Account takeover is the use of a legitimate account by someone other than its owner, reached through stolen credentials, a stolen session, or a captured recovery channel. What separates it from other intrusions is that every action it produces looks authorised, because it is performed as a valid user.
Not to be confused with
Identity theft : uses stolen personal data to open new accounts, rather than taking over one that exists.
Session hijacking : reuses a valid session token, so authentication is never replayed at all.
How Cloudflare implements it
Bot Management and Turnstile filter automated attempts at the login endpoint, leaked credentials detection flags pairs already public, and Page Shield watches for client-side scripts that read the login form itself. Access adds identity and device posture checks on internal applications.
What running it demands
The login endpoint, multi-factor authentication (MFA) included, is blind to what follows: it judges an access attempt and returns its verdict before the first action on the account.
Spotting a takeover means looking at what happens during the session, and those signals live inside the application: a changed delivery address, a new payee, a password reset from an unfamiliar device, an export of customer data.
Detecting them means adding code to the application itself, so the work belongs to the product and engineering team rather than to security. That is why these programmes stall: the controls that matter have to be defended as roadmap features, not as lines on a risk register.
API security covers the controls that protect programming interfaces: knowing which endpoints exist, checking that requests match the contract the interface publishes, verifying that the caller is entitled to the specific object requested, and detecting abuse that looks like legitimate traffic. Its distinguishing problem is authorisation logic, which no signature can express.
Not to be confused with
Web application firewall : inspects a request for known attack patterns; API security also checks that a valid-looking request is one this caller may make.
API gateway : routes, authenticates and meters calls; it is a delivery component, not a defence against abuse of the logic.
Bot management : qualifies the sender across all interfaces, where API security reasons about the call itself.
How Cloudflare implements it
Cloudflare API Shield discovers endpoints from observed traffic, validates requests against an OpenAPI schema, authenticates clients with mutual TLS or JWT, and flags broken object level authorisation and volumetric abuse. It governs the APIs you publish, not the calls your own services make outward.
An attack surface is the set of points at which an organisation can be reached from outside: exposed hosts and services, published applications and APIs, remote access paths, and the accounts attached to them. It is defined by what is reachable, not by what the teams responsible for it know about.
Not to be confused with
Vulnerability : a specific weakness in one asset; the surface is the set of assets an attacker can address at all.
Attack vector : the route taken through the surface during an attack.
External attack surface management : the practice of discovering and tracking the surface, rather than the surface itself.
How Cloudflare implements it
Security Center inventories the domains, DNS records and origins attached to an account and reports the exposures it finds. Access removes published applications from the open internet, and Cloudflare Tunnel lets an origin serve traffic with no inbound port open.
Bot mitigation covers the techniques that identify automated traffic on a site or an API, classify it by intent, then apply a decision: allow, slow down, challenge or block. It handles legitimate programs as much as hostile ones, since telling the two apart is precisely its job.
Not to be confused with
CAPTCHA : a verification mechanism; bot mitigation is what decides whether one is needed.
Web application firewall : the WAF inspects the content of the request, bot mitigation qualifies whoever sent it.
Rate limiting : counts requests on an endpoint, without judging the nature of the sender.
How Cloudflare implements it
Bot Management scores every request and lets you act on that score. Turnstile verifies a visitor without imposing a CAPTCHA. Rate Limiting bounds a specific endpoint. AI Crawl Control handles crawlers collecting content to train models.
What running it demands
Tuning happens endpoint by endpoint: a login page, a signup form and a public API do not share a tolerance threshold. The real work is not the rollout, it is managing false positives and rule drift as legitimate traffic changes.
Business email compromise is email fraud aimed at a payment process. The attacker impersonates an executive, a supplier or a legal counterparty and persuades an employee to make a transfer or change bank details. It usually carries no attachment and no link, which is why filters built around malicious payloads miss it.
Not to be confused with
Phishing : harvests credentials at scale; BEC targets one transaction.
Spear phishing : the technique often used to open a BEC attack.
Account takeover : one route into BEC, when the message is sent from a real mailbox rather than a spoofed one.
How Cloudflare implements it
Email Security scores relationship history, domain similarity and the absence of payload, which is itself a signal, and applies a disposition that automatic moves can act on. Outbound policy covers the reverse case, a compromised internal mailbox sending the request.
A CASB is a control point between an organisation's users and the cloud applications they use, whether SaaS, PaaS or IaaS. It discovers which services are in use, applies data and access policy to them, and records what people do with the data once they are past authentication.
Not to be confused with
Forward proxy : filters web traffic in general; a CASB understands the application behind it and acts on objects and permissions.
Identity and access management (IAM) : decides who may sign in; a CASB observes what happens afterwards.
How Cloudflare implements it
Cloudflare CASB connects to SaaS tenants such as Google Workspace, Microsoft 365 and Salesforce through their APIs and returns findings on misconfiguration, over-shared files and dormant privileged accounts. Gateway covers the inline side and identifies services nobody declared, and DLP applies data policy to what passes through.
What running it demands
API connection and inline filtering answer two different questions: the first reports on the state of a SaaS tenant, its shares and its permissions, without sitting in the flow and therefore without being able to interrupt it; the second is in the flow and can stop an action while it happens. Most estates need both.
The first connection produces thousands of findings, most often public links on files nobody reads. Their value depends entirely on the triage decided before the tool is plugged in: which finding types raise a ticket, and who closes them. Without that rule set in advance, the list stays open and nobody works it.
The blind spot is structural: in API mode a CASB only sees the tenants it has been connected to. Services nobody declared and personal accounts therefore surface in gateway traffic, never in the CASB.
Credential stuffing is an automated attack that replays username and password pairs stolen in earlier breaches against the login form of an unrelated service. It exploits no vulnerability in the target: it relies on people reusing the same password across sites, so a small success rate on a large list is enough.
Not to be confused with
Brute force : generates candidate passwords against a known account, rather than replaying pairs that are known to have worked somewhere.
