Cloudflare One is Cloudflare's secure access service edge (SASE) platform. SASE unifies enterprise networking with Zero Trust security: every request is authenticated and authorized based on identity and context before access is granted, and security and networking are managed through one control plane.
Security service edge (SSE), the security part of SASE, has three core components: Zero Trust network access, a secure web gateway and a cloud access security broker. In Cloudflare One these are Access, Gateway and CASB, and the platform adds remote browser isolation, data loss prevention, email security and digital experience monitoring.
Access is deny by default, but Gateway allows traffic that matches no policy. Getting both right, and keeping them right as staff, vendors and applications change, is ongoing work rather than a one-time deployment.
Access acts as an identity-aware proxy in front of your applications. It works with any SAML or OIDC identity provider, several at once. Bypass and Service Auth policies are evaluated first, and the first Allow or Block match decides the outcome.
The cloudflared connector creates outbound-only connections from your infrastructure to Cloudflare, so the firewall in front of your applications can block all inbound traffic.
Gateway inspects and filters user traffic at the DNS, network and HTTP layers. HTTPS inspection needs a Cloudflare root certificate on each device, and a policy change can take up to 60 seconds to reach every data center.
The Cloudflare One Client, formerly WARP, sends device traffic to Cloudflare and reports device health such as OS version and disk encryption. Posture checks limit access to managed or healthy devices.
Cloudflare's CASB connects to SaaS and cloud APIs with read-only permissions and scans for misconfigurations and other security issues that can occur after a user has signed in.
DLP scans HTTP traffic, SaaS application files and AI prompts for sensitive data, and needs TLS decryption to read web traffic. Browser Isolation runs active web content in a remote browser instead of on the device.
| Plan | What it includes |
|---|---|
| Free | Up to 50 users. CASB with up to 2 read-only API integrations, limited predefined DLP profiles, 24 hours of log retention and up to 3 office locations. No uptime SLA. |
| Pay-as-you-go | For teams over 50 users with narrower SSE needs. The same CASB and DLP limits as Free, 30 days of log retention, up to 50 locations, an uptime SLA and Browser Isolation as an add-on. |
| Contract | For a full SASE or workspace security deployment: 6 months of log retention, up to 250 locations, mTLS authentication, PAC-file proxy endpoints and Logpush to a SIEM or cloud storage. Full DLP, Email security, Browser Isolation, dedicated egress IPs and network services are add-ons. |
Cloudflare's per-user prices and add-on terms change, so this table lists capabilities only. Vigilbase scopes Cloudflare Zero Trust licensing for the users, applications and add-ons in scope, and operates it under Managed Cloudflare.
Cloudflare Zero Trust pricing →We start with an inventory of internal applications, identities and devices, then agree access policy, approval contacts and a way to verify intended access before rollout.
We confirm the provider configuration, group claims and MFA policy, then test the actual user journeys before rollout.
The right design depends on the application protocol, connectivity and client requirements. We validate the intended access paths and plan the cutover with access tests and a rollback path.
Each policy gets an owner and a review path. We verify that intended staff and vendor access works and that access outside the agreed policy is denied.
Zero Trust changes when a vendor needs access, a team reorganizes or an application moves. We test onboarding, access removal and emergency access against the agreed policy.
Core is business-hours governance and change management, with best-effort response. Priority adds 24/7 operations, active threat mitigation within the SLA and a named technical account manager. Critical adds immediate escalation and senior incident leadership.
Cloudflare warns that some common Allow rules let anyone reach an application, and that Bypass policies enforce no Access controls and are not logged. We review policy rules and test Bypass policies before they reach production.
Gateway allows traffic that matches no policy, and a Do Not Inspect policy skips every remaining HTTP policy. We check policy order and confirm Gateway is receiving traffic from your devices before relying on it.
An identity provider, group claim or device posture change can block the people who need access. Cloudflare advises checking posture results before enforcing them; we test the real user journeys and keep a rollback path.
For SaaS applications, Access enforces policy at sign-on and when the session is reissued, and Gateway does not end an active session when a later posture check fails. We plan access removal with that in mind.
Access can replace some VPN access patterns, but the right design depends on the protocol, connectivity and client. We plan the cutover around the applications and users in scope.
Internal access and Zero Trust →Vigilbase OS
Vigilbase OS, the cybersecurity operating system, connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place. Its native Cloudflare integration puts your Cloudflare events next to those tools, and the Vigil agent investigates high-severity incidents while Vigilbase analysts handle exceptions.
Cloudflare is the provider where live response actions run today. You choose the autonomy: keep actions off, propose them for approval, or allow low-risk, reversible actions to run. The record shows the investigation, the actions taken and the verification. For providers without live actions, the investigation returns the steps for your team to complete.
Get started with Vigilbase OSCloudflare Zero Trust is the security side of Cloudflare One, Cloudflare's SASE platform. It authenticates and authorizes every request based on identity and context before granting access, with Access for applications, Gateway for user traffic, Tunnel for private networks and the Cloudflare One Client for devices.Zero Trust principles and access controlsInternal access and Zero Trust
Cloudflare One is the platform: Cloudflare's SASE offering, which unifies networking with Zero Trust security. Cloudflare Zero Trust usually refers to the security services in it, such as Access, Gateway, CASB, DLP and Browser Isolation, and to the Zero Trust plans that license them.SASE architecture explainedInternal access and Zero Trust
Cloudflare's Free plan covers up to 50 users. Pay-as-you-go is priced per user per month, and Contract plans have an annual custom price per user. Add-ons such as Browser Isolation, full DLP and Email security cost extra.Internal access and Zero TrustCloudflare Enterprise licensing explained
Cloudflare's CASB connects to SaaS and cloud environment APIs with read-only, least-privilege permissions and scans for misconfigurations and other security issues. Free and Pay-as-you-go plans allow up to two CASB integrations.SASE architecture explained
It can replace some VPN access patterns. Access applies policies to individual applications using identity and, where configured, device posture, and Tunnel connects private applications without inbound connections. The right design depends on the application protocol, connectivity and client requirements.Zero Trust network access explainedInternal access and Zero Trust
Vigilbase sells the Cloudflare licence, deploys Cloudflare Zero Trust and runs it through Managed Cloudflare: identity integration, policy design and tuning, access testing and change control. Core, Priority and Critical set the coverage and escalation path.Compare Core, Priority and CriticalInternal access and Zero Trust
Cloudflare Zero Trust and Cloudflare One details on this page are summarized from Cloudflare's documentation and plans page. Plans, limits and add-ons change, so confirm current terms with Cloudflare or with us before you buy.
Vendor sources checked
Tell us which applications, identity providers and devices are in scope. We will scope the Zero Trust licence, the rollout and the operating coverage together.
