SECURITY ATLAS / EVALUATION BRIEF
Cloudflare One: Access and Gateway
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/cloudflare-one-access/

THE ATLAS TAKE
Cloudflare Access and Gateway are compelling building blocks for teams that want application access and internet filtering with inspectable documentation. The architecture is approachable, but the control path is still assembled: identity, device client, private connectivity and TLS trust must line up. Atlas would evaluate the platform through explicit allow and deny decisions, then test what happens when posture or identity changes. An Access login proves only one part of the design. Gateway HTTP inspection and its exclusions must be demonstrated separately for the traffic that matters.

SCOPE
The scored scope is Access plus Gateway HTTP filtering with the required client, tunnel and TLS trust configuration. DLP, browser isolation, CASB API scanning and WAN services are excluded from the selected baseline.

WORTH A LOOK WHEN
Teams comfortable assembling documented identity, endpoint and application connectivity controls.

THINK TWICE WHEN
The requirement depends on inspecting traffic without the necessary routing or TLS trust deployment.

IMPLEMENTATION
1. Choose a narrow application boundary
Map one service, its authentication redirects and required client or tunnel path before expanding access.

2. Deploy trust carefully
Pilot certificate and client configuration on representative devices and document applications that require exceptions.

3. Correlate the two log paths
Give support staff a repeatable way to connect identity events with traffic-policy outcomes and downstream application logs.

OPERATING REALITY
Application definitions, Access policies and Gateway rules need named owners. Endpoint trust and client configuration must remain healthy as devices move between networks. Troubleshooting should start with the actual route and policy match, while sensitive inspection logs require deliberate administrator access and retention choices.

COMMERCIAL CONSIDERATIONS
Compare the selected Cloudflare One plan against required users, logs and controls. Treat DLP, isolation, SaaS scanning and WAN scope as explicit commercial questions rather than baseline assumptions.
- User count and selected service plan
- Required logs, retention and export
- Client, certificate and private-connectivity operations

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Allow one application and deny an adjacent route
Acceptance evidence: Keep Access decisions and destination-side evidence.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Test a harmless HTTP policy trigger
Acceptance evidence: Verify TLS inspection, rule match and a meaningful user result.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Change a test user or posture condition
Acceptance evidence: Record when new and existing access reflect the change.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Which client mode and split-tunnel rules apply to this resource?
- Is HTTPS decrypted, bypassed or unsupported on this path?
- What log retention and export entitlements meet the investigation requirement?

EVIDENCE GAPS
- Atlas has not measured inspection efficacy, global performance or session-change timing.
- Confirm plan-specific logs, posture integrations and client/platform support.

SOURCES
Access policies (Product information)
https://developers.cloudflare.com/cloudflare-one/access-controls/policies/
HTTP policies and TLS requirements (Product information)
https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/
Zero Trust logs (Product information)
https://developers.cloudflare.com/cloudflare-one/insights/logs/

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.