Password spraying : tries one common password across many accounts, specifically to stay under lockout thresholds.
Bot Management scores each login request on behaviour and request fingerprint. Leaked credentials detection, part of the WAF, flags requests carrying a pair already known to be public and exposes the result as rule fields. Rate Limiting bounds the endpoint and Turnstile challenges without a puzzle.
What running it demands
Detection has to be switched on first: it is on by default on the Free plan, and enabled by hand on paid plans, in the dashboard, by API or through Terraform. It then flags the request without deciding anything: the decision has to be written, as a block or a challenge in the WAF, or in the application, as a step-up factor or a forced password reset.
How much the signal tells you depends on the plan: the password-leaked boolean is available everywhere, the username and password pair needs Pro or above, and the username on its own, like a password similar to a leaked one, needs Enterprise. The pair is what lets you block, since a password that is already public says nothing about the account being tried, so the plan gets checked before the rule is designed.
The configuration trap is silent: detection only reads the locations the default configuration covers, and a form posting unusual field names (user_login instead of username, say) is not one of them. Declaring a custom detection location is possible but Enterprise only, so below that there is no setting to fall back on and the form's own field names have to be brought into line. Otherwise the check runs against nothing and reports clean while the attempts go through, with no error raised anywhere.
Data residency is the geographical location where an organisation stores and processes its data, chosen to meet an internal policy, a contractual commitment or a regulatory expectation. It is a statement about where the data physically sits, and about nothing else.
Not to be confused with
Data sovereignty : which law governs the data, which is not settled by where it is stored.
Data localisation : a legal obligation to keep data in a country, whereas residency can be a choice.
Data privacy : the rules on how personal data may be used, which apply wherever it sits.
How Cloudflare implements it
The Data Localization Suite covers three distinct questions: Regional Services chooses which data centres may decrypt and process HTTPS traffic, Customer Metadata Boundary keeps logs and analytics in a selected region, and Geo Key Manager controls where private keys are held.
Data sovereignty is the principle that data is governed by the law of the country where it is held or collected. It is a question of jurisdiction rather than of location: a provider subject to a foreign law can be reached by that law regardless of where the servers stand, which is why sovereignty is argued in terms of who controls the provider, the keys and the operations.
Not to be confused with
Data residency : where the data sits, which is a necessary condition and not a sufficient one.
Sovereign cloud : an offer built to satisfy sovereignty requirements, whether by ownership, jurisdiction or operating model.
GDPR : a data protection regulation that governs use and transfer of personal data; sovereignty is the broader question of whose law applies at all.
How Cloudflare implements it
The Data Localization Suite restricts where traffic is decrypted, where metadata is retained and where keys are held. These are location and key controls: they narrow exposure, and they do not by themselves settle which jurisdiction can compel a provider, which is a matter of corporate structure and contract.
A distributed denial of service attack saturates its target with traffic sent from a large number of machines, until it stops answering legitimate requests. It can aim at network bandwidth, at server resources, or at a single function of the application.
Not to be confused with
Denial of service : comes from a single source.
Application-layer attack : imitates normal traffic, so it cannot be spotted by volume alone.
Flash crowd : a genuine surge of real users that saturates capacity with no attacker involved.
How Cloudflare implements it
DDoS Protection covers the application layer. Magic Transit protects entire address ranges at layers 3 and 4. Spectrum handles protocols other than HTTP.
Data loss prevention is the set of policies and controls that detect and stop sensitive data leaving where it should stay, whether the movement is deliberate or accidental. It covers data in transit, at rest and in use, and depends on being able to recognise the data in the first place.
Not to be confused with
Backup : keeps a copy so data can be recovered; DLP keeps it from leaving.
Data classification : labels data by sensitivity, and is the input DLP rules are written against.
Encryption : makes data unreadable without the key, without saying anything about who may move it.
How Cloudflare implements it
Cloudflare DLP inspects traffic passing through Gateway, applying profiles for known data types such as payment card numbers and national identifiers, plus custom expressions. Cloudflare CASB applies the same profiles to files already stored in connected SaaS tenants, and Email Security covers outbound mail.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC is an email authentication protocol layered on SPF and DKIM. It lets the owner of a domain publish in DNS the policy that receiving mail servers should apply to messages that claim to come from that domain but fail authentication: none, quarantine or reject. It also asks those servers to report back on what they saw.
Not to be confused with
SPF (Sender Policy Framework) : declares which servers may send for a domain; DMARC decides what happens when the check fails.
DKIM (DomainKeys Identified Mail) : signs the message so the receiver can verify it was not altered and came from the signing domain.
Lookalike domain attack : DMARC only covers the exact domain it is published for. A message sent from a similar-looking domain the attacker registered passes its own SPF, DKIM and DMARC. Registration monitoring and display filtering answer that case; DMARC does not.
How Cloudflare implements it
Email Security evaluates SPF, DKIM and DMARC results on inbound messages as part of its inspection. Cloudflare DNS hosts the DMARC TXT record, and DMARC Management collects and parses the aggregate reports that receivers return, which is the inventory the policy change depends on.
What running it demands
Publishing p=reject takes one line of DNS. Getting there without cutting off legitimate mail is an inventory exercise: it needs the list of every tool that writes on behalf of the domain, CRM, support, marketing, billing, internal applications, and the aggregate reports are what builds that list. Two mechanisms then derail the path, both of them without a visible error.
The SPF ceiling first: the protocol stops at ten DNS lookups, and each provider added through an include consumes at least one. Five SaaS senders are often enough to pass the limit, and the check then returns a permanent error: nothing warns the sender, the failure only shows up in the reports or at the receiver.
Forwarding next: mailing lists and automatic forwards rewrite the envelope of the message, which breaks SPF on perfectly legitimate flows. Only the DKIM signature survives that, so DMARC alignment for those flows has to rest on DKIM, which means signing them properly before the policy is hardened.
