Horizon Inc Cloudflare One demo

Demo library › Path

The full tour

Every chapter, in order. For a workshop rather than a meeting.

~63 minutes · needs the lab - at least one chapter reaches the private estate

  1. Who are our people, and what are they allowed to reach? One sign-in, groups that come from the identity provider rather than being typed into Cloudflare, and an application that simply does not exist for someone not entitled to it. · ~4 min · Lab and laptop
  2. Retire the VPN concentrator. An internal ticketing app on a server with no open ports, reached by name through the Cloudflare One client - and with the client off, the address does not answer at all. · ~8 min · Lab only
  3. Admins reach servers without standing credentials. SSH to the apps server with a certificate Cloudflare issues for the session - no key on the laptop, no password on the account - and the database console behind the same group. · ~10 min · Lab only
  4. Contractors get access; they do not get a laptop. A contractor signs in from her own machine, with no client, and uses the wiki in a remote browser with copy, paste, download and print turned off. · ~5 min · Lab and laptop
  5. Filter the internet for an office with no appliance. A DNS location for the London office, security and content categories, social media kept to lunch, and the same policy on every laptop. · ~5 min · Lab and laptop
  6. Stop company data leaving through the browser. A customer list blocked on its way to personal storage, the same profiles catching card numbers and passwords inside an internal app, malware stopped on download, and the matched value decrypted from the log. · ~8 min · Lab and laptop
  7. Only healthy, managed devices reach production. pgAdmin requires a device with its firewall on; switch it off and access ends, with the failing check in the log. And Backlog's experience measured from every device. · ~5 min · Lab and laptop
  8. Our staff are pasting customer data into ChatGPT. What the company has decided about each AI service, enforced: the sanctioned one inspected, the one under review isolated, the rest redirected to a page naming the two approved paths. · ~6 min · Lab and laptop
  9. Our AI agent reaches what the person driving it cannot. An agent with MCP tools across five internal apps, and the controls in the data path that stop it handing back what its user could never see in the web UI. · ~7 min · Lab and laptop
  10. Show the auditor what happened. Every decision from the earlier chapters, in the logs that recorded it - including the exact matched value and the full prompt, decrypted with a key Cloudflare does not hold. · ~5 min · Lab and laptop