Emirates Driving Institute unified four entities under one Zero Trust SASE stack.

The challenge

Emirates Driving Institute is the UAE's flagship government-recognised driving education group. It operates four distinct entities (EDI, FNDI, SDI, DIDC) across multiple sites, each with independent network environments, user domains, and on-premises application stacks hosted on Oracle Cloud Infrastructure (OCI).

This organic growth created compounding challenges:

• Fragmented multi-entity security perimeter. Four entities operating under separate domains with no unified security policy enforcement. Cross-entity access was managed through manual, ad-hoc network configurations.
• No identity-aware access control. Internal applications (Orbits ERP, DMS, HR systems, hospitality platforms) were accessible based on network location, not user identity. Insider threat, credential misuse, and overprivileged access were unmanaged risks.
• No internet filtering at branch locations. Branch users could freely access any internet destination without URL-level filtering, allowing potential data exfiltration and shadow IT.
• Multi-vendor DNS complexity. Internal DNS was split across multiple name servers (OCI Dubai, OCI Abu Dhabi, DIDC, FNDI, SDI). WARP-enrolled devices could not reliably resolve internal hostnames across all entities.

What Brixio deployed

12 Cloudflared Tunnels for secure application access

• Each tunnel mapped to specific applications per entity for segmentation.
• Internal applications accessible without public internet exposure.
• Replaced ad-hoc network access with structured, per-application connectivity.

31 Gateway rules for policy enforcement

• Branch locations restricted to approved URL lists.
• Corporate users retain full internet access with security filtering.
• Location-sensitive, identity-aware filtering architecture.

3 WARP profiles across entities

• All managed devices enrolled with encrypted, inspected traffic.
• Split tunneling configured to resolve internal DNS per entity.
• Device posture enforcement for corporate vs contractor devices.

Identity-aware access via Oracle IDCS SAML SSO

• SAML integration with Oracle Identity Cloud Service.
• Cloudflare One-Time PIN as fallback authentication.
• Access policies scoped to all five entity domains.
• Role-based access restricting users to entity-specific applications.

15 Gateway lists for granular control

• Approved URL lists per branch location.
• Blocked categories and known malicious domains.
• Entity-specific filtering policies.

Results

After phased rollout, the four entities operate under a unified Zero Trust posture with identity-driven access, branch-aware filtering, and reliable cross-entity DNS resolution.