Then there is sp=, which gets set explicitly rather than left to default: with no value of its own, a subdomain inherits the policy of the parent domain. The day p=reject is published, a subdomain served by a tool nobody follows any more stops delivering, overnight.
DNS filtering applies policy at name resolution. The resolver checks the requested domain against categories and threat feeds and returns a block response instead of an address. Because it acts before any connection opens, a single decision covers every port and protocol that would have used that name.
Not to be confused with
URL filtering : reads the path and parameters of a request, whereas DNS filtering sees only the hostname.
IP blocking : denies routing to an address, regardless of which names resolve to it.
Secure web gateway : includes DNS policy and adds inspection of the traffic that follows.
How Cloudflare implements it
Gateway resolves queries for enrolled devices and networks, applying category lists, threat intelligence and custom rules. Locations are identified by their own resolver endpoint, and policy can differ by location, by user group or by device posture.
What running it demands
The control only covers queries that reach the filtering resolver, and three routes go around it: a hardcoded IP address, a browser using its own encrypted DNS provider, and any device off the corporate network. Most of the deployment is closing those routes, forcing the resolver on managed devices and blocking third-party DoH endpoints. Read the reporting with that in mind: bypassed queries are invisible by definition, so a clean dashboard is evidence about the resolver, not about the estate.
DNSSEC adds cryptographic signatures to DNS records so a resolver can verify that an answer came from the zone that claims it and was not altered in transit. It authenticates the data; it does not encrypt the query, and it says nothing about whether the domain resolved to is safe.
Not to be confused with
DNS filtering : decides whether a name should resolve at all; DNSSEC verifies that the answer given is genuine.
DNS over HTTPS : encrypts the exchange between client and resolver; DNSSEC signs the record itself, all the way from the authoritative server.
TLS : protects the connection made after resolution, not the resolution.
How Cloudflare implements it
Cloudflare DNS signs a zone and manages the key rollover automatically once DNSSEC is enabled. The remaining step belongs to the registrar: the delegation signer record has to be published in the parent zone for validation to take effect.
What running it demands
The risk is not the attack, it is the configuration. A signed zone whose keys fall out of step fails closed: validating resolvers refuse the answer and the domain becomes unreachable, a total and immediate outage, far heavier than the spoofing it was meant to prevent.
The step outside the DNS provider's hands is the delegation signer record, the DS, which the registrar publishes in the parent zone (.com, .fr). That is the one that breaks in practice, during a domain transfer or a change of DNS provider: the zone is signed with new keys, the DS still cached by resolvers points at the old ones, and the resolvers that validate return SERVFAIL until that cache expires.
Hence an order of operations that is not improvised: remove the DS at the registrar, wait for its TTL to expire, 24 to 48 hours on most top-level domains, change the nameservers, then re-enable signing at the new provider. The rest is one rule: automate the key rollover, or do not sign. A half-managed signed zone is more dangerous than an unsigned one.
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, sets requirements for the digital operational resilience of financial entities in the European Union: ICT risk management, incident reporting, resilience testing, and management of third-party ICT providers. Providers designated as critical come under direct European supervision.
Not to be confused with
NIS2 : covers many sectors and is transposed nationally; DORA applies directly and only to finance and its ICT suppliers.
PCI DSS : a card industry standard set by private bodies, not European law.
MiFID II : governs market conduct and transparency, not the resilience of the systems underneath.
How Cloudflare implements it
Cloudflare contributes to specific articles rather than to the regulation as a whole: availability and application protection, continuous logging through Logpush for the incident reporting timeline, and the contractual and location controls that the third-party provisions require.
Edge computing runs code and processes data on nodes located close to the people or devices that generate the requests, instead of sending everything to a distant central data centre. Executing at points of presence on the network edge cuts the round trip and reduces the traffic carried back to core infrastructure.
Not to be confused with
Cloud computing : processing takes place in a small number of central regions, far from the user.
Content delivery network (CDN) : a CDN serves stored copies of content near the user; edge computing executes code there.
On-premises infrastructure : hardware the organisation owns and operates itself, rather than nodes operated by a provider.
How Cloudflare implements it
Workers runs code at the edge, with first-class support for JavaScript, TypeScript, Python and Rust, and WebAssembly for languages compiled to it. Workers KV stores values that tolerate staleness, D1 holds relational data, Durable Objects hold strongly consistent state, and R2 stores objects without egress fees.
What running it demands
The real constraint is not latency, it is data consistency, and the two storage primitives resolve that trade-off in opposite directions.
Workers KV is eventually consistent: values are cached location by location, so reads are immediate, but a write made in one region takes up to a minute, sometimes more, to propagate, and another region reads a stale value in the meantime. That suits configuration, feature flags or preferences, not a balance or a stock level.
A Durable Object is strongly consistent at the opposite cost: the data lives in a single place. A global counter held in one object therefore hands every user back the round trip the edge was meant to remove, and the way out is to partition, one object per customer, per room or per key, rather than to centralise.
Hence the order of decisions: which data tolerates staleness is settled at design time, before the first line of code. Getting it wrong means rewriting, no tuning pass recovers the choice.
The General Data Protection Regulation, Regulation (EU) 2016/679, governs how personal data of people in the European Union is collected, used, stored and transferred. It applies to organisations outside the Union when they target or monitor people inside it, and it assigns duties to the controller who decides the purpose and to the processor who acts on instruction.
Not to be confused with
NIS2 : governs the security and continuity of networks and systems; the GDPR governs the use of personal data, whoever holds it.
Data sovereignty : the question of which law applies at all; the GDPR is one such law, not the principle.
PCI DSS : a private card industry standard, contractually enforced, not legislation.
How Cloudflare implements it
The Data Localization Suite answers the location half: Regional Services chooses where HTTPS traffic may be decrypted, Customer Metadata Boundary keeps logs and analytics in a chosen region, and Geo Key Manager restricts where private keys are held. The contractual half, the data processing agreement and the transfer terms, sits outside the product.
