Cloudflare One is Cloudflare's agile SASE (Secure Access Service Edge) platform — a unified, composable, and programmable solution that replaces legacy security and networking architectures with a single control plane, data plane, and infrastructure layer atop the world's connectivity cloud.
Purpose
Enable organizations to securely connect their workforce, AI agents, and infrastructure across remote locations, branch offices, data centers, and cloud environments — without the complexity of legacy VPNs, MPLS circuits, or point products.
Key capabilities
- Zero Trust Access (ZTNA) — Identity-first, quantum-safe access to internal apps with granular least-privilege rules, eliminating VPNs.
- Secure Web Gateway (SWG) — DNS, HTTP, and network filtering to block malware, phishing, and risky domains.
- Cloud Access Security Broker (CASB) — Discover shadow IT, detect misconfigurations, and protect data at rest in SaaS applications.
- Data Loss Prevention (DLP) — Scan traffic and SaaS apps for sensitive data including PII, financial information, and source code secrets.
- Remote Browser Isolation (RBI) — Execute browser code in the cloud to safely access high-risk websites.
- AI Security — First SASE platform to secure Model Context Protocol (MCP) server connections, with deep visibility into GenAI usage.
- Email Security — AI-powered defense against phishing, business email compromise, and malware.
- Network-as-a-Service (NaaS) — Connect branches, data centers, and clouds over Cloudflare's private global backbone with post-quantum encryption.
Main use cases
Safe AI adoption, deprecating traditional VPNs with modern remote access, branch office networking without MPLS, phishing and email protection, and consistent security for distributed and hybrid workforces.
Pros
- Converges ZTNA, SWG, CASB, DLP, RBI, email security, and network services into a single SASE control plane, reducing multi-vendor complexity.
- Offers a composable, programmable SASE architecture with comprehensive APIs and first-class Terraform provider for infrastructure-as-code management.
- Supports concurrent authentication via any SAML 2.0 or OIDC-compliant identity provider, including social IdPs for contractor and vendor access without issuing corporate credentials.
- Replaces traditional VPNs with identity- and context-based per-application access, as demonstrated by Delivery Hero's deployment securing 40,000 employees and reducing bandwidth costs by 90%.
- Cloudflare Tunnel connects private resources via outbound-only connections, completely eliminating the need to expose public IP addresses.
- Global anycast network spans 300+ cities worldwide, placing security enforcement within 50ms of 95% of internet-connected users.
Cons
- Log retention is capped at 24 hours on the entry-level tier and 30 days on the standard tier, insufficient for long-term compliance without external SIEM export.
- Support responsiveness is inconsistent, with entry-tier users limited to community forums and paid-tier response times drawing user complaints.
- Inline CASB, DLP, and threat intelligence capabilities are less mature than those offered by established pure-play SASE competitors like Zscaler and Netskope.
- Documentation and training materials are insufficient, with multiple reviewers reporting lengthy and complex implementation timelines.
- Full DLP with custom profiles, OCR, and custom datasets is unavailable on self-service tiers, requiring a contract upgrade to access.