The Cloudflare question is not who is on a partner list. It is who will change a WAF rule at 2am when a customer-facing app is under attack.
A listing does not tune bots when a campaign spikes, roll DNS when you move an origin, or lead a Cloudflare incident on a Sunday night. That work needs a named operator.
Procurement signs a licence. Someone does a go-live. A few months later the WAF is still on default rules, bot management is half-on, and nobody can say who owns the account. You have a licence, not an operator.
Start with the surfaces, not the logo
Do not start with a SKU, and do not start with a directory. Start with what you are actually putting on Cloudflare.
For most of the teams we work with, that list is short. The public website and the apps behind it. The APIs customers hit. Onboarding. Staff access: Zero Trust, and who can reach what.
Each of those has a different risk. If the marketing site and a production API sit in the same project with nobody named on the account, the licence looks complete and the perimeter is not. Scope first, then decide who runs it. If you are still choosing the edge, start with Cloudflare vs Akamai or Cloudflare vs Imperva. What managed looks like after go-live is on What is Managed Cloudflare.
Who changes the rules, and who is on the hook at 2am
WAF rules change when you ship a feature. Bot settings change when a campaign spikes traffic. DNS changes when you move an origin. Zero Trust changes when a vendor needs access. Incidents do not wait for the next change window.
A security lead is usually already covering identity, endpoints, vendors, and the audit calendar. Cloudflare is a full-time job if you do it properly. If the plan is that IT will cover it when they have time, be honest about whether that time exists.
We operate Cloudflare for the teams we work with. We size it, deploy it, and stay on the account after go-live. How that works, without repeating the Learn page, is on who operates Cloudflare after go-live.
What you are actually choosing
You are choosing an operator, not a listing. Core from $3,500 a month is business-hours governance, if you already have people in hours and the work is not 24/7. Priority from $7,500 a month is 24/7 operations and active mitigation. Critical from $15,000 a month is immediate escalation and senior incident leadership. Those are public starting prices on Managed Cloudflare. Response clocks sit on the SLA.
Core is not a discount SKU. If the site is customer-facing and you need someone at 2am, you are not on Core.
Ask how you get out. If the operator is not running the account, you should be able to leave.
Before you hand someone the account
Walk these with IT, security, and procurement in the same room. What is in scope: public apps, APIs, onboarding, staff access? Who changes WAF, bots, DNS, and Zero Trust after go-live, and is that a named team or a mailbox? Who owns a Cloudflare incident on a Sunday night? How do changes fit change control, including emergency change? What will you show internal audit: configuration, change history, incident notes, not a slide about a partnership?
If the question is an operator versus a SIEM dashboard, Vigilbase vs Splunk is the cut. If you are already under attack and not on Cloudflare, start with emergency onboarding.
If you cannot answer those questions, you are not ready to hand someone the account.
If you want an operator who will size the account, deploy it against the surfaces that matter, and run WAF, bots, DNS, and Zero Trust after go-live, talk to us.