What running it demands
The technical measures are the easy part. What stalls is the transfer question, and it stalls for a reason teams rarely anticipate.
A CDN or a web application firewall that terminates TLS is processing personal data. It therefore belongs in the record of processing and in the transfer analysis, alongside the CRM. Most inventories file it under infrastructure and leave it out.
The practical consequence: where traffic is decrypted stops being an implementation detail and becomes an answer you have to be able to document, as do the region the logs stay in and the country that holds the private keys.
ISO/IEC 27001 is an international standard that sets the requirements for an information security management system: how an organisation identifies its risks, decides which controls to apply, and reviews that decision over time. It is certifiable by an accredited third party, which distinguishes it from frameworks that are only self-assessed.
Not to be confused with
ISO/IEC 27002 : the catalogue of controls and implementation guidance; 27001 sets the requirements that can be certified.
SOC 2 : an attestation report produced by an auditor against trust services criteria, widely used in North America, rather than a certification against a standard.
NIST Cybersecurity Framework : a voluntary reference for organising a security programme, with no certification attached.
How Cloudflare implements it
No product delivers certification. What the platform contributes is evidence for specific controls: Logpush and audit logs for traceability, Access for the access control clauses, and Security Center for the asset inventory the risk assessment depends on. Cloudflare also publishes its own certifications and audit reports, which a customer cites as supplier assurance rather than as its own compliance.
What running it demands
Read the scope statement before the certificate. The scope decides what the certificate is worth, and a certificate covering one product line in one data centre says close to nothing about the service actually being bought, from a supplier or from yourself. The second thing to look at is the date of the last surveillance audit rather than the initial certification, because the surveillance cycle is what shows the management system is alive rather than assembled once for the auditor.
Managed detection and response is a service in which a provider watches an organisation's telemetry, hunts for activity that no rule flagged, and takes containment action when it finds it. What separates it from monitoring is the mandate to act, agreed in advance, rather than to notify and wait.
Not to be confused with
MSSP : operates the security platform; MDR is measured on what it finds and contains.
Endpoint detection and response : the software on the machine, which MDR analysts operate.
SOC as a service : the broader monitoring function; MDR is the part with a containment mandate.
How Cloudflare implements it
Cloudflare supplies the network side of the telemetry rather than the service: Logpush exports the request, firewall and Zero Trust logs a provider correlates with endpoint data, and the API lets that provider push a blocking rule or revoke a session during an incident.
The Model Context Protocol is an open standard describing how an application built on a language model connects to external tools, data sources and prompts. It defines how a client discovers what a server offers and how it invokes it, so one integration works across different models and hosts.
Not to be confused with
API : the interface a service exposes; MCP is the convention through which an agent discovers and calls such interfaces.
Retrieval-augmented generation : a pattern for feeding documents to a model, which MCP can carry but does not define.
JSON-RPC : the message format MCP uses. The transport is a separate matter, standard input and output for a local server, HTTP for a remote one.
How Cloudflare implements it
Cloudflare hosts remote MCP servers on Workers, and Cloudflare One adds two controls: Access in front of a server, and MCP portals, which put several servers behind one endpoint and choose which tools each portal exposes. A portal can route its traffic through Gateway, which makes the calls visible in logs and subject to DLP.
A managed security service provider operates an organisation's security infrastructure on its behalf: configuration, monitoring, maintenance and change management of the controls in place. The scope is the running of the tooling, which distinguishes it from services sold on detection outcomes.
Not to be confused with
Managed service provider : runs general IT infrastructure; an MSSP is scoped to security systems.
Managed detection and response : sold on finding and containing threats, where an MSSP is sold on operating the platform.
SOC as a service : the monitoring and investigation function, which an MSSP may include in a wider contract.
How Cloudflare implements it
Cloudflare delivers services of this kind through accredited partners rather than directly, with the partner holding the configuration and the customer keeping ownership of the account. The dashboard, audit logs and Logpush are the interfaces that make that division auditable.
mTLS is TLS used in both directions. The server presents its certificate as usual and the client presents one too, each side validating the other during the handshake, before application data is exchanged. It replaces shared secrets such as API keys with an identity bound to a certificate issued by a known authority.
Not to be confused with
TLS or HTTPS : one-way authentication, where only the server proves its identity.
API key authentication : a shared secret carried in a header, which anyone holding it can replay.
OAuth 2.0 : an authorisation framework operating on application tokens, whereas mTLS authenticates the transport connection itself.
How Cloudflare implements it
API Shield validates client certificates at the edge, so an unauthenticated call never reaches the origin, and can issue them from a Cloudflare-managed certificate authority. Access supports mutual TLS as an authentication method for applications, and Authenticated Origin Pulls applies the same principle between Cloudflare and the origin server.
What running it demands
The protocol is a day of work; the certificate lifecycle is the project. The Cloudflare-managed authority is available on every plan, but bringing your own is an Enterprise feature capped at five certificate authorities, which is the constraint that decides the design when several subsidiaries each arrive with their own PKI. Automate renewal before issuing the first certificate: an expired client certificate is an outage with no attacker involved, and it lands on the flow with the fewest owners, typically an IoT fleet or a partner integration nobody has touched in two years.
The NIS2 Directive, Directive (EU) 2022/2555, is European Union legislation setting cybersecurity obligations for organisations in the sectors it covers: risk management measures, incident notification, supply chain security, and accountability of the management body. It replaces the 2016 NIS Directive and classifies the organisations in scope as essential or important entities.
Not to be confused with
GDPR : governs personal data; NIS2 governs the security and continuity of networks and information systems.
DORA : covers the financial sector specifically, and is a regulation applying directly, where NIS2 is a directive transposed by each member state.
ISO 27001 : a voluntary certifiable standard, not law, though it supports several NIS2 measures.
How Cloudflare implements it
Cloudflare products contribute to individual measures rather than to compliance as a whole: Access and Gateway for access control, DDoS Protection and WAF for availability and application security, Logpush for retention of the audit trail that notification deadlines depend on.
