SME Cyber Bundle

Technical Deep-Dive — Application Security & Cloudflare One
Ozzie Khawaja
Senior Partner Solutions Engineer · Sub Saharan Africa
1
Part 1 of 4
The Threat Landscape
Why SMEs face enterprise-grade threats — and need enterprise-grade protection.
THREAT INTELLIGENCE

SMEs Face Identical Threat Actors as Global Enterprises

In 2025 Cloudflare absorbed the largest attacks ever recorded — all mitigated inline, with zero customer impact.

230B+
Threats / day
cyber threats Cloudflare blocks every single day.
31.4 Tbps
Largest DDoS ever
absorbed inline in Nov 2025 — zero billing impact.
14.1B pps
Packet-rate record
Oct 2025 — mitigated across the Anycast edge.
THE CHALLENGE

Fragmented Point Tools vs. the SME Cyber Bundle

THE OLD WAY
Fragmented Point Solutions
Silos
Separate WAF, DDoS scrubbing and CDN — three dashboards, three contracts, three vendors.
Legacy access
VPN hardware + standalone SWG — no shared context, full lateral-movement risk.
Latency
Traffic hairpins through multiple hops — cumulative latency, cascading failure.
Blind spots
Rate limiting siloed per product — an attacker mapping the WAF isn't blocked by the CDN.
ONE PLATFORM
Cloudflare SME Cyber Bundle
Unified
L7 DDoS, WAF + Rate Limiting, CDN + LB — one dashboard, one policy engine, one contract.
Zero Trust
Access (ZTNA) + Gateway (SWG) replace VPN with per-app Zero Trust on the same network.
Local
Single-pass inspection on every PoP in 337+ cities — zero backhauling.
Shared intel
A blocked attacker in WAF is immediately blocked in Gateway DNS.
2
Part 2 of 4
Application Security
L7 DDoS Protection · WAF + Advanced Rate Limiting · CDN + Load Balancing.
SME CYBER BUNDLE

Five Components. One Platform. One Control Plane.

ALWAYS-ON
L7 DDoS Protection
Automatic unmetered L3/L4/L7 mitigation via Anycast. 31.4 Tbps absorbed inline, zero overage billing.
APP LAYER
WAF
Managed Rules, OWASP CRS, ML Attack Score (1-99) on every request. Virtual patching in minutes.
ABUSE PREVENTION
Adv. Rate Limiting
Count on any HTTP field: API key, session, ASN. Stops credential stuffing and low-volume DDoS.
PERFORMANCE
CDN + Load Balancing
Tiered Cache at 337+ PoPs. Argo Smart Routing (~30% faster). Health-aware failover < 30s.
ZERO TRUST
Access (ZTNA)
cloudflared outbound-only tunnel. Per-app identity + posture. Browser SSH/RDP. Replaces VPN.
SECURE WEB
Gateway (SWG)
DNS filtering + HTTP/S inspection + inline DLP. Blocks C2 before TCP connects. No agent for office DNS.
APP SECURITY · L7 DDOS

Layer 7 DDoS: Automatic, Unmetered, Adaptive on Every PoP

ALWAYS-ON
Zero configuration
HTTP DDoS managed ruleset always active. Mitigation fires in 3-10s — no tuning, no ticket.
NO OVERAGE
Unmetered
The Nov 2025 record used only ~6% of the 500+ Tbps network. Never metered, no per-GB charges.
PER-ZONE ML
Adaptive baselines
24-hour rolling baseline per zone. Triggers on deviation from YOUR traffic — no flash-sale false positives.
NETWORK LAYER
Anycast absorption
Absorbed across 337+ PoPs. Never concentrated at one scrubbing centre. 14.1B pps record, zero impact.
APP SECURITY · WAF + RATE LIMITING

One Rule Engine, Complete Protection

ZERO MAINTENANCE
Three managed rulesets
Managed Rules cover active CVEs. OWASP CRS v3.3 (SQLi/XSS/LFI/RFI/RCE). Exposed Credentials Check. All continuous.
cf.waf.score
ML Attack Score
Composite 1-99 plus sqli/xss/rce sub-scores — three independent models trained on ~20% of global web traffic.
WIREFILTER
Custom rules
Match URI, headers, JA3/JA4, ASN, country, threat score. Virtual patching neutralises zero-days in minutes.
ANY FIELD
Advanced Rate Limiting
Count per API key, session cookie or ASN — not just IP. Period 10-3600s. Stops brute force and abuse.
APP SECURITY · CDN + LOAD BALANCING

