the default for businesses of all sizes. Users now do most of their work on the Internet, and more data leaves the corporate moat to live on the public web. User behavior changed too — employees work from multiple managed and unmanaged devices, teams are more distributed, and the perimeter has stretched to its limit.
The Mounting Costs
Private networks are a constant chore to maintain. VPNs require expensive equipment that must be upgraded and expanded as more users work remotely, generating a backlog of IT help desk tickets. Administrators and security teams try to apply band-aids to an approach that cannot scale.
Organizations initially saved money by moving to SaaS tools, then watched bandwidth bills climb as traffic increased. The security model also aged poorly: traffic backhauled to headquarters was filtered through static, hardware-based scanning that couldn’t block new types of threats. Threats evolve, but on-premise boxes don’t.
The cost of protecting data in both environments grew as well. Inspecting Internet-bound traffic for threats and data loss required backhauling branch traffic through on-premise hardware, degrading speed and increasing bandwidth fees. More dangerously, data increasingly lived permanently outside the perimeter model — organizations were exposed to attacks that bypassed the network edge and targeted SaaS applications directly.
The castle-and-moat approach was designed for a world where corporate resources lived behind a firewall and users connected from the office. That world no longer exists. The alternative is a model that secures every connection individually, from any device, to any application — without forcing all traffic through a single choke point. That requires network capacity and intelligence at global scale, which is precisely what Cloudflare for Teams brings to the table.
The Cloudflare for Teams approach
Cloudflare for Teams is built on two products: Cloudflare Access and Cloudflare Gateway. Access, launched last year, targets the problem of securing internally managed applications. Instead of putting internal tools on a private network, teams deploy them in any environment — including hybrid or multi-cloud setups — and secure them uniformly through Cloudflare's network.
Access doesn't require opening new holes in corporate firewalls. Resources connect to Cloudflare through Argo Tunnel, a secure outbound-only connection that runs in your infrastructure. That lets organizations replace complex firewall rules with a single policy: disable all inbound connections.
Administrators build rules that determine who can authenticate to protected resources, whether those are virtual machines or internal web applications like Jira or iManage. When users connect, traffic passes through Cloudflare first, where they authenticate with their team's SSO. If valid, they're connected instantly — internal apps start to feel like SaaS products, with a seamless login experience.
Every request to those internal tools hits Cloudflare first, where identity-based policies are enforced. Access evaluates and logs each request for identity, giving administrators more visibility and stronger security than a traditional VPN offers.
All 200 Cloudflare data centers perform the full authentication check, so users connect faster wherever they are, without backhauling traffic to a home office. Administrators also save time: instead of configuring complex, error-prone network policies, IT teams enforce authentication through their identity provider. Security leaders can control access to internal applications and audit comprehensive logs from one place.
Since Access launched, Cloudflare has added support for RDP, SSH, and short-lived certificates that replace static keys. But teams also rely on SaaS applications like Box and Office 365 that don't run in infrastructure they control. That's where Cloudflare Gateway comes in.
Cloudflare Gateway secures teams by making a nearby Cloudflare data center the first destination for all outbound traffic. Instead of forcing Internet traffic through legacy on-site hardware, the product puts Cloudflare's global network between users and the Internet.
Gateway's first feature combines the world's fastest DNS resolver with Cloudflare's threat intelligence to block phishing and malware sites. It can be deployed to office networks and user devices in minutes. Once configured, it actively blocks malicious sites while applying content filtering based on administrator-defined policies.
Threats can hide in otherwise healthy hostnames, though. To protect against more advanced attacks, Gateway will audit URLs and, if enabled, inspect packets to find potential attacks before they compromise a device or office network. That same deep packet inspection can prevent accidental or malicious data export.
Organizations can add Gateway's advanced threat prevention in two ways:
- By connecting office networks to Cloudflare through GRE tunnels
- By distributing forward proxy clients to mobile devices
The first model, delivered through Cloudflare Magic Transit, gives enterprises a path to Gateway without disrupting their current workflow. Teams point traffic to Cloudflare over GRE tunnels instead of backhauling office traffic to centralized on-premise hardware. Once outbound traffic arrives, Gateway can apply file type controls, inline inspection, and data loss protection without hurting connection performance. Magic Transit simultaneously protects corporate IP networks from inbound attacks.
When users leave the office, Gateway's client application delivers the same level of Internet security. Every connection from the device passes through Cloudflare first, where threat prevention policies are applied. Cloudflare builds on technologies like the WireGuard protocol and features from Cloudflare Warp to deliver that security without compromising user experience.
Browser isolation without the tradeoffs
In both office and remote environments, the browser remains one of the most common attack vectors. Zero-day threats can compromise devices by using the browser as a vehicle to execute code.
Existing browser isolation solutions take one of two approaches: pixel pushing or DOM reconstruction. Both involve tradeoffs between performance and security. Pixel pushing degrades speed and drives up streaming costs. DOM reconstruction strips potentially harmful content before sending it to users — but that tactic relies on known vulnerabilities and remains exposed to the zero-day threats isolation tools are meant to solve.
Cloudflare Gateway will feature always-on browser isolation that also makes Internet browsing faster. The solution uses a patented approach to send vector commands that a browser can render without requiring an agent on the device. The user's browser session runs in a Cloudflare data center, where the instance is destroyed at the end of each session, keeping malware off user devices without sacrificing performance.
Why Cloudflare's network matters
Cloudflare for Teams runs on the same platform as Cloudflare's infrastructure products, which means security comes bundled with performance.
Speed
Gateway's DNS-filtering features build on Cloudflare's 1.1.1.1 public DNS resolver, the world's fastest resolver according to DNSPerf. To protect entire connections, Cloudflare for Teams deploys the same technology that underpins Warp.
Scale and reach
Cloudflare's 30 TBps of network capacity scales to meet the needs of nearly any enterprise, so customers can stop worrying about buying enough hardware. The network operates in 200 cities and more than 90 countries, placing security and performance close to users wherever they work. Cloudflare data centers operate within 100 milliseconds of 99% of the Internet-connected population in the developed world, and within 100 milliseconds of 94% globally.
Simplified administration
Confusing security products lead to mistakes that become incidents. Cloudflare Access can be deployed in less than an hour, and Gateway features build on that same dashboard and workflow.
Threat intelligence at scale
Cloudflare's network already secures more than 20 million Internet properties and blocks 72 billion cyber threats daily, drawing on data from protecting 11 million HTTP requests per second on average.
Availability
Cloudflare Access is available now for teams ready to replace their VPN. Certain Cloudflare Gateway features are in beta, with more to come over time.