PCI DSS (Payment Card Industry Data Security Standard)
PCI DSS is the security standard the payment card brands require of any organisation that stores, processes or transmits cardholder data. It is enforced contractually through acquirers rather than by law, and the level of validation required depends on transaction volume.
Not to be confused with
GDPR : legislation covering all personal data; PCI DSS is a private standard covering card data specifically.
SOC 2 : an attestation on an organisation's control environment, not a card data requirement.
EMV : the chip and PIN standard for the physical card, not the systems that process the transaction.
How Cloudflare implements it
Two requirement families map onto the platform. The WAF addresses the public-facing application requirement, and Page Shield addresses the client-side script requirements introduced in version 4.0, by inventorying and monitoring the scripts that execute on the payment page. Both produce the evidence an assessor asks for, which is often the harder half.
What running it demands
Scope is the whole game. Everything that touches the payment page falls inside the cardholder data environment, third-party scripts included, and that is what the client-side requirements of version 4.0 formalised. The discovery that surprises most teams is that the tag manager is in scope, along with whatever marketing has been allowed to inject through it. Settle who may add a script to a payment page before the assessment, because the alternative is discovering the answer during it.
Phishing is a social engineering attack that imitates a trusted organisation, in an email, a message or a web page, to obtain credentials, a payment or the execution of a file. It is sent broadly rather than written for one recipient, which is what separates it from spear phishing.
Not to be confused with
Spear phishing : written for a named target, using research on that target.
Credential stuffing : replays credentials already stolen, whereas phishing is one of the ways they are stolen.
How Cloudflare implements it
Email Security inspects inbound messages for spoofed senders, malicious links and pages imitating a login form. Gateway blocks resolution of known phishing domains, and Browser Isolation opens the ones policy allows without running their code on the endpoint.
Post-quantum cryptography is the set of cryptographic algorithms designed to remain secure against an attacker holding a cryptographically relevant quantum computer. It covers key exchange and digital signatures, and is intended to replace RSA and elliptic curve cryptography, whose security rests on problems such a machine could solve.
Not to be confused with
Quantum key distribution : exchanges keys using the physics of the transmission medium and needs dedicated hardware; post-quantum cryptography is mathematics running on ordinary computers.
Quantum computing : the machine that creates the problem, not the answer to it.
Symmetric encryption : AES and its equivalents are affected far less, and are addressed by increasing key length rather than by changing algorithm.
How Cloudflare implements it
Cloudflare supports hybrid post-quantum key agreement across its network, combining X25519 with ML-KEM, the mechanism standardised by NIST. Connections from clients that support it are already negotiated this way, and the share of traffic concerned is published on Cloudflare Radar.
Prompt injection is a class of vulnerability in applications built on large language models. Because the model reads instructions and data in the same channel, text placed in the data can be read as an instruction and override the one the application gave, whether it arrives from the user or from a document the application retrieved.
Not to be confused with
SQL injection : exploits a query language with a defined grammar, which can be parameterised; natural language cannot.
Jailbreaking : direct prompt injection aimed at the model's own safety constraints rather than at the application around it.
Hallucination : an error the model makes on its own, with no attacker involved.
How Cloudflare implements it
AI Security for Apps, a WAF detection formerly named Firewall for AI, inspects prompts sent to a model and can log or block before the request is forwarded. AI Gateway applies guardrails and data loss prevention policy to prompts and responses, and records prompt, response, provider, tokens, cost and duration per call.
What running it demands
No input filter closes this, because the injected text is valid natural language and the model has no channel in which to separate instruction from data. What bounds the damage is the permission the agent holds: an assistant that can only read cannot be talked into a payment, so scope the tools first and filter second. Where the injection arrives through a retrieved document rather than a user prompt, the control point moves to the retrieval source, which is usually owned by a team that does not yet know it has become part of the security boundary.
The Purdue model is a reference architecture that divides an industrial environment into hierarchical levels, from the sensors and actuators of the process up to the corporate information system, with a demilitarised zone between the operational and enterprise halves. It is used as the segmentation map for industrial control systems.
Not to be confused with
OSI model : describes communication layers within a protocol stack, not the organisation of an industrial site.
Micro-segmentation : an isolation technique applied inside a zone, including inside a Purdue level.
IEC 62443 : the standard that sets industrial security requirements, and which uses zones and conduits rather than Purdue levels as its own vocabulary.
How Cloudflare implements it
The products act at the enterprise levels and at the boundary, not inside the process. Cloudflare Tunnel gives an outbound-only path so an industrial site publishes nothing inbound, Access governs who reaches a given interface, and Cloudflare WAN and Magic Transit carry the site links.
What running it demands
Almost no real plant matches the diagram, and the gap is always in the same place: the remote maintenance links that equipment vendors negotiated directly with the operations team, which cross levels and predate any security review. The useful work is inventorying those crossings, one supplier at a time, before drawing a target architecture. Expect resistance, since each of those links has a production availability commitment attached to it, and the person who signed it is not in the security function.
Ransomware is malicious software that denies access to systems or data, usually by encrypting files, until a ransom is paid. Most current campaigns add a second lever: the data is copied out before it is encrypted, so paying for a decryption key does not remove the threat of publication.
Not to be confused with
Malware : the general category; ransomware is the extortion-driven part of it.
Phishing : one of the delivery routes, not the payload.
Denial of service : interrupts availability from outside without touching the data.
How Cloudflare implements it
The relevant products act on the routes in rather than on the encryption itself: Email Security on the delivery message, Gateway on the resolution of command and control domains, Browser Isolation on drive-by downloads, and Access on the lateral movement that follows an initial foothold.
What running it demands
Backups decide the outcome, and the metric that matters is restore time, not backup success. A nightly job that reports green for two years is worth nothing if restoring the file server takes eleven days. Test the restore, not the backup. And note what double extortion changed: a clean restore ends the outage but not the incident, because the copied data is still leverage. The disclosure decision therefore has to be prepared before it is needed, with legal and communications, not improvised on day two.