Performance and Availability as Security Controls

ORIGIN PROTECTION
Tiered Cache
Two-tier topology adds 30-40% hit rate. Cached content absorbs DDoS volume before it reaches your server.
~30% FASTER
Argo Smart Routing
Real-time RTT across 400+ transit networks routes each request via the fastest path — highest gains in Africa.
< 30s FAILOVER
Load Balancing
Health monitors + steering (latency, geo, proximity). Internal failover — no DNS TTL wait.
RESILIENCE
Always Online
Serves last-cached version on origin 5xx or outage. Session affinity via CF-LB cookie or IP hash.
3
Part 3 of 4
Cloudflare One
Cloudflare Access (ZTNA) · Cloudflare Gateway (SWG) · DNS Filtering.
CLOUDFLARE ONE · ACCESS (ZTNA)

Per-Application Zero Trust Replacing VPN

OUTBOUND ONLY
cloudflared tunnel
Outbound QUIC on 443 — origin needs no public IP, no inbound ports. One tunnel, many services via ingress.
EVERY REQUEST
Identity + posture
Combines IdP identity, group membership, device posture (OS, disk encryption, EDR) and network context.
VERIFIABLE
JWT assertion
CF-Access-JWT-Assertion carries user, groups, aud and posture. Origin validates via team-domain public keys.
CLIENTLESS
Browser SSH/RDP
SSH, RDP, VNC, kubectl in the browser. Short-lived certs, full keystroke audit — zero agent for contractors.
CLOUDFLARE ONE · GATEWAY (SWG)

DNS Filtering and Secure Web Gateway for Every User

DNS LAYER
DNS filtering
Blocks malware, phishing, ransomware C2 and shadow SaaS at resolution — before any TCP connection. No agent for office.
TLS DECRYPT
HTTP/S inspection
Teams root cert via MDM. Wirefilter policies block by URL, IP, app category, MIME type or custom expression.
DATA PROTECTION
Inline DLP
Detectors for cards, SSNs, passports, IBANs, AWS keys, TLS keys. Custom regex + Exact Data Match fingerprints.
ONE IDENTITY
Unified with Access
Shares IdP groups + device posture with Access — contractors get different internet policy from finance automatically.
4
Part 4 of 4
The Cloudflare Platform
All five components on the same global network — one PoP, one pipeline, one policy.
PLATFORM

Cloudflare Global Network: One Control Plane

337+
cities in 125+ countries — security decision local to every user for App Sec and CF One.
500+ Tbps
network capacity — the 31.4 Tbps record DDoS was just ~6% of available bandwidth.
230B+
cyber threats blocked every day from ~20% visibility into global web traffic.
93M+
HTTP requests/sec on average — WAF, DDoS and Rate Limiting inline simultaneously.
50ms
added latency for WARP + Gateway users — Zero Trust with no VPN performance tax.
10,000+
direct peering connections — fewer public-internet hops between users and origin.
PLATFORM · GLOBAL NETWORK

Cloudflare PoPs — Global, African, and In-Country

Click World / Africa / Nigeria to zoom — 337+ cities, 31 Africa PoPs, and PoPs in-country.

Nigeria PoPs

Lagos
LOS · West Africa hub · IXPN peer
Abuja
ABV · Federal capital territory
Port Harcourt
PHC · South-South Nigeria
31 Africa PoPs · 22 countries
337+
cities
125+
countries
31
Africa PoPs
3
Nigeria PoPs
DEPLOYMENT · PHASE 1

SME Cyber Bundle: Network Architecture & Flow

Customer DNS on-ramps to Cloudflare; every request is inspected in a single pass at the nearest PoP — no backhaul.

Service Provider
Customers
SP points customer DNS to Cloudflare
Customer must have a static IP
Service Provider
Network
On-ramp to the Cloudflare network
No DNS resolution here
Global Edge
Cloudflare Integrated Security
L7 DDoS Protection
Always-on Anycast mitigation
WAF + Rate Limiting
Managed rules + ML attack score
CDN + Load Balancing
Cache, Argo, health failover
Access (ZTNA)
Per-application Zero Trust
Gateway (SWG)
DNS + web filtering + inline DLP
Dedicated CF account inside the MTN tenant
Animated: solid packet = customer request · faded packet = inspected response — App Services + Zero Trust on one network.
WHY CLOUDFLARE

The SME Cyber Bundle — Why Cloudflare

1
31.4 Tbps
Largest DDoS ever mitigated (Nov 2025). Multi-vector attack absorbed inline in ~65 seconds — zero intervention, zero overage, zero downtime.
2
337+ cities
App Sec and Zero Trust on the same network. One PoP handles WAF, DDoS, Gateway and Access policy for every user in every location.
3
3 seconds
Average detection-to-mitigation for L7 DDoS. Rules generated programmatically in real time — impossible for scrubbing-centre approaches.
Thank You

Thank you for your
time & attention.

We welcome your questions on any aspect of the Cloudflare SME Cyber Bundle.
Q & AOzzie Khawaja — Sub Saharan Africa
PPowerPoint (.pptx)Pixel-perfect, editable in PowerPoint & Keynote
Slides render as high-res images — nothing reflows. Animated slides show a single frame.