Horizon Inc Cloudflare One demo

Demo library

Ten chapters, each one a problem Horizon Inc has and the part of Cloudflare One that solves it. Each stands alone, and the named paths below string them into a demo for a particular room.

Where to start

Twenty-five minutes, a general audience: the whole of Cloudflare One.

A specific question: pick the chapter that answers it. Every chapter page says what it needs before you start, and which part of it is not built yet.

Paths

The whole of Cloudflare One

The overall demo: identity, retiring the VPN, data protection, AI, and the evidence afterwards - one company, one afternoon.

  1. 1. Identity and per-application access
  2. 2. VPN replacement for an internal app
  3. 6. DLP on uploads and on internal apps Planned
  4. 8. Shadow AI, and the sanctioned path
  5. 10. Evidence: logs, decrypted payloads, prompts

~31 min · needs the lab · 1 chapter not built yet

Replace the VPN

For a room that runs a VPN concentrator and is tired of it.

  1. 1. Identity and per-application access
  2. 2. VPN replacement for an internal app
  3. 3. Privileged SSH and database access
  4. 7. Device posture for sensitive applications Planned

~24 min · needs the lab · 1 chapter not built yet

Secure web gateway and data protection

For a room whose question is what leaves the building, and how.

  1. 5. DNS filtering for office networks Planned
  2. 6. DLP on uploads and on internal apps Planned
  3. 4. Clientless isolated access for contractors Planned

~18 min · lab or laptop · 3 chapters not built yet

AI security

For a room whose staff and agents are already using AI, sanctioned or not.

  1. 8. Shadow AI, and the sanctioned path
  2. 9. Securing MCP and agent access
  3. 10. Evidence: logs, decrypted payloads, prompts

~18 min · lab or laptop · all ready

The full tour

Every chapter, in order. For a workshop rather than a meeting.

  1. 1. Identity and per-application access
  2. 2. VPN replacement for an internal app
  3. 3. Privileged SSH and database access
  4. 4. Clientless isolated access for contractors Planned
  5. 5. DNS filtering for office networks Planned
  6. 6. DLP on uploads and on internal apps Planned
  7. 7. Device posture for sensitive applications Planned
  8. 8. Shadow AI, and the sanctioned path
  9. 9. Securing MCP and agent access
  10. 10. Evidence: logs, decrypted payloads, prompts

~60 min · needs the lab · 4 chapters not built yet

Chapters

6 of 10 can be run today. Planned chapters are listed so the shape of the library is visible; they have no script yet. See coverage for every capability and where it is shown.

#ChapterProvesStatus
1 Who are our people, and what are they allowed to reach?One sign-in, groups that come from the identity provider rather than being typed into Cloudflare, and an application that simply does not exist for someone not entitled to it. Access, FlareID (OIDC + SCIM), App Launcher, Access audit log Ready Lab and laptop · ~4 min
2 Retire the VPN concentrator.An internal ticketing app on a server with no open ports, reached by name through the Cloudflare One client - and with the client off, the address does not answer at all. Cloudflare Tunnel, Private network routes, Split tunnels, Internal DNS, Resolver policies, Access Ready Lab only · ~8 min
3 Admins reach servers without standing credentials.SSH to the apps server with a certificate Cloudflare issues for the session - no key on the laptop, no password on the account - and the database console behind the same group. Access for Infrastructure, SSH certificate authority, Access for SaaS (OIDC), Private network routes Ready Lab only · ~7 min
4 Contractors get access; they do not get a laptop.A contractor signs in with a one-time PIN to a real external address and uses the wiki in a remote browser, with copy, paste, download and print turned off. Clientless Browser Isolation, One-time PIN, Access Planned Lab and laptop · ~5 min
5 Filter the internet for an office with no appliance.DNS locations for Horizon Inc's offices, security and content categories, a business-hours schedule and a branded block page - proven with a query against the location's resolver. Gateway DNS policies, DNS locations, Block page Planned Lab and laptop · ~5 min
6 Stop company data leaving through the browser.A customer list blocked on its way to personal storage, the same profiles catching card numbers and passwords inside an internal app, and the matched value decrypted from the log. Gateway HTTP policies, DLP profiles, Payload logging, Antivirus and sandbox Planned Lab and laptop · ~8 min
7 Only healthy, managed devices reach production.The database console requires a device that passes posture; break one check and access ends, with the audit log naming the check that failed. Device posture, Device profiles, DEX Planned Lab and laptop · ~5 min
8 Our staff are pasting customer data into ChatGPT.What the company has decided about each AI service, enforced: the sanctioned one inspected, the one under review isolated, the rest redirected to a page naming the two approved paths. Application Library, Gateway HTTP policies, Browser Isolation, AI prompt logging Ready Lab and laptop · ~6 min
9 Our AI agent reaches what the person driving it cannot.An agent with MCP tools across five internal apps, and the controls in the data path that stop it handing back what its user could never see in the web UI. MCP server portal, Access, Gateway DLP on MCP traffic, AI Gateway Ready Lab and laptop · ~7 min
10 Show the auditor what happened.Every decision from the earlier chapters, in the logs that recorded it - including the exact matched value and the full prompt, decrypted with a key Cloudflare does not hold. Access audit log, Gateway activity log, Payload and prompt logs Partial Lab and laptop · ~5 min

Before any of them