Remote browser isolation runs the browsing session on a remote machine and sends the rendered result to the user's device, so page code executes away from the endpoint. The user keeps a normal browser; what arrives locally is a stream of drawing commands or images rather than the site's own scripts.
Not to be confused with
Virtual desktop infrastructure : virtualises a whole desktop, whereas isolation virtualises the browser session only.
Web filtering : decides whether a site may be opened at all; isolation is what allows a site to be opened without running its code locally.
Endpoint sandboxing : contains code that has already reached the device; isolation keeps it from arriving.
How Cloudflare implements it
Browser Isolation runs sessions in containers on Cloudflare's network and uses Network Vector Rendering to send draw commands to the local browser. Gateway policy decides which categories open in isolation, controls copy, paste, printing, upload and download inside the session, and can disable user input entirely on risky sites. Traffic is decrypted using the Cloudflare root certificate.
What running it demands
Isolation protects the device from running page code; it does not stop a user typing their credentials into a phishing page rendered remotely. What decides the outcome is three decisions in the Gateway policy, and every one of them has to be made deliberately.
Keyboard input first: Cloudflare can disable typing on isolated sites, and it is the only one of these controls that answers the phishing case, since it stops a password being typed into the page. Like the other session restrictions, it allows the action by default and is restricted policy by policy, so nobody gets it without having written it.
The clipboard and the file transfers next, copy, paste, printing, upload, download: they are what users actually notice and contest. Tightening them with no warning and no exception route blocks day-to-day work and fills the queue with waiver requests.
The category list last: isolating everything spends latency on pages that never needed it, so isolation is kept for the risky categories, the ones policy allows but does not trust.
Secure Access Service Edge is a model in which network connectivity and network security are delivered together, from a provider's network, to users and sites wherever they are. It brings SD-WAN together with the security functions of SSE: secure web gateway, cloud access security broker, zero trust network access and firewall as a service.
Not to be confused with
SSE : the security half of SASE, without the connectivity half.
SD-WAN : the connectivity half, without the security functions.
Zero trust : the principle applied inside SASE, not a synonym for the architecture.
How Cloudflare implements it
Cloudflare One is Cloudflare's SASE platform: Access for zero trust network access, Gateway for the secure web gateway, Cloudflare CASB and DLP, with Cloudflare WAN and Magic Transit for connectivity and Cloudflare Network Firewall for network traffic.
SD-WAN is a way of running a wide area network in which software decides, per application and in real time, which transport a flow takes across several links: private circuits, broadband, mobile. The routing policy lives centrally rather than in each site's configuration, which is what makes a change a policy edit instead of a site visit.
Not to be confused with
MPLS : one of the transports SD-WAN arbitrates between, not an alternative to it.
SASE : adds the security functions of SSE to the connectivity SD-WAN provides.
VPN : builds a tunnel between two points; SD-WAN chooses which tunnel a given flow should use.
How Cloudflare implements it
Cloudflare WAN connects sites, data centres and cloud environments to Cloudflare's network, with policy applied on the same platform as the Zero Trust controls. Magic Transit covers address ranges at layers 3 and 4, and Cloudflare Network Firewall filters that traffic.
What running it demands
This is the part of a SASE programme that behaves like a network project rather than a subscription: it carries physical constraints and a calendar that is not yours to set.
Each site depends on the local carrier's lead time, and an anycast on-ramp engages a BGP announcement, which means change windows, a peering conversation and a rollback plan. That is weeks of coordination before the first cutover, not a console setting.
Hence the sequencing: connectivity goes last, after identity and after application access. Those two are delivered in weeks, this one in quarters, and mixing them into a single milestone is the surest way to make the whole programme report late.
A secure web gateway inspects the web traffic leaving an organisation and applies policy to it: which sites may be reached, which file types may be downloaded, which content is scanned. It sits inline between the user and the internet, and applies the same rules whether the user is in an office or not.
Not to be confused with
Firewall as a service : filters primarily on addresses, ports and protocols, whereas a gateway reads the HTTP exchange.
Web application firewall : protects inbound traffic to applications you publish; a gateway protects outbound traffic from your users.
DNS filtering : decides on the name alone, before the connection opens; a gateway sees the full URL, the payload and the files.
How Cloudflare implements it
Gateway carries DNS, network and HTTP policy in one place, with TLS inspection, antivirus scanning and application control. Users reach it through the WARP client, an agentless proxy endpoint or a tunnel, and Browser Isolation handles the categories that policy allows but does not trust.
What running it demands
TLS inspection is where the project stalls, and rarely for technical reasons.
On the technical side it requires the Cloudflare root certificate on every managed device, and it breaks anything that pins certificates, mobile applications and thick clients first. Those cases are handled by exception, they do not go away.
On the legal and social side it raises a question that is not the security team's to settle alone: which categories are decrypted and which are exempt. Banking, health and staff representation traffic are exempted in most European deployments.
Hence the rule: agree that list with legal and with staff representation before rollout. It takes less time than agreeing it after the first complaint.
Security Service Edge is the security half of the SASE model: secure web gateway, cloud access security broker and zero trust network access, delivered from a provider's network rather than from appliances in a data centre. It covers access to the web, to SaaS and to private applications, and leaves connectivity out of scope.
Not to be confused with
SASE : combines SSE with the network side, SD-WAN and network on-ramps.
Zero trust : the principle, continuous verification rather than implicit trust; SSE is one architecture for delivering it.
VPN : grants access to a network segment, whereas SSE grants access to a named application.
How Cloudflare implements it
Cloudflare One carries the three components on one network: Gateway for the secure web gateway, Cloudflare CASB, and Access for zero trust network access, with Browser Isolation, DLP and Digital Experience Monitoring alongside. Cloudflare WAN and Magic Transit sit outside SSE, on the connectivity side of SASE.
What running it demands
SSE is bought as a platform and delivered as a migration, in an order that is not negotiable: the identity provider first, then private application access, then internet traffic, because every later policy is written in terms of who the user is. Running the legacy VPN in parallel through that period is the normal cost, not a sign of failure. The step that slips is decommissioning: an appliance left powered on remains a route in, and the savings that justified the project only arrive when it is switched off.
Session hijacking is the reuse of a valid session token by someone other than the person it was issued to. Because the token already represents a completed authentication, the attacker never meets the login controls: no password, no second factor, no anomaly at sign-in.
Not to be confused with
Credential stuffing : replays passwords at the login form; hijacking skips the login form entirely.
Cross-site scripting : one of the ways a token is stolen, by running script in the victim's page.
Adversary in the middle : an interception position that captures the token in transit or proxies the whole session.
How Cloudflare implements it
Page Shield monitors the client-side scripts that are the usual theft route and reports changes to them. Access re-evaluates identity and device posture during a session rather than only at its start, and WAF rules can act on the mismatch between a session and the request that carries it.
What running it demands
The instinct is to bind the session to an IP address, and it is the wrong first move: mobile networks change address mid-session, so the control generates support tickets and gets switched off within a fortnight. What works is accepting that the token can be stolen and shortening what it is worth: a short lifetime, rotation at every privilege change, and re-authentication on the actions that matter rather than on every page. Rotation on privilege change is the step almost always missed, and it is the one that turns a stolen read-only session into a dead end.
Shadow AI is the use of artificial intelligence tools, including large language models and generative assistants, by employees without the approval of the teams responsible for IT and security. The exposure is not the tool itself but what is pasted into it: source code, customer records, contracts, figures that are not public yet.
Not to be confused with
Shadow IT : the same pattern across all unapproved software; shadow AI is the subset where the risk is what leaves in the prompt.
AI hallucination : a wrong answer from a model, approved or not.
Prompt injection : an attack on a model the organisation runs, rather than uncontrolled use of someone else's.
How Cloudflare implements it
Gateway identifies traffic to generative AI services and can allow, log or block it per user group. Cloudflare CASB covers the tenants that have been sanctioned, and DLP inspects what is being sent rather than only which service is reached.
A SIEM collects log and event data from applications, infrastructure and security tools, normalises it, and correlates it to raise alerts, support investigation and retain evidence. It is a platform, not an outcome: what it produces depends entirely on which sources are connected and how the correlation rules are written.
Not to be confused with
SOAR : automates the response workflow once an alert exists, where a SIEM produces the alert.
XDR : detects from its own telemetry across endpoints and network, where a SIEM ingests logs from tools it does not own.
SOC as a service : supplies the analysts who work the alerts; a SIEM is the tooling they work in.
How Cloudflare implements it
Logpush exports HTTP request, firewall event, Zero Trust and audit logs to a SIEM or to object storage, in batches rather than as a live stream. Security Analytics and Security Center give the same picture in Cloudflare's own console, without export.
What running it demands
The design constraint is ingestion cost, not detection. Cloudflare emits one record per HTTP request, so sending raw HTTP logs from a busy zone into a SIEM priced per gigabyte will consume the annual budget in weeks. Decide at the Logpush job what to send: sample the successful requests, keep the security events whole, and filter the fields nobody queries. That choice is architectural and hard to reverse, because the alternative is renegotiating a licence rather than editing a rule.
SOC as a service is the delivery of security monitoring by an external provider on a subscription: detection, triage, investigation and incident response, covering the hours the organisation cannot staff itself. The customer keeps the decisions; the provider keeps the watch and the tooling.
Not to be confused with
In-house SOC : the same function staffed and operated internally.
SIEM : the platform that collects and correlates the logs, which a SOC uses; buying one does not produce the other.
Managed detection and response : usually narrower, centred on endpoint detection and containment, and often one component of a SOC service.
How Cloudflare implements it
Cloudflare supplies the telemetry rather than the service. Logpush exports HTTP, firewall, Zero Trust and audit logs to a SIEM, Security Analytics and Security Center give the console view, and the Cloudforce One feeds in Security Center provide the threat intelligence side.
A sovereign cloud is an offer built so that the data it holds, and the operations that touch it, remain governed by the law of a chosen jurisdiction. The claim rests on three separable things: where data sits, who holds the keys, and which law the operating company answers to. Offers differ mainly in how many of the three they actually address.
Not to be confused with
Public cloud : a shared global infrastructure whose operator may answer to a foreign jurisdiction whatever the region selected.
Data residency : the location question alone, which is necessary and not sufficient.
Private cloud : a dedicated infrastructure, which says nothing by itself about applicable law.
How Cloudflare implements it
The Data Localization Suite addresses the location and key questions: Regional Services for where HTTPS traffic is decrypted, Customer Metadata Boundary for where logs stay, Geo Key Manager for where private keys are held. It does not address the third question, the jurisdiction the operating company answers to, which is a matter of corporate structure and contract.
Spear phishing is a social engineering attack written for a named individual, team or organisation. The attacker researches the target, usually from public sources, then sends a message that fits the recipient's role and current context in order to obtain credentials, a payment, or the execution of a file.
Not to be confused with
Phishing : sent broadly and without customisation; spear phishing is written for one recipient.
Whaling : spear phishing aimed specifically at senior executives.
Email Security scores inbound messages on sender relationship history, domain age, display name mismatch and link behaviour, then assigns one disposition per message, from malicious to suspicious, spam and bulk. Automatic moves act on that disposition, and retrospective scanning re-examines messages already delivered.
What running it demands
Delivery is not the end of the verdict. A suspicious disposition means the message is still under analysis, so a share of what reaches the inbox is reclassified afterwards; retroactive scanning and automatic retraction of delivered mail are part of the control, not an add-on. The residual cases are not a filtering problem at all: a message sent from a domain the attacker owns passes SPF, DKIM and DMARC by design, so any change of bank details has to be verified on a second channel. That rule belongs to finance, and it is the one that actually stops the loss.
TLS fingerprinting identifies the software behind a connection from the choices it makes when opening a session: which cipher suites it offers and in which order, which extensions, which elliptic curves. Different clients build that first message differently, so the pattern often names the client even though the traffic itself is encrypted.
Not to be confused with
Device fingerprinting : collects browser environment attributes such as screen size and installed fonts, after the connection is established.
IP reputation : judges the source address and its history, not the client software.
JA3 and JA4 : two ways of condensing the handshake into a short hash. JA4 is the more recent, and reads different fields: TLS version, whether a server name is present, the number of cipher suites and extensions, and the negotiated ALPN.
How Cloudflare implements it
Cloudflare computes JA3 and JA4 at the edge and exposes both as request fields, available in Bot Analytics, Security Events, the GraphQL analytics API and logs, and usable in WAF custom rules, transform rules and Workers. Bot Management uses the mismatch between a declared user agent and the observed handshake as one of its signals.
What running it demands
The fingerprint is stable until the client updates, and a browser release shifts the pattern for a large share of legitimate traffic on the same day, so a rule that blocks on fingerprint alone ages badly. Its real value runs the other way: it is the fastest lever available when bot scoring gets a specific client wrong, because a skip rule on a known JA3 or JA4 restores a mobile application or a partner integration in minutes, where retuning the score does not. Mobile applications are the clean case, since they usually produce one fingerprint across the whole install base.
A virtual private network creates an encrypted tunnel between a remote device and a private network across the public internet. It extends the network perimeter to the client, which is its defining property and its limitation: once authenticated, the user is on a network segment rather than in front of a named application.
Not to be confused with
ZTNA : grants access to one application after verification, where a VPN places the device on a network segment.
TLS or HTTPS : encrypts one application's traffic end to end, where a VPN encrypts everything at the network layer.
SD-WAN : connects sites to each other, where a client VPN connects individual people to a site.
How Cloudflare implements it
Cloudflare does not sell a VPN. Access and the WARP client together replace the concentrator: WARP carries the device's traffic to Cloudflare, Access decides per application, and Cloudflare Tunnel lets the origin serve without an inbound port open.
What running it demands
The VPN is rarely decommissioned on the date the business case assumed, and the reason is always the same: the last five percent of applications, the ones that speak no modern authentication, plus the third parties nobody has a contact for. Every month it stays up costs the licence and keeps the segment reachable. Inventory that tail before writing the migration plan, because it is what sets the end date, not the number of users moved.
Web application and API protection is the market category grouping the controls that defend web applications and APIs against attacks at the application layer: web application firewall, bot management, application-layer denial of service protection, and API-specific security. Its defining feature is that these are operated together rather than as separate products.
API gateway : routes and meters API calls; it is not a security control against exploitation.
API security : discovery, schema validation and abuse detection on APIs specifically, which WAAP includes alongside protection for traditional applications.
How Cloudflare implements it
Cloudflare does not sell a product called WAAP; it groups these under application security. The components are WAF, Bot Management, API Shield for schema validation, endpoint discovery and mutual TLS, and application-layer DDoS Protection, all configured on the same network.
A web application firewall inspects HTTP requests addressed to an application and blocks those matching a known attack pattern, such as SQL injection or cross-site scripting. It reads the content of the request, its parameters, headers and body, which is what a network firewall does not do.
Not to be confused with
Network firewall : filters on addresses, ports and protocols at layers 3 and 4.
Bot mitigation : qualifies the sender, whereas the WAF examines the request.
API gateway : routes, authenticates and meters API calls; the WAF inspects them for exploitation.
How Cloudflare implements it
Cloudflare WAF combines managed rulesets, including the OWASP set, with custom rules and a machine learning score for attacks no signature covers. Rate Limiting, Page Shield, leaked credentials detection and sensitive data detection are capabilities of the same suite rather than separate products.
Whaling is spear phishing aimed at the top of an organisation: chief executives, finance directors, board members. The target is chosen for what their approval unlocks, which is why the message usually asks for an authorisation or a confidential exception rather than for credentials.
Not to be confused with
Phishing : sent broadly, with no particular recipient in mind.
Spear phishing : targeted at a named person of any seniority; whaling narrows that to the leadership.
Cloudflare Email Security scores sender relationship history, domain similarity and display name mismatch, and treats the absence of any attachment or link as a signal in itself, since these messages usually carry neither. Dispositions drive automatic moves, including on mail already delivered.
Zero trust is a security principle: no user, device or request is trusted because of where it comes from, and every access decision is made explicitly, on current evidence, and re-made rather than inherited. It replaces the assumption that the inside of a network is safe.
Not to be confused with
Perimeter security : the model it replaces, in which crossing the boundary once confers trust afterwards.
ZTNA : one technology that applies the principle to private applications, not the principle itself.
Multi-factor authentication : one of the evidences an access decision uses, at one moment in time.
How Cloudflare implements it
Cloudflare One carries the enforcement points on one network: Access for private applications, Gateway for internet and SaaS traffic, Cloudflare CASB for what is stored in SaaS tenants, with Browser Isolation and DLP alongside.
Zero trust network access grants a user access to one named application after verifying identity, device state and context, and re-checks during the session. The application is not published on a network the user joins: the access path is built per application, so what is not authorised is not reachable and not visible.
Not to be confused with
VPN : places the device on a network segment, where ZTNA connects it to a single application.
Zero trust : the principle; ZTNA is one of the technologies that applies it, to private applications.
Network access control : governs admission to a physical network port, not access to an application.
How Cloudflare implements it
Cloudflare Access is the ZTNA component of Cloudflare One. It checks identity through the customer's provider, device posture through WARP, and context, then brokers the connection. Cloudflare Tunnel exposes the application to Cloudflare without an inbound port on the origin.